joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140885e44
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
movzx eax, byte [rsp + r11 - 0xd9fe]
sal dl, 0x61
not rcx
btc r11, r8
mov qword [rbx + r11*4 - 0x347f4], rcx
ror byte [rsp + r11*2 - 0x1a400], 0xa4
div al
shr word [rsp + r11 - 0xd1f4], 0xc7
lea rbx, [rbx + r11 - 0xd1f4]
mov ecx, dword [rsp + r11 - 0xd1fc]
cqo
mov esi, dword [r10 + r11*2 - 0x1a3ff]
xchg dword [rsp + r11*2 - 0x1a400], r11d
adc edx, ecx
lea r10, [rdx + r10 - 0xafc]
or dword [rsp + rdx - 0xaf7], 0x8a1a302f
sbb word [rsp + rdx - 0xafc], cx
and dword [rsp + rdx - 0xaf7], eax
xor esi, r9d
shl ax, cl
div r8b
not dword [rsp + rdx*4 - 0x2c01]
dec esi
shr dword [rsp + rdx - 0xafd], 0x85
xchg qword [rsp + rdx - 0xaf9], rdx
xor esi, 0x203f9cab
neg r11b
sar r11d, cl
lea esi, [rsi + r11 - 0x3089a201]
xchg r8d, eax
ror esi, cl
neg rdx
rol r8, cl
ja 0x140883e51
not esi
xor esi, 0x1a2905b4
mov qword [rsp + rcx*2 - 0x15fa], r9
call fcn.14088cc4d
xor byte [rsp + r8*2 - 0x6d7f395f], 0x35
movzx eax, byte [r10 + r8*2 - 0x6d7f3968]
movsx r11d, r8b
xor al, r9b
or r11b, bpl
mov qword [rsp + r8*2 - 0x6d7f3968], 0xffffffffff3c4908
shl qword [rsp + r8*2 - 0x6d7f3960], 0x27
dec al
push r8
sub dword [rsp + r8*2 - 0x6d7f3967], r8d
dec ebp
neg al
sar byte [rsp + r8 - 0x36bf9ca2], 0xe5
btc bp, 0x20
neg dword [rsp + r8 - 0x36bf9ca8]
ror al, 1
sal r11, 0xa9
not al
movzx ecx, word [rsp + r8 - 0x36bf9ca0]
xor r9b, al
or r8, qword [rsp + rcx - 0xd9f0]
adc ebp, ebp
sar dword [rsp + rcx - 0xd9ef], 0xc3
lea rax, [rsp + rax + 0x18]
xchg r11, rcx
lea rcx, [rcx + r8*8 - 0x2aefe5fc]
inc word [rsp + r11 - 0xd9f8]
mov dword [rax + r11*2 - 0x1b400], edx
movzx edx, r11b
je fcn.1408787b9
mov rcx, qword [rbx + r11*2 - 0x1b3fc]
or dword [rsp + r11*2 - 0x1b3fc], r8d
adc ebp, 0x2c1b4631
mov rbp, qword [rbx + r11 - 0xd9f4]
pop rsi
xor byte [rsp + r11*8 - 0x6cffb], 0xb
not r8w
and rcx, rbp
jmp 0x140832f63

Function at 0x1408865b3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
and word [rsp + r8 - 0x1fae5], bp
inc eax
mov qword [rsp + r8 - 0x1fb10], rsi
mov qword [rsp + r8*2 - 0x3f5f8], r9
mov qword [rsp + r8*8 - 0xfd878], rbp
rol bp, 7
xor dword [rsp + r8*2 - 0x3f5f8], eax
lea r9, [rdx + rsi + 0x153ee4a9]
mov r9, qword [rsp + r8 - 0x1fae8]
add byte [rsp + r8*2 - 0x3f61e], sil
bt ecx, r11d
jb 0x140889426
movsxd rax, eax
call fcn.140866293
lea r11d, [r11 + rax + 0x601259ed]
lea rax, [rcx*8 - 0x1973b8d0]
xadd dword [rsp + 1], ecx
sub cl, ch
rol r11d, 2
bts si, 0x82
sbb r11d, 0x8ea39c1e
inc ecx
bswap r11d
bts rsi, 0x13
mov qword [rsp], r9
and dx, 0x57b8
lea r9, [rbp + rcx*2 - 0x40d6c5de]
xor dword [rsp], r11d
xor al, ch
sal rbp, cl
pop r9
seta cl
movsxd r11, r11d
sal rbp, cl
setne sil
adc rdi, r11
lea r11, [rax*4 + 0x7687ab0d]
rol al, 0xe4
jmp rdi
Function at 0x14088660c
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sal cl, 0x44
adc rdi, rbp
push rcx
inc cx
mov rcx, qword [rax + rbx + 0x4b6e]
mov rax, qword [rbx + rax*2 + 0x96e4]
add rbx, 0xc
neg byte [rsp + 0x16]
ror dword [rsp + 0x1b], 0x2b
je 0x14088d502
mov cl, byte [rdx + rbx - 0x1097d4f4]
xchg sil, r8b
lea rbx, [rbx + rdx*4 - 0x425f53e6]
mov byte ss:[rdx + rax - 0x1097d4fc], cl
cmovnp rsi, rdx
movsx r11d, bpl
jmp rdi
xor r11d, r11d
test rax, rax
lea rsp, [rsp + 0x20]
je 0x14088d597
mov esi, 0x749b0401
or sil, 6
rol rsi, 0x46
push rbx
lea rbx, [rsi*4 - 0x4cccc3d0]
sub si, bx
lea rsi, [0x1408814e8]
mov ebx, 0x65a4eead
movzx ebx, byte [rcx + rbx - 0x65a4eead]
xor ebx, r11d
push 0xffffffffb28fff9f
push 0xffffffffc412e8ae
and ebx, 0xff
not qword [rsp + 1]
dec byte [rsp + 8]
mov ebx, dword [rsi + rbx*4]
shr r11d, 8
push 0x72b5b8a4
xor r11d, ebx
not byte [rsp + 5]
xor byte [rsp + 9], 0xad
inc rcx
xor r11d, 0xe93cd0c
dec rax
push 0x33a4c606
lea rsp, [rsp + 0x20]
jne 0x14088d533
mov ecx, 0x45b9329a
pop rbx
not r11d
mov esi, 0x6527e536
lea rbp, [rsi*4 - 0x6cfba8c5]
call fcn.140836e54
ror r11d, 1
dec dl
imul ax
push r9
xor dword [rsp + rax - 0x5aaee100], r11d
pop r9
movsxd r11, r11d
mov ebp, 0x5198d038
add rdi, r11
xadd rsi, rbp
or ebp, ecx
mov rax, qword [rbx + rdx*2 - 0x212e5606]
not dx
ja 0x1408866c1
mov ecx, 0x7d1c1bb9
mov r8d, 0x890ee99e
movzx r11d, cx
mov esi, dword [rcx + rbx - 0x7d1c1bb9]
lea rdx, [r11 + r8 + 0x1198bba9]
lea rbp, [rcx + r8*4 - 0x2405cd8]
lea rax, [rsp + r11*4 - 0x6e1c]
not rcx
btr ecx, 0x36
mov dword [rax + r11*2 - 0x3772], esi
setae r11b
mov esi, dword [r10 + r11*4 - 0x6c00]
push rdx
lea r10, [r10 + r11*4 - 0x6bfc]
mov eax, r11d
sub bpl, byte [rsp + r11 - 0x1af9]
xor esi, r9d
xor rax, rdx
ror esi, 1
bswap esi
mul bp
sbb esi, 0xf62aa111
not edx
xor esi, 0x8383592b
call fcn.140866cd2
mov r11d, 0xb3af420a
mov edx, dword [r10 + riz]
movsx ecx, r11w
lea r8, [rcx*2 + 0x2419410c]
lea r10, [r10 + rcx*2 - 0x8410]
xor edx, r9d
bt r11, 0xc
neg edx
movsx ebp, cl
xor edx, 0x662f0c2e
lea edx, [rdx + rcx*2 - 0x59342244]
neg edx
mov eax, r11d
dec edx
movzx esi, bpl
btc r8, rsi
bswap rbp
push r9
xor dword [rsp + r8 - 0x2419c120], edx
sar si, cl
pop r9
movsxd rdx, edx
rol r8b, 0xe2
adc rdi, rdx
push rsi
movzx edx, byte [rsp + rcx*4 - 0x10826]
movzx r11d, word [r10 + rcx*4 - 0x10828]
bswap r8d
rol rcx, cl
cwde
lea r10, [r10 + rax*2 - 0x8412]
ror al, 0xa2
cwd
neg edx
xor r11w, r9w
shr rdx, 0x92
or rax, rsi
xor rdx, 0xffffffffc1adc286
not r11w
sal r8d, 0x98
mul bp
dec r11w
or dword [rsp + rcx - 0x10827ff], 0x92347cb3
btr cx, si
rol r11w, 1
imul ebp, dword [rsp + rcx*2 - 0x2105000]
xchg qword [rsp + rcx - 0x1082800], rbp
dec qword [rsp + rcx*2 - 0x2105000]
dec r11w
and r8, qword [rsp + rcx*2 - 0x2105000]
xor r9w, r11w
not word [rsp + rcx - 0x10827fa]
shl word [rsp + rcx - 0x10827fa], 0x6c
xchg word [rsp + rcx*2 - 0x2104fff], si
lea r11, [rsp + r11 + 8]
call fcn.1408438ab
Function at 0x140887425
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
call fcn.140845aaa
mov rcx, qword [rbx]
mov eax, 0x5995d30a
movzx edx, al
bts rax, 0x85
mov r11b, byte [rbx + rax - 0x5995d322]
jb 0x14088e062
dec dx
lea rbx, [rbx + rax - 0x5995d320]
bswap eax
jns 0x14085c3bf
mov qword [rsp + rbp*2 - 0x2c30903e], r9
mov r9d, 0x193a1cbb
add r8, r8
xor dword [rsp + rbp*4 - 0x5861207c], edx
neg r9b
lea r9, [rbp*8 + 0x3baf16a5]
pop r9
and sil, 0x8d
mov dword [rbx + rbp - 0x16184823], edx
or bp, 0xe9be
mov ecx, dword [r10 + rbp*4 - 0x5863a6f8]
inc rax
lea r10, [r10 + rbp*2 - 0x2c31d376]
sub bp, ax
xor ecx, r9d
movzx r11d, r8b
inc ecx
bt r11d, eax
not ecx
shl r8d, 0xf1
inc ecx
add si, 0x5c0e
btc r11w, 0x23
lea rdx, [rbp*4 - 0x4ff2b379]
not ecx
btc r11d, eax
xor ecx, 0x94284199
xchg si, r8w
ror edx, 0xea
push r9
xor dword [rsp + rbp - 0x161831de], ecx
or rdx, rsi
xor dx, ax
pop r9
bt eax, eax
bt r11, 0x37
setb al
movsxd rcx, ecx
neg sil
shr si, 0xc7
sal dx, 4
adc rdi, rcx
cdqe
mov r11w, 3
mov word [rax + rbx + 0x161848fa], r11w
movsx r11d, bp
lea rbx, [rbx + rbp*2 - 0x2c3063c2]
jmp fcn.140837a63
lea rbx, [rax + rbx - 0x5020b6e8]
rol ax, 1
neg esi
mov qword [rbx + rsi - 0xff9f], rdx
jns 0x14086056c
push 0x3102e72b
or qword [rsp], 0x63de195
mov rbp, qword [rbx]
mov r8d, 0x36bc31a2
movzx esi, r8b
movzx eax, r8b
mov r8w, word [rbx + r8 - 0x36bc319a]
push rsi
push rsi
lea rbx, [rbx + rax - 0x98]
and qword [rsp + rsi*2 - 0x134], rax
call fcn.14087a8f7
mov qword [rsp + rbp*2 - 0x2c30903e], 0x43960c38
movsx esi, byte [rsp + rbp - 0x1618481b]
ror edx, 1
xor si, 0x859b
dec edx
lea r8, [rsi*4 - 0x2940e454]
btc esi, 0xf
xor dword [rsp + rbp - 0x1618481f], ebp
not edx
lea edx, [rdx + rbp*2 + 0xd8b924d]
not eax
jge 0x140861aee
mov eax, 0x928105b8
movzx r8d, byte [r10 + riz]
mov r11d, 0xd6238089
add r10, 1
mov ecx, r11d
xor r8b, r9b
sal cl, 0xa5
movsx esi, al
dec al
dec r8b
push rax
xor r8b, 0x38
movzx ebp, byte [rsp]
sal eax, 0xe5
dec r8b
rol r8b, 1
mov byte [rsp + rbp - 0xb4], al
bts ecx, 0x16
xchg byte [rsp + rax - 0x5020b6de], sil
xor r9b, r8b
lea r11, [rsi*8 + 0x161991ac]
shr bp, 0xed
lea r8, [rsp + r8 + 8]
add si, word [rsp + rbp + 3]
mov rdx, qword [r8 + rbp*4]
or r11w, bp
jle 0x140861bc2

Function at 0x140887de5
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
mov qword [r8 + rbx - 0xb63], rcx
call fcn.14082eca4
Function at 0x14088a831
Capabilities:
Authenticate hmac

Disassembly:
shl cx, cl
setb sil
neg r8b
shr r11w, 0xc6
xor r9b, r8b
movsx edx, r11b
add r8, rsp
lea r11, [rsi + rsi - 0x1ed552df]
jmp 0x1408925e5
lea rcx, [rbp*8 + 0x759cfc8d]
add r8b, 9
rol si, cl
pop rbp
lea rax, [rcx + rsi*8 - 0x28d8a16e]
xor r8b, 0x90
sub r8b, 0xa6
not r8b
jmp 0x1408609ab
mul si
mov r11d, dword [rcx + r8 - 0x759ca000]
sar al, 0x61
and cl, sil
xor al, 0x28
mov dword [rcx + rbx - 0x759ca004], r11d
movzx ebp, al
mov esi, dword [r10 + rcx - 0x759c9fff]
bt ax, dx
or bp, ax
movzx r8d, al
xor esi, r9d
mul rcx
and ax, 0x631e
sbb ebp, r8d
ror esi, 1
shl r8, 0x7c
bswap esi
movsx r11d, r8w
btr eax, ebp
sbb esi, 0xf62aa112
neg rcx
shl r11, 0x11
imul eax, ebp
xor esi, 0x8383592b
sub dl, ch
rol eax, 0x61
lea esi, [rcx + rsi - 0x300f45b7]
xadd al, dl
push r9
mul r11d
bswap r11d
cwde
xor dword [rsp + rax], esi
or r8b, 0x90
pop r9
xadd r11b, cl
shl r11b, 5
and cx, dx
movsxd rsi, esi
adc rdi, rsi
movsx esi, bp
mov ecx, dword [rbx + rcx + 0x759cfffc]
or ax, si
xor r11b, byte [r10 + rdx + 5]
lea r10, [r10 + rax - 0x42fa]
neg sil
sal r8d, 1
rol ebp, 0x4f
xor r11b, r9b
rol rax, 0x6e
add r8b, 0x17
shr sil, 0xe4
dec r11b
div rax
call fcn.14083aa58

Function at 0x14088f516
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
idiv eax
mov r11w, word [r8 + rcx]
mov word [rbx + r8*2 - 6], r11w
pop rcx
lea r11, [r8 + rdx*4 - 0x60d87244]
movzx eax, byte [r10 + r8*2 + 5]
lea rcx, [rdx + rsi*8 - 0x6ee30a52]
xor al, r9b
add al, 0x99
xor al, 0x1c
shl r8d, cl
neg al
dec al
push rcx
ror al, 1
not dword [rsp + r8 + 4]
and cl, dl
sbb qword [rsp + r8], 0xfffffffff29bf09f
adc al, r8b
sar r8b, 0x65
imul dx, word [rsp + r8 + 3]
not al
sub rcx, 0xffffffff821a1e3f
not r8d
xor r9b, al
lea rax, [rsp + rax + 8]
and dword [rsp + rsi - 0x5798fffe], ecx
mov bp, word [rsi + rax - 0x5798fffe]
sub byte [rsp + rsi - 0x5798fffb], r8b
mov word [rbx + rsi - 0x57990006], bp
or dx, word [rsp + rdx*2 - 0x3762e30d]
mov ebp, r11d
lea rbx, [rsi + rbx - 0x57990006]
call fcn.140882f42
mov word [rbx + riz + 6], bp
je 0x14088fc44
mov esi, 0xd3bfc3b2
mov ecx, dword [r10 + riz]
movsx ebp, r8w
xor ecx, r9d
inc sil
btr rsi, r8
xor ecx, 0x4d8d1b25
lea rsi, [rsi*8 - 0x1967d6ff]
bswap ecx
ror ecx, 3
dec ecx
add bpl, r8b
ror rsi, 0x13
shr bp, 0xe2
push r9
movzx edx, r8w
lea rdx, [r8*8 + 0x13b13796]
xor dword [rsp], ecx
pop r9
and dx, dx
xadd rbp, rdx
lea rax, [rsi + r8*8 + 0x4ebf5c2d]
movsxd rcx, ecx
call fcn.14088621b
Function at 0x1400110a0
Capabilities:
Create process on windows

Disassembly:
jmp 0x140015e00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xf8
lea rbp, [rsp + 0x30]
lea rcx, [0x14002a0f5]
call fcn.14001161d
mov rcx, qword [rbp + 0xe0]
call fcn.1400110a5
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rdx, str.Running_file:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400110c8
mov rdx, qword [rbp + 0xe0]
mov rcx, rax
call fcn.14001159b
lea rdx, [0x14001104b]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14001137a
Capabilities:
Terminate process

Disassembly:
jmp 0x140017a70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001146a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140018dc0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140018de0
xor al, al
jmp 0x140018e61
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140018df3
xor al, al
jmp 0x140018e61
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140018e1d
xor al, al
jmp 0x140018e61
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140018e31
xor al, al
jmp 0x140018e61
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140018e43
xor al, al
jmp 0x140018e61
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140018e5f
xor al, al
jmp 0x140018e61
mov al, 1
add rsp, 0x38
ret
Function at 0x140003560
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400035bd
lea rbx, [0x140042c20]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400035a4
cmp r10, 2
jb 0x1400035a4
cmp byte [r9], r8b
jne 0x1400035a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003580
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400035ff
lea rbx, [0x140042c20]
cmp r8b, 0x23
jne 0x1400035e3
cmp byte [r9], r8b
jne 0x1400035e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400035d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400037c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1400037de
mov qword [r8], r14
lea rdx, [0x140042730]
call fcn.140003610
mov rbx, rax
test rax, rax
jne 0x140003803
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000392d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000392d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000392d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000392d
cmp rdi, 0xffffffffffffffff
je 0x14000392d
mov rcx, rdi
call fcn.1400076b0
mov rbp, rax
test rax, rax
je 0x14000392d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000391a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x14004f820]
test r8, r8
je 0x14000390f
movsx rdx, word [r8 + 0x60f0]
lea rcx, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140003904
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rcx, [r8 + 0x60f4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60ec]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140003936
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140003928
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140003938
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400071a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140042c20]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x404c], ebx
jne 0x140007236
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001b0e0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000a8d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x14004f040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14004f820]
mov ebp, edx
mov r10, rcx
mov r9d, dword [rdi + 0x4a00]
mov rbx, qword [rdi + 0x4000]
bts r9d, 8
mov dword [rdi + 0x4a00], r9d
mov dword [rdi + 0x4a38], 1
cmp qword [rbx + 0x1b8], 0
jne 0x14000a947
cmp qword [rdi + 0x4e18], 0
mov eax, 0x260
je 0x14000a94c
mov eax, 0x230
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x114]
subss xmm2, dword [rbx + 0x110]
mov rdx, qword [r8]
call fcn.140013ba0
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rdi + 0x4a20], xmm0
xor edx, edx
mov dword [rdi + 0x4a00], r9d
mov dword [rdi + 0x4a08], 1
mov r9, qword [rbx + 8]
test r10, r10
je 0x14000a9be
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.1400033c0
jmp 0x14000a9ce
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.1400033c0
mov rcx, qword [rsp + 0x30]
xor edx, edx
movss xmm6, dword [rdi + 0x3918]
mov r8d, 0x1000107
call fcn.14000dab0
mov rsi, qword [rdi + 0x4000]
movzx r14d, al
movss dword [rdi + 0x3918], xmm6
cmp word [rsi + 0xcc], 1
mov dword [rsi + 0x88], ebp
jne 0x14000aa18
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, ebp
lea rdx, [0x140041ac1]
not r9d
lea r10, [0x140042c20]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14000aa45
cmp byte [rdx], r8b
jne 0x14000aa45
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14000aa32
not ebx
cmp dword [rdi + 0x4064], ebx
jne 0x14000aa75
xor edx, edx
xor ecx, ecx
call fcn.140007240
cmp dword [rdi + 0x4b38], ebp
jne 0x14000aaba
cmp word [rsi + 0x16c], 0
jne 0x14000aa90
cmp byte [rsi + 0x172], 0
je 0x14000aaba
xor edx, edx
mov rcx, rsi
call fcn.1400100f0
xor edx, edx
mov rcx, rsi
call fcn.140016390
mov rdx, rsi
mov ecx, ebx
call fcn.140007240
mov eax, dword [rdi + 0x4b64]
mov dword [rdi + 0x4090], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14003f030
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x1400148d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14004f040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14004f820]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x140014931
cmp byte [rbx + 0x4d4e], 0
jne 0x140014931
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003340
test dil, 2
je 0x140014a5f
jmp 0x1400149ba
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5eb8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140047f30]
mulss xmm1, dword [0x140047f28]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x140047eb0]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
call fcn.140003340
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140014a10
lea r11, [0x140042c20]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400149f3
cmp byte [r8], r9b
jne 0x1400149f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400149e0
not ecx
call fcn.14000add0
test rax, rax
je 0x140014a5f
cmp byte [rax + 0xbe], 0
je 0x140014a5f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.140003340
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.14000dab0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003f030
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret