joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002b9e
Capabilities:
Get geographical location

Disassembly:
jmp 0x1400715d0
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x24]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
call fcn.140003d82
mov ecx, 8
imul rcx, rcx, 5
mov r9d, 2
lea r8, [rsp + 0x24]
mov edx, 0x22
mov rcx, qword [rax + rcx]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov eax, 2
imul rax, rax, 0
movzx eax, word [rsp + rax + 0x24]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0x30
je 0x140071638
cmp dword [rsp + 0x20], 0x31
je 0x14007163f
cmp dword [rsp + 0x20], 0x32
je 0x140071646
jmp 0x14007164d
mov eax, 2
jmp 0x14007164f
mov eax, 1
jmp 0x14007164f
mov eax, 3
jmp 0x14007164f
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x14000332d
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400f1eb0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400f1ecd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400f1f28
test al, 7
jne 0x1400f1ec0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400f1ee1
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400f1f52
test dh, dh
je 0x1400f1f4c
shr rdx, 0x10
test dl, dl
je 0x1400f1f46
test dh, dh
je 0x1400f1f40
shr rdx, 0x10
test dl, dl
je 0x1400f1f3a
test dh, dh
je 0x1400f1f34
shr edx, 0x10
test dl, dl
je 0x1400f1f2e
test dh, dh
jne 0x1400f1ee1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140003378
Capabilities:
Query environment variable

Disassembly:
jmp 0x140131078
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
je 0x140131115
mov rbp, rax
cmp word [rax], si
je 0x1401310c1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401310a8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401310a4
sub rbp, rbx
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
add rbp, 2
mov r9d, 0x40
sar rbp, 1
add rbp, rbp
mov rcx, rbp
lea edx, [r9 - 0x3e]
call fcn.1400036ac
mov rdi, rax
test rax, rax
je 0x140131100
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call fcn.140003602
mov rsi, rdi
mov edx, 2
xor ecx, ecx
call fcn.140001e15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003823
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140097020
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400969a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14009705f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1403bf020]
jmp 0x140097069
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret

Function at 0x140003a67
Capabilities:
Query environment variable

Disassembly:
jmp 0x140130f1c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
mov rbx, rax
test rax, rax
je 0x140131004
mov rsi, rax
cmp word [rax], r14w
je 0x140130f6f
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], r14w
jne 0x140130f57
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], r14w
jne 0x140130f53
mov qword [rsp + 0x38], r14
sub rsi, rbx
mov qword [rsp + 0x30], r14
add rsi, 2
sar rsi, 1
mov r8, rbx
mov r9d, esi
mov dword [rsp + 0x28], r14d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call fcn.140004b0b
movsxd rbp, eax
test eax, eax
je 0x140131004
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov rcx, rbp
lea edx, [r9 - 0x64]
call fcn.1400036ac
mov rdi, rax
test rax, rax
je 0x140130ff2
mov qword [rsp + 0x38], r14
mov r9d, esi
mov qword [rsp + 0x30], r14
mov r8, rbx
mov dword [rsp + 0x28], ebp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.140004b0b
test eax, eax
je 0x140130ff2
mov rsi, rdi
mov rdi, r14
jmp 0x140130ff5
mov rsi, r14
mov edx, 2
mov rcx, rdi
call fcn.140001e15
jmp 0x140131007
mov rsi, r14
test rbx, rbx
je 0x140131015
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140003a80
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x140096f50
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140096920
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140096f91
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1403bf020]
jmp 0x140096f97
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x140003b2a
Capabilities:
Get geographical location

Disassembly:
jmp 0x1401170f0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.140116070
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x140117143
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
call qword [0x1403bf020]
jmp 0x140117165
xor edx, edx
mov rcx, qword [rsp + 0x50]
call fcn.140002ea0
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x48
ret

Function at 0x140003b34
Capabilities:
Terminate process

Disassembly:
jmp 0x140075390
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140003eae
Capabilities:
Print debug messages

Disassembly:
jmp 0x14013d0f0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x1403a2fe0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x14013d116
jmp 0x14013d193
mov rcx, qword [rbp + 0x30]
call fcn.14000332d
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14013d12f
jmp 0x14013d193
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x14013d14c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140001e60
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.140002419
test eax, eax
jne 0x14013d193
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400035e4
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x14000458e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140075ec0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140075ee0
xor al, al
jmp 0x140075f61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140075ef3
xor al, al
jmp 0x140075f61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140075f1d
xor al, al
jmp 0x140075f61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140075f31
xor al, al
jmp 0x140075f61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140075f43
xor al, al
jmp 0x140075f61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140075f5f
xor al, al
jmp 0x140075f61
mov al, 1
add rsp, 0x38
ret
Function at 0x140004d9a
Capabilities:
Terminate process

Disassembly:
jmp 0x140097920
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14009794e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.140005902
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140004eb2
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x140116ee0
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140115ef0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140116f15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x1403bf020]
jmp 0x140116f1f
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x38
ret
Function at 0x140005529
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140116f40
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x38
call fcn.140115f30
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x140116f7f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
mov rax, qword [rsp + 0x28]
call qword [0x1403bf020]
jmp 0x140116f8e
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140005984
Capabilities:
Print debug messages

Disassembly:
jmp 0x14010f250
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x140005abf
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140097090
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1400969e0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1400970d9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1403bf020]
jmp 0x1400970e8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret
Function at 0x140005bc8
Capabilities:
Set environment variable

Disassembly:
jmp 0x140149060
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
lea rcx, [rsp + 0x70]
call fcn.140002cde
lea rcx, [rsp + 0x40]
call fcn.140002cde
call fcn.1400039ea
mov r8d, eax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0xb0]
call fcn.1400029fa
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1401490cf
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x40]
call fcn.1400031e3
lea rcx, [rsp + 0x70]
call fcn.1400031e3
mov eax, dword [rsp + 0x24]
jmp 0x14014915c
call fcn.1400039ea
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb8]
call fcn.1400029fa
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x140149116
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x40]
call fcn.1400031e3
lea rcx, [rsp + 0x70]
call fcn.1400031e3
mov eax, dword [rsp + 0x2c]
jmp 0x14014915c
lea rcx, [rsp + 0x40]
call fcn.140002c16
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x70]
call fcn.140002c16
mov rcx, qword [rsp + 0x38]
mov rdx, rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x40]
call fcn.1400031e3
lea rcx, [rsp + 0x70]
call fcn.1400031e3
mov eax, dword [rsp + 0x30]
add rsp, 0xa8
ret

Function at 0x140005c4f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14014dd90
mov word [rsp + 0x10], dx
mov qword [rsp + 8], rcx
sub rsp, 0x48
movzx eax, word [rsp + 0x58]
movd xmm0, eax
movdqa xmmword [rsp + 0x20], xmm0
pshuflw xmm0, xmmword [rsp + 0x20], 0
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x20]
pshufd xmm0, xmm0, 0
movdqa xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x50]
and rax, 0xfff
cmp rax, 0xff0
ja 0x14014dea1
mov rax, qword [rsp + 0x50]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pxor xmm0, xmmword [rsp + 0x10]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pcmpeqw xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x30]
pcmpeqw xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
por xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x10], xmm0
movdqa xmm0, xmmword [rsp + 0x10]
pmovmskb eax, xmm0
mov dword [rsp], eax
cmp dword [rsp], 0
je 0x14014de91
mov eax, dword [rsp]
bsf eax, eax
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
add rax, qword [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x14014de81
mov rax, qword [rsp + 0x50]
mov qword [rsp + 8], rax
jmp 0x14014de8a
mov qword [rsp + 8], 0
mov rax, qword [rsp + 8]
jmp 0x14014dedc
mov rax, qword [rsp + 0x50]
add rax, 0x10
mov qword [rsp + 0x50], rax
jmp 0x14014ded7
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x58]
cmp eax, ecx
jne 0x14014deb9
mov rax, qword [rsp + 0x50]
jmp 0x14014dedc
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
test eax, eax
jne 0x14014dec9
xor eax, eax
jmp 0x14014dedc
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
jmp 0x14014ddcb
add rsp, 0x48
ret
Function at 0x140005eb6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401322c8
jmp fcn.140005c4f
Function at 0x14000617c
Capabilities:
Print debug messages

Disassembly:
jmp 0x140073168
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edx, edx
mov rdi, rcx
lea r8d, [rdx + 0x28]
add rcx, r8
call fcn.140004a61
and qword [rdi + 0x50], 0
lea rax, [0x140000000]
and dword [rdi + 0x58], 0
lea rcx, [rdi + 0x28]
and dword [rdi + 0x5c], 0
xor r8d, r8d
mov qword [rdi + 0x10], rax
xor edx, edx
mov qword [rdi + 8], rax
lea rax, [0x14032e1f0]
mov qword [rdi + 0x20], rax
mov dword [rdi], 0x60
mov dword [rdi + 0x18], 0xe00
call fcn.14000350d
test eax, eax
jne 0x1400731ff
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400731ff
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400731f8
lea rcx, str.ERROR_:_Unable_to_initialize_critical_section_in_CAtlBaseModule_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [0x1403a805a], 1
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x180002320
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180002353
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x1800019b0]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x180004780
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800047dd
lea rbx, [0x180064790]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800047c4
cmp r10, 2
jb 0x1800047c4
cmp byte [r9], r8b
jne 0x1800047c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800047a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000481f
lea rbx, [0x180064790]
cmp r8b, 0x23
jne 0x180004803
cmp byte [r9], r8b
jne 0x180004803
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800047f0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180004960
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000497a
mov qword [r8], 0
lea rdx, [0x180063a60]
call fcn.180004830
mov rbx, rax
test rax, rax
jne 0x18000499a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180004a71
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004a71
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180004a71
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004a71
cmp rdi, 0xffffffffffffffff
je 0x180004a71
mov rax, qword [0x180075f20]
test rax, rax
je 0x180004a0e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180004a71
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180004a5e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180075f20]
test rax, rax
je 0x180004a53
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180004a7a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180004a6c
mov qword [r14], rdi
mov rax, rsi
jmp 0x180004a7c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180008a60
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x128]
lea r11, [0x180064790]
mov rax, qword [rcx + 0x130]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4080], ebx
jne 0x180008af6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18002a2e0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180008b00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x130]
lea r9, [0x180064790]
movss xmm2, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movsxd rcx, dword [rcx + 0x128]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x18000ce10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x180075f20]
mov r14d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x4038]
cmp qword [rbx + 0x1e0], 0
jne 0x18000ce57
cmp qword [rdi + 0x4d20], 0
mov eax, 0x288
je 0x18000ce5c
mov eax, 0x258
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
xor r15d, r15d
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x138]
subss xmm5, dword [rbx + 0x13c]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x18000cea1
lea eax, [r15 + 1]
je 0x18000cea4
mov eax, r15d
ucomiss xmm0, xmm3
jp 0x18000ceb1
jne 0x18000ceb1
mov r15d, 2
movss xmm2, dword [0x18006ab90]
or r15d, eax
comiss xmm3, xmm1
jb 0x18000cecd
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x18000cecd
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x18000cede
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x18000cede
movaps xmm0, xmm2
or dword [rdi + 0x4918], 2
xor edx, edx
movss dword [rdi + 0x493c], xmm1
movss dword [rdi + 0x4940], xmm0
mov dword [rdi + 0x4920], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x18000cf27
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.180004660
jmp 0x18000cf3d
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x60]
call fcn.180004660
mov rcx, qword [rsp + 0x60]
xor edx, edx
movss xmm6, dword [rdi + 0x3908]
mov r8d, 0x1200107
call fcn.180010220
mov rsi, qword [rdi + 0x4038]
movzx ebp, al
movss dword [rdi + 0x3908], xmm6
cmp word [rsi + 0xf8], 1
mov dword [rsi + 0xb4], r14d
mov byte [rsi + 0x10a], r15b
jne 0x18000cf8e
movsd xmm0, qword [rsi + 0x50]
movsd qword [rbx + 0x138], xmm0
mov r9d, r14d
lea rdx, [0x180062ed1]
not r9d
lea r10, [0x180064790]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x18000cfbb
cmp byte [rdx], r8b
jne 0x18000cfbb
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18000cfa8
not ebx
cmp dword [rdi + 0x4098], ebx
jne 0x18000cfeb
xor edx, edx
xor ecx, ecx
call fcn.180008cc0
cmp dword [rdi + 0x4ab8], r14d
jne 0x18000d031
cmp word [rsi + 0x194], 0
jne 0x18000d007
cmp byte [rsi + 0x19a], 0
je 0x18000d031
xor edx, edx
mov rcx, rsi
call fcn.180013260
xor edx, edx
mov rcx, rsi
call fcn.180019b00
mov rdx, rsi
mov ecx, ebx
call fcn.180008cc0
mov eax, dword [rdi + 0x4adc]
mov dword [rdi + 0x40c0], eax
mov rbx, qword [rsp + 0x68]
movzx eax, bpl
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret