joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1766aa0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1766aaa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1766ad3
pop rbp
sub rbp, 0x33
sub rbp, 0x1366aa0
sub rsp, 0x20
jmp 0x1766af2
mov rax, 0x1366aa0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffb3a96958
xor byte [rax], dl
inc rax
dec rcx
jne 0x1766b11
invalid
jmp 0x1766b28
adc cl, dl
mov cl, 0xd3
shl dword [rax + rbx*2 + 0x58], 1
pop rax
pop rax
pop rax
adc cl, bl
cdq
push rax
pop rcx
pop rax
pop rax
adc byte [rcx - 0x4f], bl
adc byte [rdi + 0x58585d98], bl
pop rax
adc byte [rdi + 0x5858709a], bl
pop rax
adc byte [rdi - 0x66a6ef46], ch
rcr ecx, cl
push rsp
pop rax
pop rax
pop rax
adc byte [rcx - 0x50], bl
or byte [rax], cl
adc al, ah
loopne 0x1766b2d
jo 0x1766bb8
pop rax
pop rax
pop rax
pop rax
adc cl, ah
mov al, 0x8a
push rbp
pop rcx
pop rax
pop rax
pop rax
pop rax
adc byte [rcx - 0x4f], bl
adc dl, ah
cmpsd dword [rsi], dword [rdi]
loop 0x1766b1b
xor eax, 0x58580419
pop rax
pop rax
mov al, 0x5d
pop rax
pop rax
pop rax
mov cl, 0x4e
pop rax
pop rax
pop rax
cdq
mov al, 0x5a
imul ecx, dword [rcx + 0x10], 0x585c99d9
pop rax
pop rax
adc byte [rdi - 0x4922a870], ah
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
wait
add byte [rdx], al
or cl, byte [rax]
adc al, ah
loopne 0x1766b72
jo 0x1766bfd
pop rax
pop rax
pop rax
pop rax
adc cl, ah
mov al, 0x8a
push rbp
pop rcx
pop rax
pop rax
pop rax
pop rax
adc byte [rcx - 0x4f], bl
mov al, 0x5d
pop rax
pop rax
pop rax
mov cl, 0xd5
pop rdx
pop rax
pop rax
or dh, byte [rax + 0x58585825]
add cl, byte [rdi]
adc cl, dl
invalid
jge 0x1766c56
fadd qword [rdi + 0x58]
pop rax
pop rax
adc byte [rdi - 0x586f4e67], ah
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
jno 0x1766c22
invalid
cmpsd dword [rsi], dword [rdi]
jno 0x1766c31
invalid
pop rsp
pop rax
pop rax
pop rax
adc cl, bl
mov al, 0x5d
pop rax
pop rax
pop rax
mov cl, 0xcb
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
cmpsd dword [rsi], dword [rdi]
invalid
pop rax
pop rax
pop rax
rcr byte [rdi + 0x10], 1
fstp dword [rdi + 0x58585859]
adc byte [rdi + 0x58585a9b], bl
pop rax
pop rdx
mov dl, byte [rdi - 0x23]
pop rdi
pop rax
pop rax
pop rax
ror byte [rsi + 0x10], cl
cmpsd dword [rsi], dword [rdi]
sahf
mov dl, byte [rdi - 0x25]
mov ah, byte [rdi - 0x75a55859]
push rdi
fstp qword [rdi + 0x58]
pop rax
pop rax
ror byte [rsi + 0x10], cl
cmpsd dword [rsi], dword [rdi]
sahf
mov dl, byte [rdi - 0x25]
invalid
Function at 0x1800019c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001a2b
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov dword [rsp + 0x30], 0xf
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxx_xxxxxxx_________xxxxxxxxxxx_________xxxxxxx___xxxxx____xxxx___x__
mov qword [rsp + 0x20], rcx
lea r9, [0x180046b20]
mov rcx, rax
call fcn.180042280
mov r15d, r12d
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x180001b7e
mov rbx, rdi
nop dword [rax + rax]
mov byte [rsp + 0x48], 0
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001ab2
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001aff
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov qword [rsp + 0x20], r12
mov r9d, 1
lea r8, [rsp + 0x48]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x50]
mov rbp, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001b4c
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x180001a80
test rdi, rdi
je 0x180001bbf
mov rdx, qword [rsp + 0x68]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001bb7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001bb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180043acc
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180001bf0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001c5b
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
mov qword [rsp + 0x20], rcx
lea r9, [0x180046ba0]
mov rcx, rax
call fcn.180042280
mov r15d, r12d
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x180001db9
mov rbx, rdi
nop dword [rax + rax]
mov dword [rsp + 0x68], 0xe520f942
mov dword [rsp + 0x6c], 0xe10fee0e
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001ced
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001d3a
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x48]
mov rbp, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001d87
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x180001cb0
test rdi, rdi
je 0x180001dfa
mov rdx, qword [rsp + 0x60]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x180001df2
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180001df2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180043acc
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180001e30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001e9b
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov dword [rsp + 0x30], 3
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, str.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
mov qword [rsp + 0x20], rcx
lea r9, [0x180046bd8]
mov rcx, rax
call fcn.180042280
mov r15d, r12d
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x180001ff1
mov rbx, rdi
nop dword [rax + rax]
mov dword [rsp + 0x48], 0xe320f000
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001f25
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001f72
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov qword [rsp + 0x20], r12
mov r9d, 4
lea r8, [rsp + 0x48]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x50]
mov rbp, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180001fbf
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x180001ef0
test rdi, rdi
je 0x180002032
mov rdx, qword [rsp + 0x68]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x18000202a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000202a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180043acc
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180002070
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x70], rax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
xor r12d, r12d
mov qword [rsp + 0x60], r12
mov rax, qword [0x180056d48]
test rax, rax
jne 0x1800020db
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x68], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov dword [rsp + 0x30], 0xf
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, str.___xxxxxxxxx____________________xxxxxxxxxxxx
mov qword [rsp + 0x20], rcx
lea r9, str.____
mov rcx, rax
call fcn.180042280
mov r15d, r12d
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
sub r14, rdi
sar r14, 3
test r14, r14
je 0x180002239
mov rbx, rdi
nop dword [rax + rax]
mov dword [rsp + 0x68], 0xab851ec
mov dword [rsp + 0x6c], 0xcf5c28f
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x18000216d
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
lea r8d, [r9 - 0x38]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rsi, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x1800021ba
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
mov rdx, rsi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, dword [rsp + 0x48]
mov rbp, qword [rbx]
mov rax, qword [0x180056d48]
test rax, rax
jne 0x180002207
lea ecx, [rax + 0x10]
call fcn.180043720
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], r12d
mov qword [0x180056d48], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9d, esi
mov r8d, 8
mov rdx, rbp
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
inc r15d
add rbx, 8
movsxd rax, r15d
cmp rax, r14
jb 0x180002130
test rdi, rdi
je 0x18000227a
mov rdx, qword [rsp + 0x60]
sub rdx, rdi
and rdx, 0xfffffffffffffff8
mov rax, rdi
cmp rdx, 0x1000
jb 0x180002272
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180002272
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.180043acc
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180043700
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x180004520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000457d
lea rbx, [0x180046f80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180004564
cmp r10, 2
jb 0x180004564
cmp byte [r9], r8b
jne 0x180004564
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180004540
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800045bf
lea rbx, [0x180046f80]
cmp r8b, 0x23
jne 0x1800045a3
cmp byte [r9], r8b
jne 0x1800045a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180004590
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180004700
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000471a
mov qword [r8], 0
lea rdx, [0x18004c8b0]
call fcn.1800045d0
mov rbx, rax
test rax, rax
jne 0x18000473a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180004811
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004811
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180004811
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180004811
cmp rdi, 0xffffffffffffffff
je 0x180004811
mov rax, qword [0x180056d20]
test rax, rax
je 0x1800047ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180004811
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800047fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180056d20]
test rax, rax
je 0x1800047f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000481a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18000480c
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000481c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180007c20
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x180046f80]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x180007cb6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18001b210
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180007cc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x180046f80]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x180014870
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180055040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180056d20]
mov edi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x1800148d1
cmp byte [rbx + 0x4a76], 0
jne 0x1800148d1
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.180004380
test dil, 1
je 0x1800149ff
jmp 0x18001495a
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b9a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x18004e2d8]
mulss xmm1, dword [0x18004e2c0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x18004e250]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
call fcn.180004380
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1800149b0
lea r11, [0x180046f80]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180014993
cmp byte [r8], r9b
jne 0x180014993
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180014980
not ecx
call fcn.18000b9a0
test rax, rax
je 0x1800149ff
cmp byte [rax + 0xb6], 0
je 0x1800149ff
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.180004380
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000e190
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180043700
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180019b50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c80], 0
lea rbx, [rcx + 0x5c88]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180019bf7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180019baa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001be80
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180004cc0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c80]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c90]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180056c74]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180019bff
mov rcx, rbx
call fcn.180004cc0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180019f90
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180056d20]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180019ff3
mov qword [rsp], rbx
lea rbx, [0x180046f80]
nop dword [rax]
cmp r9b, 0x23
jne 0x180019fd3
cmp byte [r8], r9b
jne 0x180019fd3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180019fc0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bf8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x18001a027
mov r10, qword [r10 + 0x5c00]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18001a02e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x18001a014
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret