joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001de38
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
xor r9d, r9d
mov r10, rcx
cmp r8d, 5
ja 0x14001de92
je 0x14001de74
test r8d, r8d
je 0x14001dea7
sub r8d, 1
je 0x14001dea7
sub r8d, 1
jmp 0x14001dea7
sub r8b, 5
cmp r8b, 1
setbe al
add rcx, 8
neg al
sbb rax, rax
and rax, rcx
mov eax, dword [rax]
jmp 0x14001df73
mov ecx, r8d
sub ecx, 6
je 0x14001df64
sub ecx, 1
je 0x14001df51
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14001df2f
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x14001df2f
mov r14d, dword [r10 + 0x20]
dec r11d
mov esi, 0x96302ef6
lea rcx, [r14 + r11*4]
mov ebx, dword [rcx + r8]
add rbx, r8
mov dil, byte [rbx]
inc rbx
test dil, dil
je 0x14001df2a
movsx ecx, dil
sub dil, 0x41
mov edx, ecx
or edx, 0x20
cmp dil, 0x19
mov dil, byte [rbx]
cmova edx, ecx
inc rbx
xor edx, esi
imul esi, edx, 0x1000193
test dil, dil
jne 0x14001defb
cmp esi, 0xdb3444a0
je 0x14001df34
test r11d, r11d
jne 0x14001dedd
mov rax, qword [rax]
jmp 0x14001deb8
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
jmp 0x14001df75
lea rax, [r10 + 8]
cmp r8b, 7
cmove r9, rax
cvttsd2si eax, qword [r9]
jmp 0x14001df73
lea rax, [r10 + 8]
cmp r8b, 6
cmove r9, rax
mov eax, dword [r9]
mov dword [rdx], eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14001fb3c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp byte [rcx + 0xb0], 0
mov byte [rcx + 0x68], 1
je 0x14001fc05
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001fbe5
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14001fbe5
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0x8d7cdc38
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x14001fbe0
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x14001fbb5
cmp edi, 0xbba4a95a
je 0x14001fbea
test r10d, r10d
jne 0x14001fb98
mov rax, qword [rax]
jmp 0x14001fb73
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001fc20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp byte [rcx + 0x29], 0
mov byte [rcx + 0x28], 1
je 0x14001fce6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001fcc6
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x14001fcc6
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0x2fbab79f
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x14001fcc1
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x14001fc96
cmp edi, 0xcee0b433
je 0x14001fccb
test r10d, r10d
jne 0x14001fc79
mov rax, qword [rax]
jmp 0x14001fc54
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140021e70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
and qword [rcx], 0
mov r14, rdx
and qword [rcx + 8], 0
mov r12b, r8b
mov rax, qword [rdx]
mov rdi, rcx
mov qword [rcx], rax
mov r13d, r9d
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
add rcx, 0x10
and qword [rdx], 0
and qword [rdx + 8], 0
xor edx, edx
lea r8d, [rdx + 0x40]
call fcn.140048508
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140021f4a
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140021f4a
mov r15d, dword [r9 + 0x20]
dec r10d
mov esi, 0xe65cd81e
lea rcx, [r15 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x140021f45
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x140021f1a
cmp esi, 0xd49f96
je 0x140021f4f
test r10d, r10d
jne 0x140021efd
mov rax, qword [rax]
jmp 0x140021ed8
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov qword [rdi + 0x50], rax
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140021f79
mov cl, byte [rcx]
mov byte [rdi + 0x58], cl
mov rax, qword [rax]
test rax, rax
je 0x140021f86
mov al, byte [rax]
mov ebx, 0x200
mov byte [rdi + 0x59], al
mov r8d, ebx
lea rcx, [rdi + 0x5a]
xor edx, edx
call fcn.140048508
lea rcx, [rdi + 0x260]
mov byte [rdi + 0x25a], r12b
xorps xmm0, xmm0
mov r8d, ebx
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
mov dl, r12b
and qword [rcx + 0x18], 0
call fcn.14001998c
mov dword [rdi + 0x280], r13d
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x140021fff
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x140021fff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x140021fff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400221c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movzx r8d, dl
xor r15d, r15d
mov rdi, rcx
cmp r8d, 5
ja 0x140022296
je 0x14002237b
test dl, dl
je 0x14002237b
sub r8d, 1
je 0x14002225c
sub r8d, 1
je 0x14002223f
sub r8d, 1
je 0x14002221e
cmp r8d, 1
jne 0x1400222b4
mov byte [rcx], r15b
jmp 0x14002237e
mov ecx, 0x20
call fcn.140047a00
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], r15b
jmp 0x140022254
mov ecx, 0x18
call fcn.140047a00
mov qword [rax + 0x10], r15
mov qword [rax + 8], r15
mov qword [rax], r15
mov qword [rdi], rax
jmp 0x14002237e
mov ecx, 0x10
call fcn.140047a00
mov ecx, 0x50
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 8], r15
call fcn.140047a00
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
jmp 0x14002237e
sub r8d, 6
je 0x14002237b
sub r8d, 1
je 0x14002237b
cmp r8d, 1
je 0x140022364
mov qword [rcx], r15
test dl, dl
jne 0x14002237e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140022342
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140022342
mov r14d, dword [r9 + 0x20]
dec r10d
mov ebp, 0xa53824fd
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x14002233d
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, ebp
imul ebp, edx, 0x1000193
test bl, bl
jne 0x140022312
cmp ebp, 0x1d36c091
je 0x140022347
test r10d, r10d
jne 0x1400222f5
mov rax, qword [rax]
jmp 0x1400222d0
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
jmp 0x14002237e
mov ecx, 0x28
call fcn.140047a00
mov qword [rax + 0x18], r15
mov byte [rax + 0x20], r15b
jmp 0x140022249
mov qword [rcx], r15
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400228d4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
cmp byte [rcx], 0
mov rdi, rdx
mov rsi, rcx
jne 0x14002292c
mov byte [rcx], 1
mov ecx, 0x10
call fcn.140047a00
mov ecx, 0x50
mov rbx, rax
and qword [rax], 0
and qword [rax + 8], 0
call fcn.140047a00
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsi + 8], rbx
cmp byte [rsi], 1
jne 0x140022995
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x50]
and qword [rsp + 0x50], 0
lea rdx, [rsp + 0x20]
mov r8, rdi
call fcn.14001a38c
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rsp + 0x20]
cmp rdx, 0xf
jbe 0x14002298c
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140022987
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140022a91
mov rcx, r8
call fcn.140047a08
lea rax, [rbx + 0x40]
jmp 0x140022a6e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x140022a18
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x140022a18
mov ebp, dword [r10 + 0x20]
dec r9d
mov esi, 0x9623d3c2
lea rdx, [r8 + r9*4]
mov r11d, dword [rdx + rbp]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x140022a13
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x1400229e8
cmp esi, 0x35a2c954
je 0x140022a1d
test r9d, r9d
jne 0x1400229cb
mov rax, qword [rax]
jmp 0x1400229a6
mov eax, dword [r10 + 0x24]
mov ecx, dword [r10 + 0x1c]
add rax, r8
add rcx, r8
movzx edx, word [rax + r9*2]
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140022a6e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140022a69
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140022a91
mov rcx, r8
call fcn.140047a08
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
and qword [rdi + 0x10], 0
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call fcn.140040934
int3
Function at 0x140022ab8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8, qword [rcx]
movzx edx, byte [r8]
cmp edx, 5
ja 0x140022aff
je 0x140022aff
test edx, edx
je 0x140022aff
sub edx, 1
je 0x140022af2
sub edx, 1
jne 0x140022aff
mov rax, qword [rcx + 0x10]
jmp 0x140022bb1
mov rax, qword [rcx + 8]
add rax, 0x40
jmp 0x140022bb1
cmp qword [rcx + 0x18], 0
jne 0x140022b0e
mov rax, r8
jmp 0x140022bb1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140022b91
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140022b91
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0xd62e296e
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x140022b8c
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x140022b61
cmp edi, 0x1c4ab558
je 0x140022b96
test r10d, r10d
jne 0x140022b44
mov rax, qword [rax]
jmp 0x140022b1f
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140023ec8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov rbx, rdx
mov r11, rcx
test r9b, r9b
je 0x1400195ea
test r8, r8
je 0x14001960d
movabs r9, 0x100000001b3
mov al, byte [rbx + r10]
mov dl, byte [rbx + r10]
add al, 0x20
movzx ecx, al
sub dl, 0x41
movzx eax, byte [rbx + r10]
cmp dl, 0x19
cmova ecx, eax
inc r10
imul r11, r9
movsx rax, cl
xor r11, rax
cmp r10, r8
jb 0x1400195ba
jmp 0x14001960d
test r8, r8
je 0x14001960d
movabs r9, 0x100000001b3
movsx rcx, byte [rdx + r10]
inc r10
imul r11, r9
xor r11, rcx
cmp r10, r8
jb 0x1400195f9
mov rbx, qword [rsp + 8]
mov rax, r11
ret
xor r8d, r8d
cmp byte [rcx], r8b
je 0x140023eda
inc r8
cmp byte [rcx + r8], 0
jne 0x140023ed0
mov r9b, dl
mov rdx, rcx
movabs rcx, 0xcbf29ce484222325
jmp 0x140019598
Function at 0x140023f08
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rsi
push rdi
push r14
sub rsp, 0x38
lea rax, [r11 + 0x10]
mov qword [r11 - 0x38], rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140023faf
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x140023faf
mov r14d, dword [r11 + 0x20]
dec r10d
mov edi, 0x7f502726
lea rcx, [r14 + r10*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov bl, byte [r9]
inc r9
test bl, bl
je 0x140023faa
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r9]
cmova edx, ecx
inc r9
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x140023f7f
cmp edi, 0x39d9a6fa
je 0x140023fb4
test r10d, r10d
jne 0x140023f62
mov rax, qword [rax]
jmp 0x140023f3d
mov ecx, dword [r11 + 0x24]
mov r9, qword [rsp + 0x20]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, 0x200
add rax, r8
lea rcx, [0x1400bced0]
mov r8, qword [rsp + 0x60]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r9d, dword [rcx + r10 + 0x88]
add r9, r10
cmp r9, r10
je 0x140024068
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x140024068
mov r14d, dword [r9 + 0x20]
dec r8d
mov esi, 0x1875e8da
lea rcx, [r14 + r8*4]
mov r11d, dword [rcx + r10]
add r11, r10
mov bl, byte [r11]
inc r11
test bl, bl
je 0x140024063
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, esi
imul esi, edx, 0x1000193
test bl, bl
jne 0x140024038
cmp esi, 0x7e2883ce
je 0x14002406d
test r8d, r8d
jne 0x14002401b
mov rax, qword [rax]
jmp 0x140023ff6
mov edx, dword [r9 + 0x24]
lea rcx, [0x1400bced0]
add rdx, r10
movzx r8d, word [rdx + r8*2]
mov edx, dword [r9 + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
call r9
lea rax, [0x1400bced0]
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140043a44
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x140043adc
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x140043adc
mov r14d, dword [r9 + 0x20]
dec r10d
mov edi, 0x9853912d
lea rcx, [r14 + r10*4]
mov r11d, dword [rcx + r8]
add r11, r8
mov bl, byte [r11]
inc r11
test bl, bl
je 0x140043ad7
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r11]
cmova edx, ecx
inc r11
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x140043aac
cmp edi, 0xb195eee1
je 0x140043ae1
test r10d, r10d
jne 0x140043a8f
mov rax, qword [rax]
jmp 0x140043a6a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword [rax]
test rax, rax
jne 0x140043b08
mov al, 0x2e
jmp 0x140043b0a
mov al, byte [rax]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140043ba4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xorps xmm0, xmm0
mov rbx, rdx
movups xmmword [rdx], xmm0
and qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
mov r12, qword [rcx + 0x40]
mov rdi, qword [rcx + 0x38]
jmp 0x140043d2c
movzx esi, byte [rdi]
cmp sil, 0x1f
ja 0x140043cea
xor eax, eax
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], al
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r11d, dword [rcx + r8 + 0x88]
add r11, r8
cmp r11, r8
je 0x140043c91
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x140043c91
mov r13d, dword [r11 + 0x20]
dec r10d
mov r14d, 0x8ca306f4
lea rcx, [r10*4]
add rcx, r13
mov r9d, dword [rcx + r8]
add r9, r8
mov bpl, byte [r9]
inc r9
test bpl, bpl
je 0x140043c8c
movsx ecx, bpl
sub bpl, 0x41
mov edx, ecx
or edx, 0x20
cmp bpl, 0x19
mov bpl, byte [r9]
cmova edx, ecx
inc r9
xor edx, r14d
imul r14d, edx, 0x1000193
test bpl, bpl
jne 0x140043c5a
cmp r14d, 0xd8cda14e
je 0x140043c99
test r10d, r10d
jne 0x140043c34
mov rax, qword [rax]
jmp 0x140043c0f
mov ecx, dword [r11 + 0x24]
mov r9d, esi
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov edx, 9
add rax, r8
lea rcx, [rsp + 0x20]
lea r8, str._U_.4X_
call rax
lea rax, [rsp + 0x20]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140043cd1
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004172c
jmp 0x140043d29
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140043d14
cmp qword [rbx + 0x18], 0xf
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jbe 0x140043d09
mov rax, qword [rbx]
mov byte [rax + rcx], sil
mov byte [rax + rcx + 1], 0
jmp 0x140043d29
mov r8b, byte [rsp + 0x60]
mov r9b, sil
mov edx, 1
mov rcx, rbx
call fcn.14001bf84
inc rdi
cmp rdi, r12
jne 0x140043be6
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004624c
Capabilities:
Access peb ldr_data
Encode data using xor
Get number of processors
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rcx + 0x10]
mov rsi, rcx
sub rax, qword [rcx + 8]
mov r14, rdx
mov rcx, qword [rcx + 0xa8]
sar rax, 3
mov byte [rbp + 0x20], 2
mov dword [rbp + 0x30], eax
test rcx, rcx
je 0x1400463f7
mov rax, qword [rcx]
lea r9, [rsi + 0xb8]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x30]
call qword [rax + 0x10]
lea rdx, [rbp - 0x20]
mov byte [rbp + 0x20], al
lea rcx, [rsi + 0x20]
call fcn.140042f64
mov r9d, 1
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x10]
lea rcx, [rsi + 0x20]
movups xmm0, xmmword [rax]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp - 0x30], xmm0
call fcn.140040e44
mov r9b, 1
mov byte [rbp + 0x20], 2
lea r8, [rbp + 0x20]
mov rcx, rsi
lea rdx, [rbp - 0x30]
call fcn.14001f488
mov rdx, qword [rsi + 0x10]
cmp rdx, qword [rsi + 0x18]
je 0x140046306
mov rax, qword [rbp - 0x28]
mov qword [rdx], rax
add qword [rsi + 0x10], 8
jmp 0x140046313
lea r8, [rbp - 0x28]
lea rcx, [rsi + 8]
call fcn.14001afc4
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax - 8]
test rcx, rcx
je 0x1400463e0
cmp r14, 0xffffffffffffffff
je 0x1400463e0
call fcn.140044284
cmp r14, rax
jbe 0x1400463e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x1400463bf
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x1400463bf
mov r14d, dword [r10 + 0x20]
dec r11d
mov edi, 0x20c6dc03
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + r9]
add r8, r9
mov bl, byte [r8]
inc r8
test bl, bl
je 0x1400463ba
movsx ecx, bl
sub bl, 0x41
mov edx, ecx
or edx, 0x20
cmp bl, 0x19
mov bl, byte [r8]
cmova edx, ecx
inc r8
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x14004638f
cmp edi, 0x2e4fe9bf
je 0x1400463c4
test r11d, r11d
jne 0x140046372
mov rax, qword [rax]
jmp 0x14004634d
mov edx, dword [r10 + 0x24]
add rdx, r9
movzx r8d, word [rdx + r11*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov ecx, dword [rdx + r8*4]
add rcx, r9
call rcx
lea r11, [rsp + 0x60]
mov al, 1
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140040934
int3