joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029760
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x140206880]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x14002980a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x14002980a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140029808
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140029821
cmp eax, 1
je 0x1400297d7
test eax, eax
jne 0x140029808
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x1400297fe
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140029808
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x14002980a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400f4f10
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x14002980a

Function at 0x14002d8d0
Capabilities:
Hash data with crc32

Disassembly:
not r8d
test rdx, rdx
je 0x14002d92e
dec rdx
add rcx, 2
lea r9, [0x140110980]
mov r10d, r8d
jmp 0x14002d911
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
add rdx, 0xffffffffffffffff
jae 0x14002d987
movzx eax, byte [rcx - 2]
cmp rdx, 2
jb 0x14002d8f0
cmp al, 0x23
jne 0x14002d8f0
cmp byte [rcx - 1], 0x23
jne 0x14002d8f0
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x14002d8f0
movzx edx, byte [rcx]
test dl, dl
je 0x14002d98a
add rcx, 2
lea r9, [0x140110980]
mov r10d, r8d
jmp 0x14002d96f
movzx r11d, al
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
inc rcx
mov r10d, eax
test dl, dl
je 0x14002d987
mov eax, edx
movzx edx, byte [rcx - 1]
cmp al, 0x23
jne 0x14002d950
cmp dl, 0x23
jne 0x14002d950
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x14002d950
not eax
ret
mov eax, r8d
not eax
ret
Function at 0x14002db90
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov rsi, r8
test r8, r8
je 0x14002dbb0
mov qword [rsi], 0
call fcn.14002d990
test rax, rax
je 0x14002dbeb
mov rdi, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x14002dbe2
mov ebp, eax
mov rcx, rdi
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x14002dc00
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x14002dbe2
mov r14d, eax
xor r15d, r15d
mov rcx, rdi
mov edx, ebp
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
neg eax
sbb r15d, r15d
or r15d, r14d
cmp r15d, 0xffffffff
je 0x14002dbe2
movsxd r15, r15d
movsxd r12, ebx
lea rcx, [r15 + r12]
mov rax, qword [0x1402095c0]
test rax, rax
je 0x14002dc4c
inc dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb348]
test rax, rax
je 0x14002dbe2
mov r14, rax
mov edx, 1
mov rcx, rax
mov r8, r15
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r15
jne 0x14002dca8
test ebx, ebx
jle 0x14002dc8e
mov rcx, r14
add rcx, r15
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14002dbee
mov qword [rsi], r15
jmp 0x14002dbee
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402095c0]
test rax, rax
je 0x14002dcc3
dec dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
mov rcx, r14
call qword [0x1401eb350]
jmp 0x14002dbeb
Function at 0x140034e30
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r9, r8
mov r8, rdx
mov rax, qword [rcx + 0xf8]
movsxd rdx, dword [rcx + 0xf0]
mov eax, dword [rax + rdx*4 - 4]
not eax
test r9, r9
je 0x140034ebd
mov rdx, r9
sub rdx, r8
je 0x140034ebd
mov rdx, r8
not rdx
add rdx, r9
lea r10, [r8 + 2]
lea r11, [0x140110980]
mov edi, eax
jmp 0x140034e9d
movzx ebx, bl
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
inc r10
mov edi, esi
add rdx, 0xffffffffffffffff
jae 0x140034f17
movzx ebx, byte [r10 - 2]
cmp rdx, 2
jb 0x140034e80
cmp bl, 0x23
jne 0x140034e80
cmp byte [r10 - 1], 0x23
jne 0x140034e80
cmp byte [r10], 0x23
cmove edi, eax
jmp 0x140034e80
movzx edx, byte [r8]
test dl, dl
je 0x140034f15
lea r10, [r8 + 2]
lea r11, [0x140110980]
mov edi, eax
jmp 0x140034efb
movzx ebx, bl
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
inc r10
mov edi, esi
test dl, dl
je 0x140034f17
mov ebx, edx
movzx edx, byte [r10 - 1]
cmp bl, 0x23
jne 0x140034ee0
cmp dl, 0x23
jne 0x140034ee0
cmp byte [r10], 0x23
cmove edi, eax
jmp 0x140034ee0
mov esi, eax
not esi
mov rax, qword [rcx]
cmp dword [rax + 0x3f40], esi
jne 0x140034f30
mov ecx, esi
mov edx, 0xb
call fcn.140035640
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140044a70
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov edi, r9d
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1402095c0]
mov rcx, qword [rax + 0x3ef8]
mov byte [rcx + 0xb8], 1
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebp, dword [rcx + rdx*4 - 4]
movzx ecx, byte [r14]
test cl, cl
je 0x140044b0b
not ebp
lea rdx, [r14 + 2]
lea r8, [0x140110980]
mov r9d, ebp
jmp 0x140044aea
movzx r10d, r10b
movzx r11d, r9b
shr r9d, 8
xor r11d, r10d
xor r9d, dword [r8 + r11*4]
inc rdx
test cl, cl
je 0x140044b05
mov r10d, ecx
movzx ecx, byte [rdx - 1]
cmp r10b, 0x23
jne 0x140044ad0
cmp cl, 0x23
jne 0x140044ad0
cmp byte [rdx], 0x23
cmove r9d, ebp
jmp 0x140044ad0
not r9d
mov ebp, r9d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], ebp
jne 0x140044b28
mov ecx, ebp
mov edx, 0xb
mov r8, r14
xor r9d, r9d
call fcn.140035640
mov dword [rsp + 0x20], edi
mov rcx, r14
mov edx, ebp
mov r8, rsi
mov r9d, ebx
call fcn.140044680
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140045a50
Capabilities:
Hash data with crc32

Disassembly:
movzx edx, byte [rcx]
test dl, dl
je 0x140045aa8
add rcx, 2
mov r8d, 0xffffffff
lea r9, [0x140110980]
mov eax, 0xffffffff
jmp 0x140045a89
movzx r10d, r10b
movzx r11d, al
shr eax, 8
xor r11d, r10d
xor eax, dword [r9 + r11*4]
inc rcx
test dl, dl
je 0x140045aa4
mov r10d, edx
movzx edx, byte [rcx - 1]
cmp r10b, 0x23
jne 0x140045a70
cmp dl, 0x23
jne 0x140045a70
cmp byte [rcx], 0x23
cmove eax, r8d
jmp 0x140045a70
not eax
jmp 0x140045aaa
xor eax, eax
mov rdx, qword [0x1402095c0]
mov rcx, qword [rdx + 0x3ee0]
movsxd r8, dword [rdx + 0x3ed8]
test r8, r8
je 0x140045af7
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x140045ad8
mov r10, r9
test r9, r9
je 0x140045afd
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x140045ad0
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x140045ad0
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x140045b12
cmp dword [rdx], eax
jne 0x140045b12
mov rax, qword [rdx + 8]
ret
xor eax, eax
ret
Function at 0x1400474a0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rcx
mov rax, qword [0x1402095c0]
mov rbx, qword [rax + 0x3ef8]
mov rcx, qword [rbx + 0xf8]
movsxd rax, dword [rbx + 0xf0]
mov esi, dword [rcx + rax*4 - 4]
movzx ecx, byte [r8]
test cl, cl
je 0x14004752b
not esi
lea rdx, [r8 + 2]
lea r9, [0x140110980]
mov r10d, esi
jmp 0x14004750a
movzx r11d, r11b
movzx edi, r10b
shr r10d, 8
xor edi, r11d
xor r10d, dword [r9 + rdi*4]
inc rdx
test cl, cl
je 0x140047525
mov r11d, ecx
movzx ecx, byte [rdx - 1]
cmp r11b, 0x23
jne 0x1400474f0
cmp cl, 0x23
jne 0x1400474f0
cmp byte [rdx], 0x23
cmove r10d, esi
jmp 0x1400474f0
not r10d
mov esi, r10d
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f40], esi
jne 0x14004754b
mov ecx, esi
mov edx, 0xb
xor r9d, r9d
call fcn.140035640
mov eax, dword [rbx + 0xf0]
cmp eax, dword [rbx + 0xf4]
jne 0x140047567
lea ebp, [rax + 1]
test eax, eax
je 0x140047573
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x140047578
mov rdi, qword [rbx + 0xf8]
jmp 0x140047603
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
movsxd rcx, ebp
shl rcx, 2
mov rax, qword [0x1402095c0]
test rax, rax
je 0x140047596
inc dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb348]
mov rdi, rax
mov rdx, qword [rbx + 0xf8]
test rdx, rdx
je 0x1400475f0
movsxd r8, dword [rbx + 0xf0]
shl r8, 2
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x1400475e3
mov rax, qword [0x1402095c0]
test rax, rax
je 0x1400475e3
dec dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb350]
mov qword [rbx + 0xf8], rdi
mov dword [rbx + 0xf4], ebp
mov eax, dword [rbx + 0xf0]
cdqe
mov dword [rdi + rax*4], esi
inc dword [rbx + 0xf0]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140047620
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [0x1402095c0]
mov rbx, qword [rax + 0x3ef8]
mov r9d, ecx
shr r9d, 8
mov r8d, ecx
shr r8d, 0x10
mov edx, ecx
shr edx, 0x18
mov r10, qword [rbx + 0xf8]
movsxd rax, dword [rbx + 0xf0]
mov r10d, dword [r10 + rax*4 - 4]
not r10d
mov r11d, r10d
shr r11d, 8
xor r10d, ecx
movzx r10d, r10b
lea rdi, [0x140110980]
xor r11d, dword [rdi + r10*4]
mov r10d, r11d
shr r10d, 8
xor r11d, r9d
movzx r9d, r11b
xor r10d, dword [rdi + r9*4]
mov esi, r10d
shr esi, 8
xor r10d, r8d
movzx r8d, r10b
xor esi, dword [rdi + r8*4]
movzx r8d, sil
shr esi, 8
xor r8d, edx
xor esi, dword [rdi + r8*4]
mov rdx, qword [rbx]
not esi
cmp dword [rdx + 0x3f40], esi
jne 0x1400476ce
movsxd r8, ecx
mov ecx, esi
mov edx, 4
xor r9d, r9d
call fcn.140035640
mov eax, dword [rbx + 0xf0]
cmp eax, dword [rbx + 0xf4]
jne 0x1400476ea
lea ebp, [rax + 1]
test eax, eax
je 0x1400476f6
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1400476fb
mov rdi, qword [rbx + 0xf8]
jmp 0x140047786
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
movsxd rcx, ebp
shl rcx, 2
mov rax, qword [0x1402095c0]
test rax, rax
je 0x140047719
inc dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb348]
mov rdi, rax
mov rdx, qword [rbx + 0xf8]
test rdx, rdx
je 0x140047773
movsxd r8, dword [rbx + 0xf0]
shl r8, 2
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x140047766
mov rax, qword [0x1402095c0]
test rax, rax
je 0x140047766
dec dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb350]
mov qword [rbx + 0xf8], rdi
mov dword [rbx + 0xf4], ebp
mov eax, dword [rbx + 0xf0]
cdqe
mov dword [rdi + rax*4], esi
inc dword [rbx + 0xf0]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400478d0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r8, rcx
mov rax, qword [0x1402095c0]
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov esi, dword [rcx + rdx*4 - 4]
movzx ecx, byte [r8]
test cl, cl
je 0x14004795b
not esi
lea rdx, [r8 + 2]
lea r9, [0x140110980]
mov r10d, esi
jmp 0x14004793a
movzx r11d, r11b
movzx edi, r10b
shr r10d, 8
xor edi, r11d
xor r10d, dword [r9 + rdi*4]
inc rdx
test cl, cl
je 0x140047955
mov r11d, ecx
movzx ecx, byte [rdx - 1]
cmp r11b, 0x23
jne 0x140047920
cmp cl, 0x23
jne 0x140047920
cmp byte [rdx], 0x23
cmove r10d, esi
jmp 0x140047920
not r10d
mov esi, r10d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], esi
jne 0x140047975
mov ecx, esi
mov edx, 0xb
xor r9d, r9d
call fcn.140035640
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140049230
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x140206880]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x1402095c0]
cmp byte [rbx + 0x4a9d], 0
jne 0x140049263
mov edi, ecx
cmp byte [rbx + 0x4a9e], 0
je 0x1400492be
vbroadcastss xmm0, dword [rbx + 0x389c]
vmovsd xmm1, qword [rbx + 0xe08]
vfmadd231ps xmm1, xmm0, xmmword [0x140111bc0]
vmovlps qword [rbx + 0x47e0], xmm1
mov qword [rbx + 0x47e8], 0
mov dword [rbx + 0x47d4], 1
vmovss xmm0, dword [rbx + 0x3904]
or byte [rbx + 0x47d0], 0x41
vmulss xmm0, xmm0, dword [0x140111c10]
vmovss dword [rbx + 0x4830], xmm0
mov edi, 1
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.14002d620
test dil, 1
je 0x1400493fe
movzx ecx, byte [rsp + 0x20]
test cl, cl
je 0x140049349
mov edx, 0xffffffff
lea r8, [rsp + 0x22]
lea r9, [0x140110980]
mov eax, 0xffffffff
jmp 0x140049329
movzx r10d, r10b
movzx r11d, al
shr eax, 8
xor r11d, r10d
xor eax, dword [r9 + r11*4]
inc r8
test cl, cl
je 0x140049345
mov r10d, ecx
movzx ecx, byte [r8 - 1]
cmp r10b, 0x23
jne 0x140049310
cmp cl, 0x23
jne 0x140049310
cmp byte [r8], 0x23
cmove eax, edx
jmp 0x140049310
not eax
jmp 0x14004934b
xor eax, eax
mov rdx, qword [0x1402095c0]
mov rcx, qword [rdx + 0x3ee0]
movsxd r8, dword [rdx + 0x3ed8]
test r8, r8
je 0x140049397
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x140049378
mov r10, r9
test r9, r9
je 0x14004939d
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x140049370
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x140049370
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x1400493fe
cmp dword [rdx], eax
jne 0x1400493fe
mov rax, qword [rdx + 8]
test rax, rax
je 0x1400493fe
cmp byte [rax + 0xb6], 0
je 0x1400493fe
mov byte [rax + 0xbb], 1
mov byte [rax + 0xbd], 1
mov byte [rax + 0xd8], 1
movzx eax, word [rbx + 0x5bc2]
inc eax
mov word [rbx + 0x5bc2], ax
movsx r9d, ax
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.14002d620
or esi, 0x20c0347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.14003d740
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f4f10
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140049440
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov r14, qword [0x1402095c0]
mov rax, qword [r14 + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebx, dword [rcx + rdx*4 - 4]
movzx ecx, byte [rdi]
test cl, cl
je 0x1400494cb
not ebx
lea rdx, [rdi + 2]
lea r8, [0x140110980]
mov r9d, ebx
jmp 0x1400494aa
movzx r10d, r10b
movzx r11d, r9b
shr r9d, 8
xor r11d, r10d
xor r9d, dword [r8 + r11*4]
inc rdx
test cl, cl
je 0x1400494c5
mov r10d, ecx
movzx ecx, byte [rdx - 1]
cmp r10b, 0x23
jne 0x140049490
cmp cl, 0x23
jne 0x140049490
cmp byte [rdx], 0x23
cmove r9d, ebx
jmp 0x140049490
not r9d
mov ebx, r9d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], ebx
jne 0x1400494e8
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140035640
test byte [r14 + 0x5ce4], 4
je 0x140049504
lea rcx, str._popup__OpenPopup___s_____0x_08X__n
mov rdx, rdi
mov r8d, ebx
call fcn.14002efb0
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140049520
Function at 0x140049d20
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r9d, ecx
mov rax, qword [0x140206880]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x1402095c0]
movsxd rcx, dword [rax + 0x48b0]
cmp dword [rax + 0x48a0], ecx
jle 0x140049bf2
mov esi, edx
mov rdx, qword [rax + 0x48a8]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], r9d
jne 0x140049bf2
test esi, 0x10000000
jne 0x140049c14
lea r8, str.Popup__08x
jmp 0x140049c22
mov dword [rax + 0x47d0], 0
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f4f10
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x48c0]
lea r8, str.Menu__02d
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.14002d620
or esi, 0x4000000
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.14003d740
mov esi, eax
test al, al
jne 0x140049bfe
mov rdi, qword [0x1402095c0]
mov rax, qword [rdi + 0x3ef8]
cmp qword [rdi + 0x48d8], rax
je 0x140049c7e
test byte [rax + 0x17], 1
je 0x140049c70
mov byte [rdi + 0x3e5e], 1
call fcn.140043620
mov byte [rdi + 0x3e5e], 0
jmp 0x140049bfe
cmp byte [rdi + 0x4951], 0
je 0x140049c63
cmp dword [rdi + 0x4910], 0
jne 0x140049c63
mov ecx, dword [rdi + 0x4954]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rdi + 0x4954], ecx
jmp 0x140049c63
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rcx
mov rax, qword [0x1402095c0]
mov ecx, dword [rax + 0x48a0]
cmp ecx, dword [rax + 0x48b0]
jle 0x140049db5
mov esi, edx
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov edi, dword [rcx + rdx*4 - 4]
movzx ecx, byte [r8]
test cl, cl
je 0x140049dcf
not edi
lea rdx, [r8 + 2]
lea r9, [0x140110980]
mov r10d, edi
jmp 0x140049d9a
movzx r11d, r11b
movzx ebx, r10b
shr r10d, 8
xor ebx, r11d
xor r10d, dword [r9 + rbx*4]
inc rdx
test cl, cl
je 0x140049dc9
mov r11d, ecx
movzx ecx, byte [rdx - 1]
cmp r11b, 0x23
jne 0x140049d80
cmp cl, 0x23
jne 0x140049d80
cmp byte [rdx], 0x23
cmove r10d, edi
jmp 0x140049d80
mov dword [rax + 0x47d0], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
not r10d
mov edi, r10d
or esi, 0x141
mov rax, qword [rax]
cmp dword [rax + 0x3f40], edi
jne 0x140049def
mov ecx, edi
mov edx, 0xb
xor r9d, r9d
call fcn.140035640
mov ecx, edi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x140049ba0
Function at 0x140049e00
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x1402095c0]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x3766], 0
je 0x140049ec4
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x3ef8]
cmp eax, 0xa
ja 0x140049e4b
add eax, 0x81
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x3fa8], 0
jne 0x140049ec4
mov ecx, 0x20
call fcn.140035fe0
test al, al
je 0x140049ec4
test rdi, rdi
je 0x140049ef3
mov rax, qword [r14 + 0xf8]
movsxd rcx, dword [r14 + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
movzx eax, byte [rdi]
test al, al
je 0x140049ed4
not ebx
lea rcx, [rdi + 2]
lea rdx, [0x140110980]
mov r8d, ebx
jmp 0x140049eaa
movzx r9d, r9b
movzx r10d, r8b
shr r8d, 8
xor r10d, r9d
xor r8d, dword [rdx + r10*4]
inc rcx
test al, al
je 0x140049ece
mov r9d, eax
movzx eax, byte [rcx - 1]
cmp r9b, 0x23
jne 0x140049e90
cmp al, 0x23
jne 0x140049e90
cmp byte [rcx], 0x23
cmove r8d, ebx
jmp 0x140049e90
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not r8d
mov ebx, r8d
mov rax, qword [r14]
cmp dword [rax + 0x3f40], ebx
jne 0x140049ef9
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140035640
jmp 0x140049ef9
mov ebx, dword [rbx + 0x4794]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140049520
Function at 0x14004b970
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5cb0]
cmp qword [rcx + 0x5ca8], 0
je 0x14004ba79
mov rsi, rcx
cmp dword [rcx + 0x5cb4], 0
jns 0x14004ba1d
mov rax, qword [0x1402095c0]
test rax, rax
je 0x14004b9b4
inc dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
xor ecx, ecx
call qword [0x1401eb348]
mov r15, rax
mov rdx, qword [rsi + 0x5cb8]
test rdx, rdx
je 0x14004ba0c
movsxd r8, dword [rsi + 0x5cb0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x5cb8]
test rcx, rcx
je 0x14004b9ff
mov rax, qword [0x1402095c0]
test rax, rax
je 0x14004b9ff
dec dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb350]
mov qword [rsi + 0x5cb8], r15
mov dword [rsi + 0x5cb4], 0
mov dword [rsi + 0x5cb0], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.14002e730
mov r9, qword [rsi + 0x5ca8]
mov eax, dword [rsi + 0x5cb0]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5cb8]
test rax, rax
lea rcx, [0x1402095c8]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14002e730
Function at 0x14004c050
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x1402095c0]
lea rdx, [0x14012043c]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14004c0c4
test eax, eax
je 0x14004c0cd
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14004c0d3
mov rbx, qword [r14 + 0x5c38]
jmp 0x14004c148
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb348]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14004c13a
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14004c12d
mov rax, qword [0x1402095c0]
test rax, rax
je 0x14004c12d
dec dword [rax + 0xf4]
mov rdx, qword [0x1402095d0]
call qword [0x1401eb350]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov dword [rbx + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rcx, [rax + r15]
lea rbx, [rax + r15]
add rbx, 4
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14004c1e6
lea rax, [rdi - 1]
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140110980]
mov r11d, 0xffffffff
jmp 0x14004c1c6
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
add rax, 0xffffffffffffffff
jae 0x14004c250
movzx r10d, byte [rdx - 2]
cmp rax, 2
jb 0x14004c1a0
cmp r10b, 0x23
jne 0x14004c1a0
cmp byte [rdx - 1], 0x23
jne 0x14004c1a0
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x14004c1a0
movzx eax, byte [rsi]
test al, al
je 0x14004c24a
lea rdx, [rsi + 2]
mov r8d, 0xffffffff
lea r9, [0x140110980]
mov r11d, 0xffffffff
jmp 0x14004c230
movzx ebp, r10b
mov r10d, r11d
shr r10d, 8
movzx r11d, r11b
xor r11d, ebp
xor r10d, dword [r9 + r11*4]
inc rdx
mov r11d, r10d
test al, al
je 0x14004c250
mov r10d, eax
movzx eax, byte [rdx - 1]
cmp r10b, 0x23
jne 0x14004c210
cmp al, 0x23
jne 0x14004c210
cmp byte [rdx], 0x23
cmove r11d, r8d
jmp 0x14004c210
mov r10d, 0xffffffff
not r10d
mov dword [rcx + 4], r10d
add rcx, 0x14
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140056130
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
vmovaps xmmword [rsp + 0x30], xmm6
mov rsi, r9
vmovaps xmm6, xmm2
mov rbx, rdx
mov rdi, rcx
mov r15, qword [rsp + 0x90]
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add eax, 4
cdqe
imul rax, rax, 0x66666667
mov rcx, rax
shr rcx, 0x3f
shr rax, 0x21
add eax, ecx
shl eax, 2
movsxd rcx, eax
call fcn.14002d4f0
mov r14, rax
movzx ecx, byte [rbx]
test cl, cl
je 0x140056239
add rbx, 5
mov rax, r14
nop word [rax + rax]
movsx edx, cl
xor ecx, ecx
cmp dl, 0x5c
setge cl
xor ecx, 0xffffffdd
add ecx, edx
movsx r8d, byte [rbx - 4]
xor edx, edx
cmp r8d, 0x5c
setge dl
xor edx, 0xffffffdd
add edx, r8d
movsx r9d, byte [rbx - 3]
xor r8d, r8d
cmp r9d, 0x5c
setge r8b
xor r8d, 0xffffffdd
add r8d, r9d
movsx r9d, byte [rbx - 2]
xor r10d, r10d
cmp r9d, 0x5c
setge r10b
xor r10d, 0xffffffdd
add r10d, r9d
movsx r9d, byte [rbx - 1]
xor r11d, r11d
cmp r9d, 0x5c
setge r11b
xor r11d, 0xffffffdd
add r11d, r9d
imul r9d, r11d, 0x55
add r9d, r10d
imul r9d, r9d, 0x55
add r9d, r8d
imul r8d, r9d, 0x55
add r8d, edx
imul edx, r8d, 0x55
add edx, ecx
mov dword [rax], edx
add rax, 4
movzx ecx, byte [rbx]
add rbx, 5
test cl, cl
jne 0x1400561a0
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rsi
mov rcx, rdi
mov rdx, r14
vmovaps xmm3, xmm6
call fcn.1400565f0
mov rsi, rax
mov rcx, r14
call fcn.14002d520
mov rax, rsi
vmovaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret