joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff8c49b2a74
Capabilities:
Access peb ldr_data
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x7fffffff
mov r12d, 1
mov dword [rbp + 0x40], eax
lock dec dword [rbp + 0x40]
sub rax, r12
jne 0x7ff8c49b2a93
xor ebx, ebx
cmp dword [rbp + 0x40], ebx
jne 0x7ff8c49b2c26
mov rax, qword gs:[0x60]
mov r10d, ebx
mov r14d, 0x78f1e5bf
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rcx, qword [rdx]
jmp 0x7ff8c49b2b08
mov r9, qword [rcx + 0x60]
mov r10, rcx
mov r8d, r14d
movzx eax, word [r9]
test ax, ax
je 0x7ff8c49b2b05
movzx eax, ax
lea r9, [r9 + 2]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xf
xor r8d, eax
movzx eax, word [r9]
test ax, ax
jne 0x7ff8c49b2ad9
cmp r8d, 0x66b65ce9
je 0x7ff8c49b2b0d
mov rcx, qword [rcx]
cmp rcx, rdx
jne 0x7ff8c49b2ac6
mov rdx, qword [r10 + 0x30]
movzx r11d, bx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x20]
mov edi, dword [rcx + 0x1c]
add r10, rdx
mov r8d, dword [rcx + 0x24]
add rdi, rdx
mov esi, dword [rcx + 0x18]
add r8, rdx
test esi, esi
je 0x7ff8c49b2b89
mov ecx, dword [r10]
mov r9d, r14d
add rcx, rdx
mov al, byte [rcx]
test al, al
je 0x7ff8c49b2b75
movsx eax, al
add rcx, r12
xor eax, r9d
imul r9d, eax, 0x5bd1e995
mov eax, r9d
shr eax, 0xf
xor r9d, eax
mov al, byte [rcx]
test al, al
jne 0x7ff8c49b2b4d
cmp r9d, 0x64098594
je 0x7ff8c49b2b97
add r11w, r12w
add r10, 4
movzx eax, r11w
add r8, 2
cmp eax, esi
jb 0x7ff8c49b2b3e
mov rsi, rbx
mov rdi, qword [rbp + 0x38]
mov eax, 0x547a79f
jmp 0x7ff8c49b2ba6
movzx eax, word [r8]
mov esi, dword [rdi + rax*4]
add rsi, rdx
jmp 0x7ff8c49b2b8c
add rdi, r12
cmp dword [rdi], eax
jne 0x7ff8c49b2ba3
lea rax, [rbp + 0x50]
mov r14d, 0x2660f
lea r15, [rdi + 4]
mov qword [rbp + 0x58], r14
mov r9d, 4
mov qword [rbp - 0x10], r15
lea r8, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x10]
or rcx, 0xffffffffffffffff
call rsi
mov rdx, r15
mov dword [rbp + 0x48], 0xa6f7242c
mov rax, rbx
add rbx, r12
and eax, 3
mov al, byte [rbp + rax + 0x48]
xor byte [rdx], al
add rdx, r12
sub r14, r12
jne 0x7ff8c49b2be3
lea rax, [rbp + 0x50]
mov qword [rbp - 8], r15
lea r9d, [r14 + 0x20]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x58]
or rcx, 0xffffffffffffffff
invalid
invalid
Function at 0x7ff8c49b4786
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
push rax
mov rbp, rsp
mov r14, r9
mov r13, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x7ff8c4a32268]
xor rax, rbp
mov qword [rbp], rax
sub rsp, 0x20
lea rcx, str.VK_INSTANCE_LAYERS
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add rsp, 0x20
test eax, eax
je 0x7ff8c49b48e2
mov r12d, eax
test rsi, rsi
je 0x7ff8c49b4801
mov rax, qword [rsi + 0x3fd8]
test rax, rax
je 0x7ff8c49b4801
mov edx, r12d
mov rcx, qword [rsi + 0x3fd0]
sub rsp, 0x20
mov r8d, 8
xor r9d, r9d
call rax
jmp 0x7ff8c49b480d
mov ecx, r12d
sub rsp, 0x20
call fcn.7ff8c49f34e8
add rsp, 0x20
mov rdi, rax
test rax, rax
je 0x7ff8c49b48e2
sub rsp, 0x20
lea rcx, str.VK_INSTANCE_LAYERS
mov rdx, rdi
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov rcx, rdi
call fcn.7ff8c49f5170
add rsp, 0x20
add rax, 0x10
and rax, 0xfffffffffffffff0
call fcn.7ff8c49e16e0
sub rsp, rax
mov rbx, rsp
sub rsp, 0x20
mov rcx, rbx
mov r12, rdi
mov rdx, rdi
call fcn.7ff8c49f4f70
add rsp, 0x20
cmp byte [rbx], 0
je 0x7ff8c49b48af
sub rsp, 0x20
mov rcx, rbx
call fcn.7ff8c49af724
add rsp, 0x20
mov rdi, rax
sub rsp, 0x30
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r15
mov rcx, rsi
mov rdx, rbx
mov r8d, 2
mov r9, r14
call fcn.7ff8c49b0c18
add rsp, 0x30
mov rbx, rdi
test rdi, rdi
jne 0x7ff8c49b4869
test rsi, rsi
je 0x7ff8c49b48d2
mov rax, qword [rsi + 0x3fe8]
test rax, rax
je 0x7ff8c49b48d2
mov rcx, qword [rsi + 0x3fd0]
sub rsp, 0x20
mov rdx, r12
call rax
jmp 0x7ff8c49b48de
sub rsp, 0x20
mov rcx, r12
call fcn.7ff8c49f29a0
add rsp, 0x20
mov rcx, qword [rbp]
xor rcx, rbp
sub rsp, 0x20
call fcn.7ff8c49e1750
nop
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x7ff8c49ba6e0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
push rdi
lea r10d, [rdx + 3]
test edx, edx
mov eax, edx
cmovs eax, r10d
sar eax, 2
movsxd r9, eax
shl r9, 2
cmp r10d, 7
jb 0x7ff8c49ba740
mov r11, r9
sub r11, r9
add r11, rcx
mov r10d, eax
xor eax, eax
mov esi, dword [r11 + rax*4]
imul edi, esi, 0xcc9e2d51
imul esi, esi, 0x16a88000
shr edi, 0x11
or edi, esi
imul esi, edi, 0x1b873593
xor esi, r8d
rol esi, 0xd
lea r8d, [rsi + rsi*4]
add r8d, 0xe6546b64
inc rax
cmp r10d, eax
jne 0x7ff8c49ba70c
mov eax, edx
and eax, 3
xor r10d, r10d
cmp rax, 1
je 0x7ff8c49ba76e
cmp eax, 2
je 0x7ff8c49ba762
cmp eax, 3
jne 0x7ff8c49ba790
movzx r10d, byte [rcx + r9 + 2]
shl r10d, 0x10
movzx eax, byte [rcx + r9 + 1]
shl eax, 8
or r10d, eax
movzx eax, byte [rcx + r9]
xor eax, r10d
imul ecx, eax, 0xcc9e2d51
imul eax, eax, 0x16a88000
shr ecx, 0x11
or ecx, eax
imul eax, ecx, 0x1b873593
xor r8d, eax
xor r8d, edx
mov eax, r8d
shr eax, 0x10
xor eax, r8d
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
pop rdi
pop rsi
ret

Function at 0x7ff8c49c82a8
Capabilities:
Get common file path

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x138
mov r14, rdx
mov rdi, rcx
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rbx, [rsp + 0x20]
mov esi, 0x104
mov r8d, 0x104
mov rcx, rbx
xor edx, edx
call fcn.7ff8c49e3d70
mov rcx, rbx
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [rbx], 0
je 0x7ff8c49c8303
inc rbx
dec rsi
jne 0x7ff8c49c82f4
jmp 0x7ff8c49c8330
xor eax, eax
lea rcx, str.dxgi.dll
cmp rax, 9
je 0x7ff8c49c8322
mov dl, byte [rax + rcx]
mov byte [rbx], dl
inc rbx
inc rax
dec rsi
jne 0x7ff8c49c830c
lea rax, [rbx - 1]
test rsi, rsi
cmovne rax, rbx
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.CreateDXGIFactory1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x7ff8c49c835f
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call rax
mov esi, eax
jmp 0x7ff8c49c8364
mov esi, 0x887a0002
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, esi
add rsp, 0x138
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x7ff8c49c9d82
Capabilities:
Encrypt data using rc4 prga

Disassembly:
xor edx, edx
jmp 0x7ff8c49c9e8a
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp byte [rcx + 0x5e], 0
je 0x7ff8c49c9ecf
movzx edi, word [rsi + 0x5c]
test bl, bl
je 0x7ff8c49c9fd4
mov word [rsi + 0x5c], 0xffff
mov byte [rsi + 0x5e], 0
jmp 0x7ff8c49c9fd4
mov eax, dword [rsi + 0x58]
test eax, eax
mov edi, 1
cmovg edi, eax
xor ebp, ebp
mov rcx, qword [rsi + 0x40]
call fcn.7ff8c49f349c
cmp eax, 0xffffffff
je 0x7ff8c49c9fd0
mov byte [rsp + rbp + 0x58], al
inc rbp
cmp rdi, rbp
jne 0x7ff8c49c9ede
cmp byte [rsi + 0x5f], 0
je 0x7ff8c49c9f22
movsx eax, byte [rsp + 0x58]
mov word [rsp + 0x56], ax
test bl, bl
je 0x7ff8c49c9f94
movzx edi, word [rsp + 0x56]
mov word [rsi + 0x5c], di
jmp 0x7ff8c49c9fd4
lea r13, [rsp + 0x56]
lea r12, [rsp + 0x48]
lea r14, [rsp + 0x58]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r15, qword [rdx]
lea r9, [rsp + rdi]
add r9, 0x58
mov rax, qword [rcx]
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r8, r14
call qword [rax + 0x18]
cmp eax, 1
jne 0x7ff8c49c9fbd
mov rax, qword [rsi + 0x50]
mov qword [rax], r15
cmp rdi, 8
je 0x7ff8c49c9fd0
mov rcx, qword [rsi + 0x40]
call fcn.7ff8c49f349c
cmp eax, 0xffffffff
je 0x7ff8c49c9fd0
mov byte [rsp + rdi + 0x58], al
inc rdi
jmp 0x7ff8c49c9f31
mov edi, edi
test rdi, rdi
jle 0x7ff8c49c9fb6
mov rdx, qword [rsi + 0x40]
movsx eax, byte [rsp + rdi + 0x57]
dec rdi
movzx ecx, ax
call fcn.7ff8c49f5604
cmp eax, 0xffffffff
jne 0x7ff8c49c9f96
jmp 0x7ff8c49c9fd0
movzx edi, word [rsp + 0x56]
jmp 0x7ff8c49c9fd4
cmp eax, 2
je 0x7ff8c49c9fd0
cmp eax, 3
je 0x7ff8c49c9f02
jmp 0x7ff8c49c9f0c
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x7ff8c49ca02c
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r14, [rsp + 0x38]
lea r12, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov ebp, 0xffffffff
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r12
mov r8, r15
mov r9, r14
call qword [rax + 0x20]
mov edi, eax
mov rbx, qword [rsp + 0x28]
sub rbx, r15
mov r9, qword [rsi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.7ff8c49f30c0
cmp rax, rbx
jne 0x7ff8c49ca0b3
cmp edi, 1
je 0x7ff8c49ca060
cmp edi, 2
je 0x7ff8c49ca0b3
mov rcx, qword [rsi + 0x40]
call fcn.7ff8c49f1ea4
neg eax
sbb ebp, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, ebp
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x7ff8c49ca0d2
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x7ff8c49ca107
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7ff8c49f30c0
xor ebx, ebx
test rsi, rsi
jle 0x7ff8c49ca12c
movzx edx, byte [r14 + rbx]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp eax, 0xffffffff
je 0x7ff8c49ca12c
inc rbx
cmp rsi, rbx
jne 0x7ff8c49ca10e
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x7ff8c49ca13a
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r15d, edx
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp edx, 0xffffffff
je 0x7ff8c49ca197
mov rdi, rcx
mov byte [rsp + 0x57], r15b
cmp byte [rcx + 0x58], 0
je 0x7ff8c49ca1a6
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x57]
mov edx, 1
mov r8d, 1
call fcn.7ff8c49f30c0
mov esi, 0xffffffff
cmp rax, 1
jne 0x7ff8c49ca256
xor esi, esi
cmp r15d, 0xffffffff
cmovne esi, r15d
jmp 0x7ff8c49ca256
lea rbx, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], rbx
lea rsi, [rsp + 0x57]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r14
mov r8, rsi
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rsi
je 0x7ff8c49ca251
mov ebp, eax
cmp eax, 3
je 0x7ff8c49ca230
cmp ebp, 1
ja 0x7ff8c49ca251
mov rsi, qword [rsp + 0x48]
sub rsi, rbx
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, rbx
mov r8, rsi
call fcn.7ff8c49f30c0
cmp rax, rsi
jne 0x7ff8c49ca251
mov rsi, qword [rsp + 0x40]
cmp ebp, 1
je 0x7ff8c49ca1c3
jmp 0x7ff8c49ca197
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rsi
call fcn.7ff8c49f30c0
cmp rax, 1
je 0x7ff8c49ca197
mov esi, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, esi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x7ff8c49ca2ae
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp byte [rcx + 0x58], 0
je 0x7ff8c49ca2e3
mov r9, qword [rdi + 0x40]
mov edx, 2
mov rcx, r14
mov r8, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7ff8c49f30c0
xor ebx, ebx
test rsi, rsi
jle 0x7ff8c49ca309
movzx edx, word [r14 + rbx*2]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp ax, 0xffff
je 0x7ff8c49ca309
inc rbx
cmp rsi, rbx
jne 0x7ff8c49ca2ea
mov rbx, rsi
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x7ff8c49ca316
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov esi, edx
mov rax, qword [0x7ff8c4a32268]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp dx, 0xffff
je 0x7ff8c49ca372
mov rdi, rcx
mov word [rsp + 0x56], si
cmp byte [rcx + 0x58], 0
je 0x7ff8c49ca382
mov r9, qword [rdi + 0x40]
lea rcx, [rsp + 0x56]
mov edx, 2
mov r8d, 1
call fcn.7ff8c49f30c0
mov di, 0xffff
cmp rax, 1
jne 0x7ff8c49ca431
xor eax, eax
cmp si, 0xffff
cmove esi, eax
mov edi, esi
jmp 0x7ff8c49ca431
lea r15, [rsp + 0x58]
lea r12, [rsp + 0x48]
mov qword [r12], r15
lea rbx, [rsp + 0x56]
lea r13, [rsp + 0x60]
lea r14, [rsp + 0x40]
mov rcx, qword [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
mov rax, qword [rcx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r14
mov r8, rbx
lea r9, [rsp + 0x58]
call qword [rax + 0x10]
cmp qword [rsp + 0x40], rbx
je 0x7ff8c49ca42d
mov ebp, eax
cmp eax, 3
je 0x7ff8c49ca40c
cmp ebp, 1
ja 0x7ff8c49ca42d
mov rbx, qword [rsp + 0x48]
sub rbx, r15
mov r9, qword [rdi + 0x40]
mov edx, 1
mov rcx, r15
mov r8, rbx
call fcn.7ff8c49f30c0
cmp rax, rbx
jne 0x7ff8c49ca42d
mov rbx, qword [rsp + 0x40]
cmp ebp, 1
je 0x7ff8c49ca39f
jmp 0x7ff8c49ca372
mov r9, qword [rdi + 0x40]
mov edx, 1
mov r8d, 1
mov rcx, rbx
call fcn.7ff8c49f30c0
cmp rax, 1
je 0x7ff8c49ca372
mov di, 0xffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff8c49e1750
mov eax, edi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x7ff8c49ca542
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x7ff8c49ca579
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp r8, rdx
jne 0x7ff8c49ca553
ret

Function at 0x7ff8c49ca678
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x7ff8c49ca6b0
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp r8, rdx
jne 0x7ff8c49ca689
ret
Function at 0x140e09058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e091df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e09089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e0906f
add dl, dl
jne 0x140e09096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e090f6
xor eax, eax
add dl, dl
jne 0x140e090a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e091ad
add dl, dl
jne 0x140e090b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e090c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e090d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e090dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e090ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e0907e
mov eax, 1
add dl, dl
jne 0x140e09106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e09113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e090fb
sub eax, ebx
mov ebx, 1
jne 0x140e0914c
mov ecx, 1
add dl, dl
jne 0x140e0912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e0913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e09123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e09168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e09175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e0915d
cmp eax, 0x7d00
jae 0x140e0919b
cmp eax, 0x500
jb 0x140e09196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0907e
cmp eax, 0x7f
ja 0x140e0919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e0907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e091d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e0907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000278d
lea rbx, [0x140040060]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002774
cmp r10, 2
jb 0x140002774
cmp byte [r9], r8b
jne 0x140002774
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002750
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400027cf
lea rbx, [0x140040060]
cmp r8b, 0x23
jne 0x1400027b3
cmp byte [r9], r8b
jne 0x1400027b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400027a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000292a
mov qword [r8], 0
lea rdx, [0x14003fce4]
call fcn.1400027e0
mov rbx, rax
test rax, rax
jne 0x14000294a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002a21
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002a21
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002a21
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002a21
cmp rdi, 0xffffffffffffffff
je 0x140002a21
mov rax, qword [0x14004ca60]
test rax, rax
je 0x1400029be
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002a21
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140002a0e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004ca60]
test rax, rax
je 0x140002a03
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002a2a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002a1c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002a2c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140004e50
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140040060]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r8 + rcx*4]
mov rcx, qword [0x14004ca60]
not ebx
cmp dword [rcx + 0x3edc], ebx
jne 0x140004edb
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140017340
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140010c50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x14004ca60]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x140010ca2
cmp byte [rbx + 0x424e], 0
jne 0x140010ca2
movsx r9d, word [rbx + 0x5332]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1400025f0
test dil, 1
je 0x140010dc8
jmp 0x140010d2b
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5332]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140044c74]
mulss xmm1, dword [0x140044c68]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x140044bd0]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.1400025f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010d80
lea r11, [0x140040060]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140010d63
cmp byte [r8], r9b
jne 0x140010d63
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140010d50
not ecx
call fcn.140009e40
test rax, rax
je 0x140010dc8
cmp byte [rax + 0x96], 0
je 0x140010dc8
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5332]
mov edx, 0x10
movsx r9d, word [rbx + 0x5332]
call fcn.1400025f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c4a0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140015ef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53e0], 0
lea rbx, [rcx + 0x53e8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140015f97
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140015f4a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140017f70
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140002da0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53e0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53f0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14004ca58]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140015f9f
mov rcx, rbx
call fcn.140002da0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140016510
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14004ca60]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140016573
mov qword [rsp], rbx
lea rbx, [0x140040060]
nop dword [rax]
cmp r9b, 0x23
jne 0x140016553
cmp byte [r8], r9b
jne 0x140016553
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140016540
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400165a7
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400165ae
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140016594
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret