joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801584aa
Capabilities:
Authenticate hmac

Disassembly:
call fcn.1800e1b88
jae 0x18014b6a1
and eax, 0x1990c18e
lodsd eax, dword [rsi]
std
invalid

Function at 0x180177956
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jle 0x180001297
mov word [rsp + 0x38], 0x70e
jo 0x1801e89b0
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x40]
ret 8
movabs r11, 0x5dfc5edb67561991
push rbx
js 0x18018376b
lea rbx, [rbx + 1]
mov rbp, r11
call fcn.1801fd978
cli
iretd
lea rcx, [rcx + rcx*4 + 0x1d960298]
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsp + 8]
and word [rsp + 0x38], 0xda1
ja 0x180153fb9

Function at 0x180179220
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + rbx*8 + 0x40], rsi
mov rbx, qword [rsp + rbx*4 + 4]
cmove r8d, dword [rsp + r8*8 + 0x3c]
or dword [rsp + r8*4 + 0x40], r8d
add qword [rsp + 0x38], 0x6d498
mov rbx, r8
movabs rsi, 0x4b100aa50b97f49
add qword [rsp + r8 + 0x18], 0x7feb3ccb
or byte [rsp + rbx*4 + 0x40], 0x65
test dword [rsp + 0x43], r8d
setae bl
shr bl, 0x79
xor sil, r8b
setl r8b
mov rsi, qword [rsp + 0x38]
mov rsi, qword [rsi + r8]
and dword [rsp + r8 + 0x40], 0x1351eb6
movsxd rbx, r8d
jbe 0x1801da472
mov qword [rsp + r8*2 + 0x38], r8
lea rsi, [rsi + rbx*8 + 0x51d41209]
jb 0x18000a092
and byte [rsp + rbx*4 + 0x38], 0x32
setno bl
and byte [rsp + rbx*8 + 0x38], 0x77
ja 0x18015a726

Function at 0x18017d775
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp + 0x38], 0xffffffffffe6d5f1
push rdi
call fcn.18015578d
jae 0x180019cf3
sti
mov bh, bh
mov bh, 0x5f
mov ds, word [rcx]
jo 0x18017d7b9
sbb ah, byte [rsi]
and esp, ebx
invalid
test dword [rdi - 0x3ecdb128], ecx
sbb al, 0x9e
mov edi, 0xfef61790
invalid

Function at 0x1801afc71
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0x2ffcc5ca
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.18026abfb
add al, byte [rcx - 0x614bae73]
mov ah, 0xf3
jrcxz 0x1801afcc1
invalid
lahf
push rbp
invalid

Function at 0x1801b9197
Capabilities:
Authenticate hmac

Disassembly:
jns 0x18000fc76
mov dh, 0x56
sahf
wait
clc
cld
push rsi
fnsave dword [0x1ba423d12]
retf 0x48dd

Function at 0x1801d5e34
Capabilities:
Authenticate hmac

Disassembly:
or r8w, 0x74d3
xchg qword [rsp + rdx*2 - 0xd42802], rbp
mov rdx, qword [rsp + r8*4 - 0x3df7c]
shl rdi, 0x3e
call fcn.180008cd5
add qword [rsp + 8], 0x7fef5695
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.180206a27
mov qword [rsp + 0x38], r11
push rcx
lea rsi, [rsi + 0x76714890]
js 0x18000fc57
je fcn.180174cfd
seta byte [rsp + 0x40]
not edx
xor edx, 0x593c3eb5
mov rcx, qword [rsp + 0x30]
xchg qword [rsp + 0x50], rsi
mov rcx, qword [rsp]
cmp r14b, dl
mov dword [rsp + 0x30], r11d
lea r11, [rdx + rdx*4 + 0x3a644876]
sets r14b
mov r11w, 0x1fab
Function at 0x140003204
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000324e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000324e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000324e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000324e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000324e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003250
xor al, al
add rsp, 0x28
ret
Function at 0x140031c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rcx, [r10 + rdx*2 - 0x2f50a2cb]
movzx rdx, cx
push rcx
test r10d, 0xdca0fe06
nop
push rbx
ja 0x1401862ff
int3
add qword [rsp + r9*2 + 0x38], 0xffffffffffe85fd0
movabs r10, 0xfe35bdb9801aa7ba
mov rcx, r9
neg r9w
mov qword [rsp + 0x48], rax
push rdx
bswap r9d
mov rdx, rcx
jae 0x140031c60
Function at 0x140088ba1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx + rbx - 0x16d3c]
mov qword [rsp + 8], rsi
mov qword [rsp + rbx - 0x16d1c], rbx
sub esi, 0x96a8cba4
js 0x14014fab7
call fcn.14015d0b1
call fcn.140198ca5
int3
add r12, r12
jno 0x140172aa4
add qword [rsp], 0xfffffffffff006e8
add qword [rsp + 0x20], 0x36a376ae
shl qword [rsp + 0x20], 0xcd
jae 0x1400dd454
mov rcx, qword [rsp + 0x20]
jbe 0x140088593
neg r14
ja 0x14000ec39
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], r15
call fcn.1401027eb
loope 0x1400145d8
xor eax, dword [rcx]
invalid
mov rcx, qword [rsp]
mov rcx, qword [rcx]
jns fcn.140090130
call fcn.14001dbb4
jo 0x14009c7ee
lea rcx, [rcx*4 - 0x38fc4367]
mov rcx, qword [rsp + 0x28]
call fcn.1400137f5
mov rbp, rcx
call fcn.14001d710
cmp dword [rsp + 8], ebx
setle byte [rsp + 8]
test qword [rsp + 8], rbx
not qword [rsp + 8]
mov rbx, qword [rsp + 0x28]
ja 0x140187df2
mov qword [rsp + 0x10], 0xffffffffc7a19f84
jl 0x140014616
xor byte [rsp + 0x10], 8
call fcn.140129f45
pushfq
lodsd eax, dword [rsi]
push rax
or ah, 0x95
sub al, bl
invalid
add dword [rsp], 0xfffc4e53
cmp dword [rsp + 8], 0xc9ab8d8e
jg 0x1400fbd5f
mov rdi, qword [rsp + 8]
call fcn.1400b998a
add qword [rsp + 8], 0x47dee
shr r15d, cl
xor cx, cx
movsx r15d, cx
je 0x14008f554
xchg esp, eax
sti
and edx, ebp
test al, 0x24
jle 0x1400c8c0f
sar ah, 1
mov eax, ebp
adc al, 0xf7
cmp eax, 0x45e7c3bf
imul eax, dword [rdi + riz*2], 0xffffffe1
add al, dl
js 0x1400c8b6c
retf 0x6a70
rcl byte [rdx + rax*8], 2
mov dh, 0x55
push rax
leave
and edx, 0x2cee0d6c
and dword [rbx + 0x59], edx
invalid
call fcn.140017670
je 0x140165aff
push qword [rsp]
popfq
lea rsp, [rsp + 8]
ret
mov r10, qword [rsp + 0x38]
jg 0x14017b47c
mov r13, rax
cmp r15, 0xffffffffe5933920
jns 0x14000f8c9
lea r13, [rax + r13 + 0x5b3db697]
call fcn.140017270
shl qword [rsp + 0x20], 0xde
not qword [rsp + r12 - 0x14f1fa5b]
not byte [rsp + r12*4 - 0x53c7e9cc]
xchg qword [rsp + 0x50], rax
mov r12, qword [rsp + r12 - 0x14f1fa73]
movsx r14w, r14b
sub word [rsp + 0x20], 0xdb3a
and al, 0x20
cmp bl, bl
js 0x140010139
shl word [rsp + 0x20], 8
mov rsi, qword [rsp + 0x10]
and dword [rsp + 0x20], 0x4d31b406
not r14b
call fcn.1400aefd4
call fcn.1401949b7
adc ebx, edi
jns 0x140172b84
cmpsd dword [rsi], dword [rdi]
xchg edx, eax
sub bh, byte [rdx]
call 0x1a3e2f962
stosd dword [rdi], eax
jno 0x140172b6c
xchg edi, eax
push 0xffffffffffffffea
mov esi, 0xbe67fd0
sti
xchg ebx, eax
sub esi, esp
pop rdi
idiv byte [rdx - 0x7f07d74e]
push rsi
loopne 0x140172aec
invalid
xchg edi, eax
or esi, dword [rcx]
sub dword [rbx], edi
xor esp, dword [rbp + 0x61]
mov ecx, 0x35e70f1a
invalid
add al, al
std
ja 0x140172b2e
rol dword [rbx], 0x5e
ret
sub dword [rsp + 0x58], 0xe434fe38
neg byte [rsp + 0x58]
neg dl
jo 0x1400c8ba2
call fcn.1400dd535
call fcn.140193c90

Function at 0x1400b1866
Capabilities:
Check for software breakpoints

Disassembly:
push rsi
lea rcx, [rcx + 0x42ab3838]
js 0x1400a228b

Function at 0x1400d6d58
Capabilities:
Check for software breakpoints

Disassembly:
movabs rsi, 0x5fbd76a4ce34a427
shr si, 0x8e
add qword [rsp + 0x18], 0xd8926
Function at 0x14014724d
Capabilities:
Encode data using xor

Disassembly:
push r8
movzx rdi, byte [rsp + 0x10]
mov r8, rdx
lea rdi, [rdx + rdx*8 + 0x3104951b]
js 0x1400c8fe3
add qword [rsp + 8], 0xfffffffffffe95c8
lea rdx, [rdx + rdi*4 + 0x47270582]
lea rdi, [rdx + r8*4 - 0x7bd48dc1]
call fcn.1400cfc56

Function at 0x1404d9cb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
movsxd rbx, r12d
rol r10w, cl
btc r11w, r14w
sub edi, edi
movzx ebx, r8b
movzx r11, r11w
cmovns r10w, r14w
mov r11, rcx
movsxd r8, r15d
mov r8, rdi
nop
movzx r9d, byte [r11]
movsx r10d, di
jmp 0x1404d9cec
movzx r10d, byte [rdx]
jmp 0x1404d9cf5
inc r11
jmp 0x1404d9cfd
inc rdx
cmp r9b, spl
clc
test bl, bl
jmp 0x1404d9d0b
je 0x1404d9d38
mov ecx, r8d
not al
mov eax, 0x97348900
rol eax, cl
add al, r8b
cmp r13b, 0xbd
jmp 0x1404d9d29
xor r9b, al
jmp 0x1404d9d31
inc r8
clc
test r12b, r15b
test r9b, r9b
je 0x1404d9d4f
cmp r9b, r10b
jmp 0x1404d9d49
je 0x1404d9cdf
cmp r9b, r10b
jae 0x1404d9d81
or eax, 0xffffffff
bswap rbx
movsx bx, dl
movsx rbx, ax
mov rbx, qword [rsp + 8]
movzx rdi, r10w
movsxd rdi, eax
setae dil
mov rdi, qword [rsp + 0x10]
jmp 0x1404d9d80
ret
mov rbx, qword [rsp + 8]
seta dil
cwde
cdqe
mov eax, edi
mov rdi, qword [rsp + 0x10]
jmp 0x1404d9d99
ret
Function at 0x140002830
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000288d
lea rbx, [0x1400f3110]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002874
cmp r10, 2
jb 0x140002874
cmp byte [r9], r8b
jne 0x140002874
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002850
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400028cf
lea rbx, [0x1400f3110]
cmp r8b, 0x23
jne 0x1400028b3
cmp byte [r9], r8b
jne 0x1400028b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400028a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002a10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002a2a
mov qword [r8], 0
lea rdx, [0x1400f2aa4]
call fcn.1400028e0
mov rbx, rax
test rax, rax
jne 0x140002a4a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002b21
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002b21
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002b21
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002b21
cmp rdi, 0xffffffffffffffff
je 0x140002b21
mov rax, qword [0x140110630]
test rax, rax
je 0x140002abe
inc dword [rax + 0x3ac]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002b21
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002b0e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140110630]
test rax, rax
je 0x140002b03
dec dword [rax + 0x3ac]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002b2a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002b1c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002b2c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400055e0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
mov rax, qword [rcx + 0x108]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400f3110]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140110630]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x1d7c], ebx
jne 0x14000566d
mov dword [rax + 0x1d80], ebx
cmp dword [rax + 0x1db8], ebx
jne 0x14000567c
mov byte [rax + 0x1dbc], 1
cmp dword [rax + 0x1d64], ebx
jne 0x140005693
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140023760
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140011730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov r8, qword [0x140110630]
lea r10, [0x1400f3110]
movsxd r9, ecx
mov rdi, qword [r8 + 0x1d28]
movsxd rdx, dword [rdi + 0x100]
mov rax, qword [rdi + 0x108]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r10 + rdx*4]
not ebx
cmp dword [r8 + 0x1d64], ebx
jne 0x1400117d1
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140023760
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rcx, [rdi + 0x100]
call fcn.1400247f0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140012820
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14010f088]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140110630]
mov edi, edx
cmp byte [rbx + 0x212d], 0
jne 0x140012881
cmp byte [rbx + 0x212e], 0
jne 0x140012881
movsx r9d, word [rbx + 0x321e]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.1400027b0
test dil, 1
je 0x1400129a9
jmp 0x140012911
movss xmm1, dword [rbx + 0x1708]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x321e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400fc3e4]
mulss xmm1, dword [0x1400fc3d4]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1e44], rax
mov dword [rbx + 0x1e2c], 1
movss dword [rbx + 0x1e3c], xmm0
mov byte [rbx + 0x1e64], 1
movss dword [rbx + 0x1e40], xmm1
movss xmm0, dword [rbx + 0x1764]
mulss xmm0, dword [0x1400fc31c]
or dword [rbx + 0x1e28], 0x41
movss dword [rbx + 0x1e88], xmm0
call fcn.1400027b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140012961
lea r11, [0x1400f3110]
cmp r9b, 0x23
jne 0x140012944
cmp byte [r8], r9b
jne 0x140012944
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140012931
not ecx
call fcn.14000b1e0
test rax, rax
je 0x1400129a9
cmp byte [rax + 0xc7], 0
je 0x1400129a9
mov byte [rax + 0xce], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xe8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x321e]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x321e]
call fcn.1400027b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000de10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c3540
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140017d30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3308], 0
lea rbx, [rcx + 0x3310]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140017dd7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140017d8a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140024b10
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400031a0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3308]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3318]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140110628]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140017ddf
mov rcx, rbx
call fcn.1400031a0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140018220
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140018272
lea r11, [0x1400f3110]
cmp r9b, 0x23
jne 0x140018255
cmp byte [r8], r9b
jne 0x140018255
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018242
mov r11, qword [0x140110630]
mov r10, qword [r11 + 0x32d0]
test r10, r10
je 0x1400182b9
lea r9, [r10 + 4]
test r9, r9
je 0x1400182b9
not eax
cmp dword [r9], eax
je 0x1400182c2
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x32c8]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140018290
mov rcx, rbx
pop rbx
jmp fcn.140018130
mov rax, r9
pop rbx
ret
Function at 0x14001b9b0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001bbfe
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14010f088]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400f3110]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001bbc6
mov rcx, rbp
call fcn.14001b030
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001ba81
movsxd rdx, dword [rbp + 0x3268]
mov r8, qword [rbp + 0x3270]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001ba71
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001ba69
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001ba6c
mov rdx, rcx
test rdx, rdx
jne 0x14001ba40
cmp r8, r10
je 0x14001ba81
cmp dword [r8], r9d
jne 0x14001ba81
mov rcx, qword [r8 + 8]
jmp 0x14001ba83
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xbc]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xbc], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001bb17
cmp qword [rcx + 0x20], 0
jne 0x14001bb0c
mov qword [rcx + 0x20], rbx
jmp 0x14001bb17
cmp qword [rcx + 0x28], 0
jne 0x14001bb17
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xe]
mov dword [rbx + 0xb4], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 6]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001bb5c
nop word [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001bb50
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.1400027b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001bbb8
cmp r9b, 0x23
jne 0x14001bb9b
cmp byte [r8], r9b
jne 0x14001bb9b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001bb88
not ecx
call fcn.14000b1e0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001ba00
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3540
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14004ae10
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14010f088]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 1
call fcn.1400c3dfc
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140050db0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14004aeaa
cmp dword [rsp + 0x38], 0
jne 0x14004ae75
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14004ae98
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400c3540
add rsp, 0x68
ret
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14004aec0
Capabilities:
Create thread
Inject dll
Inject thread
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14010f088]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsxd rax, dword [0x14010f498]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.14004e090
lea rcx, str.appdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x14004af24
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14004e610
nop
mov r8d, reloc.WLDAP32.dll_Ordinal_27
lea rdx, str.LucaModzZThemeMain.Theme
lea rcx, [rsp + 0x48]
call fcn.14004c590
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x14004af60
mov rdi, qword [rax]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x14004afa0
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004af9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c3ae8
movdqa xmm0, xmmword [0x1400fc510]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x14004aff0
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
mov r9, rbx
nop dword [rax]
inc r9
cmp byte [rdi + r9], 0
jne 0x14004b020
inc r9
mov qword [rsp + 0x20], 0
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x1400f7548]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbp
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp byte [rdi + rbx], 0
jne 0x14004b0a0
lea r8, [rbx + 1]
mov r9d, 0x8000
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400c3540
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret