joyce8/EMBER2024-capa huggingface dataset:
Function at 0x238b76babe0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor eax, eax
test eax, eax
je 0x238b76babf1
jmp 0x238b76babe9
mov rax, qword [rsp + 0x60]
mov eax, dword [rax + 0x3c]
add rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0xc], 0
je 0x238b76bac5f
xor eax, eax
test eax, eax
je 0x238b76bac4f
jmp 0x238b76bac47
mov rax, qword [rsp + 0x30]
add rax, 0x14
mov qword [rsp + 0x30], rax
jmp 0x238b76bac3c
xor eax, eax
test eax, eax
je 0x238b76bac67
jmp 0x238b76bac5f
mov eax, dword [0x238b76c9fd8]
mov r8d, eax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [0x238b76c9fd0]
call fcn.238b76aca44
test eax, eax
je 0x238b76bad34
xor eax, eax
test eax, eax
je 0x238b76bac91
jmp 0x238b76bac89
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
mov eax, dword [0x238b76c9fd8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [str.p_t1c]
call qword [rax + 0x1f8]
test eax, eax
jne 0x238b76bacd9
xor eax, eax
test eax, eax
je 0x238b76bacd2
jmp 0x238b76bacca
mov eax, 0xffffffff
jmp 0x238b76bad3e
mov eax, dword [0x238b76c9fd8]
mov r8d, eax
mov rdx, qword [0x238b76c9fd0]
mov rcx, qword [rsp + 0x28]
call fcn.238b76ac93c
mov eax, dword [0x238b76c9fd8]
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
mov rax, qword [str.p_t1c]
call qword [rax + 0x1f8]
test eax, eax
jne 0x238b76bad2a
xor eax, eax
test eax, eax
je 0x238b76bad23
jmp 0x238b76bad1b
mov eax, 0xffffffff
jmp 0x238b76bad3e
xor eax, eax
test eax, eax
je 0x238b76bad32
jmp 0x238b76bad2a
jmp 0x238b76bad3c
xor eax, eax
test eax, eax
je 0x238b76bad3c
jmp 0x238b76bad34
xor eax, eax
add rsp, 0x58
ret
Function at 0x238b76bb878
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [rdx], ecx
mov dword [rdx + 0x9c0], r8d
movsxd rcx, r8d
mov eax, dword [rdx + rcx*4 - 4]
shr eax, 0x1e
xor eax, dword [rdx + rcx*4 - 4]
imul eax, eax, 0x6c078965
add eax, r8d
mov dword [rdx + rcx*4], eax
mov r8d, dword [rdx + 0x9c0]
inc r8d
mov dword [rdx + 0x9c0], r8d
cmp r8d, 0x270
jl 0x238b76bb887
ret

Function at 0x238b76bb8bc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, dword [rcx + 0x9c0]
mov r8, rcx
cmp r9d, 0x270
jl 0x238b76bb982
xor r9d, r9d
lea rbx, [0x238b76c7040]
mov r10d, r9d
mov r11d, 0x7fffffff
mov edx, 0xe3
mov ecx, dword [r8 + r10*4]
xor ecx, dword [r8 + r10*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + r10*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + r10*4 + 0x634]
mov dword [r8 + r10*4], ecx
inc r10
cmp r10, rdx
jl 0x238b76bb8f0
mov ecx, dword [r8 + rdx*4]
xor ecx, dword [r8 + rdx*4 + 4]
and ecx, r11d
xor ecx, dword [r8 + rdx*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + rdx*4 - 0x38c]
mov dword [r8 + rdx*4], ecx
inc rdx
cmp rdx, 0x26f
jl 0x238b76bb91e
mov eax, dword [r8 + 0x9bc]
mov edx, eax
xor edx, dword [r8]
and edx, r11d
xor edx, eax
mov eax, edx
shr edx, 1
and eax, 1
mov ecx, dword [rbx + rax*4]
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
mov dword [r8 + 0x9c0], r9d
mov rbx, qword [rsp + 8]
movsxd rax, r9d
mov ecx, dword [r8 + rax*4]
lea eax, [r9 + 1]
mov dword [r8 + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x238b76be990
Capabilities:
Hash data with crc32

Disassembly:
mov r8d, ecx
lea r9, [0x238b76c1cc0]
shr r8d, 8
movzx ecx, cl
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r9 + rdx*4]
mov eax, r8d
ret
Function at 0x14000117c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r9b, r9b
movzx r11d, cl
shl r11d, 2
mov rbx, r8
movzx r8d, r9b
xor r10b, r10b
add r8d, r11d
shl r8d, 2
movzx eax, r10b
inc r10b
add eax, r8d
mov cl, byte [rax + rbx]
xor byte [rdx], cl
inc rdx
cmp r10b, 4
jb 0x14000119d
inc r9b
cmp r9b, 4
jb 0x14000118f
mov rbx, qword [rsp + 8]
ret

Function at 0x1400011c4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov r8, rdx
mov rdx, rcx
mov rbx, rcx
xor ecx, ecx
call fcn.14000117c
mov dil, 1
lea r14, [rbx + 2]
mov r12d, 4
mov rdx, rbx
mov r8, r12
mov rcx, rdx
mov r9, r12
movzx eax, byte [rcx]
lea r10, str.cw
mov al, byte [rax + r10]
mov byte [rcx], al
add rcx, r12
sub r9, 1
jne 0x14000120d
inc rdx
sub r8, 1
jne 0x140001207
mov al, byte [rbx + 5]
mov cl, byte [rbx + 1]
mov byte [rbx + 1], al
mov al, byte [rbx + 9]
mov byte [rbx + 5], al
mov al, byte [rbx + 0xd]
mov byte [rbx + 9], al
mov al, byte [rbx + 0xa]
mov byte [rbx + 0xd], cl
mov cl, byte [r14]
mov byte [r14], al
mov al, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
mov cl, byte [rbx + 6]
mov byte [rbx + 6], al
mov al, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
mov cl, byte [rbx + 3]
mov byte [rbx + 3], al
mov al, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
mov al, byte [rbx + 7]
mov byte [rbx + 0xb], al
mov byte [rbx + 7], cl
cmp dil, 0xa
je 0x14000133c
mov r15, r14
mov rbp, r12
mov r11b, byte [r15 - 2]
mov r8b, byte [r15 - 1]
mov dl, r11b
mov r9b, byte [r15]
xor dl, r8b
xor r9b, byte [r15 + 1]
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
mov r10b, r9b
imul ecx, eax, 0x1b
xor r10b, r11b
xor r10b, r8b
xor cl, dl
mov dl, byte [r15]
xor cl, r11b
xor dl, r8b
xor r11b, byte [r15 + 1]
xor cl, r10b
mov byte [r15 - 2], cl
mov al, dl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
mov al, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r10b
mov byte [r15 - 1], cl
imul ecx, eax, 0x1b
mov al, r11b
shr al, 7
add r11b, r11b
movzx eax, al
xor cl, r9b
xor cl, byte [r15]
xor cl, r10b
mov byte [r15], cl
imul ecx, eax, 0x1b
xor cl, r11b
xor cl, byte [r15 + 1]
xor cl, r10b
mov byte [r15 + 1], cl
add r15, r12
sub rbp, 1
jne 0x140001287
mov r8, rsi
mov rdx, rbx
mov cl, dil
call fcn.14000117c
inc dil
jmp 0x140001201
mov r8, rsi
mov rdx, rbx
mov cl, 0xa
call fcn.14000117c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140002e64
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
xor eax, eax
lea rcx, [rbp - 0x19]
mov rbx, rdx
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rbp - 0x39], xmm0
lea r8d, [rax + 0x68]
call sub.VCRUNTIME140.dll_memset
lea rax, str.winsta0default
mov dword [rbp - 0x19], 0x68
mov rcx, rbx
mov qword [rbp - 9], rax
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
and qword [rbp + 0x67], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x77]
mov edx, 0xf01ff
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp eax, 1
jne 0x140002eeb
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp + 0x67]
xor r8d, r8d
call qword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
lea rax, [rbp - 0x39]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp - 0x19]
xor edx, edx
mov qword [rsp + 0x40], rax
mov rcx, rbx
and qword [rsp + 0x38], 0
mov rax, qword [rbp + 0x67]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x628
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x140002f4e
mov rcx, qword [rbp - 0x39]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0xf8]
add rsp, 0xe0
pop rbp
ret
Function at 0x140005470
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x1400054ad
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14000560c
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400055ac
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14000560c
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x140005520
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.14000141c
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x1400055eb
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400055eb
call fcn.1400045b0
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x1400055d2
mov rcx, r14
call fcn.1400045b0
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x14003ce40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140173020]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x14003ce74
xor eax, eax
jmp 0x14003d020
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14003ce9c
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.14003db00
jmp 0x14003d020
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call fcn.14003e8b0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14003cf38
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14001c0c0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.14003ea70
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.140016580
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.14003e9d0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14003d010
mov rcx, qword [rsp + 0x70]
call fcn.14003e420
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x14003cfd8
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400cfac0
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14003cfd6
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14003d020
jmp 0x14003cf5e
cmp qword [rsp + 0x40], 0
jbe 0x14003d010
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400cfac0
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400badc0
add rsp, 0x68
ret
Function at 0x140042550
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x88]
call fcn.1400cd678
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140042588
mov eax, 0xfffffffd
jmp 0x1400426da
mov rcx, qword [rsp + 0x88]
call fcn.1400c8c54
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x1400425aa
mov eax, 0xfffffffd
jmp 0x1400426da
cmp dword [rsp + 0x20], 0
jne 0x1400425b8
xor eax, eax
jmp 0x1400426da
mov eax, dword [rsp + 0x20]
inc eax
cdqe
lea rdx, [0x1400f847c]
mov rcx, rax
call fcn.1400bb548
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400425f0
mov eax, 0xfffffffe
jmp 0x1400426da
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call fcn.1400cd678
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x88]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400cfac0
mov qword [rsp + 0x40], rax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x40], rax
je 0x140042681
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1400bade0
cmp qword [rsp + 0x38], 0
jne 0x140042667
mov qword [rsp + 0x58], 0
jmp 0x14004267a
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov eax, 0xfffffffd
jmp 0x1400426da
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140044180
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1400bade0
cmp qword [rsp + 0x48], 0
jne 0x1400426c3
mov qword [rsp + 0x60], 0
jmp 0x1400426d6
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x34]
add rsp, 0x78
ret

Function at 0x14004d9e0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14011b900]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14004da66
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x14004da12
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x14004da70
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14011b900]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14004db6b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14004db66
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 1], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14004db3b
cmp qword [rsp + 0x38], 2
jb 0x14004db3b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004db3b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004db3b
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14004dab7
jmp 0x14004dbf4
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp]
test eax, eax
je 0x14004dbf4
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14004dbca
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004dbca
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14004dbca
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14004db6b
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret

Function at 0x14004de30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400cfac0
add rsp, 0x28
ret
Function at 0x1400654d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140021d80
mov eax, dword [rsp + 0x78]
and eax, 1
test eax, eax
je 0x14006559a
mov edx, dword [rsp + 0x80]
mov ecx, 0x14
call fcn.1400652a0
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x13
call fcn.1400652a0
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x12
call fcn.1400652a0
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x11
call fcn.1400652a0
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x28]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x44]
call fcn.140021d80
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.1400496d0
mov eax, dword [rsp + 0x78]
and eax, 2
test eax, eax
je 0x14006563c
mov edx, dword [rsp + 0x80]
mov ecx, 7
call fcn.1400652a0
movss dword [rsp + 0x2c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 6
call fcn.1400652a0
movss xmm1, dword [rsp + 0x2c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 5
call fcn.1400652a0
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 4
call fcn.1400652a0
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x34]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x4c]
call fcn.140021d80
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.1400496d0
mov eax, dword [rsp + 0x78]
and eax, 4
test eax, eax
je 0x1400656de
mov edx, dword [rsp + 0x80]
mov ecx, 0xb
call fcn.1400652a0
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0xa
call fcn.1400652a0
movss xmm1, dword [rsp + 0x38]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 9
call fcn.1400652a0
movss dword [rsp + 0x3c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 8
call fcn.1400652a0
movss xmm1, dword [rsp + 0x3c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x40]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x54]
call fcn.140021d80
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.1400496d0
movss xmm0, dword [rsp + 0x88]
ucomiss xmm0, dword [0x140164a24]
jp 0x1400656f2
je 0x140065716
mov ecx, 0xe
call fcn.14004c270
movzx eax, al
test eax, eax
je 0x140065716
movss xmm1, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
call fcn.140049680
movss xmm0, dword [rsp + 0x90]
ucomiss xmm0, dword [0x140164a24]
jp 0x14006572a
je 0x14006574e
mov ecx, 0xf
call fcn.14004c270
movzx eax, al
test eax, eax
je 0x14006574e
movss xmm1, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140049680
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140073fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140173020]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x6c], xmm0
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.140072bc0
test eax, eax
je 0x140074168
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0xe
mov rcx, rax
call fcn.140052130
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.140072bc0
test eax, eax
je 0x140074168
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x50], eax
je 0x14007415c
mov r8d, 0x8c6
lea rdx, [0x14012b8b0]
lea rcx, str.output_ctx.num_vertices__count_ctx.num_vertices
call fcn.1400c7f74
xor eax, eax
xor eax, eax
test eax, eax
jne 0x140074134
mov eax, dword [rsp + 0x50]
jmp 0x140074179
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400badc0
add rsp, 0xa8
ret