joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090290
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400902a8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400902b0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x1400902c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14009030d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140090304
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14009030f
add rax, 0x28
cmp rax, r9
jne 0x1400902f0
xor eax, eax
ret

Function at 0x140090310
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400903a0
mov rdx, qword [0x1400bf3e0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14009038e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14009038e
cmp word [rax + 0x18], 0x20b
jne 0x14009038e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400903a0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140090379
add rbx, 0x28
cmp rbx, rdi
je 0x1400903a0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140090370
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400903b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400bf3e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400903d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400903d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400903d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14009042d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140090424
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400903d0
add rax, 0x28
cmp rax, r9
jne 0x140090410
xor eax, eax
ret

Function at 0x140090430
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bf3e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14009044f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140090458
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14009044f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140090470
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400bf3e0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140090490
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140090498
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140090490
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400904e0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400904d7
test rcx, rcx
je 0x140090490
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400904c8
xor eax, eax
ret

Function at 0x1400904f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bf3e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14009050f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140090518
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140090530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400bf3e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140090550
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140090558
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140090550
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140090550
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400905a4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400905b0
add rdx, 0x28
cmp rdx, r9
jne 0x140090590
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400905c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400bf3e0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400905e2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400905f0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400905e2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400905e2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400905e2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140090645
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140090658
add rdx, 0x28
cmp r10, rdx
jne 0x140090630
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140090667
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140090677
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14009064e
test ecx, ecx
jg 0x140090660
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140008188
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x14000d868], rdi
je 0x1400081e8
cmp rax, rdi
jne 0x1400081db
mov r12d, 1
jmp 0x1400081e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400081c1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x1400081fd
lea ecx, [rax + 0x1e]
call fcn.14014a000
jmp 0x140008264
mov eax, dword [0x14000d860]
cmp eax, ebx
jne 0x14000825a
mov dword [0x14000d860], 1
lea r13, [0x140001548]
lea rdi, [0x140001530]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x14000824c
cmp eax, ebx
jne 0x14000824c
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x140008241
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000822a
cmp eax, ebx
je 0x140008264
mov eax, 0xff
jmp 0x1400083ac
mov dword [0x14000b554], 1
mov eax, dword [0x14000d860]
cmp eax, 1
jne 0x14000828c
lea rdx, [0x140001528]
lea rcx, [0x1400014b8]
call sub.msvcrt.dll__initterm
mov dword [0x14000d860], 2
cmp r12d, ebx
jne 0x14000829b
mov rax, rbx
xchg qword [0x14000d868], rax
cmp qword [0x14000d870], rbx
je 0x1400082c3
lea rcx, [0x14000d870]
call fcn.14000862c
cmp eax, ebx
je 0x1400082c3
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x14000d870]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1400082d9
mov eax, 0xff
jmp 0x1400083ac
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x14000835e
cmp word [rcx], bx
je 0x1400082f4
cmp edx, ebx
jne 0x14000835e
cmp word [rcx], bx
je 0x14000830a
cmp word [rcx], 0x20
ja 0x14000830a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082f4
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003b3c
mov dword [0x14000b550], eax
cmp dword [0x14000b534], ebx
jne 0x140008348
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b554], ebx
jne 0x14000835c
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b550]
jmp 0x1400083ac
cmp word [rcx], 0x22
jne 0x140008371
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400082e5
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1400087ec
add rsp, 0x28
jmp 0x140008188
Function at 0x140004db0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140004e0d
lea rbx, [0x14005cd90]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140004df4
cmp r10, 2
jb 0x140004df4
cmp byte [r9], r8b
jne 0x140004df4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140004dd0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140004e4f
lea rbx, [0x14005cd90]
cmp r8b, 0x23
jne 0x140004e33
cmp byte [r9], r8b
jne 0x140004e33
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004e20
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004f90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140004faa
mov qword [r8], 0
lea rdx, [0x14005cae4]
call fcn.140004e60
mov rbx, rax
test rax, rax
jne 0x140004fca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400050a1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400050a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400050a1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400050a1
cmp rdi, 0xffffffffffffffff
je 0x1400050a1
mov rax, qword [0x140072268]
test rax, rax
je 0x14000503e
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400050a1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000508e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140072268]
test rax, rax
je 0x140005083
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400050aa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000509c
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400050ac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140007320
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x14005cd90]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x140072268]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3e84], ebx
jne 0x1400073ad
mov dword [rax + 0x3e88], ebx
cmp dword [rax + 0x3ed0], ebx
jne 0x1400073bc
mov byte [rax + 0x3ed4], 1
cmp dword [rax + 0x3e6c], ebx
jne 0x1400073d3
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140019b10
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400073e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm2, dword [rcx + 0xe8]
lea r8, [0x14005cd90]
movss xmm3, dword [rcx + 0xec]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xd0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xc8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
movss dword [rsp + 4], xmm1
subss xmm0, xmm2
movss xmm1, dword [rdx + 0xc]
mov edx, dword [rax + rcx*4 - 4]
subss xmm1, xmm3
movzx eax, byte [rsp]
not edx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 1]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 2]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 3]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 4]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 5]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 6]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 7]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 8]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 9]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xb]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xc]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xd]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xe]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xf]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x140072268]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x3e84], edx
jne 0x14000757f
mov dword [rax + 0x3e88], edx
cmp dword [rax + 0x3ed0], edx
jne 0x14000758e
mov byte [rax + 0x3ed4], 1
mov eax, edx
add rsp, 0x18
ret
Function at 0x140011cd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x140072268]
lea r10, [0x14005cd90]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3e38]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3e6c], edi
jne 0x140011d75
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.140019b10
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x140011da9
inc r8d
test ecx, ecx
je 0x140011d92
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140011d97
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.14001aba0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400137a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140072268]
mov edi, ecx
cmp byte [rbx + 0x41dd], 0
jne 0x140013801
cmp byte [rbx + 0x41de], 0
jne 0x140013801
movsx r9d, word [rbx + 0x52be]
lea r8, [0x14005ca68]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004d30
test dil, 1
je 0x140013928
jmp 0x14001388a
movss xmm1, dword [rbx + 0x3830]
lea r8, [0x14005ca68]
movsx r9d, word [rbx + 0x52be]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140062648]
mulss xmm1, dword [0x140062628]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f58], rax
mov dword [rbx + 0x3f44], 1
movss dword [rbx + 0x3f50], xmm0
movss dword [rbx + 0x3f54], xmm1
movss xmm0, dword [rbx + 0x389c]
mulss xmm0, dword [0x140062488]
or dword [rbx + 0x3f40], 0x41
movss dword [rbx + 0x3fa0], xmm0
call fcn.140004d30
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400138e0
lea r11, [0x14005cd90]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400138c3
cmp byte [r8], r9b
jne 0x1400138c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400138b0
not ecx
call fcn.14000c610
test rax, rax
je 0x140013928
cmp byte [rax + 0x8e], 0
je 0x140013928
mov byte [rax + 0x95], 1
lea r8, [0x14005ca68]
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52be]
mov edx, 0x10
movsx r9d, word [rbx + 0x52be]
call fcn.140004d30
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000ecf0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140059290
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140018950
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5370], 0
lea rbx, [rcx + 0x5378]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400189f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400189aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001a970
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140005690
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5370]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5380]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140072264]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400189ff
mov rcx, rbx
call fcn.140005690
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140043070
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400430a1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140072678]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140072688]
lea rdx, [rdi + rdi]
call fcn.14002f390
mov rax, qword [0x140072678]
lea r9, [rdi - 1]
mov qword [0x1400726a0], r9
mov qword [0x1400726a8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140043214
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140072688]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140043160
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400431d5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14004319d
mov r10, qword [rdx]
cmp r10, rax
je 0x140043197
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400431d5
cmp r9, rdx
je 0x1400431b1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400431e9
cmp r9, rdx
jne 0x1400431a2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14004320f
mov r9, qword [0x1400726a0]
jmp 0x140043111
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400431d5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140043950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14006b010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x140043996
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x140043986
cmp byte [rax], cl
jne 0x140043996
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x140043977
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140043afa
cmp byte [r8 + 1], dl
je 0x140043afa
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x1400439d2
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400439fa
sub dl, 0x61
cmp dl, 0x19
ja 0x1400439ec
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400439fa
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x1400439b5
jmp 0x1400439fd
inc r9
cmp r8, r9
jae 0x140043a2f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140043a24
bt rdx, rax
jb 0x140043a2a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140043a10
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140004d30
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140043a68
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140043a60
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140043ae8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140043a83
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x140043a99
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x140043ad6
movss xmm2, dword [0x140062634]
cmp al, 0x39
ja 0x140043ad6
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140043ab0
cmp r9b, 0x2d
jne 0x140043af5
xorps xmm1, xmmword [0x140062b30]
movaps xmm0, xmm1
jmp 0x140043afd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140043afd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140059290
add rsp, 0x90
pop rbx
ret