joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084400
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140084448
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14008441a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x140096f00
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x140096f28
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140096f70
cdqe
add rsi, rax
sub rbx, rax
jne 0x140096f40
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x140096f7c
call rbp
cmp dword [rax], 4
je 0x140096f40
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400be880
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400c0840]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400c0858], 0
movups xmmword [0x1400c0848], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400be935
jmp 0x1400be9df
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400be990
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400be920
cmp qword [rbx + 7], r12
jne 0x1400be920
cmp byte [rbx + 0xf], 0x2e
jne 0x1400be920
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400be97b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400be985
cmp byte [rbx + rsi], 0x3d
je 0x1400bea15
add rbp, 0x18
cmp rbp, r13
jne 0x1400be95f
jmp 0x1400be920
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400c0858], rbx
jne 0x1400be9ef
lea rcx, [sym.__tcf_0_3]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400c0858], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400c0850], rax
test rax, rax
je 0x1400bea4c
xor edx, edx
mov qword [0x1400c0848], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400be9c7
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400bea3c
test dl, dl
jne 0x1400be920
test eax, eax
js 0x1400be920
mov dword [rbp + 0x10], eax
jmp 0x1400be920
xor ecx, ecx
mov qword [0x1400c0858], rcx
jmp 0x1400be9c7
Function at 0x140003810
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400034e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
add rsp, 0x38
ret
Function at 0x14002f780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x58
mov rax, qword [0x1400c0040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [r8 + 0x18], 0xf
mov r15, rdx
mov r10, qword [r8 + 0x10]
mov rdx, r8
movzx ebp, r9b
mov rsi, rcx
jbe 0x14002f7b4
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x14002f7e3
movabs r11, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x14002f7d0
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x20]
call fcn.140008bc0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14002f7fe
mov rcx, qword [rsi + 0x28]
cmp rcx, qword [rsi + 0x28]
je 0x14002f925
cmp byte [rsp + 0xa0], 0
mov qword [rsp + 0x98], rdi
lea rdi, [rcx + 0x30]
mov qword [rsp + 0x50], r14
lea r14, [rcx + 0x50]
je 0x14002f879
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movsx eax, word [rsp + 0x3e]
sub eax, dword [r15 + 0x10]
movsx ecx, word [rsp + 0x3a]
sub eax, ecx
inc eax
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x14002f879
mov ebx, eax
nop dword [rax]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400a0428]
call fcn.1400086f0
sub rbx, 1
jne 0x14002f860
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400a0430]
call fcn.1400086f0
cmp qword [rdi + 0x18], 0xf
mov r8, qword [rdi + 0x10]
jbe 0x14002f89a
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.140008ff0
cmp qword [r14 + 0x18], 0xf
mov r8, qword [r14 + 0x10]
mov rdi, qword [rsp + 0x98]
jbe 0x14002f8bb
mov r14, qword [r14]
mov rdx, r14
mov rcx, rax
call fcn.140008ff0
cmp qword [rsi + 0x18], 0xf
mov r8, qword [rsi + 0x10]
mov r14, qword [rsp + 0x50]
jbe 0x14002f8d9
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rax
call fcn.140008ff0
lea rdx, [0x1400a042c]
mov rcx, rax
call fcn.1400086f0
cmp qword [r15 + 0x18], 0xf
mov r8, qword [r15 + 0x10]
jbe 0x14002f901
mov r15, qword [r15]
mov rdx, r15
mov rcx, rax
call fcn.140008ff0
test bpl, bpl
jne 0x14002f925
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [0x1400093f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14007d4a0
add rsp, 0x58
pop r15
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002fad0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400c0040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [0x1400c0ab0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1400c0ab0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x1400c0ab0]
lea rcx, [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14002fb5a
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.14003fc60
mov rcx, qword [0x1400c0ab0]
mov rbx, rax
mov qword [rax + 0xc0], rcx
lea rcx, [rsp + 0x30]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x30]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdf8], xmm0
movd xmm0, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdfc], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14002fbd0
mov byte [rbx + 0xe00], 1
mov eax, dword [rbx + 0xdfc]
mov dword [rbx + 0x36e8], eax
mov byte [rbx + 0x3738], 1
jmp 0x14002fbd7
mov byte [rbx + 0xe00], 0
mov rcx, qword [0x1400c0aa0]
xor r8d, r8d
cmp byte [0x1400b578a], r8b
mov rax, qword [rcx]
je 0x14002fbf4
mov edx, 1
jmp 0x14002fbf6
xor edx, edx
call qword [rax + 0x40]
call fcn.140064040
call fcn.140064f20
call fcn.140046c60
mov rcx, qword [0x1400c0648]
call fcn.14000af10
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14002fc31
cmp byte [0x1400bfecb], 0
sete byte [0x1400bfecb]
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14002fd11
call qword [sym.imp.USER32.dll_GetForegroundWindow]
lea rdx, str.Fortnite
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
cmp byte [0x1400bfecb], 0
je 0x14002fc73
cmp rbx, rax
jne 0x14002fc73
mov rcx, rdi
call fcn.14000ea00
call fcn.140048b10
mov rcx, qword [0x1400c0a98]
lea r8, [0x1400c0aa8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x68], xmm0
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1400c0a98]
lea r8, [rsp + 0x68]
mov rdx, qword [0x1400c0aa8]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14003f850
mov rcx, rax
call fcn.140064080
cmp dword [rsp + 0x40], 0x12
jne 0x14002fb01
call fcn.140064cf0
call fcn.140065230
xor ecx, ecx
call fcn.14003d330
mov rcx, qword [0x1400c0ab0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14007d4a0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
mov rcx, qword [0x1400c0ab0]
call qword [sym.imp.USER32.dll_DestroyWindow]
lea rcx, [0x1400316e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14003a640
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x1400c0ae8]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x14003a69f
cmp qword [rdi + 0x4b38], 0
mov eax, 0x250
je 0x14003a6a4
mov eax, 0x220
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x100]
subss xmm5, dword [rbx + 0x104]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x14003a6e9
jne 0x14003a6e9
mov eax, 1
jmp 0x14003a6eb
xor eax, eax
ucomiss xmm0, xmm3
jp 0x14003a6fa
jne 0x14003a6fa
mov r14d, 2
jmp 0x14003a6fd
xor r14d, r14d
movss xmm2, dword [0x1400a29d4]
or r14d, eax
comiss xmm3, xmm1
jb 0x14003a715
addss xmm1, xmm4
maxss xmm1, xmm2
comiss xmm3, xmm0
jb 0x14003a722
addss xmm0, xmm5
maxss xmm0, xmm2
or dword [rdi + 0x47b8], 2
xor edx, edx
movss dword [rdi + 0x47d8], xmm1
movss dword [rdi + 0x47dc], xmm0
mov dword [rdi + 0x47c0], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x14003a76b
mov dword [rsp + 0x28], r15d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.1400409e0
jmp 0x14003a781
lea r8, str._s__08X
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.1400409e0
movss xmm6, dword [rdi + 0x37f8]
test sil, sil
jne 0x14003a798
mov dword [rdi + 0x37f8], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.1400382a0
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r15d
mov byte [rsi + 0xd2], r14b
jne 0x14003a7de
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r15d
lea rdx, [0x1400a1db1]
not r9d
lea r10, [0x1400a0f50]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14003a80b
cmp byte [rdx], r8b
jne 0x14003a80b
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14003a7f8
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x14003a83b
xor edx, edx
xor ecx, ecx
call fcn.14004bfd0
cmp dword [rdi + 0x48d0], r15d
jne 0x14003a888
bt r12d, 0x17
jb 0x14003a888
cmp word [rsi + 0x15c], 0
jne 0x14003a85e
cmp byte [rsi + 0x162], 0
je 0x14003a888
xor edx, edx
mov rcx, rsi
call fcn.14003f1e0
xor edx, edx
mov rcx, rsi
call fcn.140043230
mov rdx, rsi
mov ecx, ebx
call fcn.14004bfd0
mov eax, dword [rdi + 0x48f4]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003acf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c0040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400c0ae8]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a81], 0
jne 0x14003ad58
cmp byte [rbx + 0x4a82], 0
jne 0x14003ad58
movsx r9d, word [rbx + 0x5bbe]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140040960
test sil, 2
je 0x14003ae90
jmp 0x14003adf1
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400a0a9c]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1400a0a90]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
or dword [rbx + 0x47b8], 1
mov qword [rbx + 0x47d0], rax
movss dword [rbx + 0x47c8], xmm0
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f0]
mov rax, qword [0x1400c0ae8]
mulss xmm0, dword [0x1400a29a4]
or dword [rax + 0x47b8], 0x40
movss dword [rax + 0x4818], xmm0
movsx r9d, word [rbx + 0x5bbe]
call fcn.140040960
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14003ae41
lea r11, [0x1400a0f50]
cmp r9b, 0x23
jne 0x14003ae24
cmp byte [r8], r9b
jne 0x14003ae24
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003ae11
not ecx
call fcn.14003eda0
test rax, rax
je 0x14003ae90
cmp byte [rax + 0xb6], 0
je 0x14003ae90
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bbe]
movsx r9d, word [rbx + 0x5bbe]
call fcn.140040960
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400382a0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14007d4a0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14003ecf0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400c0ae8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14003ed53
mov qword [rsp], rbx
lea rbx, [0x1400a0f50]
nop dword [rax]
cmp r9b, 0x23
jne 0x14003ed33
cmp byte [r8], r9b
jne 0x14003ed33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14003ed20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c18]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14003ed87
mov r10, qword [r10 + 0x5c20]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14003ed8e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14003ed74
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14003ee20
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x14003ee70
lea r11, [0x1400a0f50]
cmp r9b, 0x23
jne 0x14003ee53
cmp byte [r8], r9b
jne 0x14003ee53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003ee40
not ecx
jmp fcn.14003eda0

Function at 0x14003f940
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1400a0f50]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x14003f9db
mov r8, r10
xor r9d, r9d
mov edx, 4
mov ecx, ebx
call fcn.14003cb50
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14003fa70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x1400a0f50]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x1400406b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x1400406cb
mov qword [r8], 0
call fcn.140040810
mov rbx, rax
test rax, rax
jne 0x1400406e1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400407eb
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400407eb
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400407eb
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400407eb
cmp rdi, 0xffffffffffffffff
je 0x1400407eb
mov rax, qword [0x1400c0ae8]
test rax, rax
je 0x140040764
inc dword [rax + 0xec]
mov rdx, qword [0x1400c0af8]
lea rcx, [rdi + rbp]
call qword [0x1400bfed0]
mov rsi, rax
test rax, rax
je 0x1400407eb
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x1400407c3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400c0ae8]
test rax, rax
je 0x1400407b1
dec dword [rax + 0xec]
mov rdx, qword [0x1400c0af8]
mov rcx, rsi
call qword [0x1400bfed8]
jmp 0x1400407f4
test ebp, ebp
jle 0x1400407d5
lea rcx, [rdi + rsi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400407e6
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400407f6
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x140040c20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140040c7d
lea rbx, [0x1400a0f50]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140040c64
cmp r10, 2
jb 0x140040c64
cmp byte [r9], r8b
jne 0x140040c64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140040c40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140040cbf
lea rbx, [0x1400a0f50]
cmp r8b, 0x23
jne 0x140040ca3
cmp byte [r9], r8b
jne 0x140040ca3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140040c90
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140040f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r12
push r13
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
lea r13, [0x140000000]
mov qword [rsp + 0x38], rbp
mov rdi, rdx
mov qword [rsp + 0x40], rsi
mov rax, rcx
mov qword [rsp + 8], r14
xor r12d, r12d
mov qword [rsp], r15
test rdi, rdi
je 0x140040fd0
cmp rax, rdi
jae 0x140041148
movzx r8d, byte [rax]
test r8b, r8b
je 0x140041148
xor ebx, ebx
mov ecx, r8d
shr rcx, 3
mov rdx, rdi
movsx r9, byte [rcx + r13 + 0xa1b58]
test r9d, r9d
sete bl
add ebx, r9d
test rdi, rdi
jne 0x140041006
movsxd rdx, ebx
add rdx, rax
xor esi, esi
lea rcx, [rax + 1]
cmp rax, rdx
cmovb esi, r8d
cmp rcx, rdx
jae 0x14004101e
movzx r15d, byte [rcx]
jmp 0x140041021
xor r15b, r15b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x140041030
movzx r14d, byte [rcx]
jmp 0x140041033
xor r14b, r14b
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x140041041
movzx ebp, byte [rcx]
jmp 0x140041044
xor bpl, bpl
lea r10, [r9*4]
movzx ecx, sil
mov r9d, dword [r10 + r13 + 0xa1b78]
and r9d, ecx
movzx r8d, r15b
shl r9d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, r14b
or r9d, ecx
movzx r11d, bpl
shl r9d, 6
and r8d, 0xc0
mov ecx, edx
and edx, 0xc0
and ecx, 0x3f
or r9d, ecx
mov ecx, r11d
shr r11d, 2
and ecx, 0x3f
or r11d, edx
shl r9d, 6
shr r11d, 2
or r9d, ecx
mov ecx, dword [r10 + r13 + 0xa1ba8]
or r11d, r8d
shr r9d, cl
shr r11d, 2
mov edx, r9d
cmp r9d, dword [r10 + r13 + 0xa1b90]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r11d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r11d, r8d
mov ecx, 0x100
cmp r9d, 0xffff
cmova edx, ecx
mov ecx, dword [r10 + r13 + 0xa1bc0]
or r11d, edx
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x14004113a
xor edx, edx
test bpl, bpl
setne dl
xor ecx, ecx
test r14b, r14b
setne cl
add edx, ecx
xor ecx, ecx
test r15b, r15b
setne cl
add edx, ecx
xor ecx, ecx
test sil, sil
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
movsxd rcx, ebx
add rax, rcx
inc r12d
jmp 0x140040fc2
mov r15, qword [rsp]
mov eax, r12d
mov r14, qword [rsp + 8]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r13
pop r12
pop rdi
ret