joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015540
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x140019338]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x140015660
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140015660
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140015660
test byte [rbx + 0x44], 4
jne 0x140015680
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x140019348]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400156c0
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x1400156f8
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x1400155e7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1400156a0
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400155fb
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x1400156d8
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14001570a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x1400156e8
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x1400155e3
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x14001564e
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x1400155b5
jmp 0x1400155bc
call sym.pthread_mutex_destroy
jmp 0x14001561c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140015644
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x14001564e
call sym.replace_spin_keys.part.0
nop
Function at 0x180001500
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
xor ebx, ebx
lea rcx, [rbp - 0x20]
xor edx, edx
mov dword [rbp + 0x410], ebx
mov r8d, 0x200
mov qword [rbp + 0x428], rbx
mov dword [rbp + 0x418], ebx
call fcn.180025f60
xor edx, edx
lea rcx, [rbp + 0x1e0]
mov r8d, 0x200
call fcn.180025f60
xor edx, edx
lea r8d, [rbx + 0x64]
lea rcx, [rsp + 0x70]
call fcn.180025f60
lea rax, [rsp + 0x70]
xor r14b, r14b
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x428]
lea edx, [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18000172a
mov r9d, dword [rbp + 0x410]
lea rax, [rbp + 0x410]
mov rcx, qword [rbp + 0x428]
lea edx, [rbx + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x1800015cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x18000172a
mov edx, dword [rbp + 0x410]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r9d, dword [rbp + 0x410]
mov edx, 2
mov rcx, qword [rbp + 0x428]
mov rsi, rax
lea rax, [rbp + 0x410]
mov r8, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x18000172a
lea rax, [rsp + 0x60]
mov dword [rbp + 0x420], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp + 0x420]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
mov r8d, 0x20
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov word [rbp + 0x424], 0x500
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x18000172a
cmp dword [rsi], ebx
jbe 0x1800016ff
lea rdi, [rsi + 8]
nop
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x1800016ec
lea rax, [rbp + 0x418]
mov dword [rbp + 0x410], 0x100
mov rdx, qword [rdi]
lea r9, [rbp + 0x410]
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x410]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x1800016fc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x534
jne 0x18000172a
lea r8, str.NONE_MAPPED
mov edx, 0x200
lea rcx, [rbp - 0x20]
call fcn.1800288c0
inc ebx
add rdi, 0x10
cmp ebx, dword [rsi]
jb 0x180001670
jmp 0x1800016ff
mov r14b, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x18000170f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
movzx eax, r14b
add rsp, 0x4e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov al, 1
add rsp, 0x4e0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002010
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x500
movzx ebx, cl
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x208
call fcn.180025f60
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
lea rdx, [0x18003f200]
lea rcx, [rsp + 0x2f0]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edi, edi
lea rcx, [rsp + 0x2f0]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x10000000
xor edx, edx
call qword [sym.imp.USER32.dll_CreateDesktopW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetThreadDesktop]
xor edx, edx
lea rcx, [rsp + 0xe0]
mov r8d, 0x208
call fcn.180025f60
mov rcx, qword [0x18004cec0]
lea rdx, [rsp + 0xe0]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea rax, [rsp + 0xe0]
sub rax, 2
nop dword [rax + rax]
cmp word [rax + 2], di
lea rax, [rax + 2]
jne 0x1800020d0
movups xmm0, xmmword [str._spdlogd.exe]
xor edx, edx
movzx ecx, word [0x18003f250]
movsd xmm1, qword [0x18003f248]
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
lea r8d, [rdx + 0x68]
mov word [rax + 0x18], cx
lea rcx, [rsp + 0x70]
call fcn.180025f60
xor eax, eax
mov dword [rsp + 0x70], 0x68
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov eax, 5
mov dword [rsp + 0xac], 1
mov word [rsp + 0xb0], ax
xor ecx, ecx
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1800021c2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x1800021ac
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x510]
add rsp, 0x500
pop rdi
ret
Function at 0x180002220
Capabilities:
Check mutex on windows
Get session user name

Disassembly:
push rdi
sub rsp, 0x470
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x488], rbx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x260]
call fcn.180025f60
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x50]
call fcn.180025f60
mov dword [rsp + 0x480], 0x104
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x180002290
add r8, r8
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.180001150
nop
mov rbx, qword [rsp + 0x28]
cmp byte [rsp + 0x20], 0
je 0x18000234f
mov rdi, qword [rsp + 0x30]
sub rdi, rbx
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800022f7
lea rdx, str.RtlComputeCrc32
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800022f7
mov r8d, edi
mov rdx, rbx
xor ecx, ecx
call rax
mov r8d, eax
lea rdx, str.GlobalIntelGameSpeed__x
lea rcx, [rsp + 0x260]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18000234f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
cmp eax, 0xb7
jne 0x180002349
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dil, 1
jmp 0x180002352
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor dil, dil
test rbx, rbx
je 0x180002388
mov rdx, qword [rsp + 0x38]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x180002380
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000239d
mov rcx, rbx
call fcn.1800076f8
movzx eax, dil
mov rbx, qword [rsp + 0x488]
add rsp, 0x470
pop rdi
ret
call fcn.180028b54
int3
Function at 0x180002a80
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
sub ebx, 1
je 0x180002abf
sub ebx, 1
je 0x180002ab2
cmp ebx, 1
jne 0x180002abf
lea rcx, str.CreateProcessNotify:_APPCERT_CREATION_DENIED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rcx, str.CreateProcessNotify:_APPCERT_CREATION_ALLOWED
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180003f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r15, r8
mov rsi, rcx
mov r12, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x180003f9c
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r12, r12
je 0x180003fd4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r12
jb 0x180003fc0
mov r14, qword [rsi + 0x30]
and r14, rdx
add r14, r14
mov r13, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
cmp rbx, qword [r13 + r14*8]
je 0x180004052
mov rbx, qword [r13 + r14*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [r13 + r14*8]
je 0x180004052
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180004012
mov rdx, qword [rdx]
mov rcx, r15
cmp r9, 0x10
jb 0x18000401e
mov rcx, qword [r15]
cmp r12, rax
jne 0x180003ff5
mov r8, r12
call fcn.180031bf0
test eax, eax
mov r9, qword [r15 + 0x18]
jne 0x180003ff5
mov rdx, rdi
mov rcx, rsi
call fcn.1800044f0
mov rax, qword [rsp + 0x88]
mov qword [rax], rbx
mov byte [rax + 8], 0
jmp 0x180004183
mov qword [rsp + 0x90], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x18000408f
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [rsi + 8]
jne 0x1800040ac
mov qword [rdx + r14*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x1800040db
cmp rax, rbx
jne 0x1800040b7
mov qword [rdx + r14*8], rdi
jmp 0x1800040db
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x1800040db
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x18003f6c8]
test rax, rax
jns 0x1800040fc
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x18000410d
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x180004170
cmp rdx, 0x200
jae 0x180004129
lea rdx, [rdx*8]
jmp 0x18000413b
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x18000413b
add rdx, rdx
mov rcx, rsi
call fcn.1800036a0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x180004170
mov r14, qword [rax + 8]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.180003f60
cmp rbx, r14
jne 0x180004150
mov r9, qword [rsp + 0x88]
mov qword [r9], rdi
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180004640
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r9, [r8 + 0x10]
mov r10, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov r11, rcx
jb 0x180004671
mov r9, qword [r8 + 0x10]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1800046a4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r10
jb 0x180004690
mov rdx, qword [r11 + 0x30]
mov rcx, qword [r11 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rbx
jne 0x1800046e4
cmp rax, rbx
jne 0x1800046da
mov rax, qword [r11 + 8]
mov qword [rcx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1800046ef
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
jmp 0x1800046ef
cmp rax, rbx
jne 0x1800046ef
mov rax, qword [rbx]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
mov rdx, qword [rbx + 0x28]
cmp rdx, 0x10
jb 0x18000473f
mov rcx, qword [rbx + 0x10]
inc rdx
cmp rdx, 0x1000
jb 0x18000473a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000477c
mov rcx, r8
call fcn.1800076f8
mov qword [rbx + 0x20], 0
mov edx, 0x38
mov qword [rbx + 0x28], 0xf
mov rcx, rbx
mov byte [rbx + 0x10], 0
call fcn.1800076f8
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call fcn.180028b54
int3

Function at 0x18000b05c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x18000b06f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.18000b67c
lea rdx, [0x1800470f8]
lea rcx, [rsp + 0x20]
call fcn.180025a10
int3

Function at 0x1800158f8
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x18004c060]
xor edx, edx
jmp fcn.18000b05c

Function at 0x180016290
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x18004c060]
jmp fcn.18000b05c

Function at 0x180021ee0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180021f9c]
mov r9, qword [r9 + 8]
jmp fcn.1800132b0

Function at 0x180021f74
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x180021fac]
mov r9, qword [r9 + 8]
jmp fcn.1800132b0
Function at 0x140003be0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003c3d
lea rbx, [0x1400b9aa0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003c24
cmp r10, 2
jb 0x140003c24
cmp byte [r9], r8b
jne 0x140003c24
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003c00
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003c7f
lea rbx, [0x1400b9aa0]
cmp r8b, 0x23
jne 0x140003c63
cmp byte [r9], r8b
jne 0x140003c63
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003c50
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003dc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140003dda
mov qword [r8], 0
lea rdx, [0x1400b97f4]
call fcn.140003c90
mov rbx, rax
test rax, rax
jne 0x140003dfa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003ed1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ed1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003ed1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003ed1
cmp rdi, 0xffffffffffffffff
je 0x140003ed1
mov rax, qword [0x14011cd08]
test rax, rax
je 0x140003e6e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140003ed1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003ebe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14011cd08]
test rax, rax
je 0x140003eb3
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003eda
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003ecc
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003edc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005860
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400b9aa0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x14011cd08]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3e84], ebx
jne 0x1400058ed
mov dword [rax + 0x3e88], ebx
cmp dword [rax + 0x3ed0], ebx
jne 0x1400058fc
mov byte [rax + 0x3ed4], 1
cmp dword [rax + 0x3e6c], ebx
jne 0x140005913
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140016f70
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000f8b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x14011cd08]
lea r10, [0x1400b9aa0]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3e38]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3e6c], edi
jne 0x14000f955
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.140016f70
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x14000f989
inc r8d
test ecx, ecx
je 0x14000f972
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14000f977
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.140018030
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140010eb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e0080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14011cd08]
mov edi, ecx
cmp byte [rbx + 0x41dd], 0
jne 0x140010f11
cmp byte [rbx + 0x41de], 0
jne 0x140010f11
movsx r9d, word [rbx + 0x52be]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140003b60
test dil, 1
je 0x140011038
jmp 0x140010f9a
movss xmm1, dword [rbx + 0x3830]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x52be]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400ce4d8]
mulss xmm1, dword [0x1400ce4c0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f58], rax
mov dword [rbx + 0x3f44], 1
movss dword [rbx + 0x3f50], xmm0
movss dword [rbx + 0x3f54], xmm1
movss xmm0, dword [rbx + 0x389c]
mulss xmm0, dword [0x1400ce450]
or dword [rbx + 0x3f40], 0x41
movss dword [rbx + 0x3fa0], xmm0
call fcn.140003b60
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010ff0
lea r11, [0x1400b9aa0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140010fd3
cmp byte [r8], r9b
jne 0x140010fd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010fc0
not ecx
call fcn.14000a3a0
test rax, rax
je 0x140011038
cmp byte [rax + 0x8e], 0
je 0x140011038
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52be]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x52be]
call fcn.140003b60
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000cb10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a4d50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140015cc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5370], 0
lea rbx, [rcx + 0x5378]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140015d67
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140015d1a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140017e00
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004220
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5370]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5380]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14011cd04]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140015d6f
mov rcx, rbx
call fcn.140004220
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret