joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010550
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x18001075a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x180010614
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1800105d0
mov ecx, dword [r10]
jmp 0x1800106f7
cmp ecx, 0x4e0
jb 0x1800106f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180010630
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x180010680
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x1800105b0
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x1800105a0
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x18001077a
cmp r8d, r14d
jne 0x180010580
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x180010ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x180074b88]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x180011049
xor edi, edi
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rdi
lea r8d, [rax + 5]
mov qword [rbx + 0x10], rdi
lea rdx, str.error
mov rcx, rbx
mov byte [rbx], dil
call fcn.180001630
jmp 0x1800110f1
mov ecx, 1
mov qword [rsp + 0x68], rsi
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
jne 0x18001108c
xor edi, edi
mov qword [rbx], rdi
lea rdx, str.error
mov qword [rbx + 0x10], rdi
mov r8d, 5
mov qword [rbx + 0x18], 0xf
mov rcx, rbx
mov byte [rbx], dil
call fcn.180001630
jmp 0x1800110ec
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
test rax, rax
je 0x180011063
mov qword [rsp + 0x28], rdi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0xf
inc r8
cmp byte [rax + r8], dil
jne 0x1800110b6
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.180001630
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rsi, qword [rsp + 0x68]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18005bc70
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1800112f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x18], 0x10
mov rsi, rdx
jb 0x18001130c
mov rcx, qword [rcx]
lea rdx, [0x180061b14]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov rcx, rax
mov rdi, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ecx, eax
mov dword [rsi], ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r8d, dword [rsi]
mov r9, rdi
mov edx, 1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800113f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180074b88]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov dword [r9], 0x400
mov rdx, rcx
mov dword [rsp + 0x38], 3
mov rbx, r9
lea rax, [rsp + 0x30]
mov rsi, r8
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x18001144a
xor al, al
jmp 0x18001147c
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005bc70
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180011910
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
call sub.MSVCP140.dll__Query_perf_frequency
mov rbx, rax
call sub.MSVCP140.dll__Query_perf_counter
cmp rbx, 0x989680
jne 0x180011932
imul rax, rax, 0x64
jmp 0x180011950
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov dword [0x180073564], eax
lea r9, [0x180073564]
mov r8d, eax
mov ecx, 1
nop word [rax + rax]
mov edx, r8d
shr edx, 0x1e
xor edx, r8d
imul r8d, edx, 0x6c078965
add r8d, ecx
mov dword [r9 + rcx*4], r8d
inc rcx
cmp rcx, 0x270
jb 0x180011970
mov rdx, rax
mov dword [0x180073560], 0x270
lea rcx, str.set_random_seed:__lld_n
add rsp, 0x20
pop rbx
jmp fcn.1800019c0
Function at 0x180014980
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180074b88]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [0x18007b399], 1
call fcn.18005b510
call fcn.18005b9a0
test rax, rax
je 0x180014a9b
mov rbx, qword [rax + 0x198]
test rbx, rbx
je 0x180014a9b
xor edx, edx
mov word [rbx + 0x179], 0
mov rcx, rbx
call fcn.18000c060
cmp byte [0x18007301d], 0
movss xmm3, dword [0x180062494]
je 0x180014a12
movss xmm2, dword [0x180073064]
movss xmm1, dword [rbx + 0x1d0]
movaps xmm0, xmm1
mulss xmm1, xmm3
addss xmm0, xmm2
addss xmm1, xmm2
movss dword [rbx + 0x1cc], xmm0
movss dword [rbx + 0x1c4], xmm1
cmp byte [0x180074fad], 0
je 0x180014a4a
movss xmm2, dword [0x18007306c]
movss xmm1, dword [rbx + 0x1e0]
movaps xmm0, xmm1
mulss xmm1, xmm3
addss xmm0, xmm2
addss xmm1, xmm2
movss dword [rbx + 0x1dc], xmm0
movss dword [rbx + 0x1d4], xmm1
cmp byte [0x18007301e], 0
je 0x180014a82
movss xmm2, dword [0x180073068]
movss xmm1, dword [rbx + 0x1f0]
movaps xmm0, xmm1
mulss xmm1, xmm3
addss xmm0, xmm2
addss xmm1, xmm2
movss dword [rbx + 0x1ec], xmm0
movss dword [rbx + 0x1e4], xmm1
cmp byte [0x18007301f], 0
je 0x180014a9b
movss xmm0, dword [0x180073074]
movss dword [rbx + 0x1f4], xmm0
mov rax, qword [0x18007aea0]
lea r9, [rsp + 0x20]
mov edx, 6
mov dword [rsp + 0x20], 0
mov rbx, qword [rax + 0xb0]
mov rcx, rbx
lea r8d, [rdx + 0x3a]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x180014af7
mov eax, dword [0x180062300]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov edx, 6
mov dword [rbx], eax
mov rcx, rbx
movzx eax, word [0x180062304]
mov word [rbx + 4], ax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, qword [0x18007b380]
mov edx, 0xfffffffc
mov rcx, qword [0x18007ad90]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
xor ecx, ecx
call fcn.18000df30
test eax, eax
je 0x180014b70
nop dword [rax + rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9d, 0x40012
lea r8, str.Internal
mov rcx, rax
lea rdx, str.Hooks_could_not_be_reverted
call qword [sym.imp.USER32.dll_MessageBoxW]
sub eax, 3
je 0x180014b50
cmp eax, 1
jne 0x180014b70
jmp 0x180014b65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x180014b50
xor ecx, ecx
call fcn.18000df30
test eax, eax
jne 0x180014b20
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18005bc70
add rsp, 0x30
pop rbx
ret
Function at 0x18001d290
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x180074b88]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18007b530]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x1fb5], 0
jne 0x18001d2f7
cmp byte [rbx + 0x1fb6], 0
jne 0x18001d2f7
mov r9d, dword [rbx + 0x2ff8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180021430
test sil, 1
je 0x18001d429
jmp 0x18001d38f
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1800640b8]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x180062498]
addss xmm0, dword [rbx + 0x130]
addss xmm1, dword [rbx + 0x134]
or dword [rbx + 0x1b38], 1
mov qword [rbx + 0x1b50], rax
movss dword [rbx + 0x1b48], xmm0
mov dword [rbx + 0x1b3c], 1
movss dword [rbx + 0x1b4c], xmm1
movss xmm0, dword [rbx + 0x1670]
mov rax, qword [0x18007b530]
mulss xmm0, dword [0x18006407c]
or dword [rax + 0x1b38], 0x40
movss dword [rax + 0x1b98], xmm0
mov r9d, dword [rbx + 0x2ff8]
call fcn.180021430
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18001d3e0
lea r11, [0x180063930]
nop
cmp r9b, 0x23
jne 0x18001d3c3
cmp byte [r8], r9b
jne 0x18001d3c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18001d3b0
not ecx
call fcn.180020110
test rax, rax
je 0x18001d429
cmp byte [rax + 0x86], 0
je 0x18001d429
mov byte [rax + 0x8d], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0xa4], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ff8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ff8]
call fcn.180021430
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.18001aca0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18005bc70
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180020b50
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xd0]
mov r9, r8
movsxd r8, dword [rcx + 0xc8]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.180021540
Function at 0x180021180
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x18002119b
mov qword [r8], 0
call fcn.1800212e0
mov rbx, rax
test rax, rax
jne 0x1800211b1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1800212b9
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800212b9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800212b9
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800212b9
cmp rdi, 0xffffffffffffffff
je 0x1800212b9
mov rax, qword [0x18007b530]
test rax, rax
je 0x180021232
inc dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
lea rcx, [rdi + rbp]
call qword [0x180074980]
mov rsi, rax
test rax, rax
je 0x1800212b9
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x180021291
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18007b530]
test rax, rax
je 0x18002127f
dec dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
mov rcx, rsi
call qword [0x180074988]
jmp 0x1800212c2
test ebp, ebp
jle 0x1800212a3
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1800212b4
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800212c4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x180021540
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002159d
lea rbx, [0x180063930]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180021584
cmp r10, 2
jb 0x180021584
cmp byte [r9], r8b
jne 0x180021584
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180021560
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800215df
lea rbx, [0x180063930]
cmp r8b, 0x23
jne 0x1800215c3
cmp byte [r9], r8b
jne 0x1800215c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800215b0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180022020
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
xor eax, eax
lea r8, [0x180063f0d]
mov dword [rsp + 0x2c], eax
lea r11, [0x180063930]
mov qword [rsp + 0x38], rax
mov r10d, 0xffffffff
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x180022076
cmp byte [r8], r9b
jne 0x180022076
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180022063
mov ecx, dword [rbx + 0x304c]
lea rax, [0x18002d360]
mov edi, dword [rbx + 0x3048]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x18002d4d0]
mov qword [rsp + 0x40], rax
lea rax, [0x18002d3f0]
mov qword [rsp + 0x48], rax
lea rax, [0x18002d280]
mov qword [rsp + 0x50], rax
lea rax, [0x18002d5c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x1800221a4
inc edi
test ecx, ecx
je 0x1800220fa
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1800220ff
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1800221a4
mov rax, qword [0x18007b530]
mov qword [rsp + 0x80], rsi
test rax, rax
je 0x180022126
inc dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
movsxd rax, edi
lea rcx, [rax + rax*8]
shl rcx, 3
call qword [0x180074980]
mov rdx, qword [rbx + 0x3050]
mov rsi, rax
test rdx, rdx
je 0x18002218f
movsxd rcx, dword [rbx + 0x3048]
lea r8, [rcx + rcx*8]
mov rcx, rax
shl r8, 3
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x3050]
test rcx, rcx
je 0x180022182
mov rax, qword [0x18007b530]
test rax, rax
je 0x180022182
dec dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
call qword [0x180074988]
mov qword [rbx + 0x3050], rsi
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x304c], edi
movsxd rax, dword [rbx + 0x3048]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*8]
mov rax, qword [rbx + 0x3050]
movups xmmword [rax + rcx*8], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + rcx*8 + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movups xmmword [rax + rcx*8 + 0x30], xmm1
movsd qword [rax + rcx*8 + 0x40], xmm0
inc dword [rbx + 0x3048]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x180023020
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18007b530]
cmp byte [rbx + 0x3068], 0
je 0x180023105
cmp qword [rbx + 0x3070], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3078]
je 0x1800230ed
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x180023092
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.18002ddb0
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.18002d880
mov eax, dword [rdi]
lea rcx, [0x18007b538]
mov r9, qword [rbx + 0x3070]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x3080]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.18002d880
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x180027a90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x18007b530]
mov r8d, ecx
mov rbx, qword [rax + 0x1a90]
add rbx, 0xc8
movzx eax, r8b
lea r8, [0x180063930]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x180027b50
lea ecx, [rdx + 1]
test r8d, r8d
je 0x180027b36
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180027b3b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18002def0
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18002a450
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x18007b530]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x3034], ecx
test rbx, rbx
je 0x18002a4bf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.18002a4d0
lea rdx, [0x180063fd8]
mov rcx, rbx
mov rdi, rax
call fcn.1800212e0
mov rbx, rax
test rax, rax
je 0x18002a4ba
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x18002c670
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [0x18007b530]
cmp byte [rbx + 0x3031], 0
jne 0x18002c7c3
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18002c7bc
lea rdx, [0x180061b14]
mov qword [rsp + 0x40], rdi
call fcn.1800212e0
mov rdi, rax
test rax, rax
je 0x18002c7b7
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18002c7a4
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002c7a4
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x18002c7a4
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18002c7a4
mov rbp, rsi
cmp rsi, 0xffffffffffffffff
je 0x18002c7a4
mov rax, qword [0x18007b530]
test rax, rax
je 0x18002c733
inc dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
mov rcx, rbp
call qword [0x180074980]
mov rsi, rax
test rax, rax
je 0x18002c7a4
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, rbp
je 0x18002c76f
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18002c780
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, rbp
mov rcx, rsi
call fcn.180022b20
mov rax, qword [0x18007b530]
test rax, rax
je 0x18002c792
dec dword [rax + 0x3bc]
mov rdx, qword [0x18007b540]
mov rcx, rsi
call qword [0x180074988]
jmp 0x18002c7ad
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 0x3031], 1
movss xmm0, dword [rbx + 0x3034]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x18002c814
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x3034], xmm0
jb 0x18002c814
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18002c803
call fcn.18002a450
mov dword [rbx + 0x3034], 0
add rsp, 0x20
pop rbx
ret
mov byte [rbx + 0x3a4], 1
mov dword [rbx + 0x3034], 0
add rsp, 0x20
pop rbx
ret