joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ac088
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x1400ac0d2
call fcn.140091278
mov dword [rax], reloc.WS2_32.dll_ntohs
call fcn.140091298
mov dword [rax], reloc.WS2_32.dll_listen
call fcn.14008e400
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140085ca0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x1400ac0dd
lea eax, [rbx + 1]
jmp 0x1400ac0bf
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400ac0bd
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400ac0bf
Function at 0x1400ad524
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400912b8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400ad5ae
cmp byte [rbp - 0x21], r15b
je 0x1400ad5a9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400ad5e4
call fcn.1400a0780
test eax, eax
jne 0x1400ad5d0
cmp byte [rbp - 0x21], r15b
je 0x1400ad5c8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400ad5e4
cmp byte [rbp - 0x21], r15b
je 0x1400ad5e1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140099b08
test eax, eax
jne 0x1400ad684
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400912b8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400ad623
cmp byte [rbp - 0x21], r15b
je 0x1400ad658
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400ad658
call fcn.1400a0780
test eax, eax
jne 0x1400ad644
cmp byte [rbp - 0x21], r15b
je 0x1400ad63d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400ad658
cmp byte [rbp - 0x21], r15b
je 0x1400ad655
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140099b08
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x1400ad684
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x1400ad687
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x1400ad695
mov rcx, rdi
call fcn.1400a04d8
cmp byte [rbp + 0x3f], r15b
je 0x1400ad6a4
mov rcx, qword [rbp + 0x27]
call fcn.1400a04d8
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x40], rax
movsd xmm0, qword [0x140002260]
mov edx, 0xb
movzx edi, word [0x140002268]
mov r9d, 0x40
movzx ebx, byte [0x14000226a]
mov r8d, 0x3000
xor ecx, ecx
movsd qword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
xor r9d, r9d
mov r8, rax
mov dword [rsp + 0x20], 0
movsd qword [rax], xmm0
xor edx, edx
mov word [rax + 8], di
xor ecx, ecx
mov byte [rax + 0xa], bl
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400010c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140001988
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019d4
xor al, al
add rsp, 0x28
ret
Function at 0x1423c4210
Capabilities:
Encode data using xor

Disassembly:
lea rsi, [0x1423ac568]
lea rsp, [rsp + 8]
mov r9d, 0xe8366d97
movzx r9d, byte [rdx]
push 0xffffffff9f035b9c
xor r9d, ecx
and r9d, 0xff
mov r9d, dword [rsi + r9*4]
shl dword [rsp + 2], 0x10
shr ecx, 8
xor ecx, r9d
inc rdx
neg word [rsp]
xor ecx, 0xa91c2806
dec rax
lea rsp, [rsp + 8]
jne 0x1423c421c
mov r9d, 0xa6005f0c
pop r9
Function at 0x140002710
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000275a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000275a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000275a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000275a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000275a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000275c
xor al, al
add rsp, 0x28
ret
Function at 0x1400021dc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140004650], rbx
je 0x140002228
cmp rax, rbx
jne 0x14000221b
mov ebx, 1
mov esi, ebx
jmp 0x14000222d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002200
mov ebx, 1
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x140002243
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400022a8
mov eax, dword [0x140004658]
test eax, eax
jne 0x1400022a2
mov dword [0x140004658], ebx
lea r15, [0x1400033b0]
lea rdi, [0x140003398]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140002294
test eax, eax
jne 0x140002298
cmp qword [rdi], 0
je 0x140002289
mov rax, qword [rdi]
mov rcx, qword [0x140003378]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000226a
test eax, eax
je 0x1400022a8
mov eax, 0xff
jmp 0x140002384
mov dword [0x140004064], ebx
mov eax, dword [0x140004658]
cmp eax, ebx
jne 0x1400022cf
lea rdx, [0x140003390]
lea rcx, [0x140003380]
call sub.msvcrt.dll__initterm
mov dword [0x140004658], 2
test esi, esi
jne 0x1400022dc
xor eax, eax
xchg qword [0x140004650], rax
cmp qword [0x140004660], 0
je 0x140002310
lea rcx, [0x140004660]
call fcn.140002540
test eax, eax
je 0x140002310
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140004660]
mov r9, qword [0x140003378]
call r9
mov r8, qword [0x140004078]
mov rdx, qword [0x140004070]
mov ecx, dword [0x140004068]
call fcn.140001800
mov dword [0x140004060], eax
cmp dword [0x140004080], 0
jne 0x140002340
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140004064], 0
jne 0x140002355
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140004060]
jmp 0x140002384
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140128000
add rsp, 0x28
jmp 0x1400021dc

Function at 0x140002450
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000249c
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002494
cmp dword [rcx + 0x3c], edx
jl 0x140002494
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140002494
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000249c
mov rax, rdx
add rsp, 0x18
ret
Function at 0x141910a24
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp rdi
push rax
lahf
movsx ax, spl
push r13
cbw
bswap ax
cmovb rax, r8
push rcx
bswap eax
cwde
movzx rcx, bp
push rsi
cmovne rsi, r13
mov sil, r12b
push r14
not sil
movzx cx, r14b
push r12
movsxd rcx, edi
cmovg ax, r8w
push r15
push r9
cbw
push rdx
movsx ax, ch
cdqe
cdq
push r8
cdq
cwd
push r11
rdtsc
movsx ecx, r8w
xchg rsi, r9
push rbp
movsx rcx, r10w
push rbx
push r10
movsxd r9, r15d
cdq
movzx r9d, r8w
pushfq
push rdi
movzx r9, cx
sub r9, rsi
movabs rcx, 0
and bp, 0x383d
test r13b, r14b
shl rdi, cl
push rcx
rdtsc
mov rsi, qword [rsp + 0x90]
xor r9w, 0x2737
movzx r9w, spl
sub esi, 0x50510e96
or edx, r14d
rol ah, 0x29
shl dh, cl
not esi
sbb r9b, r9b
xor bp, 0x6cf4
adc al, spl
neg esi
sete dil
movzx r9w, dil
inc esi
rol esi, 1
sbb r9b, 0x6d
sub esi, 0x54e1507d
movsx bp, bl
neg esi
lea rsi, [rsi + rcx]
rol r9w, cl
add al, sil
shl rdx, cl
movabs rax, 0x100000000
add rsi, rax
clc
mov r9, rsp
ror edx, 0x54
sub rsp, 0x180
sbb dh, 0x8c
and rsp, 0xfffffffffffffff0
bt di, 0xe6
inc al
mov rbp, rsi
movsx ax, bh
bsf dx, bp
bts dx, sp
movabs rdx, 0
cdqe
sub rbp, rdx
lea rdi, [0x141910b4e]
test rbp, 0x1c6e01d1
xchg ah, al
ror rax, 0x17
sub rsi, 4
sal ax, cl
mov eax, dword [rsi]
clc
cmc
xor eax, ebp
cmp dil, 0xf0
xor eax, 0x38515e7a
test rsi, r9
cmp r14, 0x45a869a4
bswap eax
test esp, 0xea5ba4
test bl, r9b
cmc
add eax, 0x4b1026f5
cmp cl, dl
cmp dl, 0x53
not eax
clc
cmc
push rbp
xor ebp, r15d
sub bpl, dl
bts bp, r15w
xor dword [rsp], eax
add bpl, 0xfe
pop rbp
cmp esi, 0x3173325d
cmc
movsxd rax, eax
cmp bp, 0x3d62
add rdi, rax
jmp 0x1418b3833
Function at 0x140002830
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1400d6080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1400d7240]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x140002a4f
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140002a4f
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1400d7240]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140002904
movsx rdx, word [r8 + 0x5438]
lea rax, [r8 + 0x543c]
mov r9d, dword [r8 + 0x3fe8]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x1400028f9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5438], cx
movsx rax, cx
lea rax, [rax*8 + 0x543c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x5430]
test rdi, rdi
je 0x140002921
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140002924
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x1400beba8]
mov qword [rsi + 0x88], rax
mov qword [rsi + 0x98], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x140002967
mov rsi, qword [r8 + 0x98]
jmp 0x14000296a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140002995
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1400d7240]
mov rcx, qword [rax + 0x4bd0]
mov rax, qword [rdi]
mov rdx, qword [rcx]
mov qword [rdx + 0x30], rax
mov qword [rdx + 0x28], rax
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x140002a0f
inc rbx
cmp rbx, 5
jl 0x1400029f1
jmp 0x140002a3b
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x140002a51
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400ab050
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x140006e10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140006e6d
lea rbx, [0x1400c03c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140006e54
cmp r10, 2
jb 0x140006e54
cmp byte [r9], r8b
jne 0x140006e54
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140006e30
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140006eaf
lea rbx, [0x1400c03c0]
cmp r8b, 0x23
jne 0x140006e93
cmp byte [r9], r8b
jne 0x140006e93
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006e80
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140007070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x14000708e
mov qword [r8], r14
lea rdx, [0x1400bfe80]
call fcn.140006ec0
mov rbx, rax
test rax, rax
jne 0x1400070b3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400071df
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400071df
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400071df
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400071df
cmp rdi, 0xffffffffffffffff
je 0x1400071df
mov rcx, rdi
call fcn.14000b8a0
mov rbp, rax
test rax, rax
je 0x1400071df
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400071cc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1400d7240]
test r8, r8
je 0x1400071c1
movsx rdx, word [r8 + 0x5438]
lea rcx, [r8 + 0x543c]
mov r9d, dword [r8 + 0x3fe8]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1400071b6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5438], cx
movsx rax, cx
lea rcx, [r8 + 0x543c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x5434]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400071e8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400071da
mov qword [rsi], rdi
mov rax, rbp
jmp 0x1400071ea
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140015020
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1400c03c0]
movsxd rcx, dword [rcx + 0x108]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x110]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x40f8], ebx
jne 0x1400150b4
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14001f280
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140018bd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400d6080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400d7240]
mov edi, ecx
cmp byte [rbx + 0x4df5], 0
jne 0x140018c31
cmp byte [rbx + 0x4df6], 0
jne 0x140018c31
movsx r9d, word [rbx + 0x51f0]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140006c10
test dil, 2
je 0x140018d6f
jmp 0x140018ccb
movss xmm0, dword [rbx + 0x3a08]
mov eax, dword [rbx + 0x4ac0]
movaps xmm1, xmm0
mulss xmm1, dword [0x1400c57d0]
mulss xmm0, dword [0x1400c57c4]
addss xmm1, dword [rbx + 0xe0]
addss xmm0, dword [rbx + 0xe4]
test al, 1
jne 0x140018c8c
xor ecx, ecx
movss dword [rbx + 0x4ad0], xmm1
mov qword [rbx + 0x4ad8], rcx
or eax, 1
movss dword [rbx + 0x4ad4], xmm0
mov dword [rbx + 0x4ac4], 1
movss xmm0, dword [rbx + 0x3a64]
lea r8, str.Tooltip__02d
mulss xmm0, dword [0x1400c5740]
lea rcx, [rsp + 0x20]
movsx r9d, word [rbx + 0x51f0]
or eax, 0x40
mov edx, reloc.WS2_32.dll_recv
mov dword [rbx + 0x4ac0], eax
movss dword [rbx + 0x4b20], xmm0
call fcn.140006c10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018d20
lea r11, [0x1400c03c0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140018d03
cmp byte [r8], r9b
jne 0x140018d03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018cf0
not ecx
call fcn.14000ed10
test rax, rax
je 0x140018d6f
cmp byte [rax + 0xca], 0
je 0x140018d6f
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x51f0]
movsx r9d, word [rbx + 0x51f0]
call fcn.140006c10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140011c80
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ab050
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001db80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5358], 0
lea rbx, [rcx + 0x5360]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001dc27
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001dbda
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140020440
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400076f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5358]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5368]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400d7238]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001dc2f
mov rcx, rbx
call fcn.1400076f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001de90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1400d7240]
xor ebp, ebp
cmp byte [rbx + 0x52a0], bpl
jne 0x14001df6f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001df68
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140007070
mov rsi, rax
test rax, rax
je 0x14001df68
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x14001def4
mov rcx, rax
call fcn.14001e0c0
mov r8, qword [0x1400d7240]
test r8, r8
je 0x14001df5f
movsx rdx, word [r8 + 0x5438]
lea rcx, [r8 + 0x543c]
mov r9d, dword [r8 + 0x3fe8]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14001df54
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x5438], cx
movsx rax, cx
lea rcx, [r8 + 0x543c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x5434]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x52a0], 1
movss xmm0, dword [rbx + 0x52a4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001dffe
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x52a4], xmm0
jb 0x14001dffe
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14001dff1
mov rax, qword [0x1400d7240]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x52a4], ebp
call fcn.14001e320
lea rdx, [0x1400bfe84]
mov rcx, rdi
mov rsi, rax
call fcn.140006ec0
mov rdi, rax
test rax, rax
je 0x14001dff8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001dff8
mov byte [rbx + 0xb4], 1
mov dword [rbx + 0x52a4], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001e020
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400d7240]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001e083
mov qword [rsp], rbx
lea rbx, [0x1400c03c0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001e063
cmp byte [r8], r9b
jne 0x14001e063
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001e050
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x52b8]
not eax
mov r8, qword [r10 + 0x52c0]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14001e0af
cmp dword [r8 + 8], eax
je 0x14001e0b6
add r8, 0x48
cmp r8, rcx
jne 0x14001e0a0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret