joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f4f0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180072af0]
mov rdi, rdx
mov rsi, rcx
test rax, rax
jne 0x18000f679
movups xmm1, xmmword [0x180064e00]
movzx edx, word [0x180064e18]
mov r8, 0xffffffffffffffff
movups xmm0, xmmword [0x180064df0]
mov word [rbp + 0x47], dx
xor dl, 0x59
movups xmmword [rbp + 0x2f], xmm1
xor byte [rbp + 0x30], 0x42
xor byte [rbp + 0x31], 0x43
xor byte [rbp + 0x32], 0x44
xor byte [rbp + 0x33], 0x45
xor byte [rbp + 0x34], 0x46
xor byte [rbp + 0x35], 0x47
xor byte [rbp + 0x36], 0x48
xor byte [rbp + 0x37], 0x49
xor byte [rbp + 0x38], 0x4a
xor byte [rbp + 0x39], 0x4b
xor byte [rbp + 0x3a], 0x4c
xor byte [rbp + 0x3b], 0x4d
xor byte [rbp + 0x3c], 0x4e
xor byte [rbp + 0x3d], 0x4f
xor byte [rbp + 0x3e], 0x50
movups xmmword [rbp + 0x1f], xmm0
xor byte [rbp + 0x20], 0x32
movsd xmm0, qword [0x180064e10]
xor byte [rbp + 0x21], 0x33
xor byte [rbp + 0x22], 0x34
xor byte [rbp + 0x23], 0x35
xor byte [rbp + 0x24], 0x36
xor byte [rbp + 0x25], 0x37
xor byte [rbp + 0x26], 0x38
xor byte [rbp + 0x27], 0x39
xor byte [rbp + 0x28], 0x3a
xor byte [rbp + 0x29], 0x3b
xor byte [rbp + 0x2a], 0x3c
xor byte [rbp + 0x2b], 0x3d
xor byte [rbp + 0x2c], 0x3e
xor byte [rbp + 0x2d], 0x3f
xor byte [rbp + 0x2e], 0x40
movsd qword [rbp + 0x3f], xmm0
xorps xmm0, xmm0
xor byte [rbp + 0x3f], 0x51
xor byte [rbp + 0x40], 0x52
xor byte [rbp + 0x41], 0x53
xor byte [rbp + 0x42], 0x54
xor byte [rbp + 0x43], 0x55
xor byte [rbp + 0x44], 0x56
xor byte [rbp + 0x45], 0x57
xor byte [rbp + 0x46], 0x58
movd eax, xmm1
xorps xmm1, xmm1
mov byte [rbp + 0x1f], 0x46
mov byte [rbp + 0x47], dl
xor al, 0x41
xor byte [rbp + 0x48], 0x5a
mov byte [rbp + 0x2f], al
lea rax, [rbp + 0x1f]
movups xmmword [rbp - 1], xmm0
movdqu xmmword [rbp + 0xf], xmm1
inc r8
cmp byte [rax + r8], 0
jne 0x18000f614
lea rdx, [rbp + 0x1f]
lea rcx, [rbp - 1]
call fcn.180001670
lea rcx, [rbp - 1]
call fcn.18000c820
mov rdx, qword [rbp + 0x17]
mov qword [0x180072af0], rax
cmp rdx, 0x10
jb 0x18000f679
mov rcx, qword [rbp - 1]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000f66d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000f6e0
call fcn.180010820
mov rax, qword [0x180072af0]
xorps xmm0, xmm0
mov qword [rsp + 0xa0], rbx
movsd qword [rbp - 9], xmm0
lea r8, [rbp - 0x19]
movups xmmword [rbp - 0x19], xmm0
mov ebx, dword [rax + 0xb0]
mov rdx, rax
mov rcx, rsi
call fcn.18000f8e0
mov rax, qword [0x180072af0]
lea r11, [rsp + 0x90]
mov rsi, qword [r11 + 0x18]
mov dword [rax + 0xb0], ebx
mov rax, rdi
movups xmm0, xmmword [rbp - 0x19]
mov rbx, qword [rsp + 0xa0]
movsd xmm1, qword [rbp - 9]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.180001550
int3
Function at 0x180012310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push r13
push r14
sub rsp, 0x40
mov r14, rcx
xor ecx, ecx
call fcn.180012530
movabs rbx, 0x7ffffffdfffe
mov r13, rax
lea r8, [rax - 0x10000]
cmp r8, rbx
ja 0x18001248f
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r15
test r14, r14
je 0x180012467
mov rcx, rax
call fcn.180012960
lea rcx, [rax - 0x10000]
cmp rcx, rbx
ja 0x180012467
movzx r12d, word [rax + 0x14]
xor ebx, ebx
movzx ebp, word [rax + 6]
add r12, rax
movzx edi, bx
cmp bx, bp
jae 0x180012469
movabs rdx, 0x8de9fb9362232325
movabs r9, 0x592b55494a04faaf
nop dword [rax]
movzx eax, di
lea rcx, [rax + rax*4]
mov esi, dword [r12 + rcx*8 + 0x20]
cmp dword [r12 + rcx*8 + 0x28], esi
mov r15d, dword [r12 + rcx*8 + 0x24]
cmovb esi, dword [r12 + rcx*8 + 0x28]
test r15d, r15d
je 0x18001243e
test esi, esi
je 0x18001243e
mov rax, qword [r12 + rcx*8 + 0x18]
mov r8, rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
test al, al
je 0x1800123fa
nop dword [rax + rax]
inc r8
cmp byte [rsp + r8 + 0x20], bl
jne 0x1800123f0
lea ecx, [rax - 0x41]
cmp cl, 0x19
ja 0x180012404
add al, 0x20
test r8, r8
jne 0x18001240e
mov rax, rdx
jmp 0x180012439
movsx rcx, al
lea rdx, [rsp + 0x21]
xor rcx, r9
dec r8
mov r9b, 1
call fcn.1800120f0
movabs rdx, 0x8de9fb9362232325
movabs r9, 0x592b55494a04faaf
cmp rax, r14
je 0x18001244c
inc di
cmp di, bp
jb 0x1800123b0
jmp 0x180012469
mov r8, qword [rsp + 0x68]
lea rcx, [r15 + r13]
mov edx, esi
add rdx, r15
add rdx, r13
call fcn.1800121d0
mov rbx, rax
jmp 0x180012469
xor ebx, ebx
mov r15, qword [rsp + 0x30]
mov rax, rbx
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop r13
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop r14
pop r13
pop rbx
ret
Function at 0x180012780
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
lea rax, [rdx - 0x10000]
movabs r10, 0x7ffffffdfffe
mov rbx, rdx
mov r15, rcx
cmp rax, r10
ja 0x18001293a
xor ebp, ebp
mov eax, ebp
cmp byte [rdx], al
je 0x18001293a
inc rax
cmp byte [rax + rdx], bpl
jne 0x1800127c4
cmp rax, 1
jbe 0x18001293a
add rcx, 0xffffffffffff0000
cmp rcx, r10
ja 0x18001293a
mov ecx, 0x5a4d
cmp word [r15], cx
jne 0x18001293a
mov edx, dword [r15 + 0x3c]
add rdx, r15
cmp dword [rdx], 0x4550
jne 0x18001293a
lea rcx, [rdx - 0x10000]
cmp rcx, r10
ja 0x18001293a
lea rcx, [rdx - 0xff78]
cmp rcx, r10
ja 0x18001293a
mov edx, dword [rdx + 0x88]
add rdx, r15
lea rcx, [rdx - 0x10000]
cmp rcx, r10
ja 0x18001293a
cmp dword [rdx + 0x10], ebp
je 0x18001293a
mov ecx, dword [rdx + 0x1c]
test ecx, ecx
je 0x18001293a
mov r8d, dword [rdx + 0x20]
test r8d, r8d
je 0x18001293a
mov r9d, dword [rdx + 0x24]
test r9d, r9d
je 0x18001293a
mov r13d, dword [rdx + 0x14]
test r13d, r13d
je 0x18001293a
cmp dword [rdx + 0x18], ebp
je 0x18001293a
lea rdx, [r15 + rcx]
mov qword [rsp + 0x38], rdx
lea r14, [r15 + r8]
lea rsi, [r15 + r9]
test r13d, r13d
je 0x18001293a
movzx ecx, word [rsi]
mov r12d, dword [rdx + rcx*4]
test r12d, r12d
je 0x180012927
mov edi, dword [r14]
add rdi, r15
lea rcx, [rdi - 0x10000]
cmp rcx, r10
ja 0x180012927
test rax, rax
je 0x180012912
mov r11, rbx
sub rdi, rbx
nop dword [rax]
movzx edx, byte [r11]
movzx r10d, byte [rdi + r11]
lea r8d, [rdx - 0x41]
lea ecx, [rdx + 0x20]
cmp r8b, 0x19
movzx r9d, cl
lea r8d, [r10 - 0x41]
cmova r9d, edx
lea ecx, [r10 + 0x20]
cmp r8b, 0x19
movzx edx, cl
cmova edx, r10d
cmp dl, r9b
jne 0x180012918
inc r11
mov rcx, r11
sub rcx, rbx
cmp rcx, rax
jb 0x1800128d0
lea rax, [r15 + r12]
jmp 0x18001293c
mov rdx, qword [rsp + 0x38]
movabs r10, 0x7ffffffdfffe
inc ebp
add rsi, 2
add r14, 4
cmp ebp, r13d
jb 0x1800128a0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180012960
Capabilities:
Parse pe header

Disassembly:
lea rax, [rcx - 0x10000]
movabs rdx, 0x7ffffffdfffe
cmp rax, rdx
ja 0x180012993
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180012993
mov eax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
ret
xor eax, eax
ret
Function at 0x18001ac20
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18001ac70
lea r11, [0x1800651e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18001ac53
cmp byte [r8], r9b
jne 0x18001ac53
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18001ac40
mov rcx, qword [0x180072b80]
not eax
movsxd rdx, dword [rcx + 0x1a68]
mov r9, qword [rcx + 0x1a70]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18001acd1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18001acc9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18001accc
mov rdx, r8
test rdx, rdx
jne 0x18001aca0
cmp r9, r10
je 0x18001ace0
cmp dword [r9], eax
jne 0x18001ace0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x18001b780
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xc8]
mov r9, r8
movsxd r8, dword [rcx + 0xc0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.18001bf90

Function at 0x18001bf90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001bfed
lea rbx, [0x1800651e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001bfd4
cmp r10, 2
jb 0x18001bfd4
cmp byte [r9], r8b
jne 0x18001bfd4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001bfb0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001c02f
lea rbx, [0x1800651e0]
cmp r8b, 0x23
jne 0x18001c013
cmp byte [r9], r8b
jne 0x18001c013
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001c000
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18001cdb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
movzx edx, byte [0x18006576a]
lea r8, [rbp - 0x3f]
xor eax, eax
lea r11, [0x1800651e0]
mov dword [rbp - 0x2c], eax
mov r9b, 0x57
mov qword [rbp - 0x10], rax
mov r10d, 0xffffffff
lea rax, [rbp + 0x10]
mov rbx, rcx
mov qword [rbp - 0x38], rax
mov eax, dword [0x180065764]
mov dword [rbp - 0x40], eax
movzx eax, word [0x180065768]
xor byte [rbp - 0x3f], 0x32
xor byte [rbp - 0x3e], 0x33
xor byte [rbp - 0x3d], 0x34
mov word [rbp - 0x3c], ax
xor al, 0x35
xor byte [rbp - 0x3b], 0x36
xor dl, 0x37
mov byte [rbp - 0x40], r9b
mov byte [rbp - 0x3a], dl
mov edx, r10d
mov byte [rbp - 0x3c], al
cmp r9b, 0x23
jne 0x18001ce3a
cmp byte [r8], r9b
jne 0x18001ce3a
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18001ce27
mov ecx, dword [rbx + 0x2fac]
lea rax, [0x180028550]
mov edi, dword [rbx + 0x2fa8]
not edx
mov qword [rbp - 0x28], rax
lea rax, [0x180028390]
mov qword [rbp - 0x20], rax
lea rax, [0x180028600]
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x30], edx
cmp edi, ecx
jne 0x18001cf46
inc edi
test ecx, ecx
je 0x18001cea2
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18001cea7
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18001cf46
mov rax, qword [0x180072b80]
mov qword [rsp + 0x78], rsi
test rax, rax
je 0x18001cecb
inc dword [rax + 0x3bc]
mov rdx, qword [0x180072b90]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x180072320]
mov rdx, qword [rbx + 0x2fb0]
mov rsi, rax
test rdx, rdx
je 0x18001cf34
movsxd rcx, dword [rbx + 0x2fa8]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.1800520c0
mov rcx, qword [rbx + 0x2fb0]
test rcx, rcx
je 0x18001cf27
mov rax, qword [0x180072b80]
test rax, rax
je 0x18001cf27
dec dword [rax + 0x3bc]
mov rdx, qword [0x180072b90]
call qword [0x180072328]
mov qword [rbx + 0x2fb0], rsi
mov rsi, qword [rsp + 0x78]
mov dword [rbx + 0x2fac], edi
movsxd rax, dword [rbx + 0x2fa8]
lea r11, [rsp + 0x60]
movups xmm0, xmmword [rbp - 0x38]
mov rdi, qword [r11 + 0x28]
movups xmm1, xmmword [rbp - 0x28]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2fb0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rbp - 0x18]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2fa8]
mov byte [rbx], 1
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180022940
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x180072b80]
lea rdx, [0x1800651e0]
mov r8d, ecx
mov rbx, qword [rax + 0x1a80]
add rbx, 0xc0
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x1800229f7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x1800229e3
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1800229e8
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180029050
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180022aa0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x180072b80]
lea rdx, [0x1800651e0]
mov r8, rcx
mov rbx, qword [rax + 0x1a80]
add rbx, 0xc0
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180022ba1
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180022b8d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180022b92
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180029050
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002b450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18002b5e1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18002b4c0
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18002ecb0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180029930
mov dword [rbx + 0x80], 0
jmp 0x18002b5cd
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18002f1c0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18003f980
Capabilities:
Encode data using base64

Disassembly:
or r8d, 2
jmp fcn.18003f990
Function at 0x140003f10
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003f44
cmp word [rcx], 0x5a4d
jne 0x140003f44
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003f44
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f44
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003e50
test eax, eax
jne 0x140003f60
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003ec0
test rax, rax
je 0x140003f55
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004709
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004610
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400045b0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400051c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400051e3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1400051e3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005291
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x1409ad8d0]
mov r8, rcx
mov rcx, r9
call fcn.1400051c0
test eax, eax
je 0x1400052bd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.1400051e4
xor eax, eax
add rsp, 0x28
ret
Function at 0x140005390
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400053b8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400053de
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400053e0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005439
test ecx, ecx
jle 0x140005419
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005439
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005439
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140005460
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005482
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140005498
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400054b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400054b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400054f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000558e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000552d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000556e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000558e
cmp rbx, rax
ja 0x140005540
test rbx, rbx
je 0x14000558e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret