joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400138b0
Capabilities:
Terminate thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
movaps xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rdi, rcx
lea rax, vtable.boost::asio::detail::win_iocp_io_context.0
mov qword [rcx], rax
cmp qword [rcx + 0xa8], 0
je 0x140013995
lea rax, [rdi + 0xa8]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdi
mov rcx, rdi
call fcn.140012f80
mov rbx, qword [rbp - 0x28]
mov rsi, qword [rbx]
movdqu xmm0, xmmword [rsi + 8]
pshufd xmm0, xmm0, 0x4e
movdqa xmmword [rbp - 0x40], xmm0
lea rdx, [rbp - 0x40]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mfence
mov eax, dword [0x140113d48]
mov rdx, qword [rsi + 8]
test eax, eax
je 0x140013951
mov rcx, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140013970
lea rcx, [method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rsi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rbp - 0x20]
mov rsi, qword [rbx]
test rsi, rsi
je 0x14001398e
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14009fe00
mov qword [rbx], 0
mov rdx, qword [rdi + 0x90]
test rdx, rdx
je 0x1400139f9
xorps xmm6, xmm6
lea rsi, [rbp - 0x40]
nop dword [rax + rax]
mov rax, qword [rdx + 0x20]
mov qword [rdi + 0x90], rax
test rax, rax
jne 0x1400139cb
mov qword [rdi + 0x98], 0
mov qword [rdx + 0x20], 0
mov rax, qword [rdx + 0x28]
movaps xmmword [rbp - 0x40], xmm6
mov qword [rbp - 0x30], 0
xor ecx, ecx
mov r8, rsi
xor r9d, r9d
call rax
mov rdx, qword [rdi + 0x90]
test rdx, rdx
jne 0x1400139b0
lea rcx, [rdi + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140013a12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rdi + 0x48]
test rsi, rsi
je 0x140013a2d
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.14009fe00
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x140013a3c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140016d20
Capabilities:
Terminate thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401129a8]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0x60], 0
je 0x140016da5
test edx, edx
jne 0x140016df6
mov rcx, qword [rsi + 0x58]
call fcn.140012f80
mov rdi, qword [rsi + 0x60]
movdqu xmm0, xmmword [rdi + 8]
pshufd xmm0, xmm0, 0x4e
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mfence
mov eax, dword [0x140113d48]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x140016db4
mov rcx, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140016dd3
test edx, edx
je 0x140016df6
mov rax, qword [rsi + 0x58]
xor ecx, ecx
xchg dword [rax + 0x34], ecx
jmp 0x140016df6
lea rcx, [method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsi + 0x60]
test rdi, rdi
je 0x140016dee
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14009fe00
mov qword [rsi + 0x60], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a0150
nop
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x140016e10
Capabilities:
Terminate thread

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x1401129a8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x140016f05
lock sub dword [rcx + 0x30], 1
jne 0x140016e41
call fcn.140012f80
mov rcx, qword [rsi + 0x30]
call fcn.140012f80
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x140016eea
movdqu xmm0, xmmword [rdi + 8]
pshufd xmm0, xmm0, 0x4e
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
mov ecx, 2
xor r8d, r8d
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mfence
mov eax, dword [0x140113d48]
mov rdx, qword [rdi + 8]
test eax, eax
je 0x140016ea8
mov rcx, rdx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x140016ec7
lea rcx, [method.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.virtual_8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rdi + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdi, qword [rsi + 0x38]
test rdi, rdi
je 0x140016ee2
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.14009fe00
mov qword [rsi + 0x38], 0
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x140016efd
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsi + 0x30], 0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400a0150
nop
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x140021cc0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
mov eax, 0x13b8
call fcn.1400a00f0
sub rsp, rax
mov esi, r8d
mov edi, edx
mov rax, qword [0x1401129a8]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
call fcn.1400a0ba4
mov dword [rsp + 0x13ac], 0xffffffff
mov dword [rsp + 0x2c], eax
mov ecx, 3
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rsp + rcx*4 + 0x24], eax
cmp rcx, 0x271
je 0x140021d3d
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
add eax, 0xffffffff
mov dword [rsp + rcx*4 + 0x28], eax
add rcx, 2
jmp 0x140021d00
mov dword [rsp + 0x28], 0x270
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x24], esi
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140021d80
mov esi, eax
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400a0150
mov eax, esi
add rsp, 0x13b8
pop rdi
pop rsi
ret

Function at 0x140021e80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r8, rdx
mov rax, qword gs:[0x60]
mov r9, qword [rax + 0x18]
add r9, 0x10
mov r9, qword [r9]
mov rax, qword [r9 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov r11d, dword [rcx + rax + 0x88]
test r11, r11
je 0x140021e9b
mov edx, dword [rax + r11 + 0x18]
lea r10, [rax + 1]
jmp 0x140021ecd
mov esi, 0x74687433
cmp esi, 0x3661d18b
je 0x140021f08
sub rdx, 1
jb 0x140021e9b
mov ecx, dword [rax + r11 + 0x20]
add rcx, rax
mov ecx, dword [rcx + rdx*4]
mov bl, byte [rax + rcx]
test bl, bl
je 0x140021ec0
add rcx, r10
mov esi, 0x74687433
nop dword [rax]
movsx edi, bl
xor edi, esi
imul esi, edi, 0x1000193
movzx ebx, byte [rcx]
add rcx, 1
test bl, bl
jne 0x140021ef0
jmp 0x140021ec5
mov ecx, dword [rax + r11 + 0x1c]
mov ebx, dword [rax + r11 + 0x24]
add rcx, rax
add rbx, rax
mov edx, edx
movzx edx, word [rbx + rdx*2]
mov ebx, dword [rcx + rdx*4]
add rbx, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call rbx
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140023d10
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [rdx]
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x140023d3e
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140023d3e
add rcx, rax
movzx edx, word [rcx + 0x18]
xor eax, eax
cmp edx, 0x20b
cmove rax, rcx
ret
xor eax, eax
ret

Function at 0x140023d50
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov al, 1
sub rdx, qword [r9 + 0x30]
je 0x140023eaa
test byte [r9 + 0x5e], 0x40
jne 0x140023d76
xor eax, eax
jmp 0x140023eaa
movzx ecx, word [r9 + 6]
test rcx, rcx
je 0x140023eaa
lea r10, [r9 + 0x18]
mov r15d, dword [r9 + 0xb0]
movzx ebx, word [r9 + 0x14]
add rbx, r9
add rbx, 0x18
lea rcx, [rcx + rcx*4]
lea rcx, [rbx + rcx*8]
jmp 0x140023dbd
add rbx, 0x28
cmp rbx, rcx
jae 0x140023eaa
mov edi, dword [rbx + 0xc]
cmp r15d, edi
jb 0x140023db0
mov esi, dword [rbx + 8]
add esi, edi
cmp esi, r15d
jbe 0x140023db0
test r8, r8
je 0x140023eaa
mov ecx, dword [rbx + 0x14]
sub r15, rdi
add r15, rcx
add r15, r8
mov r11d, dword [r9 + 0xb4]
add r11, r15
jmp 0x140023df9
mov ecx, dword [r15 + 4]
mov ecx, ecx
add r15, rcx
cmp r11, r15
jbe 0x140023eaa
mov ecx, dword [r15 + 4]
test ecx, ecx
je 0x140023eaa
lea r14d, [rcx - 8]
cmp r14d, 2
jb 0x140023df4
shr r14d, 1
xor r13d, r13d
jmp 0x140023e36
xor esi, esi
test rsi, rsi
cmove rsi, r8
add qword [rsi + r12], rdx
add r13, 1
cmp r13, r14
je 0x140023df0
movzx r12d, word [r15 + r13*2 + 8]
cmp r12d, 0x1000
jb 0x140023e2d
movzx ecx, r12w
shr ecx, 0xc
cmp cx, 0xa
je 0x140023e58
cmp cx, 3
jne 0x140023e2d
and r12d, 0xfff
movzx edi, word [r9 + 6]
test rdi, rdi
je 0x140023e20
mov esi, dword [r15]
movzx ecx, word [r9 + 0x14]
add rcx, r10
lea rdi, [rdi + rdi*4]
lea rbx, [rcx + rdi*8]
jmp 0x140023e89
add rcx, 0x28
cmp rcx, rbx
jae 0x140023e20
mov edi, dword [rcx + 0xc]
cmp esi, edi
jb 0x140023e80
mov ebp, dword [rcx + 8]
add ebp, edi
cmp ebp, esi
jbe 0x140023e80
mov ecx, dword [rcx + 0x14]
sub rsi, rdi
add rsi, rcx
add rsi, r8
jmp 0x140023e22
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140025250
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Make suspicious ntquerysysteminformation call
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12d, edx
mov r13, rcx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebp, dword [rcx + rax + 0x88]
test rbp, rbp
je 0x140025277
mov edx, dword [rax + rbp + 0x18]
lea rbx, [rax + 1]
jmp 0x1400252ad
mov esi, 0x7680f998
cmp esi, 0xdcdc03a4
je 0x1400252e8
sub rdx, 1
jb 0x140025277
mov ecx, dword [rax + rbp + 0x20]
add rcx, rax
mov edi, dword [rcx + rdx*4]
mov cl, byte [rax + rdi]
test cl, cl
je 0x1400252a0
add rdi, rbx
mov esi, 0x7680f998
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rdi]
add rdi, 1
test cl, cl
jne 0x1400252d0
jmp 0x1400252a5
mov ecx, dword [rax + rbp + 0x1c]
mov ebp, dword [rax + rbp + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov r15d, 0x1130
mov ecx, 0x1130
call rdx
test rax, rax
je 0x140025408
mov r14, rax
mov qword [rsp + 0x20], r13
mov r13d, 0xc0000004
jmp 0x140025362
add r15, r15
mov ecx, dword [rax + rdi + 0x1c]
mov ebp, dword [rax + rdi + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebp, dword [rcx + rdx*4]
add rbp, rax
mov rcx, r14
mov rdx, r15
call rbp
mov r14, rax
test rax, rax
je 0x140025412
cmp r13d, 0xc0000004
jne 0x140025415
mov ecx, r12d
mov rdx, r14
mov r8d, r15d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r13d, eax
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov edi, dword [rcx + rax + 0x88]
test rdi, rdi
je 0x140025395
mov edx, dword [rax + rdi + 0x18]
lea rbp, [rax + 1]
jmp 0x1400253d1
mov ebx, 0x3dec360e
cmp ebx, 0x9c1ff3a8
je 0x140025330
sub rdx, 1
jb 0x140025395
mov ecx, dword [rax + rdi + 0x20]
add rcx, rax
mov esi, dword [rcx + rdx*4]
mov cl, byte [rax + rsi]
test cl, cl
je 0x1400253c0
add rsi, rbp
mov ebx, 0x3dec360e
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
movzx ecx, byte [rsi]
add rsi, 1
test cl, cl
jne 0x1400253f0
jmp 0x1400253c5
mov qword [r13], 0
jmp 0x14002541e
xor r14d, r14d
mov r13, qword [rsp + 0x20]
mov qword [r13], r14
mov rax, r13
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140025440
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov r13, rdx
mov r15, rcx
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0x88]
test rbx, rbx
je 0x140025467
mov edx, dword [rax + rbx + 0x18]
lea rdi, [rax + 1]
jmp 0x14002549d
mov esi, 0x4acc76fd
cmp esi, 0x40a6efae
je 0x1400254d9
sub rdx, 1
jb 0x140025467
mov ecx, dword [rax + rbx + 0x20]
add rcx, rax
mov ebp, dword [rcx + rdx*4]
mov cl, byte [rax + rbp]
test cl, cl
je 0x140025490
add rbp, rdi
mov esi, 0x4acc76fd
nop dword [rax]
movsx ecx, cl
xor ecx, esi
imul esi, ecx, 0x1000193
movzx ecx, byte [rbp]
add rbp, 1
test cl, cl
jne 0x1400254c0
jmp 0x140025495
mov ecx, dword [rax + rbx + 0x1c]
mov ebp, dword [rax + rbx + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebp, dword [rcx + rdx*4]
add rbp, rax
mov r8d, dword [0x140113d98]
xor r12d, r12d
mov ecx, 0x400
xor edx, edx
call rbp
mov r14, rax
lea rax, [r15 + 0x10]
mov qword [rsp + 0x30], rax
jmp 0x140025530
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x28]
call fcn.1400269c0
nop word cs:[rax + rax]
nop
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
movsxd rcx, dword [rax + 0x3c]
mov esi, dword [rcx + rax + 0x88]
test rsi, rsi
je 0x140025541
mov edx, dword [rax + rsi + 0x18]
lea rbp, [rax + 1]
jmp 0x14002557d
mov edi, 0x922ed672
cmp edi, 0x3c5c83a2
je 0x1400255c0
sub rdx, 1
jb 0x140025541
mov ecx, dword [rax + rsi + 0x20]
add rcx, rax
mov ebx, dword [rcx + rdx*4]
mov cl, byte [rax + rbx]
test cl, cl
je 0x140025570
add rbx, rbp
mov edi, 0x922ed672
nop dword [rax]
movsx ecx, cl
xor ecx, edi
imul edi, ecx, 0x1000193
movzx ecx, byte [rbx]
add rbx, 1
test cl, cl
jne 0x1400255a0
jmp 0x140025575
mov ecx, dword [rax + rsi + 0x1c]
mov ebp, dword [rax + rsi + 0x24]
add rcx, rax
add rbp, rax
mov edx, edx
movzx edx, word [rbp + rdx*2]
mov ebp, dword [rcx + rdx*4]
add rbp, rax
mov r9d, 0x30
mov rcx, r14
mov rdx, r12
lea r8, [rsp + 0x38]
call rbp
test rax, rax
je 0x140025649
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x50]
lea r12, [rcx + rax]
mov edx, dword [rsp + 0x48]
test r13, r13
je 0x140025620
cmp edx, 0x40
jne 0x140025530
cmp rcx, r13
je 0x140025629
jmp 0x140025530
cmp edx, 0x40
jne 0x140025530
mov qword [rsp + 0x28], rax
mov rdx, qword [r15 + 0x18]
cmp rdx, qword [r15 + 0x20]
je 0x140025515
mov qword [rdx], rax
add qword [r15 + 0x18], 8
jmp 0x140025530
mov al, 1
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140025fe0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
jle 0x14002607f
mov r14, r8
mov rdi, rdx
mov r12, rcx
cmp qword [rcx + 0x68], 0
je 0x140026087
mov rbx, r14
jmp 0x14002603f
cmp rbx, rsi
cmovl rsi, rbx
mov rcx, rdi
mov r8, rsi
call fcn.1400a5150
add rdi, rsi
sub rbx, rsi
mov rax, qword [r12 + 0x50]
sub dword [rax], esi
mov rax, qword [r12 + 0x38]
movsxd rcx, esi
add qword [rax], rcx
test rbx, rbx
jle 0x140026077
mov rax, qword [r12 + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140026059
mov rax, qword [r12 + 0x50]
movsxd rsi, dword [rax]
test rsi, rsi
jg 0x140026010
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140026077
mov byte [rdi], al
add rdi, 1
add rbx, 0xffffffffffffffff
test rbx, rbx
jg 0x14002603f
sub r14, rbx
jmp 0x14002618b
xor r14d, r14d
jmp 0x14002618b
mov rax, qword [r12 + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400260df
mov rax, qword [r12 + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400260df
cmp r15, r14
cmovae r15, r14
mov rcx, rdi
mov r8, r15
call fcn.1400a5150
add rdi, r15
mov rsi, r14
sub rsi, r15
mov rax, qword [r12 + 0x50]
sub dword [rax], r15d
mov rax, qword [r12 + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [r12 + 0x80], 0
jne 0x1400260f1
jmp 0x140026188
mov rsi, r14
cmp qword [r12 + 0x80], 0
je 0x140026188
mov rax, qword [r12 + 0x18]
lea rcx, [r12 + 0x70]
cmp qword [rax], rcx
jne 0x140026130
mov ecx, dword [r12 + 0x90]
mov rdx, qword [r12 + 0x88]
mov qword [rax], rdx
mov rax, qword [r12 + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [r12 + 0x50]
mov dword [rax], ecx
nop word cs:[rax + rax]
nop
cmp rsi, 0x1000
jb 0x140026164
mov r9, qword [r12 + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.1400b71c0
add rdi, rax
sub rsi, rax
cmp rax, 0xfff
je 0x140026130
jmp 0x140026188
test rsi, rsi
je 0x140026186
mov r9, qword [r12 + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rsi
call fcn.1400b71c0
sub rsi, rax
jmp 0x140026188
xor esi, esi
sub r14, rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140030b80
Capabilities:
Hash data with crc32

Disassembly:
not r8d
test rdx, rdx
je 0x140030be2
add rdx, 0xffffffffffffffff
add rcx, 2
lea r9, [0x1400d97e0]
mov r10d, r8d
jmp 0x140030bc2
mov eax, r10d
shr eax, 8
movzx r10d, r10b
xor r10d, r11d
xor eax, dword [r9 + r10*4]
add rcx, 1
mov r10d, eax
add rdx, 0xffffffffffffffff
jae 0x140030c3e
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x140030ba0
cmp rdx, 2
jb 0x140030ba0
cmp byte [rcx - 1], 0x23
jne 0x140030ba0
cmp byte [rcx], 0x23
cmove r10d, r8d
jmp 0x140030ba0
mov r10b, byte [rcx]
test r10b, r10b
je 0x140030c41
add rcx, 2
lea r9, [0x1400d97e0]
mov edx, r8d
jmp 0x140030c21
movzx r10d, r10b
mov eax, edx
shr eax, 8
movzx edx, dl
xor edx, r10d
xor eax, dword [r9 + rdx*4]
add rcx, 1
mov r10d, r11d
mov edx, eax
test r11b, r11b
je 0x140030c3e
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x140030c00
cmp r11b, 0x23
jne 0x140030c00
cmp byte [rcx], 0x23
cmove edx, r8d
mov r11b, 0x23
jmp 0x140030c00
not eax
ret
mov eax, r8d
not eax
ret
Function at 0x140031000
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r13d, r9d
mov rdi, r8
test r8, r8
je 0x140031022
mov qword [rdi], 0
call fcn.140030c50
test rax, rax
je 0x14003105a
mov rbx, rax
mov rcx, rax
call fcn.1400b7760
cmp eax, 0xffffffff
je 0x140031052
mov esi, eax
mov rcx, rbx
xor edx, edx
mov r8d, 2
call fcn.1400b3bcc
test eax, eax
je 0x140031070
mov rcx, rbx
call fcn.1400b6590
xor esi, esi
mov rax, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
call fcn.1400b7760
cmp eax, 0xffffffff
je 0x140031052
mov r14d, eax
xor ebp, ebp
mov rcx, rbx
mov edx, esi
xor r8d, r8d
call fcn.1400b3bcc
cmp eax, 1
sbb ebp, ebp
not ebp
or ebp, r14d
cmp ebp, 0xffffffff
je 0x140031052
movsxd r14, ebp
movsxd r15, r13d
lea r12, [r14 + r15]
mov rdx, qword [0x140114190]
mov rcx, r12
call qword [0x14010a998]
mov rsi, rax
mov rax, qword [0x140114180]
test rax, rax
je 0x14003115c
mov r8d, dword [rax + 0x40c8]
movsx rdx, word [rax + 0x6370]
cmp dword [rax + rdx*8 + 0x6374], r8d
jne 0x1400310f1
lea rdx, [rax + rdx*8]
add rdx, 0x6374
jmp 0x14003113b
add edx, 1
movsxd rdx, edx
imul rbp, rdx, 0x2aaaaaab
mov rcx, rbp
shr rcx, 0x3f
shr rbp, 0x20
add ebp, ecx
add ebp, ebp
lea ecx, [rbp + rbp*2]
sub edx, ecx
mov word [rax + 0x6370], dx
movsxd rcx, edx
lea rdx, [rax + rcx*8]
add rdx, 0x6374
mov dword [rax + rcx*8 + 0x6374], r8d
mov dword [rax + rcx*8 + 0x6378], 0
cmp r12, 0xffffffffffffffff
je 0x14003114e
add word [rdx + 4], 1
add rax, 0x6368
jmp 0x140031159
add word [rdx + 6], 1
add rax, 0x636c
add dword [rax], 1
test rsi, rsi
je 0x140031052
mov edx, 1
mov rcx, rsi
mov r8, r14
mov r9, rbx
call fcn.1400b71c0
cmp rax, r14
jne 0x1400311ab
test r13d, r13d
jle 0x140031192
mov rcx, rsi
add rcx, r14
xor edx, edx
mov r8, r15
call fcn.1400a5800
mov rcx, rbx
call fcn.1400b6590
test rdi, rdi
je 0x14003105c
mov qword [rdi], r14
jmp 0x14003105c
mov rcx, rbx
call fcn.1400b6590
mov rax, qword [0x140114180]
test rax, rax
je 0x140031234
mov ecx, dword [rax + 0x40c8]
movsx rdx, word [rax + 0x6370]
cmp dword [rax + rdx*8 + 0x6374], ecx
jne 0x1400311e3
movzx ecx, word [rax + rdx*8 + 0x637a]
add ecx, 1
jmp 0x140031225
add edx, 1
movsxd rdx, edx
imul rbp, rdx, 0x2aaaaaab
mov rbx, rbp
shr rbx, 0x3f
shr rbp, 0x20
add ebp, ebx
add ebp, ebp
lea ebp, [rbp + rbp*2]
sub edx, ebp
mov word [rax + 0x6370], dx
movsxd rdx, edx
mov dword [rax + rdx*8 + 0x6374], ecx
mov dword [rax + rdx*8 + 0x6378], 0
mov cx, 1
mov word [rax + rdx*8 + 0x637a], cx
add dword [rax + 0x636c], 1
mov rdx, qword [0x140114190]
mov rcx, rsi
call qword [0x14010a9a0]
jmp 0x14003105a
Function at 0x140039c90
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r9, r8
mov r8, rdx
mov rax, qword [rcx + 0x140]
movsxd rdx, dword [rcx + 0x138]
mov r10d, dword [rax + rdx*4 - 4]
not r10d
test r9, r9
je 0x140039d19
mov rax, r9
sub rax, r8
je 0x140039d19
mov rdx, r8
not rdx
add rdx, r9
lea rax, [r8 + 2]
lea r11, [0x1400d97e0]
mov edi, r10d
jmp 0x140039cfb
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
add rax, 1
mov edi, esi
add rdx, 0xffffffffffffffff
jae 0x140039d6a
movzx ebx, byte [rax - 2]
cmp ebx, 0x23
jne 0x140039ce0
cmp rdx, 2
jb 0x140039ce0
cmp byte [rax - 1], 0x23
jne 0x140039ce0
cmp byte [rax], 0x23
cmove edi, r10d
jmp 0x140039ce0
mov dl, byte [r8]
test dl, dl
je 0x140039d67
lea rax, [r8 + 2]
lea r11, [0x1400d97e0]
mov edi, r10d
jmp 0x140039d4e
movzx edx, dl
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, edx
xor esi, dword [r11 + rdi*4]
add rax, 1
mov edx, ebx
mov edi, esi
test bl, bl
je 0x140039d6a
movzx ebx, byte [rax - 1]
cmp dl, 0x23
jne 0x140039d30
cmp bl, 0x23
jne 0x140039d30
cmp byte [rax], 0x23
cmove edi, r10d
mov bl, 0x23
jmp 0x140039d30
mov esi, r10d
not esi
mov rax, qword [rcx]
cmp dword [rax + 0x41d4], esi
jne 0x140039d83
mov ecx, esi
mov edx, 0xb
call fcn.140054480
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004e3f0
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12d, r9d
mov r14d, r8d
mov r15, rdx
mov r13, rcx
mov rax, qword [0x140114180]
mov rcx, qword [rax + 0x4180]
mov byte [rcx + 0x101], 1
mov r8, qword [rax + 0x4180]
mov rax, qword [r8 + 0x140]
movsxd rcx, dword [r8 + 0x138]
mov esi, dword [rax + rcx*4 - 4]
not esi
mov bl, byte [r13]
test bl, bl
je 0x14004e493
lea rdx, [r13 + 2]
lea rdi, [0x1400d97e0]
mov ecx, esi
jmp 0x14004e47c
movzx ebx, bl
mov ebp, ecx
shr ebp, 8
movzx ecx, cl
xor ecx, ebx
xor ebp, dword [rdi + rcx*4]
add rdx, 1
mov ebx, eax
mov ecx, ebp
test al, al
je 0x14004e495
movzx eax, byte [rdx - 1]
cmp bl, 0x23
jne 0x14004e460
cmp al, 0x23
jne 0x14004e460
cmp byte [rdx], 0x23
cmove ecx, esi
mov al, 0x23
jmp 0x14004e460
mov ebp, esi
not ebp
mov rax, qword [r8]
cmp dword [rax + 0x41d4], ebp
jne 0x14004e4b4
mov ecx, ebp
mov edx, 0xb
mov r8, r13
xor r9d, r9d
call fcn.140054480
mov dword [rsp + 0x20], r12d
mov rcx, r13
mov edx, ebp
mov r8, r15
mov r9d, r14d
call fcn.14004e4e0
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret