joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006720
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 0x5a4d
test rcx, rcx
je 0x140006797
mov edx, 0x40
call fcn.1400078d0
test al, al
jne 0x140006797
cmp word [rbx], di
jne 0x140006797
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140006797
lea rsi, [rbx + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1400078d0
test al, al
jne 0x140006797
cmp dword [rsi], 0x4550
jne 0x140006797
test rsi, rsi
je 0x140006797
mov edx, 0xf8
mov rcx, rsi
call fcn.1400078d0
test al, al
je 0x140006791
xor esi, esi
jmp 0x14000679e
movzx esi, word [rsi + 0x18]
jmp 0x14000679e
xor esi, esi
test rbx, rbx
je 0x140006812
mov edx, 0x40
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140006812
cmp word [rbx], di
jne 0x140006812
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140006812
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006812
cmp dword [rdi], 0x4550
jne 0x140006812
test rdi, rdi
je 0x140006812
mov eax, 0x20b
cmp si, ax
jne 0x1400067ff
mov rax, qword [rdi + 0x30]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x34]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140006830
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140006934
mov edx, 0x40
call fcn.1400078d0
test al, al
jne 0x140006934
mov esi, 0x5a4d
cmp word [rbx], si
jne 0x140006934
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140006934
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006934
cmp dword [rdi], 0x4550
jne 0x140006934
mov edx, 0x40
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140006919
cmp word [rbx], si
jne 0x140006919
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140006919
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006919
cmp dword [rdi], 0x4550
jne 0x140006919
test rdi, rdi
je 0x140006919
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006919
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x140006919
mov rcx, rbx
call fcn.140006510
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140006400
mov eax, dword [rax + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140006950
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x140006a21
call fcn.140006340
mov rsi, rax
test rax, rax
je 0x140006a21
mov edx, 0x40
mov qword [rsp + 0x30], rdi
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x1400069e2
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x1400069e2
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x1400069e2
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x1400069e2
cmp dword [rdi], 0x4550
jne 0x1400069e2
test rdi, rdi
je 0x1400069e2
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x1400069e2
mov eax, 0x20b
lea rax, [rsi + 4]
test rax, rax
je 0x140006a0a
cmp rax, rbx
jb 0x140006a0a
mov rcx, rax
sub rcx, rbx
lea rdx, [rcx + 0x14]
cmp rdx, rbp
ja 0x140006a0a
cmp rdx, 0x14
jb 0x140006a0a
cmp rdx, rcx
jae 0x140006a0c
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140006d40
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x140006f4c
test r8, r8
je 0x140006f4c
call fcn.140006340
mov r15, rax
test rax, rax
je 0x140006f4c
mov edx, 0x40
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140006de9
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140006de9
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140006de9
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140006de9
cmp dword [rbx], 0x4550
jne 0x140006de9
test rbx, rbx
je 0x140006de9
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140006de9
mov eax, 0x20b
movzx eax, word [r15 + 0x14]
xor r11d, r11d
add rax, r15
mov r14d, r11d
movzx ebp, r11w
lea rdx, [rax + 0x18]
mov eax, dword [r15 + 0x54]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x60], eax
cmp r11w, word [r15 + 6]
jae 0x140006f2f
nop word [rax + rax]
movzx eax, bp
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x140006f4c
cmp rbx, rdi
jb 0x140006f4c
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r13
ja 0x140006f4c
cmp rax, 0x28
jb 0x140006f4c
cmp rax, rcx
jb 0x140006f4c
cmp rax, rsi
ja 0x140006f4c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x140006f1d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x140006f1d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r12]
cmp rax, rsi
jbe 0x140006eaa
mov rax, rsi
mov r8, r11
sub rax, r9
cmp rsi, r9
cmova r8, rax
cmp r9, rsi
jb 0x140006eb8
test r8, r8
jne 0x140006f4c
lea rax, [rdx + r8]
cmp rax, rsi
ja 0x140006f4c
test rcx, rcx
je 0x140006f18
cmp rcx, rdi
jb 0x140006f18
cmp rax, r13
ja 0x140006f18
cmp rax, r8
jb 0x140006f18
cmp rax, rdx
jb 0x140006f18
test r10, r10
je 0x140006f18
cmp r10, r12
jb 0x140006f18
lea rax, [r9 + r8]
cmp rax, rsi
ja 0x140006f18
cmp rax, r8
jb 0x140006f18
cmp rax, r9
jb 0x140006f18
mov rdx, rcx
mov rcx, r10
call fcn.140049380
test r14d, r14d
je 0x140006f11
cmp dword [rbx + 0x14], r14d
jae 0x140006f15
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc bp
cmp bp, word [r15 + 6]
jb 0x140006e20
mov eax, dword [rsp + 0x60]
test eax, eax
cmove eax, r14d
mov r8d, eax
cmp r8, rsi
ja 0x140006f4c
mov rdx, rdi
mov rcx, r12
call fcn.140049380
mov al, 1
jmp 0x140006f4e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140006f90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov r12, r8
mov edx, 5
mov rsi, rcx
call fcn.140006610
test rax, rax
je 0x140007202
test rsi, rsi
je 0x140007202
cmp rax, rsi
jb 0x140007202
mov rcx, rax
sub rcx, rsi
lea rdx, [rcx + 8]
cmp rdx, r14
ja 0x140007202
cmp rdx, 8
jb 0x140007202
cmp rdx, rcx
jb 0x140007202
mov ecx, dword [rax + 4]
mov edx, 0x40
mov ebx, dword [rax]
mov dword [rsp + 0x20], ecx
mov rcx, rsi
mov dword [rsp + 0x78], ebx
call fcn.1400078d0
test al, al
jne 0x140007066
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140007066
movsxd rax, dword [rsi + 0x3c]
cmp eax, 0x400
jg 0x140007066
lea rbx, [rsi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140007062
cmp dword [rbx], 0x4550
jne 0x140007062
test rbx, rbx
je 0x140007062
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
mov ebx, dword [rsp + 0x78]
mov r10d, dword [rsp + 0x20]
xor r13d, r13d
test r10d, r10d
je 0x1400071fe
mov r11d, 0x1000
nop dword [rax]
lea eax, [rbx + r13]
lea r15, [rax + rsi]
mov ecx, eax
test r15, r15
je 0x140007202
cmp r15, rsi
jb 0x140007202
add rax, 8
cmp rax, r14
ja 0x140007202
cmp rax, 8
jb 0x140007202
cmp rax, rcx
jb 0x140007202
mov eax, dword [r15 + 4]
test eax, eax
je 0x1400071fe
mov r9d, dword [r15]
lea rbp, [rax - 8]
shr rbp, 1
lea rax, [r15 + 8]
mov dword [rsp + 0x24], r9d
test rax, rax
je 0x140007202
cmp rax, rsi
jb 0x140007202
sub rax, rsi
lea rbx, [rax + 2]
cmp rbx, r14
ja 0x140007202
cmp rbx, 2
jb 0x140007202
cmp rbx, rax
jb 0x140007202
test rbp, rbp
je 0x1400071ed
xor r8d, r8d
test rbp, rbp
je 0x1400071ed
mov rax, rbx
nop dword [rax + rax]
lea rdx, [rsi - 2]
add rdx, rax
je 0x140007169
cmp rdx, rsi
jb 0x140007169
cmp rax, r14
ja 0x140007169
cmp rax, 2
jb 0x140007169
lea rcx, [rax - 2]
cmp rax, rcx
jb 0x140007169
cmp word [rdx], r11w
jae 0x140007169
add rax, 2
inc r8
cmp r8, rbp
jb 0x140007130
jmp 0x1400071ed
xor edi, edi
nop dword [rax + rax]
lea rcx, [rsi - 2]
add rcx, rbx
je 0x1400071dd
cmp rcx, rsi
jb 0x1400071dd
cmp rbx, r14
ja 0x1400071dd
cmp rbx, 2
jb 0x1400071dd
lea rax, [rbx - 2]
cmp rbx, rax
jb 0x1400071dd
movzx eax, word [rcx]
mov ecx, eax
shr eax, 0xc
and ecx, 0xfff
test eax, eax
je 0x1400071dd
cmp eax, 3
je 0x1400071ae
cmp eax, 0xa
jne 0x140007202
add ecx, r9d
cmp rcx, r14
jae 0x140007202
test r12, r12
je 0x1400071d1
mov rax, qword [r12]
lea rdx, [rcx + rsi]
mov rcx, r12
call qword [rax]
test al, al
je 0x140007202
mov r9d, dword [rsp + 0x24]
add rbx, 2
inc rdi
cmp rdi, rbp
jb 0x140007170
test rdi, rdi
je 0x140007202
mov r10d, dword [rsp + 0x20]
mov r11d, 0x1000
add r13d, dword [r15 + 4]
mov ebx, dword [rsp + 0x78]
cmp r13d, r10d
jb 0x140007080
mov al, 1
jmp 0x140007204
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140007230
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.140006830
mov edi, eax
test eax, eax
je 0x1400074ba
test rbp, rbp
jne 0x140007261
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140006610
test rax, rax
je 0x1400074ba
mov eax, dword [rax]
test eax, eax
je 0x1400074ba
mov ebx, eax
add rbx, r14
je 0x1400074ba
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400074ba
cmp rbx, r14
jb 0x1400072bc
lea rax, [r14 + rdi]
cmp rbx, rax
jae 0x1400072bc
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x1400072d0
sub ebx, r14d
jmp 0x1400072d2
cmp rbx, rdi
jae 0x1400074ba
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x14000741a
mov edx, 0x40
mov rcx, r14
call fcn.1400078d0
test al, al
jne 0x14000741a
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x14000741a
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x14000741a
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x14000741a
cmp dword [rdi], 0x4550
jne 0x14000741a
test rdi, rdi
je 0x14000741a
mov edx, 0xf8
mov rcx, rdi
call fcn.1400078d0
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x140007429
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x140007420
test rcx, rcx
je 0x1400074b3
cmp rcx, r14
jb 0x1400074b3
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x1400074b3
cmp rbx, 8
jb 0x1400074b3
cmp rbx, rax
jb 0x1400074b3
mov rcx, r14
call fcn.140006830
xor edi, edi
lea rcx, [r14 - 8]
add rcx, rbx
je 0x1400074b5
cmp rcx, r14
jb 0x1400074b5
cmp rbx, rbp
ja 0x1400074b5
cmp rbx, 8
jb 0x1400074b5
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x1400074b5
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400074b5
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140007404
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x1400073a2
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140007720
inc rdi
add rbx, 8
jmp 0x1400073a2
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x1400074b3
test rcx, rcx
je 0x1400074b3
cmp rcx, r14
jb 0x1400074b3
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x1400074b3
cmp rbx, 4
jb 0x1400074b3
cmp rbx, rax
jb 0x1400074b3
mov rcx, r14
call fcn.140006830
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x1400074b5
cmp rcx, r14
jb 0x1400074b5
cmp rbx, rbp
ja 0x1400074b5
cmp rbx, 4
jb 0x1400074b5
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x1400074b5
mov eax, dword [rcx]
test eax, eax
je 0x1400074b5
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x14000749d
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140007455
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140007720
inc rdi
add rbx, 4
jmp 0x140007455
xor edi, edi
mov rax, rdi
jmp 0x1400074bc
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400083e0
Capabilities:
Reference processor manufacturer constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x170
mov rax, qword [0x140299ac0]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x50]
call fcn.140049a20
lea rcx, [rsp + 0x50]
call fcn.140009430
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r15b
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
mov dl, 0xa
call fcn.1400049b0
movzx r8d, al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140009ea0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x140008570
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
cmp rdi, 6
jb 0x140008500
lea rsi, [rdi + rbx]
lea r8, [rsi - 5]
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.140049ea0
test rax, rax
je 0x140008500
cmp dword [rax], 0x61774d56
jne 0x1400084d5
cmp word [rax + 4], 0x6572
je 0x1400084f3
inc rax
lea r8, [rsi - 5]
sub r8, rax
mov edx, 0x56
mov rcx, rax
call fcn.140049ea0
test rax, rax
jne 0x1400084c5
jmp 0x140008500
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x140008602
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0xf
cmova rbx, qword [rsp + 0x30]
cmp rdi, 0xa
jb 0x140008570
lea r8, [rdi - 9]
add r8, rbx
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.140049ea0
test rax, rax
je 0x140008570
movabs rsi, 0x426c617574726956
nop dword [rax]
cmp qword [rax], rsi
jne 0x140008551
cmp word [rax + 8], 0x786f
je 0x1400085f5
inc rax
lea r8, [rdi - 9]
add r8, rbx
sub r8, rax
mov edx, 0x56
mov rcx, rax
call fcn.140049ea0
test rax, rax
jne 0x140008540
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400085ab
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008609
call fcn.14003db0c
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.140008610
movzx eax, bl
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14003dac0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140008570
mov bl, 1
jmp 0x140008572
call fcn.14002af5c
int3
Function at 0x140008ad0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140008af4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x140008b82
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008b50
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x140008b50
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140049380
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140008b6d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140008b75
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x140008b11
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x140008c60
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140008b99
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008b9b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008bcd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140049380
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140008c5d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008c08
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x140008c3e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14002c5b0
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x140008c5d
cmp rsi, rax
ja 0x140008c11
test rsi, rsi
je 0x140008c5d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14002c5b0
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x140010740
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140299ac0]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor esi, esi
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400107f0
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov r14, rbx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x3c]
mov edx, 0x14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x1400107f0
cmp dword [rsp + 0x3c], esi
setne sil
test r14, r14
je 0x140010801
mov rcx, rbx
mov rax, qword [0x14008c340]
call rax
test esi, esi
je 0x140010833
mov rsi, qword gs:[0x60]
test rsi, rsi
je 0x140010833
mov rbx, qword [rsi + 0x38]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rsi + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.1400019b0
mov eax, ebp
test rbp, rbp
jne 0x140010851
mov rcx, rdi
call fcn.140006830
test eax, eax
je 0x14001085b
mov edx, eax
mov rcx, rdi
call fcn.1400022e0
mov rdx, rbp
mov rcx, rdi
call fcn.1400074d0
test rdi, rdi
je 0x140010935
mov edx, 0x40
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140010935
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x140010935
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140010935
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.1400078d0
test al, al
jne 0x140010935
cmp dword [rsi], 0x4550
jne 0x140010935
test rsi, rsi
je 0x140010935
mov edx, 0x40
mov rcx, rdi
call fcn.1400078d0
test al, al
jne 0x140010913
cmp word [rdi], bx
jne 0x140010913
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140010913
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
test al, al
jne 0x140010913
cmp dword [rbx], 0x4550
jne 0x140010913
test rbx, rbx
je 0x140010913
mov edx, 0xf8
mov rcx, rbx
call fcn.1400078d0
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x140010935
add rax, rdi
test r15b, r15b
je 0x140010931
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
jmp 0x14001093a
call rax
jmp 0x14001093a
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003dac0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400244b0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x140056010]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x140056020]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x140056030]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x140024685
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x1400245ad
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x140024550
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14002460e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x1400245d0
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x140024510
test r9, r9
jne 0x140024500
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x1400246d1
test r9, r9
je 0x1400246a8
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x140024690
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret