joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f18b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400f18f2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400f1939
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400f1992
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400f1950
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400f19d3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1401076a2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1401076a3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400f19a0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400f294c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f2996
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f2996
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f2996
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f2996
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f2996
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f2998
xor al, al
add rsp, 0x28
ret
Function at 0x1400f33bc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400f33f6
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400f33fb
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400f3444
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400f3444
dec r8
sub rdx, 1
jne 0x1400f342a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400d4860
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.1400d9130
sub rsp, rax
mov rax, qword [0x14011a680]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x1400d4922
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1400e8094
cmp rax, 1
jne 0x1400d497e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400d48ff
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400d48f3
cmp rcx, 1
jb 0x1400d497e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400d48c0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x1400d4953
lea rcx, [rsp + 0x80]
call fcn.1400eac44
jmp 0x1400d4955
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.1400d8e60
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400dc5f0
int3
Function at 0x1400d57d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14012297e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x1400d5855
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1401227d0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x1401227d0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x1401227d0], rdx
call fcn.1400d3710
cmp eax, ebx
jne 0x1400d59bd
mov byte [0x14012297e], 1
lea rdx, [0x1400f99f8]
mov rcx, rsi
call fcn.1400e7b40
test eax, eax
je 0x1400d58e0
cmp byte [0x14012297d], 1
je 0x1400d58e0
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236d0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236d8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236e0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236e8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236f0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401236f8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140123700], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x140123708], rax
mov byte [0x14012297d], 1
mov r8, qword [0x1401227d0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x1400d5907
inc rax
test cl, cl
jne 0x1400d58f0
mov ecx, r9d
jmp 0x1400d590c
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x1400d5913
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x1400d5978
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x1400d5955
inc rax
test cl, cl
jne 0x1400d5940
mov ecx, r9d
jmp 0x1400d595a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x1400d5961
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x1400d5930
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x1400d59a8
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1400d1d00
add rdi, 8
sub rbx, 1
jne 0x1400d5990
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.1400e4854
call fcn.1400dc5f0
int3
Function at 0x1400d8a00
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14011a680]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400d8ab1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1400e8094
cmp rax, 1
jne 0x1400d8ae7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x1400d8a8d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x1400d8a80
cmp rcx, 1
jb 0x1400d8ae7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400d8a50
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400d8e60
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400dc5f0
int3

Function at 0x1400d8ce0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14011a680]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x1400d8d8f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1400e8094
cmp rax, 1
jne 0x1400d8dc5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x1400d8d6c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x1400d8d60
cmp rcx, 1
jb 0x1400d8dc5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1400d8d30
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400d8e60
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400dc5f0
int3

Function at 0x1400d9894
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d98de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d98de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d98de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d98de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d98de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400d98e0
xor al, al
add rsp, 0x28
ret
Function at 0x1400ddc64
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400ddcd3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ddcd3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ddcd3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ddcd3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ddcd3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ddcd3
cmp dword [rcx + 0xf8], 0
je 0x1400ddcd3
mov ecx, ebx
call fcn.1400ddd84
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400ddb60
nop
cmp dword [rbp + 0x20], 0
je 0x1400ddd21
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400ddd2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400ddc64

Function at 0x1400dde68
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400ddcd3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400ddcd3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400ddcd3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400ddcd3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400ddcd3
cmp dword [rcx + 0x84], 0xe
jbe 0x1400ddcd3
cmp dword [rcx + 0xf8], 0
je 0x1400ddcd3
mov ecx, ebx
call fcn.1400ddd84
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400ddb60
nop
cmp dword [rbp + 0x20], 0
je 0x1400ddd21
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400ddd2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x1400ddc64
Function at 0x1400efba0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400efc27
mov rsi, rbx
cmp word [rax], bp
je 0x1400efbe6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400efbd0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400efbcc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400eb11c
mov rdi, rax
test rax, rax
je 0x1400efc14
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400f5f20
mov rbp, rdi
xor ecx, ecx
call fcn.1400ebc64
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f232c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400f2342
mov al, 1
jmp 0x1400f23a2
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400f2353
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400f23a0
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400f0344
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400f23a0
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400f23a0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400f23a0
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400f23a2
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400f5d00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400f5d28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400f5d28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140006850
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400580c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140058360]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x1400068b8
cmp byte [rbx + 0x424e], 0
jne 0x1400068b8
movsx r9d, word [rbx + 0x5342]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000b110
test sil, 1
je 0x1400069e9
jmp 0x140006951
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140049078]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x14004906c]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x3fa0], 1
mov qword [rbx + 0x3fb8], rax
movss dword [rbx + 0x3fb0], xmm0
mov dword [rbx + 0x3fa4], 1
movss dword [rbx + 0x3fb4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mov rax, qword [0x140058360]
mulss xmm0, dword [0x140049028]
or dword [rax + 0x3fa0], 0x40
movss dword [rax + 0x4000], xmm0
movsx r9d, word [rbx + 0x5342]
call fcn.14000b110
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400069a1
lea r11, [0x140047960]
cmp r9b, 0x23
jne 0x140006984
cmp byte [r8], r9b
jne 0x140006984
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140006971
not ecx
call fcn.140009ef0
test rax, rax
je 0x1400069e9
cmp byte [rax + 0x96], 0
je 0x1400069e9
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5342]
mov edx, 0x10
movsx r9d, word [rbx + 0x5342]
call fcn.14000b110
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140003af0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400443e0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009e40
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140058360]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140009ea3
mov qword [rsp], rbx
lea rbx, [0x140047960]
nop dword [rax]
cmp r9b, 0x23
jne 0x140009e83
cmp byte [r8], r9b
jne 0x140009e83
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140009e70
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53a0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140009ed7
mov r10, qword [r10 + 0x53a8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140009ede
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140009ec4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140009f70
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140009fc0
lea r11, [0x140047960]
cmp r9b, 0x23
jne 0x140009fa3
cmp byte [r8], r9b
jne 0x140009fa3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140009f90
not ecx
jmp fcn.140009ef0

Function at 0x14000a550
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r8, [0x140047960]
movsxd rcx, dword [rcx + 0xd0]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x140058360]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x14000a5e8
movsxd r8, edx
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.140008600
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000a670
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0xf0]
lea r10, [0x140047960]
mov rax, qword [rcx + 0xd8]
movss xmm1, dword [rcx + 0xf4]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xd0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret

Function at 0x14000b360
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000b3bd
lea rbx, [0x140047960]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000b3a4
cmp r10, 2
jb 0x14000b3a4
cmp byte [r9], r8b
jne 0x14000b3a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000b380
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000b3ff
lea rbx, [0x140047960]
cmp r8b, 0x23
jne 0x14000b3e3
cmp byte [r9], r8b
jne 0x14000b3e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000b3d0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000ca90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53f0], 0
lea rbx, [rcx + 0x53f8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000cb37
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14000caea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001a590
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14001a0a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53f0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5400]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140058368]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14000cb3f
mov rcx, rbx
call fcn.14001a0a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret