joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014af90
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x10016664b], 0
movdqu xmm0, xmmword [0x100001fe0]
mov rbx, rcx
movdqu xmmword [rcx], xmm0
je 0x10014afc7
mov ecx, dword [0x1001666b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x10014afc7
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbx], xmm0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x10014e480
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100165138]
jne 0x10014e49b
rol rcx, 0x10
test cx, 0xffff
jne 0x10014e497
ret 0
ror rcx, 0x10
jmp 0x10014ebec
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100165f80]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100166078]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10014ec71
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100165f80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10014ec93
mov rax, qword [rsp + 0x88]
mov qword [0x100166078], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100166018], rax
mov rax, qword [0x100166078]
mov qword [0x100165ef0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100166000], rax
mov dword [0x100165ee0], 0xc0000409
mov dword [0x100165ee4], 1
mov rax, qword [0x100165138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100165140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001f98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10014ed14
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10014ed7f
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x10014ed9f
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001fa8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1400018a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdx, qword [0x1400884e0]
lea rcx, [rsp + 0x30]
xorps xmm0, xmm0
mov qword [0x140088550], 0
xorps xmm1, xmm1
mov qword [rsp + 0x38], 0
xorps xmm6, xmm6
movaps xmmword [rsp + 0x40], xmm0
mov rdx, qword [rdx + 0xc8]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
call fcn.14005b800
test al, al
jne 0x140001929
mov rax, qword [0x1400884e0]
xor ebx, ebx
mov qword [rax + 0xc8], rbx
jmp 0x140001af6
movss xmm0, dword [rsp + 0x68]
ucomiss xmm0, xmm6
mov qword [rsp + 0xc0], rdi
mov rdi, qword [0x1400884e0]
movss xmm1, dword [rsp + 0x6c]
jp 0x140001952
jne 0x140001952
ucomiss xmm1, xmm6
jp 0x140001952
je 0x140001989
movd xmm2, dword [rdi + 0xbc]
movd xmm3, dword [rdi + 0xb8]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm3, xmm3
subss xmm1, xmm2
subss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
mov rcx, qword [0x1400884f8]
movd xmm1, dword [rcx + 0x1c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x140001997
xor ebx, ebx
mov qword [rdi + 0xc8], rbx
jmp 0x140001aee
mov eax, dword [rcx + 0x20]
cmp eax, 1
jne 0x1400019a8
movzx eax, byte [rdi + 0xc2]
jmp 0x1400019c3
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdi, qword [0x1400884e0]
mov rcx, qword [0x1400884f8]
shr eax, 0xf
and al, 1
mov qword [rsp + 0xc8], r14
test al, al
je 0x140001ad6
cmp byte [rcx + 0x28], 0
mov r14d, 2
je 0x1400019fa
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140001ae6
mov rdi, qword [0x1400884e0]
cmp byte [0x140087050], 0
je 0x140001add
mov byte [0x140087050], 0
mov byte [rdi + 0xc1], 1
call fcn.140001400
mov rax, qword [0x1400884f8]
xor ebx, ebx
cmp byte [rax + 0x43], bl
je 0x140001a95
mov qword [rsp + 0xb0], rbp
lea rcx, [rsp + 0x20]
mov ebp, 1
mov qword [rsp + 0xb8], rsi
mov qword [rsp + 0x20], rbp
call fcn.140001d40
mov rsi, qword [0x1400884f0]
mov dword [rsi + 0xc], ebp
lea r8, [rsi + 0xc]
mov qword [rsi + 0x14], rbx
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
call fcn.14005d840
mov rbp, qword [rsp + 0xb0]
cmp eax, 1
jne 0x140001a8d
mov dword [rsi + 0xc], r14d
lea r8, [rsi + 0xc]
mov qword [rsi + 0x14], rbx
mov edx, dword [rsi + 8]
mov rcx, qword [rsi]
call fcn.14005d840
mov rsi, qword [rsp + 0xb8]
mov rax, qword [0x1400884f8]
cmp byte [rax + 0x44], bl
je 0x140001ac0
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], 0xa
call fcn.140001d40
mov rdx, qword [0x140088558]
call fcn.1400010f0
mov rax, qword [0x1400884e0]
mov qword [rax + 0xc8], rbx
mov byte [rax + 0xc1], bl
jmp 0x140001ae6
mov byte [0x140087050], 1
xor ebx, ebx
mov qword [rdi + 0xc8], rbx
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xc0]
xor al, al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140068380
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x140001b20
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
sub rsp, 0xa8
mov rdx, qword [0x1400884e0]
lea rcx, [rsp + 0x20]
xorps xmm0, xmm0
movaps xmmword [rax - 0x38], xmm8
xorps xmm1, xmm1
mov qword [rax - 0x80], 0
xorps xmm8, xmm8
movaps xmmword [rax - 0x78], xmm0
mov rdx, qword [rdx + 0xc8]
movaps xmmword [rax - 0x68], xmm1
movaps xmmword [rax - 0x58], xmm0
mov qword [rax - 0x48], 0
call fcn.14005b800
test al, al
jne 0x140001b95
mov rax, qword [0x1400884e0]
xor ecx, ecx
mov qword [rax + 0xc8], rcx
xor al, al
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
mov qword [rsp + 0xb8], rbx
mov rbx, qword [0x1400884e0]
movaps xmmword [rsp + 0x90], xmm6
movss xmm6, dword [rsp + 0x5c]
movaps xmmword [rsp + 0x80], xmm7
movss xmm7, dword [rsp + 0x58]
ucomiss xmm7, xmm8
movss dword [rsp + 0xb4], xmm6
jp 0x140001bd9
jne 0x140001bd9
ucomiss xmm6, xmm8
jp 0x140001bd9
je 0x140001c22
movd xmm0, dword [rbx + 0xb8]
cvtdq2ps xmm0, xmm0
subss xmm7, xmm0
movd xmm0, dword [rbx + 0xbc]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0xb0], xmm7
subss xmm6, xmm0
movaps xmm0, xmm7
movaps xmm1, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll__hypotf
mov rax, qword [0x1400884f8]
movaps xmm1, xmm0
movd xmm0, dword [rax + 0x1c]
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x140001c53
xor ecx, ecx
mov qword [rbx + 0xc8], rcx
xor al, al
movaps xmm6, xmmword [rsp + 0x90]
mov rbx, qword [rsp + 0xb8]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm8, xmmword [rsp + 0x70]
add rsp, 0xa8
ret
mov ecx, dword [rax + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140001c2b
mov rax, qword [0x1400884f8]
cmp byte [rax + 0x28], 0
je 0x140001c82
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140001c2b
comiss xmm7, xmm8
mov qword [rsp + 0xa0], rdi
movaps xmm0, xmm7
jbe 0x140001c9a
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
jmp 0x140001c9f
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
comiss xmm6, xmm8
movss dword [rsp + 0xb0], xmm0
movaps xmm0, xmm6
jbe 0x140001cb8
call sub.api_ms_win_crt_math_l1_1_0.dll_floorf
jmp 0x140001cbd
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
lea rdx, [rsp + 0xb0]
movss dword [rsp + 0xb4], xmm0
call fcn.140001010
movss xmm0, dword [rsp + 0xb0]
mov rdi, qword [0x1400884f0]
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_roundf]
cvttss2si eax, xmm0
movss xmm0, dword [rsp + 0xb4]
mov dword [rdi + 0x14], eax
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_roundf]
xor ecx, ecx
lea r8, [rdi + 0xc]
mov dword [rdi + 0xc], ecx
cvttss2si eax, xmm0
mov dword [rdi + 0x18], eax
mov edx, dword [rdi + 8]
mov rcx, qword [rdi]
call fcn.14005d840
mov rdi, qword [rsp + 0xa0]
cmp eax, 1
sete al
jmp 0x140001c2d
Function at 0x140008a90
Capabilities:
Delete file
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
mov rbp, qword [0x1400884f8]
mov ecx, 0x104
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140008c49
mov ecx, 0x104
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
movdqa xmm0, xmmword [0x140079db0]
mov dword [rsp + 0x40], 0x4e785fa4
mov dword [rsp + 0x44], 0x8a6ab5f9
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov ecx, 0x3cc
mov eax, dword [rcx + rdx]
mov ebx, 0x4b8
add rbx, rdx
test al, 1
jne 0x140008b83
or eax, 1
mov dword [rcx + rdx], eax
mov byte [rbx + 0x19], 1
lea rax, [rbx + 0x18]
lea rcx, [rsp + 0x48]
cmp rbx, rcx
ja 0x140008b64
lea rcx, [rsp + 0x30]
cmp rax, rcx
jb 0x140008b64
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbx + 0x10], xmm0
mov byte [rbx + 0x18], 0xd7
jmp 0x140008b76
movups xmmword [rbx], xmm0
movsd xmm0, qword [rsp + 0x40]
movsd qword [rbx + 0x10], xmm0
mov byte [rbx + 0x18], 0xd7
lea rcx, [0x14006f200]
call fcn.1400684c0
nop
cmp byte [rbx + 0x19], 0
je 0x140008bf0
xor byte [rbx], 0xd7
xor byte [rbx + 1], 0x71
xor byte [rbx + 2], 0x33
xor byte [rbx + 3], 0xb
xor byte [rbx + 4], 0xb5
xor byte [rbx + 5], 0xe5
xor byte [rbx + 6], 0x23
xor byte [rbx + 7], 0xcf
xor byte [rbx + 8], 0xd7
xor byte [rbx + 9], 0x71
xor byte [rbx + 0xa], 0x33
xor byte [rbx + 0xb], 0xb
xor byte [rbx + 0xc], 0xb5
xor byte [rbx + 0xd], 0xe5
xor byte [rbx + 0xe], 0x23
xor byte [rbx + 0xf], 0xcf
xor byte [rbx + 0x10], 0xd7
xor byte [rbx + 0x11], 0x71
xor byte [rbx + 0x12], 0x33
xor byte [rbx + 0x13], 0xb
xor byte [rbx + 0x14], 0xb5
xor byte [rbx + 0x15], 0xe5
xor byte [rbx + 0x16], 0x23
xor byte [rbx + 0x17], 0xcf
xor byte [rbx + 0x18], 0xd7
mov byte [rbx + 0x19], 0
mov qword [rsp + 0x20], r14
mov r9, rsi
mov r8, rbx
mov edx, 0x104
mov rcx, rdi
call fcn.140002540
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
jne 0x140008c37
mov rcx, rbp
call fcn.140008c70
test al, al
je 0x140008c37
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, 1
jmp 0x140008c4b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140068380
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000de20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000de7d
lea rbx, [0x140072870]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000de64
cmp r10, 2
jb 0x14000de64
cmp byte [r9], r8b
jne 0x14000de64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000de40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000debf
lea rbx, [0x140072870]
cmp r8b, 0x23
jne 0x14000dea3
cmp byte [r9], r8b
jne 0x14000dea3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000de90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000e000
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000e01a
mov qword [r8], 0
lea rdx, [0x140077b74]
call fcn.14000ded0
mov rbx, rax
test rax, rax
jne 0x14000e03a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000e111
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000e111
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000e111
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000e111
cmp rdi, 0xffffffffffffffff
je 0x14000e111
mov rax, qword [0x1400884c8]
test rax, rax
je 0x14000e0ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000e111
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000e0fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400884c8]
test rax, rax
je 0x14000e0f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000e11a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000e10c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000e11c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140010b60
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140072870]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1400884c8]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x140010bf6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140023b40
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140010c00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x140072870]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14001d9d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400884c8]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x14001da31
cmp byte [rbx + 0x424e], 0
jne 0x14001da31
movsx r9d, word [rbx + 0x5342]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000dce0
test dil, 1
je 0x14001db58
jmp 0x14001daba
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5342]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400792dc]
mulss xmm1, dword [0x1400792c8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x3fb8], rax
mov dword [rbx + 0x3fa4], 1
movss dword [rbx + 0x3fb0], xmm0
movss dword [rbx + 0x3fb4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x1400791fc]
or dword [rbx + 0x3fa0], 0x41
movss dword [rbx + 0x4000], xmm0
call fcn.14000dce0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001db10
lea r11, [0x140072870]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14001daf3
cmp byte [r8], r9b
jne 0x14001daf3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001dae0
not ecx
call fcn.140016530
test rax, rax
je 0x14001db58
cmp byte [rax + 0x96], 0
je 0x14001db58
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5342]
mov edx, 0x10
movsx r9d, word [rbx + 0x5342]
call fcn.14000dce0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140018ce0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140068380
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140022790
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53f0], 0
lea rbx, [rcx + 0x53f8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140022837
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400227ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140024850
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000e700
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53f0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5400]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400884c0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002283f
mov rcx, rbx
call fcn.14000e700
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140022cc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400884c8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140022d23
mov qword [rsp], rbx
lea rbx, [0x140072870]
nop dword [rax]
cmp r9b, 0x23
jne 0x140022d03
cmp byte [r8], r9b
jne 0x140022d03
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140022cf0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53a0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140022d57
mov r10, qword [r10 + 0x53a8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140022d5e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140022d44
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140060f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.140060a20
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetc]
cmp eax, 0xffffffff
jne 0x140060f5e
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
test eax, eax
je 0x140060f5e
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 5]
call fcn.140061160
mov eax, dword [rbx + 0x6c]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
xor edx, edx
mov qword [rsp + 0x30], rdi
mov rcx, rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
cmp rdi, 0xffffffffffffffff
jne 0x140060fb7
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
lea edx, [r9 + 5]
call fcn.140061160
mov eax, dword [rbx + 0x6c]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
jae 0x140060f92
test rdi, rdi
jne 0x140060fe2
xor r9d, r9d
lea edx, [rdi + 0xd]
xor r8d, r8d
mov rcx, rbx
call fcn.140061160
mov eax, dword [rbx + 0x6c]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
lea rcx, [rdi + 1]
call fcn.140068790
mov r9, rsi
mov qword [rbx + 0x98], rax
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140061030
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 5]
call fcn.140061160
mov eax, dword [rbx + 0x6c]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rax, qword [rbx + 0x98]
mov byte [rdi + rax], 0
call fcn.140061290
mov eax, dword [rbx + 0x6c]
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret

Function at 0x140061600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x78]
mov rdi, r8
mov rsi, rdx
test r9, r9
je 0x140061632
mov edx, 1
mov rcx, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rcx, 0x110
mov qword [rsp + 0x30], rbx
mov edx, edi
call fcn.140061fd0
mov r8, rdi
mov rdx, rsi
mov rbx, rax
lea rcx, [rax - 1]
call sub.VCRUNTIME140.dll_memcpy
mov rsi, qword [rsp + 0x38]
mov byte [rbx + rdi - 1], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret