joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180026e58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 4
jb 0x180026e80
mov rax, qword [0x1800880e0]
and rax, r15
add rax, rax
mov rcx, qword [0x1800880c8]
mov rbx, qword [rcx + rax*8 + 8]
mov rbp, qword [0x1800880b8]
cmp rbx, rbp
jne 0x180026eeb
mov rbx, rbp
mov rsi, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [0x1800880c0], rax
jne 0x180026f2a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x180026efd
cmp rbx, rdx
je 0x180026f20
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x180026ef4
mov rbp, qword [rbx]
mov rsi, rbp
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x180026eca
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x18002708a
mov rbp, rbx
xor eax, eax
mov rsi, rbx
jmp 0x180026f0e
lea rax, [0x1800880b8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18006b9e4
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
and qword [rax + 0x18], 0
mov r8, qword [0x1800880c0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x180026f74
cvtsi2ss xmm0, rcx
jmp 0x180026f89
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1800880e8]
xorps xmm1, xmm1
test rcx, rcx
js 0x180026f9f
cvtsi2ss xmm1, rcx
jmp 0x180026fb4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1800880b0]
seta al
test al, al
je 0x180027021
call fcn.1800270c0
mov rcx, qword [0x1800880e0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x1800880c8]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x1800880b8]
cmp rax, rbx
je 0x18002700d
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x180027005
mov rbx, rax
cmp rax, r8
je 0x180027064
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180026ff9
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rsi, rbx
mov rbp, qword [rsp + 0x20]
mov r8, qword [0x1800880c0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1800880c0], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x1800880c8]
mov rax, qword [0x1800880e0]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1800880b8]
jne 0x18002706b
mov qword [rcx + rax*8], rdi
jmp 0x18002707d
mov qword [rsp + 0x20], rax
jmp 0x180027012
cmp r8, rsi
jne 0x180027076
mov qword [rcx + rax*8], rdi
jmp 0x180027082
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180027082
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800270c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [0x1800880c0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1800880e8]
js 0x1800270e8
cvtsi2ss xmm0, rcx
jmp 0x1800270fd
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x1800880b0]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x18007c3a0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18002712f
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18002712f
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18002715d
cmp rbx, 0x200
jae 0x18002715a
shl rbx, 3
cmp rbx, rcx
jae 0x18002715d
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
jbe 0x180027186
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [0x1800880b8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800880c8]
lea rdx, [rdi + rdi]
call fcn.180026d24
mov rax, qword [0x1800880b8]
lea r9, [rdi - 1]
mov qword [0x1800880e0], r9
mov qword [0x1800880e8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800272d4
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 4
jb 0x1800271ee
mov rdi, qword [0x1800880c8]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18002722c
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18002729a
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18002726f
mov r10, qword [r10]
cmp r10, rax
je 0x180027225
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180027225
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x1800272ae
cmp qword [rdi + r11*8], r10
jne 0x180027265
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800272d4
mov r9, qword [0x1800880e0]
jmp 0x1800271de
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18002729a
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1800272f0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800273ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r13, rdx
mov r12, rcx
cmp rdx, r8
je 0x18002746d
mov rax, qword [rcx + 8]
mov rdi, rdx
mov rbp, qword [rcx + 0x18]
movabs r15, 0xcbf29ce484222325
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
movabs rdx, 0x100000001b3
movzx eax, byte [rcx + r13 + 0x10]
inc rcx
xor r15, rax
imul r15, rdx
cmp rcx, 4
jb 0x180027404
and r15, qword [r12 + 0x30]
add r15, r15
mov rax, qword [rbp + r15*8]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + r15*8 + 8]
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x20
call fcn.18006ba20
dec qword [r12 + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x18002748e
cmp rdi, rsi
jne 0x180027436
cmp qword [rsp + 0x30], r13
jne 0x180027466
mov qword [rbp + r15*8], rdi
mov qword [r14], rdi
mov qword [rdi + 8], r14
lea r11, [rsp + 0x40]
mov rax, rsi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [rsp + 0x30], r13
jne 0x1800274a4
mov r13, qword [rsp + 0x20]
mov qword [rbp + r15*8], r13
mov rax, r13
jmp 0x1800274a7
mov rax, r14
mov qword [rbp + r15*8 + 8], rax
cmp rdi, rsi
je 0x180027466
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r13, 0x100000001b3
movzx eax, byte [rdi + rdx + 0x10]
inc rdx
xor rcx, rax
imul rcx, r13
cmp rdx, 4
jb 0x1800274c7
mov r15, qword [r12 + 0x30]
mov r13, qword [rsp + 0x20]
and r15, rcx
add r15, r15
mov rax, qword [rbp + r15*8 + 8]
mov qword [rsp + 0x28], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x20
call fcn.18006ba20
dec qword [r12 + 0x10]
cmp rbx, qword [rsp + 0x28]
je 0x180027520
cmp rdi, rsi
je 0x180027461
jmp 0x1800274f6
mov qword [rbp + r15*8], r13
mov qword [rbp + r15*8 + 8], r13
jmp 0x1800274ac
Function at 0x1800276d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1800276fd
mov rdx, qword [r8]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r8 + 0x10], rcx
jbe 0x18002772d
movzx eax, byte [rcx + rdx]
xor r14, rax
movabs r8, 0x100000001b3
imul r14, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x18002770f
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.180027f1c
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x180027756
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1800278ff
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
jne 0x180027774
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rbp + 8]
mov qword [rsp + 0x20], r12
and qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.18006b9e4
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.18001ffec
mov rcx, qword [rbx + 0x20]
mov qword [rdi + 0x30], rcx
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1800277bd
cvtsi2ss xmm0, rcx
jmp 0x1800277d2
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1800277e5
cvtsi2ss xmm2, rbx
jmp 0x1800277fd
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x180027898
divss xmm0, dword [rbp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x18007c3a0]
comiss xmm0, xmm1
jb 0x180027842
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180027842
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180027870
cmp rbx, 0x200
jae 0x18002786d
shl rbx, 3
cmp rbx, rcx
jae 0x180027870
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.180027998
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.180027f1c
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x30], xmm0
and qword [rsp + 0x28], 0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1800278d7
mov qword [rcx + rax*8], rdi
jmp 0x1800278e9
cmp r9, rdx
jne 0x1800278e2
mov qword [rcx + rax*8], rdi
jmp 0x1800278ee
cmp qword [rcx + rax*8 + 8], r8
jne 0x1800278ee
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
lea rcx, [rsp + 0x20]
call fcn.180027914
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180027998
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x20], rcx
mov rsi, rcx
mov r8d, 1
bsr rcx, rax
mov eax, r8d
shl rax, cl
cmp rdx, rax
jbe 0x1800279e1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, r8
lea r12, [rsi + 0x18]
bsr rcx, rax
mov rbx, r8
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.180026d24
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x180027b91
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
mov r13, qword [r15 + 0x10]
jb 0x180027a42
mov rdx, qword [r15]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
test r13, r13
je 0x180027a70
movzx eax, byte [rcx + rdx]
movabs r8, 0x100000001b3
xor r14, rax
inc rcx
imul r14, r8
cmp rcx, r13
jb 0x180027a53
and r14, qword [rsi + 0x30]
mov r12, qword [r12]
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x180027a8f
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x180027b81
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x180027aa6
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x180027ab3
mov rcx, qword [r15]
cmp r13, rax
jne 0x180027af7
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180027af7
mov r8, qword [rsi]
cmp r8, rbx
je 0x180027aed
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8 + 8], rbx
jmp 0x180027b7c
cmp qword [r12 + r14*8], rsi
je 0x180027b57
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0x10
mov rax, qword [rdx + 0x10]
jb 0x180027b13
mov rdx, qword [rdx]
cmp qword [r15 + 0x18], 0x10
mov rcx, r15
jb 0x180027b20
mov rcx, qword [r15]
cmp r13, rax
jne 0x180027af7
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180027af7
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x180027b7c
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rsi, qword [rsp + 0x20]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x180027a2a
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.180027bbc
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180027cd8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r10, rcx
cmp rdx, r8
je 0x180027e79
mov r14, qword [rcx + 0x18]
lea rax, [rcx + 8]
mov r12, qword [rdx + 8]
lea rcx, [rdx + 0x10]
cmp qword [rcx + 0x18], 0x10
mov r13, qword [rax]
mov r9, qword [rcx + 0x10]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], rdx
jb 0x180027d33
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x180027d63
movzx eax, byte [r8 + rcx]
inc r8
xor rdx, rax
imul rdx, r11
cmp r8, r9
jb 0x180027d4f
mov r15, qword [r10 + 0x30]
lea rcx, [rbp - 0x20]
and r15, rdx
add r15, r15
mov rbx, qword [r14 + r15*8]
mov rax, qword [r14 + r15*8 + 8]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x48], rax
call fcn.180027e94
mov rax, qword [rbp + 0x48]
cmp rsi, rax
je 0x180027db8
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x180027e2f
cmp rcx, rax
lea rcx, [rbp - 0x20]
sete bl
call fcn.180027e94
mov rax, qword [rbp + 0x48]
test bl, bl
je 0x180027d90
mov rbx, qword [rbp + 0x50]
cmp rbx, rsi
jne 0x180027dc4
mov qword [r14 + r15*8], r13
mov r12, r13
mov qword [r14 + r15*8 + 8], r12
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x180027e6e
mov r12, qword [rbp + 0x40]
lea rdx, [rcx + 0x10]
cmp qword [rdx + 0x18], 0x10
mov r9, qword [rdx + 0x10]
jb 0x180027dec
mov rdx, qword [rdx]
xor r8d, r8d
movabs rsi, 0xcbf29ce484222325
test r9, r9
je 0x180027e20
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + rdx]
inc r8
xor rsi, rax
imul rsi, rcx
cmp r8, r9
jb 0x180027e08
mov rcx, qword [rbp - 0x10]
and rsi, qword [r12 + 0x30]
add rsi, rsi
mov r15, qword [r14 + rsi*8 + 8]
jmp 0x180027e40
cmp qword [rbp + 0x50], rsi
jne 0x180027e6e
mov qword [r14 + r15*8], rcx
jmp 0x180027e6e
cmp rcx, rdi
je 0x180027e6a
cmp rcx, r15
lea rcx, [rbp - 0x20]
sete bl
call fcn.180027e94
mov rcx, qword [rbp - 0x10]
test bl, bl
je 0x180027e3b
mov qword [r14 + rsi*8], r13
mov qword [r14 + rsi*8 + 8], r13
cmp rcx, rdi
je 0x180027e6e
jmp 0x180027dda
mov qword [r14 + rsi*8], rcx
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x98]
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180029028
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180086020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov dword [rbp - 0x30], 0x64616f4c
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x2c], 0x7262694c
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x28], 0x41797261
mov byte [rbp - 0x24], 0
mov dword [rbp - 0x20], 0x4e52454b
mov dword [rbp - 0x1c], 0x41424c45
mov dword [rbp - 0x18], 0x642e4553
mov word [rbp - 0x14], 0x6c6c
mov byte [rbp - 0x12], 0
call fcn.1800290a8
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18006b380
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x1800290a8
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get ntdll base address

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x180086020]
xor rax, rsp
mov qword [rsp + 0x100], rax
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x64
mov rdi, rdx
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov r8, rcx
xor ecx, ecx
lea edx, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
jmp 0x18002912e
mov rcx, qword [rax + 0x60]
lea r8, [rsp + 0x30]
sub r8, rcx
movzx edx, word [rcx]
movzx r9d, word [rcx + r8]
sub edx, r9d
jne 0x180029127
add rcx, 2
test r9d, r9d
jne 0x180029111
test edx, edx
je 0x180029137
mov rax, qword [rax]
cmp qword [rax + 0x30], 0
jne 0x180029105
jmp 0x180029140
mov rax, qword [rax + 0x30]
test rax, rax
jne 0x18002914d
mov rcx, rbx
call fcn.180029028
test rax, rax
je 0x180029158
mov rdx, rdi
mov rcx, rax
call fcn.18002920c
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.18006b380
mov rbx, qword [rsp + 0x130]
add rsp, 0x110
pop rdi
ret

Function at 0x18002917c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x180087930]
xor ebp, ebp
test rax, rax
je 0x1800291f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800291f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800291f2
movzx ebx, word [rcx + 0x14]
movzx edi, bp
movzx esi, word [rcx + 6]
add rbx, 0x18
add rbx, rcx
cmp bp, si
jae 0x1800291ed
lea rdx, str..text
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x1800291ed
add rbx, 0x28
inc di
cmp di, si
jb 0x1800291ce
mov rax, rbx
jmp 0x1800291f4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18002920c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x180086020]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor r12d, r12d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x180029387
movsxd rax, dword [rcx + 0x3c]
mov r9d, dword [rax + rcx + 0x88]
mov r11d, dword [rax + rcx + 0x8c]
lea r8, [rcx + r9]
test r11d, r11d
je 0x180029387
lea r13d, [r12 + 1]
cmp rdx, 0xffff
ja 0x180029336
mov ecx, dword [r8 + 0x1c]
movzx eax, bp
sub ax, word [r8 + 0x10]
add rcx, rbx
add ax, r13w
movzx edx, ax
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180029336
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180029336
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x1800292c2
test r8, r8
je 0x180029387
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
mov edx, 0x2e
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_strchr]
lea rdi, [rax + r13]
mov byte [rax], r12b
cmp byte [rdi], 0x23
jne 0x180029307
lea rcx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
movzx edi, ax
lea rcx, [rsp + 0x20]
call fcn.180029028
mov rsi, rax
cmp rax, rbx
jne 0x180029329
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x180029387
mov rdx, rdi
mov rcx, rsi
call fcn.18002920c
jmp 0x180029389
mov ecx, dword [r8 + 0x18]
mov edi, r12d
mov r15d, dword [r8 + 0x20]
sub ecx, r13d
lea r10d, [rdi + rcx]
mov rsi, rbp
shr r10d, 1
lea rax, [r15 + r10*4]
mov edx, dword [rax + rbx]
add rdx, rbx
sub rsi, rdx
mov al, byte [rdx]
cmp al, byte [rdx + rsi]
jne 0x18002936e
add rdx, r13
test al, al
jne 0x18002935b
mov eax, r12d
jmp 0x180029373
sbb eax, eax
or eax, r13d
test eax, eax
jns 0x18002937d
lea edi, [r10 + 1]
jmp 0x180029383
jle 0x1800293b4
lea ecx, [r10 - 1]
cmp edi, ecx
jbe 0x180029344
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.18006b380
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [r8 + 0x24]
add rcx, rbx
cmp word [rcx + r10*2], r12w
je 0x180029387
movzx edx, word [rcx + r10*2]
mov ecx, dword [r8 + 0x1c]
add rcx, rbx
mov edi, dword [rcx + rdx*4]
cmp edi, r9d
jb 0x180029406
lea eax, [r9 + r11]
cmp edi, eax
jae 0x180029406
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbx + rdi]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x1800293f8
jmp 0x1800292cb
lea rax, [rbx + rdi]
jmp 0x180029389