joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411250
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00413b80
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.00413b80
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x4112c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0041ea54]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x411468
mov rax, qword [0x0041ea58]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x41130c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x411397
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x4112f0
mov rcx, r12
call fcn.00412020
mov rbp, rax
test rax, rax
je 0x4114a2
mov rax, qword [0x0041ea58]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.00412150
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0041ea58]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4114b1
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x411390
sub eax, 4
and eax, 0xfffffffb
jne 0x411420
add dword [0x0041ea54], 1
cmp ebx, 8
jae 0x4113c8
test bl, 4
jne 0x411470
test ebx, ebx
je 0x4113b9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x411490
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x4113b9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x4113fa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0041ea58]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x411390
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00411250
nop dword [rax]
xor edi, edi
jmp 0x411317
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x4113b9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x4113b9
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.00411250
mov rax, qword [0x0041ea58]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.00411250
nop
nop dword [rax]
Function at 0x411c90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0041ed40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0041ed20]
test rbx, rbx
je 0x411ce4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x411cdb
test r12, r12
je 0x411cdb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x411cc0
lea rcx, [0x0041ed40]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x412020
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0041af50]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x412099
mov rcx, r10
call fcn.00411ef0
test eax, eax
je 0x412099
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x412096
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x41208d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x412099
add r8, 0x28
cmp r8, r9
jne 0x412078
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140004f20
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
mov r8d, 0x100
mov eax, 1
cmp rdx, 0x40
jb 0x140005022
test cl, 3
je 0x140004f47
mov r8d, 0x400
jmp 0x140005022
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x14000501c
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x140004f3c
cmp r9d, 0x1000000
jbe 0x140004f76
mov r8d, 0x700
jmp 0x140005022
lea r11, [r9 + 0x88]
cmp r11, rdx
ja 0x140005022
cmp dword [rcx + r9], 0x4550
jne 0x14000501c
movzx esi, word [rcx + r9 + 0x18]
cmp esi, 0x20b
je 0x140004faa
cmp esi, 0x10b
jne 0x14000501c
mov edi, dword [rcx + r9 + 0x54]
cmp rdi, rdx
ja 0x140005022
mov r10d, dword [rcx + r9 + 0x50]
cmp edi, r10d
ja 0x140004f6b
movzx esi, si
cmp esi, 0x20b
jne 0x140005028
mov esi, dword [rcx + r9 + 0x84]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x140005022
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x140004f6b
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x140005022
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x140005022
mov r8d, 0x500
or rax, r8
pop rdi
pop rsi
ret
mov r8d, 0x600
jmp 0x140005022
Function at 0x140005760
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 4], 0
mov qword [rbp - 0x30], rdx
mov r14, qword [rdx]
mov edi, 8
lea r15, [rbp - 4]
xor ebx, ebx
xor esi, esi
jmp 0x1400057bd
mov r13, r12
mov qword [rbp - 0x18], r13
mov rbx, r13
mov esi, r12d
lea r8d, [rbx*8]
mov dword [rsp + 0x20], 3
mov rcx, r14
mov rdx, rdi
mov r9, r15
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x14000585c
mov r12d, dword [rbp - 4]
cmp r12d, esi
jbe 0x1400058b8
mov rsi, r12
sub rsi, rbx
jbe 0x1400057b0
mov rax, qword [rbp - 0x20]
sub rax, rbx
mov r13, rbx
cmp rax, rsi
jae 0x14000581a
lea rcx, [rbp - 0x28]
mov rdx, rbx
mov r8, rsi
call fcn.14001f870
mov rdi, qword [rbp - 0x28]
mov r13, qword [rbp - 0x18]
lea rcx, [rdi + r13*8]
cmp rsi, 2
jb 0x14000584d
mov r8, rbx
not r8
add r8, r12
shl r8, 3
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [r12 + r13]
sub rax, rbx
lea rcx, [rdi + rax*8]
add rcx, 0xfffffffffffffff8
add r13, rsi
dec r13
mov qword [rcx], 0
inc r13
jmp 0x1400057b3
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 8], rax
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rcx + 0x10], xmm0
mov rax, qword [rbp - 0x38]
mov qword [rcx + 0x20], rax
mov qword [rcx], 0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x1400058a3
shl rdx, 3
mov r8d, 8
mov rcx, rdi
call fcn.1400036c0
mov rax, qword [rbp - 0x10]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r14d, r12d
shr r14d, 3
cmp rbx, r14
jb 0x140005988
cmp r12d, 8
jae 0x1400058da
mov eax, 8
xor ecx, ecx
jmp 0x14000595f
mov r15, r14
shl r15, 4
movzx eax, byte [0x140032161]
mov edx, 8
mov rcx, r15
call fcn.1400036b0
test rax, rax
je 0x14000599c
cmp r14d, 1
jne 0x14000590c
xor ecx, ecx
mov r10, qword [rbp - 0x30]
jmp 0x140005945
mov edx, r14d
and edx, 0xfffffffe
lea r8, [rax + 0x18]
xor ecx, ecx
mov r10, qword [rbp - 0x30]
nop dword [rax]
mov r9, qword [rdi + rcx*8]
mov qword [r8 - 0x18], r10
mov qword [r8 - 0x10], r9
mov r9, qword [rdi + rcx*8 + 8]
mov qword [r8 - 8], r10
mov qword [r8], r9
add rcx, 2
add r8, 0x20
cmp rdx, rcx
jne 0x140005920
test r14b, 1
je 0x14000595c
mov rdx, qword [rdi + rcx*8]
shl rcx, 4
mov qword [rax + rcx], r10
mov qword [rax + rcx + 8], rdx
mov rcx, r14
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], rcx
mov qword [rdx], 4
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x140005891
jmp 0x1400058a3
lea r8, str.C:Users.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinproc_0.6.4_srcprocessmod.rs
mov rcx, r14
mov rdx, rbx
call fcn.140020a20
jmp 0x1400059a9
mov ecx, 8
mov rdx, r15
call fcn.140020440
ud2
Function at 0x140008430
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400084c0
jmp 0x1400084af
jae 0x140008580
cmp r8, 0x201
jae 0x1400084c0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140008518
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400084ef
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001fab0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140008541
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400085e8
mov r8d, r14d
cmp r15, r8
jne 0x1400084a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000860b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400084af
jmp 0x1400084c0
cmp rsi, r8
jb 0x140008625
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140009e60
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400085d1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400036c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400085b9
jmp 0x1400085d1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400205d0
jmp 0x14000863a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140020a20
ud2
Function at 0x14000eca0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140026748]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000ece4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000ed4a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000ed81
test eax, eax
js 0x14000ed5b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000ed74
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.140009c00
mov rcx, rax
call fcn.140006510
mov ecx, 7
int 0x29
ud2
Function at 0x14001d130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001d1aa
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001d1a0
cmp r11, r10
ja 0x14001d243
cmp r10, rdx
ja 0x14001d257
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001d1a2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001d180
jmp 0x14001d217
ja 0x14001d1aa
mov r11, r10
cmp rax, r8
jne 0x14001d152
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001d21b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001d1f0
mov r8, r10
sub ecx, r9d
jns 0x14001d20e
jmp 0x14001d21d
cmp r10, rdx
je 0x14001d229
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001d21d
xor al, 1
cmp r8, rdx
jne 0x14001d1d0
jmp 0x14001d21d
xor eax, eax
jmp 0x14001d21d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400205d0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140020aa0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140020a20
ud2

Function at 0x14001f354
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f39e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f39e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f39e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f39e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f39e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001f3a0
xor al, al
add rsp, 0x28
ret
Function at 0x180002800
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000285d
lea rbx, [0x180046c80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180002844
cmp r10, 2
jb 0x180002844
cmp byte [r9], r8b
jne 0x180002844
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002820
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000289f
lea rbx, [0x180046c80]
cmp r8b, 0x23
jne 0x180002883
cmp byte [r9], r8b
jne 0x180002883
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180002870
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800029e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800029fa
mov qword [r8], 0
lea rdx, [0x180046a7c]
call fcn.1800028b0
mov rbx, rax
test rax, rax
jne 0x180002a1a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180002af1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002af1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180002af1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002af1
cmp rdi, 0xffffffffffffffff
je 0x180002af1
mov rax, qword [0x180055390]
test rax, rax
je 0x180002a8e
inc dword [rax + 0x3b4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180002af1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180002ade
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180055390]
test rax, rax
je 0x180002ad3
dec dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002afa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180002aec
mov qword [r14], rdi
mov rax, rsi
jmp 0x180002afc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000e0d0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x180055390]
lea rdx, [0x180046c80]
mov r8, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x18000e1d1
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18000e1bd
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000e1c2
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180015b50
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18000e1f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x180055390]
lea rdx, [0x180046c80]
mov r8d, ecx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x18000e2a7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18000e293
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000e298
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180015b50
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18000f140
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180054010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180055390]
mov edi, edx
cmp byte [rbx + 0x1e25], 0
jne 0x18000f1a0
cmp byte [rbx + 0x1e26], 0
jne 0x18000f1a0
mov r9d, dword [rbx + 0x2ec8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180002780
test dil, 1
je 0x18000f2be
jmp 0x18000f228
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2ec8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x18004be38]
mulss xmm1, dword [0x18004be28]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x18004bd70]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
call fcn.180002780
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18000f278
lea r11, [0x180046c80]
cmp r9b, 0x23
jne 0x18000f25b
cmp byte [r8], r9b
jne 0x18000f25b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000f248
not ecx
call fcn.180008d60
test rax, rax
je 0x18000f2be
cmp byte [rax + 0x8e], 0
je 0x18000f2be
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ec8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ec8]
call fcn.180002780
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000b370
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180044150
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180013ec0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x180055390]
cmp byte [rbx + 0x2f5c], 0
je 0x180013fac
cmp qword [rbx + 0x2f68], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f70]
je 0x180013f94
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x180013f3b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180015980
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.180003020
mov eax, dword [rdi]
lea rcx, [0x180055388]
mov r9, qword [rbx + 0x2f68]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x2f78]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180003020
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret