joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fd9c
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
cmp qword [rcx + 0xb0], rdi
je 0x14002fe1e
xor r8d, r8d
call fcn.14002fc60
mov rsi, rax
test rax, rax
je 0x14002feb7
mov ecx, dword [rsp + 0x70]
mov r9d, 3
mov dword [rsp + 0x28], ecx
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete dil
mov eax, edi
jmp 0x14002feb7
mov ebp, dword [rsp + 0x70]
mov eax, 2
lea ecx, [rbp*2 + 1]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140015344
mov r14, rax
mov r8d, edi
test ebp, ebp
je 0x14002fe82
mov rdx, rax
mov r8d, ebp
mov r9d, ebp
mov al, byte [rbx]
and al, 0xf
movzx ecx, al
add cx, 0x41
mov word [rdx], cx
lea rdx, [rdx + 4]
mov al, byte [rbx]
inc rbx
shr al, 4
movzx ecx, al
add cx, 0x41
mov word [rdx - 2], cx
sub r9, 1
jne 0x14002fe57
lea eax, [r8 + r8]
mov word [r14 + rax*2], di
mov rax, qword [rsi]
mov rbx, qword [rax + 0x110]
mov rcx, rbx
call fcn.140037cac
mov r9, r14
mov r8, r12
mov rdx, r15
mov rcx, rsi
call rbx
mov rcx, r14
mov ebx, eax
call fcn.14001533c
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret

Function at 0x140031c3c
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov rcx, qword [rdx]
cmp dword [rcx - 0x10], 0
je 0x140031c6e
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140031c6e
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.140035588
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140031c80
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140031cab
mov r8, rdx
mov rdx, qword [rdi]
call fcn.140029820
jmp 0x140031d23
cmp byte [0x14007ef58], 0
jne 0x140031cf2
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140031ce2
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14007ef50], rax
jmp 0x140031ce9
mov rbx, qword [0x14007ef50]
mov byte [0x14007ef58], 1
jmp 0x140031cf9
mov rbx, qword [0x14007ef50]
test rbx, rbx
je 0x140031d17
mov rcx, rbx
call fcn.140037cac
mov r8d, dword [rdi + 8]
xor r9d, r9d
mov rcx, qword [rdi]
mov rdx, rsi
call rbx
jmp 0x140031d23
mov rcx, qword [rdi]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140041ca8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140041a7c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140041a7c
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140041a7c
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140041a7c
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140041a7c
cmp dword [rcx + 0x84], 0xe
jbe 0x140041a7c
cmp dword [rcx + 0xf8], esi
je 0x140041a7c
mov ecx, r14d
call fcn.140041bc4
mov ecx, 2
call fcn.140047588
nop
cmp byte [0x14007f868], 0
jne 0x140041b46
mov r15d, 1
mov eax, r15d
xchg dword [0x14007f858], eax
test ebx, ebx
jne 0x140041aef
mov rdi, qword [0x140079698]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14007f860]
cmp rcx, rax
je 0x140041ae6
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140001890]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14007faa0]
jmp 0x140041afb
cmp ebx, r15d
jne 0x140041b01
lea rcx, [0x14007fab8]
call fcn.1400429c4
nop
test ebx, ebx
jne 0x140041b18
lea rdx, [0x140052bb0]
lea rcx, [0x140052b90]
call fcn.140042c90
lea rdx, [0x140052bc0]
lea rcx, [0x140052bb8]
call fcn.140042c90
movzx eax, byte [0x14007f868]
test esi, esi
cmove eax, r15d
mov byte [0x14007f868], al
jmp 0x140041b46
mov ecx, 2
call fcn.1400475dc
test esi, esi
jne 0x140041b5d
mov ecx, r14d
call fcn.140041b78
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140041a0c
Function at 0x140046610
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400464b0
call fcn.14003bc9c
mov dword [rax], 0x16
call fcn.14003bb7c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140046498
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140046498
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400464e2
lock or dword [rax + 0x14], 0x10
jmp 0x140046498
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400464ff
mov rcx, qword [rbp + 0x10]
call fcn.14004cc60
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140044a48
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140045ee8
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140046556
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140046498
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400465c2
mov rcx, qword [rbp + 0x10]
call fcn.140044a48
cmp eax, 0xffffffff
je 0x1400465a9
mov rcx, qword [rbp + 0x10]
call fcn.140044a48
cmp eax, 0xfffffffe
je 0x1400465a9
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.140044a48
movsxd rdi, eax
lea rsi, [0x14007fb10]
mov rcx, rbx
sar rdi, 6
call fcn.140044a48
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400465b0
lea rax, [0x140079980]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400465c2
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400465f8
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400465f4
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400465f4
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x14004649b
jmp 0x140046468
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
adc eax, 0x15243aff
invalid
adc edi, edi
and bl, byte [rcx]
adc bh, bh
and bl, byte [rcx]
adc edi, edi
and ebx, dword [rcx]
adc al, 0xff
and eax, 0x25ff1419
sbb dword [rdi + rdi*8], edx
and eax, 0x25ff1419
sbb dword [rdi + rdi*8], edx
adc al, 0xff
adc al, 0xff
and eax, 0x25ff1419
sbb dword [rdi + rdi*8], edx
and eax, 0x25ff1419
sbb dword [rdi + rdi*8], edx
and eax, 0x26ff1319
sbb dl, byte es:[rdx]
sbb dl, byte es:[rdx]
dec dword [rbx + 0x3f]
jmp 0x170635e46
cmp eax, 0x2029333d
mul byte [rax]
invalid
adc bh, bh
and dword [rax], ebx
adc bh, bh
and dword [rax], ebx
adc bh, bh
and bl, byte [rax]
adc edi, edi
and ebx, dword [rax]
adc edi, edi
and ebx, dword [rax]
adc edi, edi
and ebx, dword [rax]
adc edi, edi
and ebx, dword [rax]
adc edi, edi
and ebx, dword [rax]
adc edi, edi
and eax, 0x24ff1118
adc al, 0xe
invalid
invalid
cmp ch, byte [0xf8c2f642]
mov dl, 0xff
div dh
invalid
Function at 0x140017724
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x1400211b8], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x1400211c8]
jne 0x140017771
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x1400211f0], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x1400211b8], 1
mov ecx, dword [0x1400211f0]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x140017846
mov rcx, qword [0x1400204cc]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140017871
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400211c0]
test rax, rax
je 0x1400177c1
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x1400211c0], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14001788c]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x1400211f0]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x1400204cc]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140017871
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14000181c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001866
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001866
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001866
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001866
cmp dword [rcx + 0x84], 0xe
jbe 0x140001866
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001868
xor al, al
add rsp, 0x28
ret
Function at 0x140002840
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400dd040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1400e48d0]
lea rdx, [rsp + 0x28]
mov rdi, qword [0x1400e4840]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
mov qword [rsp + 0x40], 0
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1400e48d8]
cvtsi2ss xmm0, qword [0x1400e48e0]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1400e48d8], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rbx, qword [0x1400e4840]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
cmp byte [rbx + 0x397], 0
je 0x14000297f
cvttss2si eax, dword [rbx + 0x128]
mov rcx, qword [0x1400e48d0]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
cvttss2si eax, dword [rbx + 0x12c]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14000297f
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x128], 0xff7fffff
mov dword [rbx + 0x12c], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400029fe
mov rdx, qword [0x1400e48d0]
cmp rax, rdx
je 0x1400029b7
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1400029fe
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400029fe
mov rcx, qword [0x1400e48d0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400029fe
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x128], xmm0
movss dword [rbx + 0x12c], xmm1
cmp byte [rdi + 0xc8], 0
je 0x140002a0e
mov eax, 0xffffffff
jmp 0x140002a1b
mov rax, qword [0x1400e4840]
mov eax, dword [rax + 0x1f08]
cmp dword [0x1400e1c10], eax
je 0x140002a2e
mov dword [0x1400e1c10], eax
call fcn.1400023f0
call fcn.140002570
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400758e0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400043a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400043fd
lea rbx, [0x1400b1930]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400043e4
cmp r10, 2
jb 0x1400043e4
cmp byte [r9], r8b
jne 0x1400043e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400043c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000443f
lea rbx, [0x1400b1930]
cmp r8b, 0x23
jne 0x140004423
cmp byte [r9], r8b
jne 0x140004423
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004410
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000459a
mov qword [r8], 0
lea rdx, [0x1400c878c]
call fcn.140004450
mov rbx, rax
test rax, rax
jne 0x1400045ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.14007d008
mov esi, eax
cmp eax, 0xffffffff
je 0x140004688
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.14007dc60
test eax, eax
jne 0x140004688
mov rcx, rbx
call fcn.14007d008
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004688
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.14007dc60
test eax, eax
jne 0x140004688
cmp rdi, 0xffffffffffffffff
je 0x140004688
mov rax, qword [0x1400e4840]
test rax, rax
je 0x14000462a
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.140088360
mov rsi, rax
test rax, rax
je 0x140004688
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.140082cfc
mov rcx, rbx
cmp rax, rdi
je 0x140004676
call fcn.14007d958
mov rax, qword [0x1400e4840]
test rax, rax
je 0x14000466c
dec dword [rax + 0x3b0]
mov rcx, rsi
call fcn.14007c650
jmp 0x140004690
call fcn.14007d958
test r14, r14
je 0x140004683
mov qword [r14], rdi
mov rax, rsi
jmp 0x140004692
mov rcx, rbx
call fcn.14007d958
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400100f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400dd040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400e4840]
mov edi, edx
cmp byte [rbx + 0x1f0d], 0
jne 0x140010151
cmp byte [rbx + 0x1f0e], 0
jne 0x140010151
movsx r9d, word [rbx + 0x2fe6]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004320
test dil, 1
je 0x140010278
jmp 0x1400101da
movss xmm1, dword [rbx + 0x163c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x2fe6]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400ca864]
mulss xmm1, dword [0x1400ca850]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1cb0], rax
mov dword [rbx + 0x1c9c], 1
movss dword [rbx + 0x1ca8], xmm0
movss dword [rbx + 0x1cac], xmm1
movss xmm0, dword [rbx + 0x16a8]
mulss xmm0, dword [0x1400ca7e8]
or dword [rbx + 0x1c98], 0x41
movss dword [rbx + 0x1cf8], xmm0
call fcn.140004320
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010230
lea r11, [0x1400b1930]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140010213
cmp byte [r8], r9b
jne 0x140010213
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010200
not ecx
call fcn.14000a230
test rax, rax
je 0x140010278
cmp byte [rax + 0x8e], 0
je 0x140010278
mov byte [rax + 0x96], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x2fe6]
mov edx, 0x10
movsx r9d, word [rbx + 0x2fe6]
call fcn.140004320
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c950
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400758e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14002db00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x14002db87
mov rbx, r15
mov rbp, r15
jmp 0x14002dbca
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x14002dba1
cmp rbx, rcx
je 0x14002dbc4
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14002db93
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 0x10], rax
je 0x14002dd29
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.140075900
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [r13]
mov qword [rdi + 0x10], rax
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14002dc1a
cvtsi2ss xmm0, rcx
jmp 0x14002dc2f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14002dc42
cvtsi2ss xmm1, rcx
jmp 0x14002dc57
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14002dcc1
mov rcx, rsi
call fcn.14002dd60
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x14002dc94
mov qword [rsp + 0x28], 0
jmp 0x14002dcb4
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x14002dcb1
mov rbx, rax
cmp rax, rdx
je 0x14002dcf5
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14002dca0
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x14002dd05
mov qword [rcx + rax*8], rdi
jmp 0x14002dd17
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x14002dcb9
cmp r8, rbp
jne 0x14002dd10
mov qword [rcx + rax*8], rdi
jmp 0x14002dd1c
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14002dd1c
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x14002dba9
lea rcx, str.unordered_map_set_too_long
call fcn.140073c10
int3