joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2230
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [str.J__f_]
mov rdi, rax
test rax, rax
jne 0x1400c2272
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400c22b9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400c2312
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400c22d0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400c2353
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400d7212]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400d7213]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400c2320
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1400c2370
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, [0x1400d7320]
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400c23aa
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400c23af
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400c23f8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400c23f8
dec r8
sub rdx, 1
jne 0x1400c23de
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x1400c3bc8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c3c12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c3c12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c3c12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c3c12
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c3c12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c3c14
xor al, al
add rsp, 0x28
ret
Function at 0x14127d17c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14127d186
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14127d1af
pop rbp
sub rbp, 0x33
sub rbp, 0x127d17c
sub rsp, 0x20
jmp 0x14127d1ce
mov rax, 0x127d17c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffbe833f18
xor byte [rax], dl
inc rax
dec rcx
jne 0x14127d1ed
jmp 0x14127d204
push rax
xchg ecx, eax
int1
xchg ebx, eax
xchg ecx, eax
and al, 0x18
sbb byte [rax], bl
push rax
cdq
fst dword [rax]
sbb dword [rax], ebx
sbb byte [rax + 0x19], dl
int1
push rax
invalid

Function at 0x180cee6da
Capabilities:
Encode data using xor

Disassembly:
setno r11b
xor r11d, r11d
jge 0x18179d538
adc eax, 0xe0a009dc
pop rax
sbb eax, 0xe8324ce7
xor ch, al
xchg ebp, eax
lea esp, [rdx - 0x24e46e5]
jae 0x180cee749
invalid

Function at 0x180d6220a
Capabilities:
Encode data using xor

Disassembly:
and r14b, 0xa9
push qword [rsp + 0x18]
popfq
mov qword [rsp + 0x18], 0xbf29f2d
mov r15w, 0x629d
movsx r14w, r14b
pushfq
and r14d, 0x6d932a9c
push r9
call 0x180d6220a
movabs r15, 0x39ce6adf3d2b617a
add qword [rsp], 0xffffffffff48e0a4
call fcn.180cd6569
movabs r9, 0x47071f17413f55ed
jo 0x180d5f87e
xor r14, 0x170c595b
lea r15, [r15*2 + 0xfe679c7]
mov r15, qword [rsp + 0x18]
xor r9, 0x71b02006
cmp r9d, 0x43cb667d
jl 0x180db467a
jg 0x180db466b
push qword [rsp + 0x48]
popfq
je 0x180db4692
popfq
lea rsp, [rsp + 0x50]
call fcn.181826907
jns fcn.180c7cc0d
call fcn.180daede4
or byte [rax - 0x68], ch
xchg edi, eax
loopne 0x180db466a
sub dword [rdi + rcx*4 + 0x68045cef], edx
mov eax, 0x6b9bf422
insb byte [rdi], dx
lahf
and dword [rbx - 0x3e65af69], ecx
add byte [rax - 0x63], ch
and byte [rsi], 0xec
imul ebx, dword [rdi - 0x680fa6b7], 0xfffffff6
hlt
push 0xffffffff9bf422b8
imul ebp, dword [rdi + rbx*4 + 0x21], 0xffffff8b
xchg edi, eax
push rax
invalid
Function at 0x14002e50c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002e294
Function at 0x1400338c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
movsxd rax, dword [rcx + 0x3c]
mov eax, dword [rcx + rax + 0x88]
add rax, rcx
mov r11d, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
mov esi, dword [rax + 0x1c]
mov edi, dword [rax + 0x24]
test r11d, r11d
je 0x140033930
lea rbx, [rcx + r8]
xor r10d, r10d
nop dword [rax + rax]
mov r8d, dword [rbx + r10*4]
xor r9d, r9d
add r8, rcx
cmp byte [r8], 0
je 0x140033922
movzx eax, byte [r8]
add r8, 1
or eax, 0x60
movzx eax, al
add r9d, eax
add r9d, r9d
cmp byte [r8], 0
jne 0x140033908
cmp edx, r9d
je 0x140033936
add r10, 1
cmp r11d, r10d
ja 0x1400338f8
xor eax, eax
pop rbx
pop rsi
pop rdi
ret
lea rax, [rdi + r10*2]
movzx eax, word [rcx + rax]
lea rax, [rsi + rax*4]
mov eax, dword [rcx + rax]
add rax, rcx
pop rbx
pop rsi
pop rdi
ret

Function at 0x140033958
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x6a8
mov ecx, 0x6d948
lea r8, [rsp + 0x70]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0x50
lea rdx, [r8 + 0x610]
mov byte [rsp + 0x51], 0x59
mov byte [rsp + 0x52], WSAGetLastError
mov byte [rsp + 0x53], 0x4f
mov byte [rsp + 0x54], 0x78
mov byte [rsp + 0x55], 0x45
mov byte [rsp + 0x56], 0x3c
mov byte [rsp + 0x57], 0x23
mov byte [rsp + 0x58], 0x42
mov byte [rsp + 0x59], 0x41
mov byte [rsp + 0x5a], 0x26
mov byte [rsp + 0x5b], 0x25
mov byte [rsp + 0x5c], 0x46
mov byte [rsp + 0x5d], 0x24
mov byte [rsp + 0x5e], 0x3e
mov byte [rsp + 0x5f], 0x21
mov byte [rsp + 0x60], 0x7a
mov byte [rsp + 0x61], 0x38
mov byte [rsp + 0x62], 0x66
mov byte [rsp + 0x63], WSAGetLastError
mov byte [rsp + 0x64], 0
lea rax, [r8 + 0x88]
nop word [rax + rax]
mov qword [rax], 0xffffffffff10d4c4
add rax, 8
cmp rax, rdx
jne 0x140033a08
sub ecx, 1
jne 0x1400339f8
cmp qword [rsp + 0x440], 0xffffffffff10d4c4
je 0x140033a4c
call fcn.140033b88
mov edx, 0x6d92a5e2
mov rbx, rax
mov rcx, rax
call fcn.1400338c8
lea rsi, [rsp + 0x40]
mov rcx, rbx
lea rbx, [rsp + 0x38]
mov edx, 0x3803e5e2
mov rbp, rax
call fcn.1400338c8
xor r8d, r8d
mov rdi, rax
mov qword [rsp + 0x40], 0x3d74a
mov dword [rsp + 0x28], 4
add byte [rax], al

Function at 0x140033b88
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x140007650
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [rcx]
test edx, edx
jne 0x140007678
mov dword [rcx + 4], 2
lea rax, [rcx + 4]
cmp edx, 3
jne 0x1400076a1
mov dword [rax], 4
cmp edx, 0x22
jne 0x1400076ac
mov dword [rax], 0x4a
ret
cmp edx, 1
jne 0x140007682
mov dword [rcx + 4], edx
jmp 0x14000765d
cmp edx, 2
jne 0x14000765d
lea rax, [rcx + 4]
mov dword [rax], 3
cmp edx, 0x17
jne 0x140007844
mov dword [rax], 0x38
ret
cmp edx, 4
jne 0x1400076b8
mov dword [rax], 5
cmp edx, 0x23
jne 0x1400076c3
mov dword [rax], 0x4b
ret
cmp edx, 5
jne 0x1400076cf
mov dword [rax], 6
cmp edx, 0x24
jne 0x1400076da
mov dword [rax], 0x4c
ret
cmp edx, 6
jne 0x1400076e6
mov dword [rax], 8
cmp edx, 0x25
jne 0x1400076f1
mov dword [rax], 0x4d
ret
cmp edx, 7
jne 0x1400076fd
mov dword [rax], 9
cmp edx, 0x26
jne 0x140007708
mov dword [rax], 0x4e
ret
cmp edx, 8
jne 0x140007714
mov dword [rax], 0xc
cmp edx, 0x27
jne 0x14000771f
mov dword [rax], 0x4f
ret
cmp edx, 9
jne 0x14000772b
mov dword [rax], 0xd
cmp edx, 0x28
jne 0x140007736
mov dword [rax], 0x50
ret
cmp edx, 0xa
jne 0x140007742
mov dword [rax], 0x10
cmp edx, 0x29
jne 0x14000774d
mov dword [rax], 0x51
ret
cmp edx, 0xb
jne 0x140007759
mov dword [rax], 0x11
cmp edx, 0x2a
jne 0x140007764
mov dword [rax], 0x52
ret
cmp edx, 0xc
jne 0x140007770
mov dword [rax], 0x12
cmp edx, 0x2b
jne 0x14000777b
mov dword [rax], 0x53
ret
cmp edx, 0xd
jne 0x140007787
mov dword [rax], 0x13
cmp edx, 0x2c
jne 0x140007792
mov dword [rax], 0x54
ret
cmp edx, 0xe
jne 0x14000779e
mov dword [rax], 0x14
cmp edx, 0x2d
jne 0x1400077a9
mov dword [rax], 0x55
ret
cmp edx, 0xf
jne 0x1400077b5
mov dword [rax], 0x30
cmp edx, 0x2e
jne 0x1400077c0
mov dword [rax], 0x56
ret
cmp edx, 0x10
jne 0x1400077cc
mov dword [rax], 0x31
cmp edx, 0x2f
jne 0x1400077d7
mov dword [rax], 0x57
ret
cmp edx, 0x11
jne 0x1400077e3
mov dword [rax], 0x32
cmp edx, 0x30
jne 0x1400077ee
mov dword [rax], 0x58
ret
cmp edx, 0x12
jne 0x1400077fa
mov dword [rax], 0x33
cmp edx, 0x31
jne 0x140007805
mov dword [rax], 0x59
ret
cmp edx, 0x13
jne 0x140007811
mov dword [rax], 0x34
cmp edx, 0x32
jne 0x14000781c
mov dword [rax], 0x5a
ret
cmp edx, 0x14
jne 0x140007828
mov dword [rax], 0x35
cmp edx, 0x33
jne 0x140007827
mov dword [rax], 0x18
ret
cmp edx, 0x15
jne 0x140007834
mov dword [rax], 0x36
ret
cmp edx, 0x16
jne 0x140007691
mov dword [rax], 0x37
ret
cmp edx, 0x18
jne 0x140007850
mov dword [rax], 0x39
ret
cmp edx, 0x19
jne 0x14000785c
mov dword [rax], 0x41
ret
cmp edx, 0x1a
jne 0x140007868
mov dword [rax], 0x42
ret
cmp edx, 0x1b
jne 0x140007874
mov dword [rax], 0x43
ret
cmp edx, 0x1c
jne 0x140007880
mov dword [rax], 0x44
ret
cmp edx, 0x1d
jne 0x14000788c
mov dword [rax], 0x45
ret
cmp edx, 0x1e
jne 0x140007898
mov dword [rax], 0x46
ret
cmp edx, 0x1f
jne 0x1400078a4
mov dword [rax], 0x47
ret
cmp edx, 0x20
jne 0x1400078b0
mov dword [rax], 0x48
ret
cmp edx, 0x21
jne 0x14000766c
mov dword [rax], 0x49
ret
Function at 0x140008f20
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov edx, dword [rcx + 8]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140008fae
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x140008fa5
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
jbe 0x140008f80
mov rdx, qword [rbx]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rdi
test eax, eax
je 0x14000901e
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x140008f73
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140008fe8
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140008fe3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009064
mov rcx, r8
call fcn.1400404f4
xor eax, eax
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140040490
mov rbx, qword [rsp + 0x290]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov rdi, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000905f
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000905a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140009064
mov rcx, r8
call fcn.1400404f4
mov rax, rdi
jmp 0x140008fea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400098a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400098d5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400094a0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140009a14
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14000998d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140009a03
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400099ca
mov r10, qword [rdx]
cmp r10, rax
je 0x1400099c4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140009a03
cmp r9, rdx
je 0x1400099df
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140009a25
cmp r9, rdx
jne 0x1400099d0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140009940
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140009a03
Function at 0x14000b5a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000b5fd
lea rbx, [0x140043bd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000b5e4
cmp r10, 2
jb 0x14000b5e4
cmp byte [r9], r8b
jne 0x14000b5e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000b5c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000b63f
lea rbx, [0x140043bd0]
cmp r8b, 0x23
jne 0x14000b623
cmp byte [r9], r8b
jne 0x14000b623
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000b610
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000b780
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000b79a
mov qword [r8], 0
lea rdx, [0x14004376c]
call fcn.14000b650
mov rbx, rax
test rax, rax
jne 0x14000b7ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000b893
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b893
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000b893
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b893
cmp rdi, 0xffffffffffffffff
je 0x14000b893
mov rax, qword [0x140139e08]
test rax, rax
je 0x14000b830
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000b893
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000b880
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140139e08]
test rax, rax
je 0x14000b875
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000b89c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000b88e
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000b89e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000e9c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xf0]
lea r8, [0x140043bd0]
movsxd rcx, dword [rcx + 0xe8]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, r11
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x140139e08]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x14000ea55
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140020eb0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14001a8e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140139e08]
mov edi, ecx
cmp byte [rbx + 0x4a2d], 0
jne 0x14001a941
cmp byte [rbx + 0x4a2e], 0
jne 0x14001a941
movsx r9d, word [rbx + 0x5b32]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000b460
test dil, 1
je 0x14001aa68
jmp 0x14001a9cc
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b32]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140048924]
mov edx, 0x10
mulss xmm1, dword [0x140048904]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x4790], rax
mov dword [rbx + 0x477c], 1
movss dword [rbx + 0x4788], xmm0
movss dword [rbx + 0x478c], xmm1
movss xmm0, dword [rbx + 0x38f4]
mulss xmm0, dword [0x140048818]
or dword [rbx + 0x4778], 0x41
movss dword [rbx + 0x47d8], xmm0
call fcn.14000b460
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001aa20
lea r11, [0x140043bd0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001aa03
cmp byte [r8], r9b
jne 0x14001aa03
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a9f0
not ecx
call fcn.1400125d0
test rax, rax
je 0x14001aa68
cmp byte [rax + 0xae], 0
je 0x14001aa68
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b32]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b32]
call fcn.14000b460
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140014d10
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140040490
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001f750
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c18], 0
lea rbx, [rcx + 0x5c20]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001f7f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001f7aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140021b10
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000bbe0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c18]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c28]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140139e18]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001f7ff
mov rcx, rbx
call fcn.14000bbe0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001fd70
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140139e08]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001fdd3
mov qword [rsp], rbx
lea rbx, [0x140043bd0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001fdb3
cmp byte [r8], r9b
jne 0x14001fdb3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001fda0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b90]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001fe07
mov r10, qword [r10 + 0x5b98]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001fe0e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001fdf4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret