joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009650
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r14, rcx
call fcn.140008c20
test eax, eax
je 0x1400098d8
mov edi, eax
test rbp, rbp
jne 0x140009681
mov ebp, edi
mov edx, 9
mov rcx, r14
call fcn.140008a20
test rax, rax
je 0x1400098d8
mov eax, dword [rax]
test eax, eax
je 0x1400098d8
mov ebx, eax
add rbx, r14
je 0x1400098d8
mov rbx, qword [rbx + 0x18]
test rbx, rbx
je 0x1400098d8
cmp rbx, r14
jb 0x1400096dc
lea rax, [rdi + r14]
cmp rbx, rax
jae 0x1400096dc
mov rax, rbx
mov ecx, 0xffffffff
sub rax, r14
cmp rax, rcx
jae 0x1400096f0
sub ebx, r14d
jmp 0x1400096f2
cmp rbx, rdi
jae 0x1400098d8
mov ecx, 0xffffffff
cmp rbx, rcx
cmovb ecx, ebx
mov ebx, ecx
test r14, r14
je 0x140009838
mov edx, 0x40
mov rcx, r14
call fcn.140009d00
test al, al
jne 0x140009838
mov eax, 0x5a4d
cmp word [r14], ax
jne 0x140009838
movsxd rax, dword [r14 + 0x3c]
cmp eax, 0x400
jg 0x140009838
lea rdi, [r14 + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140009838
cmp dword [rdi], 0x4550
jne 0x140009838
mov edx, 0xf8
mov rcx, rdi
call fcn.140009d00
test al, al
mov eax, ebx
lea rcx, [rax + r14]
jne 0x140009847
mov edx, 0x20b
cmp word [rdi + 0x18], dx
jne 0x14000983e
test rcx, rcx
je 0x1400098d1
cmp rcx, r14
jb 0x1400098d1
lea rbx, [rax + 8]
cmp rbx, rbp
ja 0x1400098d1
cmp rbx, 8
jb 0x1400098d1
cmp rbx, rax
jb 0x1400098d1
mov rcx, r14
call fcn.140008c20
xor edi, edi
nop dword [rax]
lea rcx, [r14 - 8]
add rcx, rbx
je 0x1400098d3
cmp rcx, r14
jb 0x1400098d3
cmp rbx, rbp
ja 0x1400098d3
cmp rbx, 8
jb 0x1400098d3
lea rax, [rbx - 8]
cmp rbx, rax
jb 0x1400098d3
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1400098d3
mov rdx, qword [rsi + 8]
cmp rdx, qword [rsi + 0x10]
je 0x140009822
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 8
jmp 0x1400097c0
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140009b40
inc rdi
add rbx, 8
jmp 0x1400097c0
mov eax, ebx
lea rcx, [r14 + rax]
test r14, r14
je 0x1400098d1
test rcx, rcx
je 0x1400098d1
cmp rcx, r14
jb 0x1400098d1
lea rbx, [rax + 4]
cmp rbx, rbp
ja 0x1400098d1
cmp rbx, 4
jb 0x1400098d1
cmp rbx, rax
jb 0x1400098d1
mov rcx, r14
call fcn.140008c20
xor edi, edi
lea rcx, [r14 - 4]
add rcx, rbx
je 0x1400098d3
cmp rcx, r14
jb 0x1400098d3
cmp rbx, rbp
ja 0x1400098d3
cmp rbx, 4
jb 0x1400098d3
lea rax, [rbx - 4]
cmp rbx, rax
jb 0x1400098d3
mov eax, dword [rcx]
test eax, eax
je 0x1400098d3
mov rdx, qword [rsi + 8]
mov qword [rsp + 0x40], rax
cmp rdx, qword [rsi + 0x10]
je 0x1400098bb
mov qword [rdx], rax
inc rdi
add qword [rsi + 8], 8
add rbx, 4
jmp 0x140009873
lea r8, [rsp + 0x40]
mov rcx, rsi
call fcn.140009b40
inc rdi
add rbx, 4
jmp 0x140009873
xor edi, edi
mov rax, rdi
jmp 0x1400098da
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14000aa60
Capabilities:
Reference processor manufacturer constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x170
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x50]
call fcn.140046050
lea rcx, [rsp + 0x50]
call fcn.14000ba70
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r15b
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
mov dl, 0xa
call fcn.140006960
movzx r8d, al
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000c4c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14000abe0
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
cmp rdi, 6
jb 0x14000ab71
lea rsi, [rdi + rbx]
lea r8, [rsi - 5]
sub r8, rbx
mov rcx, rbx
mov edx, 0x56
call fcn.1400523f0
test rax, rax
je 0x14000ab71
cmp dword [rax], 0x61774d56
jne 0x14000ab55
cmp word [rax + 4], 0x6572
je 0x14000ab64
inc rax
lea r8, [rsi - 5]
sub r8, rax
mov rcx, rax
jmp 0x14000ab36
sub rax, rbx
cmp rax, 0xffffffffffffffff
jne 0x14000ac72
lea rbx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rbx, qword [rsp + 0x30]
cmp rdi, 0xa
jb 0x14000abe0
lea r8, [rdi - 9]
add r8, rbx
sub r8, rbx
mov edx, 0x56
mov rcx, rbx
call fcn.1400523f0
test rax, rax
je 0x14000abe0
movabs rsi, 0x426c617574726956
nop
cmp qword [rax], rsi
jne 0x14000abc1
cmp word [rax + 8], 0x786f
je 0x14000ac65
inc rax
lea r8, [rdi - 9]
add r8, rbx
sub r8, rax
mov edx, 0x56
mov rcx, rax
call fcn.1400523f0
test rax, rax
jne 0x14000abb0
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ac1b
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ac16
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ac79
call fcn.140043a2c
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
call fcn.14000ac80
movzx eax, bl
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400439e0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r15
ret
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x14000abe0
mov bl, 1
jmp 0x14000abe2
call fcn.140030524
int3
Function at 0x14000b130
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000b152
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000b1cc
mov rdi, r14
mov rcx, rbx
call fcn.140005050
test rax, rax
jle 0x14000b1a4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400459a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000b1bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000b1c4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000b166
sub r14, rdi
jmp 0x14000b2af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b1e3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b1e5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b217
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400459a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000b2ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000b252
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000b28d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140031b4c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000b2ac
cmp rbp, rax
ja 0x14000b260
test rbp, rbp
je 0x14000b2ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140031b4c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140013330
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx r14d, r8b
mov rsi, rdx
mov rdi, rcx
mov rbp, qword gs:[0x60]
test rbp, rbp
je 0x14001337a
mov rbx, qword [rbp + 0x38]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rbp + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.140001a60
mov eax, esi
test rsi, rsi
jne 0x140013398
mov rcx, rdi
call fcn.140008c20
test eax, eax
je 0x1400133a2
mov edx, eax
mov rcx, rdi
call fcn.140002380
mov rdx, rsi
mov rcx, rdi
call fcn.1400098f0
test rdi, rdi
je 0x140013471
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140013471
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x140013471
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140013471
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140009d00
test al, al
jne 0x140013471
cmp dword [rsi], 0x4550
jne 0x140013471
mov edx, 0x40
mov rcx, rdi
call fcn.140009d00
test al, al
jne 0x140013450
cmp word [rdi], bx
jne 0x140013450
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140013450
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
test al, al
jne 0x140013450
cmp dword [rbx], 0x4550
jne 0x140013450
mov edx, 0xf8
mov rcx, rbx
call fcn.140009d00
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x140013471
add rax, rdi
test r14b, r14b
je 0x14001346d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rdi
call rax
jmp 0x140013476
call rax
jmp 0x140013476
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14001f510
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x13f0]
mov eax, 0x14f0
call fcn.140044740
sub rsp, rax
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rbp + 0x13e0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea rcx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rsp + 0x30], rcx
lea rax, [fcn.1400038b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
mov qword [rbp - 0x58], rbx
mov qword [rsp + 0x70], rcx
lea rax, [fcn.14001f0e0]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x50], rcx
lea rax, [fcn.14001f1b0]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x28], rbx
mov qword [rbp - 0x10], rcx
lea rax, [fcn.1400038b0]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x30]
call fcn.1400108b0
nop
lea r9, [0x140010580]
lea edx, [rbx + 0x40]
lea r8d, [rbx + 4]
lea rcx, [rsp + 0x30]
call fcn.140043a80
call fcn.14004b768
mov dword [rbp + 0x13d4], 0xffffffff
mov dword [rbp + 0x54], eax
lea ecx, [rbx + 1]
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [rbp + rcx*4 + 0x54], eax
inc rcx
cmp rcx, 0x270
jb 0x14001f620
mov dword [rbp + 0x50], 0x270
lea r8, [rbp + 0x50]
mov rdx, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x30]
call fcn.14001f6e0
call fcn.140031fa0
and eax, 0x80000003
jge 0x14001f66a
dec eax
or eax, 0xfffffffc
inc eax
inc eax
movsxd rsi, eax
test eax, eax
jle 0x14001f6a0
mov rdi, rbx
nop word [rax + rax]
mov rax, qword [rbp + 0x30]
mov rcx, qword [rdi + rax + 0x38]
test rcx, rcx
je 0x14001f6d1
mov rax, qword [rcx]
call qword [rax + 0x10]
inc rbx
add rdi, 0x40
cmp rbx, rsi
jl 0x14001f680
lea rcx, [rbp + 0x30]
call fcn.140010c40
mov rcx, qword [rbp + 0x13e0]
xor rcx, rsp
call fcn.1400439e0
lea r11, [rsp + 0x14f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14004a3a0
nop
int3
Function at 0x14001f830
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14001f891
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x14001f850
mov ecx, dword [r10]
jmp 0x14001f97a
cmp ecx, 0x4e0
jb 0x14001f97a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001f8b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14001f900
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400287f0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x14005e050]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x14005e060]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x14005e070]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x1400289c5
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x1400288ed
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x140028890
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14002894e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x140028910
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x140028850
test r9, r9
jne 0x140028840
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x140028a11
test r9, r9
je 0x1400289e8
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x1400289d0
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x140028a80
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x140028a9e
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x140028cdf
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x14005e440]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x14005e420]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x14005e400]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x140028c2f
cmp r9, 0x20
jb 0x140028c03
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x140028b7a
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x140028b5a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x140028b40
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x140028b10
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x140028af6
jmp 0x140028cbd
test ecx, ecx
mov ecx, eax
je 0x140028c1c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.1400287f0
jmp 0x140028cbd
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.140027d10
jmp 0x140028cbd
test ecx, ecx
je 0x140028c6e
test r9, r9
je 0x140028c58
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x140028c40
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x140028ca8
test r9, r9
je 0x140028c94
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x140028c80
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x140038d24
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140038d56
call fcn.1400322f8
mov dword [rax], 0x16
call fcn.140030504
jmp 0x140038e75
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140038e75
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140038e75
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140038d85
lock or dword [rcx + 0x14], 0x10
jmp 0x140038e75
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140038d99
call fcn.140039420
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.140035c9c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140039938
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140038e63
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x140038e2e
mov rcx, rsi
call fcn.140035c9c
cmp eax, edi
je 0x140038e19
mov rcx, rsi
call fcn.140035c9c
cmp eax, 0xfffffffe
je 0x140038e19
mov rcx, rsi
call fcn.140035c9c
movsxd rbx, eax
lea r14, [0x14012b890]
mov rcx, rsi
sar rbx, 6
call fcn.140035c9c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140038e20
lea rdx, [0x14012a3d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140038e2e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x140038e52
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x140038e52
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x140038e52
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140038e78
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x1400391a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140044740
sub rsp, rax
mov rax, qword [0x14012aab8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140035c9c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400391ef
mov rax, rbp
jmp 0x1400392f7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x12b890]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14003a110
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x12b890]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400392f3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400392f3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14003a110
test rax, rax
js 0x1400392f3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400392f3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400392e5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400392e5
cmp byte [rcx], 0xd
jne 0x1400392cb
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x1400392da
cmp byte [rcx + 1], 0xa
jne 0x1400392da
inc rcx
jmp 0x1400392da
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x12a430]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x1400392ad
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400392f7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1400439e0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret