joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14017f400
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x140519680]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14017f4fe
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x14017f4e5
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov dword [rsp + 0x3a], eax
mov word [rsp + 0x3e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call fcn.140399b30
movaps xmm0, xmmword [0x1404804c0]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x1404804d0]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x1404804e0]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x1404804f0]
xorps xmm0, xmm0
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
movq rax, xmm0
xor qword [rbx + 0x20], rax
xor qword [rbx + 8], 0
psrldq xmm0, 8
movq rax, xmm0
xor qword [rbx + 0x28], rax
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x14017f503
cmp byte [rcx + 0xe8], 0
je 0x14017f4f6
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140367840
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x140184370
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0xab0]
mov ecx, dword [0x1407b6ca8]
movdqa xmm4, xmmword [0x1404dd800]
add rcx, rax
movdqa xmm5, xmmword [0x1404dd550]
movdqu xmm0, xmmword [rdx]
movdqu xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm3, xmmword [rdx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1404dd5a0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1404dd6e0]
cmp rax, rcx
jae 0x140184400
nop word [rax + rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm5
aesdec xmm2, xmm6
aesenc xmm3, xmm7
movdqu xmmword [rax], xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmmword [rax + 0x20], xmm2
movdqu xmmword [rax + 0x30], xmm3
add rax, 0x40
cmp rax, rcx
jb 0x1401843d0
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [rdx], xmm0
movdqu xmmword [rdx + 0x10], xmm1
movdqu xmmword [rdx + 0x20], xmm2
movdqu xmmword [rdx + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x140187ad0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov ecx, 0x28
call fcn.140367860
mov r8, rax
mov rcx, qword [rsp + 0x78]
mov r10d, dword [rcx]
mov dword [rax], r10d
mov rcx, qword [rsp + 0x70]
mov r9d, dword [rcx]
mov dword [rax + 4], r9d
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx]
mov dword [rax + 8], edx
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
mov qword [rax + 0x10], rdx
mov rax, qword [rbx]
mov qword [r8 + 0x18], rax
mov qword [r8 + 0x20], rdi
mov qword [rsp + 0x40], r8
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, r8
lea r8, [0x140187bb0]
xor edx, edx
xor ecx, ecx
call fcn.140378508
mov qword [rsi], rax
test rax, rax
je 0x140187b73
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call fcn.14036699c
int3
Function at 0x140187e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebp, ebp
lea rax, vtable.xmrig::RxQueue.0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rbp
mov dword [rcx + 0x18], ebp
mov qword [rcx + 0x20], rbp
mov qword [rcx + 0x28], rbp
mov qword [rcx + 0x30], rbp
mov dword [rcx + 0x38], ebp
add rcx, 0x40
call fcn.140367080
nop
lea rcx, [rsi + 0x88]
mov dword [rcx], ebp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
xorps xmm0, xmm0
movups xmmword [rcx + 0x18], xmm0
movups xmmword [rcx + 0x28], xmm0
movups xmmword [rcx + 0x38], xmm0
mov qword [rcx + 0x48], rbp
lea edx, [rbp + 2]
call fcn.1403669e4
nop
mov qword [rsi + 0xd8], rbp
mov qword [rsi + 0xe0], rbp
xorps xmm0, xmm0
movups xmmword [rsi + 0xe8], xmm0
mov qword [rsi + 0xf8], rbp
mov qword [rsi + 0x100], rbp
mov qword [rsi + 0x108], rbp
lea ecx, [rbp + 0x18]
call fcn.140367860
mov rdi, rax
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_class_xmrig::Async_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
mov rdx, rsi
mov rcx, rbx
call fcn.140015d60
nop
mov qword [rsi + 0xd8], rbx
mov rbx, qword [rsi + 0xe0]
mov qword [rsi + 0xe0], rdi
test rbx, rbx
je 0x140187fa2
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140187fa2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140187fa2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov ecx, reloc.WS2_32.dll_recv
call fcn.140367860
mov qword [rax], rsi
lea rcx, [0x1401884f0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140071f70]
xor edx, edx
xor ecx, ecx
call fcn.140378508
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140188015
cmp dword [rsi + 0xf0], 0
jne 0x14018800f
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0xe8], xmm1
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call fcn.14037511c
nop
mov dword [rsp + 0x38], ebp
mov ecx, 6
call fcn.14036699c
int3
Function at 0x14018a3f0
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140519680]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movups xmm0, xmmword [0x140480880]
mov rbx, r8
mov r8, rdx
movups xmm1, xmmword [0x140480890]
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r9, [rbp - 0x70]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x40], 0
call fcn.14018a1e0
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
shr rax, 3
lea rdx, [0x1404808a0]
and eax, 0x3f
add rcx, rax
cmp rax, 0x38
jae 0x14018a47f
mov r8d, gethostname
sub r8, rax
call fcn.140399490
jmp 0x14018a4c0
mov r8d, 0x40
sub r8, rax
call fcn.140399490
lea r9, [rbp + 0x90]
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.140189380
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
mov rdx, qword [rsp + 0x40]
lea r9, [rbp + 0x90]
movzx eax, byte [rsp + 0x40]
lea r8, [rbp - 0x70]
mov byte [rbp - 0x79], al
lea rcx, [rsp + 0x20]
mov rax, rdx
shr rax, 8
mov byte [rbp - 0x7a], al
mov rax, rdx
shr rax, 0x10
mov byte [rbp - 0x7b], al
mov rax, rdx
shr rax, 0x18
mov byte [rbp - 0x7c], al
mov rax, rdx
shr rax, 0x20
mov byte [rbp - 0x7d], al
mov rax, rdx
shr rax, 0x28
mov byte [rbp - 0x7e], al
mov rax, rdx
shr rdx, 0x38
mov byte [rbp - 0x80], dl
lea rdx, [rsp + 0x48]
shr rax, 0x30
mov byte [rbp - 0x7f], al
call fcn.140189380
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140189030
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140367840
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x14018b9f0
Capabilities:
Encode data using xor

Disassembly:
test r9d, r9d
je 0x14018bb61
push rbx
sub rsp, 0x10
xor eax, eax
mov r10d, r8d
mov qword [rsp + 0x30], rdi
mov rbx, rdx
mov r11, rcx
cmp r9d, 8
jb 0x14018bb36
lea r8d, [r9 - 1]
lea edi, [r8 + r10]
mov edx, r8d
add rdi, rcx
add rdx, rbx
add rcx, r10
cmp rcx, rdx
ja 0x14018ba3a
cmp rdi, rbx
jae 0x14018bb36
cmp r9d, 0x40
jb 0x14018bb0a
mov qword [rsp + 0x20], rbp
mov edi, r9d
mov qword [rsp + 0x28], rsi
and edi, 0x3f
mov ebp, r9d
mov qword [rsp + 8], r14
sub ebp, edi
mov qword [rsp], r15
mov r14d, 0xfffffff0
lea esi, [r10 + 0x20]
sub r14d, r10d
mov r15d, reloc.WS2_32.dll_recv
sub r15d, r10d
nop dword [rax + rax]
movdqu xmm1, xmmword [rbx + rax]
lea ecx, [rsi - 0x20]
add eax, 0x40
movdqu xmm0, xmmword [rcx + r11]
lea r8d, [rsi - 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + r11], xmm1
lea ecx, [r14 + rsi]
movdqu xmm0, xmmword [r8 + r11]
movdqu xmm1, xmmword [rcx + rbx]
mov ecx, esi
sub ecx, r10d
xorps xmm1, xmm0
movdqu xmmword [r8 + r11], xmm1
lea r8d, [rsi + 0x10]
movdqu xmm0, xmmword [rsi + r11]
movdqu xmm1, xmmword [rcx + rbx]
lea ecx, [r15 + rsi]
xorps xmm1, xmm0
movdqu xmmword [rsi + r11], xmm1
add esi, 0x40
movdqu xmm0, xmmword [r8 + r11]
movdqu xmm1, xmmword [rcx + rbx]
xorps xmm1, xmm0
movdqu xmmword [r8 + r11], xmm1
cmp eax, ebp
jb 0x14018ba80
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x20]
cmp edi, 8
jb 0x14018bb31
mov r8d, r9d
and r8d, 0xfffffff8
movq xmm1, qword [rbx + rax]
lea ecx, [rax + r10]
movq xmm0, qword [rcx + r11]
add eax, 8
xorps xmm1, xmm0
movq qword [rcx + r11], xmm1
cmp eax, r8d
jb 0x14018bb11
cmp eax, r9d
jae 0x14018bb57
mov r8d, eax
add r8, rbx
nop dword [rax]
movzx ecx, byte [r8]
lea edx, [rax + r10]
xor byte [rdx + r11], cl
lea r8, [r8 + 1]
inc eax
cmp eax, r9d
jb 0x14018bb40
mov rdi, qword [rsp + 0x30]
add rsp, 0x10
pop rbx
ret
Function at 0x14018bb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea r13, [0x1404809b0]
mov qword [rsp + 0x28], recv
mov qword [rsp + 0x20], r13
mov rbx, rcx
mov rcx, rbx
call fcn.14018bcc0
mov rcx, rbx
call fcn.14018be70
mov rcx, rbx
call fcn.14018bfe0
xor r13d, r13d
nop
mov eax, 0xcccccccd
lea r10d, [r13*4]
mul r13d
mov ecx, r13d
add r10d, r13d
shr edx, 2
inc r13d
lea eax, [rdx + rdx*4]
sub ecx, eax
lea r8d, [rcx + rcx*4]
mov r12, qword [rbx + r8*8]
lea eax, [r8 + 2]
mov r15, qword [rbx + rax*8]
lea ecx, [r8 + 1]
mov rsi, qword [rbx + rcx*8]
lea eax, [r8 + 3]
mov rdi, qword [rbx + rax*8]
lea r14, [rbx + r8*8]
imul eax, edx, 0x19
not rsi
and rsi, r15
not r15
and r15, rdi
xor rsi, r12
not rdi
sub r10d, eax
lea eax, [r10 + 1]
xor r15, qword [rbx + rax*8]
lea r11, [rbx + rax*8]
lea eax, [r8 + 4]
mov r9, qword [rbx + rax*8]
lea eax, [r10 + 2]
and rdi, r9
lea r8, [rbx + rax*8]
xor rdi, qword [r8]
lea eax, [r10 + 3]
lea rdx, [rbx + rax*8]
not r9
and r9, r12
lea eax, [r10 + 4]
xor r9, qword [rdx]
not r12
and r12, qword [rbx + rcx*8]
xor r12, qword [rbx + rax*8]
mov qword [r14], rsi
mov qword [r11], r15
mov qword [r8], rdi
mov qword [rdx], r9
mov qword [rbx + rax*8], r12
cmp r13d, 5
jb 0x14018bbc0
mov r13, qword [rsp + 0x20]
mov rax, qword [r13]
add r13, 8
xor qword [rbx], rax
sub qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
jne 0x14018bba4
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14018bcc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140519680]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
lea rsi, [rsp]
mov r11d, edi
mov rbx, rcx
nop word [rax + rax]
mov ecx, 4
lea rsi, [rsi + 8]
mov r10d, r11d
mov eax, 0xcccccccd
mul r11d
mov r9d, edx
shr r9d, 2
sub ecx, r9d
lea eax, [r9 + r9*4]
lea r8d, [r11 + rcx*4]
sub r10d, eax
add r8d, ecx
mov ecx, 3
sub ecx, r9d
mov rdx, qword [rbx + r8*8]
lea eax, [r11 + rcx*4]
add ecx, eax
xor rdx, qword [rbx + rcx*8]
mov ecx, 2
sub ecx, r9d
lea eax, [r11 + rcx*4]
inc r11d
add ecx, eax
lea eax, [r10 + 5]
xor rdx, qword [rbx + rcx*8]
xor rdx, qword [rbx + rax*8]
xor rdx, qword [rbx + r10*8]
mov qword [rsi - 8], rdx
cmp r11d, 5
jb 0x14018bcf0
mov r9, qword [rsp + 0x20]
mov r11, qword [rsp + 8]
mov r10, qword [rsp + 0x10]
mov rcx, r11
mov rdx, qword [rsp]
mov r8, qword [rsp + 0x18]
shr rcx, 0x3f
lea rax, [r11 + r11]
xor rcx, rax
lea rax, [r10 + r10]
xor rcx, r9
mov qword [rsp + 0x28], rcx
mov rcx, r10
shr rcx, 0x3f
xor rcx, rax
lea rax, [r8 + r8]
xor rcx, rdx
mov qword [rsp + 0x30], rcx
mov rcx, r8
shr rcx, 0x3f
xor rcx, rax
lea rax, [r9 + r9]
xor rcx, r11
mov qword [rsp + 0x38], rcx
mov rcx, r9
shr rcx, 0x3f
lea r9, [rsp + 0x28]
xor rcx, rax
lea rax, [rdx + rdx]
xor rcx, r10
mov qword [rsp + 0x40], rcx
mov rcx, rdx
shr rcx, 0x3f
xor rcx, rax
xor rcx, r8
mov qword [rsp + 0x48], rcx
nop dword [rax + rax]
mov r8, qword [r9]
lea r9, [r9 + 8]
mov ecx, edi
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea eax, [rdx + rdx*4]
sub ecx, eax
mov eax, ecx
add eax, 5
xor qword [rbx + rcx*8], r8
mov ecx, 2
sub ecx, edx
xor qword [rbx + rax*8], r8
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 3
sub ecx, edx
lea eax, [rdi + rcx*4]
add ecx, eax
xor qword [rbx + rcx*8], r8
mov ecx, 4
sub ecx, edx
lea eax, [rdi + rcx*4]
inc edi
add ecx, eax
xor qword [rbx + rcx*8], r8
cmp edi, 5
jb 0x14018bdf0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140367840
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14018c1c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x28
mov ebp, dword [rcx + 0xc8]
mov r12, r8
shr ebp, 3
mov rsi, rdx
cmp dword [rcx + 0xd0], 0
mov rdi, rcx
je 0x14018c1f4
mov eax, 1
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov qword [rsp + 0x60], r14
mov r14d, r13d
test r12, r12
je 0x14018c3cd
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], r15
nop word [rax + rax]
mov r8d, dword [rdi + 0xcc]
test r8d, r8d
jne 0x14018c373
lea rax, [r14 + rbp]
mov r15d, ebp
cmp r12, rax
jb 0x14018c373
mov rbx, r12
sub rbx, r14
cmp rbx, r15
jb 0x14018c36b
nop
mov eax, r13d
test ebp, ebp
je 0x14018c354
cmp ebp, 8
jb 0x14018c32f
lea ecx, [rbp - 1]
lea r8, [rcx + rdi]
add rcx, rsi
cmp rdi, rcx
ja 0x14018c27c
cmp r8, rsi
jae 0x14018c32f
cmp ebp, 0x40
jb 0x14018c307
mov r8d, ebp
mov r9d, ebp
and r8d, 0x3f
sub r9d, r8d
mov r10d, 0x20
nop dword [rax + rax]
mov ecx, eax
add eax, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
lea ecx, [r10 - 0x10]
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
mov ecx, r10d
movdqu xmm0, xmmword [rcx + rdi]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rcx + rdi], xmm1
lea ecx, [r10 + 0x10]
add r10d, 0x40
movdqu xmm0, xmmword [rdi + rcx]
movdqu xmm1, xmmword [rcx + rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi + rcx], xmm1
cmp eax, r9d
jb 0x14018c2a0
cmp r8d, 8
jb 0x14018c32b
mov edx, ebp
and edx, 0xfffffff8
nop dword [rax]
mov ecx, eax
add eax, 8
movq xmm0, qword [rdi + rcx]
movq xmm1, qword [rcx + rsi]
xorps xmm1, xmm0
movq qword [rdi + rcx], xmm1
cmp eax, edx
jb 0x14018c310
cmp eax, ebp
jae 0x14018c354
mov ecx, eax
mov r9d, ebp
sub r9d, eax
lea r8, [rcx + rsi]
lea rdx, [rcx + rdi]
nop
movzx eax, byte [r8]
lea r8, [r8 + 1]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14018c340
mov rcx, rdi
call fcn.14018bb70
add rsi, r15
sub rbx, r15
cmp rbx, r15
jae 0x14018c250
mov r14, r12
sub r14, rbx
jmp 0x14018c3ba
mov edx, r12d
mov ecx, ebp
sub edx, r14d
sub ecx, r8d
lea eax, [rdx + r8]
cmp eax, ebp
cmovbe ecx, edx
mov rdx, rsi
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
add r14, rbx
call fcn.14018b9f0
add dword [rdi + 0xcc], ebx
add rsi, rbx
cmp dword [rdi + 0xcc], ebp
jne 0x14018c3ba
mov rcx, rdi
call fcn.14018bb70
mov dword [rdi + 0xcc], r13d
cmp r14, r12
jb 0x14018c220
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x60]
xor eax, eax
mov r13, qword [rsp + 0x58]
add rsp, 0x28
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019bc60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov ebp, edx
mov r13, rcx
xor r15d, r15d
lea rcx, [rsp + 0x70]
call fcn.140031190
mov r9, rax
movabs rax, 0x431bde82d7b634db
imul qword [r9]
mov rbx, rdx
sar rbx, 0x12
mov rax, rbx
shr rax, 0x3f
add rbx, rax
mov r12d, r15d
mov rax, qword [r13 + 0x30]
mov rax, qword [rax]
cmp byte [rax + 0x19], r12b
jne 0x14019bd22
nop word [rax + rax]
mov rcx, qword [rax + 0x28]
cmp qword [rcx + 0x10], r15
je 0x14019bcce
mov r12d, dword [rax + 0x20]
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], r15b
je 0x14019bcfa
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], r15b
jne 0x14019bcf5
cmp rax, qword [rcx + 0x10]
jne 0x14019bcf5
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], r15b
je 0x14019bce2
mov rax, rcx
jmp 0x14019bd1c
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r15b
jne 0x14019bd1c
nop word [rax + rax]
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], r15b
je 0x14019bd10
cmp byte [rax + 0x19], r15b
je 0x14019bcc0
mov edx, r12d
mov rcx, r13
call fcn.14019b720
mov rdi, rax
mov qword [rsp + 0x70], rax
lea rdx, [r13 + 0x18]
mov r9d, esi
mov r8d, ebp
mov rcx, rax
call fcn.1401873c0
mov rdx, rbx
mov ecx, r12d
call fcn.14019b6b0
cmp qword [r13 + 0x38], 1
jbe 0x14019be9e
mov rbx, qword [r13 + 0x30]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], r15b
jne 0x14019be96
lea rdx, [0x14019c500]
nop word [rax + rax]
lea rsi, [rbx + 0x20]
cmp dword [rsi], r12d
je 0x14019be3f
mov rcx, rdi
call fcn.140187830
mov rbp, rax
mov qword [rsp + 0x88], rax
mov r14, qword [r13 + 0x48]
cmp r14, qword [r13 + 0x50]
je 0x14019be0e
mov ecx, 0x20
call fcn.140367860
mov qword [rax], rbp
mov ecx, dword [rsi]
mov dword [rax + 8], ecx
mov rcx, qword [rsi + 8]
mov qword [rax + 0x10], rcx
lea rcx, [0x14019c500]
mov qword [rax + 0x18], rcx
mov qword [rsp + 0x88], rax
lea rsi, [r14 + 8]
mov qword [rsp + 0x28], rsi
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x14019cf40]
xor edx, edx
xor ecx, ecx
call fcn.140378508
mov qword [r14], rax
test rax, rax
je 0x14019beb8
add qword [r13 + 0x48], 0x10
jmp 0x14019be33
lea rax, [rsp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsi + 8]
mov r8, rdx
mov rdx, r14
lea rcx, [r13 + 0x40]
call fcn.14019cc60
lea rdx, [0x14019c500]
mov rdi, qword [rsp + 0x70]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14019be6b
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14019be66
cmp rbx, qword [rax + 0x10]
jne 0x14019be66
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14019be53
mov rbx, rax
jmp 0x14019be8c
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14019be8c
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14019be80
cmp byte [rbx + 0x19], 0
je 0x14019bd80
mov rcx, r13
call fcn.14019c590
mov byte [r13 + 1], 1
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsi], r15d
mov ecx, 6
call fcn.14036699c
int3
Function at 0x14019ca30
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14019cc4f
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14019cb9b
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004310
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x18
call fcn.140367860
mov r9, rax
mov rax, qword [rsp + 0xc0]
movzx ecx, byte [rax]
mov byte [r9], cl
mov rax, qword [rsp + 0xb8]
movzx ecx, byte [rax]
mov byte [r9 + 1], cl
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 4], ecx
mov rax, qword [r13]
mov qword [r9 + 8], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x10], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x14019cf00]
xor edx, edx
xor ecx, ecx
call fcn.140378508
mov qword [r12], rax
test rax, rax
je 0x14019cc3c
mov qword [rsp + 0x90], r12
mov rdx, qword [r14 + 8]
mov rax, qword [r14]
mov rcx, r15
cmp rbx, rdx
jne 0x14019cbbf
cmp rax, rdx
je 0x14019cc16
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x14019cb80
jmp 0x14019cc16
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14019cc55
jmp 0x14019caa8
cmp rax, rbx
je 0x14019cbe9
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14019cbd0
mov qword [rsp + 0x90], r15
mov rax, qword [r14 + 8]
cmp rbx, rax
je 0x14019cc16
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x14019cc00
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.14017f0c0
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14036699c
nop
call fcn.1400042f0
int3
call fcn.1400040e0
int3
Function at 0x14019cc60
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r9
mov rbx, rdx
mov r14, rcx
mov rdx, qword [rcx]
mov rdi, rbx
sub rdi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x14019ce6f
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
jbe 0x14019cdbb
mov rsi, r9
mov qword [rsp + 0x98], r9
mov rcx, rsi
shl rcx, 4
call fcn.140004310
mov r15, rax
mov qword [rsp + 0x40], rax
and rdi, 0xfffffffffffffff0
lea r12, [rdi + rax]
lea rdi, [r12 + 0x10]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x90], rdi
mov ecx, 0x20
call fcn.140367860
mov r9, rax
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rax]
mov qword [r9], rcx
mov rax, qword [rsp + 0xb0]
mov ecx, dword [rax]
mov dword [r9 + 8], ecx
mov rax, qword [r13]
mov qword [r9 + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [r9 + 0x18], rax
mov qword [rsp + 0x48], r9
lea r13, [r12 + 8]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0
lea r8, [0x14019cf40]
xor edx, edx
xor ecx, ecx
call fcn.140378508
mov qword [r12], rax
test rax, rax
je 0x14019ce5c
mov qword [rsp + 0x90], r12
mov rdx, qword [r14 + 8]
mov rax, qword [r14]
mov rcx, r15
cmp rbx, rdx
jne 0x14019cddf
cmp rax, rdx
je 0x14019ce36
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x14019cda0
jmp 0x14019ce36
lea rax, [rdx + rcx]
mov rsi, r8
cmp rax, r8
cmovae rsi, rax
mov qword [rsp + 0x98], rsi
cmp rsi, r9
ja 0x14019ce75
jmp 0x14019ccd8
cmp rax, rbx
je 0x14019ce09
nop dword [rax]
nop dword [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x14019cdf0
mov qword [rsp + 0x90], r15
mov rax, qword [r14 + 8]
cmp rbx, rax
je 0x14019ce36
sub rdi, rbx
nop dword [rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rdi + rbx], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x14019ce20
mov r9, rsi
mov r8, qword [rsp + 0x30]
mov rdx, r15
mov rcx, r14
call fcn.14017f0c0
mov rax, r12
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r13], 0
mov ecx, 6
call fcn.14036699c
nop
call fcn.1400042f0
int3
call fcn.1400040e0
int3