joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002af4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002b3e
mov ecx, memset
cmp word [rax], cx
jne 0x140002b3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002b3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002b3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002b3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002b40
xor al, al
add rsp, 0x28
ret
Function at 0x180006760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
test edx, edx
je 0x18000679e
mov r9d, edx
lea r10, [0x180119310]
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [rcx]
lea rcx, [rcx + 2]
mov edx, eax
shr eax, 8
xor r8, rdx
movzx edx, r8b
xor eax, dword [r10 + rdx*4]
sub r9, 1
jne 0x180006780
not eax
ret
Function at 0x180013700
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test rcx, rcx
je 0x180013760
mov r8, qword [rcx]
test r8, r8
je 0x180013760
mov r8, qword [r8 + 0x10]
mov eax, 0xffffffff
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [r8 + rcx], 0
jne 0x180013720
test ecx, ecx
je 0x18001375d
mov r9d, ecx
lea r10, [0x180119310]
nop dword [rax + rax]
movsx edx, byte [r8]
lea r8, [r8 + 1]
mov ecx, eax
shr eax, 8
xor rdx, rcx
movzx ecx, dl
xor eax, dword [r10 + rcx*4]
sub r9, 1
jne 0x180013740
not eax
ret
xor eax, eax
ret

Function at 0x180015260
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x18001526d
xor eax, eax
jmp 0x1800152e6
mov r9, qword [rcx]
test r9, r9
jne 0x180015279
xor eax, eax
jmp 0x1800152e6
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x180015286
xor eax, eax
jmp 0x1800152e6
mov r10, r9
mov qword [rsp + 8], r9
xor edx, edx
mov r8d, 0xffffffff
lea r11, [0x180119310]
mov dword [rsp], edx
mov ecx, r8d
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1800152b0
cmp edx, eax
jae 0x1800152dc
movsx eax, byte [r10]
xor rax, rcx
movzx ecx, al
shr r8d, 8
xor r8d, dword [r11 + rcx*4]
inc r10
mov qword [rsp + 8], r10
inc edx
jmp 0x18001529d
not r8d
mov eax, r8d
jmp 0x1800152e6
add rsp, 0x18
ret

Function at 0x180015cf0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x180296b35], 0
mov rbx, rcx
je 0x180015d61
mov ecx, dword [0x180296c20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180015d61
cmp dword [0x180296b50], 1
jne 0x180015d61
lea rcx, [rbx + 0xa8]
cmp rcx, 0x40000
jbe 0x180015d61
lea rax, [rcx + 8]
movabs rdx, 0x7fffffff0000
cmp rax, rdx
jae 0x180015d61
mov rcx, qword [rcx]
add rcx, 0x1fc
cmp rcx, 0x40000
jbe 0x180015d61
lea rax, [rcx + 4]
cmp rax, rdx
jae 0x180015d61
mov dword [rcx], 0x3c23d70a
add rsp, 0x20
pop rbx
ret
Function at 0x180016b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x180016ca9
mov edx, dword [0x180296940]
mov rax, qword gs:[0x58]
mov esi, 4
mov rdi, qword [rax + rdx*8]
mov edx, dword [0x1802be0a8]
cmp edx, dword [rdi + rsi]
jle 0x180016b88
lea rcx, [0x1802be0a8]
call fcn.1800f8774
mov edx, dword [0x1802be0a8]
cmp edx, 0xffffffff
jne 0x180016b88
mov ecx, 0xac5e6f4b
call fcn.18000c310
lea rcx, [0x1802be0a8]
mov qword [0x1802bdc30], rax
call fcn.1800f8714
mov edx, dword [0x1802be0a8]
mov rax, qword [0x1802bdc30]
cmp qword [rax + rbx], 0
je 0x180016ca9
cmp edx, dword [rdi + rsi]
jle 0x180016bd1
lea rcx, [0x1802be0a8]
call fcn.1800f8774
cmp dword [0x1802be0a8], 0xffffffff
jne 0x180016bd1
mov ecx, 0xac5e6f4b
call fcn.18000c310
lea rcx, [0x1802be0a8]
mov qword [0x1802bdc30], rax
call fcn.1800f8714
mov rax, qword [0x1802bdc30]
mov rbx, qword [rax + rbx]
test rbx, rbx
je 0x180016ca9
mov eax, dword [rdi + rsi]
cmp dword [0x1802bd910], eax
jle 0x180016c25
lea rcx, [0x1802bd910]
call fcn.1800f8774
cmp dword [0x1802bd910], 0xffffffff
jne 0x180016c25
mov ecx, 0x99c155f5
call fcn.180009330
lea rcx, [0x1802bd910]
mov rdx, qword [rax]
mov qword [0x1802bd8d8], rdx
call fcn.1800f8714
mov rax, qword [0x1802bd8d8]
mov rcx, rbx
call rax
test rax, rax
je 0x180016ca9
mov r8, qword [rax]
test r8, r8
je 0x180016ca9
mov r8, qword [r8 + 0x10]
mov edx, 0xffffffff
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r8 + rax], 0
jne 0x180016c50
test eax, eax
je 0x180016ca9
mov r9d, eax
lea r10, [0x180119310]
nop dword [rax + rax]
movsx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
xor edx, dword [r10 + rax*4]
sub r9, 1
jne 0x180016c70
not edx
cmp edx, 0xafa91f9a
jne 0x180016ca9
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180016cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x180016e59
mov edx, dword [0x180296940]
mov rax, qword gs:[0x58]
mov esi, 4
mov rdi, qword [rax + rdx*8]
mov edx, dword [0x1802be0a8]
cmp edx, dword [rdi + rsi]
jle 0x180016d38
lea rcx, [0x1802be0a8]
call fcn.1800f8774
mov edx, dword [0x1802be0a8]
cmp edx, 0xffffffff
jne 0x180016d38
mov ecx, 0xac5e6f4b
call fcn.18000c310
lea rcx, [0x1802be0a8]
mov qword [0x1802bdc30], rax
call fcn.1800f8714
mov edx, dword [0x1802be0a8]
mov rax, qword [0x1802bdc30]
cmp qword [rax + rbx], 0
je 0x180016e59
cmp edx, dword [rdi + rsi]
jle 0x180016d81
lea rcx, [0x1802be0a8]
call fcn.1800f8774
cmp dword [0x1802be0a8], 0xffffffff
jne 0x180016d81
mov ecx, 0xac5e6f4b
call fcn.18000c310
lea rcx, [0x1802be0a8]
mov qword [0x1802bdc30], rax
call fcn.1800f8714
mov rax, qword [0x1802bdc30]
mov rbx, qword [rax + rbx]
test rbx, rbx
je 0x180016e59
mov eax, dword [rdi + rsi]
cmp dword [0x1802bd910], eax
jle 0x180016dd5
lea rcx, [0x1802bd910]
call fcn.1800f8774
cmp dword [0x1802bd910], 0xffffffff
jne 0x180016dd5
mov ecx, 0x99c155f5
call fcn.180009330
lea rcx, [0x1802bd910]
mov rdx, qword [rax]
mov qword [0x1802bd8d8], rdx
call fcn.1800f8714
mov rax, qword [0x1802bd8d8]
mov rcx, rbx
call rax
test rax, rax
je 0x180016e59
mov r8, qword [rax]
test r8, r8
je 0x180016e59
mov r8, qword [r8 + 0x10]
mov edx, 0xffffffff
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [r8 + rax], 0
jne 0x180016e00
test eax, eax
je 0x180016e59
mov r9d, eax
lea r10, [0x180119310]
nop dword [rax + rax]
movsx ecx, byte [r8]
lea r8, [r8 + 1]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
xor edx, dword [r10 + rax*4]
sub r9, 1
jne 0x180016e20
not edx
cmp edx, 0xa35b001c
jne 0x180016e59
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18001b580
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x28
cmp byte [0x180296c4f], 0
jne 0x18001b5e0
lea rcx, [rsp + 0x30]
mov byte [0x180296c4f], 1
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
xorps xmm1, xmm1
cvtsi2ss xmm0, qword [rsp + 0x38]
cvtsi2ss xmm1, qword [rsp + 0x30]
movss dword [0x180296c88], xmm0
movss dword [0x180296a4c], xmm1
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x30]
subss xmm0, dword [0x180296a4c]
divss xmm0, dword [0x180296c88]
add rsp, 0x28
ret
Function at 0x18001cc20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
cmp byte [0x180296b1a], 0
je 0x18001cd50
mov ecx, dword [0x180296c34]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18001cd50
call fcn.180017060
mov rcx, rax
call fcn.180016ed0
lea rdx, [rbp - 0x50]
mov rcx, rax
mov r10, rax
call fcn.180015b40
mov rcx, r10
call fcn.180015bf0
mov r8d, eax
test eax, eax
jne 0x18001ccb7
cmp byte [0x180296b1a], al
je 0x18001ccad
movss xmm1, dword [rbp - 0x38]
movss xmm0, dword [0x180296b78]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x180123ac0]
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
add rsp, 0x80
pop rbp
ret
movss xmm0, dword [rbp - 0x38]
jmp 0x18001ce31
lea rcx, [rbp - 0x40]
nop dword [rax + rax]
mov eax, dword [rcx + 8]
movsd xmm0, qword [rcx]
mov dword [rbp - 0x58], eax
lea rax, [rbp - 0x60]
movsd qword [rbp - 0x60], xmm0
cmp dword [rax], r8d
je 0x18001cd39
add rax, 4
lea rdx, [rbp - 0x58]
cmp rax, rdx
jne 0x18001ccd3
cmp dword [rbp - 0x60], 0
je 0x18001cd39
add rcx, 0xc
lea rax, [rbp - 0x10]
cmp rcx, rax
jne 0x18001ccc0
cmp byte [0x180296b1a], 0
movss xmm0, dword [0x180296b78]
je 0x18001cd21
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x180123b90]
cvtpd2ps xmm0, xmm0
add rsp, 0x80
pop rbp
ret
addss xmm0, dword [0x180123d48]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm0, xmm0
add rsp, 0x80
pop rbp
ret
cmp byte [0x180296b1a], 0
je 0x18001ce2c
movss xmm1, dword [rbp - 0x58]
jmp 0x18001cc86
call fcn.180017060
mov rcx, rax
call fcn.180016ed0
lea rdx, [rbp - 0x50]
mov rcx, rax
mov r10, rax
call fcn.180015b40
mov rcx, r10
call fcn.180015bf0
mov r8d, eax
test eax, eax
jne 0x18001cd8e
cmp byte [0x180296b1a], al
je 0x18001ccad
movss xmm1, dword [rbp - 0x38]
jmp 0x18001ce05
lea rcx, [rbp - 0x40]
mov eax, dword [rcx + 8]
movsd xmm0, qword [rcx]
mov dword [rbp - 0x58], eax
lea rax, [rbp - 0x60]
movsd qword [rbp - 0x60], xmm0
cmp dword [rax], r8d
je 0x18001cdf7
add rax, 4
lea rdx, [rbp - 0x58]
cmp rax, rdx
jne 0x18001cda5
cmp dword [rbp - 0x60], 0
je 0x18001cdf7
add rcx, 0xc
lea rax, [rbp - 0x10]
cmp rcx, rax
jne 0x18001cd92
cmp byte [0x180296b1a], 0
movss xmm0, dword [0x180296b78]
je 0x18001cd21
cvtps2pd xmm0, xmm0
addsd xmm0, qword [0x180123b80]
cvtpd2ps xmm0, xmm0
add rsp, 0x80
pop rbp
ret
cmp byte [0x180296b1a], 0
je 0x18001ce2c
movss xmm1, dword [rbp - 0x58]
movss xmm0, dword [0x180296b78]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
mulsd xmm1, qword [0x180123a48]
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
add rsp, 0x80
pop rbp
ret
movss xmm0, dword [rbp - 0x58]
addss xmm0, dword [0x180296b78]
cvtps2pd xmm1, xmm0
cvtpd2ps xmm0, xmm1
add rsp, 0x80
pop rbp
ret
Function at 0x18001d5b0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
call fcn.180017060
mov rcx, rax
call fcn.180016ed0
mov rbx, rax
test rax, rax
je 0x18001d7c8
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180015b40
cmp dword [rsp + 0x20], 0
je 0x18001d7c8
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x18001d7c8
cmp eax, 0xfffffffe
jne 0x18001d68c
mov rcx, rbx
call fcn.180015d70
cmp byte [0x180296b0a], 0
je 0x18001d7c8
add rbx, 0xa8
cmp rbx, 0x40000
jbe 0x18001d7c8
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18001d7c8
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x3a0]
cmp r9, 0x40000
jbe 0x18001d65f
lea rax, [r9 + 1]
cmp rax, rcx
jae 0x18001d65f
mov byte [r9], 1
lea rdx, [r8 + 0x3a4]
cmp rdx, 0x40000
jbe 0x18001d7c8
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x18001d7c8
mov dword [rdx], 0x3f800000
add rsp, 0x70
pop rbx
ret
cmp eax, 3
jne 0x18001d6f4
mov rcx, rbx
call fcn.180015d70
cmp byte [0x180296b0f], 0
je 0x18001d6e7
lea rdx, [rbx + 0xa8]
cmp rdx, 0x40000
jbe 0x18001d6e7
lea rax, [rdx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18001d6e7
mov rdx, qword [rdx]
add rdx, 0x1fc
cmp rdx, 0x40000
jbe 0x18001d6e7
lea rax, [rdx + 4]
cmp rax, rcx
jae 0x18001d6e7
mov dword [rdx], 0x3d4ccccd
mov rcx, rbx
add rsp, 0x70
pop rbx
jmp fcn.180015cf0
cmp eax, 2
jne 0x18001d74d
mov rcx, rbx
call fcn.180015d70
mov rcx, rbx
call fcn.180015cf0
cmp byte [0x180296b09], 0
je 0x18001d7c8
lea rdx, [rbx + 0xa8]
cmp rdx, 0x40000
jbe 0x18001d7c8
lea rax, [rdx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18001d7c8
mov rdx, qword [rdx]
add rdx, 0x290
jmp 0x18001d7b3
cmp eax, 0xffffffff
jne 0x18001d7c8
mov rcx, rbx
call fcn.180015d70
cmp byte [0x180296b1c], 0
je 0x18001d7c8
add rbx, 0xa8
cmp rbx, 0x40000
jbe 0x18001d7c8
lea rax, [rbx + 8]
movabs rcx, 0x7fffffff0000
cmp rax, rcx
jae 0x18001d7c8
mov rdx, qword [rbx]
mov r8, rdx
lea r9, [rdx + 0x3a0]
cmp r9, 0x40000
jbe 0x18001d7ac
lea rax, [r9 + 4]
cmp rax, rcx
jae 0x18001d7ac
mov dword [r9], 0x3f800000
lea rdx, [r8 + 0x3b0]
cmp rdx, 0x40000
jbe 0x18001d7c8
lea rax, [rdx + 1]
cmp rax, rcx
jae 0x18001d7c8
mov byte [rdx], 1
add rsp, 0x70
pop rbx
ret
Function at 0x180023280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1800232f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800232f5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1800232e5
nop
cmp rbx, rcx
jae 0x1800232f5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1800232d0
cmp rbx, rcx
jae 0x1800232f5
cmp word [rbx], 0
je 0x1800232f5
mov rax, rbx
jmp 0x1800232f7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18004c800
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x38
cmp dword [0x1802b8f88], 3
jne 0x18004ca67
mov r10, qword [0x180296cd0]
lea rdx, [0x180121ed9]
mov qword [rsp + 0x48], rbx
mov r8b, 0x4d
mov qword [rsp + 0x30], rdi
lea rdi, [0x180119e50]
mov dword [rsp + 0x40], 0x438b0000
mov rax, qword [r10 + 0x3ea0]
mov dword [rsp + 0x44], 0x43d20000
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp r8b, 0x23
jne 0x18004c884
cmp byte [rdx], r8b
jne 0x18004c884
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [rdi + rcx*4]
test r8b, r8b
jne 0x18004c871
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18004c8be
lea r8, str.Main
mov edx, 0xb
mov ecx, ebx
call fcn.18006ba70
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, str.Main
call fcn.180049530
call fcn.18005e7f0
movss xmm1, dword [0x180123bd4]
call fcn.180064d70
mov r10, qword [0x180296cd0]
lea rdx, [0x180121ec9]
mov dword [rsp + 0x40], 0x438b0000
mov r8b, 0x4f
mov dword [rsp + 0x44], 0x43d20000
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp r8b, 0x23
jne 0x18004c945
cmp byte [rdx], r8b
jne 0x18004c945
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [rdi + rcx*4]
test r8b, r8b
jne 0x18004c932
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18004c97f
lea r8, [0x180121ec8]
mov edx, 0xb
mov ecx, ebx
call fcn.18006ba70
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, [0x180121ec8]
call fcn.180049530
call fcn.18005e7f0
movss xmm1, dword [0x180123bd4]
call fcn.180064d70
mov r10, qword [0x180296cd0]
lea r8, [0x180121ed1]
mov dword [rsp + 0x40], 0x438b0000
mov dl, 0x4f
mov dword [rsp + 0x44], 0x43d20000
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp dl, 0x23
jne 0x18004ca04
cmp byte [r8], dl
jne 0x18004ca04
cmp byte [r8 + 1], dl
cmove ebx, r9d
movzx ecx, bl
movzx eax, dl
movzx edx, byte [r8]
xor rcx, rax
shr ebx, 8
inc r8
xor ebx, dword [rdi + rcx*4]
test dl, dl
jne 0x18004c9f2
mov rdi, qword [rsp + 0x30]
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18004ca41
lea r8, str.Other1
mov edx, 0xb
mov ecx, ebx
call fcn.18006ba70
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, str.Other1
call fcn.180049530
mov rbx, qword [rsp + 0x48]
add rsp, 0x38
jmp fcn.18005e7f0
add rsp, 0x38
ret
Function at 0x18004ca70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x38
cmp dword [0x1802b8f88], 4
jne 0x18004cc78
mov r10, qword [0x180296cd0]
lea rdx, [0x180121ed9]
mov qword [rsp + 0x48], rbx
mov r8b, 0x4d
mov qword [rsp + 0x30], rdi
lea rdi, [0x180119e50]
mov dword [rsp + 0x40], 0x43d08000
mov rax, qword [r10 + 0x3ea0]
mov dword [rsp + 0x44], 0x43d20000
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp r8b, 0x23
jne 0x18004caf4
cmp byte [rdx], r8b
jne 0x18004caf4
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [rdi + rcx*4]
test r8b, r8b
jne 0x18004cae1
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18004cb2e
lea r8, str.Main
mov edx, 0xb
mov ecx, ebx
call fcn.18006ba70
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, str.Main
call fcn.180049530
call fcn.18005e7f0
movss xmm1, dword [0x180123e6c]
call fcn.180064d70
mov r10, qword [0x180296cd0]
lea r8, [0x180121ee1]
mov dword [rsp + 0x40], 0x43d08000
mov dl, 0x4d
mov dword [rsp + 0x44], 0x43d20000
mov rax, qword [r10 + 0x3ea0]
mov byte [rax + 0x98], 1
mov rax, qword [r10 + 0x3ea0]
movsxd rcx, dword [rax + 0xd0]
mov rax, qword [rax + 0xd8]
mov r9d, dword [rax + rcx*4 - 4]
not r9d
mov ebx, r9d
cmp dl, 0x23
jne 0x18004cbb3
cmp byte [r8], dl
jne 0x18004cbb3
cmp byte [r8 + 1], dl
cmove ebx, r9d
movzx ecx, bl
movzx eax, dl
movzx edx, byte [r8]
xor rcx, rax
shr ebx, 8
inc r8
xor ebx, dword [rdi + rcx*4]
test dl, dl
jne 0x18004cba1
mov rdi, qword [rsp + 0x30]
not ebx
cmp dword [r10 + 0x3ed4], ebx
jne 0x18004cbf0
lea r8, str.Main1
mov edx, 0xb
mov ecx, ebx
call fcn.18006ba70
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, str.Main1
call fcn.180049530
mov r8d, 0x260
lea rdx, [0x180295c28]
lea rcx, str.Menu_Color
call fcn.180080600
mov rbx, qword [rsp + 0x48]
test al, al
je 0x18004cc6f
movss xmm2, dword [0x180123d4c]
movss xmm0, dword [0x180295c28]
movss xmm1, dword [0x180295c30]
mulss xmm0, xmm2
mulss xmm1, xmm2
cvttss2si eax, xmm0
movss xmm0, dword [0x180295c2c]
mov dword [0x18013c060], eax
mulss xmm0, xmm2
cvttss2si eax, xmm0
mov dword [0x18013c064], eax
cvttss2si eax, xmm1
mov dword [0x18013c068], eax
add rsp, 0x38
jmp fcn.18005e7f0
add rsp, 0x38
ret
Function at 0x18004e640
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x18004e650
xor al, al
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x18004e620]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18004e67d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x38
ret

Function at 0x18004e9d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x18004ea00
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x18004ea28
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18004ea2a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18004ea83
test ecx, ecx
jle 0x18004ea63
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18004ea83
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18004ea83
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18004eab0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18004eae1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x18004eaf8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18004eb20
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18004eb22
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004eb54
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x18004ebf1
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18004eb92
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x18004ebd1
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x18004ec12
cmp rdi, rax
ja 0x18004eba0
test rbx, rbx
je 0x18004ebf1
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x18004ebf4