joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005ff00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov r12, r8
mov rdi, rdx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebp, byte [rdx + 8]
cmp rbp, r8
seta al
test bpl, bpl
je 0x14006016c
test al, al
je 0x14006012a
mov r15, qword [rdi]
cmp r12, 1
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdi
je 0x14005ff9b
test r12, r12
je 0x140060173
lea rax, [r12 - 1]
nop dword [rax + rax]
mov rsi, qword [r15]
test rsi, rsi
je 0x140060161
mov rdx, rsi
not rdx
cmp qword [r15 + 8], rdx
jne 0x14006015c
bswap rsi
prefetcht0 byte [rsi]
mov r15, rsi
add rax, 0xffffffffffffffff
jne 0x14005ff70
mov r14, qword [r15]
xor esi, esi
test r14, r14
je 0x140060184
mov rax, r14
not rax
cmp qword [r15 + 8], rax
jne 0x14006015c
bswap r14
prefetcht0 byte [r14]
mov r13, qword [rcx + 0x5f8]
add r13, 8
mov edi, 1
mov rbx, qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
mov rcx, r13
call rbx
test al, al
jne 0x14006000a
jmp 0x14006014d
pause
dec eax
jne 0x14005ffe5
add esi, edi
add edi, edi
cmp edi, 0x40
mov eax, 0x40
cmovge edi, eax
cmp esi, 0x3e8
jl 0x14005ffd7
mov rcx, r13
call sub.KERNEL32.dll_AcquireSRWLockExclusive
test r14, r14
je 0x1400600ec
movaps xmm6, xmmword [0x1400dba00]
lea rdx, [rsp + 0x40]
nop
mov rbp, r14
mov r14, qword [r14]
test r14, r14
je 0x1400600c2
mov rcx, r14
not rcx
cmp qword [rbp + 8], rcx
jne 0x14006015c
bswap r14
prefetcht0 byte [r14]
mov rcx, rbp
and rcx, 0xffffffffffe00000
mov rax, rbp
shr rax, 9
and eax, 0xfe0
lea rsi, [rcx + rax]
add rsi, 0x1000
movzx ebx, byte [rcx + rax + 0x101e]
mov rax, rbx
shl rax, 5
mov rcx, rsi
sub rcx, rax
movaps xmmword [rsp + 0x40], xmm6
mov rdi, qword [rcx]
cmp rdi, rbp
je 0x140060169
neg rbx
bswap rdi
mov qword [rbp], rdi
not rdi
mov qword [rbp + 8], rdi
mov qword [rcx], rbp
shl rbx, 5
movzx eax, word [rsi + rbx + 0x18]
add eax, 0xffffffff
mov word [rsi + rbx + 0x18], ax
test ax, ax
jle 0x1400600ca
test r14, r14
jne 0x140060020
jmp 0x1400600ec
xor r14d, r14d
jmp 0x140060046
mov rsi, rdx
int3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [r15], 0
mov qword [r15 + 8], 0xffffffffffffffff
mov rsi, qword [rsp + 0x28]
mov byte [rsi + 8], r12b
movzx eax, r12b
sub rax, qword [rsp + 0x30]
movzx ecx, word [rsi + 0xa]
imul rcx, rax
mov rax, qword [rsp + 0x38]
add qword [rax + 0x590], rcx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140069700
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, edi
test edi, edi
jg 0x14005ffe5
jmp 0x14005ffed
call fcn.140094b70
xor r15d, r15d
jmp 0x14005ff95
int3
xor eax, eax
jmp 0x14005ff3d
mov rdx, r15
int3
xor r14d, r14d
jmp 0x14005ffc0
Function at 0x140060710
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400fdf30]
cmp rsi, 1
jbe 0x140060733
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400fdf30]
call fcn.14003d910
test al, al
je 0x140060779
mov qword [0x1400fdf38], 0
lea rdi, [0x1400fdf30]
lea rsi, [0x1400fdf38]
mov rcx, rsi
xor edx, edx
call fcn.140036db0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14003d9b0
jmp 0x140060723
mov rsi, qword [0x1400fdf30]
jmp 0x140060723

Function at 0x140060b80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x1400fdf58]
cmp rsi, 1
jbe 0x140060ba3
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400587a0
lea rcx, [0x1400fdf58]
call fcn.14003d910
test al, al
je 0x140060be9
mov qword [0x1400fdf60], 0
lea rdi, [0x1400fdf58]
lea rsi, [0x1400fdf60]
mov rcx, rsi
xor edx, edx
call fcn.140036db0
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.14003d9b0
jmp 0x140060b93
mov rsi, qword [0x1400fdf58]
jmp 0x140060b93

Function at 0x140061170
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x14006119c
xor ecx, ecx
lea r9, [0x1400e37a0]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
add rcx, 1
cmp r8, rcx
jne 0x140061180
ret
Function at 0x14006a58d
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006a5ab
je 0x14006a5b6
call 0x14006a605
mov bl, 0xc7
lahf
pop rsi
jne 0x14006a596
call 0x14006a5ae
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14006a596
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14006a5e4
je 0x14006a622
invalid
je 0x14006a633
jne 0x14006a596
lea rax, [0x14006a4bc]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14006621d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14006a6d4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14006a72d
je 0x14006a733
call 0x14006a724
fild qword [rdi - 0x7c]
jmp 0x174fa6ea6
jne 0x14006a6f6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14006a6b6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14006a5a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006a5ab
je 0x14006a5b6
call 0x14006a605
mov bl, 0xc7
lahf
pop rsi
jne 0x14006a596
call 0x14006a5ae
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14006a596
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14006a5e4
je 0x14006a622
invalid
je 0x14006a633
jne 0x14006a596
lea rax, [0x14006a4bc]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14006621d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14006a6d4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14006a72d
je 0x14006a733
call 0x14006a724
fild qword [rdi - 0x7c]
jmp 0x174fa6ea6
jne 0x14006a6f6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14006a6b6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14006a5cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006a5ab
je 0x14006a5b6
call 0x14006a605
mov bl, 0xc7
lahf
pop rsi
jne 0x14006a596
call 0x14006a5ae
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14006a596
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14006a5e4
je 0x14006a622
invalid
je 0x14006a633
jne 0x14006a596
lea rax, [0x14006a4bc]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14006621d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14006a6d4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14006a72d
je 0x14006a733
call 0x14006a724
fild qword [rdi - 0x7c]
jmp 0x174fa6ea6
jne 0x14006a6f6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14006a6b6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14006a605
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14006a5ab
je 0x14006a5b6
call 0x14006a605
mov bl, 0xc7
lahf
pop rsi
jne 0x14006a596
call 0x14006a5ae
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14006a596
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14006a5e4
je 0x14006a622
invalid
je 0x14006a633
jne 0x14006a596
lea rax, [0x14006a4bc]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x14006621d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14006a6d4
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14006a72d
je 0x14006a733
call 0x14006a724
fild qword [rdi - 0x7c]
jmp 0x174fa6ea6
jne 0x14006a6f6
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14006a6b6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x140097410
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x40], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x40]
mov qword [r14 - 8], r12
lea r13, [rsp + 0x30]
lea r15, [rsp + 0x38]
mov ebp, 0xffffffff
mov qword [rsp + 0x30], r12
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x30]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.14007f968
cmp rax, rbx
jne 0x1400974ac
cmp edi, 1
je 0x140097454
cmp edi, 2
je 0x1400974ac
mov rcx, qword [rsi + 0x40]
call fcn.14007ec58
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140069700
mov eax, ebp
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400974d0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140097505
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14007f968
xor ebx, ebx
test rsi, rsi
jle 0x14009752a
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x14009752a
inc rbx
cmp rsi, rbx
jne 0x14009750c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140097540
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rax, qword [0x1400f4028]
xor rax, rsp
mov qword [rsp + 0x60], rax
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x58], r12
cmp edx, 0xffffffff
je 0x1400975aa
mov r15d, edx
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x1400975d0
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.14007f968
mov esi, 0xffffffff
cmp rax, 1
je 0x1400975ad
jmp 0x1400975b0
xor r15d, r15d
mov esi, r15d
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069700
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x58]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
lea rsi, [rsp + 0x57]
lea r14, [rsp + 0x40]
mov qword [rsp + 0x40], r12
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r13
lea rbp, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x140097680
mov ebp, eax
cmp eax, 3
je 0x14009765f
cmp ebp, 1
ja 0x140097680
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.14007f968
cmp rax, rsi
jne 0x140097680
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x1400975e8
jmp 0x1400975ad
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.14007f968
cmp rax, 1
je 0x1400975ad
mov esi, 0xffffffff
jmp 0x1400975b0

Function at 0x1400976d0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x140097705
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14007f968
xor ebx, ebx
test rsi, rsi
jle 0x14009772b
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x14009772b
inc rbx
cmp rsi, rbx
jne 0x14009770c
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000b6a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000b6c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000b73c
mov rdi, r14
mov rcx, rbx
call fcn.14000e6e0
test rax, rax
jle 0x14000b714
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400a6380
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000b72c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000b734
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000b6d6
sub r14, rdi
jmp 0x14000b81f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b753
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b755
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b787
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a6380
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000b81c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000b7c2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000b7fd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b5fc8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000b81c
cmp rbp, rax
ja 0x14000b7d0
test rbp, rbp
je 0x14000b81c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b5fc8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140026220
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14002627d
lea rbx, [0x140145eb0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140026264
cmp r10, 2
jb 0x140026264
cmp byte [r9], r8b
jne 0x140026264
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140026240
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400262bf
lea rbx, [0x140145eb0]
cmp r8b, 0x23
jne 0x1400262a3
cmp byte [r9], r8b
jne 0x1400262a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140026290
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140026400
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14002641a
mov qword [r8], 0
lea rdx, [0x140152288]
call fcn.1400262d0
mov rbx, rax
test rax, rax
jne 0x14002643a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400b7134
mov esi, eax
cmp eax, 0xffffffff
je 0x140026508
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400b6398
test eax, eax
jne 0x140026508
mov rcx, rbx
call fcn.1400b7134
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140026508
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400b6398
test eax, eax
jne 0x140026508
cmp rdi, 0xffffffffffffffff
je 0x140026508
mov rax, qword [0x140176a70]
test rax, rax
je 0x1400264aa
inc dword [rax + 0xec]
mov rcx, rdi
call fcn.1400ba0b4
mov rsi, rax
test rax, rax
je 0x140026508
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400b5fc8
mov rcx, rbx
cmp rax, rdi
je 0x1400264f6
call fcn.1400ae8d8
mov rax, qword [0x140176a70]
test rax, rax
je 0x1400264ec
dec dword [rax + 0xec]
mov rcx, rsi
call fcn.1400aa908
jmp 0x140026510
call fcn.1400ae8d8
test r14, r14
je 0x140026503
mov qword [r14], rdi
mov rax, rsi
jmp 0x140026512
mov rcx, rbx
call fcn.1400ae8d8
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140028d00
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140145eb0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140176a70]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3ef4], ebx
jne 0x140028d8d
mov dword [rax + 0x3ef8], ebx
cmp dword [rax + 0x3f40], ebx
jne 0x140028d9c
mov byte [rax + 0x3f44], 1
cmp dword [rax + 0x3edc], ebx
jne 0x140028db3
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.14003b670
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140028dc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0xe8]
lea r8, [0x140145eb0]
movss xmm3, dword [rcx + 0xec]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xd0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xc8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
movss dword [rsp + 4], xmm1
subss xmm0, xmm2
movss xmm1, dword [rdx + 0xc]
mov edx, dword [rax + rcx*4 - 4]
subss xmm1, xmm3
movzx eax, byte [rsp]
not edx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 1]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 2]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 3]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 4]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 5]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 6]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 7]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 8]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 9]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xb]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xc]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xd]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xe]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xf]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140176a70]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x3ef4], edx
jne 0x140028f5f
mov dword [rax + 0x3ef8], edx
cmp dword [rax + 0x3f40], edx
jne 0x140028f6e
mov byte [rax + 0x3f44], 1
mov eax, edx
add rsp, 0x18
ret