joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006d70
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180005eb0
mov qword [rsp + 0x28], 0
cmp qword [0x180075bd0], 0
jne 0x180006db8
cmp qword [0x180075be0], 0
je 0x180006db8
mov rax, qword [0x180075be0]
mov qword [0x180075bd0], rax
cmp qword [0x180075bd0], 0
je 0x180006e5e
mov rax, qword [0x180075bd0]
cmp qword [rax + 0x10], 0
je 0x180006e5e
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180006e5e
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180006e5e
mov rax, qword [0x180075bd0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180006e24
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180006e2b
xor eax, eax
jmp 0x180006fd5
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.18005d420
mov rax, qword [rsp + 0x28]
jmp 0x180006fd5
mov rax, qword [0x180075be0]
mov qword [0x180075bd0], rax
jmp 0x180006e80
mov rax, qword [0x180075bd0]
mov rax, qword [rax + 8]
mov qword [0x180075bd0], rax
cmp qword [0x180075bd0], 0
je 0x180006ecd
cmp qword [0x180075bd0], 0
je 0x180006ecb
mov rax, qword [0x180075bd0]
cmp qword [rax + 0x10], 0
je 0x180006ecb
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180006ecb
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180006ecb
jmp 0x180006dfc
jmp 0x180006e6e
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180006c40
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180006fd3
mov rax, qword [rsp + 0x48]
mov qword [0x180075bd0], rax
mov rax, qword [0x180075bd0]
mov dword [rax], 0x52727464
mov rax, qword [0x180075bd0]
mov qword [rax + 0x10], 0
mov rax, qword [0x180075bd0]
mov rcx, qword [0x180075be0]
mov qword [rax + 8], rcx
mov rax, qword [0x180075bd0]
mov qword [0x180075be0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180075bd0]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180006f84
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180006fbe
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180006f7a
mov rax, qword [0x180075bd0]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180006dfc
xor eax, eax
add rsp, 0x58
ret
Function at 0x180009360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x1800300ff
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6e8
mov ecx, 0x6d97a
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0x36
lea rdx, [r8 + 0x648]
mov byte [rsp + 0x51], 0x49
mov byte [rsp + 0x52], 0x3e
mov byte [rsp + 0x53], 0x33
mov byte [rsp + 0x54], 0x5f
mov byte [rsp + 0x55], 0x40
mov byte [rsp + 0x56], 0x52
mov byte [rsp + 0x57], 0x59
mov byte [rsp + 0x58], 0x4b
mov byte [rsp + 0x59], 0x68
mov byte [rsp + 0x5a], 0x71
mov byte [rsp + 0x5b], 0x46
mov byte [rsp + 0x5c], 0x79
mov byte [rsp + 0x5d], 0x28
mov byte [rsp + 0x5e], 0x46
mov byte [rsp + 0x5f], 0x61
mov byte [rsp + 0x60], 0x44
mov byte [rsp + 0x61], 0x65
mov byte [rsp + 0x62], 0x79
mov byte [rsp + 0x63], 0x6c
mov byte [rsp + 0x64], 0x3e
mov byte [rsp + 0x65], 0x30
mov byte [rsp + 0x66], 0
nop word [rax + rax]
lea rax, [r8 + 0xb0]
nop word [rax + rax]
mov qword [rax], 0x383027c
add rax, 8
cmp rax, rdx
jne 0x1800301bf
sub ecx, 1
jne 0x1800301af
cmp qword [rsp + 0x490], 0x383027c
je 0x180030203
lea rdx, [0x18006f06e]
xor r9d, r9d
call fcn.18003034f
xor r8d, r8d
mov rbx, rax
mov edx, 0x6d92a5e2
mov rcx, rax
lea rsi, [rsp + 0x40]
call fcn.18003006f
mov rcx, rbx
lea rbx, [rsp + 0x38]
xor r8d, r8d
mov edx, 0x3803e5e2
mov rbp, rax
call fcn.18003006f
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x40], 0x3d322
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rsi
mov rdx, rbx
mov rcx, 0xffffffffffffffff
call rbp
test eax, eax
js 0x18003030c
lea rax, [rsp + 0x48]
mov r9d, 0x40
mov r8, rsi
mov rdx, rbx
mov rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
call rdi
test eax, eax
js 0x18003032f
xor r8d, r8d
cmp qword [rsp + 0x40], 0
mov eax, 0x36
movabs r10, resource.0
movabs r9, 0x642c8590b21642c9
jne 0x1800302eb
jmp 0x180030303
mov rax, r8
mov rcx, r8
mov rdi, r8
mul r9
sub rcx, rdx
shr rcx, 1
add rdx, rcx
shr rdx, 4
lea rax, [rdx + rdx*2]
shl rax, 3
sub rax, rdx
sub rdi, rax
movzx eax, byte [rsp + rdi + 0x50]
xor al, byte [r8 + r10]
mov rdx, qword [rsp + 0x38]
mov byte [rdx + r8], al
add r8, 1
cmp qword [rsp + 0x40], r8
ja 0x1800302bf
call qword [rsp + 0x38]
jmp 0x1800301e2
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18006f03f]
xor ecx, ecx
call qword [0x180072077]
xor eax, eax
add rsp, 0x6e8
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x18006f057]
xor ecx, ecx
call qword [0x180072077]
xor eax, eax
jmp 0x180030323
Function at 0x18003006f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
add rax, rcx
mov ebx, dword [rax + 0x18]
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x1c]
mov ebp, dword [rax + 0x24]
test ebx, ebx
je 0x1800300d3
lea rsi, [rcx + r9]
lea r10d, [r8 + 0x60]
xor r11d, r11d
nop
mov eax, dword [rsi + r11*4]
xor r8d, r8d
add rax, rcx
cmp byte [rax], 0
je 0x1800300c5
nop
movzx r9d, byte [rax]
add rax, 1
or r9d, r10d
add r8d, r9d
add r8d, r8d
cmp byte [rax], 0
jne 0x1800300af
cmp edx, r8d
je 0x1800300da
add r11, 1
cmp ebx, r11d
ja 0x18003009f
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rbp + r11*2]
movzx eax, word [rcx + rax]
lea rax, [rdi + rax*4]
mov eax, dword [rcx + rax]
add rax, rcx
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x18003034f
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x18005bec0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18005bee8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18005bee8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140012d70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x1400117b0
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1400220a2]
call fcn.14001136b
nop
lea rax, [0x14001ac30]
mov byte [rbp + 4], al
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x44], 0
jmp 0x140011826
mov eax, dword [rbp + 0x44]
inc eax
mov dword [rbp + 0x44], eax
movsxd rax, dword [rbp + 0x44]
cmp rax, 1
jae 0x14001184c
movsxd rax, dword [rbp + 0x44]
mov rcx, qword [rbp + 0x28]
movsx eax, byte [rcx + rax]
sub eax, 0x45
movsxd rcx, dword [rbp + 0x44]
mov rdx, qword [rbp + 0x28]
mov byte [rdx + rcx], al
jmp 0x14001181e
movzx eax, byte [rbp + 4]
mov r8d, 1
mov edx, eax
mov rcx, qword [rbp + 0x28]
call fcn.1400111ae
nop
lea rax, [rbp + 0x64]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x88], rax
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ac00]
call fcn.140011302
mov eax, edi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400111a9
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x140011271
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400140c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400140e0
xor al, al
jmp 0x140014161
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400140f3
xor al, al
jmp 0x140014161
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001411d
xor al, al
jmp 0x140014161
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014131
xor al, al
jmp 0x140014161
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014143
xor al, al
jmp 0x140014161
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001415f
xor al, al
jmp 0x140014161
mov al, 1
add rsp, 0x38
ret
Function at 0x1400045b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x2130
call fcn.1400171a0
sub rsp, rax
mov rax, qword gs:[0x60]
mov rbp, rdx
mov esi, ecx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r8, dword [r10 + 0x3c]
mov ebx, dword [r8 + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140004657
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140004657
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc3c693a2
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140004652
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140004630
cmp r8d, 0x72e31f57
je 0x14000465c
test r9d, r9d
jne 0x140004610
mov rax, qword [rax]
jmp 0x1400045e0
mov ecx, dword [rbx + 0x24]
mov r8d, esi
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov ecx, 0x410
call rax
mov rsi, rax
test rax, rax
je 0x1400047e5
mov qword [rsp + 0x2158], r14
lea r9, [rsp + 0x2150]
mov r8d, 0x2000
lea rdx, [rsp + 0x130]
mov rcx, rsi
xor r14d, r14d
call qword [0x140019030]
test eax, eax
je 0x140004721
test dword [rsp + 0x2150], 0xfffffff8
mov ebx, r14d
jbe 0x140004721
nop dword [rax]
mov eax, ebx
lea rdi, [rsp + 0x130]
mov rdx, qword [rdi + rax*8]
lea rdi, [rdi + rax*8]
mov r9d, 0x104
lea r8, [rsp + 0x20]
mov rcx, rsi
call qword [0x140019010]
test eax, eax
je 0x14000470c
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.1400097f0
test rax, rax
jne 0x14000471e
mov eax, dword [rsp + 0x2150]
inc ebx
shr eax, 3
cmp ebx, eax
jb 0x1400046d0
jmp 0x140004721
mov r14, qword [rdi]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400047b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400047b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb404d392
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400047b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140004790
cmp r8d, 0x55894c98
je 0x1400047bc
test r9d, r9d
jne 0x140004770
mov rax, qword [rax]
jmp 0x140004740
mov edx, dword [rbx + 0x24]
mov rcx, rsi
add rdx, r10
movzx r8d, word [rdx + r9*2]
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov r9d, dword [rdx + r8*4]
add r9, r10
call r9
mov rax, r14
mov r14, qword [rsp + 0x2158]
mov rbx, qword [rsp + 0x2160]
add rsp, 0x2130
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006b2b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret

Function at 0x140008264
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140019090]
test rax, rax
je 0x1400082ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400082ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400082ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400082ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400082ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400082b0
xor al, al
add rsp, 0x28
ret

Function at 0x14000e9fc
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000ea6b
xor ecx, ecx
call qword [0x140019090]
test rax, rax
je 0x14000ea6b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ea6b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ea6b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ea6b
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ea6b
cmp dword [rcx + 0xf8], 0
je 0x14000ea6b
mov ecx, ebx
call fcn.14000eb1c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000e8f8
nop
cmp dword [rbp + 0x20], 0
je 0x14000eab9
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000eac4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14000e9fc

Function at 0x14000ec00
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000e9fc

Function at 0x1400170d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400170f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400170f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003784
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400037ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400037ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400037ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400037ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400037ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400037d0
xor al, al
add rsp, 0x28
ret
Function at 0x403506
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x40
mov rax, r8
mov rsi, rcx
mov rcx, qword [rdx]
mov r8d, 0xffffffff
cmp r9, r8
cmovb r8, r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rax
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x403543
mov ecx, dword [rsp + 0x3c]
xor eax, eax
jmp 0x4035e8
call sub.KERNEL32.dll_GetLastError
cmp ax, 6
je 0x4035d9
movzx eax, ax
cmp eax, 8
je 0x40357e
cmp eax, 0x21
je 0x4035c8
cmp eax, 0x40
je 0x4035b7
cmp eax, 0x6d
je 0x40358f
cmp eax, 0x3e3
je 0x4035a0
cmp eax, 0x6f8
je 0x40357e
cmp eax, 0x718
jne 0x4035b1
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 9
jmp 0x4035e8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 8
jmp 0x4035e8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0xa
jmp 0x4035e8
mov ax, 0xf
jmp 0x4035e8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0xe
jmp 0x4035e8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0xc
jmp 0x4035e8
and word [rsp + 0x38], 0
and dword [rsp + 0x34], 0
mov ax, 0xb
mov qword [rsi], rcx
mov word [rsi + 8], ax
mov eax, dword [rsp + 0x34]
mov dword [rsi + 0xa], eax
movzx eax, word [rsp + 0x38]
mov word [rsi + 0xe], ax
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x140003cf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003d4d
lea rbx, [0x1400dbb60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003d34
cmp r10, 2
jb 0x140003d34
cmp byte [r9], r8b
jne 0x140003d34
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003d10
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003d8f
lea rbx, [0x1400dbb60]
cmp r8b, 0x23
jne 0x140003d73
cmp byte [r9], r8b
jne 0x140003d73
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003d60
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140003f50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x140003f7f
mov r8d, 0x78f
lea rdx, str.D:PANELES_CSENSI_XEONimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x140003f8b
mov qword [rdi], 0
lea rdx, [0x1400db388]
mov rcx, rbx
call fcn.140003da0
mov rbx, rax
test rax, rax
jne 0x140003fad
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140004086
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004086
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140004086
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004086
cmp rsi, 0xffffffffffffffff
je 0x140004086
mov rax, qword [0x1402055d0]
test rax, rax
je 0x140004023
inc dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140004086
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140004073
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402055d0]
test rax, rax
je 0x140004068
dec dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000408f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140004081
mov qword [rdi], rsi
mov rax, rbp
jmp 0x140004091
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007b20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xe8], 0
mov rbx, rcx
movsxd rdi, edx
jg 0x140007b57
mov r8d, 0x706
lea rdx, str.D:PANELES_CSENSI_XEONimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [rbx + 0xf0]
lea rdx, [0x1400dbb60]
movsxd r8, dword [rbx + 0xe8]
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x1402055d0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140007bd6
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001e9f0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140007bf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp dword [rcx + 0xe8], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140007c23
mov r8d, 0x706
lea rdx, str.D:PANELES_CSENSI_XEONimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movss xmm0, dword [rbx + 0x108]
lea r10, [0x1400dbb60]
movsxd rcx, dword [rbx + 0xe8]
mov rax, qword [rbx + 0xf0]
movss xmm2, dword [rdi]
movss xmm1, dword [rbx + 0x10c]
subss xmm2, xmm0
movss xmm3, dword [rdi + 4]
mov r9d, dword [rax + rcx*4 - 4]
subss xmm3, xmm1
movss xmm4, dword [rdi + 8]
not r9d
movzx ecx, r9b
subss xmm4, xmm0
movss xmm0, dword [rdi + 0xc]
shr r9d, 8
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp + 0x20], xmm2
movzx eax, byte [rsp + 0x20]
xor rcx, rax
movss dword [rsp + 0x24], xmm3
mov eax, r8d
movss dword [rsp + 0x28], xmm4
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 0x2c], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x24]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x28]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
mov rbx, qword [rsp + 0x40]
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0x2c]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x30
pop rdi
ret