joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x006d3fa0]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x472afb
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x472d20
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x006d3fa0]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x472db7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x473180
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4731b4
mov rcx, 0x28
jmp 0x4731bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006d3fa0], rcx
pop rbp
ret

Function at 0x484140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4841b3
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x60], dil
mov qword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov byte [rsp + 0x18], al
call sym.internal_bytealg.IndexByte.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
add rsp, 0x38
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp sym.bytes.IndexByte
Function at 0x486d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486ea6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x48], rdi
test rdi, rdi
je 0x486d7b
jmp 0x486d9d
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call sym.unicode_utf8.RuneCountInString
mov qword [rsp + 0x48], rax
inc rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x48], rdi
cmp rdi, 1
je 0x486daa
jmp 0x486e03
mov rdx, qword [rsp + 0x70]
test rdi, rdi
ja 0x486db9
jmp 0x486e97
movzx eax, byte [rdx]
mov byte [rsp + 0x27], al
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], al
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 0x30], 0
jmp 0x486e0e
jmp 0x486e10
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
call sym.strings.Index
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x486e36
jmp 0x486e46
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
add rsp, 0x50
pop rbp
ret
inc qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdx
add rax, rdx
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rcx, rax
jae 0x486e6e
jmp 0x486e92
sub rcx, rax
mov rsi, rcx
neg rcx
sar rcx, 0x3f
and rax, rcx
add rdx, rax
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rsi
jmp 0x486e8d
jmp 0x486e0e
call sym.runtime.panicSliceB
xor eax, eax
mov rcx, rdi
nop dword [rax]
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.strings.Count
Function at 0x4b9f20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4ba0d2
push rbp
mov rbp, rsp
sub rsp, 0xa0
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
jne 0x4b9fa9
jmp 0x4b9ff2
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x60], xmm15
lea rdx, [0x00593938]
mov qword [rsp + 0x48], rdx
lea rdx, [0x00592a28]
mov qword [rsp + 0x50], rdx
mov rdi, qword [rsp + 0x48]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
add rsp, 0xa0
pop rbp
ret
mov rcx, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rcx
inc rcx
lea rax, [0x00554e80]
xor ebx, ebx
call sym.runtime.makeslice
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 0
inc rsi
mov qword [rsp + 0x80], rsi
mov rdx, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rcx, rax
xor edi, edi
mov rax, rdx
call sym.syscall.encodeWTF16
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rcx
inc rbx
cmp rcx, rbx
jae 0x4ba067
jmp 0x4ba069
jmp 0x4ba07c
mov edi, 1
lea rsi, [0x00554e80]
call sym.runtime.growslice
jmp 0x4ba07c
lea rdx, [rax + rbx*2]
lea rdx, [rdx - 2]
mov word [rdx], 0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor edi, edi
xor esi, esi
add rsp, 0xa0
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop dword [rax]
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4fc900
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 8
mov qword [rsp + 0x18], rax
mov byte [rsp + 0x20], bl
mov qword [rsp], 0
movzx ecx, byte [rsp + 0x20]
xor rax, rcx
mov qword [rsp + 0x18], rax
movabs rcx, 0x100000001b3
imul rax, rcx
mov qword [rsp + 0x18], rax
mov qword [rsp], rax
add rsp, 8
pop rbp
ret

Function at 0x4fc960
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
jmp 0x4fc98b
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdx
cmp qword [rsp + 0x18], rdx
jl 0x4fc99e
jmp 0x4fc9e3
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
cmp rcx, rax
ja 0x4fc9b9
jmp 0x4fc9f3
add rbx, rax
movzx ebx, byte [rbx]
xor rdx, rbx
mov qword [rsp + 0x38], rdx
movabs rbx, 0x100000001b3
imul rdx, rbx
mov qword [rsp + 0x38], rdx
jmp 0x4fc9dc
inc qword [rsp + 0x18]
jmp 0x4fc98b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
add rsp, 0x28
pop rbp
ret
call sym.runtime.panicIndex
nop
int3

Function at 0x4fca00
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x4fca25
cmp qword [rsp + 8], 8
jl 0x4fca2f
jmp 0x4fca69
movzx ecx, byte [rsp + 0x28]
xor rcx, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
mov rdx, qword [rsp + 0x28]
shr rdx, 8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
nop
jmp 0x4fca62
inc qword [rsp + 8]
jmp 0x4fca25
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret

Function at 0x4fca80
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp], 0
mov qword [rsp + 8], 0
jmp 0x4fcaa4
cmp qword [rsp + 8], 4
jl 0x4fcaae
jmp 0x4fcae4
movzx ecx, byte [rsp + 0x28]
xor qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x28]
shr ecx, 8
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x20]
movabs rdx, 0x100000001b3
imul rcx, rdx
mov qword [rsp + 0x20], rcx
jmp 0x4fcadd
inc qword [rsp + 8]
jmp 0x4fcaa4
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
add rsp, 0x10
pop rbp
ret
Function at 0x502340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50254b
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdi
mov byte [rsp + 0x16], 0
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdi
cmp rdi, rdx
jg 0x502382
nop
jmp 0x50238f
mov byte [rsp + 0x16], 0
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 0x20], 0
jmp 0x50239a
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x30], rdx
cmp qword [rsp + 0x20], rdx
jl 0x5023b0
jmp 0x5024ae
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
nop
cmp rcx, rax
ja 0x5023ca
jmp 0x502545
lea rcx, [rdx + rax]
movzx eax, byte [rcx]
mov byte [rsp + 0x1e], al
call sym.path_filepath.isSlash
mov byte [rsp + 0x19], al
nop
test al, al
jne 0x5023e6
jmp 0x50242b
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
cmp rax, rcx
jb 0x5023ff
jmp 0x502540
lea rcx, [rdx + rax]
movzx eax, byte [rcx]
mov byte [rsp + 0x1d], al
call sym.path_filepath.isSlash
mov byte [rsp + 0x19], al
test al, al
jne 0x502419
jmp 0x50241e
jmp 0x5024a2
mov byte [rsp + 0x16], 0
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rcx, rax
ja 0x502445
nop
jmp 0x502538
lea rcx, [rdx + rax]
movzx eax, byte [rcx]
mov byte [rsp + 0x1c], al
call sym.path_filepath.toUpper
mov byte [rsp + 0x18], al
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
cmp rcx, rax
ja 0x502472
jmp 0x502533
lea rcx, [rdx + rax]
movzx eax, byte [rcx]
mov byte [rsp + 0x1b], al
nop dword [rax]
call sym.path_filepath.toUpper
mov byte [rsp + 0x17], al
cmp byte [rsp + 0x18], al
jne 0x502491
jmp 0x5024a0
mov byte [rsp + 0x16], 0
xor eax, eax
add rsp, 0x40
pop rbp
ret
jmp 0x5024a2
jmp 0x5024a4
inc qword [rsp + 0x20]
jmp 0x50239a
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x38], rbx
cmp rdx, rbx
setg byte [rsp + 0x19]
jg 0x5024ce
jmp 0x502506
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x50]
cmp rax, rcx
jb 0x5024e9
jmp 0x50252e
lea rcx, [rdx + rax]
movzx eax, byte [rcx]
mov byte [rsp + 0x1a], al
call sym.path_filepath.isSlash
mov byte [rsp + 0x1f], al
xor eax, 1
mov byte [rsp + 0x19], al
jmp 0x502508
jmp 0x502508
cmp byte [rsp + 0x19], 0
jne 0x502511
jmp 0x50251e
mov byte [rsp + 0x16], 0
xor eax, eax
add rsp, 0x40
pop rbp
ret
mov byte [rsp + 0x16], 1
mov eax, 1
add rsp, 0x40
pop rbp
ret
call sym.runtime.panicIndex
call sym.runtime.panicIndex
call sym.runtime.panicIndex
nop dword [rax]
call sym.runtime.panicIndex
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.path_filepath.pathHasPrefixFold
Function at 0x521d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x521efb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
lea rsi, [0x00593c40]
nop
cmp rdx, rsi
je 0x521da7
jmp 0x521dbd
movzx edx, word [rcx]
movzx esi, word [rcx + 2]
movzx edi, word [rcx + 4]
movzx ecx, word [rcx + 6]
mov eax, 1
jmp 0x521dc9
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
xor eax, eax
jmp 0x521dc9
mov word [rsp + 0x20], dx
mov word [rsp + 0x22], si
mov word [rsp + 0x24], di
mov word [rsp + 0x26], cx
mov byte [rsp + 0x17], al
movzx ecx, word [rsp + 0x20]
movzx edx, word [rsp + 0x22]
movzx esi, word [rsp + 0x24]
movzx edi, word [rsp + 0x26]
mov word [rsp + 0x18], cx
mov word [rsp + 0x1a], dx
mov word [rsp + 0x1c], si
mov word [rsp + 0x1e], di
movzx ecx, byte [rsp + 0x17]
mov byte [rsp + 0x16], cl
mov byte [rsp + 0x15], cl
test cl, cl
jne 0x521e1c
jmp 0x521e3c
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
add rsp, 0x70
pop rbp
ret
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x88]
call rcx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x3c], edi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x54], ebx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x4c], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], ebx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], edi
mov word [rsp + 0x20], 0
mov word [rsp + 0x22], 0
mov word [rsp + 0x24], 0
mov word [rsp + 0x26], 0
mov ecx, dword [rsp + 0x28]
mov word [rsp + 0x20], cx
mov ecx, dword [rsp + 0x2c]
mov word [rsp + 0x22], cx
mov ecx, dword [rsp + 0x30]
mov word [rsp + 0x24], cx
mov ecx, dword [rsp + 0x34]
mov word [rsp + 0x26], cx
lea rax, [0x0056e040]
lea rbx, [rsp + 0x20]
call sym.runtime.convTnoptr
mov qword [rsp + 0x68], rax
lea rcx, [0x00593c40]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.image_color.rgba64Model
Function at 0x523660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52381e
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rbx
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
lea rsi, [0x00593c80]
nop
cmp rdx, rsi
je 0x5236a7
jmp 0x5236bd
movzx edx, byte [rcx]
movzx esi, byte [rcx + 1]
movzx edi, byte [rcx + 2]
movzx ecx, byte [rcx + 3]
mov eax, 1
jmp 0x5236c9
xor esi, esi
xor edi, edi
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x5236c9
mov byte [rsp + 0x24], dl
mov byte [rsp + 0x25], sil
mov byte [rsp + 0x26], dil
mov byte [rsp + 0x27], cl
mov byte [rsp + 0x23], al
movzx edx, byte [rsp + 0x24]
mov byte [rsp + 0x1b], dl
mov byte [rsp + 0x1c], sil
mov byte [rsp + 0x1d], dil
mov byte [rsp + 0x1e], cl
movzx ecx, byte [rsp + 0x23]
mov byte [rsp + 0x1a], cl
mov byte [rsp + 0x16], cl
test cl, cl
jne 0x523709
jmp 0x523729
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
add rsp, 0x70
pop rbp
ret
mov rcx, qword [rsp + 0x80]
test byte [rcx], al
mov rcx, qword [rcx + 0x18]
mov rax, qword [rsp + 0x88]
nop
call rcx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x2c], eax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ecx
shr eax, 8
shr ebx, 8
shr ecx, 8
call sym.image_color.RGBToCMYK
mov byte [rsp + 0x22], al
mov byte [rsp + 0x21], bl
mov byte [rsp + 0x20], cl
mov byte [rsp + 0x1f], dil
mov byte [rsp + 0x2b], al
mov byte [rsp + 0x2a], bl
mov byte [rsp + 0x29], cl
mov byte [rsp + 0x28], dil
mov byte [rsp + 0x19], al
mov byte [rsp + 0x17], bl
mov byte [rsp + 0x15], cl
mov byte [rsp + 0x18], dil
mov byte [rsp + 0x24], 0
mov byte [rsp + 0x25], 0
mov byte [rsp + 0x26], 0
mov byte [rsp + 0x27], 0
movzx ecx, byte [rsp + 0x19]
mov byte [rsp + 0x24], cl
movzx ecx, byte [rsp + 0x17]
mov byte [rsp + 0x25], cl
movzx ecx, byte [rsp + 0x15]
mov byte [rsp + 0x26], cl
movzx ecx, byte [rsp + 0x18]
mov byte [rsp + 0x27], cl
lea rax, [0x0056dda0]
lea rbx, [rsp + 0x24]
call sym.runtime.convTnoptr
mov qword [rsp + 0x68], rax
lea rcx, [0x00593c80]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.image_color.cmykModel
Function at 0x52a4e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a6d2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x30], 0
movzx r8d, byte [0x006d450c]
mov r9d, r8d
xor r8d, 1
mov byte [rsp + 0x2f], r8b
test r9b, r9b
jne 0x52a531
jmp 0x52a544
movzx r8d, byte [0x006d4512]
xor r8d, 1
mov byte [rsp + 0x2f], r8b
jmp 0x52a546
jmp 0x52a546
cmp byte [rsp + 0x2f], 0
jne 0x52a6be
jmp 0x52a553
mov r8, qword [rsp + 0x88]
mov qword [rsp + 0x48], r8
cmp r8, 0x40
jge 0x52a56b
jmp 0x52a65a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
and eax, 0xf
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
sub rcx, rax
mov qword [rsp + 0x40], rcx
mov rdx, qword [rsp + 0x90]
mov rax, qword [rsp + 0x80]
cmp rdx, rcx
jae 0x52a5af
jmp 0x52a6b9
jmp 0x52a5b1
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov ebx, dword [rsp + 0x78]
not ebx
mov dword [rsp], ebx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
call sym.hash_crc32.ieeeCLMUL.abi0
xorps xmm15, xmm15
mov r14, qword [0x006d3fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x34], eax
not eax
mov dword [rsp + 0x78], eax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x90]
jmp 0x52a620
cmp rcx, rax
jae 0x52a62a
jmp 0x52a6b4
sub rbx, rax
sub rcx, rax
mov r8, rbx
neg rbx
sar rbx, 0x3f
and rax, rbx
add rdx, rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x90], r8
jmp 0x52a65c
jmp 0x52a65c
mov rdx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rdx
test rdx, rdx
je 0x52a670
jmp 0x52a67e
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x30], eax
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x80]
mov rbx, qword [0x0064bf80]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x90]
mov eax, dword [rsp + 0x78]
call sym.hash_crc32.slicingUpdate
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], eax
add rsp, 0x68
pop rbp
ret
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAcap
lea rax, [0x00554d80]
lea rbx, [0x005934d0]
call sym.runtime.gopanic
nop
mov dword [rsp + 8], eax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov eax, dword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.hash_crc32.archUpdateIEEE
Function at 0x52ae60
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x52af35
movdqa xmm0, xmmword [0x00592c00]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x52aea1
movdqa xmm0, xmmword [0x00592c10]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x52afb7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x52af8b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005929e8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x00592c20]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret