joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a910
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000a960
lea r11, [0x180048810]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000a943
cmp byte [r8], r9b
jne 0x18000a943
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000a930
mov rcx, qword [0x1800559b8]
not eax
movsxd rdx, dword [rcx + 0x3eb8]
mov r9, qword [rcx + 0x3ec0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000a9c1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000a9b9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000a9bc
mov rdx, r8
test rdx, rdx
jne 0x18000a990
cmp r9, r10
je 0x18000a9d0
cmp dword [r9], eax
jne 0x18000a9d0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180018c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5cb0], 0
lea rbx, [rcx + 0x5cb8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180018ca3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x180018c56
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.18001b530
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180003610
mov eax, dword [rbx]
lea rcx, [0x1800559b0]
mov r9, qword [rdi + 0x5cb0]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x5cc0]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180018cab
mov rcx, rbx
call fcn.180003610
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180019120
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1800559b8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180019183
mov qword [rsp], rbx
lea rbx, [0x180048810]
nop dword [rax]
cmp r9b, 0x23
jne 0x180019163
cmp byte [r8], r9b
jne 0x180019163
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180019150
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
not eax
mov r8, qword [r10 + 0x5c28]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1800191af
cmp dword [r8 + 8], eax
je 0x1800191b6
add r8, 0x48
cmp r8, rcx
jne 0x1800191a0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x18003ddf0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18003de7c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18003de50
lea r11, [0x180048810]
nop
cmp r9b, 0x23
jne 0x18003de33
cmp byte [r8], r9b
jne 0x18003de33
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18003de20
mov rcx, qword [0x1800559b8]
not eax
cmp dword [rcx + 0x3f38], eax
jne 0x18003de67
mov dword [rcx + 0x3f3c], eax
cmp dword [rcx + 0x3f68], eax
jne 0x18003ded9
mov byte [rcx + 0x3f6c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1800559b8]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x3ed8]
movsxd rax, dword [rbx + 0xf0]
mov r8, qword [rbx + 0xf8]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.180002e50
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x3f20], eax
jne 0x18003ded2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18001a4b0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180040260
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
lea r9, [rsp + 0x20]
mov rbx, rdx
mov r8d, 0x40
mov rdx, rsi
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
mov word [rdi], 0x25ff
mov qword [rdi + 6], rbx
cmp rsi, 0xe
jbe 0x1800402c9
lea r8, [rsi - 0xe]
mov edx, 0x90
lea rcx, [rdi + 0xe]
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x24]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180045a60
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180044380
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800443af
xor eax, eax
mov qword [0x1800559e8], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180044230]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800447a0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180044804
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x1800447f2
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1800447eb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x1800447bf
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x180055a98]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180044814
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x180055b20]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x18004484a
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180044880
mov eax, 0xa
jmp 0x18004490f
test esi, esi
je 0x1800448a2
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800448c3
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800448c3
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800448bd
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800448c3
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x180044bf4
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x180044c0b
cmp r8b, 0x90
je 0x180044c0b
cmp r8b, 0xcc
jne 0x180044c2d
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180044c29
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180044c2d
add edx, r10d
cmp edx, r9d
jb 0x180044c19
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180044f94
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x180044fde
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x180055b10]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
jmp 0x180045017
cmp rbx, r14
jb 0x180045014
cmp rbx, r12
jae 0x180045014
cmp qword [rbx + 8], rsi
jne 0x180045179
mov rbx, qword [rbx]
test rbx, rbx
jne 0x180045000
mov r15, rdi
cmp rdi, r14
jb 0x180045133
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
jmp 0x180045063
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18004509d
cmp dword [rbp - 0x10], 0x10000
je 0x18004506d
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x18004509d
sub r15, r13
cmp r15, r14
jae 0x180045039
jmp 0x18004509d
test r15, r15
je 0x18004509d
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18004513e
cmp r15, r14
jae 0x180045028
test rbx, rbx
jmp 0x180045131
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x180045179
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180045179
cmp dword [rbp - 0x10], 0x10000
je 0x18004510c
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jbe 0x1800450c9
jmp 0x180045179
test rdi, rdi
je 0x180045179
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18004513e
cmp rdi, r12
jbe 0x1800450a5
jmp 0x180045179
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x18004514a
mov rax, qword [0x180055b10]
mov qword [rbx], rax
mov qword [0x180055b10], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18000f060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movsxd rax, dword [rcx + 0x3c]
xor r8d, r8d
mov r11, rdx
mov r9, rcx
mov r10d, dword [rax + rcx + 0x88]
add r10, rcx
mov ebx, dword [r10 + 0x18]
test ebx, ebx
je 0x18000f0db
mov esi, dword [r10 + 0x24]
mov r14d, dword [r10 + 0x20]
movzx ebp, byte [rdx]
lea rax, [rsi + r8*2]
movzx edi, word [rax + r9]
lea rax, [r14 + r8*4]
mov edx, dword [rax + r9]
add rdx, r9
movzx ecx, byte [rdx]
cmp cl, bpl
jne 0x18000f0d3
mov rax, r11
sub rdx, r11
test cl, cl
je 0x18000f0f4
movzx ecx, byte [rdx + rax + 1]
inc rax
cmp cl, byte [rax]
je 0x18000f0c3
inc r8d
cmp r8d, ebx
jb 0x18000f0a1
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdi*4]
add rax, r9
jmp 0x18000f0dd

Function at 0x18000f2e0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x30]
mov rdi, rcx
mov rdx, qword [rax + 0x60]
mov rsi, qword [rdx + 0x18]
add rsi, 0x20
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x18000f37e
movabs rbp, 0x6c00640074006e
nop
cmp rdi, 1
jbe 0x18000f35f
mov rax, qword [0x18006a008]
test rax, rax
jne 0x18000f352
mov ecx, 1
call fcn.18000f2e0
mov rcx, rax
lea rdx, str._wcsicmp
call fcn.18000f060
mov qword [0x18006a008], rax
mov rdx, qword [rbx + 0x50]
mov rcx, rdi
call rax
test eax, eax
jmp 0x18000f374
jne 0x18000f371
cmp word [rbx + 0x48], 0x12
jne 0x18000f376
mov rax, qword [rbx + 0x50]
cmp qword [rax], rbp
jmp 0x18000f374
test rdi, rdi
je 0x18000f395
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x18000f320
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
jmp 0x18000f380
Function at 0x180028430
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180028480
lea r11, [0x18005bc50]
nop dword [rax]
cmp r9b, 0x23
jne 0x180028463
cmp byte [r8], r9b
jne 0x180028463
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028450
mov rcx, qword [0x18006a120]
not eax
movsxd rdx, dword [rcx + 0x1ad8]
mov r9, qword [rcx + 0x1ae0]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x1800284e1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x1800284d9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x1800284dc
mov rdx, r8
test rdx, rdx
jne 0x1800284b0
cmp r9, r10
je 0x1800284f0
cmp dword [r9], eax
jne 0x1800284f0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x1800290b0
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0xc0]
mov r9, r8
mov r8, qword [rcx + 0xc8]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.180029910

Function at 0x180029910
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18002996d
lea rbx, [0x18005bc50]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180029954
cmp r10, 2
jb 0x180029954
cmp byte [r9], r8b
jne 0x180029954
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180029930
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800299af
lea rbx, [0x18005bc50]
cmp r8b, 0x23
jne 0x180029993
cmp byte [r9], r8b
jne 0x180029993
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180029980
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18002a3c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x18005c1f5]
mov dword [rsp + 0x2c], eax
lea r11, [0x18005bc50]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x18002a413
cmp byte [r8], r9b
jne 0x18002a413
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18002a400
mov ecx, dword [rbx + 0x2fec]
lea rax, [0x180034090]
mov edi, dword [rbx + 0x2fe8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x180033fc0]
mov qword [rsp + 0x38], rax
lea rax, [0x180034150]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x18002a523
inc edi
test ecx, ecx
je 0x18002a47f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18002a484
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18002a523
mov rax, qword [0x18006a120]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x18002a4a8
inc dword [rax + 0x3bc]
mov rdx, qword [0x18006a130]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x180069300]
mov rdx, qword [rbx + 0x2ff0]
mov rsi, rax
test rdx, rdx
je 0x18002a511
movsxd rcx, dword [rbx + 0x2fe8]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2ff0]
test rcx, rcx
je 0x18002a504
mov rax, qword [0x18006a120]
test rax, rax
je 0x18002a504
dec dword [rax + 0x3bc]
mov rdx, qword [0x18006a130]
call qword [0x180069308]
mov qword [rbx + 0x2ff0], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2fec], edi
movsxd rax, dword [rbx + 0x2fe8]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ff0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2fe8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18002ade0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18006a120]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x18002ae1e
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x18002ae15
test r13, r13
je 0x18002ae2a
inc dword [r13 + 0x3bc]
mov rdx, qword [0x18006a130]
lea rcx, [rbx + 1]
call qword [0x180069300]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x18002b003
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
movzx eax, byte [rcx]
cmp al, 0xa
je 0x18002b04e
cmp al, 0xd
je 0x18002b04e
mov rbx, rcx
cmp rcx, r12
jae 0x18002aea3
nop
movzx eax, byte [rbx]
cmp al, 0xa
je 0x18002aea3
cmp al, 0xd
je 0x18002aea3
inc rbx
cmp rbx, r12
jb 0x18002ae90
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x18002afe7
cmp al, 0x5b
jne 0x18002afce
cmp rbx, rcx
jbe 0x18002afce
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x18002afce
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x18002afe7
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x18002afe7
mov byte [r15], 0
lea r8, [r14 + 1]
movzx r9d, byte [r14]
mov esi, 0xffffffff
mov r10, qword [0x18006a120]
mov ecx, esi
test r9b, r9b
je 0x18002af6a
cmp r9b, 0x23
jne 0x18002af47
cmp byte [r8], r9b
jne 0x18002af47
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x18005bc50]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x18002af35
movsxd rax, dword [r10 + 0x2fe8]
xor r8d, r8d
xor edx, edx
not ecx
test eax, eax
jle 0x18002afa3
mov r10, qword [r10 + 0x2ff0]
mov r9, rax
lea rax, [r10 + 8]
nop word [rax + rax]
cmp dword [rax], ecx
je 0x18002afa9
inc r8d
inc rdx
add rax, 0x30
cmp rdx, r9
jl 0x18002af90
xor edi, edi
xor ebp, ebp
jmp 0x18002afe7
movsxd rax, r8d
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r10
je 0x18002afa5
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x18002afe7
test rdi, rdi
je 0x18002afe7
test rbp, rbp
je 0x18002afe7
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x18002ae74
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x18002b02e
mov rax, qword [0x18006a120]
test rax, rax
je 0x18002b02e
dec dword [rax + 0x3bc]
mov rdx, qword [0x18006a130]
mov rcx, rsi
call qword [0x180069308]
mov byte [r13 + 0x2fd0], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x18002ae74
Function at 0x18002b1e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x18006a120]
cmp byte [rbx + 0x3008], 0
je 0x18002b2c5
cmp qword [rbx + 0x3010], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3018]
je 0x18002b2ad
mov ecx, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test ecx, ecx
jns 0x18002b252
mov eax, ecx
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.180034950
mov dword [rdi], ebp
mov r8, rsi
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.180034400
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3010]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3020]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x18006a128]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.180034400
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x180031d40
Capabilities:
Write file on windows

Disassembly:
push r14
push r15
sub rsp, 0x28
mov rax, qword [0x18006a120]
xor r15d, r15d
mov r14, rcx
mov dword [rax + 0x2fd4], r15d
test rcx, rcx
je 0x180031e70
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], rdi
mov rdi, qword [0x18006a120]
lea rbx, [rdi + 0x2fd8]
mov dword [rdi + 0x2fd4], r15d
mov ecx, dword [rbx + 4]
test ecx, ecx
jns 0x180031dae
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.180034950
mov dword [rbx], r15d
cmp dword [rbx + 4], r15d
jne 0x180031dc4
mov edx, 8
mov rcx, rbx
call fcn.180034950
movsxd rcx, dword [rbx]
mov ebp, r15d
mov rax, qword [rbx + 8]
mov byte [rcx + rax], r15b
inc dword [rbx]
cmp dword [rdi + 0x2fe8], r15d
jle 0x180031e05
mov rsi, r15
mov r9, qword [rdi + 0x2ff0]
mov r8, rbx
add r9, rsi
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rdi + 0x2fe8]
jl 0x180031de0
mov eax, dword [rbx]
lea rdx, [0x18005c2bc]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x2fe0]
cmove ecx, r15d
lea rdi, [0x18006a128]
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.180029650
mov rbp, qword [rsp + 0x48]
mov rbx, rax
test rax, rax
je 0x180031e61
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
pop r15
pop r14
ret