joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x14000e831
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14000e8d2
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000e8a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000e89f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e97b
mov rcx, r8
call fcn.140050d90
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400505b0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14000e917
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000e913
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000e90e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000e97b
mov rcx, r8
call fcn.140050d90
xor al, al
jmp 0x14000e8a6
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x6a600
mov qword [rsp + 0x20], rbp
lea rdx, [0x140064050]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x14000e964
cmp rax, 8
jb 0x14000e913
lea rdx, [rax*2 + 2]
jmp 0x14000e8ea
cmp rax, 8
jb 0x14000e8a4
lea rdx, [rax*2 + 2]
jmp 0x14000e877
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000e990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 8
mov dword [rsp + 0x40], ebp
jb 0x14000e9c1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14000ea62
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000ea34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000ea2f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000eb0b
mov rcx, r8
call fcn.140050d90
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400505b0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14000eaa7
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x14000eaa3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000ea9e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000eb0b
mov rcx, r8
call fcn.140050d90
xor al, al
jmp 0x14000ea36
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x3400
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400ce650]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x14000eaf4
cmp rax, 8
jb 0x14000eaa3
lea rdx, [rax*2 + 2]
jmp 0x14000ea7a
cmp rax, 8
jb 0x14000ea34
lea rdx, [rax*2 + 2]
jmp 0x14000ea07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000eb20
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
cmp qword [rdx + 0x18], 8
mov r15, rcx
mov qword [rsp + 0x50], rdx
mov r13, rdx
jb 0x14000eb49
mov r13, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r12, r15
jb 0x14000eb56
mov r12, qword [rcx]
movzx edx, word [0x1400542b0]
mov eax, 0x56
movzx ecx, word [0x1400542b2]
mov r14d, 0x56
movzx ebp, word [0x1400542ac]
movzx r8d, ax
movzx r10d, word [0x1400542ae]
xor dx, ax
lea ebx, [rax - 0x1e]
mov word [rsp + 0x30], ax
lea r9d, [rax - 0x32]
xor cx, ax
lea edi, [rax - 0x1f]
xor bp, ax
lea esi, [rax - 0x31]
xor r10w, ax
lea r11d, [rax - 0x33]
xor r9w, r14w
movzx eax, word [0x1400542b4]
xor dx, r14w
xor ax, r8w
mov word [rsp + 0x32], r9w
xor r8w, r14w
mov word [rsp + 0x42], dx
xor cx, r14w
mov word [rsp + 0x3c], r8w
xor bx, r14w
mov word [rsp + 0x44], cx
mov word [rsp + 0x36], bx
lea rdx, [rsp + 0x32]
xor ebx, ebx
xor r11w, r14w
xor r10w, r14w
mov dword [rsp + 0x28], ebx
xor ax, r14w
mov qword [rsp + 0x20], rbx
xor di, r14w
mov word [rsp + 0x34], r11w
xor si, r14w
mov word [rsp + 0x38], di
xor bp, r14w
mov word [rsp + 0x3a], si
mov r8, r12
mov word [rsp + 0x3e], bp
mov r9, r13
mov word [rsp + 0x40], r10w
xor ecx, ecx
mov word [rsp + 0x46], ax
mov word [rsp + 0x48], bx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [r15 + 0x18]
mov r14, qword [rsp + 0x50]
cmp rdx, 8
jb 0x14000ec7a
mov rcx, qword [r15]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000ec75
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000eced
mov rcx, r8
call fcn.140050d90
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov word [r15], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 8
jb 0x14000ecc5
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000ecc0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000eced
mov rcx, r8
call fcn.140050d90
mov qword [r14 + 0x10], rbx
mov word [r14], bx
mov rbx, qword [rsp + 0xb0]
mov qword [r14 + 0x18], 7
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000f710
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000f7aa
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x14000f7aa
nop dword [rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000f793
inc rax
test ecx, ecx
jne 0x14000f780
test edx, edx
je 0x14000f7cd
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x14000f770
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400505b0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov eax, dword [rsp + 0x28]
jmp 0x14000f7ac
Function at 0x140010bf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
shr rcx, 0x38
mov rax, rdi
shr rax, 0x38
mov qword [rsp + 0x30], rax
mov rdx, rdi
shr rdx, 0x30
mov rax, rdi
shr rax, 0x30
mov qword [rsp + 0x28], rax
mov r8, rdi
shr r8, 0x28
mov r13, rdi
shr r13, 0x28
mov r9, rdi
shr r9, 0x20
mov r12, rdi
shr r12, 0x20
mov r10, rdi
shr r10, 0x18
mov r15, rdi
shr r15, 0x18
mov r11, rdi
shr r11, 0x10
mov r14, rdi
shr r14, 0x10
mov rbx, rdi
shr rbx, 8
mov rbp, rdi
shr rbp, 8
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov esi, 0x170
mov eax, dword [rsi + rax]
xor esi, esi
test al, 1
jne 0x140010d32
or eax, 1
mov rcx, qword [rsp + 0x20]
mov edx, 0x170
mov dword [rdx + rcx], eax
mov ebx, 0x130
add rbx, rcx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov qword [rsp + 0x38], rbx
mov dword [rbx], esi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
lea ecx, [rsi + 0x30]
call fcn.140050b04
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
lea edx, [rsi + 0x10]
call fcn.140011490
nop
lea rcx, [0x140052ca0]
call fcn.140050e6c
nop
mov rdx, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
jmp 0x140010d44
mov rbp, rbx
mov r14, r11
mov r15, r10
mov r12, r9
mov r13, r8
mov r8, rcx
mov rax, rdi
movzx ecx, al
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
movzx eax, bpl
xor rcx, rax
imul rcx, r9
movzx eax, r14b
xor rcx, rax
imul rcx, r9
movzx eax, r15b
xor rcx, rax
imul rcx, r9
movzx eax, r12b
xor rcx, rax
imul rcx, r9
movzx eax, r13b
xor rcx, rax
imul rcx, r9
movzx eax, dl
xor rcx, rax
imul rcx, r9
xor rcx, r8
imul rcx, r9
mov rdx, qword [rsp + 0x20]
mov r9d, 0x130
mov r8, qword [rdx + r9 + 0x30]
and r8, rcx
add r8, r8
mov rcx, qword [rdx + r9 + 0x18]
mov rax, qword [rcx + r8*8 + 8]
mov rdx, qword [rdx + r9 + 8]
cmp rax, rdx
je 0x140010df3
mov rcx, qword [rcx + r8*8]
cmp rdi, qword [rax + 0x10]
je 0x140010df0
cmp rax, rcx
je 0x140010df3
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x140010de1
mov rsi, rax
test rsi, rsi
cmove rsi, rdx
cmp rsi, rdx
je 0x140010e04
mov eax, dword [rsi + 0x18]
jmp 0x140010e09
mov eax, 0xffffffff
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140014d40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140064010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140014de2
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140014dd9
lea r8, [rsp + 0x4c]
mov rax, rbx
sub r8, rbx
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140014dc3
inc rax
test ecx, ecx
jne 0x140014db0
mov rcx, rdi
test edx, edx
je 0x140014e05
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140014da2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400505b0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
mov ebx, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x140014de4

Function at 0x140016530
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001658d
lea rbx, [0x140054660]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140016574
cmp r10, 2
jb 0x140016574
cmp byte [r9], r8b
jne 0x140016574
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140016550
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400165cf
lea rbx, [0x140054660]
cmp r8b, 0x23
jne 0x1400165b3
cmp byte [r9], r8b
jne 0x1400165b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400165a0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140016710
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14001672a
mov qword [r8], 0
lea rdx, [0x140058ed0]
call fcn.1400165e0
mov rbx, rax
test rax, rax
jne 0x14001674a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140016821
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140016821
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140016821
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140016821
cmp rdi, 0xffffffffffffffff
je 0x140016821
mov rax, qword [0x14015c4d8]
test rax, rax
je 0x1400167be
inc dword [rax + 0x3bc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140016821
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14001680e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14015c4d8]
test rax, rax
je 0x140016803
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14001682a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14001681c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14001682c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14001a740
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x140058de5]
mov dword [rsp + 0x2c], eax
lea r11, [0x140054660]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x14001a793
cmp byte [r8], r9b
jne 0x14001a793
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x14001a780
mov ecx, dword [rbx + 0x2f7c]
lea rax, [0x140027120]
mov edi, dword [rbx + 0x2f78]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1400271d0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400272b0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x14001a895
inc edi
test ecx, ecx
je 0x14001a7ff
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001a804
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x14001a895
mov rax, qword [0x14015c4d8]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x14001a828
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2f80]
mov rsi, rax
test rdx, rdx
je 0x14001a883
movsxd rcx, dword [rbx + 0x2f78]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f80]
test rcx, rcx
je 0x14001a87d
mov rax, qword [0x14015c4d8]
test rax, rax
je 0x14001a87d
dec dword [rax + 0x3bc]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2f80], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f7c], edi
movsxd rax, dword [rbx + 0x2f78]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f80]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f78]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x14001c310
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14001c360
lea r11, [0x140054660]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001c343
cmp byte [r8], r9b
jne 0x14001c343
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001c330
mov rcx, qword [0x14015c4d8]
not eax
movsxd rdx, dword [rcx + 0x1a50]
mov r9, qword [rcx + 0x1a58]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x14001c3c1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x14001c3b9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x14001c3bc
mov rdx, r8
test rdx, rdx
jne 0x14001c390
cmp r9, r10
je 0x14001c3d0
cmp dword [r9], eax
jne 0x14001c3d0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x140021570
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x14015c4d8]
lea rdx, [0x140054660]
mov r8, rcx
mov rsi, qword [rax + 0x1a68]
lea rbx, [rsi + 0xc0]
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rsi + 0xc4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x140021678
lea ecx, [r9 + 1]
test r8d, r8d
je 0x140021664
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140021669
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140028370
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400216a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x14015c4d8]
lea rdx, [0x140054660]
mov r8d, ecx
mov rsi, qword [rax + 0x1a68]
lea rbx, [rsi + 0xc0]
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rsi + 0xc4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x14002175f
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14002174b
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140021750
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140028370
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140026910
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x14015c4d8]
cmp byte [rbx + 0x2f98], 0
je 0x1400269fc
cmp qword [rbx + 0x2fa0], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2fa8]
je 0x1400269e4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14002698b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400281b0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140016cc0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2fa0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2fb0]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x14015c4cc]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140016cc0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140026d80
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x14015c4d8]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x140026dbe
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140026db5
test r13, r13
je 0x140026dca
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x140026f93
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x140026fd7
cmp al, 0xd
je 0x140026fd7
mov rbx, rcx
cmp rcx, r12
jae 0x140026e43
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x140026e43
cmp al, 0xd
je 0x140026e43
inc rbx
cmp rbx, r12
jb 0x140026e30
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x140026f77
cmp al, 0x5b
jne 0x140026f5e
cmp rbx, rcx
jbe 0x140026f5e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x140026f5e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call fcn.140051abe
mov r15, rax
test rax, rax
je 0x140026f77
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call fcn.140051abe
mov r11, rax
test rax, rax
je 0x140026f77
mov r10, qword [0x14015c4d8]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x140026f0a
cmp r9b, 0x23
jne 0x140026ee7
cmp byte [r8], r9b
jne 0x140026ee7
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x140054660]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x140026ed5
mov r8d, dword [r10 + 0x2f78]
xor eax, eax
not ecx
test r8d, r8d
jle 0x140026f34
mov r9, qword [r10 + 0x2f80]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x140026f3a
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x140026f25
xor edi, edi
xor ebp, ebp
jmp 0x140026f77
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x140026f36
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x140026f77
test rdi, rdi
je 0x140026f77
test rbp, rbp
je 0x140026f77
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x140026e10
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x140026fbe
mov rax, qword [0x14015c4d8]
test rax, rax
je 0x140026fbe
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2f60], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x140026e10