joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c940
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000c976
mov rcx, rbx
mov rdx, r14
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000c990
mov rax, qword [rbx + 0x58]
movsxd rdi, dword [rax]
test rsi, rsi
jg 0x14000c997
jmp 0x14000c9ce
xor edi, edi
test rsi, rsi
jle 0x14000c9ce
test rdi, rdi
jle 0x14000c9ce
cmp rdi, rsi
cmovg rdi, rsi
mov rdx, r14
mov r8, rdi
call fcn.140115f70
add r14, rdi
mov r15, rsi
sub r15, rdi
mov rax, qword [rbx + 0x58]
sub dword [rax], edi
mov rax, qword [rbx + 0x40]
movsxd rcx, edi
add qword [rax], rcx
test r15, r15
jg 0x14000c9d6
jmp 0x14000c9f6
mov r15, rsi
test r15, r15
jle 0x14000c9f6
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14000c9f6
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r15, rax
sub rsi, r15
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14000d020
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140279c48]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14000d0e4
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14000d0e4
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000d0e2
lea rdx, [rsi + 0x74]
lea r9, [rsp + 0x50]
mov rcx, qword [rsi + 0x68]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
test eax, eax
jle 0x14000d099
cmp eax, 3
jge 0x14000d0d4
cmp eax, 1
jne 0x14000d0e2
jmp 0x14000d0a1
test eax, eax
jne 0x14000d0e2
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14000d0ca
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000d0e2
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14000d0e4
cmp eax, 3
jne 0x14000d0e2
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14000d0e4
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c4bd0
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x140033f20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
cmp dword [0x14027ef88], 0xa
jl 0x140033f52
mov eax, dword [0x14027ef8c]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
je 0x140033f52
nop word cs:[rax + rax]
nop dword [rax]
jmp 0x140033f50
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov r10, qword [r8 + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov r9d, dword [rax + r10 + 0x88]
test r9, r9
je 0x140033f63
mov eax, dword [r10 + r9 + 0x18]
mov rdx, rax
nop word cs:[rax + rax]
nop dword [rax]
sub rdx, 1
jb 0x140033f63
mov r11d, eax
add r11d, 0xffffffff
mov eax, dword [r10 + r9 + 0x20]
add rax, r10
mov eax, dword [rax + r11*4]
add rax, r10
mov esi, 0x29a9ae37
nop word cs:[rax + rax]
nop dword [rax + rax]
mov ecx, esi
movsx ebx, byte [rax]
add rax, 1
mov edi, esi
xor edi, ebx
imul esi, edi, 0x1000193
test ebx, ebx
jne 0x140033fc0
mov rax, rdx
cmp ecx, 0x1d8f1a15
jne 0x140033f90
mov eax, dword [r10 + r9 + 0x1c]
mov ecx, dword [r10 + r9 + 0x24]
add rax, r10
add rcx, r10
movzx ecx, word [rcx + r11*2]
mov eax, dword [rax + rcx*4]
add rax, r10
call rax
movups xmm0, xmmword [0x1401ca334]
movaps xmmword [rsp + 0x20], xmm0
mov eax, dword [0x1401ca343]
mov dword [rsp + 0x2f], eax
mov byte [rsp + 0x20], 0x43
movups xmm0, xmmword [rsp + 0x21]
xorps xmm0, xmmword [str.6789:_____ABCDE]
movups xmmword [rsp + 0x21], xmm0
xor byte [rsp + 0x31], 0x46
xor byte [rsp + 0x32], 0x47
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, qword gs:[0x60]
mov r9, qword [rcx + 0x18]
add r9, 0x10
mov ecx, dword [0x14027ef90]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x14027ef94], 0xa
setl r8b
or r8b, cl
jmp 0x140034089
test r8b, r8b
je 0x140034120
mov r9, qword [r9]
mov r11, qword [r9 + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov r10d, dword [rcx + r11 + 0x88]
test r10, r10
je 0x140034080
mov esi, dword [r11 + r10 + 0x18]
mov rdx, rsi
nop dword [rax]
sub rdx, 1
jb 0x140034080
mov ecx, esi
add ecx, 0xffffffff
mov esi, dword [r11 + r10 + 0x20]
add rsi, r11
mov esi, dword [rsi + rcx*4]
add rsi, r11
mov ebx, 0x98aeda22
nop
mov edi, ebx
movsx ebp, byte [rsi]
add rsi, 1
xor ebx, ebp
imul ebx, ebx, 0x1000193
test ebp, ebp
jne 0x1400340d0
mov rsi, rdx
cmp edi, 0x2df65ce7
jne 0x1400340b0
mov edx, dword [r11 + r10 + 0x1c]
mov ebp, dword [r11 + r10 + 0x24]
add rdx, r11
add rbp, r11
movzx ecx, word [rbp + rcx*2]
mov ebp, dword [rdx + rcx*4]
add rbp, r11
mov rcx, rax
xor edx, edx
call rbp
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
jmp 0x140034120
Function at 0x14003d0c0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
not r8d
test rdx, rdx
je 0x14003d150
mov eax, dword [0x14027a7d8]
lea esi, [rax - 1]
imul esi, eax
test sil, 1
sete al
cmp dword [0x14027a7dc], 0xa
setl r9b
or r9b, al
lea r10, [0x1401ca9b0]
mov r11d, r8d
jmp 0x14003d11c
mov eax, r11d
shr eax, 8
movzx esi, r11b
xor esi, edi
xor eax, dword [r10 + rsi*4]
mov r11d, eax
test rdx, rdx
je 0x14003d1b0
mov rax, rcx
add rdx, 0xffffffffffffffff
add rcx, 1
movzx edi, byte [rax]
nop word [rax + rax]
test r9b, r9b
je 0x14003d130
cmp dil, 0x23
jne 0x14003d100
cmp rdx, 2
jb 0x14003d100
cmp byte [rcx], 0x23
jne 0x14003d100
cmp byte [rax + 2], 0x23
cmove r11d, r8d
jmp 0x14003d100
mov r10b, byte [rcx]
test r10b, r10b
je 0x14003d1ad
add rcx, 2
lea r9, [0x1401ca9b0]
mov edx, r8d
jmp 0x14003d190
movzx edi, r10b
mov eax, edx
shr eax, 8
movzx edx, dl
xor edx, edi
xor eax, dword [r9 + rdx*4]
add rcx, 1
mov r10d, r11d
mov edx, eax
test r11b, r11b
je 0x14003d1b0
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x14003d170
cmp r11b, 0x23
jne 0x14003d170
cmp byte [rcx], 0x23
cmove edx, r8d
mov r11b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x14003d170
mov eax, r8d
not eax
pop rdi
pop rsi
ret
Function at 0x14003d340
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12d, r9d
mov rsi, r8
test r8, r8
je 0x14003d360
mov qword [rsi], 0
call fcn.14003d1c0
test rax, rax
je 0x14003d39b
mov rdi, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x14003d392
mov ebx, eax
mov rcx, rdi
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x14003d3af
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x14003d392
mov r14d, eax
xor ebp, ebp
mov rcx, rdi
mov edx, ebx
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r14d
cmp ebp, 0xffffffff
je 0x14003d392
movsxd r14, ebp
movsxd r15, r12d
lea rcx, [r14 + r15]
mov rax, qword [0x1402808a8]
test rax, rax
je 0x14003d3fc
add dword [rax + 0x3bc], 1
mov rdx, qword [0x1402808b8]
call qword [0x140275378]
test rax, rax
je 0x14003d392
mov rbx, rax
mov edx, 1
mov rcx, rax
mov r8, r14
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
jne 0x14003d459
test r12d, r12d
jle 0x14003d43f
mov rcx, rbx
add rcx, r14
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14003d39d
mov qword [rsi], r14
jmp 0x14003d39d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x14027a788]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x14027a78c], 0xa
setl al
or al, cl
test al, al
je 0x14003d480
mov rax, qword [0x1402808a8]
test rax, rax
je 0x14003d497
add dword [rax + 0x3bc], 0xffffffff
mov rdx, qword [0x1402808b8]
mov rcx, rbx
call qword [0x140275380]
jmp 0x14003d39b
Function at 0x140041ec0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rdx
mov rdx, qword [rcx + 0xd0]
mov ecx, dword [rcx + 0xc8]
add ecx, 0xffffffff
movsxd rcx, ecx
mov r9d, dword [rdx + rcx*4]
mov rdx, r8
sub rdx, rax
test r8, r8
cmove rdx, r8
mov rcx, rax
mov r8d, r9d
jmp fcn.14003d0c0

Function at 0x140041f00
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov rax, qword [rcx + 0xd0]
mov ebp, dword [rcx + 0xc8]
add ebp, 0xffffffff
movsxd rbp, ebp
mov eax, dword [rax + rbp*4]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
movss xmm2, dword [rcx + 0x10]
movss xmm3, dword [rcx + 0x14]
subss xmm0, xmm2
cvttss2si ebp, xmm0
mov ecx, ebp
shr ecx, 8
mov edi, ebp
shr edi, 0x10
mov r14d, ebp
shr r14d, 0x18
subss xmm1, xmm3
cvttss2si ebx, xmm1
mov esi, ebx
shr esi, 8
mov r11d, ebx
shr r11d, 0x10
mov r10d, ebx
shr r10d, 0x18
movss xmm0, dword [rdx + 8]
subss xmm0, xmm2
cvttss2si r15d, xmm0
mov r8d, r15d
movss xmm0, dword [rdx + 0xc]
subss xmm0, xmm3
cvttss2si edx, xmm0
not eax
xor ebp, eax
movzx ebp, bpl
lea r9, [0x1401ca9b0]
shr eax, 8
xor eax, dword [r9 + rbp*4]
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [r9 + rcx*4]
xor edi, eax
movzx ecx, dil
shr eax, 8
xor eax, dword [r9 + rcx*4]
shr r8d, 8
mov edi, r15d
movzx ecx, al
xor ecx, r14d
shr eax, 8
xor eax, dword [r9 + rcx*4]
xor ebx, eax
movzx ecx, bl
shr eax, 8
xor eax, dword [r9 + rcx*4]
xor esi, eax
movzx ecx, sil
shr eax, 8
xor eax, dword [r9 + rcx*4]
shr edi, 0x10
mov esi, r15d
xor r11d, eax
movzx ecx, r11b
shr eax, 8
xor eax, dword [r9 + rcx*4]
movzx ecx, al
xor ecx, r10d
shr eax, 8
xor eax, dword [r9 + rcx*4]
xor r15d, eax
movzx ecx, r15b
shr eax, 8
xor eax, dword [r9 + rcx*4]
shr esi, 0x18
xor r8d, eax
movzx ecx, r8b
shr eax, 8
xor eax, dword [r9 + rcx*4]
xor edi, eax
movzx ecx, dil
shr eax, 8
xor eax, dword [r9 + rcx*4]
movzx ecx, al
xor ecx, esi
shr eax, 8
xor eax, dword [r9 + rcx*4]
mov ecx, eax
xor ecx, edx
movzx ecx, cl
shr eax, 8
xor eax, dword [r9 + rcx*4]
mov ecx, edx
shr ecx, 8
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [r9 + rcx*4]
mov ecx, edx
shr ecx, 0x10
xor ecx, eax
movzx ecx, cl
shr eax, 8
xor eax, dword [r9 + rcx*4]
movzx ecx, al
shr edx, 0x18
xor edx, ecx
shr eax, 8
xor eax, dword [r9 + rdx*4]
not eax
mov rcx, qword [0x1402808a8]
cmp dword [rcx + 0x1ae0], eax
jne 0x14004208e
mov dword [rcx + 0x1ae4], eax
cmp dword [rcx + 0x1b20], eax
jne 0x14004209d
mov byte [rcx + 0x1b24], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140042f20
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rax, qword [0x1402808a8]
test rax, rax
je 0x140042f3f
add dword [rax + 0x3bc], 1
mov rdx, qword [0x1402808b8]
mov ecx, 0x3ea0
call qword [0x140275378]
mov r14, rax
mov rcx, rax
mov rdx, rdi
call fcn.140043050
cmp qword [0x1402808a8], 0
jne 0x140042f70
mov qword [0x1402808a8], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x28], xmm0
lea rax, str.Window
mov qword [rsp + 0x20], rax
mov r8d, 0xffffffff
mov al, 0x57
lea rcx, [0x1401d7555]
lea rdx, [0x1401ca9b0]
mov edi, 0xffffffff
jmp 0x140042fc9
movzx eax, al
movzx esi, dil
shr edi, 8
xor esi, eax
xor edi, dword [rdx + rsi*4]
add rcx, 1
mov eax, ebx
test bl, bl
je 0x140042fe1
movzx ebx, byte [rcx - 1]
cmp al, 0x23
jne 0x140042fb0
cmp bl, 0x23
jne 0x140042fb0
cmp byte [rcx], 0x23
cmove edi, r8d
mov bl, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140042fb0
not edi
mov dword [rsp + 0x28], edi
lea rax, [0x140051020]
mov qword [rsp + 0x30], rax
lea rax, [0x140051060]
mov qword [rsp + 0x40], rax
lea rax, [0x140051170]
mov qword [rsp + 0x48], rax
lea rax, [0x1400512d0]
mov qword [rsp + 0x50], rax
lea rax, [0x1400514f0]
mov qword [rsp + 0x58], rax
mov rcx, r14
add rcx, 0x3048
lea rdx, [rsp + 0x20]
call fcn.1400517b0
mov byte [r14], 1
mov rax, r14
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400548f0
Capabilities:
Hash data with crc32

Disassembly:
mov dl, byte [rcx]
test dl, dl
je 0x14005494d
add rcx, 2
mov r8d, 0xffffffff
lea r9, [0x1401ca9b0]
mov eax, 0xffffffff
jmp 0x14005492d
movzx r11d, dl
movzx edx, al
shr eax, 8
xor edx, r11d
xor eax, dword [r9 + rdx*4]
add rcx, 1
mov edx, r10d
test r10b, r10b
je 0x140054949
movzx r10d, byte [rcx - 1]
cmp dl, 0x23
jne 0x140054910
cmp r10b, 0x23
jne 0x140054910
cmp byte [rcx], 0x23
cmove eax, r8d
mov r10b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140054910
not eax
jmp 0x14005494f
xor eax, eax
mov rcx, qword [0x1402808a8]
mov r8, qword [rcx + 0x1a80]
movsxd r9, dword [rcx + 0x1a78]
test r9, r9
je 0x1400549a7
mov r10, r8
mov r11, r9
mov rdx, r9
jmp 0x140054988
mov r11, rdx
test rdx, rdx
je 0x1400549ad
shr rdx, 1
mov rcx, rdx
shl rcx, 4
cmp dword [r10 + rcx], eax
jae 0x140054980
not rdx
add rdx, r11
add r10, rcx
add r10, 0x10
jmp 0x140054980
xor r9d, r9d
mov r10, r8
shl r9, 4
add r8, r9
cmp r10, r8
je 0x1400549c3
cmp dword [r10], eax
jne 0x1400549c3
mov rax, qword [r10 + 8]
ret
xor eax, eax
ret

Function at 0x140056ae0
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, qword [0x1402808a8]
mov r15, qword [r8 + 0x1a90]
mov r14, qword [r15 + 0xd0]
mov r9d, dword [r15 + 0xc8]
lea eax, [r9 - 1]
cdqe
mov edi, dword [r14 + rax*4]
not edi
mov al, byte [rcx]
test al, al
je 0x140056b64
add rcx, 2
lea rsi, [0x1401ca9b0]
mov ebp, edi
jmp 0x140056b4d
movzx eax, al
mov ebx, ebp
shr ebx, 8
movzx ebp, bpl
xor ebp, eax
xor ebx, dword [rsi + rbp*4]
add rcx, 1
mov eax, edx
mov ebp, ebx
test dl, dl
je 0x140056b66
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x140056b30
cmp dl, 0x23
jne 0x140056b30
cmp byte [rcx], 0x23
cmove ebp, edi
mov dl, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140056b30
mov ebx, edi
cmp r9d, dword [r15 + 0xcc]
jne 0x140056c49
lea ebp, [r9 + 1]
test r9d, r9d
je 0x140056b8c
mov eax, r9d
shr eax, 0x1f
add eax, r9d
sar eax, 1
add eax, r9d
jmp 0x140056b91
mov eax, 8
cmp eax, ebp
cmovg ebp, eax
cmp r9d, ebp
jge 0x140056c49
movsxd rcx, ebp
shl rcx, 2
test r8, r8
je 0x140056bb3
add dword [r8 + 0x3bc], 1
mov rdx, qword [0x1402808b8]
call qword [0x140275378]
mov r14, rax
mov rdx, qword [r15 + 0xd0]
test rdx, rdx
je 0x140056c34
movsxd r8, dword [r15 + 0xc8]
shl r8, 2
mov rcx, r14
call fcn.140115f70
mov rcx, qword [r15 + 0xd0]
test rcx, rcx
je 0x140056c27
mov eax, dword [0x14027a788]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x14027a78c], 0xa
setl al
or al, dl
nop dword [rax]
test al, al
je 0x140056c10
mov rax, qword [0x1402808a8]
test rax, rax
je 0x140056c27
add dword [rax + 0x3bc], 0xffffffff
mov rdx, qword [0x1402808b8]
call qword [0x140275380]
mov qword [r15 + 0xd0], r14
mov dword [r15 + 0xcc], ebp
mov r9d, dword [r15 + 0xc8]
not ebx
movsxd rax, r9d
mov dword [r14 + rax*4], ebx
add dword [r15 + 0xc8], 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140058430
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r8, qword [0x1402808a8]
mov rax, qword [r8 + 0x1a90]
mov rbp, qword [rax + 0xd0]
mov eax, dword [rax + 0xc8]
add eax, 0xffffffff
cdqe
mov r9d, dword [rbp + rax*4]
mov eax, dword [0x14027aad0]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete al
cmp dword [0x14027aad4], 0xa
setl r10b
or r10b, al
mov r11d, dword [r8 + 0x1ae0]
not r9d
cmp r10b, 1
jne 0x14005850c
mov bl, byte [rcx]
mov eax, r9d
test bl, bl
je 0x1400584eb
lea rsi, [rcx + 2]
lea rdi, [0x1401ca9b0]
mov ebp, r9d
jmp 0x1400584cf
movzx ebx, bl
mov eax, ebp
shr eax, 8
movzx ebp, bpl
xor ebp, ebx
xor eax, dword [rdi + rbp*4]
add rsi, 1
mov ebx, r14d
mov ebp, eax
test r14b, r14b
je 0x1400584eb
movzx r14d, byte [rsi - 1]
cmp bl, 0x23
jne 0x1400584b0
cmp r14b, 0x23
jne 0x1400584b0
cmp byte [rsi], 0x23
cmove ebp, r9d
mov r14b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x1400584b0
not eax
cmp r11d, eax
je 0x140058592
cmp dword [r8 + 0x1b20], eax
je 0x1400585a6
test r10b, r10b
jne 0x1400585b7
mov bl, byte [rcx]
mov edi, r9d
test bl, bl
je 0x14005856a
lea rax, [rcx + 2]
lea r14, [0x1401ca9b0]
mov esi, r9d
jmp 0x14005854f
movzx ebx, bl
mov edi, esi
shr edi, 8
movzx esi, sil
xor esi, ebx
xor edi, dword [r14 + rsi*4]
add rax, 1
mov ebx, ebp
mov esi, edi
test bpl, bpl
je 0x14005856a
movzx ebp, byte [rax - 1]
cmp bl, 0x23
jne 0x140058530
cmp bpl, 0x23
jne 0x140058530
cmp byte [rax], 0x23
cmove esi, r9d
mov bpl, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140058530
not edi
cmp r11d, edi
jne 0x140058578
mov dword [r8 + 0x1ae4], r11d
cmp dword [r8 + 0x1b20], edi
jne 0x140058490
mov byte [r8 + 0x1b24], 1
jmp 0x140058490
mov dword [r8 + 0x1ae4], r11d
cmp dword [r8 + 0x1b20], eax
jne 0x140058503
mov byte [r8 + 0x1b24], 1
test r10b, r10b
je 0x14005850c
mov ecx, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.1400585d0
Function at 0x140058f90
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, dword [0x14027b4b8]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete bl
cmp dword [0x14027b4bc], 0xa
setl al
or al, bl
nop word cs:[rax + rax]
nop
test al, al
je 0x140058fc0
mov r9, qword [0x1402808a8]
mov eax, dword [r9 + 0x1bf0]
cmp eax, dword [r9 + 0x1c00]
jle 0x14005902f
mov rax, qword [r9 + 0x1a90]
mov rbp, qword [rax + 0xd0]
mov eax, dword [rax + 0xc8]
add eax, 0xffffffff
cdqe
mov r10d, dword [rbp + rax*4]
mov eax, dword [0x14027aad0]
lea ebp, [rax - 1]
imul ebp, eax
test bpl, 1
sete al
cmp dword [0x14027aad4], 0xa
setl r11b
or r11b, al
mov r14d, dword [r9 + 0x1ae0]
not r10d
cmp r11b, 1
je 0x140059043
jmp 0x1400590cd
mov dword [r9 + 0x1b38], 0
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov bl, byte [rcx]
mov eax, r10d
test bl, bl
je 0x14005909b
lea rsi, [rcx + 2]
lea rdi, [0x1401ca9b0]
mov ebp, r10d
jmp 0x14005907f
movzx ebx, bl
mov eax, ebp
shr eax, 8
movzx ebp, bpl
xor ebp, ebx
xor eax, dword [rdi + rbp*4]
add rsi, 1
mov ebx, r8d
mov ebp, eax
test r8b, r8b
je 0x14005909b
movzx r8d, byte [rsi - 1]
cmp bl, 0x23
jne 0x140059060
cmp r8b, 0x23
jne 0x140059060
cmp byte [rsi], 0x23
cmove ebp, r10d
mov r8b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140059060
not eax
cmp r14d, eax
jne 0x1400590a9
mov dword [r9 + 0x1ae4], r14d
cmp dword [r9 + 0x1b20], eax
jne 0x1400590ba
mov byte [r9 + 0x1b24], 1
mov r8d, edx
or r8d, 0x141
test r11b, r11b
jne 0x140059153
mov bl, byte [rcx]
mov esi, r10d
test bl, bl
je 0x14005912b
lea rax, [rcx + 2]
lea rdi, [0x1401ca9b0]
mov ebp, r10d
jmp 0x14005910f
movzx ebx, bl
mov esi, ebp
shr esi, 8
movzx ebp, bpl
xor ebp, ebx
xor esi, dword [rdi + rbp*4]
add rax, 1
mov ebx, r8d
mov ebp, esi
test r8b, r8b
je 0x14005912b
movzx r8d, byte [rax - 1]
cmp bl, 0x23
jne 0x1400590f0
cmp r8b, 0x23
jne 0x1400590f0
cmp byte [rax], 0x23
cmove ebp, r10d
mov r8b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x1400590f0
not esi
cmp r14d, esi
jne 0x140059139
mov dword [r9 + 0x1ae4], r14d
cmp dword [r9 + 0x1b20], esi
jne 0x140059043
mov byte [r9 + 0x1b24], 1
jmp 0x140059043
mov ecx, eax
mov edx, r8d
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp 0x140058de0
Function at 0x140059170
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r12, qword [0x1402808a8]
mov eax, edx
and eax, 0x1f
cmp byte [r12 + rax + 0x432], 0
je 0x140059202
mov r14d, edx
mov r15, rcx
mov rsi, qword [r12 + 0x1a90]
mov ecx, 8
call fcn.140042720
test al, al
je 0x140059202
test r15, r15
je 0x140059210
mov rax, qword [rsi + 0xd0]
mov ecx, dword [rsi + 0xc8]
add ecx, 0xffffffff
movsxd rcx, ecx
mov r11d, dword [rax + rcx*4]
mov eax, dword [0x14027aad0]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x14027aad4], 0xa
setl r8b
or r8b, al
mov r9d, dword [r12 + 0x1ae0]
not r11d
cmp r8b, 1
je 0x14005921b
jmp 0x14005929c
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, dword [rsi + 0x11c]
jmp 0x140059349
mov bl, byte [r15]
mov ecx, r11d
test bl, bl
je 0x14005927a
lea rdx, [r15 + 2]
lea rdi, [0x1401ca9b0]
mov eax, r11d
jmp 0x14005925e
movzx esi, bl
mov ecx, eax
shr ecx, 8
movzx eax, al
xor eax, esi
xor ecx, dword [rdi + rax*4]
add rdx, 1
mov ebx, r10d
mov eax, ecx
test r10b, r10b
je 0x14005927a
movzx r10d, byte [rdx - 1]
cmp bl, 0x23
jne 0x140059240
cmp r10b, 0x23
jne 0x140059240
cmp byte [rdx], 0x23
cmove eax, r11d
mov r10b, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140059240
not ecx
cmp r9d, ecx
je 0x140059321
cmp dword [r12 + 0x1b20], ecx
je 0x140059337
test r8b, r8b
jne 0x140059349
mov bl, byte [r15]
mov eax, r11d
test bl, bl
je 0x1400592f6
lea rcx, [r15 + 2]
lea rdi, [0x1401ca9b0]
mov esi, r11d
jmp 0x1400592dd
movzx ebx, bl
mov eax, esi
shr eax, 8
movzx esi, sil
xor esi, ebx
xor eax, dword [rdi + rsi*4]
add rcx, 1
mov ebx, edx
mov esi, eax
test dl, dl
je 0x1400592f6
movzx edx, byte [rcx - 1]
cmp bl, 0x23
jne 0x1400592c0
cmp dl, 0x23
jne 0x1400592c0
cmp byte [rcx], 0x23
cmove esi, r11d
mov dl, reloc.WLDAP32.dll_Ordinal_35
jmp 0x1400592c0
not eax
cmp r9d, eax
jne 0x140059305
mov dword [r12 + 0x1ae4], r9d
cmp dword [r12 + 0x1b20], eax
jne 0x14005921b
mov byte [r12 + 0x1b24], 1
jmp 0x14005921b
mov dword [r12 + 0x1ae4], r9d
cmp dword [r12 + 0x1b20], ecx
jne 0x140059293
mov byte [r12 + 0x1b24], 1
test r8b, r8b
je 0x14005929c
mov edx, r14d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400585d0
Function at 0x14005ae90
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov qword [rsp + 0x78], r9
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov rax, qword [0x140279c48]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [0x1402808a8]
cmp byte [rbx + 0x3068], 0
je 0x14005b015
mov rsi, rcx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
lea rdi, [rbx + 0x3078]
cmp qword [rbx + 0x3070], 0
je 0x14005b005
mov eax, dword [rbx + 0x307c]
test eax, eax
jns 0x14005afb1
mov ecx, eax
neg ecx
shr ecx, 1
xor edx, edx
mov ebp, eax
sub ebp, ecx
cmovs ebp, edx
cmp eax, ebp
jge 0x14005afb1
mov ecx, ebp
mov rax, qword [0x1402808a8]
test rax, rax
je 0x14005af28
add dword [rax + 0x3bc], 1
mov rdx, qword [0x1402808b8]
call qword [0x140275378]
mov r14, rax
mov rdx, qword [rbx + 0x3080]
test rdx, rdx
je 0x14005afa4
movsxd r8, dword [rbx + 0x3078]
mov rcx, r14
call fcn.140115f70
mov rcx, qword [rbx + 0x3080]
test rcx, rcx
je 0x14005af97
mov eax, dword [0x14027a788]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x14027a78c], 0xa
setl al
or al, dl
nop dword [rax]
test al, al
je 0x14005af80
mov rax, qword [0x1402808a8]
test rax, rax
je 0x14005af97
add dword [rax + 0x3bc], 0xffffffff
mov rdx, qword [0x1402808b8]
call qword [0x140275380]
mov qword [rbx + 0x3080], r14
mov dword [rbx + 0x307c], ebp
mov dword [rbx + 0x3078], 0
mov r8, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
call fcn.14003dfa0
mov r9, qword [rbx + 0x3070]
mov eax, dword [rbx + 0x3078]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rbx + 0x3080]
test rax, rax
lea rcx, [0x1402808b0]
cmovne rcx, rax
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14005b015
mov r8, qword [rsp + 0x20]
mov rcx, rdi
mov rdx, rsi
call fcn.14003dfa0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400c4bd0
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret