joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140093d30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1403e6c88]
lea r10, [0x1402e2460]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3f58]
add rbx, 0x108
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3f94], edi
jne 0x140093dd5
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.1400af910
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x140093e09
inc r8d
test ecx, ecx
je 0x140093df2
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140093df7
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.1400b13c0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140095e10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1403dc468]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403e6c88]
mov edi, ecx
cmp byte [rbx + 0x4375], 0
jne 0x140095e71
cmp byte [rbx + 0x4376], 0
jne 0x140095e71
movsx r9d, word [rbx + 0x5456]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140081ec0
test dil, 1
je 0x140095fa7
jmp 0x140095f01
movss xmm1, dword [rbx + 0x3938]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5456]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1403b2e30]
mulss xmm1, dword [0x1403b2e0c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd14]
addss xmm1, dword [rbx + 0xd18]
mov qword [rbx + 0x4084], rax
mov dword [rbx + 0x406c], 1
movss dword [rbx + 0x407c], xmm0
mov byte [rbx + 0x40a4], 1
movss dword [rbx + 0x4080], xmm1
movss xmm0, dword [rbx + 0x3994]
mulss xmm0, dword [0x1403b2cf4]
or dword [rbx + 0x4068], 0x41
movss dword [rbx + 0x40c8], xmm0
call fcn.140081ec0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140095f51
lea r11, [0x1402e2460]
cmp r9b, 0x23
jne 0x140095f34
cmp byte [r8], r9b
jne 0x140095f34
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140095f21
mov rcx, qword [0x1403e6c88]
not edx
add rcx, 0x3f38
call fcn.140082860
test rax, rax
je 0x140095fa7
cmp byte [rax + 0xcb], 0
je 0x140095fa7
mov byte [rax + 0xd2], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xec], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5456]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5456]
call fcn.140081ec0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14008ffb0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140260d10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14009b4e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdx, qword [0x1403e6c88]
xor r15d, r15d
mov ebp, ecx
mov rbx, rdx
mov r14d, r15d
mov rsi, qword [rdx + 0x3f58]
test cl, 0x10
jne 0x14009b68b
mov edi, dword [rdx + 0x4028]
test edi, edi
je 0x14009b560
cmp dword [rdx + 0x3fac], edi
jne 0x14009b684
mov eax, dword [rdx + 0x3ff4]
cmp eax, 0xffffffff
cmove eax, r15d
movsxd r15, eax
cmp byte [r15 + rdx + 0xd1c], r14b
je 0x14009b684
cmp byte [rsi + 0xd0], r14b
jne 0x14009b684
jmp 0x14009b602
cmp byte [rdx + 0xd1c], r14b
je 0x14009b684
cmp byte [rsi + 0xd0], r14b
jne 0x14009b684
test byte [rdx + 0x4030], 1
jne 0x14009b59d
cmp dword [rdx + 0x3fac], r14d
je 0x14009b684
cmp qword [rdx + 0x3fe8], rsi
jne 0x14009b684
test bpl, 8
je 0x14009b684
add rdx, 0x4034
mov rcx, rsi
call fcn.140086dc0
mov edx, eax
mov dword [rbx + 0x4028], eax
lea rcx, [rbx + 0x4034]
mov edi, eax
call fcn.140087250
movzx r14d, al
test al, al
je 0x14009b5ef
cmp byte [rbx + 0x3638], r15b
je 0x14009b5ef
mov rdx, rsi
mov ecx, edi
call fcn.140086f80
mov rcx, rsi
call fcn.140092f80
cmp dword [rbx + 0x3fac], edi
jne 0x14009b684
mov rdx, qword [0x1403e6c88]
mov byte [rbx + 0x3fb9], r14b
mov rax, qword [rsi + 0x110]
movsxd rcx, dword [rsi + 0x108]
mov r14d, dword [rax + rcx*4 - 4]
movsxd rax, r15d
cmp byte [rax + rdx + 0xd1c], 0
jne 0x14009b62d
xor cl, cl
jmp 0x14009b645
movss xmm1, dword [rdx + 0x38]
movss xmm0, dword [rdx + rax*4 + 0x36b8]
mulss xmm1, xmm1
comiss xmm0, xmm1
setae cl
movdqa xmm0, xmmword [0x1403b3a20]
mov qword [rdx + 0x3fc0], 0xffffffffffffffff
movups xmmword [rdx + 0x3fc8], xmm0
movd dword [rdx + 0x3fd8], xmm0
cmp byte [rdx + 0x4225], 0
mov word [rdx + 0x423c], 0
setne al
mov byte [rdx + 0x4224], al
test cl, cl
jne 0x14009b6d8
xor al, al
jmp 0x14009b776
mov r9d, 0xffffffff
lea rdx, [0x1402dfd59]
mov edi, r9d
lea r10, [0x1402e2460]
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14009b6b8
cmp byte [rdx], r8b
jne 0x14009b6b8
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14009b6a5
not edi
cmp byte [rbx + 0x4374], 0
jne 0x14009b716
call fcn.14009b420
mov dword [rbx + 0x4394], edi
mov dword [rbx + 0x4398], r14d
mov byte [rbx + 0x4374], 1
mov dword [rbx + 0x4378], ebp
mov dword [rbx + 0x4380], r15d
cmp edi, dword [rbx + 0x3fac]
jne 0x14009b716
mov byte [rbx + 0x3fba], 1
mov eax, dword [rbx + 0x3ed8]
mov dword [rbx + 0x437c], eax
mov byte [rbx + 0x4375], 1
test bpl, 1
jne 0x14009b767
xor ecx, ecx
call fcn.140095e10
cmp dword [rbx + 0x43e8], 0
je 0x14009b767
test dword [rbx + 0x43dc], 0x1000
je 0x14009b767
mov rax, qword [rbx + 0x3f58]
mov byte [rax + 0xd0], 1
mov byte [rax + 0xd2], 1
mov byte [rax + 0xec], 1
test bpl, 0x12
jne 0x14009b774
and dword [rbx + 0x4030], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14009bba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5548], 0
lea rbx, [rcx + 0x5550]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14009bc47
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14009bbfa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400b1150
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140082df0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5548]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5558]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1403e6c80]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14009bc4f
mov rcx, rbx
call fcn.140082df0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14009c3b0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x14009c402
lea r11, [0x1402e2460]
cmp r9b, 0x23
jne 0x14009c3e5
cmp byte [r8], r9b
jne 0x14009c3e5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14009c3d2
mov r11, qword [0x1403e6c88]
mov r10, qword [r11 + 0x5510]
test r10, r10
je 0x14009c449
lea r9, [r10 + 4]
test r9, r9
je 0x14009c449
not eax
cmp dword [r9], eax
je 0x14009c452
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x5508]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x14009c420
mov rcx, rbx
pop rbx
jmp fcn.14009c2c0
mov rax, r9
pop rbx
ret
Function at 0x14009f770
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14009f97c
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1403dc468]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1402e2460]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x14009f944
mov rcx, rbp
call fcn.14009eef0
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x14009f7ee
lea rcx, [rbp + 0x54a8]
call fcn.140082860
mov r11, rax
jmp 0x14009f7f1
xor r11d, r11d
mov qword [rbx + 0x18], r11
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xc4]
and eax, 0xfffffe49
movss dword [rbx + 0x58], xmm1
or eax, 0x49
mov dword [rbx + 0xc4], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test r11, r11
je 0x14009f885
cmp qword [r11 + 0x20], 0
jne 0x14009f87a
mov qword [r11 + 0x20], rbx
jmp 0x14009f885
cmp qword [r11 + 0x28], 0
jne 0x14009f885
mov qword [r11 + 0x28], rbx
mov eax, dword [rdi - 0xc]
mov dword [rbx + 0xbc], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 4]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14009f8cc
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14009f8c0
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, shutdown
call fcn.140081ec0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x14009f928
cmp r9b, 0x23
jne 0x14009f90b
cmp byte [r8], r9b
jne 0x14009f90b
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x14009f8f8
mov rcx, qword [0x1403e6c88]
not edx
add rcx, 0x3f38
call fcn.140082860
mov qword [rbx + 0x88], rax
add rdi, 0x24
sub rsi, 1
jne 0x14009f7c0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140260d10
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400a6ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x1400a6f2d
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x1400a6f32
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x1400a6f5d
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x1400a6f5d
mov rcx, qword [rax + 0x388]
test rcx, rcx
je 0x1400a6f5d
mov eax, dword [rcx + 8]
mov dword [rsp + 0x28], eax
jmp 0x1400a6f62
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x1400a6f7c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x1400a6f81
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x1400a7003
inc ecx
test r8d, r8d
je 0x1400a6fee
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400a6ff3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.1400800f0
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
inc edi
test rdx, rdx
je 0x1400a7043
mov r8d, edi
mov rcx, rbp
call fcn.1400a6ee0
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400a6f10
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400f00d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r8, qword [rcx + 0x190]
mov r9, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x1400f010c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r8 + 0x118]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r8 + 0x130], xmm0
subss xmm0, dword [r8 + 0x48]
movss dword [r8 + 0x11c], xmm1
subss xmm0, dword [r8 + 0x158]
movss dword [r8 + 0x15c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r8 + 0x150], eax
movsx eax, byte [rbx + 0x62]
mov dword [r8 + 0x16c], eax
movss dword [r8 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r8 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r8 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r8 + 0x1d4], eax
cmp byte [rbx + 0x5a], 0
jne 0x1400f01a7
maxss xmm1, dword [rcx + 0x88]
movss dword [r8 + 0x11c], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r8 + 0xd0], al
cmp byte [rbx + 0x60], 0
je 0x1400f01cd
mov rax, qword [0x1403e6c88]
xor ecx, ecx
mov dword [rax + 0x4028], ecx
mov dword [rax + 0x4030], ecx
test dword [r9 + 4], 0x100000
je 0x1400f01de
mov eax, 2
jmp 0x1400f025d
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r8 + 0x2b8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r8 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r8 + 0x2b8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx eax, byte [rbx + 0x57]
mov rdx, qword [r8 + 0x2b8]
mov r8d, eax
mov rcx, qword [r9 + 0x1a8]
call fcn.1400e6600
mov rdi, qword [0x1403e6c88]
cmp byte [rdi + 0x553c], 0
je 0x1400f02a5
cmp byte [rbx + 0x60], 0
jne 0x1400f02a5
xor r8d, r8d
lea rdx, [0x1403b0218]
mov rcx, rsi
call fcn.14009bcb0
mov dword [rdi + 0x5570], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400f27b0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x1403e6c88]
mov rdx, qword [rax + 0x4430]
cmp ecx, 0xffffffff
jne 0x1400f27ca
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x1400f2849
mov r10d, dword [rdx]
lea r8, [0x1403b0209]
movzx eax, word [rdx + 0x80]
lea r11, [0x1402e2460]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x1400f2823
cmp byte [r8], r9b
jne 0x1400f2823
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400f2810
not ecx
xor edx, edx
jmp fcn.140096070
ret
Function at 0x14011b420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1403dc468]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r10, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14011b466
lea rax, [r10 + 1]
cmp cl, 0x25
jne 0x14011b456
cmp byte [rax], cl
jne 0x14011b466
cmp cl, cl
cmovne rax, r10
movzx ecx, byte [rax + 1]
lea r10, [rax + 1]
test cl, cl
jne 0x14011b447
cmp byte [r10], 0x25
jne 0x14011b58a
cmp byte [r10 + 1], 0x25
je 0x14011b58a
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.140100840
mov r8, rax
cmp r10, rax
jae 0x14011b4c0
movabs r9, 0x800000000000009
nop word [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x14011b4b5
bt r9, rcx
jb 0x14011b4bb
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x14011b4a0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140081ec0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14011b4f8
inc rcx
cmp byte [rcx], 0x20
je 0x14011b4f0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14011b578
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14011b513
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14011b529
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14011b566
movss xmm2, dword [0x1403b2e18]
cmp al, 0x39
ja 0x14011b566
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14011b540
cmp r9b, 0x2d
jne 0x14011b585
xorps xmm1, xmmword [0x1403b39e0]
movaps xmm0, xmm1
jmp 0x14011b58d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14011b58d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140260d10
add rsp, 0x90
pop rbx
ret
Function at 0x14011bbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1403dc468]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r10, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14011bc16
lea rax, [r10 + 1]
cmp cl, 0x25
jne 0x14011bc06
cmp byte [rax], cl
jne 0x14011bc16
cmp cl, cl
cmovne rax, r10
movzx ecx, byte [rax + 1]
lea r10, [rax + 1]
test cl, cl
jne 0x14011bbf7
cmp byte [r10], 0x25
jne 0x14011bd34
cmp byte [r10 + 1], 0x25
je 0x14011bd34
mov rcx, r10
lea r11, [rsp + 0x20]
call fcn.140100840
mov r8, rax
cmp r10, rax
jae 0x14011bc70
movabs r9, 0x800000000000009
nop word [rax + rax]
movzx edx, byte [r10]
inc r10
lea ecx, [rdx - 0x24]
cmp cl, 0x3b
ja 0x14011bc65
bt r9, rcx
jb 0x14011bc6b
mov byte [r11], dl
inc r11
cmp r10, r8
jb 0x14011bc50
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140081ec0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14011bca8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14011bca0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14011bd26
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14011bcc3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14011bcd9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14011bd14
movsd xmm2, qword [0x1403b2db0]
cmp al, 0x39
ja 0x14011bd14
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14011bcf0
cmp r9b, 0x2d
jne 0x14011bd2f
xorps xmm1, xmmword [0x1403b39d0]
movaps xmm0, xmm1
jmp 0x14011bd37
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14011bd37
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140260d10
add rsp, 0x90
pop rbx
ret
Function at 0x14011c290
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1403dc468]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
xor ebx, ebx
mov r9d, 0x20019
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14011c38b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.EgyVoice
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x30], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14011c38b
mov ecx, dword [rsp + 0x30]
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140261640
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x40]
mov rbx, rax
lea rdx, str.EgyVoice
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14011c38b
mov rcx, rbx
call fcn.140260d30
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140260d10
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140260d10
add rsp, 0x50
pop rbx
ret