joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400141d0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.140014330
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140038008]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x14003cac0]
test eax, eax
je 0x140014205
test eax, eax
jg 0x14001424d
jmp 0x140014282
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.1400124d0
test al, al
je 0x14001430a
lea rcx, [rsp + 0x20]
call fcn.14001aeb0
movsxd rcx, dword [0x14003cac0]
lea rdx, [0x140041b40]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003cac0], eax
test eax, eax
jle 0x140014282
lea rdi, [0x140041b40]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001bb00
test eax, eax
je 0x1400142eb
inc rbx
movsxd rax, dword [0x14003cac0]
add rdi, 8
cmp rbx, rax
jl 0x140014260
mov rcx, rsi
call fcn.14001bb38
cmp rax, 2
jne 0x140014299
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x1400142ed
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400142b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x1400142ed
cmp dword [0x14003cac0], 0x3ff
jg 0x1400142ed
mov rcx, rsi
call fcn.14001aeb0
movsxd rcx, dword [0x14003cac0]
lea rdx, [0x140041b40]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003cac0], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140014390
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, str._HOME_
call fcn.140013720
int3

Function at 0x140014b44
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140014b8e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140014b8e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140014b8e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140014b8e
cmp dword [rcx + 0x84], 0xe
jbe 0x140014b8e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140014b90
xor al, al
add rsp, 0x28
ret
Function at 0x140019d70
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019eb8
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019f27
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019f27
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019f27
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019f27
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019f27
cmp dword [rcx + 0x84], 0xe
jbe 0x140019f27
cmp dword [rcx + 0xf8], 0
je 0x140019f27
mov ecx, ebx
call fcn.140019df0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001a04c
nop
cmp dword [rbp + 0x20], 0
je 0x140019f75
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019e84
int3

Function at 0x14001bfc0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001bfe8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001bfe8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140021844
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400218cb
mov rsi, rbx
cmp word [rax], bp
je 0x14002188a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140021874
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140021870
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001ec88
mov rdi, rax
test rax, rax
je 0x1400218b8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140015390
mov rbp, rdi
xor ecx, ecx
call fcn.14001dd38
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140025530
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140025546
mov al, 1
jmp 0x1400255a6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140025557
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400255a4
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400218e0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400255a4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400255a4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400255a4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400255a6
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1800026b0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1800ce040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x1800d1758], 0
jne 0x1800026d8
call fcn.180029950
mov rcx, qword [0x1800d1790]
lea rdx, [rsp + 0x28]
mov rdi, qword [0x1800d1670]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm1
movss dword [rdi + 0x14], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rsp + 0x40]
xorps xmm1, xmm1
mov rax, rcx
xorps xmm0, xmm0
sub rax, qword [0x1800d1798]
cvtsi2ss xmm0, qword [0x1800d17a0]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x18], xmm1
mov qword [0x1800d1798], rcx
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x148], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x149], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [0x1800d1670]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x14b], 0
mov byte [rdi + 0x14a], al
cmp byte [rcx + 0x3a3], 0
lea rbx, [rcx + 0x130]
je 0x1800027eb
cvttss2si eax, dword [rbx]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], eax
cvttss2si eax, dword [rcx + 0x134]
mov rcx, qword [0x1800d1790]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000285c
mov rdx, qword [0x1800d1790]
cmp rax, rdx
je 0x18000281c
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x18000285c
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x18000285c
mov rcx, qword [0x1800d1790]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x18000285c
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc8], 0
je 0x18000286c
mov eax, 0xffffffff
jmp 0x180002879
mov rax, qword [0x1800d1670]
mov eax, dword [rax + 0x1e90]
cmp dword [0x1800cf728], eax
je 0x18000288c
mov dword [0x1800cf728], eax
call fcn.180029db0
call fcn.18000b410
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180053700
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180007730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000778d
lea rbx, [0x1800ba340]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180007774
cmp r10, 2
jb 0x180007774
cmp byte [r9], r8b
jne 0x180007774
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180007750
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800077cf
lea rbx, [0x1800ba340]
cmp r8b, 0x23
jne 0x1800077b3
cmp byte [r9], r8b
jne 0x1800077b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800077a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800079b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800079ca
mov qword [r8], 0
lea rdx, [0x1800be698]
call fcn.1800077e0
mov rbx, rax
test rax, rax
jne 0x1800079ea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.18005d59c
mov esi, eax
cmp eax, 0xffffffff
je 0x180007ab8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18005e06c
test eax, eax
jne 0x180007ab8
mov rcx, rbx
call fcn.18005d59c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180007ab8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18005e06c
test eax, eax
jne 0x180007ab8
cmp rdi, 0xffffffffffffffff
je 0x180007ab8
mov rax, qword [0x1800d1670]
test rax, rax
je 0x180007a5a
inc dword [rax + 0x3bc]
mov rcx, rdi
call fcn.180064410
mov rsi, rax
test rax, rax
je 0x180007ab8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18005ede0
mov rcx, rbx
cmp rax, rdi
je 0x180007aa6
call fcn.18005dd84
mov rax, qword [0x1800d1670]
test rax, rax
je 0x180007a9c
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.18005eb6c
jmp 0x180007ac0
call fcn.18005dd84
test r14, r14
je 0x180007ab3
mov qword [r14], rdi
mov rax, rsi
jmp 0x180007ac2
mov rcx, rbx
call fcn.18005dd84
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000be90
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x1800be5bd]
mov dword [rsp + 0x2c], eax
lea r11, [0x1800ba340]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x18000bee3
cmp byte [r8], r9b
jne 0x18000bee3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18000bed0
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x1800187e0]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x180018890]
mov qword [rsp + 0x38], rax
lea rax, [0x180018970]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18000bfe3
inc edi
test ecx, ecx
je 0x18000bf4f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18000bf54
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18000bfe3
mov rax, qword [0x1800d1670]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18000bf78
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call fcn.180064410
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x18000bfd1
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.18007e290
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18000bfcc
mov rax, qword [0x1800d1670]
test rax, rax
je 0x18000bfcc
dec dword [rax + 0x3bc]
call fcn.18005eb6c
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18000d4d0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000d520
lea r11, [0x1800ba340]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000d503
cmp byte [r8], r9b
jne 0x18000d503
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000d4f0
mov rcx, qword [0x1800d1670]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000d581
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000d579
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000d57c
mov rdx, r8
test rdx, rdx
jne 0x18000d550
cmp r9, r10
je 0x18000d590
cmp dword [r9], eax
jne 0x18000d590
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180012a10
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d1670]
lea rdx, [0x1800ba340]
mov r8, rcx
mov rsi, qword [rax + 0x1a18]
lea rbx, [rsi + 0xc0]
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rsi + 0xc4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180012b18
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180012b04
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180012b09
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180019ba0
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180012b40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d1670]
lea rdx, [0x1800ba340]
mov r8d, ecx
mov rsi, qword [rax + 0x1a18]
lea rbx, [rsi + 0xc0]
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rsi + 0xc4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180012bff
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180012beb
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180012bf0
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180019ba0
movsxd rcx, dword [rbx]
mov rax, qword [rsi + 0xc8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180018440
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x1800d1670]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x18001847e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x180018475
test r13, r13
je 0x18001848a
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call fcn.180064410
mov r8, rbx
mov qword [rsp + 0x58], rax
mov rdx, rdi
mov rcx, rax
mov rsi, rax
lea r12, [rax + rbx]
call fcn.18007e290
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x180018653
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x180018696
cmp al, 0xd
je 0x180018696
mov rbx, rcx
cmp rcx, r12
jae 0x180018503
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x180018503
cmp al, 0xd
je 0x180018503
inc rbx
cmp rbx, r12
jb 0x1800184f0
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x180018637
cmp al, 0x5b
jne 0x18001861e
cmp rbx, rcx
jbe 0x18001861e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x18001861e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call fcn.18007ecd0
mov r15, rax
test rax, rax
je 0x180018637
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call fcn.18007ecd0
mov r11, rax
test rax, rax
je 0x180018637
mov r10, qword [0x1800d1670]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x1800185ca
cmp r9b, 0x23
jne 0x1800185a7
cmp byte [r8], r9b
jne 0x1800185a7
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x1800ba340]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x180018595
mov r8d, dword [r10 + 0x2f10]
xor eax, eax
not ecx
test r8d, r8d
jle 0x1800185f4
mov r9, qword [r10 + 0x2f18]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x1800185fa
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x1800185e5
xor edi, edi
xor ebp, ebp
jmp 0x180018637
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x1800185f6
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x180018637
test rdi, rdi
je 0x180018637
test rbp, rbp
je 0x180018637
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x1800184d0
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x18001867e
mov rax, qword [0x1800d1670]
test rax, rax
je 0x18001867e
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.18005eb6c
mov byte [r13 + 0x2ef4], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x1800184d0
Function at 0x180023b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x180023d21
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x180023c00
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.180023550
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.180022ba0
mov dword [rbx + 0x80], 0
jmp 0x180023d0d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.180021a70
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180045090
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1800ce040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x1800450df
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x1800d19c0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x18004511d
cmp rsi, r14
jb 0x180045115
cmp rsi, r15
jae 0x180045115
cmp qword [rsi + 8], 0
jne 0x1800452e7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180045100
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x1800451b2
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x1800451a9
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800451a9
cmp dword [rsp + 0x40], 0x10000
je 0x18004522b
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x1800451a9
sub rbx, rbp
cmp rbx, r14
jae 0x180045170
test rsi, rsi
jne 0x180045290
cmp rdi, r15
ja 0x1800452cf
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x1800452cf
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800452cf
cmp dword [rsp + 0x40], 0x10000
je 0x180045261
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x1800451e2
jmp 0x1800452cf
test rbx, rbx
je 0x1800451a9
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180045290
cmp rbx, r14
jae 0x180045150
jmp 0x1800451b2
test rdi, rdi
je 0x1800452cf
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180045290
cmp rdi, r15
jbe 0x1800451c0
jmp 0x1800452cf
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x1800452a0
mov rax, qword [0x1800d19c0]
mov qword [rsi], rax
mov qword [0x1800d19c0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180053700
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret