joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019264
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x480
mov rax, qword [0x140027098]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
cmp qword [0x140027f98], 0xffffffffffffffff
mov r8d, 0x104
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
lea rdi, str.unknown
je 0x1400193e5
cmp qword [0x140029830], rbx
je 0x1400193e5
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1400192e1
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x208
call fcn.140010880
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x50]
call fcn.140016388
test eax, eax
jns 0x140019301
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebx
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x260]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x14001932d
lea rcx, [rsp + 0x260]
xor edx, edx
mov r8d, 0x208
call fcn.140010880
xor ecx, ecx
call fcn.140019d2c
lea rdx, str._Logging_started:__S_
mov ecx, 1
mov r8, rax
call fcn.140019144
mov r11d, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x44]
movzx ecx, r11w
movzx eax, r9w
lea rdx, [rsp + 0x260]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], ecx
shr r11d, 0x10
mov dword [rsp + 0x28], r11d
lea r8, [rsp + 0x50]
lea rdx, str.Executable:__S_v_d._d._d._d_r_nComputer__:__S
mov ecx, 1
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.140019144
mov r11d, dword [0x140027fa0]
test r11d, r11d
je 0x1400193c8
dec r11d
je 0x1400193bf
dec r11d
je 0x1400193b6
dec r11d
jne 0x1400193cf
lea rdi, str.debug
jmp 0x1400193cf
lea rdi, str.verbose
jmp 0x1400193cf
lea rdi, str.standard
jmp 0x1400193cf
lea rdi, str.none
lea rdx, str.____logging_level:__s____
mov r8, rdi
mov ecx, 1
call fcn.140019144
jmp 0x1400193ea
mov ebx, 1
mov eax, ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140010528
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140019434
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], r8
push rbp
mov rbp, rsp
push rdi
push r14
sub rsp, 0x50
lea rax, [r11 + 0x18]
xor ebx, ebx
mov r8d, edx
and qword [r11 - 0x20], rbx
and dword [rsp + 0x40], ebx
mov qword [r11 - 0x38], rax
and dword [rsp + 0x28], ebx
lea rax, [r11 - 0x20]
mov r14d, r9d
mov rdx, rcx
xor r9d, r9d
mov ecx, 0x900
mov qword [r11 - 0x48], rax
xor edi, edi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov esi, eax
test eax, eax
jne 0x1400194a7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019536
test esi, esi
je 0x1400194f4
mov rcx, qword [0x140027f98]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x40]
sub r8d, edi
add rdx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400194ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019536
add edi, dword [rsp + 0x40]
cmp edi, esi
jb 0x1400194ab
test r14d, r14d
je 0x140019536
mov rdx, qword [0x140027fa8]
mov rcx, qword [0x140027f98]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140019536
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140019546
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret

Function at 0x14001955c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rbp
mov rbp, rsp
push rdi
push r14
sub rsp, 0x40
and qword [rax - 0x28], 0
mov r14d, r8d
mov r8, rdx
mov rdx, rcx
lea rcx, [rax - 0x28]
xor edi, edi
and dword [rax + 0x20], edi
call fcn.140015f8c
mov ebx, eax
test eax, eax
js 0x140019634
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test eax, eax
je 0x1400195f2
mov rcx, qword [0x140027f98]
and qword [rsp + 0x20], 0
mov r8d, esi
mov edx, edi
lea r9, [rsp + 0x78]
sub r8d, edi
add rdx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400195ea
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019634
add edi, dword [rsp + 0x78]
cmp edi, esi
jb 0x1400195a9
test r14d, r14d
je 0x140019634
mov rdx, qword [0x140027fa8]
mov rcx, qword [0x140027f98]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140019634
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140019643
call fcn.140016048
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140019a84
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x10050
call fcn.140010958
sub rsp, rax
mov rax, qword [0x140027098]
xor rax, rsp
mov qword [rbp - 0x40], rax
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
xor ebx, ebx
cmp qword [0x140029838], rbx
mov r15, r9
mov r14, r8
mov edi, edx
mov rsi, rcx
mov r13d, 0x80070000
jne 0x140019b08
mov eax, dword [0x140029840]
lea r9d, [rbx + 1]
lea rcx, [0x140029838]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140019b08
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019bcd
mov rcx, qword [0x140029838]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x140019b4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019bcd
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r8d, 0x10000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140019b84
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019bcd
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
test r8d, r8d
je 0x140019ba3
lea rdx, [rsp + 0x40]
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
jmp 0x140019b2f
xor ebx, ebx
mov r9, r15
mov r8, r14
and dword [rsp + 0x20], ebx
lea edx, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x140019bcd
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r13d
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140019bdd
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, ebx
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.140010528
add rsp, 0x10050
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140019c00
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov rdi, rdx
xor ebx, ebx
and qword [r11 - 0x10], rbx
lea r9, [r11 + 0x20]
xor r8d, r8d
mov edx, 0x20000005
mov qword [r11 - 0x18], rax
mov dword [rsp + 0x50], 4
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140019c5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019c61
mov ecx, dword [rsp + 0x58]
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret
Function at 0x140019c74
Capabilities:
Read http header

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140027098]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov rdi, rdx
lea r9, [r11 - 0x20]
and qword [r11 - 0x30], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea rax, [r11 - 0x28]
xor r8d, r8d
mov edx, 0x4000000b
xor ebx, ebx
mov dword [rsp + 0x30], 0x10
mov qword [r11 - 0x38], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140019ce7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140019d0d
lea rcx, [rsp + 0x38]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x140019d0d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140010528
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x140002cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002d36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002d36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002d36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002d36
cmp dword [rcx + 0x84], 0xe
jbe 0x140002d36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002d38
xor al, al
add rsp, 0x28
ret
Function at 0x180001160
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18003f040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
cmp edx, 1
je 0x180001192
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180032390
add rsp, 0x60
pop rbx
ret
mov ecx, 8
call fcn.1800323b0
lea rcx, [0x180032220]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180001280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180001241
cmp dword [rsp + 0x38], 0
je 0x180001235
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x180001235
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
nop
cmp dword [rsp + 0x38], 0
je 0x18000121d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180032390
add rsp, 0x60
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180002870
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800028cd
lea rbx, [0x1800348f0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800028b4
cmp r10, 2
jb 0x1800028b4
cmp byte [r9], r8b
jne 0x1800028b4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002890
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000290f
lea rbx, [0x1800348f0]
cmp r8b, 0x23
jne 0x1800028f3
cmp byte [r9], r8b
jne 0x1800028f3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800028e0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180006b10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x18003469d]
mov dword [rsp + 0x2c], eax
lea r11, [0x1800348f0]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x180006b63
cmp byte [r8], r9b
jne 0x180006b63
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180006b50
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180012440]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1800124f0]
mov qword [rsp + 0x38], rax
lea rax, [0x1800125d0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180006c65
inc edi
test ecx, ecx
je 0x180006bcf
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180006bd4
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180006c65
mov rax, qword [0x18003fae8]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x180006bf8
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x180006c53
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x180006c4d
mov rax, qword [0x18003fae8]
test rax, rax
je 0x180006c4d
dec dword [rax + 0x3bc]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x180008090
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x1800080e0
lea r11, [0x1800348f0]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800080c3
cmp byte [r8], r9b
jne 0x1800080c3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800080b0
mov rcx, qword [0x18003fae8]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180008141
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180008139
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000813c
mov rdx, r8
test rdx, rdx
jne 0x180008110
cmp r9, r10
je 0x180008150
cmp dword [r9], eax
jne 0x180008150
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x18000d410
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x18003fae8]
lea rdx, [0x1800348f0]
mov r8d, ecx
mov rbx, qword [rax + 0x1a18]
add rbx, 0xc0
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x18000d4c7
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18000d4b3
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x18000d4b8
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180013670
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180011c30
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18003fae8]
cmp byte [rbx + 0x2f30], 0
je 0x180011d1c
cmp qword [rbx + 0x2f38], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f40]
je 0x180011d04
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x180011cab
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800134b0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.180002ff0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2f38]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f48]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x18003fae0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180002ff0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x1800120a0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18003fae8]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x1800120de
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1800120d5
test r13, r13
je 0x1800120ea
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x1800122b3
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x1800122f7
cmp al, 0xd
je 0x1800122f7
mov rbx, rcx
cmp rcx, r12
jae 0x180012163
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x180012163
cmp al, 0xd
je 0x180012163
inc rbx
cmp rbx, r12
jb 0x180012150
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x180012297
cmp al, 0x5b
jne 0x18001227e
cmp rbx, rcx
jbe 0x18001227e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x18001227e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x180012297
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x180012297
mov r10, qword [0x18003fae8]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x18001222a
cmp r9b, 0x23
jne 0x180012207
cmp byte [r8], r9b
jne 0x180012207
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x1800348f0]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x1800121f5
mov r8d, dword [r10 + 0x2f10]
xor eax, eax
not ecx
test r8d, r8d
jle 0x180012254
mov r9, qword [r10 + 0x2f18]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x18001225a
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x180012245
xor edi, edi
xor ebp, ebp
jmp 0x180012297
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x180012256
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x180012297
test rdi, rdi
je 0x180012297
test rbp, rbp
je 0x180012297
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x180012130
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x1800122de
mov rax, qword [0x18003fae8]
test rax, rax
je 0x1800122de
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2ef4], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x180012130
Function at 0x180012300
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x18003fae8]
xor r15d, r15d
mov r14, rcx
mov dword [rbx + 0x2ef8], r15d
test rcx, rcx
je 0x18001242b
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 0x2f00]
mov dword [rbx + 0x2ef8], r15d
mov ecx, dword [rdi + 4]
test ecx, ecx
jns 0x180012364
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.1800134b0
mov dword [rdi], r15d
cmp dword [rdi + 4], r15d
jne 0x18001237a
mov edx, 8
mov rcx, rdi
call fcn.1800134b0
movsxd rcx, dword [rdi]
mov ebp, r15d
mov rax, qword [rdi + 8]
mov byte [rcx + rax], r15b
inc dword [rdi]
cmp dword [rbx + 0x2f10], r15d
jle 0x1800123c5
mov rsi, r15
nop word [rax + rax]
mov r9, qword [rbx + 0x2f18]
mov r8, rdi
add r9, rsi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rbx + 0x2f10]
jl 0x1800123a0
mov eax, dword [rdi]
lea rdx, [0x180034754]
test eax, eax
lea rdi, [0x18003fae0]
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f08]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.180002920
mov rbp, qword [rsp + 0x40]
mov rbx, rax
test rax, rax
je 0x180012421
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret