joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000e710
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, qword [r8]
xor esi, esi
mov r14d, r9d
mov rdi, r8
mov rbp, rcx
test dl, dl
je 0x18000e75d
mov r8d, r14d
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x18000e75d
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18000e7af
mov r8, qword [rdi]
lea rax, [rsp + 0x60]
mov r9, r14
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x18000e755
mov r9d, dword [rsp + 0x70]
cmp r9d, 0x40
je 0x18000e7ad
lea rax, [rsp + 0x58]
mov r8, r14
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x18000e7ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
mov rbp, qword [rsp + 0x68]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x18000f480
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180058460]
mov r15, rcx
mov rcx, rdx
mov rbp, r8
call qword [rax + 0xe0]
mov r14, rax
test rax, rax
je 0x18000f605
mov qword [rsp + 0x90], rbx
mov ebx, 0x57
test rbp, rbp
je 0x18000f5e8
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x60], r12
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x18000f5e3
mov ebx, dword [rsp + 0xa8]
mov qword [rsp + 0x98], rsi
lea edx, [rax + 2]
inc ebx
mov qword [rsp + 0x68], rdi
mov esi, r12d
mov ecx, ebx
mov dword [rsp + 0xa8], ebx
call fcn.180029734
mov rdi, rax
test rax, rax
jne 0x18000f54f
lea ebx, [rax + 8]
jmp 0x18000f5d6
mov r9d, ebx
mov r8, rax
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
jne 0x18000f5c4
nop word [rax + rax]
mov rax, qword [0x180058460]
mov rcx, rdi
call qword [rax + 0x2e0]
mov rbx, rax
test rax, rax
je 0x18000f5a6
mov r9, qword [0x180058460]
mov r8, rax
mov edx, 0x103eb
mov rcx, r14
call qword [r9 + 0x50]
mov rcx, rbx
call fcn.180029778
mov r9d, dword [rsp + 0xa8]
inc esi
mov r8, rdi
mov edx, esi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test eax, eax
je 0x18000f570
cmp ebx, 0x103
mov rcx, rdi
cmove ebx, r12d
call fcn.180029778
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x98]
mov r12, qword [rsp + 0x60]
mov rax, qword [0x180058460]
mov r8, r14
mov rdx, r15
mov ecx, ebx
call qword [rax + 0xc0]
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop r15
pop r14
pop rbp
ret
Function at 0x18000f620
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180058460]
mov r15, rcx
mov rcx, rdx
mov rbp, r8
call qword [rax + 0xe0]
mov r14, rax
test rax, rax
je 0x18000f7e1
mov qword [rsp + 0xa0], rbx
mov ebx, 0x57
test rbp, rbp
je 0x18000f7c4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x70], r12
xor r12d, r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test eax, eax
jne 0x18000f7bf
mov ebx, dword [rsp + 0xb8]
mov qword [rsp + 0xa8], rsi
lea edx, [rax + 2]
inc ebx
mov qword [rsp + 0x78], rdi
mov esi, r12d
mov ecx, ebx
mov dword [rsp + 0xb8], ebx
call fcn.180029734
mov rdi, rax
test rax, rax
jne 0x18000f6f2
lea ebx, [rax + 8]
jmp 0x18000f7b2
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x60]
mov r8, rax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x60], ebx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test eax, eax
jne 0x18000f7a0
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x180058460]
mov rcx, rdi
call qword [rax + 0x2e0]
mov rbx, rax
test rax, rax
je 0x18000f766
mov r9, qword [0x180058460]
mov r8, rax
mov edx, 0x103f2
mov rcx, r14
call qword [r9 + 0x50]
mov rcx, rbx
call fcn.180029778
mov eax, dword [rsp + 0xb8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
inc esi
lea r9, [rsp + 0x60]
mov r8, rdi
mov rcx, rbp
mov edx, esi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test eax, eax
je 0x18000f730
cmp ebx, 0x103
mov rcx, rdi
cmove ebx, r12d
call fcn.180029778
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x70]
mov rax, qword [0x180058460]
mov r8, r14
mov rdx, r15
mov ecx, ebx
call qword [rax + 0xc0]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
Function at 0x18000fc80
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x48
mov rax, qword [0x180058460]
mov r15, rcx
mov rcx, rdx
mov r12, r8
mov rsi, rdx
call qword [rax + 0xe0]
mov rbp, rax
test rax, rax
je 0x18000fdea
mov qword [rsp + 0x70], rbx
mov rbx, qword [0x180058460]
mov edx, 0x103f2
mov rcx, rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], r14
call qword [rbx + 0xc8]
mov rcx, rax
call qword [rbx + 0x2d8]
mov r8, qword [0x180058460]
mov edx, 0x203f3
mov rcx, rsi
mov r14, rax
call qword [r8 + pe_nt_image_headers64]
mov r9, qword [0x180058460]
lea r8, [rsp + 0x30]
mov edx, 0x403f4
mov rcx, rsi
mov edi, eax
call qword [r9 + 0x88]
test eax, eax
je 0x18000fd21
mov edi, 0x57
jmp 0x18000fdbe
test edi, edi
je 0x18000fd89
cmp edi, 2
jbe 0x18000fd5a
cmp edi, 7
jne 0x18000fd89
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x88], rax
call fcn.18000fa30
mov rbx, rax
mov rax, qword [rsp + 0x88]
jmp 0x18000fd92
mov rax, qword [0x180058460]
mov rcx, qword [rsp + 0x38]
call qword [rax + 0x2d8]
mov rbx, rax
or rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x18000fd73
lea rax, [rax*2 + 2]
jmp 0x18000fd92
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov r9d, edi
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp rbx, qword [rsp + 0x38]
je 0x18000fdbe
mov rcx, rbx
call fcn.180029778
mov rcx, r14
call fcn.180029778
mov rax, qword [0x180058460]
mov r8, rbp
mov rdx, r15
mov ecx, edi
call qword [rax + 0xc0]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r15
pop r12
pop rsi
pop rbp
ret
Function at 0x18000fe00
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
push r14
sub rsp, 0x48
mov rax, qword [0x180058460]
mov r12, rcx
mov rcx, rdx
mov r14, r8
mov rsi, rdx
call qword [rax + 0xe0]
mov rdi, rax
test rax, rax
je 0x180010005
mov qword [rsp + 0x70], rbx
mov rbx, qword [0x180058460]
mov qword [rsp + 0x78], rbp
xor ebp, ebp
mov edx, 0x103f2
mov rcx, rsi
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x88], ebp
mov dword [rsp + 0x30], ebp
call qword [rbx + 0xc8]
mov rcx, rax
call qword [rbx + 0x2d8]
xor r9d, r9d
xor r8d, r8d
mov r15, rax
lea rax, [rsp + 0x88]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov rdx, r15
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x18000ffd9
mov ecx, dword [rsp + 0x88]
inc ecx
mov dword [rsp + 0x88], ecx
mov edx, ecx
lea ecx, [rax + 1]
call fcn.180029734
mov rbx, rax
test rax, rax
je 0x18000ffd9
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, eax
test eax, eax
jne 0x18000ffd9
mov rax, qword [0x180058460]
mov r8d, dword [rsp + 0x30]
mov edx, 0x203f3
mov rcx, rdi
call qword [rax + 0x58]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x18000ffbc
cmp eax, 2
jbe 0x18000ff84
cmp eax, 4
je 0x18000ff6d
cmp eax, 7
jne 0x18000ffbc
mov eax, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, rbx
mov qword [rsp + 0x38], rax
call fcn.18000f800
mov edx, 0x403f4
mov rsi, rax
mov rcx, rdi
test rax, rax
je 0x18000ffc4
mov r10, qword [0x180058460]
mov r9d, dword [rsp + 0x38]
mov r8, rax
call qword [r10 + 0x48]
mov rcx, rsi
call fcn.180029778
jmp 0x18000ffd9
mov rax, qword [0x180058460]
mov r8d, dword [rbx]
mov edx, 0x403f4
mov rcx, rdi
call qword [rax + 0x58]
jmp 0x18000ffd9
mov rax, qword [0x180058460]
mov rcx, rbx
call qword [rax + 0x2e0]
mov edx, 0x403f4
mov rcx, rdi
mov rsi, rax
test rax, rax
je 0x18000ffc4
mov r9, qword [0x180058460]
mov r8, rax
call qword [r9 + 0x50]
mov rcx, rsi
call fcn.180029778
jmp 0x18000ffd9
mov edx, 0x403f4
mov rcx, rdi
mov rax, qword [0x180058460]
mov r9d, dword [rsp + 0x88]
mov r8, rbx
call qword [rax + 0x48]
mov rcx, r15
call fcn.180029778
mov rax, qword [0x180058460]
mov r8, rdi
mov rdx, r12
mov ecx, ebp
call qword [rax + 0xc0]
mov r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180013760
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, [0x180041bd0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.psapi.dll
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernel32.dll
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rbx, rbx
je 0x180013859
test rax, rax
je 0x180013859
test rdi, rdi
je 0x180013859
lea rdx, str.QueryFullProcessImageNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180059a40], rax
test rax, rax
jne 0x1800137fc
lea rcx, str.Psapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x180013859
lea rdx, str.GetProcessImageFileNameW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180059a48], rax
test rax, rax
je 0x180013859
lea rdx, str.GetProcessImageFileNameW
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180059a48], rax
test rax, rax
je 0x180013859
lea rdx, str.GetRawInputData
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x180059a58], rax
test rax, rax
je 0x180013853
lea rdx, str.RegisterRawInputDevices
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180059a50], rax
test rax, rax
jne 0x180013866
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180013a20
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor eax, eax
movzx ebx, cx
mov edi, edx
mov qword [rsp + 0x30], rax
xor edx, edx
mov ecx, ebx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x30], eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, 0x28
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], 0
lea ecx, [r8 - 0x27]
mov word [rsp + 0x2a], ax
mov word [rsp + 0x28], bx
mov dword [rsp + 0x2c], edi
call qword [sym.imp.USER32.dll_SendInput]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x180013da0
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Get file attributes
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x420
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x400
xor ebx, ebx
call fcn.180029ee0
lea rdx, [rsp + 0x20]
lea rcx, [0x180041c48]
mov r8d, 0x3ff
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rcx, qword [0x180058458]
lea r8, [0x180041c58]
lea edx, [rbx + 0x65]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x180013e0f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x440]
add rsp, 0x420
pop rdi
ret
mov rcx, qword [0x180058458]
mov rdx, rax
mov qword [rsp + 0x430], rbp
mov qword [rsp + 0x438], rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [0x180058458]
mov rdx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, [rsp + 0x20]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x180013ea6
lea rdx, [0x180041c5c]
lea rcx, [rsp + 0x20]
call fcn.18002c624
mov rdi, rax
test rax, rax
je 0x180013e9e
mov r8d, ebp
mov r9, rax
mov edx, 1
mov rcx, rsi
call fcn.18002b2b8
mov rcx, rdi
call fcn.18002a924
jmp 0x180013ea6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, qword [rsp + 0x438]
mov rbp, qword [rsp + 0x430]
mov qword [0x1800586c8], rax
test rax, rax
jne 0x180013ed5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x440]
add rsp, 0x420
pop rdi
ret
Function at 0x18001a1a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
call fcn.18001a4a0
mov edx, 0x98
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.18001a480
mov rbx, rax
test rax, rax
jne 0x18001a1f6
mov rcx, rdi
call fcn.18001ceb0
mov rcx, qword [rdi]
mov dword [rcx + 0x28], reloc.WS2_32.dll_getservbyport
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.1800199b0]
lea rcx, str.JPEGMEM
mov qword [rbx], rax
lea rax, [fcn.180019800]
mov qword [rbx + 8], rax
lea rax, [fcn.1800198d0]
mov qword [rbx + 0x10], rax
lea rax, [fcn.180019710]
mov qword [rbx + 0x18], rax
lea rax, [0x18001a0a0]
mov qword [rbx + 0x20], rax
lea rax, [0x180019ff0]
mov qword [rbx + 0x28], rax
lea rax, [0x180019e10]
mov qword [rbx + 0x30], rax
lea rax, [0x1800195b0]
mov qword [rbx + 0x38], rax
lea rax, [0x180019440]
mov qword [rbx + 0x40], rax
lea rax, [fcn.180019ca0]
mov qword [rbx + 0x48], rax
lea rax, [0x18001a150]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], 0x98
mov qword [rdi + 8], rbx
call fcn.18002de40
test rax, rax
je 0x18001a2fd
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call fcn.18002deac
test eax, eax
jle 0x18001a2fd
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x18001a2f0
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x18001a2f4
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18002d648
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.18002d4b0
Function at 0x140008890
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rbx, qword [0x1401921f8]
mov esi, edx
mov edi, ecx
cmp byte [rbx + 0x212d], 0
jne 0x1400088e9
cmp byte [rbx + 0x212e], 0
jne 0x1400088e9
movsx r9d, word [rbx + 0x321e]
lea r8, [0x1400c3db0]
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140016350
test sil, 1
je 0x140008a28
jmp 0x140008989
movss xmm1, dword [rbx + 0x1708]
lea r8, [0x1400c3db0]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400c43b8]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400c43b0]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
or dword [rbx + 0x1e28], 1
mov qword [rbx + 0x1e44], rax
movss dword [rbx + 0x1e3c], xmm0
mov dword [rbx + 0x1e2c], 1
movss dword [rbx + 0x1e40], xmm1
mov byte [rbx + 0x1e64], 1
movss xmm0, dword [rbx + 0x1764]
mov rax, qword [0x1401921f8]
mulss xmm0, dword [0x1400c4348]
or dword [rax + 0x1e28], 0x40
movss dword [rax + 0x1e88], xmm0
movsx r9d, word [rbx + 0x321e]
call fcn.140016350
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400089e0
lea r11, [0x1400c3840]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400089c3
cmp byte [r8], r9b
jne 0x1400089c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400089b0
not ecx
call fcn.140014aa0
test rax, rax
je 0x140008a28
cmp byte [rax + 0xc7], 0
je 0x140008a28
mov byte [rax + 0xce], 1
lea r8, [0x1400c3db0]
mov byte [rax + 0xe8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x321e]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x321e]
call fcn.140016350
or edi, 0x22c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140004a70
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140014900
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140014952
lea r11, [0x1400c3840]
cmp r9b, 0x23
jne 0x140014935
cmp byte [r8], r9b
jne 0x140014935
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014922
mov r11, qword [0x1401921f8]
mov r10, qword [r11 + 0x32d0]
test r10, r10
je 0x140014999
lea r9, [r10 + 4]
test r9, r9
je 0x140014999
not eax
cmp dword [r9], eax
je 0x1400149a2
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x32c8]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140014970
mov rcx, rbx
pop rbx
jmp fcn.14000a590
mov rax, r9
pop rbx
ret

Function at 0x140014b20
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140014b70
lea r11, [0x1400c3840]
cmp r9b, 0x23
jne 0x140014b53
cmp byte [r8], r9b
jne 0x140014b53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014b40
not ecx
jmp fcn.140014aa0

Function at 0x140015240
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
mov rax, qword [rcx + 0x108]
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x1400c3840]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, qword [0x1401921f8]
xor ebx, dword [r8 + rcx*4]
not ebx
cmp dword [rax + 0x1d7c], ebx
jne 0x1400152c2
mov dword [rax + 0x1d80], ebx
cmp dword [rax + 0x1db8], ebx
jne 0x1400152d1
mov byte [rax + 0x1dbc], 1
mov rcx, qword [0x1401921f8]
cmp dword [rcx + 0x1d64], ebx
jne 0x1400152f1
xor r9d, r9d
movsxd r8, edx
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.14000a710
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400160a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x1400160bb
mov qword [r8], 0
call fcn.140016200
mov rbx, rax
test rax, rax
jne 0x1400160d1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400161d9
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400161d9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400161d9
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400161d9
cmp rdi, 0xffffffffffffffff
je 0x1400161d9
mov rax, qword [0x1401921f8]
test rax, rax
je 0x140016152
inc dword [rax + 0x3ac]
mov rdx, qword [0x140192208]
lea rcx, [rdi + rbp]
call qword [0x1400eaed0]
mov rsi, rax
test rax, rax
je 0x1400161d9
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x1400161b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401921f8]
test rax, rax
je 0x14001619f
dec dword [rax + 0x3ac]
mov rdx, qword [0x140192208]
mov rcx, rsi
call qword [0x1400eaed8]
jmp 0x1400161e2
test ebp, ebp
jle 0x1400161c3
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400161d4
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400161e4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x1400164a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400164fd
lea rbx, [0x1400c3840]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400164e4
cmp r10, 2
jb 0x1400164e4
cmp byte [r9], r8b
jne 0x1400164e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400164c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001653f
lea rbx, [0x1400c3840]
cmp r8b, 0x23
jne 0x140016523
cmp byte [r9], r8b
jne 0x140016523
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140016510
mov rbx, qword [rsp + 8]
not eax
ret