joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010db0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x110]
lea r9, [0x1400b4360]
mov r8, rdx
movsxd rdx, dword [rcx + 0x108]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
xor ebx, dword [r9 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr rax, 0x10
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, qword [0x1400df098]
xor ebx, dword [r9 + rcx*4]
not ebx
cmp dword [rax + 0x4034], ebx
jne 0x140010e9a
mov dword [rax + 0x4038], ebx
cmp dword [rax + 0x4080], ebx
jne 0x140010ea9
mov byte [rax + 0x4084], 1
cmp dword [rax + 0x401c], ebx
jne 0x140010ebd
mov edx, 0xc
mov ecx, ebx
call fcn.14003af80
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140010ed0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
mov rax, qword [rcx + 0x110]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400b4360]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1400df098]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x4034], ebx
jne 0x140010f5d
mov dword [rax + 0x4038], ebx
cmp dword [rax + 0x4080], ebx
jne 0x140010f6c
mov byte [rax + 0x4084], 1
cmp dword [rax + 0x401c], ebx
jne 0x140010f83
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.14003af80
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140010f90
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x110]
lea r9, [0x1400b4360]
mov r8, rdx
movsxd rdx, dword [rcx + 0x108]
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, r8
shr rax, 8
movzx edx, al
mov rax, r8
xor ebx, dword [r9 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr rax, 0x10
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
xor ebx, dword [r9 + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r9 + rcx*4]
mov rcx, qword [0x1400df098]
not ebx
cmp dword [rcx + 0x401c], ebx
jne 0x140011080
mov edx, 0xc
mov ecx, ebx
call fcn.14003af80
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140011090
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0x128]
lea r8, [0x1400b4360]
movss xmm3, dword [rcx + 0x12c]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0x110]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0x108]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
movss dword [rsp + 4], xmm1
subss xmm0, xmm2
movss xmm1, dword [rdx + 0xc]
mov edx, dword [rax + rcx*4 - 4]
subss xmm1, xmm3
movzx eax, byte [rsp]
not edx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 1]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 2]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 3]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 4]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 5]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 6]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 7]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 8]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 9]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xb]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xc]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xd]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xe]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xf]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1400df098]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x4034], edx
jne 0x14001122f
mov dword [rax + 0x4038], edx
cmp dword [rax + 0x4080], edx
jne 0x14001123e
mov byte [rax + 0x4084], 1
mov eax, edx
add rsp, 0x18
ret
Function at 0x14001e290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1400df098]
lea r10, [0x1400b4360]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3fe0]
add rbx, 0x108
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x401c], edi
jne 0x14001e335
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.14003af80
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x14001e369
inc r8d
test ecx, ecx
je 0x14001e352
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001e357
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14003cd50
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400205e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400df098]
mov edi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x140020641
cmp byte [rbx + 0x43fe], 0
jne 0x140020641
movsx r9d, word [rbx + 0x54de]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000c120
test dil, 1
je 0x140020769
jmp 0x1400206d1
movss xmm1, dword [rbx + 0x39c0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x54de]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400cbe64]
mulss xmm1, dword [0x1400cbe44]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd9c]
addss xmm1, dword [rbx + 0xda0]
mov qword [rbx + 0x410c], rax
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4104], xmm0
mov byte [rbx + 0x412c], 1
movss dword [rbx + 0x4108], xmm1
movss xmm0, dword [rbx + 0x3a1c]
mulss xmm0, dword [0x1400cbd3c]
or dword [rbx + 0x40f0], 0x41
movss dword [rbx + 0x4150], xmm0
call fcn.14000c120
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140020721
lea r11, [0x1400b4360]
cmp r9b, 0x23
jne 0x140020704
cmp byte [r8], r9b
jne 0x140020704
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400206f1
not ecx
call fcn.1400176b0
test rax, rax
je 0x140020769
cmp byte [rax + 0xcb], 0
je 0x140020769
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, 0x10
movsx r9d, word [rbx + 0x54de]
call fcn.14000c120
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14001a400
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400afe50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140025bf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdx, qword [0x1400df098]
xor r15d, r15d
mov ebp, ecx
mov rbx, rdx
mov r14d, r15d
mov rsi, qword [rdx + 0x3fe0]
test cl, 0x10
jne 0x140025d9b
mov edi, dword [rdx + 0x40b0]
test edi, edi
je 0x140025c70
cmp dword [rdx + 0x4034], edi
jne 0x140025d94
mov eax, dword [rdx + 0x407c]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdx + 0xda4], r14b
je 0x140025d94
cmp byte [rsi + 0xd0], r14b
jne 0x140025d94
jmp 0x140025d12
cmp byte [rdx + 0xda4], r14b
je 0x140025d94
cmp byte [rsi + 0xd0], r14b
jne 0x140025d94
test byte [rdx + 0x40b8], 1
jne 0x140025cad
cmp dword [rdx + 0x4034], r14d
je 0x140025d94
cmp qword [rdx + 0x4070], rsi
jne 0x140025d94
test bpl, 8
je 0x140025d94
add rdx, 0x40bc
mov rcx, rsi
call fcn.140011090
mov edx, eax
mov dword [rbx + 0x40b0], eax
lea rcx, [rbx + 0x40bc]
mov edi, eax
call fcn.140011520
movzx r14d, al
test al, al
je 0x140025cff
cmp byte [rbx + 0x36c0], r15b
je 0x140025cff
mov rdx, rsi
mov ecx, edi
call fcn.140011250
mov rcx, rsi
call fcn.14001d4e0
cmp dword [rbx + 0x4034], edi
jne 0x140025d94
mov rdx, qword [0x1400df098]
mov byte [rbx + 0x4041], r14b
mov rax, qword [rsi + 0x110]
movsxd rcx, dword [rsi + 0x108]
mov r14d, dword [rax + rcx*4 - 4]
movsxd rax, r15d
cmp byte [rax + rdx + 0xda4], 0
jne 0x140025d3d
xor cl, cl
jmp 0x140025d55
movss xmm1, dword [rdx + 0x38]
movss xmm0, dword [rdx + rax*4 + 0x3740]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae cl
movdqa xmm0, xmmword [0x1400cc220]
mov qword [rdx + 0x4048], 0xffffffffffffffff
movups xmmword [rdx + 0x4050], xmm0
movd dword [rdx + 0x4060], xmm0
cmp byte [rdx + 0x42ad], 0
mov word [rdx + 0x42c4], 0
setne al
mov byte [rdx + 0x42ac], al
test cl, cl
jne 0x140025de8
xor al, al
jmp 0x140025e86
mov r9d, 0xffffffff
lea rdx, [0x1400b9419]
mov edi, r9d
lea r10, [0x1400b4360]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140025dc8
cmp byte [rdx], r8b
jne 0x140025dc8
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140025db5
not edi
cmp byte [rbx + 0x43fc], 0
jne 0x140025e26
call fcn.140025b30
mov dword [rbx + 0x441c], edi
mov dword [rbx + 0x4420], r14d
mov byte [rbx + 0x43fc], 1
mov dword [rbx + 0x4400], ebp
mov dword [rbx + 0x4408], r15d
cmp edi, dword [rbx + 0x4034]
jne 0x140025e26
mov byte [rbx + 0x4042], 1
mov eax, dword [rbx + 0x3f60]
mov dword [rbx + 0x4404], eax
mov byte [rbx + 0x43fd], 1
test bpl, 1
jne 0x140025e77
xor ecx, ecx
call fcn.1400205e0
cmp dword [rbx + 0x4470], 0
je 0x140025e77
test dword [rbx + 0x4464], 0x1000
je 0x140025e77
mov rax, qword [rbx + 0x3fe0]
mov byte [rax + 0xd0], 1
mov byte [rax + 0xd2], 1
mov byte [rax + 0xec], 1
test bpl, 0x12
jne 0x140025e84
and dword [rbx + 0x40b8], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400262b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x55d0], 0
lea rbx, [rcx + 0x55d8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140026357
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002630a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14003cae0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000d0e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x55d0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x55e0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400df090]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002635f
mov rcx, rbx
call fcn.14000d0e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140026a90
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140026ae2
lea r11, [0x1400b4360]
cmp r9b, 0x23
jne 0x140026ac5
cmp byte [r8], r9b
jne 0x140026ac5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140026ab2
mov r11, qword [0x1400df098]
mov r10, qword [r11 + 0x5598]
test r10, r10
je 0x140026b29
lea r9, [r10 + 4]
test r9, r9
je 0x140026b29
not eax
cmp dword [r9], eax
je 0x140026b32
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x5590]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140026b00
mov rcx, rbx
pop rbx
jmp fcn.1400269a0
mov rax, r9
pop rbx
ret
Function at 0x1400322f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x14003233d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x140032342
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14003236d
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14003236d
mov rax, qword [rax + 0x388]
test rax, rax
je 0x14003236d
mov eax, dword [rax + 8]
mov dword [rsp + 0x28], eax
jmp 0x140032372
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14003238c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x140032391
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x140032413
inc ecx
test r8d, r8d
je 0x1400323fe
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140032403
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.14003c630
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
inc edi
test rdx, rdx
je 0x140032453
mov r8d, edi
mov rcx, rbp
call fcn.1400322f0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x140032320
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x140084960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x190]
mov r10, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x14008499c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0x118]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0x130], xmm0
subss xmm0, dword [r9 + 0x48]
movss dword [r9 + 0x11c], xmm1
subss xmm0, dword [r9 + 0x158]
movss dword [r9 + 0x15c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x150], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x16c], eax
movss dword [r9 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1d4], eax
cmp byte [rbx + 0x5a], 0
jne 0x140084a37
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0x11c], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0xd0], al
cmp byte [rbx + 0x60], 0
je 0x140084a5d
mov rax, qword [0x1400df098]
xor ecx, ecx
mov dword [rax + 0x40b0], ecx
mov dword [rax + 0x40b8], ecx
test dword [r10 + 4], 0x100000
je 0x140084a72
mov r8d, 2
jmp 0x140084af2
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2b8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2b8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x2b8]
mov rcx, qword [r10 + 0x1a8]
call fcn.140076890
mov rdi, qword [0x1400df098]
cmp byte [rdi + 0x55c4], 0
je 0x140084b37
cmp byte [rbx + 0x60], 0
jne 0x140084b37
xor r8d, r8d
lea rdx, [0x1400cb150]
mov rcx, rsi
call fcn.1400263c0
mov dword [rdi + 0x55f8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140086fb0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1400df098]
mov rdx, qword [rax + 0x44b8]
cmp ecx, 0xffffffff
jne 0x140086fca
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x140087049
mov r10d, dword [rdx]
lea r8, [0x1400cb141]
movzx eax, word [rdx + 0x80]
lea r11, [0x1400b4360]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x140087023
cmp byte [r8], r9b
jne 0x140087023
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140087010
not ecx
xor edx, edx
jmp fcn.140020830
ret
Function at 0x1400a7990
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov r11, qword [0x1400df098]
mov r8, rcx
mov rbx, qword [r11 + 0x4520]
test rbx, rbx
je 0x1400a7a1e
test dword [rbx + 0x10], 0x100000
jne 0x1400a7a1e
mov rdx, rcx
mov rcx, qword [r11 + 0x3fe0]
call fcn.140010d30
test eax, eax
je 0x1400a7aca
movsxd rcx, dword [rbx]
xor r8d, r8d
test ecx, ecx
jle 0x1400a7aca
mov r10, qword [rbx + 8]
mov r9, rcx
mov rcx, r10
mov edx, r8d
cmp dword [rcx], eax
je 0x1400a7a00
inc r8d
inc rdx
add rcx, 0x30
cmp rdx, r9
jl 0x1400a79e7
add rsp, 0x20
pop rbx
ret
movsxd rax, r8d
lea rcx, [rax + rax*2]
shl rcx, 4
add rcx, r10
je 0x1400a7aca
mov byte [rcx + 0x2c], 1
add rsp, 0x20
pop rbx
ret
movzx r9d, byte [r8]
mov r10d, 0xffffffff
inc r8
mov ecx, r10d
test r9b, r9b
je 0x1400a7a6f
lea rbx, [0x1400b4360]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400a7a53
cmp byte [r8], r9b
jne 0x1400a7a53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400a7a40
not ecx
call fcn.1400176b0
mov rbx, rax
test rax, rax
je 0x1400a7aca
test byte [rax + 0x3f9], 1
je 0x1400a7aca
mov rcx, qword [rax + 0x418]
test rcx, rcx
je 0x1400a7aca
mov edx, dword [rax + 0x90]
cmp dword [r11 + 0x4034], edx
jne 0x1400a7aa9
mov dword [r11 + 0x4038], edx
cmp dword [r11 + 0x4080], edx
jne 0x1400a7aba
mov byte [r11 + 0x4084], 1
mov rcx, qword [rcx + 0x40]
call fcn.1400a6050
or byte [rbx + 0x3f9], 8
add rsp, 0x20
pop rbx
ret
Function at 0x1400af410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400da010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x1400af456
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x1400af446
cmp byte [rax], cl
jne 0x1400af456
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x1400af437
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400af5ba
cmp byte [r8 + 1], dl
je 0x1400af5ba
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400af492
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400af4ba
sub dl, 0x61
cmp dl, 0x19
ja 0x1400af4ac
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400af4ba
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400af475
jmp 0x1400af4bd
inc r9
cmp r8, r9
jae 0x1400af4ef
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400af4e4
bt rdx, rax
jb 0x1400af4ea
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400af4d0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14000c120
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x1400af528
nop
inc rcx
cmp byte [rcx], 0x20
je 0x1400af520
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400af5a8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x1400af543
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x1400af559
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x1400af596
movss xmm2, dword [0x1400cbe4c]
cmp al, 0x39
ja 0x1400af596
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x1400af570
cmp r9b, 0x2d
jne 0x1400af5b5
xorps xmm1, xmmword [0x1400cc1f0]
movaps xmm0, xmm1
jmp 0x1400af5bd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400af5bd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400afe50
add rsp, 0x90
pop rbx
ret