joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010338
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400101a0

Function at 0x140014a90
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140011340
xor ebx, ebx
mov rdi, rax
cmp qword [0x14001e130], rbx
jne 0x140014b96
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x140014c6b
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140014c6b
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14001e130], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14001e138], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x14001e140], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x14001e150], rax
test rax, rax
je 0x140014b8d
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x14001e148], rax
jmp 0x140014b9d
mov rax, qword [0x14001e148]
jmp 0x140014ba4
mov rax, qword [0x14001e148]
mov r11, qword [0x14001e150]
cmp rax, rdi
je 0x140014c0c
cmp r11, rdi
je 0x140014c0c
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x14001e150]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x140014c0c
test rax, rax
je 0x140014c0c
call rsi
test rax, rax
je 0x140014c06
lea rcx, [rsp + 0x88]
mov r9d, 0xc
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140014c06
test byte [rsp + 0x38], 1
jne 0x140014c0c
bts ebp, 0x15
jmp 0x140014c4a
mov rcx, qword [0x14001e138]
cmp rcx, rdi
je 0x140014c4a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140014c4a
call rax
mov rbx, rax
test rax, rax
je 0x140014c4a
mov rcx, qword [0x14001e140]
cmp rcx, rdi
je 0x140014c4a
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140014c4a
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x14001e130]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x140014c6b
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x140014c6d
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140005dc0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x10], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x10325476
ret
Function at 0x1400139f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x140013a22
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.140012fb0
nop
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x140013a7d
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x18]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x18]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x18], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x140013a2a
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x140013a99
lea rcx, [0x14009f138]
call fcn.140006350
jmp 0x140013bdd
cmp dword [rsp + 0x20], 4
jge 0x140013abf
mov rcx, qword [rsp + 0x50]
call fcn.140012ea0
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x140013a99
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x140013b2f
lea rcx, str.zlib_corrupt
call fcn.140006350
jmp 0x140013bdd
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x140013b58
lea rcx, str.read_past_buffer
call fcn.140006350
jmp 0x140013bdd
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x30]
jbe 0x140013b91
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rsp + 0x50]
call fcn.140013260
test eax, eax
jne 0x140013b91
xor eax, eax
jmp 0x140013bdd
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x20]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x20]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x20], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14001e5c0
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov word [rsp + 0x20], ax
movzx eax, word [rsp + 0x20]
cmp eax, 0x804
je 0x14001e5f6
movzx eax, word [rsp + 0x20]
cmp eax, 0x404
je 0x14001e5f6
mov dword [rsp + 0x24], 1
jmp 0x14001e5fe
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
mov byte [0x1403f2f10], al
mov r8, qword [rsp + 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [0x1403f2f40]
call fcn.140026c80
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x48]
lea rcx, [0x1403f2f40]
call fcn.1400233d0
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call fcn.140022e40
movzx eax, al
test eax, eax
je 0x14001e691
movzx eax, byte [0x1403f2f10]
test eax, eax
je 0x14001e67b
mov rdx, qword [rsp + 0x60]
lea rcx, [0x1403f2f40]
call fcn.140023300
mov rcx, rax
call fcn.140023850
mov qword [rsp + 0x28], rax
jmp 0x14001e68a
mov rcx, qword [rsp + 0x60]
call fcn.140023850
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
jmp 0x14001e69b
mov rcx, qword [rsp + 0x60]
call fcn.140023850
add rsp, 0x58
ret

Function at 0x14001ec00
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x14001ec27
lea rcx, str.File_deleted_successfully_n
call fcn.140001970
nop
jmp 0x14001ec35
lea rcx, str.Error_deleting_file
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
nop
add rsp, 0x28
ret
Function at 0x14001ec40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x298
mov rax, qword [0x1400b1040]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x14001eca9
lea rdx, str.Failed_to_create_process_snapshot.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140026f00
mov qword [rsp + 0x28], rax
lea rdx, [0x1400272e0]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x14001ed5d
mov dword [rsp + 0x40], 0x238
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14001ecfe
lea rdx, str.Failed_to_get_first_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140026f00
mov qword [rsp + 0x30], rax
lea rdx, [0x1400272e0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14001ed5d
lea rax, [rsp + 0x6c]
mov rcx, qword [rsp + 0x2a0]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x14001ed24
add rax, 2
test dx, dx
jne 0x14001ed0e
xor eax, eax
jmp 0x14001ed29
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14001ed3c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14001ed5d
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001ecfe
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14009a0e0
add rsp, 0x298
ret
Function at 0x14001ed80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x1400b1040]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea r8, [0x14009fb30]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x38], 0
jne 0x14001edc7
xor eax, eax
jmp 0x14001eea2
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cdqe
mov rcx, qword [rsp + 0x68]
mov qword [rcx], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
add rax, 1
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ee36
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x14001eea2
mov r9, qword [rsp + 0x38]
mov rax, qword [rsp + 0x68]
mov r8, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
cmp qword [rsp + 0x30], rax
je 0x14001ee81
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
jmp 0x14001eea2
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
mov byte [rcx + rax], 0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009a0e0
add rsp, 0x58
ret
Function at 0x140021eb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140021ee9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140021fd8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140021f80
cmp qword [rsp + 0x20], 0
jle 0x140021f80
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140021f29
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140025e70
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x140021fc8
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140021fc8
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140021fe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1400b1040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140022014
xor eax, eax
jmp 0x140022211
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140022046
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140022211
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x1400220f8
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140022230
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140025e70
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140022201
mov rcx, qword [rsp + 0x80]
call fcn.1400242a0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x1400221ae
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x1400221a9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140022211
jmp 0x140022124
cmp qword [rsp + 0x50], 0
jbe 0x140022201
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14009a0e0
add rsp, 0x78
ret
Function at 0x140024360
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x1400b1040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14002439d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400243a4
mov al, 1
jmp 0x1400244fc
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140025d80
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140025d80
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.140025de0
movzx eax, al
test eax, eax
je 0x1400243f9
xor al, al
jmp 0x1400244fc
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x140024469
cmp dword [rsp + 0x30], 1
je 0x140024475
cmp dword [rsp + 0x30], 3
je 0x1400244ea
jmp 0x1400244fa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400244c1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x1400244c1
xor al, al
jmp 0x1400244fc
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400244db
mov dword [rsp + 0x34], 1
jmp 0x1400244e3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x1400244fc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400244fc
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009a0e0
add rsp, 0xa8
ret

Function at 0x140032930
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400a3850]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x1400329be
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140032962
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x1400329d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400a3850]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140032ad4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140032acf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140032aa4
cmp qword [rsp + 0x38], 2
jb 0x140032aa4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140032aa4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140032aa4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140032a17
jmp 0x140032b66
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140032b66
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140032b3c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140032b3c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140032b3c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140032ad4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret