joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4458e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x445a4a
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4458f8
cmp edx, ecx
jne 0x445a38
nop dword [rax]
test rsi, rsi
jne 0x445a38
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x445954
nop
call fcn.00467f40
xorps xmm15, xmm15
mov r14, qword [0x00f2a748]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004457e0
mov rcx, qword [0x00ed5658]
mov rdx, qword [0x00ed5650]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x445a33
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x445a28
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x00ed6f50]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x00ed6f50], rbx
nop
mov edx, 1
lea rsi, [0x00ed6f58]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x445a17
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x008d63bb]
mov ebx, 0x28
call fcn.004370c0
mov rcx, rax
mov rax, rsi
call fcn.00466580
call fcn.00435580
lea rax, [0x008d32df]
mov ebx, 0x23
call fcn.004370c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004458e0
Function at 0x45a6e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a799
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045a7e0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463de0
xorps xmm15, xmm15
mov r14, qword [0x00f2a748]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463f20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045a6e0
Function at 0x466020
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00f2ad20]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00f2a4c2], 0
je 0x466056
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00f2b0a0]
aesenc xmm0, xmmword [0x00f2b0b0]
aesenc xmm0, xmmword [0x00f2b0c0]
movq rax, xmm0
ret
jmp 0x40a360
Function at 0x140006090
Capabilities:
Enumerate processes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x1400060bf
xor eax, eax
jmp 0x140006129
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x140006127
mov eax, dword [rsp + 0x288]
cmp dword [rsp + 0x38], eax
jne 0x140006111
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x4c]
jmp 0x140006129
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [rsp + 0x20], eax
jmp 0x1400060ec
xor eax, eax
add rsp, 0x270
pop rdi
ret

Function at 0x140006140
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdx, qword [rsp + 0x298]
lea rcx, [rsp + 0x6c]
call qword [sym.imp.ntdll.dll__wcsicmp]
test eax, eax
jne 0x1400061d1
mov edx, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x290]
call fcn.140006090
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp + 0x24], eax
jbe 0x1400061d1
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000618b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x290]
mov qword [rcx + 0x10], rax
mov eax, dword [rsp + 0x20]
add rsp, 0x288
ret
Function at 0x140010850
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x20]
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x14001087f
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 4
jae 0x1400108c3
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x140010872
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x14001a0f0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1402197e0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14001a17e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x14001a122
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x14001a190
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1402197e0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x14001a294
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x14001a28f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x14001a264
cmp qword [rsp + 0x38], 2
jb 0x14001a264
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a264
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a264
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14001a1d7
jmp 0x14001a326
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14001a326
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14001a2fc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a2fc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001a2fc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14001a294
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x140057c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax + 4]
vmovss dword [rsp + 0x60], xmm0
mov rax, qword [rsp + 0xa0]
vmovss xmm0, dword [rax]
vmovss dword [rsp + 0x58], xmm0
mov rax, qword [rsp + 0x98]
vmovss xmm0, dword [rax + 4]
vmovss dword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x98]
vmovss xmm0, dword [rax]
vmovss dword [rsp + 0x48], xmm0
vmovss xmm0, dword [rsp + 0x48]
vmovss dword [rsp + 0x20], xmm0
vmovss xmm0, dword [rsp + 0x50]
vmovss dword [rsp + 0x24], xmm0
vmovss xmm0, dword [rsp + 0x58]
vmovss dword [rsp + 0x28], xmm0
vmovss xmm0, dword [rsp + 0x60]
vmovss dword [rsp + 0x2c], xmm0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x140057d7a
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + 0x90]
mov rdi, rax
lea rsi, [rcx + 0x88]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [rsp + 0x38]
jae 0x140057d2c
vmovss xmm0, dword [rsp + 0x38]
vmovss dword [rsp + 0x20], xmm0
vmovss xmm0, dword [rsp + 0x24]
vcomiss xmm0, dword [rsp + 0x3c]
jae 0x140057d46
vmovss xmm0, dword [rsp + 0x3c]
vmovss dword [rsp + 0x24], xmm0
vmovss xmm0, dword [rsp + 0x28]
vcomiss xmm0, dword [rsp + 0x40]
jbe 0x140057d60
vmovss xmm0, dword [rsp + 0x40]
vmovss dword [rsp + 0x28], xmm0
vmovss xmm0, dword [rsp + 0x2c]
vcomiss xmm0, dword [rsp + 0x44]
jbe 0x140057d7a
vmovss xmm0, dword [rsp + 0x44]
vmovss dword [rsp + 0x2c], xmm0
vmovss xmm0, dword [rsp + 0x20]
vcomiss xmm0, dword [rsp + 0x28]
jb 0x140057d96
vmovss xmm0, dword [rsp + 0x20]
vmovss dword [rsp + 0x30], xmm0
jmp 0x140057da2
vmovss xmm0, dword [rsp + 0x28]
vmovss dword [rsp + 0x30], xmm0
vmovss xmm0, dword [rsp + 0x30]
vmovss dword [rsp + 0x28], xmm0
vmovss xmm0, dword [rsp + 0x24]
vcomiss xmm0, dword [rsp + 0x2c]
jb 0x140057dca
vmovss xmm0, dword [rsp + 0x24]
vmovss dword [rsp + 0x34], xmm0
jmp 0x140057dd6
vmovss xmm0, dword [rsp + 0x2c]
vmovss dword [rsp + 0x34], xmm0
vmovss xmm0, dword [rsp + 0x34]
vmovss dword [rsp + 0x2c], xmm0
mov rax, qword [rsp + 0x90]
add rax, 0x58
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
call fcn.140047400
mov rax, qword [rsp + 0x90]
lea rcx, [rsp + 0x20]
lea rdi, [rax + 0x88]
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x90]
call fcn.1400578c0
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x14005bfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
vmovss dword [rsp + 0x20], xmm3
vmovss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
vmovss xmm0, dword [rsp + 0x80]
vcomiss xmm0, dword [0x1403193f0]
jae 0x14005bfef
mov rax, qword [rsp + 0x70]
add rax, 0x78
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.140046710
jmp 0x14005c106
mov rax, qword [rsp + 0x70]
add rax, 0x78
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x78]
mov ecx, dword [rsp + 0x98]
lea eax, [rcx + rax + 1]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140046e00
mov dword [rsp + 0x20], 0
jmp 0x14005c030
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jg 0x14005c106
vcvtsi2ss xmm0, xmm0, dword [rsp + 0x20]
vcvtsi2ss xmm1, xmm1, dword [rsp + 0x98]
vdivss xmm0, xmm0, xmm1
vmovss xmm1, dword [rsp + 0x90]
vsubss xmm1, xmm1, dword [rsp + 0x88]
vmulss xmm0, xmm0, xmm1
vmovss xmm1, dword [rsp + 0x88]
vaddss xmm0, xmm1, xmm0
vmovss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x78
mov qword [rsp + 0x50], rax
vmovss xmm0, dword [rsp + 0x24]
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
vmulss xmm0, xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
vmovss xmm1, dword [rax + 4]
vaddss xmm0, xmm1, xmm0
vmovss dword [rsp + 0x30], xmm0
vmovss xmm0, dword [rsp + 0x24]
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
vmulss xmm0, xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
vmovss xmm1, dword [rax]
vaddss xmm0, xmm1, xmm0
vmovss dword [rsp + 0x28], xmm0
vmovss xmm0, dword [rsp + 0x28]
vmovss dword [rsp + 0x38], xmm0
vmovss xmm0, dword [rsp + 0x30]
vmovss dword [rsp + 0x3c], xmm0
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
call fcn.140046710
jmp 0x14005c026
add rsp, 0x68
ret
Function at 0x14006bdb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14006bdd6
mov dword [rsp + 0x20], 1
jmp 0x14006bdde
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
add rsp, 0x38
ret
Function at 0x140098460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
vmovss dword [rsp + 0x20], xmm3
vmovss dword [rsp + 0x18], xmm2
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov eax, 0x10
mov eax, eax
mov rcx, qword gs:[0x58]
mov rcx, qword [rcx]
mov eax, dword [rax + rcx]
cmp dword [0x1403bdc80], eax
jle 0x1400984d3
lea rcx, [0x1403bdc80]
call fcn.1400c62c4
cmp dword [0x1403bdc80], 0xffffffff
jne 0x1400984d3
lea rcx, [0x1403bdc40]
call fcn.140098840
lea rcx, [0x1400c7100]
call fcn.1400c65a0
lea rcx, [0x1403bdc80]
call fcn.1400c6258
mov r8, qword [rsp + 0xe0]
lea rdx, [rsp + 0x30]
lea rcx, [0x1403bdc40]
call fcn.140098d90
lea rax, [0x1403bdc40]
add rax, 8
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x30], rax
jne 0x140098536
mov dword [rsp + 0x20], 1
jmp 0x14009853e
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x1400985cc
lea rax, [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x60]
call fcn.14000d970
vmovss xmm0, dword [rsp + 0xf0]
vmovss dword [rsp + 0xb0], xmm0
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xb8]
lea rcx, [0x1403bdc40]
call fcn.140098e40
lea rax, [rsp + 0x90]
mov rcx, rax
call fcn.1400068f0
mov r8, qword [rsp + 0xe0]
lea rdx, [rsp + 0x88]
lea rcx, [0x1403bdc40]
call fcn.140098d90
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
call fcn.140020e80
vmovss xmm0, dword [0x140319458]
vsubss xmm0, xmm0, dword [rax + 0x10]
vmovss xmm1, dword [rsp + 0x100]
vmulss xmm0, xmm1, xmm0
vmovss dword [rsp + 0x38], xmm0
vmovss xmm0, dword [rsp + 0x38]
vmovss dword [rsp + 0x3c], xmm0
movzx eax, byte [rsp + 0xe8]
test eax, eax
je 0x14009861a
vmovss xmm0, dword [rsp + 0xf8]
vmovss dword [rsp + 0x24], xmm0
jmp 0x140098629
vmovss xmm0, dword [rsp + 0xf0]
vmovss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
vmovss xmm0, dword [rax + 0x20]
vmovss dword [rsp + 0x28], xmm0
vmovss xmm0, dword [rsp + 0x24]
vsubss xmm0, xmm0, dword [rsp + 0x28]
vmulss xmm0, xmm0, dword [rsp + 0x3c]
vmovss xmm1, dword [rsp + 0x28]
vaddss xmm0, xmm1, xmm0
vmovss dword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
vmovss xmm0, dword [rsp + 0x40]
vmovss dword [rax + 0x20], xmm0
mov rax, qword [rsp + 0x30]
add rax, 0x10
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
vmovss xmm0, dword [rax + 0x20]
vmovss dword [rsp + 0x44], xmm0
mov rcx, qword [rsp + 0xe0]
call fcn.1400068f0
vmovss xmm0, dword [rsp + 0x44]
add rsp, 0xd8
ret
Function at 0x14009a450
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
movabs rax, 0xcbf29ce484222325
mov qword [rsp], rax
mov qword [rsp + 8], 0
jmp 0x14009a484
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 8], rax
jae 0x14009a4cc
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rsp]
xor rcx, rax
mov rax, rcx
mov qword [rsp], rax
movabs rax, 0x100000001b3
mov rcx, qword [rsp]
imul rcx, rax
mov rax, rcx
mov qword [rsp], rax
jmp 0x14009a477
mov rax, qword [rsp]
add rsp, 0x18
ret
Function at 0x14009e3e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14009e41e
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14009e5d9
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
cmp qword [rax], 0
je 0x14009e44b
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
jmp 0x14009e453
mov dword [rsp + 0x20], 0
movsxd rax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x80], 0
jle 0x14009e572
cmp qword [rsp + 0x28], 0
jle 0x14009e572
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x80], rax
jge 0x14009e494
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x40]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
xor eax, eax
test eax, eax
je 0x14009e4f8
mov qword [rsp + 0x30], 0
jmp 0x14009e4c3
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x30], rax
je 0x14009e4f6
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x78]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
mov byte [rax], cl
jmp 0x14009e4b6
jmp 0x14009e509
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x28]
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x58]
mov ecx, dword [rsp + 0x28]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x58]
mov dword [rcx], eax
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
mov qword [rcx], rax
cmp qword [rsp + 0x80], 0
jle 0x14009e5c6
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x14009e5c6
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x80]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14009fbf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14009fc1b
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14009fc22
mov al, 1
jmp 0x14009fd89
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x3c], 0xffffffff
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0xffffffff
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jne 0x14009fc6e
mov dword [rsp + 0x34], 1
jmp 0x14009fc76
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x14009fc86
xor al, al
jmp 0x14009fd89
mov qword [rsp + 0x68], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14009fcf6
cmp dword [rsp + 0x30], 1
je 0x14009fd02
cmp dword [rsp + 0x30], 3
je 0x14009fd77
jmp 0x14009fd87
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14009fd4e
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14009fd4e
xor al, al
jmp 0x14009fd89
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14009fd68
mov dword [rsp + 0x38], 1
jmp 0x14009fd70
mov dword [rsp + 0x38], 0
movzx eax, byte [rsp + 0x38]
jmp 0x14009fd89
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14009fd89
xor al, al
add rsp, 0xa8
ret
Function at 0x1400a12c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.1400a1a00
lea rax, [0x1400a1ad0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x90]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
mov rax, qword [rsp + 0x90]
cmp qword [rax], 0
je 0x1400a13bd
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
mov qword [rax], rcx
jmp 0x1400a13d7
mov rax, qword [rsp + 0x90]
mov dword [rax + 8], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
lea rcx, [rsp + 0x30]
call fcn.14009f7a0
add rsp, 0x88
ret