joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001070
Capabilities:
Parse pe header

Disassembly:
push rdi
push r14
sub rsp, 0x68
mov rax, qword [0x140280a80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov rdi, rcx
mov edx, 0xd
call fcn.140003c20
test rax, rax
jne 0x1400010a3
mov al, 1
jmp 0x140001274
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x60], rbp
test rdi, rdi
je 0x140001265
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140001265
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x140001265
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140001265
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140001265
cmp dword [rbx], 0x4550
jne 0x140001265
test rbx, rbx
je 0x140001265
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140001265
mov eax, 0x20b
cmp word [rbx + 0x18], ax
jne 0x140001265
mov rcx, rdi
call fcn.140003e40
mov ebp, eax
mov edx, 0xd
lea rax, vtable.peconv::default_func_resolver.0
mov rcx, rdi
mov qword [rsp + 0x40], rax
call fcn.140003c20
test rax, rax
je 0x140001265
mov ebx, dword [rax]
mov edx, dword [rax + 4]
lea rcx, [rbx + rdi]
cmp edx, 0x20
jb 0x140001265
test rcx, rcx
je 0x140001265
cmp rcx, rdi
jb 0x140001265
lea rax, [rbx + 0x20]
cmp rax, rbp
ja 0x140001265
cmp rax, 0x20
jb 0x140001265
cmp rax, rbx
jb 0x140001265
mov qword [rsp + 0x50], r15
mov r8b, 1
mov r15d, edx
shr r15, 5
test r15, r15
je 0x14000125a
add rbx, 0x20
mov qword [rsp + 0x58], rsi
xor esi, esi
lea rdx, [rdi - 0x20]
add rdx, rbx
je 0x140001255
cmp rdx, rdi
jb 0x140001255
cmp rbx, rbp
ja 0x140001255
cmp rbx, 0x20
jb 0x140001255
lea rax, [rbx - 0x20]
cmp rbx, rax
jb 0x140001255
mov eax, dword [rdi + rbx - 0x1c]
test eax, eax
je 0x140001255
cmp rax, r14
jbe 0x140001202
sub rax, r14
lea r9, [rdi + rax]
test r9, r9
je 0x140001245
cmp r9, rdi
jb 0x140001245
lea rcx, [rax + 1]
cmp rcx, rbp
ja 0x140001245
cmp rcx, 1
jb 0x140001245
cmp rcx, rax
jb 0x140001245
lea rax, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov qword [rsp + 0x28], rdx
mov rdx, rbp
call fcn.140001290
movzx r8d, al
inc rsi
add rbx, 0x20
cmp rsi, r15
jb 0x1400011d0
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
movzx eax, r8b
jmp 0x140001267
xor al, al
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002cbc0
add rsp, 0x68
pop r14
pop rdi
ret
Function at 0x140001470
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, r8
mov r13, rdx
mov r12, rcx
xor edi, edi
cmp qword [r8], rdi
je 0x1400015b4
mov r8, qword [r8 + 8]
test r8, r8
je 0x1400015b4
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400014cc
inc rcx
mov qword [rbx + 0x10], rcx
mov rax, qword [rbx + 0x18]
dec rax
mov qword [rbx + 0x18], rax
jmp 0x140001548
mov rcx, r12
call qword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov r15, rax
mov qword [rsp + 0x28], rdi
test rax, rax
je 0x1400015ad
movzx esi, word [rax + 0x14]
add rsi, 0x18
add rsi, rax
mov qword [rsp + 0x28], rsi
movzx r14d, di
mov word [rsp + 0x20], di
nop
cmp r14w, word [r15 + 6]
jae 0x14000152d
mov r8d, 8
mov rdx, rsi
mov rcx, r13
call fcn.14001f588
test eax, eax
jne 0x140001586
mov eax, dword [rsi + 0xc]
add rax, r12
mov qword [rbx + 0x10], rax
mov eax, dword [rsi + 8]
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000159e
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14000159e
mov r8, qword [rbx + 8]
cmp rax, r8
jb 0x14000159e
mov r14, rcx
sub r14, r8
add r14, rax
cmp rcx, r14
ja 0x14000159e
mov rsi, qword [rbx + 8]
mov rdx, rcx
mov rcx, qword [rbx]
call qword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp rax, rsi
je 0x1400015c5
mov rcx, qword [rbx + 0x10]
inc rcx
mov qword [rbx + 0x10], rcx
mov rax, qword [rbx + 0x18]
dec rax
mov qword [rbx + 0x18], rax
mov r8, rsi
jmp 0x140001551
add rsi, 0x28
mov qword [rsp + 0x28], rsi
inc r14w
mov word [rsp + 0x20], r14w
jmp 0x140001500
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov edi, 0xc0000225
jmp 0x1400015c1
mov edi, 0xc00000ef
jmp 0x1400015c1
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
mov edi, 0xc000000d
mov dword [rsp + 0x24], edi
jmp 0x1400015cd
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x1400019a0
Capabilities:
Check os version

Disassembly:
push rbp
push rbx
push r12
push r13
mov rbp, rsp
sub rsp, 0x48
mov rax, qword [0x140280a80]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r13d, edx
mov r12, rcx
call fcn.1400016c0
mov rbx, rax
test rax, rax
jne 0x1400019d9
mov eax, 0xc00000bb
jmp 0x140001bb3
xor eax, eax
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
lea r8, [rbp - 0x20]
mov qword [rbp - 0x28], rax
lea rdi, [rbp - 0x28]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov qword [rsp + 0x40], r15
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
xor esi, esi
cmp dword [rbp - 0x28], 6
jne 0x140001a27
cmp dword [rbp - 0x24], 3
jne 0x140001a27
mov r15d, 1
jmp 0x140001a2b
seta r15b
test r15b, r15b
je 0x140001a45
mov rdx, rbx
mov ecx, 4
call fcn.1400015f0
test eax, eax
js 0x140001ba1
xor eax, eax
mov qword [rsp + 0x88], r14
mov r14d, dword [rbx]
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
mov dword [rbp - 0x18], esi
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x140001a8c
cmp dword [rbp - 0x24], 2
jne 0x140001a8c
mov eax, 1
jmp 0x140001a8f
seta al
movzx edi, al
cmp r14d, dword [rbx + 4]
je 0x140001b24
test r14d, r14d
je 0x140001af1
cmp edi, r14d
jae 0x140001ac2
lea rax, [rdi + 1]
lea rcx, [rax + rax*2]
lea rax, [rbx + rcx*8]
cmp r12, qword [rax]
jb 0x140001ac4
inc edi
add rax, 0x18
cmp edi, r14d
jb 0x140001ab2
je 0x140001af1
lea eax, [rdi + 1]
sub r14d, edi
mov ecx, eax
lea rdx, [rdi + 1]
add rcx, 2
lea rdx, [rdi + rdx*2]
lea rdx, [rbx + rdx*8]
lea r8, [r14 + r14*2]
shl r8, 3
lea rax, [rcx + rax*2]
lea rcx, [rbx + rax*8]
call fcn.140035e30
lea rcx, [rdi + rdi*2]
mov r8d, 3
lea rdi, [rbx + rcx*8]
mov dl, 1
mov rcx, r12
lea r9, [rbp - 0x18]
call qword [sym.imp.ntdll.dll_RtlImageDirectoryEntryToData]
mov qword [rdi + 0x10], rax
mov eax, dword [rbp - 0x18]
mov dword [rdi + 0x24], eax
mov qword [rdi + 0x18], r12
mov dword [rdi + 0x20], r13d
inc dword [rbx]
jmp 0x140001b38
test al, al
je 0x140001b31
mov dword [rbx + 0xc], 1
jmp 0x140001b38
mov dword [rbx + 8], 1
mov r14, qword [rsp + 0x88]
test r15b, r15b
je 0x140001b56
mov rdx, rbx
mov ecx, 2
call fcn.1400015f0
test eax, eax
js 0x140001ba1
xor eax, eax
lea rdi, [rbp - 0x28]
mov qword [rbp - 0x28], rax
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], eax
lea rdx, [rbp - 0x24]
mov ecx, 0xc
rep stosb byte [rdi], al
lea rcx, [rbp - 0x28]
call qword [sym.imp.ntdll.dll_RtlGetNtVersionNumbers]
cmp dword [rbp - 0x28], 6
jne 0x140001b88
cmp dword [rbp - 0x24], 2
je 0x140001b90
seta sil
test esi, esi
je 0x140001b95
mov eax, dword [rbx + 0xc]
jmp 0x140001b98
mov eax, dword [rbx + 8]
neg eax
sbb eax, eax
and eax, 0xc0000017
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14002cbc0
add rsp, 0x48
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x1400035d0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x140280a80]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rdx
mov rbx, rcx
call fcn.140003e40
mov ebp, eax
test eax, eax
je 0x140003796
test rbx, rbx
je 0x140003796
mov edx, 0x40
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140003796
mov r15d, 0x5a4d
cmp word [rbx], r15w
jne 0x140003796
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003796
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003796
cmp dword [rdi], 0x4550
jne 0x140003796
test rdi, rdi
je 0x140003796
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003796
mov r12d, 0x20b
cmp word [rdi + 0x18], r12w
jne 0x140003796
mov qword [rsp + 0x98], r14
lea rax, vtable.peconv::default_func_resolver.0
test rsi, rsi
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
cmovne r14, rsi
mov qword [rsp + 0x38], rbp
xor esi, esi
mov edx, 0x40
mov rcx, rbx
mov dword [rsp + 0x41], esi
mov word [rsp + 0x45], si
mov byte [rsp + 0x47], sil
call fcn.140004f00
test al, al
jne 0x140003728
cmp word [rbx], r15w
jne 0x140003728
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x400
jg 0x140003728
lea rdi, [rbx + rax]
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003728
cmp dword [rdi], 0x4550
jne 0x140003728
test rdi, rdi
je 0x140003728
mov edx, 0xf8
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140003728
movzx esi, word [rdi + 0x18]
lea rax, vtable.FillImportThunks.0
mov qword [rsp + 0x48], r14
cmp si, r12w
mov qword [rsp + 0x28], rax
mov edx, 1
mov rcx, rbx
sete byte [rsp + 0x40]
call fcn.140003c20
mov r14, qword [rsp + 0x98]
test rax, rax
jne 0x140003760
mov al, 1
jmp 0x140003798
mov ecx, dword [rax]
lea r8, [rcx + rbx]
test r8, r8
je 0x140003796
cmp r8, rbx
jb 0x140003796
lea rax, [rcx + 0x14]
cmp rax, rbp
ja 0x140003796
cmp rax, 0x14
jb 0x140003796
cmp rax, rcx
jb 0x140003796
lea r9, [rsp + 0x28]
mov rdx, rbp
mov rcx, rbx
call fcn.140003200
jmp 0x140003798
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14002cbc0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004350
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
test rcx, rcx
je 0x14000455c
test r8, r8
je 0x14000455c
call fcn.140003950
mov r15, rax
test rax, rax
je 0x14000455c
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x1400043f9
mov eax, 0x5a4d
cmp word [rdi], ax
jne 0x1400043f9
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x1400043f9
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x1400043f9
cmp dword [rbx], 0x4550
jne 0x1400043f9
test rbx, rbx
je 0x1400043f9
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x1400043f9
mov eax, 0x20b
movzx eax, word [r15 + 0x14]
xor r11d, r11d
add rax, r15
mov r14d, r11d
movzx ebp, r11w
lea rdx, [rax + 0x18]
mov eax, dword [r15 + 0x54]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x60], eax
cmp r11w, word [r15 + 6]
jae 0x14000453f
nop word [rax + rax]
movzx eax, bp
lea rcx, [rax + rax*4]
lea rbx, [rdx + rcx*8]
test rbx, rbx
je 0x14000455c
cmp rbx, rdi
jb 0x14000455c
mov rcx, rbx
sub rcx, rdi
lea rax, [rcx + 0x28]
cmp rax, r13
ja 0x14000455c
cmp rax, 0x28
jb 0x14000455c
cmp rax, rcx
jb 0x14000455c
cmp rax, rsi
ja 0x14000455c
mov ecx, dword [rbx + 0x14]
test ecx, ecx
je 0x14000452d
mov eax, dword [rbx + 0x10]
test eax, eax
je 0x14000452d
mov r9d, dword [rbx + 0xc]
mov edx, ecx
mov r8d, eax
add rcx, rdi
add rax, r9
lea r10, [r9 + r12]
cmp rax, rsi
jbe 0x1400044ba
mov rax, rsi
mov r8, r11
sub rax, r9
cmp rsi, r9
cmova r8, rax
cmp r9, rsi
jb 0x1400044c8
test r8, r8
jne 0x14000455c
lea rax, [rdx + r8]
cmp rax, rsi
ja 0x14000455c
test rcx, rcx
je 0x140004528
cmp rcx, rdi
jb 0x140004528
cmp rax, r13
ja 0x140004528
cmp rax, r8
jb 0x140004528
cmp rax, rdx
jb 0x140004528
test r10, r10
je 0x140004528
cmp r10, r12
jb 0x140004528
lea rax, [r9 + r8]
cmp rax, rsi
ja 0x140004528
cmp rax, r8
jb 0x140004528
cmp rax, r9
jb 0x140004528
mov rdx, rcx
mov rcx, r10
call fcn.140035e30
test r14d, r14d
je 0x140004521
cmp dword [rbx + 0x14], r14d
jae 0x140004525
mov r14d, dword [rbx + 0x14]
xor r11d, r11d
mov rdx, qword [rsp + 0x20]
inc bp
cmp bp, word [r15 + 6]
jb 0x140004430
mov eax, dword [rsp + 0x60]
test eax, eax
cmove eax, r14d
mov r8d, eax
cmp r8, rsi
ja 0x14000455c
mov rdx, rdi
mov rcx, r12
call fcn.140035e30
mov al, 1
jmp 0x14000455e
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140007a80
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140280a80]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx r15d, r8b
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
xor ebx, ebx
mov qword [rsp + 0x40], rbx
xor esi, esi
xor r14d, r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140007b30
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov r14, rbx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0x3c]
mov edx, 0x14
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140007b30
cmp dword [rsp + 0x3c], esi
setne sil
test r14, r14
je 0x140007b41
mov rcx, rbx
mov rax, qword [0x140076200]
call rax
test esi, esi
je 0x140007b73
mov rsi, qword gs:[0x60]
test rsi, rsi
je 0x140007b73
mov rbx, qword [rsi + 0x38]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop
mov qword [rsi + 0x10], rdi
mov rcx, rbx
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov rdx, rdi
mov rcx, rdi
call fcn.140001070
mov eax, ebp
test rbp, rbp
jne 0x140007b91
mov rcx, rdi
call fcn.140003e40
test eax, eax
je 0x140007b9b
mov edx, eax
mov rcx, rdi
call fcn.1400019a0
mov rdx, rbp
mov rcx, rdi
call fcn.140004ae0
test rdi, rdi
je 0x140007c75
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140007c75
mov ebx, 0x5a4d
cmp word [rdi], bx
jne 0x140007c75
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007c75
lea rsi, [rdi + rax]
mov edx, 0xf8
mov rcx, rsi
call fcn.140004f00
test al, al
jne 0x140007c75
cmp dword [rsi], 0x4550
jne 0x140007c75
test rsi, rsi
je 0x140007c75
mov edx, 0x40
mov rcx, rdi
call fcn.140004f00
test al, al
jne 0x140007c53
cmp word [rdi], bx
jne 0x140007c53
movsxd rax, dword [rdi + 0x3c]
cmp eax, 0x400
jg 0x140007c53
lea rbx, [rdi + rax]
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
test al, al
jne 0x140007c53
cmp dword [rbx], 0x4550
jne 0x140007c53
test rbx, rbx
je 0x140007c53
mov edx, 0xf8
mov rcx, rbx
call fcn.140004f00
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x140007c75
add rax, rdi
test r15b, r15b
je 0x140007c71
xor r8d, r8d
mov edx, 1
mov rcx, rdi
call rax
jmp 0x140007c7a
call rax
jmp 0x140007c7a
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002cbc0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14001ba30
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov ebx, ecx
movaps xmmword [rsp + 0x30], xmm7
mov r10, rdx
movdqa xmm7, xmmword [0x140040f10]
mov edi, 0x15b0
movaps xmmword [rsp + 0x20], xmm8
movdqa xmm8, xmmword [0x140040f20]
movaps xmmword [rsp + 0x10], xmm9
movaps xmmword [rsp], xmm10
movdqa xmm10, xmmword [0x140040f30]
shr ebx, 0x10
movzx r11d, cx
cmp r9, 0x10
jb 0x14001bc05
xorps xmm5, xmm5
nop dword [rax]
cmp r9, rdi
movd xmm3, r11d
mov rax, r9
movd xmm9, ebx
cmova rax, rdi
movdqa xmm6, xmm5
and rax, 0xfffffffffffffff0
movdqa xmm4, xmm5
sub r9, rax
cmp rax, 0x20
jb 0x14001bb2d
mov rdx, rax
shr rdx, 5
imul rcx, rdx, 0xffffffffffffffe0
add rax, rcx
nop word [rax + rax]
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
add r8, 0x20
movdqa xmm0, xmm1
paddd xmm6, xmm3
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
movdqu xmmword [r10 + 0x10], xmm2
add r10, 0x20
pmaddubsw xmm1, xmm10
paddd xmm3, xmm0
movdqa xmm0, xmm2
pmaddubsw xmm2, xmm8
psadbw xmm0, xmm5
pmaddwd xmm1, xmm7
pmaddwd xmm2, xmm7
paddd xmm3, xmm0
paddd xmm9, xmm1
paddd xmm4, xmm2
sub rdx, 1
jne 0x14001bad0
pslld xmm6, 5
paddd xmm4, xmm9
paddd xmm4, xmm6
movdqa xmm6, xmm5
cmp rax, 0x10
jb 0x14001bb8e
movdqa xmm2, xmm3
shr rax, 4
nop dword [rax]
movdqu xmm1, xmmword [r8]
add r8, 0x10
paddd xmm6, xmm2
movdqa xmm0, xmm1
psadbw xmm0, xmm5
movdqu xmmword [r10], xmm1
add r10, 0x10
paddd xmm3, xmm0
movdqa xmm0, xmm1
pmaddubsw xmm0, xmm8
movdqa xmm2, xmm3
pmaddwd xmm0, xmm7
paddd xmm4, xmm0
sub rax, 1
jne 0x14001bb50
movdqa xmm0, xmm3
pslld xmm6, 4
psrldq xmm0, 8
paddd xmm6, xmm4
paddd xmm0, xmm3
mov eax, 0x80078071
movd r11d, xmm0
movdqa xmm1, xmm6
punpckhqdq xmm1, xmm6
paddd xmm1, xmm6
mul r11d
pshufd xmm0, xmm1, 1
paddd xmm0, xmm1
movd ebx, xmm0
shr edx, 0xf
imul eax, edx, 0xfff1
sub r11d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x10
jae 0x14001ba90
test r9, r9
jne 0x14001ba80
shl ebx, 0x10
or ebx, r11d
mov eax, ebx
jmp 0x14001bc51
test r9, r9
je 0x14001bc28
sub r8, r10
nop dword [rax]
movzx eax, byte [r8 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r11d, eax
add ebx, r11d
sub r9, 1
jne 0x14001bc10
mov eax, 0x80078071
mul r11d
mov eax, 0x80078071
shr edx, 0xf
imul ecx, edx, 0xfff1
mul ebx
sub r11d, ecx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r11d
mov rbx, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x10]
movaps xmm10, xmmword [rsp]
add rsp, 0x50
pop rdi
ret
Function at 0x14001bcc0
Capabilities:
Compute adler32 checksum

Disassembly:
sub rsp, 0x68
mov r11, r8
mov r10, rdx
mov eax, ecx
test r8, r8
jne 0x14001bcde
mov eax, 1
vzeroupper
add rsp, 0x68
ret
test r9, r9
je 0x14001bf1f
mov qword [rsp + 0x70], rbx
mov ebx, ecx
mov qword [rsp + 0x60], rdi
mov edi, 0x15b0
vmovaps xmmword [rsp + 0x50], xmm6
vmovaps xmmword [rsp + 0x40], xmm7
vmovdqu ymm7, ymmword [0x140041300]
vmovaps xmmword [rsp + 0x30], xmm8
vmovdqu ymm8, ymmword [0x1400412e0]
vmovaps xmmword [rsp + 0x20], xmm9
vmovdqu ymm9, ymmword [0x1400412c0]
movzx r8d, cx
mov ecx, dword [rsp + 0x90]
shr ebx, 0x10
cmp r9, 0x10
jb 0x14001be6f
cmp r9, 0x20
jb 0x14001be43
vpxor xmm6, xmm6, xmm6
nop
cmp r9, rdi
mov rax, r9
vmovd xmm2, r8d
cmova rax, rdi
and rax, 0xffffffffffffffe0
sub r9, rax
vmovd xmm3, ebx
vmovdqu ymm5, ymm2
vmovdqu ymm4, ymm6
cmp rax, 0x20
jb 0x14001bdba
shr rax, 5
nop dword [rax]
vmovdqu ymm0, ymmword [r11]
add r11, 0x20
vpsadbw ymm1, ymm0, ymm6
test ecx, ecx
je 0x14001bd9a
vmovdqu ymmword [r10], ymm0
add r10, 0x20
vpaddd ymm2, ymm1, ymm2
vpmaddubsw ymm0, ymm0, ymm7
vpmaddwd ymm1, ymm0, ymm8
vpaddd ymm4, ymm4, ymm5
vpaddd ymm3, ymm1, ymm3
vmovdqu ymm5, ymm2
sub rax, 1
jne 0x14001bd80
vpermd ymm1, ymm9, ymm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
vpshufd xmm1, xmm2, 1
vpaddd xmm0, xmm1, xmm2
vmovd r8d, xmm0
vpslld ymm0, ymm4, 5
vpaddd ymm2, ymm0, ymm3
vextracti128 xmm1, ymm2, 1
vpaddd xmm1, xmm1, xmm2
vpunpckhqdq xmm0, xmm1, xmm1
vpaddd xmm2, xmm0, xmm1
mov eax, 0x80078071
mul r8d
vpshufd xmm1, xmm2, 1
shr edx, 0xf
imul eax, edx, 0xfff1
vpaddd xmm0, xmm1, xmm2
vmovd ebx, xmm0
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xfff1
sub ebx, eax
cmp r9, 0x20
jae 0x14001bd50
mov eax, ebx
shl eax, 0x10
or eax, r8d
test r9, r9
jne 0x14001bd36
jmp 0x14001befd
test ecx, ecx
mov ecx, eax
je 0x14001be5c
mov r8, r11
mov rdx, r10
vzeroupper
call fcn.14001ba30
jmp 0x14001befd
mov r8, r9
mov rdx, r11
vzeroupper
call fcn.14001af50
jmp 0x14001befd
test ecx, ecx
je 0x14001beae
test r9, r9
je 0x14001be98
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + r10]
mov byte [r10], al
lea r10, [r10 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001be80
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul ecx, edx, 0xfff1
sub r8d, ecx
jmp 0x14001bee8
test r9, r9
je 0x14001bed4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
add r8d, eax
add ebx, r8d
sub r9, 1
jne 0x14001bec0
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xfff1
sub r8d, eax
mov eax, 0x80078071
mul ebx
shr edx, 0xf
imul eax, edx, 0xf
add eax, ebx
shl eax, 0x10
or eax, r8d
vmovaps xmm8, xmmword [rsp + 0x30]
vmovaps xmm7, xmmword [rsp + 0x40]
vmovaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
vmovaps xmm9, xmmword [rsp + 0x20]
vzeroupper
add rsp, 0x68
ret
Function at 0x140027ff0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400209fc
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140028091
cmp ebx, dword [rsp + 0x30]
je 0x14002808a
test esi, esi
je 0x14002808a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140028065
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140028072
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x14002804f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140028076
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140028093
mov eax, 1
jmp 0x140028093
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400285a0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14002860f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002860f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002860f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002860f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002860f
cmp dword [rcx + 0x84], 0xe
jbe 0x14002860f
cmp dword [rcx + 0xf8], 0
je 0x14002860f
mov ecx, ebx
call fcn.1400286c0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14002849c
nop
cmp dword [rbp + 0x20], 0
je 0x14002865d
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140028668
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400285a0

Function at 0x1400287a4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400285a0
Function at 0x14002d634
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002d67e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002d67e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002d67e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002d67e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002d67e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002d680
xor al, al
add rsp, 0x28
ret