joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b1070
Capabilities:
Read file via mapping

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp dword [r8], 0
jle 0x1402b10af
xor eax, eax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
cmp ecx, 0x8007000e
jne 0x1402b107f
mov dword [rsi], 7
jmp 0x1402b107f
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
call fcn.1400ed570
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000080
mov dword [rsp + 0x20], 3
mov rcx, rbx
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x1402b108b
mov r14, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov rcx, rax
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x1402b108b
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rdi + 8], rax
test rax, rax
je 0x1402b1161
mov qword [rdi + 0x28], rbx
mov al, 1
jmp 0x1402b1081
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1402b107f

Function at 0x1402b4970
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1403ba93c]
mov ecx, dword [0x1403adeec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1402b49d0
cmp rdi, rsi
je 0x1402b49cc
mov eax, 0xffffffff
lea rcx, [0x1403ba53c]
mov dl, byte [rdi]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [rcx + rdx*4]
inc rdi
cmp rdi, rsi
jne 0x1402b49ae
not eax
add rsp, 0x28
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1402b49c5
lea rcx, [0x1403ba93c]
call fcn.1401a10c0
cmp dword [0x1403ba93c], 0xffffffff
jne 0x1402b499d
call fcn.1402b4a00
lea rcx, [0x1403ba93c]
call fcn.1401a1158
jmp 0x1402b499d
Function at 0x1402b4a00
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rsi, [0x1403ba53c]
mov r8d, 0x400
mov rcx, rsi
mov dl, 0xaa
call fcn.1401a48a0
mov dl, 1
xor ecx, ecx
mov eax, 0xedb88320
test dl, 1
je 0x1402b4af7
mov r9d, ecx
shl r9d, 0x1e
sar r9d, 0x1f
and r9d, eax
mov r8d, ecx
and r8d, 1
neg r8d
and r8d, eax
mov edx, ecx
shr edx, 1
xor edx, r8d
mov r8d, edx
shr r8d, 1
xor r8d, r9d
mov r9d, r8d
shl r9d, 0x1a
sar r9d, 0x1f
and r9d, eax
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
mov r10d, ecx
shl r10d, 0x1a
sar r10d, 0x1f
and r10d, 0x3b6e20c8
mov r11d, ecx
shl r11d, 0x1b
sar r11d, 0x1f
and r11d, 0x1db71064
mov edi, ecx
shl edi, 0x1c
sar edi, 0x1f
and edi, 0xedb8832
mov ebx, ecx
shl ebx, 0x1d
sar ebx, 0x1f
and ebx, 0x76dc419
xor ebx, edi
xor ebx, r11d
xor ebx, r10d
shr r8d, 6
xor r8d, ebx
xor r8d, edx
xor r8d, r9d
mov dword [rsi], r8d
cmp rcx, 0xff
lea r8, [rcx + 1]
setb dl
add rsi, 4
mov rcx, r8
cmp r8, 0x100
jne 0x1402b4a27
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
lea rax, str.out_of_bounds_access_in_std::array_T__N_
mov qword [rsp + 0x20], rax
lea rcx, str._s:_d:_assertion__s_failed:__s
lea rdx, str....._buildtools_third_partylibc_trunkinclude_array
lea r9, str.__n____Size
mov r8d, 0xe3
call fcn.1401e43d0
int3

Function at 0x1402c1d00
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14039c038]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
add rsi, rdi
xor r15d, r15d
lea r14, [rsp + 0x2c]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1402c1d4e
mov rdx, rcx
add rdi, rdx
cmp al, 1
je 0x1402c1d8c
cmp rdi, rsi
jae 0x1402c1d8c
mov dword [rsp + 0x2c], 0
mov r8d, esi
sub r8d, edi
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r9, r14
call r12
test eax, eax
sete dl
mov ecx, dword [rsp + 0x2c]
test rcx, rcx
sete al
or al, dl
mov edx, 0
jne 0x1402c1d47
jmp 0x1402c1d44
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401a2750
nop
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1402cf880
Capabilities:
Parse pe header

Disassembly:
cmp rdx, 0x40
jb 0x1402cf8ce
cmp byte [rcx], 0x4d
jne 0x1402cf8ce
cmp byte [rcx + 1], 0x5a
jne 0x1402cf8ce
mov r9d, dword [rcx + 0x3c]
mov r10, rdx
sub r10, r9
xor eax, eax
cmp r10, 0x18
jb 0x1402cf8d0
cmp r9, rdx
jae 0x1402cf8d0
cmp r9d, 0x40
jb 0x1402cf8d0
mov r10d, r9d
and r10d, 7
jne 0x1402cf8d0
cmp byte [rcx + r9], 0x50
jne 0x1402cf8ce
cmp byte [rcx + r9 + 1], 0x45
jne 0x1402cf8ce
cmp byte [rcx + r9 + 2], 0
je 0x1402cf8d1
xor eax, eax
ret
cmp byte [rcx + r9 + 3], 0
jne 0x1402cf8ce
add r9, 0x18
xor eax, eax
sub rdx, r9
jbe 0x1402cf8d0
cmp rdx, 2
jb 0x1402cf8d0
cmp word [rcx + r9], r8w
sete al
jmp 0x1402cf8d0
Function at 0x1402dfd80
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14039c038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402dfde0
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a2750
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1402ece70
Capabilities:
Decompress data using quicklz

Disassembly:
mov r8d, dword [rdx]
mov eax, r8d
and eax, 0xf800d000
cmp eax, 0xf0008000
sete al
mov r9d, r8d
not r9d
test r9d, 0x3c00000
setne r9b
and r9b, al
test cl, 1
sete r10b
lea eax, [rcx + 0x100000]
cmp eax, 0x200000
setb al
and al, r10b
and al, r9b
cmp al, 1
jne 0x1402ecf0e
mov r9d, ecx
shr r9d, 1
and r9d, 0x7ff
and r8d, 0xfbc0d000
mov r10d, ecx
shl r10d, 6
and r10d, 0x4000000
mov r11d, ecx
shl r11d, 4
and r11d, 0x3f0000
or r11d, r10d
mov r10d, ecx
shr r10d, 5
and r10d, 0x2000
or r10d, r11d
shr ecx, 8
and ecx, 0x800
or ecx, r10d
or ecx, r9d
or ecx, r8d
mov dword [rdx], ecx
ret

Function at 0x1402ecfa0
Capabilities:
Decompress data using quicklz

Disassembly:
mov eax, edx
or eax, ecx
test al, 1
je 0x1402ecfab
xor eax, eax
ret
sub edx, ecx
mov eax, edx
and eax, 1
lea ecx, [rdx + rax]
add ecx, 0xfffffffc
mov rdx, r8
jmp fcn.1402ece70
Function at 0x1402f0c40
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039c038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14032ae20]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e1f90
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402f54b0
test al, al
je 0x1402f0d95
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402f0d0d
mov rcx, r14
call fcn.1401e1f90
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402f54b0
test al, al
je 0x1402f0d56
cmp dword [rbx], 0x4550
jne 0x1402f0dc6
mov sil, 1
test rdi, rdi
je 0x1402f0da5
mov qword [rdi], r14
jmp 0x1402f0da5
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0da3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402f0e3a
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0da3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402f0e34
mov ecx, 1
call fcn.140151850
test al, al
jne 0x1402f0e08
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401a2750
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0da3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402f0e3a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401e2360
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402f0e4f
and r8d, 0x7f
jmp 0x1402f0e56
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401e2360
mov rcx, rdi
call fcn.140088400
jmp 0x1402f0da3
Function at 0x1402f0e70
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14039c038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14032ae20]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401e1f90
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.1402f54b0
test al, al
je 0x1402f0fc5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402f0f3d
mov rcx, r14
call fcn.1401e1f90
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.1402f54b0
test al, al
je 0x1402f0f86
cmp dword [rbx], 0x4550
jne 0x1402f0ff6
mov sil, 1
test rdi, rdi
je 0x1402f0fd5
mov qword [rdi], r14
jmp 0x1402f0fd5
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0fd3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1402f106a
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0fd3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1402f1064
mov ecx, 1
call fcn.140151850
test al, al
jne 0x1402f1038
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401a2750
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140151850
test al, al
je 0x1402f0fd3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1402f106a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140087f20
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401e2360
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402f107f
and r8d, 0x7f
jmp 0x1402f1086
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401e2360
mov rcx, rdi
call fcn.140088400
jmp 0x1402f0fd3
Function at 0x180001190
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x150
xor edx, edx
mov rsi, rcx
mov dword [rsp + 0x20], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800011ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.180002c64
lea rdx, str.Failed_to_create_process_snapshot:__d_n
lea rcx, [rax + 0x60]
mov r8d, ebx
call fcn.180002e78
xor eax, eax
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rsi
ret
lea rdx, [rsp + 0x20]
mov rcx, rax
mov qword [rsp + 0x160], rdi
xor edi, edi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180001239
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.180019528
test eax, eax
je 0x180001235
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180001210
jmp 0x180001239
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x168]
mov eax, edi
mov rdi, qword [rsp + 0x160]
add rsp, 0x150
pop rsi
ret
Function at 0x1800131ac
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x180026358]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800064f0
xor ebx, ebx
cmp qword [0x180027048], rbx
mov rdi, rax
jne 0x1800132bf
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x180013396
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180013396
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x180027048], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x180027050], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x180027058], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x180027068], rax
test rax, rax
je 0x1800132b6
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x180027060], rax
jmp 0x1800132c6
mov rax, qword [0x180027060]
jmp 0x1800132cd
mov rax, qword [0x180027060]
mov r11, qword [0x180027068]
cmp rax, rdi
je 0x180013334
cmp r11, rdi
je 0x180013334
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x180027068]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180013334
test rax, rax
je 0x180013334
call rsi
test rax, rax
je 0x18001332e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18001332e
test byte [rsp + 0x40], 1
jne 0x180013334
bts ebp, 0x15
jmp 0x180013374
mov rcx, qword [0x180027050]
cmp rcx, rdi
je 0x180013374
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013374
call rax
mov rbx, rax
test rax, rax
je 0x180013374
mov rcx, qword [0x180027058]
cmp rcx, rdi
je 0x180013374
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013374
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x180027048]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x180013396
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x180013398
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18000a0a0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180016aeb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x180026358]
jne 0x18000a0ba
rol rcx, 0x10
test cx, 0xffff
jne 0x18000a0b6
repz ret
ror rcx, 0x10
jmp 0x180016a44
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x180027120]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x180027218]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180016ac9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x180027120]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180016aeb
mov rax, qword [rsp + 0x88]
mov qword [0x180027218], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1800271b8], rax
mov rax, qword [0x180027218]
mov qword [0x180027090], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1800271a0], rax
mov dword [0x180027080], 0xc0000409
mov dword [0x180027084], 1
mov rax, qword [0x180026358]
mov qword [rsp + 0x68], rax
mov rax, qword [0x180026360]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x180027118], eax
mov ecx, 1
call fcn.18000a0c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18001fba0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x180027118], 0
jne 0x180016b72
mov ecx, 1
call fcn.18000a0c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140007800
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000785d
lea rbx, [0x140042e20]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140007844
cmp r10, 2
jb 0x140007844
cmp byte [r9], r8b
jne 0x140007844
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140007820
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000789f
lea rbx, [0x140042e20]
cmp r8b, 0x23
jne 0x140007883
cmp byte [r9], r8b
jne 0x140007883
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140007870
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400079a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1400079be
mov qword [r8], r14
lea rdx, [0x1400483f0]
call fcn.1400078b0
mov rbx, rax
test rax, rax
jne 0x1400079e3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140007b0d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140007b0d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140007b0d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140007b0d
cmp rdi, 0xffffffffffffffff
je 0x140007b0d
mov rcx, rdi
call fcn.14000c050
mov rbp, rax
test rax, rax
je 0x140007b0d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140007afa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x140051840]
test r8, r8
je 0x140007aef
movsx rdx, word [r8 + 0x60a8]
lea rcx, [r8 + 0x60ac]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140007ae4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60a8], cx
movsx rax, cx
lea rcx, [r8 + 0x60ac]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60a4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140007b16
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140007b08
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140007b18
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000b810
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140042e20]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x14000b8a6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001f1f0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b8b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x140042e20]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret