joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006010
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, rcx
movsxd rax, dword [rcx + 8]
mov qword [r11 - 0x58], rax
xor eax, eax
mov qword [r11 - 0x50], rax
mov dword [rsp + 0x60], 0x30
mov dword [rsp + 0x78], eax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x20], rax
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140136380], eax
jle 0x140006121
lea rcx, [0x140136380]
call fcn.1400ab3e0
cmp dword [0x140136380], 0xffffffff
jne 0x140006121
lea rdx, str.NtOpenProcess
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400060c0
lea rcx, [rsp + 0x20]
call fcn.14000d600
nop
mov rdi, qword [0x140134d58]
sub rdi, qword [0x140134d50]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.14000ce30
mov rcx, qword [rax]
movzx ebx, word [rcx + 0x30]
imul rbx, rdi
add rbx, qword [0x140134d68]
lea rcx, [rsp + 0x20]
call fcn.14000a890
mov qword [0x140136360], rbx
lea rcx, [0x140136380]
call fcn.1400ab374
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
mov edx, 0x1fffff
mov rcx, rsi
call qword [0x140136360]
test eax, eax
setns al
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400ab310
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008330
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140008352
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400083cc
mov rdi, r14
mov rcx, rbx
call fcn.14000a870
test rax, rax
jle 0x1400083a4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400d6bb0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400083bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400083c4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140008366
sub r14, rdi
jmp 0x1400084af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400083e3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400083e5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008417
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400d6bb0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400084ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140008452
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000848d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b3ab8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400084ac
cmp rbp, rax
ja 0x140008460
test rbp, rbp
je 0x1400084ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b3ab8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140009df0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
mov rcx, qword [rcx + 0x70]
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
movzx edi, word [rcx + 6]
xor r12d, r12d
test rdi, rdi
je 0x140009f18
nop
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x17], xmm1
movsd xmm0, qword [rbx + 0x20]
movsd qword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movups xmmword [rbp - 0x39], xmm1
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea rax, [rbp + 7]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140009e73
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.14000d600
mov eax, dword [rbp + 0x17]
mov qword [rbp - 0x19], rax
mov ecx, dword [rbp + 0xf]
mov qword [rbp - 0x11], rcx
mov r8d, dword [rbp + 0x1b]
mov dword [rbp - 9], r8d
mov r9d, dword [rbp + 0x13]
mov dword [rbp - 5], r9d
xor r10d, r10d
mov qword [rbp - 1], r10
mov rdx, qword [r15 + 0x60]
cmp rdx, qword [r15 + 0x68]
je 0x140009ef3
movaps xmm0, xmmword [rbp - 0x39]
movups xmmword [rdx], xmm0
movaps xmm1, xmmword [rbp - 0x29]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], recv
mov byte [rbp - 0x39], r10b
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rcx
mov dword [rdx + 0x30], r8d
mov dword [rdx + 0x34], r9d
mov dword [rdx + 0x38], r10d
add qword [r15 + 0x60], 0x40
jmp 0x140009f01
lea r8, [rbp - 0x39]
lea rcx, [r15 + 0x58]
call fcn.14000f4e0
nop
lea rcx, [rbp - 0x39]
call fcn.14000a890
add rbx, 0x28
sub rdi, 1
jne 0x140009e40
mov rax, qword [r15 + 0x70]
mov rax, qword [rax + 0xa0]
mov rcx, rax
shr rcx, 0x20
test ecx, ecx
je 0x140009fff
mov r11d, eax
mov ebx, eax
add rbx, qword [r15 + 0x78]
mov r8, qword [r15 + 0x58]
mov r10, qword [r15 + 0x60]
cmp r8, r10
je 0x140009f71
mov ecx, dword [r8 + 0x34]
cmp ecx, eax
ja 0x140009f5c
mov rdx, qword [r8 + 0x28]
add rdx, rcx
cmp r11, rdx
jb 0x140009f67
add r8, 0x40
cmp r8, r10
jne 0x140009f48
jmp 0x140009f71
mov eax, dword [r8 + 0x30]
sub rax, rcx
add rbx, rax
cmp dword [rbx], 0
je 0x140009fff
nop word [rax + rax]
mov r14, r12
mov edx, dword [rbx + 4]
lea rax, [rdx - 8]
sar rax, 1
test eax, eax
je 0x140009ff5
lea rsi, [rbx + 8]
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rbp - 0x49], eax
movzx eax, word [rsi]
mov word [rbp - 0x45], ax
mov rdx, qword [r15 + 0x88]
cmp rdx, qword [r15 + 0x90]
je 0x140009fcd
mov rax, qword [rbp - 0x49]
mov qword [rdx], rax
add qword [r15 + 0x88], 8
jmp 0x140009fdd
lea r8, [rbp - 0x49]
lea rcx, [r15 + 0x80]
call fcn.14000fed0
inc r14
add rsi, 2
mov edx, dword [rbx + 4]
lea rax, [rdx - 8]
sar rax, 1
mov eax, eax
cmp r14, rax
jb 0x140009fa0
mov eax, edx
add rbx, rax
cmp dword [rbx], 0
jne 0x140009f80
mov rcx, r15
call fcn.14000a9b0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400ab310
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14000d0e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov r15, rdx
mov r13, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000d10e
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x14000d143
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x14000d130
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000fab0
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000d16c
mov qword [r15], rcx
mov byte [r15 + 8], r12b
jmp 0x14000d311
movabs rax, 0x492492492492492
cmp qword [r13 + 0x10], rax
je 0x14000d32c
lea rbp, [r13 + 8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
mov ecx, 0x38
call fcn.1400ab458
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.140009a60
mov qword [rsi + 0x30], r12
mov rcx, qword [r13 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14000d1c4
cvtsi2ss xmm0, rcx
jmp 0x14000d1d9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r13 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000d1ec
cvtsi2ss xmm1, rcx
jmp 0x14000d201
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r13]
seta al
test al, al
je 0x14000d2b9
mov rcx, r13
call fcn.14000e130
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov rdx, qword [r13 + 0x18]
mov rbx, qword [rdx + rax*8 + 8]
mov rcx, qword [rbp]
cmp rbx, rcx
jne 0x14000d245
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r12
jmp 0x14000d2ae
mov r12, qword [rdx + rax*8]
mov rbp, qword [rsi + 0x20]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000d262
mov rdx, qword [rdx]
lea rcx, [rsi + 0x10]
cmp qword [rsi + 0x28], 0xf
jbe 0x14000d271
mov rcx, qword [rsi + 0x10]
cmp rbp, rax
jne 0x14000d282
mov r8, rbp
call fcn.1400d7690
test eax, eax
je 0x14000d28d
cmp rbx, r12
je 0x14000d29c
mov rbx, qword [rbx + 8]
jmp 0x14000d250
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
jmp 0x14000d2aa
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rbp, [r13 + 8]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [r13 + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [rbp]
jne 0x14000d2f2
mov qword [rcx + rax*8], rsi
jmp 0x14000d304
cmp r9, rdx
jne 0x14000d2fd
mov qword [rcx + rax*8], rsi
jmp 0x14000d309
cmp qword [rcx + rax*8 + 8], r8
jne 0x14000d309
mov qword [rcx + rax*8 + 8], rsi
mov qword [r15], rsi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400a9f18
int3
Function at 0x1400197d0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x140134a58]
mov r11, qword [rcx + 0x30]
test rax, rax
jne 0x1400198ab
movsxd rax, dword [r11 + 0x3c]
xor r10d, r10d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
mov edi, dword [rax + r11 + 0x88]
mov esi, dword [rdi + r11 + 0x20]
nop
lea rax, [rsi + r10*4]
mov r9d, 0x17a7cdc
mov eax, dword [rax + r11]
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140019875
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r9d
imul r9d, edx, 0x1000193
test r8b, r8b
jne 0x140019840
cmp r9d, 0x27c0ce1b
je 0x14001987a
inc r10d
jmp 0x140019820
mov ecx, dword [rdi + r11 + 0x24]
mov rsi, qword [rsp + 0x48]
add rcx, r11
mov rbx, qword [rsp + 0x40]
movzx edx, word [rcx + r10*2]
mov ecx, dword [rdi + r11 + 0x1c]
mov rdi, qword [rsp + 0x30]
add rcx, r11
mov eax, dword [rcx + rdx*4]
add rax, r11
mov qword [0x140134a58], rax
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
lea ecx, [rdx + 0x25]
call rax
mov cl, byte [0x7ffe026c]
cmp cl, 0xa
je 0x1400198f8
cmp cl, 6
jne 0x1400198f1
movzx edx, byte [0x7ffe0270]
sub edx, 1
je 0x1400198f1
sub edx, 1
je 0x1400198f1
cmp edx, 1
jne 0x1400198f8
xor al, al
add rsp, 0x38
ret
cmp eax, 0xc0000354
sete al
add rsp, 0x38
ret
Function at 0x14001cc00
Capabilities:
Connect socket
Initialize winsock library

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x210
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rsp + 0x200], rax
mov rbx, rdx
mov rdi, rcx
call fcn.140065b80
mov rax, qword [0x140134bd8]
mov ecx, 4
test rax, rax
je 0x14001cc3d
call rax
jmp 0x14001cc42
call fcn.1400bdfc4
mov rcx, rax
test rax, rax
je 0x14001cc5f
mov word [rsp + 0x40], 0x303
movzx eax, word [rsp + 0x40]
mov word [rcx], ax
mov word [rcx + 2], 0x101
call fcn.140064b40
mov qword [rdi + 0x10], rax
lea rdx, [0x140134be0]
cmp qword [0x140134bf8], 0xf
mov esi, 1
cmova rdx, qword [0x140134be0]
test rax, rax
je 0x14001cc96
test byte [rax + 0xb1], 2
je 0x14001cc96
xor ecx, ecx
jmp 0x14001cc98
mov ecx, esi
mov r8d, dword [0x140134bf0]
mov dword [rsp + 0x30], ecx
mov rcx, rax
call fcn.140066aa0
cmp eax, esi
jne 0x14001ce03
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14001ccd9
movzx eax, byte [rcx + 0xb1]
and al, 0xfd
mov qword [rcx + 0x110], 0
or al, sil
mov byte [rcx + 0xb1], al
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14001ce03
mov qword [rsp + 0x240], rbp
lea r8d, [rax + 6]
mov ebp, 2
mov edx, esi
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov dword [rdi], eax
cmp eax, 0xffffffff
je 0x14001cdfb
mov rcx, qword [rbx]
mov word [rsp + 0x48], bp
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x1f41
mov dword [rsp + 0x4c], eax
call qword [sym.imp.WS2_32.dll_htons]
movsxd rcx, dword [rdi]
lea r8d, [rbp + 0xe]
lea rdx, [rsp + 0x48]
mov word [rsp + 0x4a], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x14001cdfb
mov rbp, qword [rdi + 0x10]
test rbp, rbp
jne 0x14001cd65
mov qword [rdi + 8], rbp
jmp 0x14001cdea
mov rax, qword [0x140134bd8]
mov ecx, 0x1ab8
test rax, rax
je 0x14001cd7a
call rax
jmp 0x14001cd7f
call fcn.1400bdfc4
mov rbx, rax
test rax, rax
je 0x14001cdc5
mov rdx, rbp
mov rcx, rax
call fcn.14006cb30
test eax, eax
jns 0x14001cdc5
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001cda3
call fcn.14006afc0
mov rcx, rbx
call fcn.14006d130
mov rax, qword [0x140134bd0]
mov rcx, rbx
test rax, rax
je 0x14001cdbe
call rax
jmp 0x14001cdc3
call fcn.1400b3694
xor ebx, ebx
mov ecx, dword [rdi]
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x14001cdea
lea rax, [rbx + 0x2bc]
mov dword [rax], ecx
mov qword [rbx + 0x20], rax
lea rax, [rbx + 0x2c0]
mov dword [rax], ecx
mov qword [rbx + 0x28], rax
mov rcx, qword [rdi + 8]
call fcn.140066bb0
cmp eax, esi
jne 0x14001cdfb
xchg byte [rdi + 4], sil
mov rbp, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1400ab310
add rsp, 0x210
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002aec0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14002af21
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14002aee0
mov ecx, dword [r9]
jmp 0x14002b00b
cmp ecx, 0x4e0
jb 0x14002b00b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14002af40
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14002af90
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400348b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14003490d
lea rbx, [0x1401080d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400348f4
cmp r10, 2
jb 0x1400348f4
cmp byte [r9], r8b
jne 0x1400348f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400348d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14003494f
lea rbx, [0x1401080d0]
cmp r8b, 0x23
jne 0x140034933
cmp byte [r9], r8b
jne 0x140034933
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140034920
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140034a90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140034aaa
mov qword [r8], 0
lea rdx, [0x1401076e4]
call fcn.140034960
mov rbx, rax
test rax, rax
jne 0x140034aca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400bb048
mov esi, eax
cmp eax, 0xffffffff
je 0x140034b98
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400b3e88
test eax, eax
jne 0x140034b98
mov rcx, rbx
call fcn.1400bb048
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140034b98
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400b3e88
test eax, eax
jne 0x140034b98
cmp rdi, 0xffffffffffffffff
je 0x140034b98
mov rax, qword [0x140134bc0]
test rax, rax
je 0x140034b3a
inc dword [rax + 0x3bc]
mov rcx, rdi
call fcn.1400bdfc4
mov rsi, rax
test rax, rax
je 0x140034b98
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400b3ab8
mov rcx, rbx
cmp rax, rdi
je 0x140034b86
call fcn.1400b2818
mov rax, qword [0x140134bc0]
test rax, rax
je 0x140034b7c
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.1400b3694
jmp 0x140034ba0
call fcn.1400b2818
test r14, r14
je 0x140034b93
mov qword [r14], rdi
mov rax, rsi
jmp 0x140034ba2
mov rcx, rbx
call fcn.1400b2818
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140038640
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
xor eax, eax
lea r8, [0x140107539]
mov dword [rsp + 0x2c], eax
lea r11, [0x1401080d0]
mov qword [rsp + 0x38], rax
mov r10d, 0xffffffff
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rax, [0x14010750c]
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x140038696
cmp byte [r8], r9b
jne 0x140038696
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140038683
mov ecx, dword [rbx + 0x303c]
lea rax, [0x140044a60]
mov edi, dword [rbx + 0x3038]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x140044af0]
mov qword [rsp + 0x40], rax
lea rax, [0x140044be0]
mov qword [rsp + 0x48], rax
lea rax, [0x140044cc0]
mov qword [rsp + 0x50], rax
lea rax, [0x140044da0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x1400387b4
inc edi
test ecx, ecx
je 0x14003871a
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14003871f
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1400387b4
mov rax, qword [0x140134bc0]
mov qword [rsp + 0x80], rsi
test rax, rax
je 0x140038746
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*8]
shl rcx, 3
call fcn.1400bdfc4
mov rdx, qword [rbx + 0x3040]
mov rsi, rax
test rdx, rdx
je 0x14003879f
movsxd rcx, dword [rbx + 0x3038]
lea r8, [rcx + rcx*8]
mov rcx, rax
shl r8, 3
call fcn.1400d6bb0
mov rcx, qword [rbx + 0x3040]
test rcx, rcx
je 0x14003879a
mov rax, qword [0x140134bc0]
test rax, rax
je 0x14003879a
dec dword [rax + 0x3bc]
call fcn.1400b3694
mov qword [rbx + 0x3040], rsi
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x303c], edi
movsxd rax, dword [rbx + 0x3038]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*8]
mov rax, qword [rbx + 0x3040]
movups xmmword [rax + rcx*8], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + rcx*8 + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movups xmmword [rax + rcx*8 + 0x30], xmm1
movsd qword [rax + rcx*8 + 0x40], xmm0
inc dword [rbx + 0x3038]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140040030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401310c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140134bc0]
mov edi, edx
cmp byte [rbx + 0x1fad], 0
jne 0x140040090
cmp byte [rbx + 0x1fae], 0
jne 0x140040090
mov r9d, dword [rbx + 0x2fec]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140034830
test dil, 1
je 0x1400401ae
jmp 0x140040118
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2fec]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14011b294]
mulss xmm1, dword [0x14011b284]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x130]
addss xmm1, dword [rbx + 0x134]
mov qword [rbx + 0x1b48], rax
mov dword [rbx + 0x1b34], 1
movss dword [rbx + 0x1b40], xmm0
movss dword [rbx + 0x1b44], xmm1
movss xmm0, dword [rbx + 0x166c]
mulss xmm0, dword [0x14011b1bc]
or dword [rbx + 0x1b30], 0x41
movss dword [rbx + 0x1b90], xmm0
call fcn.140034830
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140040168
lea r11, [0x1401080d0]
cmp r9b, 0x23
jne 0x14004014b
cmp byte [r8], r9b
jne 0x14004014b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140040138
not ecx
call fcn.14003a270
test rax, rax
je 0x1400401ae
cmp byte [rax + 0x7e], 0
je 0x1400401ae
mov byte [rax + 0x85], 1
lea r8, [0x140107590]
mov dword [rax + 0x9c], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fec]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x2fec]
call fcn.140034830
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14003c960
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ab310
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret