joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63d8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63d9d2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x3032611b63052f36
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1e36e5ab3032611b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x61b8a2d2e56786fb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6ffa20d7366a686f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x65a76973206572e4
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc1a17121c1610
mov qword [rsp + 0x42], rdx
movabs rdx, 0x10018141d0b000c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0b080d12040f09
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1016140d2210181c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c02111c0a220a08
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x63d96c
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x26
jge 0x63d99e
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x63d9c5
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x24
jb 0x63d952
jmp 0x63d9b9
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.00444d40
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x24
call fcn.00457d20
mov eax, edi
mov ecx, 0x24
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0063d8a0

Function at 0x6419e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x641ab2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x663432c93578314d
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xf0e061d5
movabs rdx, 0x8010a0400040a0b
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0xa08040a
xor eax, eax
jmp 0x641a44
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6e]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
cmp rax, 0xc
jge 0x641a7c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xc
jae 0x641aa5
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6e]
cmp rsi, 0xc
jb 0x641a2a
jmp 0x641a97
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.006419e0
Function at 0x645320
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x645466
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x80], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x18], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x18]
nop
call fcn.006446a0
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x48], xmm15
movups xmmword [rsp + 0x58], xmm15
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x40], rcx
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x80]
xor eax, eax
jmp 0x6453c0
inc rax
mov rcx, rbx
nop dword [rax + rax]
cmp rax, 5
jge 0x645403
imul rdx, rax, 0x33
mov rsi, rdx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rsi
mov rdi, rdx
and rdx, 0xfffffffffffffff8
sub rsi, rdx
cmp rsi, 0x40
sbb rdx, rdx
mov r8, qword [rsp + rax*8 + 0x40]
mov rbx, rcx
mov rcx, rsi
shl r8, cl
and r8, rdx
mov qword [rsp + 0x10], r8
xor ecx, ecx
jmp 0x64542c
test byte [rcx], al
mov rax, rcx
mov ebx, 0x20
mov rcx, rbx
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rbx + rdi]
or r8d, edx
mov byte [rbx + rdi], r8b
inc rcx
mov rdi, rsi
cmp rcx, 8
jge 0x6453b5
movzx edx, byte [rsp + rcx + 0x10]
mov rsi, rdi
sar rdi, 3
add rdi, rcx
cmp rdi, 0x20
jge 0x6453b5
test byte [rbx], al
cmp rdi, 0x20
jb 0x64541a
mov rax, rdi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00457d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004556c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00645320
Function at 0x653ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x653cf2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xba7386c7128c5f2a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x277320ba7386c712
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x14c965de56722c50
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7611c7e0f7b2d974
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xdf46ecc269c67dca
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf22031f2004021c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1d040f22031f2004
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa07001c21191d19
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1f0c14151f161218
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1521181903151113
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b1d1f1c1f150500
mov qword [rsp + 0x60], rdx
movabs rdx, 0x70e0e0b170c0e0c
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x653c8d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x32
jge 0x653cba
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x653ce5
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x23
jb 0x653c70
jmp 0x653cd5
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x23
call fcn.00444d40
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x23
nop dword [rax]
call fcn.00457d20
mov eax, edi
mov ecx, 0x23
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00653ba0
Function at 0x65b9a0
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
mov rcx, qword [rax + 0xd0]
cmp rcx, 6
jne 0x65ba25
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
nop dword [rax]
jmp 0x65bb86
cmp rcx, 0xe
jne 0x65baa0
movabs rcx, 0x8c3d37c819544da2
mov qword [rax], rcx
movabs rcx, 0x73e1996689dcd4d6
mov qword [rax + 8], rcx
movabs rcx, 0x1dfab7ae32ff9c82
mov qword [rax + 0x10], rcx
movabs rcx, 0x679dd514582f9fcf
mov qword [rax + 0x18], rcx
movabs rcx, 0xf6d2b697bd44da8
mov qword [rax + 0x20], rcx
movabs rcx, 0x77e36f7304c48942
mov qword [rax + 0x28], rcx
movabs rcx, 0x3f9d85a86a1d36c8
mov qword [rax + 0x30], rcx
movabs rcx, 0x1112e6ad91d692a1
mov qword [rax + 0x38], rcx
jmp 0x65bb86
cmp rcx, 0xf
jne 0x65bb17
movabs rcx, 0x22312194fc2bf72c
mov qword [rax], rcx
movabs rcx, 0x9f555fa3c84c64c2
mov qword [rax + 8], rcx
movabs rcx, 0x2393b86b6f53b151
mov qword [rax + 0x10], rcx
movabs rcx, 0x963877195940eabd
mov qword [rax + 0x18], rcx
movabs rcx, 0x96283ee2a88effe3
mov qword [rax + 0x20], rcx
movabs rcx, 0xbe5e1e2553863992
mov qword [rax + 0x28], rcx
movabs rcx, 0x2b0199fc2c85b8aa
mov qword [rax + 0x30], rcx
movabs rcx, 0xeb72ddc81c52ca2
mov qword [rax + 0x38], rcx
jmp 0x65bb86
movabs rcx, 0x6a09e667f3bcc908
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
movups xmmword [rax + 0xc0], xmm15
ret
Function at 0x6645e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6646e8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x3f21644365f82d66
mov qword [rsp + 0x19], rdx
movabs rdx, 0x515474670d3f2164
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64313e0453444003
mov qword [rsp + 0x26], rdx
movabs rdx, 0x406010e0b11020e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x51001120e100e13
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1209051001120e10
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80108070f0c0d04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x664682
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x38]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x38]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1a
jge 0x6646af
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x6646db
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x664665
jmp 0x6646cf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457d20
mov eax, edi
mov ecx, 0x15
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.006645e0

Function at 0x664700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x664808
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xdcd764dbc8154666
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3ed2c09f6fe841dc
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2525efe2546cfb7f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1016130810120c03
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10130b140e0f0102
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x91206030d041013
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf01020706161301
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x6647a2
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1e
jge 0x6647cf
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x6647fb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x664785
jmp 0x6647ef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457d20
mov eax, edi
mov ecx, 0x17
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00664700
Function at 0x6657c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x665912
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x574ab0a66d69da66
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9da7f9acdb759ed3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x72c9d89c25a6bd71
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20729b8fe9e39413
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc48d7d3a65716976
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1a061118080c0126
mov qword [rsp + 0x42], rdx
movabs rdx, 0x50b0d031b1a1a06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2715071b100e1204
mov qword [rsp + 0x50], rdx
movabs rdx, 0x8140627160f1503
mov qword [rsp + 0x58], rdx
movabs rdx, 0x260509110e251a26
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa201d060f1a111d
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1622191c26130901
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x6658aa
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x36
jge 0x6658dc
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x665905
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0x28
jb 0x665890
jmp 0x6658f7
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.00444d40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x28
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0x28
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.006657c0

Function at 0x669d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x669de8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x65588ca8726376b2
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb973a9bfa3f49b9f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50b0a0d00010c08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90d0f0409050b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10a0d060f060508
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x669d81
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x16
jge 0x669db3
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x669ddb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0x10
jb 0x669d67
jmp 0x669dcf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457d20
mov eax, edi
mov ecx, 0x10
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00669d00
Function at 0x140005da0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140005dfd
lea rbx, [0x14004faf0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140005de4
cmp r10, 2
jb 0x140005de4
cmp byte [r9], r8b
jne 0x140005de4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140005dc0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140005e3f
lea rbx, [0x14004faf0]
cmp r8b, 0x23
jne 0x140005e23
cmp byte [r9], r8b
jne 0x140005e23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140005e10
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140005f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140005f9a
mov qword [r8], 0
lea rdx, [0x140053edc]
call fcn.140005e50
mov rbx, rax
test rax, rax
jne 0x140005fba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140006093
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006093
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140006093
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006093
cmp rdi, 0xffffffffffffffff
je 0x140006093
mov rax, qword [0x1400b9e88]
test rax, rax
je 0x140006030
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140006093
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140006080
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400b9e88]
test rax, rax
je 0x140006075
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000609c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000608e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000609e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140008d80
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x110]
lea r8, [0x14004faf0]
movsxd rcx, dword [rcx + 0x108]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x1400b9e88]
not ebx
cmp dword [rcx + 0x401c], ebx
jne 0x140008e15
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140027ec0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140016450
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14005e040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400b9e88]
mov edi, ecx
cmp byte [rbx + 0x43fd], 0
jne 0x1400164b1
cmp byte [rbx + 0x43fe], 0
jne 0x1400164b1
movsx r9d, word [rbx + 0x54de]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140005d20
test dil, 1
je 0x1400165db
jmp 0x140016543
movss xmm1, dword [rbx + 0x39c0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x54de]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140054e94]
mov edx, 0x10
mulss xmm1, dword [0x140054e88]
addss xmm0, dword [rbx + 0xd9c]
addss xmm1, dword [rbx + 0xda0]
mov qword [rbx + 0x410c], rax
mov dword [rbx + 0x40f4], 1
movss dword [rbx + 0x4104], xmm0
mov byte [rbx + 0x412c], 1
movss dword [rbx + 0x4108], xmm1
movss xmm0, dword [rbx + 0x3a1c]
mulss xmm0, dword [0x140054dd4]
or dword [rbx + 0x40f0], 0x41
movss dword [rbx + 0x4150], xmm0
call fcn.140005d20
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140016593
lea r11, [0x14004faf0]
cmp r9b, 0x23
jne 0x140016576
cmp byte [r8], r9b
jne 0x140016576
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016563
not ecx
call fcn.14000e990
test rax, rax
je 0x1400165db
cmp byte [rax + 0xcb], 0
je 0x1400165db
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x54de]
mov edx, 0x10
movsx r9d, word [rbx + 0x54de]
call fcn.140005d20
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.1400117b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004d340
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14001b910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x55d0], 0
lea rbx, [rcx + 0x55d8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001b9b3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x14001b966
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.1400291d0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140006580
mov eax, dword [rbx]
lea rcx, [0x1400b9e86]
mov r9, qword [rdi + 0x55d0]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x55e0]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001b9bb
mov rcx, rbx
call fcn.140006580
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001bdf0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x14001be42
lea r11, [0x14004faf0]
cmp r9b, 0x23
jne 0x14001be25
cmp byte [r8], r9b
jne 0x14001be25
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001be12
mov r11, qword [0x1400b9e88]
xor r9d, r9d
not eax
mov r10, qword [r11 + 0x5598]
test r10, r10
lea rcx, [r10 + 4]
cmovne r9, rcx
test r9, r9
je 0x14001be8e
cmp dword [r9], eax
je 0x14001be97
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x5590]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x14001be65
mov rcx, rbx
pop rbx
jmp fcn.14001bd00
test r9, r9
je 0x14001be8e
mov rax, r9
pop rbx
ret

Function at 0x14001beb0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400b9e88]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001bf13
mov qword [rsp], rbx
lea rbx, [0x14004faf0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001bef3
cmp byte [r8], r9b
jne 0x14001bef3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001bee0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5580]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001bf47
mov r10, qword [r10 + 0x5588]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001bf4e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001bf34
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret