joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bc0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rsi, r8
mov ebp, r15d
mov r14, rdx
mov rdi, rcx
nop word [rax + rax]
mov edx, 9
mov rcx, rsi
call fcn.1401767f0
mov rdx, qword [rdi + 0x18]
mov r11, rax
imul r11, qword [rdi + 8]
mov r8d, dword [rdi + 0x38]
mov rax, r11
shr rax, 0x21
xor r11, rax
mov eax, dword [rdi + 0x3c]
mov rcx, r11
shr r11, 5
and r11, qword [rdi + 0x28]
and ecx, 0x1f
shrx rbx, rcx, rax
add ebx, r8d
movzx eax, byte [rdx + r11]
cmp ebx, eax
jae 0x1401bc150
nop dword [rax]
movzx eax, byte [rdx + r11 + 1]
inc r11
add ebx, r8d
cmp ebx, eax
jb 0x1401bc140
movzx eax, byte [rdx + r11]
cmp ebx, eax
jne 0x1401bc189
mov rcx, r11
shl rcx, 4
add rcx, qword [rdi + 0x10]
mov rax, qword [rsi]
cmp rax, qword [rcx]
jne 0x1401bc175
movzx eax, byte [rsi + 8]
cmp al, byte [rcx + 8]
je 0x1401bc1b2
movzx eax, byte [rdx + r11 + 1]
inc r11
add rcx, 0x10
add ebx, r8d
cmp ebx, eax
je 0x1401bc164
mov rax, qword [rdi + 0x30]
cmp qword [rdi + 0x20], rax
jb 0x1401bc1bf
mov rcx, rdi
call fcn.1401bfb80
test al, al
je 0x1401bc1ad
inc ebp
cmp ebp, 0x100
jl 0x1401bc0f0
mov qword [r14], r15
jmp 0x1401bc20c
mov qword [r14], r11
mov dword [r14 + 8], 1
jmp 0x1401bc210
lea eax, [r8 + rbx]
mov rsi, r11
cmp eax, 0xff
jbe 0x1401bc1d1
mov qword [rdi + 0x30], r15
cmp byte [rdx + r11], r15b
je 0x1401bc1f3
inc r11
cmp byte [rdx + r11], r15b
jne 0x1401bc1d7
cmp r11, rsi
je 0x1401bc1f3
mov r8, rsi
mov rdx, r11
mov rcx, rdi
call fcn.140059150
mov rax, qword [rdi + 0x18]
mov qword [r14], rsi
mov byte [rsi + rax], bl
inc qword [rdi + 0x20]
cmp r11, rsi
setne r15b
add r15d, 2
mov dword [r14 + 8], r15d
mov rbx, qword [rsp + 0x40]
mov rax, r14
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401bc3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r14, r8
mov ebp, r12d
mov r15, rdx
mov rsi, rcx
nop dword [rax]
mov r8, qword [r14]
mov rdx, qword [rsi + 0x18]
mov rbx, r8
imul rbx, qword [rsi + 8]
mov r9d, dword [rsi + 0x38]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [rsi + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [rsi + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, r9d
movzx eax, byte [rdx + rbx]
cmp edi, eax
jae 0x1401bc42f
nop
movzx eax, byte [rdx + rbx + 1]
inc rbx
add edi, r9d
cmp edi, eax
jb 0x1401bc420
movzx eax, byte [rdx + rbx]
cmp edi, eax
jne 0x1401bc458
imul rcx, rbx, 0x13
add rcx, qword [rsi + 0x10]
nop
cmp r8, qword [rcx]
je 0x1401bc481
movzx eax, byte [rdx + rbx + 1]
inc rbx
add rcx, 0x13
add edi, r9d
cmp edi, eax
je 0x1401bc440
mov rax, qword [rsi + 0x30]
cmp qword [rsi + 0x20], rax
jb 0x1401bc48e
mov rcx, rsi
call fcn.1401bfed0
test al, al
je 0x1401bc47c
inc ebp
cmp ebp, 0x100
jl 0x1401bc3e0
mov qword [r15], r12
jmp 0x1401bc4dc
mov qword [r15], rbx
mov dword [r15 + 8], 1
jmp 0x1401bc4e0
lea eax, [r9 + rdi]
mov r14, rbx
cmp eax, 0xff
jbe 0x1401bc4a0
mov qword [rsi + 0x30], r12
cmp byte [rdx + rbx], r12b
je 0x1401bc4c2
inc rbx
cmp byte [rdx + rbx], r12b
jne 0x1401bc4a6
cmp rbx, r14
je 0x1401bc4c2
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.1401c0000
mov rax, qword [rsi + 0x18]
mov qword [r15], r14
mov byte [r14 + rax], dil
inc qword [rsi + 0x20]
cmp rbx, r14
setne r12b
add r12d, 2
mov dword [r15 + 8], r12d
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1401be590
Capabilities:
Send data
Send data on socket

Disassembly:
mov r8, qword [rdx]
xor r9d, r9d
mov rcx, qword [rcx + 8]
mov dl, 4
jmp fcn.14019d1e0

Function at 0x1401be750
Capabilities:
Send data
Send data on socket

Disassembly:
mov r8, qword [rdx]
xor r9d, r9d
mov rcx, qword [rcx + 8]
mov dl, 5
jmp fcn.14019d1e0
Function at 0x1401c3dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1401c3de4
call fcn.140026410
test al, al
je 0x1401c3f0f
mov edx, 9
mov qword [rsp + 0x30], rsi
mov rcx, rdi
call fcn.1401767f0
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x1401c3e40
nop
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1401c3e30
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x1401c3e58
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x1401c3e69
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x1401c3e60
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x1401c3eea
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x1401c3eb9
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x1401c3ea0
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1401c3ee2
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1401c3ec0
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x1401c4090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1401c40b4
call fcn.140026410
test al, al
je 0x1401c41df
mov rdx, qword [rdi]
mov qword [rsp + 0x30], rsi
call fcn.140176c00
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x1401c4110
nop word [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1401c4100
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x1401c4128
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x1401c4139
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x1401c4130
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x1401c41ba
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x1401c4189
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x1401c4170
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1401c41b2
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1401c4190
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x1401c41f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1401c4214
call fcn.140026410
test al, al
je 0x1401c433f
mov rax, qword [rdi]
mov r9d, dword [rbx + 0x38]
mov qword [rsp + 0x30], rsi
mov eax, dword [rax + 2]
imul rax, qword [rbx + 8]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x1401c4270
nop dword [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1401c4260
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x1401c4288
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x1401c4299
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x1401c4290
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x1401c431a
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x1401c42e9
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x1401c42d0
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1401c4312
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1401c42f0
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x1401c4350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1401c4374
call fcn.140026410
test al, al
je 0x1401c449f
mov rcx, qword [rdi]
mov edx, 0x23
mov qword [rsp + 0x30], rsi
call fcn.1401767f0
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x1401c43d0
nop
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1401c43c0
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x1401c43e8
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x1401c43f9
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x1401c43f0
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x1401c447a
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x1401c4449
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x1401c4430
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1401c4472
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1401c4450
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x1401c50d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r13, r8
mov r15d, ebp
mov r12, rdx
mov rbx, rcx
nop word [rax + rax]
mov rcx, qword [r13]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], bpl
jne 0x1401c5110
call fcn.140025020
mov rdi, qword [rbx + 0x18]
mov r8, rax
imul r8, qword [rbx + 8]
mov r14d, dword [rbx + 0x38]
mov rcx, r8
shr rcx, 0x21
xor r8, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, r8
shr r8, 5
and r8, qword [rbx + 0x28]
and edx, 0x1f
shrx r10, rdx, rcx
add r10d, r14d
movzx eax, byte [rdi + r8]
cmp r10d, eax
jae 0x1401c5171
nop dword [rax + rax]
movzx eax, byte [rdi + r8 + 1]
inc r8
add r10d, r14d
cmp r10d, eax
jb 0x1401c5160
movzx eax, byte [rdi + r8]
cmp r10d, eax
jne 0x1401c51cc
mov rsi, qword [r13]
mov r11, r8
shl r11, 4
add r11, qword [rbx + 0x10]
nop word [rax + rax]
mov r9, qword [r11]
mov rax, rsi
sub r9, rsi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1401c51b3
inc rax
test ecx, ecx
jne 0x1401c51a0
test edx, edx
je 0x1401c51fb
movzx eax, byte [rdi + r8 + 1]
inc r8
add r11, 0x10
add r10d, r14d
cmp r10d, eax
je 0x1401c5190
mov rax, qword [rbx + 0x30]
cmp qword [rbx + 0x20], rax
jb 0x1401c520d
mov rcx, rbx
call fcn.1401c6c80
test al, al
je 0x1401c51f2
inc r15d
cmp r15d, 0x100
jl 0x1401c5100
mov qword [r12], rbp
jmp 0x1401c52d3
mov qword [r12], r8
mov dword [r12 + 8], 1
jmp 0x1401c52d8
lea eax, [r14 + r10]
mov r9, r8
cmp eax, 0xff
jbe 0x1401c521f
mov qword [rbx + 0x30], rbp
cmp byte [rdi + r8], bpl
je 0x1401c52b9
nop dword [rax]
mov rdx, r8
inc r8
cmp byte [rdi + r8], bpl
jne 0x1401c5230
cmp r8, r9
je 0x1401c52b9
mov rax, qword [rbx + 0x10]
mov rcx, r8
add rcx, rcx
vmovups xmm0, xmmword [rax + rcx*8 - 0x10]
vmovups xmmword [rax + rcx*8], xmm0
cmp rdx, r9
je 0x1401c5289
mov rcx, rdx
shl rcx, 4
sub rdx, r9
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rcx - 0x10]
vmovups xmm0, xmmword [rax + rcx]
vmovups xmmword [rax + rcx + 0x10], xmm0
sub rdx, 1
jne 0x1401c5270
mov rdx, qword [rbx + 0x18]
mov rcx, r8
movzx eax, byte [rcx + rdx - 1]
add al, byte [rbx + 0x38]
mov byte [rcx + rdx], al
mov rdx, qword [rbx + 0x18]
movzx eax, byte [rcx + rdx]
add eax, dword [rbx + 0x38]
cmp eax, 0xff
jbe 0x1401c52b1
mov qword [rbx + 0x30], rbp
dec rcx
cmp rcx, r9
jne 0x1401c5290
mov rax, qword [rbx + 0x18]
mov qword [r12], r9
mov byte [r9 + rax], r10b
inc qword [rbx + 0x20]
cmp r8, r9
setne bpl
add ebp, 2
mov dword [r12 + 8], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401c6ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x30], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1401c6ee4
call fcn.140026410
test al, al
je 0x1401c701f
mov rcx, qword [rdi]
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x30], rsi
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1401c6ef3
call fcn.140025020
imul rax, qword [rbx + 8]
mov r9d, dword [rbx + 0x38]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov ecx, dword [rbx + 0x3c]
mov rdx, rax
shr rax, 5
and rax, qword [rbx + 0x28]
and edx, 0x1f
shrx r8, rdx, rcx
mov rdx, qword [rbx + 0x18]
add r8d, r9d
movzx ecx, byte [rdx + rax]
cmp r8d, ecx
ja 0x1401c6f50
nop word [rax + rax]
movzx ecx, byte [rdx + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1401c6f40
movzx ecx, r8b
xor esi, esi
add ecx, r9d
mov r10, rax
cmp ecx, 0xff
jbe 0x1401c6f68
mov qword [rbx + 0x30], rsi
cmp byte [rdx + rax], sil
je 0x1401c6f79
nop
inc rax
cmp byte [rdx + rax], sil
jne 0x1401c6f70
mov rdx, qword [rbx + 0x10]
mov r11, r10
shl r11, 4
add r11, rdx
cmp rax, r10
je 0x1401c6ffa
mov rcx, rax
lea r9, [rax - 1]
add rcx, rcx
vmovups xmm0, xmmword [rdx + rcx*8 - 0x10]
vmovups xmmword [rdx + rcx*8], xmm0
cmp r9, r10
je 0x1401c6fc9
mov rdx, r9
shl rdx, 4
sub r9, r10
mov rcx, qword [rbx + 0x10]
lea rdx, [rdx - 0x10]
vmovups xmm0, xmmword [rdx + rcx]
vmovups xmmword [rdx + rcx + 0x10], xmm0
sub r9, 1
jne 0x1401c6fb0
mov rdx, qword [rbx + 0x18]
nop dword [rax]
movzx ecx, byte [rdx + rax - 1]
add cl, byte [rbx + 0x38]
mov byte [rdx + rax], cl
mov rdx, qword [rbx + 0x18]
movzx ecx, byte [rdx + rax]
add ecx, dword [rbx + 0x38]
cmp ecx, 0xff
jbe 0x1401c6ff2
mov qword [rbx + 0x30], rsi
dec rax
cmp rax, r10
jne 0x1401c6fd0
vmovups xmm0, xmmword [rdi]
mov rsi, qword [rsp + 0x30]
vmovups xmmword [r11], xmm0
mov rax, qword [rbx + 0x18]
mov byte [r10 + rax], r8b
inc qword [rbx + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14001c8f0
int3
Function at 0x1401cb2c0
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov rbx, rdx
mov r15, rcx
mov rdx, qword [rcx]
mov rsi, rbx
sub rsi, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r9, 0xfffffffffffffff
cmp rax, r9
je 0x1401cb4fb
lea r8, [rax + 1]
mov qword [rsp + 0x30], r8
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r9
sub rax, rdx
cmp rcx, rax
ja 0x1401cb4f5
lea rax, [rdx + rcx]
mov r14, r8
cmp rax, r8
cmovae r14, rax
cmp r14, r9
ja 0x1401cb4f5
mov rcx, r14
shl rcx, 4
mov qword [rsp + 0xa8], r14
test rcx, rcx
jne 0x1401cb360
xor edi, edi
mov qword [rsp + 0xa8], r14
jmp 0x1401cb3a0
cmp rcx, 0x1000
jb 0x1401cb398
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1401cb4f5
mov rcx, rax
call fcn.1403f4d70
test rax, rax
je 0x1401cb391
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1401cb3a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403f4d70
mov rdi, rax
mov qword [rsp + 0x98], rdi
and rsi, 0xfffffffffffffff0
lea r13, [rsi + rdi]
lea rsi, [r13 + 0x10]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x90], rsi
mov ecx, 0x18
call fcn.1403f4d70
vmovups xmm0, xmmword [r12]
vmovups xmmword [rax], xmm0
vmovsd xmm1, qword [r12 + 0x10]
vmovsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea r12, [r13 + 8]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401cb7f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [r13], rax
test rax, rax
je 0x1401cb4e1
mov qword [rsp + 0x90], r13
mov rdx, qword [r15 + 8]
mov rax, qword [r15]
mov rcx, rdi
cmp rbx, rdx
jne 0x1401cb45f
cmp rax, rdx
je 0x1401cb4bb
nop dword [rax + rax]
vpxor xmm0, xmm0, xmm0
vmovups xmm1, xmmword [rax]
vmovups xmmword [rax], xmm0
vmovups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rdx
jne 0x1401cb440
jmp 0x1401cb4bb
cmp rax, rbx
je 0x1401cb48d
nop dword [rax]
nop dword [rax + rax]
vpxor xmm0, xmm0, xmm0
vmovups xmm1, xmmword [rax]
vmovups xmmword [rax], xmm0
vmovups xmmword [rcx], xmm1
lea rcx, [rcx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x1401cb470
mov qword [rsp + 0x90], rdi
mov rax, qword [r15 + 8]
cmp rbx, rax
je 0x1401cb4bb
sub rsi, rbx
vpxor xmm0, xmm0, xmm0
vmovups xmm1, xmmword [rbx]
vmovups xmmword [rbx], xmm0
vmovups xmmword [rsi + rbx], xmm1
add rbx, 0x10
cmp rbx, rax
jne 0x1401cb4a1
mov r9, r14
mov r8, qword [rsp + 0x30]
mov rdx, rdi
mov rcx, r15
call fcn.1401c19f0
mov rax, r13
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [r12], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.140002bb0
int3
call fcn.1400033c0
int3
Function at 0x1401cb750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov ecx, 0x18
call fcn.1403f4d70
vmovups xmm0, xmmword [rbx]
vmovups xmmword [rax], xmm0
vmovsd xmm1, qword [rbx + 0x10]
vmovsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401cb7f0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1401cb7be
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1401e1830
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1401e188d
lea rbx, [0x140db6590]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1401e1874
cmp r10, 2
jb 0x1401e1874
cmp byte [r9], r8b
jne 0x1401e1874
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1401e1850
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1401e18cf
lea rbx, [0x140db6590]
cmp r8b, 0x23
jne 0x1401e18b3
cmp byte [r9], r8b
jne 0x1401e18b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1401e18a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1401e1a90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1401e1aae
mov qword [r8], r14
lea rdx, [0x1413a189c]
call fcn.1401e18e0
mov rbx, rax
test rax, rax
jne 0x1401e1ad3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1401e1bff
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401e1bff
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1401e1bff
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1401e1bff
cmp rdi, 0xffffffffffffffff
je 0x1401e1bff
mov rcx, rdi
call fcn.1401e7830
mov rbp, rax
test rax, rax
je 0x1401e1bff
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1401e1bec
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x141443c60]
test r8, r8
je 0x1401e1be1
movsx rdx, word [r8 + 0x6320]
lea rcx, [r8 + 0x6324]
mov r9d, dword [r8 + 0x40a8]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1401e1bd6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6320], cx
movsx rax, cx
lea rcx, [r8 + 0x6324]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x631c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1401e1c08
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1401e1bfa
mov qword [rsi], rdi
mov rax, rbp
jmp 0x1401e1c0a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401ebd70
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x1401ebdc0
lea r11, [0x140db6590]
nop dword [rax]
cmp r9b, 0x23
jne 0x1401ebda3
cmp byte [r8], r9b
jne 0x1401ebda3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x1401ebd90
mov rcx, qword [0x141443c60]
not edx
add rcx, 0x4130
jmp fcn.1401e22d0