joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005940
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov eax, 0x2c000
mov qword [rsp + 0x110], r14
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x48], 0x1c800
mov dword [rbp + 0x50], 0x3bc00
mov dword [rbp + 0x40], 0x1000
call fcn.140027b90
call fcn.140026470
xor ecx, ecx
call qword [0x140002830]
mov rcx, qword [rbp + 0x58]
lea rdx, [rsp + 0x30]
add rcx, rax
mov dword [rsp + 0x30], 0xefb823d6
mov qword [rbp + 0x58], rcx
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x34], 0xc3ce2662
mov dword [rsp + 0x38], 0x12554ce2
mov dword [rsp + 0x3c], 0xe773e87d
mov dword [rsp + 0x40], 0x6b779c83
mov dword [rsp + 0x44], 0x573ba9b1
mov dword [rsp + 0x48], 0xeadb5fb2
mov dword [rsp + 0x4c], 0xa28eb60d
call fcn.1400028c0
mov r14, qword [rbp + 0x58]
mov esi, dword [rbp + 0x48]
mov rbx, r14
mov dword [rbp], 0x2d314218
mov dword [rbp + 4], 0xb6daeffc
mov dword [rbp + 8], 0xdf149b9
mov dword [rbp + 0xc], 0xbd7e7e03
test rsi, rsi
je 0x140005a5d
lea rdi, [rbp]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003590
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140005a40
sub rdi, 0x10
movaps xmmword [rbp], xmm0
sub rsi, 1
jne 0x140005a20
mov ecx, dword [rbp + 0x50]
call fcn.1400264c0
mov r9d, dword [rbp + 0x48]
lea r8, [r14 + 0x10]
mov edx, dword [rbp + 0x50]
sub r9d, 0x20
mov rcx, rax
mov rbx, rax
call fcn.140005be0
mov r8d, dword [rbp + 0x48]
xor edx, edx
mov rcx, qword [rbp + 0x58]
call fcn.140026490
call fcn.140004730
mov r14, qword [rsp + 0x110]
mov rsi, rax
test rax, rax
je 0x140005aec
mov r8, qword [rax + 0x30]
mov edx, 0x28
lea ecx, [rdx + 0x18]
call r8
mov rdi, rax
test rax, rax
je 0x140005aec
mov qword [rax + 0x10], rsi
mov rdx, rbx
mov dword [rax + 0x18], 1
mov rcx, rdi
xor eax, eax
mov qword [rdi + 0x1c], rax
lea r8d, [rax + 1]
call fcn.140003d80
test eax, eax
jne 0x140005aec
mov rbx, qword [rsi + 0x38]
mov rcx, rdi
call rbx
mov rcx, rsi
call rbx
mov eax, dword [rbp + 0x40]
add rsp, 0x118
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140008e80
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 8
lea r9, [rcx + rdx]
mov r8, rcx
cmp rdx, 0x10
jb 0x140008f2f
mov qword [rsp + 0x10], rbx
mov eax, 0x61c8864f
mov qword [rsp], rdi
xor ebx, ebx
lea rdi, [r9 - 0x10]
mov r10d, 0x24234428
mov r11d, 0x85ebca77
imul ecx, dword [r8], 0x7a143589
sub r10d, ecx
imul ecx, dword [r8 + 4], 0x7a143589
rol r10d, 0xd
imul r10d, r10d, 0x9e3779b1
sub r11d, ecx
imul ecx, dword [r8 + 8], 0x7a143589
rol r11d, 0xd
imul r11d, r11d, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [r8 + 0xc], 0x7a143589
rol ebx, 0xd
add r8, 0x10
imul ebx, ebx, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp r8, rdi
jbe 0x140008eb5
mov rdi, qword [rsp]
rol eax, 0x12
rol ebx, 0xc
add eax, ebx
rol r11d, 7
mov rbx, qword [rsp + 0x10]
add eax, r11d
rol r10d, 1
add eax, r10d
jmp 0x140008f34
mov eax, 0x165667b1
add eax, edx
lea rdx, [r8 + 4]
cmp rdx, r9
ja 0x140008f5e
nop
imul ecx, dword [r8], 0x3d4d51c3
mov r8, rdx
add rdx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp rdx, r9
jbe 0x140008f40
cmp r8, r9
jae 0x140008f8d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
imul edx, ecx, 0x165667b1
add edx, eax
rol edx, 0xb
imul eax, edx, 0x9e3779b1
cmp r8, r9
jb 0x140008f70
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae3d
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 8
ret

Function at 0x1400276b0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push rdi
sub rsp, 0x30
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx edx, byte [rsp + 0x20]
mov ecx, 0x53b2070f
call fcn.1400276e0
add rsp, 0x30
pop rdi
ret

Function at 0x140027b40
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
movsx eax, byte [rsp + 0x10]
mov rcx, qword [rsp + 8]
mov ecx, dword [rcx]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
mov rcx, qword [rsp + 8]
mov dword [rcx], eax
ret

Function at 0x1400289f0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140027820
mov dword [rsp + 0x20], 0
jmp 0x140028a1c
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140027ad0
mov rcx, rax
call fcn.1400277c0
cmp eax, 0xf8f45725
jne 0x140028a49
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400278b0
jmp 0x140028a4b
jmp 0x140028a12
add rsp, 0x48
ret
Function at 0x140002430
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebx, r8d
mov rdi, rdx
lea rdx, str.Press_Key
cmp ecx, 0x7b
ja 0x140002469
movsxd rax, ecx
lea rdx, str.Keybind
mov rdx, qword [rdx + rax*8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x140064a20]
movdqu xmmword [rsp + 0x48], xmm1
mov byte [rsp + 0x38], 0
cmp byte [rdx], 0
jne 0x140002498
mov r8d, 8
lea rdx, str.Your_Key
jmp 0x1400024aa
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x1400024a0
lea rcx, [rsp + 0x38]
call fcn.14000f070
cmp ebx, 1
jne 0x1400024d0
mov r8d, 9
lea rdx, str.Press_Key
lea rcx, [rsp + 0x38]
call fcn.14000f070
mov dword [rsp + 0x30], 0x42fa0000
mov dword [rsp + 0x34], 0x41a00000
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x30]
call fcn.140041620
test al, al
je 0x14000251f
test ebx, ebx
jne 0x14000251f
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14000255f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000255a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000255a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140059660
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140059640
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x14000a470
Capabilities:
Read .ini file

Disassembly:
push rdi
sub rsp, 0x90
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rax, str.C:config.ini
mov rdi, r8
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea r8, [0x14005d8aa]
mov dword [rsp + 0x20], 0x40
lea rcx, str.Colors
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x14000a52b
lea r8, [rsp + 0x30]
lea rdx, [0x14005de28]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
test rax, rax
je 0x14000a524
mov qword [rsp + 0xa0], rbx
xor ebx, ebx
cmp rbx, 4
jge 0x14000a51c
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
lea r8, [rsp + 0x30]
cvtsd2ss xmm1, xmm0
lea rdx, [0x14005de28]
xor ecx, ecx
movss dword [rdi + rbx*4], xmm1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
inc rbx
test rax, rax
jne 0x14000a4e5
mov rbx, qword [rsp + 0xa0]
mov eax, 1
jmp 0x14000a52d
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140059640
add rsp, 0x90
pop rdi
ret
Function at 0x14000d260
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov rax, qword [0x14010b1a8]
test rax, rax
je 0x14000d295
mov rcx, qword [rax + 0xa0]
jmp 0x14000d298
mov rcx, rsi
cmp qword [rcx + 0x48], rsi
jne 0x14000d2a3
call fcn.14003e090
call fcn.14003eed0
call fcn.14001a970
call fcn.140005da0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], rsi
movzx r9d, byte [rsp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140011560
nop
mov ecx, dword [0x14010a2e4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14000d2f1
cmp byte [0x14010a2e0], 0
sete byte [0x14010a2e0]
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x14000d493
cmp byte [0x14010a2e0], 0
je 0x14000d3be
call fcn.14000b2d0
cmp byte [0x14010a2e0], 0
je 0x14000d3be
cmp byte [0x14010a2f8], 0
je 0x14000d3be
mov rcx, qword [0x14010b1a8]
movsd xmm0, qword [rcx + 0xdfc]
movsd qword [rsp + 0x38], xmm0
mov rcx, qword [rcx + 0x40a0]
mov rcx, qword [rcx]
call fcn.140019070
mov rbx, rax
movdqa xmm0, xmmword [0x140064cf0]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140015580
mov edi, eax
test eax, 0xff000000
je 0x14000d3be
mov dword [rsp + 0x28], 0x1f
movss xmm0, dword [0x14006488c]
movss dword [rsp + 0x20], xmm0
xorps xmm3, xmm3
movss xmm2, dword [0x140064874]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140036fa0
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.1400364a0
mov dword [rbx + 0x78], esi
call fcn.14001d5f0
movss xmm2, dword [0x14010a28c]
movaps xmm0, xmm2
mulss xmm0, dword [0x14010a280]
movss dword [rsp + 0x58], xmm0
movss xmm1, dword [0x14010a284]
mulss xmm1, xmm2
movss dword [rsp + 0x5c], xmm1
movss xmm0, dword [0x14010a288]
mulss xmm0, xmm2
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm2
mov rcx, qword [0x14010b0e8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x14010b198]
mov edx, 1
call qword [rax + 0x108]
mov rcx, qword [0x14010b0e8]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov rdx, qword [0x14010b198]
call qword [rax + 0x190]
mov rax, qword [0x14010b1a8]
mov rcx, qword [rax + 0x40a0]
mov rcx, qword [rcx]
add rcx, 0x48
cmp byte [rcx], 0
cmove rcx, rsi
call fcn.14003d620
mov rcx, qword [0x14010b110]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140059640
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.1400047a0
int3
Function at 0x14000d4a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm0
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x14010b220]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x14010b220]
lea rcx, [rsp + 0x38]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x14000d529
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rbx, qword [0x14010b1a8]
lea rcx, [rsp + 0x30]
mov dword [rbx + 0x18], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x30]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xdfc], xmm0
movd xmm0, dword [rsp + 0x34]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe00], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14000d590
mov byte [rbx + 0xe04], 1
mov eax, dword [rbx + 0xe00]
mov dword [rbx + 0x36e8], eax
mov byte [rbx + 0x3738], 1
jmp 0x14000d597
mov byte [rbx + 0xe04], 0
call fcn.14000d260
cmp dword [rsp + 0x40], 0x12
jne 0x14000d4d0
mov rdi, qword [0x14010b1a8]
xor esi, esi
test rdi, rdi
je 0x14000d5be
mov rbx, qword [rdi + 0xa0]
jmp 0x14000d5c1
mov rbx, rsi
call fcn.14003e5d0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000d5d5
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000d5e3
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000d5f2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x14010b1a8]
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0xa0], rsi
test rax, rax
je 0x14000d612
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [0x14010b1a8]
test rax, rax
je 0x14000d630
mov rbx, qword [rax + 0x98]
jmp 0x14000d633
mov rbx, rsi
mov rcx, qword [rbx + 0x30]
lea rdi, [rax + 8]
test rcx, rcx
je 0x14000d64d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x14010b1a8]
mov qword [rdi + 0x80], rsi
mov qword [rdi + 0x90], rsi
test rax, rax
je 0x14000d666
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x14010b1a8]
mov qword [0x14010b1a8], rbx
call fcn.14001c000
mov qword [0x14010b1a8], rsi
test rbx, rbx
je 0x14000d6b1
mov rcx, rbx
call fcn.14002cf20
mov rax, qword [0x14010b1a8]
test rax, rax
je 0x14000d6a8
dec dword [rax + 0xf4]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140059640
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000d6e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rdx, str.CrosshairX
lea rcx, str.Chrome_WidgetWin_1
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
mov qword [0x14010b220], rax
test rax, rax
jne 0x14000d739
mov r9d, 0x40
lea r8, [0x14005d8aa]
lea rdx, str._Overlay_Failed__Please_Make_Sure_You_Have_CrosshairX_Open
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14000d7e6
mov dword [rsp + 0x30], 0x40
mov eax, dword [0x14010b214]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14010b208]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
mov rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov edx, 0xffffffec
mov r8d, 0x80020
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_SetWindowLongA]
movdqa xmm0, xmmword [0x1400649f0]
movdqu xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, qword [0x14010b220]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov edx, 5
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_UpdateWindow]
xor edx, edx
mov rcx, qword [0x14010b220]
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.14000c5b0
call fcn.14000d4a0
movzx r8d, al
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 1
call fcn.140059908
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400128d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14000d885
cmp dword [rsp + 0x48], 0
je 0x14000d879
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000d879
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140059640
add rsp, 0x70
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140013180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400131e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400131a0
mov ecx, dword [r9]
jmp 0x1400132cb
cmp ecx, 0x4e0
jb 0x1400132cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140013200
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140013250
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140014ff0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001504d
lea rbx, [0x14005e920]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140015034
cmp r10, 2
jb 0x140015034
cmp byte [r9], r8b
jne 0x140015034
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140015010
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001508f
lea rbx, [0x14005e920]
cmp r8b, 0x23
jne 0x140015073
cmp byte [r9], r8b
jne 0x140015073
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140015060
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400151d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400151ea
mov qword [r8], 0
lea rdx, [0x140063a54]
call fcn.1400150a0
mov rbx, rax
test rax, rax
jne 0x14001520a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400152e3
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400152e3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400152e3
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400152e3
cmp rdi, 0xffffffffffffffff
je 0x1400152e3
mov rax, qword [0x14010b1a8]
test rax, rax
je 0x140015280
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400152e3
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400152d0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14010b1a8]
test rax, rax
je 0x1400152c5
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400152ec
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400152de
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400152ee
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140018510
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r14, [0x14005e920]
movsxd rcx, dword [rcx + 0xd0]
mov rbp, rdx
mov rdi, rdx
mov rbx, rdx
mov r11, rdx
shr rbx, 0x30
mov r10, rdx
shr r11, 0x28
mov esi, dword [rax + rcx*4 - 4]
mov r9, rdx
not esi
movzx eax, bpl
movzx ecx, sil
mov r8, rdx
xor rcx, rax
shr esi, 8
shr rdx, 8
movzx eax, dl
shr r8, 0x10
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r8b
shr r9, 0x18
shr r10, 0x20
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r9b
shr rdi, 0x38
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r10b
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, r11b
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
movzx eax, bl
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rax
shr esi, 8
xor esi, dword [r14 + rcx*4]
movzx ecx, sil
xor rcx, rdi
shr esi, 8
xor esi, dword [r14 + rcx*4]
mov rcx, qword [0x14010b1a8]
not esi
cmp dword [rcx + 0x3ed4], esi
jne 0x140018618
mov r8, rbp
mov edx, 0xc
mov ecx, esi
call fcn.14002bd90
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140018630
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd8]
lea r8, [0x14005e920]
movsxd rcx, dword [rcx + 0xd0]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14010b1a8]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x1400186c5
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14002bd90
mov eax, ebx
add rsp, 0x20
pop rbx
ret