joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007da90
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1c0]
add rdx, 0x628
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x14007dae8
cmp qword [rdx + 0xb8], 0
je 0x14007dae8
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8, str.REST__d
call fcn.14009b090
mov edi, eax
test eax, eax
jne 0x14007dadd
mov dl, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.14007bde0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.14007d630

Function at 0x14007dfb0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x14007dff2
lea rdx, str.Couldnt_set_desired_mode
call fcn.1400552b0
mov eax, reloc.WS2_32.dll_recvfrom
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp edx, 0xc8
je 0x14007e009
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.1400553a0
cmp sil, 0x13
jne 0x14007e026
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.14007dcc0
cmp sil, 0x14
jne 0x14007e16a
cmp byte [rbx + 0x6f8], 2
mov qword [rsp + 0x58], r14
mov r14, qword [rbx + 0x20]
jne 0x14007e0ad
mov rax, qword [rbx + 0x1c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x14007e0ad
xor r9d, r9d
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.14005c030
mov esi, eax
test eax, eax
jne 0x14007e156
mov rcx, qword [rsp + 0x50]
mov edx, Ordinal_50
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x14007e0a2
mov rdi, qword [rsp + 0x50]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], sil
jmp 0x14007e0ad
mov rcx, qword [rsp + 0x50]
call qword [case.0x140048565.0]
mov rdx, qword [rbx + 0x800]
test rdx, rdx
jne 0x14007e0d2
cmp byte [rbx + 0x1299], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x1400b368f]
test rdi, rdi
mov r9, r8
lea rax, [0x1400b9200]
cmovne r9, rdi
lea rcx, [0x1400a4a14]
cmovne r8, rax
call fcn.14005d880
mov rcx, rdi
mov rbp, rax
call qword [case.0x140048565.0]
test rbp, rbp
jne 0x14007e124
mov r14, qword [rsp + 0x58]
mov esi, reloc.WLDAP32.dll_Ordinal_27
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, [r14 + 0x628]
mov r9, rbp
lea r8, [0x1400b37f4]
mov rcx, rbx
call fcn.14009b090
mov rcx, rbp
mov esi, eax
call qword [case.0x140048565.0]
test esi, esi
jne 0x14007e156
mov dl, Ordinal_32
mov rcx, rbx
call fcn.14007bde0
mov r14, qword [rsp + 0x58]
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp sil, 0x15
jne 0x14007e175
mov r8b, reloc.WS2_32.dll_listen
jmp 0x14007e17e
cmp sil, 0x16
jne 0x14007e18a
mov r8b, recv
mov dl, 1
mov rcx, rbx
call fcn.14007d7f0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140089b90
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x1400f5cd0]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x140089bf8
mov r9d, 2
mov dword [rsp + 0x20], 3
xor r8d, r8d
xor edx, edx
mov ecx, 6
call fcn.140091a50
test al, al
je 0x140089bec
mov dword [0x1400f5cd0], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x1400f5cd0], 1
jmp 0x140089bfd
cmp eax, 2
je 0x140089c4f
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x140089c2e
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x140089c4f
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret

Function at 0x14008a7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x1400ca7c0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, qword [rcx]
mov rsi, r9
mov rdi, rcx
mov rbp, r8
mov r14, qword [rax + 0x10]
mov dword [r9], 0
xor r9d, r9d
mov rcx, qword [r14 + 0x98]
call qword [sym.imp.WS2_32.dll_recv]
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
jne 0x14008a883
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14008a847
mov dword [rsi], 0x51
jmp 0x14008a87c
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.140069830
mov rcx, qword [rdi + 8]
lea rdx, str.Recv_failure:__s
mov r8, rax
call fcn.1400552b0
mov rax, qword [rdi + 8]
mov dword [rax + 0xc8c], ebx
mov dword [rsi], gethostname
mov rbx, 0xffffffffffffffff
mov edx, dword [rsi]
lea r8, str.nw_in_read_len_zu__fd_qd______d__err_d
mov rcx, qword [rdi + 8]
mov r9, rbp
mov dword [rsp + 0x30], edx
mov rdx, qword [r14 + 0x98]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi]
call fcn.1400553f0
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14009f040
add rsp, 0x150
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14008a8d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x1c0
mov rax, qword [0x1400ca7c0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
mov r9, qword [rbx + 0x98]
cmp r9, 0xffffffffffffffff
je 0x14008aa1e
mov rax, qword [rdx + 0x20]
mov rcx, qword [rax + 0x360]
test dword [rcx + 0x8c], 0x800
jne 0x14008aa1e
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
lea r8, [rsp + 0x20]
mov rcx, r9
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x14008a9ae
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.140069830
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, rsi
call fcn.1400552b0
mov eax, 2
jmp 0x14008aa20
mov edx, dword [rsp + 0x20]
lea r9, [rbx + 0x140]
lea r8, [rbx + 0x10e]
lea rcx, [rsp + 0x30]
call fcn.140057a80
test al, al
jne 0x14008aa1e
mov qword [rsp + 0x1e0], rdi
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov ebx, dword [rax]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.140069830
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1400552b0
mov rdi, qword [rsp + 0x1e0]
mov eax, 2
jmp 0x14008aa20
xor eax, eax
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14009f040
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1c0
pop rsi
ret
Function at 0x14009c720
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x14009c75b
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14009c759
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009dc90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x14009dcd3
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x14009dd20
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x14009dd82
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x14009dd40
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x14009ddc1
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1400b33d9]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400b33da]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x14009dd90
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x14009dfb0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ca7c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbp, r8
mov dword [rsp + 0x20], 0xf0000040
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
mov r9d, Ordinal_26
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14009dffc
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x14009e0cf
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14009e040
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov qword [rsp + 0x38], 0
jmp 0x14009e0cf
mov rcx, rbp
call fcn.1400590b0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov edx, 2
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x20
jne 0x14009e0ab
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rdi
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009e0bb
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009e0cd
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009f040
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x14009ee90
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x14009eef5
nop dword [rax + rax]
movzx r8d, byte [r10]
lea r10, [r10 + 1]
movzx eax, r8b
movzx r9d, r8b
shr r9b, 1
and al, 0xfe
not r9b
movzx eax, al
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
shr r9b, 1
xor r9b, r8b
or r8b, 1
test r9b, 2
movzx ecx, r8b
cmove ecx, eax
mov byte [r10 - 1], cl
sub rdx, 1
jne 0x14009eea0
ret
Function at 0x14009ef00
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400ca7c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14009ef83
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x14009efa5
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009f040
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.1400590b0
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x14009f004
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14009f014
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14009f026
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x14009ef88

Function at 0x14009fe64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14009feae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14009feae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14009feae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14009feae
cmp dword [rcx + 0x84], 0xe
jbe 0x14009feae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14009feb0
xor al, al
add rsp, 0x28
ret
Function at 0x180009df0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1801443c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm6, xmm6
mov rbp, rdx
cvtss2sd xmm6, xmm2
mov rsi, rcx
mov rdi, r9
lea rcx, [0x18012a098]
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.180009bc0
movsxd rbx, eax
lea rcx, [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call fcn.180011f30
cmp qword [rsp + 0x50], 0xf
lea rcx, [rsp + 0x38]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmova rcx, qword [rsp + 0x38]
lea r8, [0x18012a098]
movq r9, xmm6
call fcn.180009b60
cmp qword [rsp + 0x50], 0xf
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x58]
cmova r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x38]
call fcn.180012210
lea rcx, [rsp + 0x58]
call fcn.1800ab974
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18009aae0
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180016410
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180016432
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1800164ac
mov rdi, r14
mov rcx, rbx
call fcn.180017650
test rax, rax
jle 0x180016484
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1800ce3a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001649c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800164a4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180016446
sub r14, rdi
jmp 0x18001658f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800164c3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800164c5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800164f7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800ce3a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001658c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180016532
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18001656d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800ad2fc
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18001658c
cmp rbp, rax
ja 0x180016540
test rbp, rbp
je 0x18001658c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800ad2fc
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x18001a840
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001a89d
lea rbx, [0x1800e0040]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001a884
cmp r10, 2
jb 0x18001a884
cmp byte [r9], r8b
jne 0x18001a884
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001a860
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001a8df
lea rbx, [0x1800e0040]
cmp r8b, 0x23
jne 0x18001a8c3
cmp byte [r9], r8b
jne 0x18001a8c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001a8b0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18001aa20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001aa3a
mov qword [r8], 0
lea rdx, [0x18012a450]
call fcn.18001a8f0
mov rbx, rax
test rax, rax
jne 0x18001aa5a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800add90
mov esi, eax
cmp eax, 0xffffffff
je 0x18001ab28
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1800ad6cc
test eax, eax
jne 0x18001ab28
mov rcx, rbx
call fcn.1800add90
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001ab28
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800ad6cc
test eax, eax
jne 0x18001ab28
cmp rdi, 0xffffffffffffffff
je 0x18001ab28
mov rax, qword [0x1801478b0]
test rax, rax
je 0x18001aaca
inc dword [rax + 0x3b4]
mov rcx, rdi
call fcn.1800b0c88
mov rsi, rax
test rax, rax
je 0x18001ab28
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800ad2fc
mov rcx, rbx
cmp rax, rdi
je 0x18001ab16
call fcn.1800ac3f8
mov rax, qword [0x1801478b0]
test rax, rax
je 0x18001ab0c
dec dword [rax + 0x3b4]
mov rcx, rsi
call fcn.1800aced8
jmp 0x18001ab30
call fcn.1800ac3f8
test r14, r14
je 0x18001ab23
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001ab32
mov rcx, rbx
call fcn.1800ac3f8
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800272a0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801478b0]
lea rdx, [0x1800e0040]
mov r8, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x1800273a1
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18002738d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180027392
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18002f410
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1800273c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801478b0]
lea rdx, [0x1800e0040]
mov r8d, ecx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180027477
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180027463
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180027468
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18002f410
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180028440
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1801443c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1801478b0]
mov edi, edx
cmp byte [rbx + 0x1e25], 0
jne 0x1800284a0
cmp byte [rbx + 0x1e26], 0
jne 0x1800284a0
mov r9d, dword [rbx + 0x2ec8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.18001a7c0
test dil, 1
je 0x1800285be
jmp 0x180028528
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2ec8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1801304e0]
mulss xmm1, dword [0x1801304cc]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x1801303a8]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
call fcn.18001a7c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180028578
lea r11, [0x1800e0040]
cmp r9b, 0x23
jne 0x18002855b
cmp byte [r8], r9b
jne 0x18002855b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028548
not ecx
call fcn.180021c10
test rax, rax
je 0x1800285be
cmp byte [rax + 0x8e], 0
je 0x1800285be
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ec8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ec8]
call fcn.18001a7c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.180024310
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009aae0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret