joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ce12
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x1800284a0]
test rdx, rdx
jne 0x18001ceac
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180024ff0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180025000]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025010]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025020]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x68001a0007001c
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x8a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x68
inc rax
cmp rax, 0x46
jne 0x18001ce7e
mov word [rsp + 0xbc], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x1800284a0], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x48], xmm0
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x58], rax
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001cf1a
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0xc0]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x30]
xor r9d, r9d
call fcn.180020390
mov rax, qword [rsp + 0x70]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18001cf3a
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xb0
mov rsi, rdx
mov rdx, qword [0x1800284a8]
test rdx, rdx
jne 0x18001cfb6
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180024df0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [str.6_e_5_6_.y]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025030]
movaps xmmword [rdx + 0x1e], xmm0
mov word [rdx + 0x2e], 0x57
mov word [rdx + 0x5e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x57
inc rax
cmp rax, 0x30
jne 0x18001cf88
mov word [rsp + 0xa0], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x1800284a8], rax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001d009
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x40]
mov r8, rsi
xor r9d, r9d
call fcn.180020390
movsd xmm0, qword [rsi + 0x18]
jmp 0x18001d009
add rsp, 0xb0
pop rsi
ret
Function at 0x18001d012
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xe0
movaps xmmword [rsp + 0xd0], xmm6
movaps xmm6, xmm1
mov rdx, qword [0x1800284b0]
test rdx, rdx
jne 0x18001d0ac
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180024eb0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180024ec0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025040]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025050]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x34004700510051
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x8a], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x34
inc rax
cmp rax, 0x46
jne 0x18001d07e
mov word [rsp + 0xcc], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x1800284b0], rax
movsd qword [rsp + 0x30], xmm6
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001d0f4
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x40]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.180020390
movsd xmm0, qword [rsi + 8]
jmp 0x18001d0f4
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rsi
ret

Function at 0x18001d702
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
mov rdi, r8
mov rsi, rdx
cmp qword [0x1800284e0], 0
jne 0x18001d7a4
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180025190]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800251a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800251b0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800251c0]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x64004b006a0051
mov qword [rdx + 0x3e], rax
mov dword [rdx + 0x46], 0x600068
mov word [rdx + 0x4a], 5
mov word [rdx + 0x96], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 5
inc rax
cmp rax, 0x4c
jne 0x18001d779
mov word [rsp + 0xd8], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov qword [0x1800284e0], rax
cmp byte [0x1800284f0], 0
je 0x18001d80b
mov rcx, qword [0x1800284e8]
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x40], xmm0
test rcx, rcx
je 0x18001d7fc
mov rdx, qword [0x1800284e0]
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x40]
mov r8, rdi
xor r9d, r9d
call fcn.180020390
mov eax, dword [rdi + 0x10]
jmp 0x18001d7fc
mov dword [rsi], eax
mov rax, rsi
add rsp, 0xe8
pop rdi
pop rsi
ret
mov byte [0x1800284f0], 1
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x1800251d0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800251e0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800251f0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025200]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x2d002600350026
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x54
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x54
inc rax
cmp rax, 0x48
jne 0x18001d865
mov word [rsp + 0xd0], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rcx, rax
mov qword [0x1800284e8], rax
jmp 0x18001d7b4
Function at 0x18001d898
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xe8
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x1800284f8]
test rdx, rdx
jne 0x18001d93f
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180025210]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180025220]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025230]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025240]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x6b00440065005e
mov qword [rdx + 0x3e], rax
mov dword [rdx + 0x46], 0x6f0067
mov word [rdx + 0x4a], 0xa
mov word [rdx + 0x96], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0xa
inc rax
cmp rax, 0x4c
jne 0x18001d911
mov word [rsp + 0xd8], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x1800284f8], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x40], xmm0
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001d987
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x40]
mov r8, rdi
xor r9d, r9d
call fcn.180020390
mov eax, dword [rdi + 0x10]
jmp 0x18001d987
mov dword [rsi], eax
mov rax, rsi
add rsp, 0xe8
pop rdi
pop rsi
ret

Function at 0x18001d996
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xe0
mov rdi, r8
mov rsi, rdx
mov rdx, qword [0x180028500]
test rdx, rdx
jne 0x18001da3e
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180025250]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x180025260]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025270]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025280]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x7c006700610046
mov qword [rdx + 0x3e], rax
mov dword [rdx + 0x46], 0x72007b
mov word [rdx + 0x4a], 0x15
mov word [rdx + 0x96], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x15
inc rax
cmp rax, 0x4c
jne 0x18001da10
mov word [rsp + 0xd8], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x180028500], rax
lea rbx, [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov eax, dword [rdi]
mov dword [rbx - 8], eax
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001da86
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.180020390
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rdi
pop rsi
ret
Function at 0x18001da9a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rdx, qword [0x180028508]
test rdx, rdx
jne 0x18001db33
lea rdx, [rsp + 0x42]
movaps xmm0, xmmword [0x180025290]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800252a0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800252b0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x1800252c0]
movaps xmmword [rdx + 0x2e], xmm0
mov dword [rdx + 0x3e], 0x550053
mov word [rdx + 0x42], 0x27
mov word [rdx + 0x86], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x40], 0x27
inc rax
cmp rax, 0x44
jne 0x18001db05
mov word [rsp + 0xc8], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x180028508], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x40], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x50], xmm0
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001db83
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
xor r9d, r9d
call fcn.180020390
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret

Function at 0x18001db9a
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, qword [rsp + 0x138]
mov ebp, dword [rsp + 0x130]
mov rdx, qword [0x180028510]
test rdx, rdx
jne 0x18001dc50
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x1800252d0]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [0x1800252e0]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x1800252f0]
movaps xmmword [rdx + 0x1e], xmm0
movaps xmm0, xmmword [0x180025300]
movaps xmmword [rdx + 0x2e], xmm0
movabs rax, 0x17000d002a003c
mov qword [rdx + 0x3e], rax
mov word [rdx + 0x46], 0x63
mov word [rdx + 0x8e], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x63
inc rax
cmp rax, 0x48
jne 0x18001dc22
mov word [rsp + 0xc0], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x180028510], rax
movups xmm0, xmmword [rbx]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001dcb0
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0xd0]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x30]
xor r9d, r9d
call fcn.180020390
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xe0
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x18001ddfe
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov ebx, r9d
mov rsi, r8
mov rdi, rdx
mov bpl, byte [rsp + 0x100]
mov rdx, qword [0x180028520]
test rdx, rdx
jne 0x18001de9a
lea rdx, [rsp + 0x32]
movaps xmm0, xmmword [0x180025360]
movaps xmmword [rdx - 2], xmm0
movaps xmm0, xmmword [str.__43:]
movaps xmmword [rdx + 0xe], xmm0
movaps xmm0, xmmword [0x180025380]
movaps xmmword [rdx + 0x1e], xmm0
movabs rax, 0x330034003c0029
mov qword [rdx + 0x2e], rax
mov dword [rdx + 0x36], 0x5d002e
mov word [rdx + 0x72], 0
mov eax, 1
xor byte [rsp + rax*2 + 0x30], 0x5d
inc rax
cmp rax, 0x3a
jne 0x18001de6c
mov word [rsp + 0xa4], 0
lea rcx, [0x180027d40]
call fcn.180003f18
mov rdx, rax
mov qword [0x180028520], rax
movups xmm0, xmmword [rdi]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], bl
mov byte [rsp + 0x51], bpl
mov rcx, qword [0x180027d28]
test rcx, rcx
je 0x18001defa
mov rax, qword [rcx]
mov rax, qword [rax + 0x270]
lea r8, [rsp + 0xa8]
mov qword [r8], rax
mov qword [r8 + 8], 0
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.180020390
cmp byte [rsi + 0x22], 0
setne al
jmp 0x18001defa
and al, 1
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x18001e8d0
Capabilities:
Access peb ldr_data

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rbx, qword [rax + 0x18]
add rbx, 0x20
xor esi, esi
mov r14, rbx
mov r14, qword [r14]
cmp r14, rbx
je 0x18001e91a
test rdi, rdi
je 0x18001e916
mov rdx, qword [r14 + 0x50]
mov rcx, rdi
xor r8d, r8d
call fcn.18001ea33
test al, al
je 0x18001e8f6
mov rsi, qword [r14 + 0x20]
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x18001e9b1
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push rbx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x18001ea18
movsxd rax, dword [rcx + 0x3c]
movzx r10d, word [rax + rcx + 6]
test r10, r10
je 0x18001ea18
add rax, rcx
movzx r9d, word [rax + 0x14]
add r9, rax
add r9, 0x18
xor eax, eax
xor r11d, r11d
mov bl, byte [r9]
test bl, bl
je 0x18001ea1c
mov esi, 1
movzx edi, byte [rdx + rsi - 1]
test edi, edi
je 0x18001ea1c
movzx ebx, bl
cmp edi, ebx
jne 0x18001ea0a
mov bl, byte [r9 + rsi]
inc rsi
test bl, bl
jne 0x18001e9ed
jmp 0x18001ea1c
inc r11
add r9, 0x28
cmp r11, r10
jne 0x18001e9e1
jmp 0x18001ea2f
xor eax, eax
jmp 0x18001ea2f
test r8, r8
je 0x18001ea28
mov eax, dword [r9 + 8]
mov qword [r8], rax
mov eax, dword [r9 + 0xc]
add rax, rcx
pop rbx
pop rdi
pop rsi
ret
Function at 0x18001ee7c
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rdx
mov rdx, rcx
lea rcx, [0x180027d40]
call fcn.180003f18
test rax, rax
je 0x18001eef2
mov r12, qword [rax + 0x50]
test r12, r12
je 0x18001eef2
lea rbx, [rsp + 0x30]
lea r14, [0x180027d68]
lea r15, [rsp + 0x2c]
mov ebp, dword [r12 + 0x20]
test ebp, ebp
jle 0x18001eee8
mov esi, dword [r12 + 0x3c]
mov rcx, rbx
mov rdx, rdi
call fcn.180004d10
mov rcx, r14
mov rdx, r15
mov r8, rbx
call fcn.18001d702
cmp ebp, dword [rsp + 0x2c]
je 0x18001ef06
mov r12, qword [r12 + 0x18]
test r12, r12
jne 0x18001eebb
xor esi, esi
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x31]
movaps xmm0, xmmword [0x1800254a0]
movaps xmmword [rcx - 1], xmm0
movabs rax, 0x36273124242d6226
mov qword [rcx + 0xf], rax
mov dword [rcx + 0x17], 0x673a7262
mov word [rcx + 0x1b], 0x481a
mov byte [rcx + 0x1d], 0
mov eax, 1
xor byte [rsp + rax + 0x30], 0x42
inc rax
cmp rax, 0x1e
jne 0x18001ef3a
mov byte [rsp + 0x4e], 0
mov edx, esi
call fcn.18001ef56
jmp 0x18001eef4
Function at 0x18001ef56
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x238
mov rsi, rcx
lea rdi, [rsp + 0x278]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r9
lea rcx, [rsp + 0x30]
mov r8d, 0x200
xor edx, edx
call fcn.18001e010
mov qword [rsp + 0x28], rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18001efa3
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18001efa3
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bpl, byte [rax + rdi]
test bpl, bpl
je 0x18001f01f
add rdi, r10
mov ebx, 0x88eff5c5
movsx r14d, bpl
lea ebp, [r14 - 0x41]
mov r15d, r14d
or r15d, 0x20
cmp bpl, 0x1a
cmovae r15d, r14d
xor r15d, ebx
imul ebx, r15d, 0x1000193
mov bpl, byte [rdi]
inc rdi
test bpl, bpl
jne 0x18001efeb
cmp ebx, 0x53d4c6f3
je 0x18001f029
test r11, r11
jne 0x18001efd0
jmp 0x18001efa3
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
mov r9, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x200
mov r8, rsi
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x18001f069
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x18001f069
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x18001f0df
add rsi, r10
mov edi, 0x17e8881d
movsx ebx, bl
lea ebp, [rbx - 0x41]
mov r14d, ebx
or r14d, 0x20
cmp bpl, 0x1a
cmovae r14d, ebx
xor r14d, edi
imul edi, r14d, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x18001f0af
cmp edi, 0x92650a8d
je 0x18001f0e6
test r11, r11
jne 0x18001f096
jmp 0x18001f069
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
lea rcx, [rsp + 0x30]
call rdx
nop
add rsp, 0x238
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140002e10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002e6d
lea rbx, [0x140061350]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002e54
cmp r10, 2
jb 0x140002e54
cmp byte [r9], r8b
jne 0x140002e54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002e30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002eaf
lea rbx, [0x140061350]
cmp r8b, 0x23
jne 0x140002e93
cmp byte [r9], r8b
jne 0x140002e93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002e80
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002ff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000300a
mov qword [r8], 0
lea rdx, [0x140060dac]
call fcn.140002ec0
mov rbx, rax
test rax, rax
jne 0x14000302a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003101
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003101
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003101
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003101
cmp rdi, 0xffffffffffffffff
je 0x140003101
mov rax, qword [0x1400a4400]
test rax, rax
je 0x14000309e
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003101
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400030ee
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400a4400]
test rax, rax
je 0x1400030e3
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000310a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400030fc
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000310c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140011340
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword [0x1400a4400]
lea r10, [0x140061350]
mov r9, qword [rax + 0x1d18]
movsxd rdx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx eax, cl
movzx edx, r8b
shr r8d, 8
xor rdx, rax
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r10 + rdx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r10 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r10 + rcx*4]
lea rcx, [r9 + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.1400232c0
add rsp, 0x28
ret

Function at 0x1400122b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140073040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400a4400]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140012310
cmp byte [rbx + 0x20d6], 0
jne 0x140012310
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002d90
test dil, 1
je 0x140012436
jmp 0x14001239f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400688cc]
mulss xmm1, dword [0x1400688c0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x140068834]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.140002d90
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400123f0
lea r11, [0x140061350]
nop
cmp r9b, 0x23
jne 0x1400123d3
cmp byte [r8], r9b
jne 0x1400123d3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400123c0
not ecx
call fcn.14000ae00
test rax, rax
je 0x140012436
cmp byte [rax + 0xcf], 0
je 0x140012436
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.140002d90
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000d8a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c420
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret