joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180037058
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x180071060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
and dword [rsp + 0x20], 0
and dword [rsp + 0x44], 0
and dword [rsp + 0x40], 0
mov rbx, rcx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov dword [rsp + 0x3c], 0x10325476
call fcn.18003ada0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.18003ae54
and qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0xf
lea rdx, [rsp + 0x90]
mov r8d, 0x10
mov rcx, rbx
mov byte [rbx + 8], 0
call fcn.180006c70
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18003c6c0
add rsp, 0xb0
pop rbx
ret
Function at 0x18003b1ec
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor eax, eax
xor esi, esi
mov rbp, r8
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov eax, dword [rcx + 0x10]
shl eax, 2
mov r10, rdx
mov rbx, rcx
cmp eax, esi
mov r9d, esi
jle 0x18003b25a
mov eax, r9d
inc r9d
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [r10]
inc r10
mov byte [rcx + rdx*4], al
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp r9d, eax
jl 0x18003b226
mov edx, dword [rbx + 0x18]
mov rcx, rbx
call fcn.18003b360
mov edi, dword [rbx + 0x18]
lea r14, [0x180072b50]
jmp 0x18003b2b5
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003b274
add r11, 4
sub r8, 1
jne 0x18003b271
mov edx, edi
mov rcx, rbx
call fcn.18003b360
mov rcx, rbx
call fcn.18003b4a0
mov rcx, rbx
dec edi
call fcn.18003b418
cmp edi, 1
mov r11, rbx
mov r8d, 4
jge 0x18003b271
mov r9, rsi
movzx edx, byte [r11 + r9]
mov ecx, edx
and edx, 0xf
shr ecx, 4
shl rcx, 4
add rcx, rdx
mov al, byte [rcx + r14]
mov byte [r11 + r9], al
inc r9
cmp r9, 4
jl 0x18003b2d0
add r11, 4
sub r8, 1
jne 0x18003b2cd
xor edx, edx
mov rcx, rbx
call fcn.18003b360
mov eax, dword [rbx + 0x10]
shl eax, 2
cmp eax, esi
jle 0x18003b344
mov eax, esi
inc esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sub eax, edx
sar ecx, 2
movsxd rdx, eax
movsxd rax, ecx
lea rcx, [rbx + rax]
mov al, byte [rcx + rdx*4]
mov byte [rbp], al
mov eax, dword [rbx + 0x10]
inc rbp
shl eax, 2
cmp esi, eax
jl 0x18003b313
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18003b360
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r11d, 4
add rax, rax
mov r10, r11
lea rdx, [rcx + rax*8 + 0x3c]
xor r8d, r8d
mov r9, rdx
mov al, byte [r9]
add r9, r11
xor byte [rcx + r8], al
inc r8
cmp r8, r11
jl 0x18003b37a
inc rdx
add rcx, r11
sub r10, 1
jne 0x18003b374
repz ret
Function at 0x18003c2f0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x180071060]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r12, rdx
mov rbx, rcx
and dword [rsp + 0x20], 0
xor esi, esi
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov r13, rcx
mov qword [r11 - 0x38], 0xf
mov qword [r11 - 0x40], rax
mov byte [rsp + 0x38], al
je 0x18003c4e2
lea rdi, [0x18005dbe0]
movsx rax, byte [r12 + rsi]
mov cl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003c376
cmp cl, r14b
je 0x18003c361
cmp cl, r14b
je 0x18003c4e2
movsx rax, byte [r12 + rsi]
mov bpl, byte [rax + rdi]
inc rsi
cmp rsi, r13
jae 0x18003c395
cmp bpl, r14b
je 0x18003c37f
cmp bpl, r14b
je 0x18003c4e2
mov r8b, bpl
sar r8b, 4
and r8b, 3
shl cl, 2
or r8b, cl
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.180009550
jmp 0x18003c3c7
lea rdi, [0x18005dbe0]
mov al, byte [r12 + rsi]
inc rsi
cmp al, 0x3d
je 0x18003c4a6
movsx rax, al
mov dil, byte [rax + rdi]
cmp rsi, r13
jae 0x18003c3e8
cmp dil, r14b
je 0x18003c3c0
cmp dil, r14b
je 0x18003c4e2
mov r8b, dil
sar r8b, 2
and r8b, 0xf
shl bpl, 4
or r8b, bpl
mov ebp, 1
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180009550
lea rdx, [0x18005dbe0]
mov al, byte [r12 + rsi]
add rsi, rbp
cmp al, 0x3d
je 0x18003c46a
movsx rax, al
mov cl, byte [rax + rdx]
cmp rsi, r13
jae 0x18003c438
cmp cl, r14b
je 0x18003c41c
cmp cl, r14b
je 0x18003c4e2
shl dil, 6
or dil, cl
mov r8b, dil
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.180009550
cmp rsi, r13
lea rdi, [0x18005dbe0]
jb 0x18003c361
jmp 0x18003c4e2
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180005ff0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003c4a1
mov rcx, qword [rsp + 0x38]
call fcn.18003cec4
mov rax, rbx
jmp 0x18003c51c
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180005ff0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003c4dd
mov rcx, qword [rsp + 0x38]
call fcn.18003cec4
mov rax, rbx
jmp 0x18003c51c
mov qword [rbx + 0x20], 0xf
and qword [rbx + 0x18], 0
mov byte [rbx + 8], 0
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180005ff0
nop
cmp qword [rsp + 0x50], 0x10
jb 0x18003c519
mov rcx, qword [rsp + 0x38]
call fcn.18003cec4
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003c6c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18003df07
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180071060]
jne 0x18003c6da
rol rcx, 0x10
test cx, 0xffff
jne 0x18003c6d6
repz ret
ror rcx, 0x10
jmp 0x18003de60
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180073f50]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x180074048]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x18003dee5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180073f50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x18003df07
mov rax, qword [rsp + 0x88]
mov qword [0x180074048], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x180073fe8], rax
mov rax, qword [0x180074048]
mov qword [0x180073ec0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x180073fd0], rax
mov dword [0x180073eb0], 0xc0000409
mov dword [0x180073eb4], 1
mov rax, qword [0x180071060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180071068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180073f48], eax
mov ecx, 1
call fcn.18003e1e8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1800598c8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180073f48], 0
jne 0x18003df8e
mov ecx, 1
call fcn.18003e1e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1800416e0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x180041554
Function at 0x18004408c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.18003e2f4
xor ebx, ebx
mov rdi, rax
cmp qword [0x180074b98], rbx
jne 0x180044192
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180044267
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180044267
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180074b98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180074ba0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x180074ba8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x180074bb8], rax
test rax, rax
je 0x180044189
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x180074bb0], rax
jmp 0x180044199
mov rax, qword [0x180074bb0]
jmp 0x1800441a0
mov rax, qword [0x180074bb0]
mov r11, qword [0x180074bb8]
cmp rax, rdi
je 0x180044208
cmp r11, rdi
je 0x180044208
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x180074bb8]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x180044208
test rax, rax
je 0x180044208
call rsi
test rax, rax
je 0x180044202
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x180044202
test byte [rsp + 0x38], 1
jne 0x180044208
bts ebp, 0x15
jmp 0x180044246
mov rcx, qword [0x180074ba0]
cmp rcx, rdi
je 0x180044246
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180044246
call rax
mov rbx, rax
test rax, rax
je 0x180044246
mov rcx, qword [0x180074ba8]
cmp rcx, rdi
je 0x180044246
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180044246
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180074b98]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x180044267
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x180044269
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x14002cf90
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov r9d, 1
bsr r8, rax
mov rsi, rcx
shlx rax, r9, r8
cmp rdx, rax
jbe 0x14002cfc5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, r9
bsr rcx, rax
mov qword [rsp + 0x40], rdi
mov r8, rbx
inc ecx
mov qword [rsp + 0x48], r14
shlx rdi, r9, rcx
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14002cae0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14002d114
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rbp
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002d08d
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14002d103
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x14002d0ca
mov r8, qword [rax]
cmp r8, rcx
je 0x14002d0c4
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14002d103
cmp r9, rax
je 0x14002d0df
nop
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x14002d129
cmp r9, rax
jne 0x14002d0d0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14002d040
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14002d103
Function at 0x140030a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140030aed
lea rbx, [0x140081140]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140030ad4
cmp r10, 2
jb 0x140030ad4
cmp byte [r9], r8b
jne 0x140030ad4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140030ab0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140030b2f
lea rbx, [0x140081140]
cmp r8b, 0x23
jne 0x140030b13
cmp byte [r9], r8b
jne 0x140030b13
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140030b00
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140034110
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r10, [0x140081140]
mov rax, qword [rcx + 0x108]
mov r9, rcx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dl
movzx r8d, bl
shr ebx, 8
xor r8, rax
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r10 + r8*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x14003419b
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140048da0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400341b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x140081140]
vmovss xmm3, dword [rcx + 0x120]
vmovss xmm4, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140042880
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140092040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140116768]
mov edi, ecx
cmp byte [rbx + 0x4d55], 0
jne 0x1400428e1
cmp byte [rbx + 0x4d56], 0
jne 0x1400428e1
movsx r9d, word [rbx + 0x5ec0]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140030870
test dil, 2
je 0x140042a0f
jmp 0x140042969
vmovss xmm1, dword [rbx + 0x39bc]
vmovss xmm0, dword [0x140086ef0]
vfmadd213ss xmm0, xmm1, dword [rbx + 0xe44]
vmovss xmm2, dword [0x140086f0c]
vfmadd213ss xmm2, xmm1, dword [rbx + 0xe40]
movsx r9d, word [rbx + 0x5ec0]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x4a0c], 1
vmovss dword [rbx + 0x4a18], xmm2
vmovss dword [rbx + 0x4a1c], xmm0
mov qword [rbx + 0x4a20], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3a18]
vmulss xmm1, xmm0, dword [0x140086dac]
or dword [rbx + 0x4a08], 0x41
lea edx, [rax + 0x10]
vmovss dword [rbx + 0x4a68], xmm1
call fcn.140030870
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400429c0
lea r11, [0x140081140]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400429a3
cmp byte [r8], r9b
jne 0x1400429a3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140042990
not ecx
call fcn.140038550
test rax, rax
je 0x140042a0f
cmp byte [rax + 0xbe], 0
je 0x140042a0f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5ec0]
movsx r9d, word [rbx + 0x5ec0]
call fcn.140030870
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14003af70
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400783b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140047640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6018], 0
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x1400476c3
xor edx, edx
add rcx, 0x6020
call fcn.140049ec0
mov r8, rsi
lea rcx, [rbx + 0x6020]
mov rdx, rbp
call fcn.1400312f0
mov eax, dword [rbx + 0x6020]
xor edx, edx
mov r9, qword [rbx + 0x6018]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x6028]
cmove ecx, edx
test rax, rax
movsxd r8, ecx
mov edx, 1
lea rcx, [0x140116751]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1400476cf
add rcx, 0x6020
call fcn.1400312f0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140047af0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140116768]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140047b53
mov qword [rsp], rbx
lea rbx, [0x140081140]
nop dword [rax]
cmp r9b, 0x23
jne 0x140047b33
cmp byte [r8], r9b
jne 0x140047b33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140047b20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f88]
not eax
mov r8, qword [r10 + 0x5f90]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x140047b7f
cmp dword [r8 + 8], eax
je 0x140047b86
add r8, 0x48
cmp r8, rcx
jne 0x140047b70
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x140047b90
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
call fcn.140030b40
mov rbx, rax
test rax, rax
je 0x140047d0d
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140047cfa
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140047cfa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140047cfa
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140047cfa
cmp rdi, 0xffffffffffffffff
je 0x140047cfa
mov rcx, rdi
call fcn.1400349f0
mov rsi, rax
test rax, rax
je 0x140047cfa
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140047c5e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp fcn.140034a90
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140047c74
mov rdx, rdi
mov rcx, rsi
call fcn.140047d20
mov r8, qword [0x140116768]
test r8, r8
je 0x140047ce1
movsx rdx, word [r8 + 0x60f8]
lea rcx, [r8 + 0x60fc]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je case.default.0x140047cf3
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f8], cx
movsx rax, cx
lea rcx, [r8 + 0x60fc]
lea rcx, [rcx + rax*8]
xor eax, eax
mov dword [rcx], r9d
mov dword [rcx + 4], eax
inc word [rcx + 6]
inc dword [r8 + 0x60f4]
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x14005d400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140116768]
mov rcx, qword [rax + 0x4e20]
mov r9, qword [rax + 0x4008]
vmovups xmm0, xmmword [r9 + 0x248]
vmovups xmmword [rcx + 0x170], xmm0
vmovss xmm4, dword [rcx + 0x150]
vmovss xmm3, dword [rcx + 0x154]
vmovss xmm2, dword [rcx + 0x158]
vmovss xmm1, dword [rcx + 0x15c]
vmovups xmm0, xmmword [rcx + 0x150]
mov rax, qword [r9 + 0x2a8]
vmovups xmmword [r9 + 0x248], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.140055780

Function at 0x14005d4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140116768]
mov rcx, qword [rax + 0x4e20]
mov r10, qword [rax + 0x4008]
movsxd rax, dword [rcx + 0x74]
vmovss xmm4, dword [rcx + 0x170]
vmovss xmm3, dword [rcx + 0x174]
vmovss xmm2, dword [rcx + 0x178]
vmovss xmm1, dword [rcx + 0x17c]
vmovups xmm0, xmmword [rcx + 0x170]
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
vmovups xmmword [r10 + 0x248], xmm0
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.140055780