joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a280
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14, qword [0x1800f4478]
cmp byte [r14 + 0x7b], 0
jne 0x18000a2ba
lea rdx, [0x1800bddc3]
mov rcx, rsi
call fcn.18007e93c
test rax, rax
cmove rax, rsi
mov rsi, rax
mov rcx, rsi
call fcn.180095e10
mov rdi, rax
movsxd r15, dword [r14 + 0x5c20]
mov eax, r15d
mov ecx, edi
and ecx, 0xfffffffc
mov ebp, ecx
add ebp, 0x18
lea r12d, [rcx + rax]
add r12d, 0x18
mov eax, dword [r14 + 0x5c24]
cmp eax, r12d
jge 0x18000a300
test eax, eax
je 0x18000a30c
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
mov eax, ecx
jmp 0x18000a311
mov rbx, qword [r14 + 0x5c28]
jmp 0x18000a38e
mov eax, 8
mov r13d, eax
cmp eax, r12d
cmovle r13d, r12d
movsxd rcx, r13d
test r14, r14
je 0x18000a32a
inc dword [r14 + 0xec]
mov rdx, qword [0x1800f2248]
call qword [0x1800d3aa0]
mov rbx, rax
mov rdx, qword [r14 + 0x5c28]
test rdx, rdx
je 0x18000a380
movsxd r8, dword [r14 + 0x5c20]
mov rcx, rbx
call fcn.1800a8560
mov rcx, qword [r14 + 0x5c28]
test rcx, rcx
je 0x18000a373
mov rax, qword [0x1800f4478]
test rax, rax
je 0x18000a373
dec dword [rax + 0xec]
mov rdx, qword [0x1800f2248]
call qword [0x1800d3aa8]
mov qword [r14 + 0x5c28], rbx
mov dword [r14 + 0x5c24], r13d
mov dword [r14 + 0x5c20], r12d
mov dword [rbx + r15], ebp
mov rax, qword [r14 + 0x5c28]
lea rcx, [rax + r15]
lea rbx, [rax + r15]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x18000a42b
lea r8, [rdi - 1]
lea r9, [rsi + 2]
mov eax, 0xffffffff
lea rdx, [0x1800b5850]
mov r11d, 0xffffffff
jmp 0x18000a409
movzx r10d, r10b
mov ebp, r11d
shr r11d, 8
movzx ebp, bpl
xor ebp, r10d
mov r10d, ebp
xor r11d, dword [rdx + r10*4]
inc r9
mov r10d, r11d
add r8, 0xffffffffffffffff
jae 0x18000a49b
movzx r10d, byte [r9 - 2]
cmp r8, 2
jb 0x18000a3e0
cmp r10b, 0x23
jne 0x18000a3e0
cmp byte [r9 - 1], 0x23
jne 0x18000a3e0
cmp byte [r9], 0x23
cmove r11d, eax
jmp 0x18000a3e0
movzx ebp, byte [rsi]
test bpl, bpl
je 0x18000a495
lea r9, [rsi + 2]
mov eax, 0xffffffff
lea rdx, [0x1800b5850]
mov r11d, 0xffffffff
jmp 0x18000a477
movzx r10d, r10b
mov ebp, r11d
shr r11d, 8
movzx ebp, bpl
xor ebp, r10d
mov r10d, ebp
xor r11d, dword [rdx + r10*4]
inc r9
mov ebp, r8d
mov r10d, r11d
test r8b, r8b
je 0x18000a49b
mov r10d, ebp
movzx r8d, byte [r9 - 1]
cmp bpl, 0x23
jne 0x18000a450
cmp r8b, 0x23
jne 0x18000a450
cmp byte [r9], 0x23
cmove r11d, eax
jmp 0x18000a450
mov r10d, 0xffffffff
not r10d
mov dword [rcx + 4], r10d
add rcx, 0x14
inc rdi
mov rdx, rsi
mov r8, rdi
call fcn.1800a8560
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x18000d540
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, dword [rcx + 0xf0]
mov eax, ecx
test ecx, ecx
jg 0x18000d57c
lea rcx, [0x1800c18d6]
lea rdx, str...dependenciesimguiimgui.h
mov r8d, 0x735
call fcn.18008f150
mov eax, dword [rbx + 0xf0]
mov rcx, qword [rbx + 0xf8]
cdqe
mov eax, dword [rcx + rax*4 - 4]
not eax
test rsi, rsi
je 0x18000d60b
mov rcx, rsi
sub rcx, rdi
je 0x18000d60b
mov rcx, rdi
not rcx
mov rdx, rcx
add rdx, rsi
lea r8, [rdi + 2]
lea rcx, [0x1800b5850]
mov r10d, eax
jmp 0x18000d5e9
movzx r9d, r9b
mov r11d, r10d
shr r10d, 8
movzx r11d, r11b
xor r11d, r9d
mov r9d, r11d
xor r10d, dword [rcx + r9*4]
inc r8
mov ebp, r10d
add rdx, 0xffffffffffffffff
jae 0x18000d675
movzx r9d, byte [r8 - 2]
cmp rdx, 2
jb 0x18000d5c0
cmp r9b, 0x23
jne 0x18000d5c0
cmp byte [r8 - 1], 0x23
jne 0x18000d5c0
cmp byte [r8], 0x23
cmove r10d, eax
jmp 0x18000d5c0
movzx r11d, byte [rdi]
test r11b, r11b
je 0x18000d673
lea r8, [rdi + 2]
lea rcx, [0x1800b5850]
mov r10d, eax
jmp 0x18000d656
movzx r9d, r9b
mov r11d, r10d
shr r10d, 8
movzx r11d, r11b
xor r11d, r9d
mov r9d, r11d
xor r10d, dword [rcx + r9*4]
inc r8
mov r11d, edx
mov ebp, r10d
test dl, dl
je 0x18000d675
mov r9d, r11d
movzx edx, byte [r8 - 1]
cmp r11b, 0x23
jne 0x18000d630
cmp dl, 0x23
jne 0x18000d630
cmp byte [r8], 0x23
cmove r10d, eax
jmp 0x18000d630
mov ebp, eax
not ebp
mov rax, qword [rbx]
cmp dword [rax + 0x3f20], ebp
jne 0x18000d694
mov ecx, ebp
mov edx, 0xb
mov r8, rdi
mov r9, rsi
call fcn.18000d1a0
mov eax, ebp
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x18000d6a0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov esi, edx
mov rdi, rcx
mov r14d, edx
shr r14d, 8
mov ebp, edx
shr ebp, 0x10
mov ebx, edx
shr ebx, 0x18
mov ecx, dword [rcx + 0xf0]
mov eax, ecx
test ecx, ecx
jg 0x18000d6eb
lea rcx, [0x1800c18d6]
lea rdx, str...dependenciesimguiimgui.h
mov r8d, 0x735
call fcn.18008f150
mov eax, dword [rdi + 0xf0]
mov rcx, qword [rdi + 0xf8]
cdqe
mov eax, dword [rcx + rax*4 - 4]
not eax
mov ecx, eax
shr eax, 8
xor ecx, esi
movzx ecx, cl
mov edx, ecx
lea rcx, [0x1800b5850]
mov r8d, eax
xor r8d, dword [rcx + rdx*4]
mov rax, qword [rdi]
mov edx, r8d
mov edi, r8d
shr edi, 8
xor edx, r14d
movzx edx, dl
xor edi, dword [rcx + rdx*4]
mov edx, edi
shr edi, 8
xor edx, ebp
movzx edx, dl
xor edi, dword [rcx + rdx*4]
mov edx, edi
shr edi, 8
movzx edx, dl
xor edx, ebx
xor edi, dword [rcx + rdx*4]
not edi
cmp dword [rax + 0x3f20], edi
jne 0x18000d75f
movsxd r8, esi
mov ecx, edi
mov edx, 4
xor r9d, r9d
call fcn.18000d1a0
mov eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x18000d770
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov ecx, dword [rcx + 0xf0]
mov eax, ecx
test ecx, ecx
jg 0x18000d7a7
lea rcx, [0x1800c18d6]
lea rdx, str...dependenciesimguiimgui.h
mov r8d, 0x735
call fcn.18008f150
mov eax, dword [rdi + 0xf0]
mov rcx, qword [rdi + 0xf8]
cdqe
mov eax, dword [rcx + rax*4 - 4]
movss xmm3, dword [rdi + 0x110]
movss xmm1, dword [rdi + 0x114]
movss xmm0, dword [rsi + 0xc]
movss xmm2, dword [rsi + 8]
movss xmm5, dword [rsi]
movss xmm4, dword [rsi + 4]
subss xmm5, xmm3
not eax
mov edx, eax
mov r8d, eax
shr r8d, 8
movd ecx, xmm5
xor edx, ecx
movzx eax, dl
mov r9d, eax
lea rax, [0x1800b5850]
mov edx, r8d
xor edx, dword [rax + r9*4]
mov r8d, ecx
mov r9d, ecx
shr ecx, 8
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [rax + rcx*4]
shr r8d, 0x10
xor r8d, edx
shr edx, 8
movzx ecx, r8b
xor edx, dword [rax + rcx*4]
mov ecx, edx
shr edx, 8
movzx ecx, cl
shr r9d, 0x18
xor r9d, ecx
mov ecx, r9d
xor edx, dword [rax + rcx*4]
subss xmm4, xmm1
mov r8d, edx
shr edx, 8
movd ecx, xmm4
xor r8d, ecx
movzx r8d, r8b
xor edx, dword [rax + r8*4]
mov r8d, ecx
mov r9d, ecx
shr ecx, 8
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [rax + rcx*4]
shr r8d, 0x10
xor r8d, edx
shr edx, 8
movzx ecx, r8b
xor edx, dword [rax + rcx*4]
mov ecx, edx
shr edx, 8
movzx ecx, cl
shr r9d, 0x18
xor r9d, ecx
mov ecx, r9d
xor edx, dword [rax + rcx*4]
subss xmm2, xmm3
mov r8d, edx
shr edx, 8
movd ecx, xmm2
xor r8d, ecx
movzx r8d, r8b
xor edx, dword [rax + r8*4]
mov r8d, ecx
mov r9d, ecx
shr ecx, 8
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [rax + rcx*4]
shr r8d, 0x10
xor r8d, edx
shr edx, 8
movzx ecx, r8b
xor edx, dword [rax + rcx*4]
mov ecx, edx
shr edx, 8
movzx ecx, cl
shr r9d, 0x18
xor r9d, ecx
mov ecx, r9d
xor edx, dword [rax + rcx*4]
subss xmm0, xmm1
mov r8d, edx
shr edx, 8
movd ecx, xmm0
xor r8d, ecx
movzx r8d, r8b
xor edx, dword [rax + r8*4]
mov r8d, ecx
mov r9d, ecx
shr ecx, 8
xor ecx, edx
shr edx, 8
movzx ecx, cl
xor edx, dword [rax + rcx*4]
shr r8d, 0x10
xor r8d, edx
shr edx, 8
movzx ecx, r8b
xor edx, dword [rax + rcx*4]
mov ecx, edx
shr edx, 8
movzx ecx, cl
shr r9d, 0x18
xor r9d, ecx
mov ecx, r9d
xor edx, dword [rax + rcx*4]
mov eax, edx
not eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180019bd0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1800f4478]
cmp byte [rdi + 0x4a81], 0
jne 0x180019c01
cmp byte [rdi + 0x4a82], 0
je 0x180019c79
movss xmm0, dword [rdi + 0x3894]
movss xmm1, dword [0x1800b4be0]
movaps xmm2, xmm0
mulss xmm2, dword [0x1800b4be4]
mulss xmm1, xmm0
addss xmm1, dword [rdi + 0xe04]
movss xmm0, dword [rdi + 0x38f0]
addss xmm2, dword [rdi + 0xe00]
movss dword [rdi + 0x47c8], xmm2
movss dword [rdi + 0x47cc], xmm1
mov qword [rdi + 0x47d0], 0
mov dword [rdi + 0x47bc], 1
or byte [rdi + 0x47b8], 0x41
mulss xmm0, dword [0x1800b4be8]
movss dword [rdi + 0x4818], xmm0
mov ecx, 2
mov ebx, ecx
movsx r9d, word [rdi + 0x5bb2]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.180004150
mov eax, ebx
test bl, 2
je 0x180019de2
movzx r11d, byte [rsp + 0x20]
test r11b, r11b
je 0x180019d1b
mov eax, 0xffffffff
lea r8, [rsp + 0x22]
lea rcx, [0x1800b5850]
mov r10d, 0xffffffff
jmp 0x180019cf6
movzx r9d, r9b
mov r11d, r10d
shr r10d, 8
movzx r11d, r11b
xor r11d, r9d
mov r9d, r10d
xor r9d, dword [rcx + r11*4]
inc r8
mov r11d, edx
mov r10d, r9d
test dl, dl
je 0x180019d13
mov r9d, r11d
movzx edx, byte [r8 - 1]
cmp r11b, 0x23
jne 0x180019cd0
cmp dl, 0x23
jne 0x180019cd0
cmp byte [r8], 0x23
cmove r10d, eax
jmp 0x180019cd0
not r9d
mov eax, r9d
jmp 0x180019d1d
xor eax, eax
mov rdx, qword [0x1800f4478]
mov rcx, qword [rdx + 0x3ec0]
movsxd rdx, dword [rdx + 0x3eb8]
test rdx, rdx
je 0x180019d7b
mov r10, rcx
mov r9, rdx
jmp 0x180019d4b
mov r10, r8
mov r9, r11
test r11, r11
je 0x180019d73
mov r8, r10
mov r11, r9
shr r11, 1
mov r10, r11
shl r10, 4
cmp dword [r8 + r10], eax
jae 0x180019d40
not r11
add r9, r11
add r8, r10
add r8, 0x10
mov r11, r9
jmp 0x180019d40
mov r9, rdx
mov rdx, r8
jmp 0x180019d81
xor r9d, r9d
mov rdx, rcx
shl r9, 4
add rcx, r9
cmp rdx, rcx
je 0x180019de2
cmp dword [rdx], eax
jne 0x180019de2
mov rax, qword [rdx + 8]
test rax, rax
je 0x180019de2
cmp byte [rax + 0xb6], 0
je 0x180019de2
mov byte [rax + 0xbb], 1
mov byte [rax + 0xbd], 1
mov byte [rax + 0xd8], 1
movzx eax, word [rdi + 0x5bb2]
inc eax
mov word [rdi + 0x5bb2], ax
movsx r9d, ax
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.180004150
or esi, 0x20c0347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.18001a2c0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007d5f0
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1800260d0
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
movups xmmword [rsp + 0x40], xmm6
mov ebx, r9d
mov esi, edx
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [0x1800f4478]
mov r12, qword [r14 + 0x3ed8]
cmp qword [r12 + 0x1a8], 0
jne 0x180026120
cmp qword [r14 + 0x4b38], 0
je 0x180026372
lea rax, [r12 + 0x220]
mov edx, dword [r12 + 0x14]
movss xmm0, dword [r8 + 4]
cvttss2si r9d, xmm0
movss xmm1, dword [r8]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm2, xmm0
movaps xmm3, xmm2
cvttss2si r8d, xmm1
cvttps2dq xmm0, xmm1
cvtdq2ps xmm0, xmm0
movss xmm1, dword [0x1800b4a14]
test r9d, r9d
sete r13b
jg 0x180026180
movss xmm3, dword [r12 + 0x254]
subss xmm3, dword [r12 + 0x104]
addss xmm3, xmm2
maxss xmm3, xmm1
movaps xmm2, xmm3
mov r15d, dword [rsp + 0xc0]
and edx, 4
movaps xmm3, xmm0
test r8d, r8d
sete dil
jg 0x1800261b0
movss xmm3, dword [rax]
subss xmm3, dword [r12 + 0x100]
addss xmm3, xmm0
maxss xmm3, xmm1
mov ebp, edx
or ebp, r15d
add r13b, r13b
or dword [r14 + 0x47b8], 2
movss dword [r14 + 0x47d8], xmm3
movss dword [r14 + 0x47dc], xmm2
mov dword [r14 + 0x47c0], 1
mov r9, qword [r12 + 8]
test rcx, rcx
je 0x1800261f9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rcx
lea r8, str._s__s__08X
jmp 0x180026204
mov dword [rsp + 0x20], esi
lea r8, str._s__08X
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.180004200
mov r8d, ebp
or r8d, 0x1000103
or r13b, dil
movss xmm6, dword [r14 + 0x37f8]
test bl, bl
jne 0x180026235
mov dword [r14 + 0x37f8], 0
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.18001a2c0
mov ebx, eax
movss dword [r14 + 0x37f8], xmm6
mov rdi, qword [r14 + 0x3ed8]
mov dword [rdi + 0x80], esi
mov byte [rdi + 0xd2], r13b
cmp word [rdi + 0xc2], 1
jne 0x180026276
mov rax, qword [rdi + 0x20]
mov qword [r12 + 0x100], rax
mov ebp, esi
not ebp
shr ebp, 8
mov eax, esi
movzx eax, sil
xor eax, 0xdc
mov edx, eax
lea rax, [0x1800b5850]
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x23
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x43
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x68
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x69
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x6c
xor ebp, dword [rax + rdx*4]
mov edx, ebp
shr ebp, 8
movzx edx, dl
xor edx, 0x64
xor ebp, dword [rax + rdx*4]
not ebp
cmp dword [r14 + 0x3f38], ebp
jne 0x1800262fc
xor ecx, ecx
xor edx, edx
call fcn.18000dbd0
test r15d, 0x800000
jne 0x18002634d
cmp dword [r14 + 0x48d0], esi
jne 0x18002634d
cmp word [rdi + 0x15c], 0
jne 0x180026321
cmp byte [rdi + 0x162], 0
je 0x18002634d
mov rcx, rdi
xor edx, edx
call fcn.18000e7d0
mov rcx, rdi
xor edx, edx
call fcn.180018d10
mov ecx, ebp
mov rdx, rdi
call fcn.18000dbd0
mov eax, dword [r14 + 0x48f4]
mov dword [r14 + 0x3f60], eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18007d5f0
mov eax, ebx
movups xmm6, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [r12 + 0x250]
jmp 0x180026128
Function at 0x1800268b0
Capabilities:
Hash data with crc32

Disassembly:
movzx edx, byte [rcx]
test dl, dl
je 0x18002692b
mov r8, rcx
add r8, 2
mov eax, 0xffffffff
lea rcx, [0x1800b5850]
mov r11d, edx
mov r10d, 0xffffffff
jmp 0x180026906
movzx r9d, r9b
mov r11d, r10d
shr r10d, 8
movzx r11d, r11b
xor r11d, r9d
mov r9d, r10d
xor r9d, dword [rcx + r11*4]
inc r8
mov r11d, edx
mov r10d, r9d
test dl, dl
je 0x180026923
mov r9d, r11d
movzx edx, byte [r8 - 1]
cmp r11b, 0x23
jne 0x1800268e0
cmp dl, 0x23
jne 0x1800268e0
cmp byte [r8], 0x23
cmove r10d, eax
jmp 0x1800268e0
not r9d
mov eax, r9d
jmp 0x18002692d
xor eax, eax
mov rdx, qword [0x1800f4478]
mov rcx, qword [rdx + 0x3ec0]
movsxd rdx, dword [rdx + 0x3eb8]
test rdx, rdx
je 0x18002698b
mov r10, rcx
mov r9, rdx
jmp 0x18002695b
mov r10, r8
mov r9, r11
test r11, r11
je 0x180026983
mov r8, r10
mov r11, r9
shr r11, 1
mov r10, r11
shl r10, 4
cmp dword [r8 + r10], eax
jae 0x180026950
not r11
add r9, r11
add r8, r10
add r8, 0x10
mov r11, r9
jmp 0x180026950
mov r9, rdx
mov rdx, r8
jmp 0x180026991
xor r9d, r9d
mov rdx, rcx
shl r9, 4
add rcx, r9
cmp rdx, rcx
je 0x1800269a6
cmp dword [rdx], eax
jne 0x1800269a6
mov rax, qword [rdx + 8]
ret
xor eax, eax
ret

Function at 0x18002ec70
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movups xmmword [rsp + 0x30], xmm6
mov rsi, r9
movaps xmm6, xmm2
mov r14, rdx
mov rdi, rcx
mov r15, qword [rsp + 0xa0]
mov rcx, rdx
call fcn.180095e10
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rax, 0x3f
shr rcx, 0x21
add ecx, eax
shl ecx, 2
movsxd rcx, ecx
call fcn.180003ff0
mov rbx, rax
movzx edx, byte [r14]
test dl, dl
je 0x18002ed9e
add r14, 5
mov rax, r14
mov rcx, rbx
nop word [rax + rax]
movsx r8d, dl
mov edx, r8d
cmp r8b, 0x5c
setge dl
xor r9d, r9d
mov r9b, dl
xor r9d, 0xffffffdd
mov edx, r9d
add edx, r8d
movsx r9d, byte [rax - 4]
cmp r9d, 0x5c
setge r8b
xor r10d, r10d
mov r10b, r8b
xor r10d, 0xffffffdd
mov r8d, r10d
add r8d, r9d
movsx r9d, byte [rax - 3]
cmp r9d, 0x5c
setge r10b
xor r11d, r11d
mov r11b, r10b
xor r11d, 0xffffffdd
add r11d, r9d
movsx r9d, byte [rax - 2]
cmp r9d, 0x5c
setge r10b
xor ebp, ebp
mov bpl, r10b
xor ebp, 0xffffffdd
add ebp, r9d
movsx r9d, byte [rax - 1]
cmp r9d, 0x5c
setge r10b
xor r14d, r14d
mov r14b, r10b
xor r14d, 0xffffffdd
add r14d, r9d
imul r9d, r14d, 0x55
add r9d, ebp
imul r9d, r9d, 0x55
add r9d, r11d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
mov dword [rcx], r8d
add rcx, 4
movzx r8d, byte [rax]
add rax, 5
mov edx, r8d
test r8b, r8b
jne 0x18002ece0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, rbx
movaps xmm3, xmm6
call fcn.18003a6d0
mov rsi, rax
mov rcx, rbx
call fcn.180004020
mov rax, rsi
movups xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180050c00
Capabilities:
Resume thread

Disassembly:
mov edx, 1
jmp 0x180050c00
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x1800f2288], ebx
je 0x180050c63
mov r14, qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
nop
mov r15, rax
cmp rax, 0x20
setae al
xor ecx, ecx
mov cl, al
call r14
inc r15
xor eax, eax
lock cmpxchg dword [0x1800f2288], ebx
mov rax, r15
jne 0x180050c40
cmp qword [0x1800f2290], 0
je 0x180050cb2
test rdi, rdi
je 0x180050cbc
mov eax, dword [0x1800f22a4]
mov ecx, eax
test rcx, rcx
je 0x180050ca8
mov rdx, qword [0x1800f2298]
add rdx, 0x20
neg rcx
xor eax, eax
nop
cmp qword [rdx - 0x20], rdi
je 0x180050cca
add rdx, 0x38
mov r8, rax
dec r8
mov rax, r8
cmp rcx, r8
jne 0x180050c90
mov ebx, 4
jmp 0x180050d91
mov ebx, 2
jmp 0x180050d91
mov ecx, esi
call fcn.180050dc0
mov ebx, eax
jmp 0x180050d91
mov ecx, eax
mov ebx, 4
cmp eax, 1
je 0x180050d91
mov ecx, dword [rdx]
shr ecx, 1
and ecx, 1
cmp ecx, esi
jne 0x180050cf5
cmp esi, 1
mov ebx, 0
adc ebx, 5
jmp 0x180050d91
mov rdi, rax
neg rdi
mov edx, edi
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180050f70
mov ebx, eax
test eax, eax
jne 0x180050d91
mov ecx, edi
mov edx, esi
call fcn.180051370
mov ebx, eax
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x180050d91
mov eax, dword [rsp + 0x2c]
mov r14d, eax
test r14, r14
je 0x180050d7f
mov r15, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x180050d5b
mov rax, rbp
inc rax
mov rbp, rax
cmp r14, rax
je 0x180050d7f
mov r8d, dword [rsi + rbp*4]
mov ecx, 0x5a
xor edx, edx
call r15
test rax, rax
je 0x180050d4d
mov rdi, rax
mov rcx, rax
call r12
mov rcx, rdi
call r13
jmp 0x180050d4d
mov rcx, qword [0x1800f2290]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xchg dword [0x1800f2288], eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007d5f0
mov eax, ebx
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x180050dc0
Capabilities:
Resume thread

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, dword [0x1800f22a4]
test rax, rax
je 0x180050e20
mov esi, ecx
mov rcx, qword [0x1800f2298]
xor edi, edi
mov ebx, 0x20
nop word [rax + rax]
mov edx, dword [rcx + rbx]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180050e27
add rbx, 0x38
mov rdx, rdi
inc rdx
mov rdi, rdx
mov r8d, eax
cmp eax, edx
jne 0x180050e00
xor ecx, ecx
jmp 0x180050f46
test esi, esi
setne al
xor r8d, r8d
mov r8b, al
lea rcx, [rsp + 0x20]
mov edx, 0xffffffff
call fcn.180050f70
mov ecx, eax
test eax, eax
jne 0x180050f46
mov ecx, dword [0x1800f22a4]
mov eax, edi
cmp edi, ecx
jae 0x180050ec8
mov rdx, qword [0x1800f2298]
mov rax, rbx
mov rbx, rdi
jmp 0x180050e8f
mov rdx, rcx
mov ecx, eax
mov r8, rbx
inc r8
mov eax, eax
mov r9d, eax
add rdi, 0x38
mov rax, rdi
mov rbx, r8
cmp r8, r9
jae 0x180050ec8
mov rdi, rax
mov eax, dword [rdx + rax]
shr eax, 1
mov r8d, eax
and r8d, 1
mov eax, ecx
mov rcx, rdx
cmp r8d, esi
je 0x180050e70
mov ecx, ebx
mov edx, esi
call fcn.180051370
test eax, eax
jne 0x180050f68
mov rcx, qword [0x1800f2298]
mov eax, dword [0x1800f22a4]
jmp 0x180050e70
xor ebx, ebx
mov rsi, qword [rsp + 0x20]
test rsi, rsi
je 0x180050f44
mov eax, dword [rsp + 0x2c]
mov r14d, eax
test r14, r14
je 0x180050f32
mov r15, qword [sym.imp.KERNEL32.dll_OpenThread]
mov r12, qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r13, qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
jmp 0x180050f0e
mov rax, rbp
inc rax
mov rbp, rax
cmp r14, rax
je 0x180050f32
mov r8d, dword [rsi + rbp*4]
mov ecx, 0x5a
xor edx, edx
call r15
test rax, rax
je 0x180050f00
mov rdi, rax
mov rcx, rax
call r12
mov rcx, rdi
call r13
jmp 0x180050f00
mov rcx, qword [0x1800f2290]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, ebx
mov esi, ecx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007d5f0
mov eax, esi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebx, eax
jmp 0x180050eca
Function at 0x180051370
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov esi, edx
mov rax, qword [0x1800d3040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15, qword [0x1800f2298]
mov ecx, ecx
mov eax, ecx
imul r12, rax, 0x38
mov rax, qword [r15 + r12]
movzx ecx, byte [r15 + r12 + 0x20]
mov edx, ecx
test cl, 1
sete cl
xor r8d, r8d
mov r8b, cl
mov ecx, r8d
lea rcx, [rcx + rcx*4]
lea rdi, [rax + rcx]
add rdi, 0xfffffffffffffffb
and edx, 1
mov eax, edx
lea rbx, [rax*2 + 5]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov rdx, rbx
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18005141d
lea r14, [r15 + r12]
add r14, 0x20
test esi, esi
je 0x180051424
mov byte [rdi], 0xe9
mov eax, dword [r15 + r12 + 8]
mov ecx, edi
sub eax, edi
add eax, 0xfffffffb
mov dword [rdi + 1], eax
test byte [r14], 1
je 0x180051446
add r15, r12
mov rax, qword [r15]
mov word [rax], 0xf9eb
jmp 0x180051446
mov esi, 0xa
jmp 0x18005148c
test byte [r14], 1
lea rax, [r15 + r12 + 0x18]
jne 0x18005143c
movzx ecx, byte [rax + 4]
mov byte [rdi + 4], cl
mov eax, dword [rax]
mov dword [rdi], eax
jmp 0x180051446
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rdi + 3], eax
mov dword [rdi], ecx
mov r8d, dword [rsp + 0x2c]
lea r9, [rsp + 0x2c]
mov rcx, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov rdx, rdi
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, esi
movzx ecx, byte [r14]
and al, 1
mov dl, al
add edx, edx
and cl, 0xf9
or cl, dl
shl al, 2
or al, cl
mov byte [r14], al
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007d5f0
mov eax, esi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret