joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443620
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00468db8], eax
je 0x44363a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x443a70
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x443a93
call fcn.00446700
cmp eax, 1
je 0x443a9e
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
mov ecx, 0xa
lea rbx, [rsp + 0x20]
xor eax, eax
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x443b27
mov eax, 0x28
jmp 0x443afa
add rax, 1
cmp rax, 0x6b
je 0x443b19
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x443af0
cmp eax, 0x6a
je 0x443b19
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
jmp 0x443b07

Function at 0x443bc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00481470], 1
je 0x443bd6
call fcn.00443b30
mov ecx, dword [0x00468db8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x443c00
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004439b0
cmp qword [0x00489050], 0
mov rsi, rax
je 0x443bea
test rax, rax
je 0x443bea
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
call fcn.00443a70
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x443ce9
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xbc], 0
mov ecx, dword [0x00468db8]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x443ce9
mov rbx, rsi
jmp 0x443bea
call sub.msvcrt.dll_abort
nop
nop
Function at 0x445240
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
call fcn.004439b0
test rax, rax
mov rbx, rax
je 0x445451
test r13, r13
je 0x44527b
mov rax, qword [rax + 0x1d8]
mov qword [r13], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x4452f0
cmp esi, 1
je 0x4452e1
mov ecx, 0x14
call r14
cmp esi, 5
je 0x4452f0
add esi, 1
jmp 0x4452b2
xor ecx, ecx
call r12
jmp 0x4452dc
lea rdi, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, rdi
call fcn.00443a70
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x445432
test rbp, rbp
je 0x4454a0
mov eax, dword [rbp]
mov rsi, qword [rbp + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x445480
mov eax, dword [rbp + 0x18]
mov edx, esi
mov dword [rbx + 0xc0], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x00444030]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rsi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
ja 0x445402
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x4453b2
cmp eax, 0xffffffff
mov edx, 0xfffffffe
jl 0x4453b2
cmp eax, 0xe
mov edx, 0xf
jg 0x4453b2
cmp eax, 2
mov edx, 2
cmovle edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x445465
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x445411
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.00443310
mov rcx, rdi
call fcn.00443a70
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test r13, r13
je 0x44543f
mov qword [r13], 0
cmp qword [rbx + 0x1d0], 0
jne 0x445451
mov rcx, rbx
call fcn.00443850
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x4453e9
call fcn.00443bc0
mov eax, dword [rax + 0xc0]
mov edx, esi
mov dword [rbx + 0xc0], eax
jmp 0x44534f
xor edx, edx
jmp 0x44534f
Function at 0x447e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov ecx, dword [0x00481aa4]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x447f30
mov rax, qword [0x00481aa8]
xor ebx, ebx
add rax, 0x18
mov rdx, qword [rax]
cmp rsi, rdx
jb 0x447e5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rsi, rdx
jb 0x447f16
add ebx, 1
add rax, 0x28
cmp ebx, ecx
jne 0x447e40
mov rcx, rsi
call fcn.00448a50
test rax, rax
mov r12, rax
je 0x447f68
movsxd rbx, ebx
lea rbx, [rbx + rbx*4]
shl rbx, 3
mov r13, rbx
add r13, qword [0x00481aa8]
mov qword [r13 + 0x20], rax
mov dword [r13], 0
call fcn.00448ba0
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 0x18], rax
mov rax, qword [0x00481aa8]
mov rcx, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x447f4b
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x447f0f
sub eax, 0x40
and eax, 0xffffffbf
je 0x447f0f
add rbx, qword [0x00481aa8]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x447f37
add dword [0x00481aa4], 1
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_memcpy
xor ebx, ebx
jmp 0x447e67
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00447da0
mov rax, qword [0x00481aa8]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.00447da0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00447da0
nop
nop dword [rax + rax]

Function at 0x4486c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00481d80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00481d60]
test rbx, rbx
je 0x448714
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x44870b
test rsi, rsi
je 0x44870b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4486f0
lea rcx, [0x00481d80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x448a50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00475bc0]
xor edx, edx
mov r8, rcx
cmp word [r9], 0x5a4d
je 0x448a70
mov rax, rdx
add rsp, 0x28
ret
mov rcx, r9
call fcn.00448930
test eax, eax
je 0x448a68
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add rax, r9
movzx edx, word [rax + 0x14]
lea rdx, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x448acd
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
cmp rcx, r8
mov rax, r8
jb 0x448ac4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x448a68
add rdx, 0x28
cmp rdx, r9
jne 0x448ab0
xor edx, edx
mov rax, rdx
add rsp, 0x28
ret

Function at 0x449360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x4494ec
cmp byte [rbx], 0
je 0x4494b4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4494d0
test al, 0x10
je 0x4494b4
lea rdi, [rsp + 0x20]
mov r8d, 0x104
mov rdx, rbx
mov rcx, rdi
mov rsi, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rsi]
add rsi, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4493be
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rsi + 2]
mov ecx, eax
cmove rsi, rdx
add cl, al
sbb rsi, 3
sub rsi, rdi
lea rcx, [rsi + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x4494df
lea r9, [rax + 0x244]
lea rbp, [rsi + 1]
mov rdx, rdi
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rbx + 0x244], 0
mov r9, rax
je 0x449450
movzx eax, byte [rbx + rsi + 0x243]
cmp al, 0x2f
je 0x449450
cmp al, 0x5c
je 0x449450
mov r8d, 0x5c
mov word [r9 + rsi], r8w
mov rsi, rbp
mov eax, 0x2a
xor edx, edx
xor ecx, ecx
mov word [r9 + rsi], ax
mov word [rbx + 0x12c], dx
lea rdx, [rbx + 0x130]
mov word [rbx + 0x12e], cx
xor eax, eax
mov ecx, 0x20
mov rdi, rdx
mov qword [rbx + 0x238], 0xffffffffffffffff
mov dword [rbx + 0x240], 0
mov dword [rbx + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x4494a5
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x4494a5
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x4494a5
Function at 0x140004280
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400042dd
lea rbx, [0x140078200]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400042c4
cmp r10, 2
jb 0x1400042c4
cmp byte [r9], r8b
jne 0x1400042c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400042a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000431f
lea rbx, [0x140078200]
cmp r8b, 0x23
jne 0x140004303
cmp byte [r9], r8b
jne 0x140004303
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400042f0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000447a
mov qword [r8], 0
lea rdx, [0x140077c60]
call fcn.140004330
mov rbx, rax
test rax, rax
jne 0x14000449a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140004573
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004573
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004573
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004573
cmp rdi, 0xffffffffffffffff
je 0x140004573
mov rax, qword [0x14008ae30]
test rax, rax
je 0x140004510
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140004573
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140004560
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14008ae30]
test rax, rax
je 0x140004555
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000457c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000456e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000457e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140011f50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14008ae30]
lea r10, [0x140078200]
mov r8, rcx
mov rbx, qword [rax + 0x1c20]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr rax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr r8, 0x38
shr rax, 0x30
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
xor rcx, r8
shr edi, 8
mov r8d, dword [rbx + 4]
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x140012070
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14001205c
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140012061
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140024580
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140012090
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14008ae30]
lea r10, [0x140078200]
mov r8d, ecx
mov rbx, qword [rax + 0x1c20]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
mov eax, r8d
mov r8d, dword [rbx + 4]
xor rdx, rcx
shr rax, 0x18
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r10 + rcx*4]
not edi
cmp r9d, r8d
jne 0x140012151
lea ecx, [r9 + 1]
test r8d, r8d
je 0x14001213d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140012142
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140024580
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140012f90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14008ae30]
mov edi, edx
cmp byte [rbx + 0x1f85], 0
jne 0x140012ff0
cmp byte [rbx + 0x1f86], 0
jne 0x140012ff0
mov r9d, dword [rbx + 0x2fc8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004200
test dil, 1
je 0x14001311a
jmp 0x140013081
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2fc8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14007f80c]
mov edx, 0x10
mulss xmm1, dword [0x14007f7f8]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1cec], rax
mov dword [rbx + 0x1cd4], 1
movss dword [rbx + 0x1ce4], xmm0
mov byte [rbx + 0x1d0c], 1
movss dword [rbx + 0x1ce8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x14007f484]
or dword [rbx + 0x1cd0], 0x41
movss dword [rbx + 0x1d30], xmm0
call fcn.140004200
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400130d1
lea r11, [0x140078200]
cmp r9b, 0x23
jne 0x1400130b4
cmp byte [r8], r9b
jne 0x1400130b4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400130a1
not ecx
call fcn.14000b9a0
test rax, rax
je 0x14001311a
cmp byte [rax + 0xbf], 0
je 0x14001311a
mov byte [rax + 0xc6], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0xdc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fc8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2fc8]
call fcn.140004200
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000e400
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400735e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140017cb0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x14008ae30]
cmp byte [rbx + 0x3090], 0
je 0x140017d9c
cmp qword [rbx + 0x3098], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x30a0]
je 0x140017d84
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x140017d2b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140024460
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.1400049a0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3098]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x30a8]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x14008ae28]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.1400049a0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140018110
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140018162
lea r11, [0x140078200]
cmp r9b, 0x23
jne 0x140018145
cmp byte [r8], r9b
jne 0x140018145
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018132
mov r11, qword [0x14008ae30]
xor r9d, r9d
not eax
mov r10, qword [r11 + 0x3078]
test r10, r10
lea rcx, [r10 + 4]
cmovne r9, rcx
test r9, r9
je 0x1400181ae
cmp dword [r9], eax
je 0x1400181b7
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3070]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140018185
mov rcx, rbx
pop rbx
jmp fcn.140018020
test r9, r9
je 0x1400181ae
mov rax, r9
pop rbx
ret
Function at 0x14001b8b0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001baeb
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14008a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140078200]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001bab3
mov rcx, rbp
call fcn.14001aef0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001b981
movsxd rdx, dword [rbp + 0x3010]
mov r8, qword [rbp + 0x3018]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001b971
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001b969
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001b96c
mov rdx, rcx
test rdx, rdx
jne 0x14001b940
cmp r8, r10
je 0x14001b981
cmp dword [r8], r9d
jne 0x14001b981
mov rcx, qword [r8 + 8]
jmp 0x14001b983
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb0]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb0], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001ba17
cmp qword [rcx + 0x18], 0
jne 0x14001ba0c
mov qword [rcx + 0x18], rbx
jmp 0x14001ba17
cmp qword [rcx + 0x20], 0
jne 0x14001ba17
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xa8], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001ba4c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001ba40
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140004200
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001baa8
cmp r9b, 0x23
jne 0x14001ba8b
cmp byte [r8], r9b
jne 0x14001ba8b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001ba78
not ecx
call fcn.14000b9a0
mov qword [rbx + 0x78], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001b900
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400735e0
add rsp, 0x58
pop rsi
pop rbp
ret