joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086cb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140086cf2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140086d39
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140086d92
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140086d50
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140086dd3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400a3402]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400a3403]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140086da0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140cdd088
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140cdd092
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140cdd0bb
pop rbp
sub rbp, 0x33
sub rbp, 0xcdd088
sub rsp, 0x20
jmp 0x140cdd0da
ret 0xfda0
mov rax, 0xcdd088
add rax, rbp
add rax, 0x84
mov rcx, 0x647
mov rdx, 0x1dc047fd
xor byte [rax], dl
inc rax
dec rcx
jne 0x140cdd0f9
jmp 0x140cdd110
mov ch, 0x74
adc al, 0x76
je 0x140cdd0d7
std
std
std
mov ch, 0x7c
cmp al, 0xf5
cld
std
std
mov ch, 0xfc
adc al, 0xb5
cmp bh, byte [0x13ecbcf1b]
mov ch, 0x3a
invalid
Function at 0x140003200
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004020
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004020
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140003270
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1400090a4]
mov rbx, rcx
test esi, esi
jle 0x1400033a0
mov rax, qword [0x1400090a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400032bb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003345
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400032a0
mov rcx, rbx
call fcn.140003cc0
mov rdi, rax
test rax, rax
je 0x1400033c2
mov rax, qword [0x1400090a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003e00
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1400090a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400033a7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000333e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003350
add dword [0x1400090a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1400090a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000333e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140003200
nop dword [rax]
xor esi, esi
jmp 0x1400032c8
mov rax, qword [0x1400090a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140003200
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140003200
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003930
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400090e0]
test rbx, rbx
je 0x14000398c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003983
test rsi, rsi
je 0x140003983
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003968
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003cc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140006950]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003ce0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003ce8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003ce0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003d3d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003d34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003ce0
add rax, 0x28
cmp rax, r9
jne 0x140003d20
xor eax, eax
ret

Function at 0x140003d40
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006950]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003d5f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003d68
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003d5f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003e00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006950]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003e1f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003e28
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x7ff8af2326b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.user32.dll_GetKeyState]
movsx ecx, ax
mov eax, 1
test ecx, 0x80000000
lea ecx, [rax + 0x10]
cmovne edi, eax
call qword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jns 0x7ff8af2326e7
or edi, 2
mov ecx, 0x12
call qword [sym.imp.user32.dll_GetKeyState]
test ax, ax
jns 0x7ff8af2326fa
or edi, 4
mov ecx, 0x5c
call qword [sym.imp.user32.dll_GetKeyState]
mov ecx, 0x5b
movsx ebx, ax
call qword [sym.imp.user32.dll_GetKeyState]
movsx ecx, ax
or ecx, ebx
jns 0x7ff8af23271d
or edi, 8
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff8af232730
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.user32.dll_GetAsyncKeyState]
movsx ecx, ax
mov eax, 1
test ecx, 0x80000000
lea ecx, [rax + 0x10]
cmovne edi, eax
call qword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jns 0x7ff8af232767
or edi, 2
mov ecx, 0x12
call qword [sym.imp.user32.dll_GetAsyncKeyState]
test ax, ax
jns 0x7ff8af23277a
or edi, 4
mov ecx, 0x5c
call qword [sym.imp.user32.dll_GetAsyncKeyState]
mov ecx, 0x5b
movsx ebx, ax
call qword [sym.imp.user32.dll_GetAsyncKeyState]
movsx ecx, ax
or ecx, ebx
jns 0x7ff8af23279d
or edi, 8
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff8af2343f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x7ff8af2b6430]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
je 0x7ff8af23448a
nop dword [rax + rax]
cmp dword [rsp + 0x38], 0x12
jne 0x7ff8af234455
mov rbx, qword [0x7ff8af2b7708]
test rbx, rbx
je 0x7ff8af23446b
mov rcx, rbx
call fcn.7ff8af231b40
mov rbx, qword [rbx]
test rbx, rbx
jne 0x7ff8af234443
jmp 0x7ff8af23446b
lea rcx, [rsp + 0x30]
call qword [sym.imp.user32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.user32.dll_DispatchMessageW]
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.user32.dll_PeekMessageW]
test eax, eax
jne 0x7ff8af234430
mov rdi, qword [0x7ff8af2b7710]
test rdi, rdi
je 0x7ff8af2345ad
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], rsi
call fcn.7ff8af232730
mov ecx, 0xa0
mov ebp, eax
call qword [sym.imp.user32.dll_GetAsyncKeyState]
mov ecx, 0xa1
movzx ebx, ax
shr ebx, 0xf
call qword [sym.imp.user32.dll_GetAsyncKeyState]
movzx esi, ax
shr esi, 0xf
test ebx, ebx
jne 0x7ff8af2344f7
cmp byte [rdi + 0x1e0], 1
jne 0x7ff8af2344f7
xor r9d, r9d
xor r8d, r8d
mov edx, 0x154
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call fcn.7ff8af231100
test esi, esi
mov rsi, qword [rsp + 0x98]
jne 0x7ff8af234523
cmp byte [rdi + 0x1e4], 1
jne 0x7ff8af234523
xor r9d, r9d
xor r8d, r8d
mov edx, 0x158
mov rcx, rdi
mov dword [rsp + 0x20], ebp
call fcn.7ff8af231100
cmp dword [rdi + 0x80], 0x34003
mov rbp, qword [rsp + 0x90]
jne 0x7ff8af2345ad
mov rcx, qword [rdi + 0x2c0]
lea rdx, [rsp + 0x60]
call qword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
cmp dword [rdi + 0x2e0], eax
jne 0x7ff8af234570
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
cmp dword [rdi + 0x2e4], eax
je 0x7ff8af2345ad
mov eax, ecx
mov rcx, qword [rdi + 0x2c0]
mov dword [rsp + 0x60], r8d
cdq
mov dword [rdi + 0x2e0], r8d
sub eax, edx
lea rdx, [rsp + 0x60]
sar eax, 1
mov dword [rsp + 0x64], eax
mov dword [rdi + 0x2e4], eax
call qword [sym.imp.user32.dll_ClientToScreen]
mov edx, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x60]
call qword [sym.imp.user32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff8af286d70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x7ff8af234e80
Capabilities:
Set thread local storage value

Disassembly:
cmp dword [0x7ff8af2b6d60], 0
jne 0x7ff8af234e95
xor edx, edx
mov ecx, 0x10001
jmp fcn.7ff8af234680
test rcx, rcx
je 0x7ff8af234eaf
cmp dword [rcx + 0x1f0], 0
jne 0x7ff8af234eaf
xor edx, edx
mov ecx, 0x1000a
jmp fcn.7ff8af234680
jmp fcn.7ff8af237080
Function at 0x7ff8af236c50
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rcx, [0x7ff8af28b730]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7f20], rax
test rax, rax
jne 0x7ff8af236c85
lea rdx, [0x7ff8af28b708]
mov ecx, 0x10008
call fcn.7ff8af234680
xor eax, eax
add rsp, 0x28
ret
lea rdx, [0x7ff8af28b6f0]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7f20]
lea rdx, [0x7ff8af28b6d8]
mov qword [0x7ff8af2b7f28], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7f20]
lea rdx, [0x7ff8af28b6c0]
mov qword [0x7ff8af2b7f30], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7f20]
lea rdx, [0x7ff8af28b6b0]
mov qword [0x7ff8af2b7f38], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7f20]
lea rdx, [0x7ff8af28b6a0]
mov qword [0x7ff8af2b7f40], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x7ff8af2b7f48], rax
mov eax, 1
add rsp, 0x28
ret

Function at 0x7ff8af237080
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x7ff8af2370bc
mov rdx, qword [rcx + 0x238]
mov rcx, qword [rcx + 0x230]
call qword [0x7ff8af2b7f40]
test eax, eax
je 0x7ff8af2370b3
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x7ff8af237920
lea rdx, [0x7ff8af28b860]
jmp 0x7ff8af2370d1
xor edx, edx
xor ecx, ecx
call qword [0x7ff8af2b7f40]
test eax, eax
jne 0x7ff8af2370db
lea rdx, [0x7ff8af28b838]
mov ecx, 0x10008
call fcn.7ff8af234680
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp 0x7ff8af237920
mov rdx, rcx
mov ecx, dword [0x7ff8af2b85bc]
jmp qword [sym.imp.kernel32.dll_TlsSetValue]

Function at 0x7ff8af2378b0
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.kernel32.dll_TlsAlloc]
mov dword [0x7ff8af2b85bc], eax
cmp eax, 0xffffffff
jne 0x7ff8af2378dd
lea rdx, [0x7ff8af28bb50]
mov ecx, 0x10008
call fcn.7ff8af234680
xor eax, eax
add rsp, 0x28
ret
mov dword [0x7ff8af2b85b8], 1
mov eax, 1
add rsp, 0x28
ret
Function at 0x7ff8af238b50
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x58
lea rcx, [0x7ff8af28bdb0]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7ea0], rax
test rax, rax
jne 0x7ff8af238b85
lea rdx, [0x7ff8af28bd90]
mov ecx, 0x10008
call fcn.7ff8af234680
xor eax, eax
add rsp, 0x58
ret
lea rdx, [0x7ff8af28bd80]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rcx, [0x7ff8af28bd70]
mov qword [0x7ff8af2b7ea8], rax
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7ee0], rax
test rax, rax
jne 0x7ff8af238bcd
lea rdx, [0x7ff8af28bd48]
mov ecx, 0x10008
call fcn.7ff8af234680
xor eax, eax
add rsp, 0x58
ret
lea rdx, [0x7ff8af28bd30]
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7ee0]
lea rdx, [0x7ff8af28bd10]
mov qword [0x7ff8af2b7ee8], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rcx, [0x7ff8af28bd00]
mov qword [0x7ff8af2b7ef0], rax
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7eb0], rax
test rax, rax
je 0x7ff8af238c34
lea rdx, [0x7ff8af28bce8]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x7ff8af2b7eb8], rax
lea rcx, [0x7ff8af28bcd8]
lea rax, [0x7ff8af28bcc8]
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea rcx, [0x7ff8af28bcb8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rcx
lea rcx, [0x7ff8af28bca8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
lea rcx, [0x7ff8af28bc98]
mov qword [rsp + 0x40], rcx
mov rcx, rax
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7ec8], rax
test rax, rax
jne 0x7ff8af238c9b
mov rax, qword [rsp + rbx*8 + 0x28]
inc rbx
test rax, rax
jne 0x7ff8af238c77
jmp 0x7ff8af238ccd
lea rdx, [0x7ff8af28bc80]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7ec8]
lea rdx, [0x7ff8af28bc70]
mov qword [0x7ff8af2b7ed0], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x7ff8af2b7ed8], rax
lea rcx, [0x7ff8af28bc60]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, qword [rsp + 0x50]
mov qword [0x7ff8af2b7ef8], rax
test rax, rax
je 0x7ff8af238d1d
lea rdx, [0x7ff8af28bc48]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rcx, qword [0x7ff8af2b7ef8]
lea rdx, [0x7ff8af28bc38]
mov qword [0x7ff8af2b7f00], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x7ff8af2b7f08], rax
lea rcx, [0x7ff8af28bc28]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov qword [0x7ff8af2b7f10], rax
test rax, rax
je 0x7ff8af238d4d
lea rdx, [0x7ff8af28bc10]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [0x7ff8af2b7f18], rax
mov eax, 1
add rsp, 0x58
ret
Function at 0x7ff8af23aff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x7ff8af23b04d
lea rbx, [0x7ff8af290300]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x7ff8af23b034
cmp r10, 2
jb 0x7ff8af23b034
cmp byte [r9], r8b
jne 0x7ff8af23b034
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x7ff8af23b010
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x7ff8af23b08f
lea rbx, [0x7ff8af290300]
cmp r8b, 0x23
jne 0x7ff8af23b073
cmp byte [r9], r8b
jne 0x7ff8af23b073
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x7ff8af23b060
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x7ff8af23b250
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x7ff8af23b27f
mov r8d, 0x652
lea rdx, [0x7ff8af28c830]
lea rcx, [0x7ff8af28c8a0]
call qword [sym.imp.ucrtbase.dll__wassert]
test rdi, rdi
je 0x7ff8af23b28b
mov qword [rdi], 0
lea rdx, [0x7ff8af28fdd8]
mov rcx, rbx
call fcn.7ff8af23b0a0
mov rbx, rax
test rax, rax
jne 0x7ff8af23b2ad
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.ucrtbase.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x7ff8af23b384
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff8af23b384
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x7ff8af23b384
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff8af23b384
cmp rsi, 0xffffffffffffffff
je 0x7ff8af23b384
mov rax, qword [0x7ff8af2b73d0]
test rax, rax
je 0x7ff8af23b321
inc dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_malloc]
mov rbp, rax
test rax, rax
je 0x7ff8af23b384
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x7ff8af23b371
call qword [sym.imp.ucrtbase.dll_fclose]
mov rax, qword [0x7ff8af2b73d0]
test rax, rax
je 0x7ff8af23b366
dec dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x7ff8af23b38d
call qword [sym.imp.ucrtbase.dll_fclose]
test rdi, rdi
je 0x7ff8af23b37f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x7ff8af23b38f
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff8af23d860
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rdi, edx
mov r14, rcx
mov ebx, edi
mov esi, edi
mov ebp, edi
shr ebx, 0x18
mov edx, edi
shr esi, 0x10
mov r8d, edi
shr ebp, 8
mov r9d, edi
shr edx, 8
shr r8d, 0x10
movzx r10d, dil
shr r9d, 0x18
cmp dword [rcx + 0xc8], 0
jg 0x7ff8af23d8d1
mov r8d, 0x6c2
lea rdx, [0x7ff8af28c6f0]
lea rcx, [0x7ff8af290078]
call qword [sym.imp.ucrtbase.dll__wassert]
movzx r10d, dil
movzx edx, bpl
movzx r8d, sil
movzx r9d, bl
movsxd rcx, dword [r14 + 0xc8]
mov rax, qword [r14 + 0xd0]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r10b
movzx ecx, bl
lea r10, [0x7ff8af290300]
xor rcx, rax
shr ebx, 8
movzx eax, dl
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, qword [0x7ff8af2b73d0]
xor ebx, dword [r10 + rcx*4]
not ebx
cmp dword [rax + 0x1c6c], ebx
jne 0x7ff8af23d946
mov dword [rax + 0x1c70], ebx
cmp dword [rax + 0x1ca8], ebx
jne 0x7ff8af23d955
mov byte [rax + 0x1cac], 1
cmp dword [rax + 0x1c54], ebx
jne 0x7ff8af23d96c
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.7ff8af2525a0
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x7ff8af249a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r10, qword [0x7ff8af2b73d0]
movsxd rdi, ecx
mov esi, edi
mov ebp, edi
mov r14d, edi
shr esi, 0x18
mov rbx, qword [r10 + 0x1c20]
mov edx, edi
add rbx, 0xc8
shr ebp, 0x10
mov r8d, edi
shr r14d, 8
mov r9d, edi
shr edx, 8
shr r8d, 0x10
movzx r11d, dil
shr r9d, 0x18
cmp dword [rbx], 0
jg 0x7ff8af249b18
mov r8d, 0x6c2
lea rdx, [0x7ff8af28c6f0]
lea rcx, [0x7ff8af290078]
call qword [sym.imp.ucrtbase.dll__wassert]
mov r10, qword [0x7ff8af2b73d0]
movzx r11d, dil
movzx edx, r14b
movzx r8d, bpl
movzx r9d, sil
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov esi, dword [rax + rcx*4 - 4]
not esi
movzx eax, r11b
movzx ecx, sil
lea r11, [0x7ff8af290300]
xor rcx, rax
shr esi, 8
movzx eax, dl
xor esi, dword [r11 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r8b
xor esi, dword [r11 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r9b
xor esi, dword [r11 + rcx*4]
movzx ecx, sil
shr esi, 8
xor rcx, rax
xor esi, dword [r11 + rcx*4]
not esi
cmp dword [r10 + 0x1c54], esi
jne 0x7ff8af249b8d
mov r8, rdi
mov edx, 4
mov ecx, esi
call fcn.7ff8af2525a0
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x7ff8af249bc1
inc r8d
test ecx, ecx
je 0x7ff8af249baa
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x7ff8af249baf
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.7ff8af2537e0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rbp, qword [rsp + 0x50]
mov dword [rax + rcx*4], esi
inc dword [rbx]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x7ff8af24b1f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff8af2b6430]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff8af2b73d0]
mov edi, ecx
cmp byte [rbx + 0x1fb5], 0
jne 0x7ff8af24b251
cmp byte [rbx + 0x1fb6], 0
jne 0x7ff8af24b251
movsx r9d, word [rbx + 0x3096]
lea r8, [0x7ff8af28f578]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff8af23af70
test dil, 1
je 0x7ff8af24b378
jmp 0x7ff8af24b2da
movss xmm1, dword [rbx + 0x1628]
lea r8, [0x7ff8af28f578]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff8af2aa214]
xor eax, eax
mulss xmm1, dword [0x7ff8af2aa204]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d30], rax
mov dword [rbx + 0x1d1c], 1
movss dword [rbx + 0x1d28], xmm0
movss dword [rbx + 0x1d2c], xmm1
movss xmm0, dword [rbx + 0x1684]
mulss xmm0, dword [0x7ff8af2aa174]
or dword [rbx + 0x1d18], 0x41
movss dword [rbx + 0x1d78], xmm0
movsx r9d, word [rbx + 0x3096]
call fcn.7ff8af23af70
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff8af24b330
lea r11, [0x7ff8af290300]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x7ff8af24b313
cmp byte [r8], r9b
jne 0x7ff8af24b313
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff8af24b300
not ecx
call fcn.7ff8af2437e0
test rax, rax
je 0x7ff8af24b378
cmp byte [rax + 0x8e], 0
je 0x7ff8af24b378
mov byte [rax + 0x95], 1
lea r8, [0x7ff8af28f578]
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x3096]
mov edx, 0x10
movsx r9d, word [rbx + 0x3096]
call fcn.7ff8af23af70
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff8af246140
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff8af286d70
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret