joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c108
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14000bedc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000bedc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000bedc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000bedc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000bedc
cmp dword [rcx + 0x84], 0xe
jbe 0x14000bedc
cmp dword [rcx + 0xf8], esi
je 0x14000bedc
mov ecx, r14d
call fcn.14000c024
mov ecx, 2
call fcn.14000e574
nop
cmp byte [0x14001e310], 0
jne 0x14000bfa6
mov r15d, 1
mov eax, r15d
xchg dword [0x14001e304], eax
test ebx, ebx
jne 0x14000bf4f
mov rdi, qword [section..data]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14001e308]
cmp rcx, rax
je 0x14000bf46
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14000a2c8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14001e320]
jmp 0x14000bf5b
cmp ebx, r15d
jne 0x14000bf61
lea rcx, [0x14001e338]
call fcn.14000c618
nop
test ebx, ebx
jne 0x14000bf78
lea rdx, [0x1400142c8]
lea rcx, [0x1400142a8]
call fcn.14000bd9c
lea rdx, [0x1400142d8]
lea rcx, [0x1400142d0]
call fcn.14000bd9c
movzx eax, byte [0x14001e310]
test esi, esi
cmove eax, r15d
mov byte [0x14001e310], al
jmp 0x14000bfa6
mov ecx, 2
call fcn.14000e5c8
test esi, esi
jne 0x14000bfbd
mov ecx, r14d
call fcn.14000bfd8
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14000be6c
Function at 0x140004030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000408d
lea rbx, [0x140244040]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140004074
cmp r10, 2
jb 0x140004074
cmp byte [r9], r8b
jne 0x140004074
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140004050
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400040cf
lea rbx, [0x140244040]
cmp r8b, 0x23
jne 0x1400040b3
cmp byte [r9], r8b
jne 0x1400040b3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400040a0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1400042bf
mov r8d, 0x645
lea rdx, [0x14023db40]
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1400042cb
mov qword [rdi], 0
lea rdx, [0x140241ee8]
mov rcx, rbx
call fcn.1400040e0
mov rbx, rax
test rax, rax
jne 0x1400042ed
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400043c4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400043c4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400043c4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400043c4
cmp rsi, 0xffffffffffffffff
je 0x1400043c4
mov rax, qword [0x1402738d0]
test rax, rax
je 0x140004361
inc dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1400043c4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1400043b1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402738d0]
test rax, rax
je 0x1400043a6
dec dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400043cd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400043bf
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1400043cf
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140007480
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rbx, rcx
mov edi, edx
jg 0x1400074b6
mov r8d, 0x6d1
lea rdx, [0x14023d8f0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x140244040]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1402738d0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1d6c], edx
jne 0x140007530
mov dword [rax + 0x1d70], edx
cmp dword [rax + 0x1da8], edx
jne 0x14000753f
mov byte [rax + 0x1dac], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x140007550
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x108], 0
mov rdi, rdx
mov rbx, rcx
jg 0x140007583
mov r8d, 0x6d1
lea rdx, [0x14023d8f0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbx + 0x108]
mov rax, qword [rbx + 0x110]
movss xmm0, dword [rdi]
subss xmm0, dword [rbx + 0x50]
movss xmm1, dword [rdi + 4]
subss xmm1, dword [rbx + 0x54]
cvttss2si r8d, xmm0
movss xmm0, dword [rdi + 8]
subss xmm0, dword [rbx + 0x50]
cvttss2si r9d, xmm1
movss xmm1, dword [rdi + 0xc]
lea rdi, [0x140244040]
subss xmm1, dword [rbx + 0x54]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, r8b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
cvttss2si r10d, xmm0
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
cvttss2si r11d, xmm1
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r10b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
xor ebx, dword [rdi + rdx*4]
shr eax, 0x10
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
movzx eax, r11b
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r11d
shr eax, 8
movzx edx, al
mov eax, r11d
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1402738d0]
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r11d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [rdi + rdx*4]
not ebx
cmp dword [rax + 0x1d6c], ebx
jne 0x140007724
mov dword [rax + 0x1d70], ebx
cmp dword [rax + 0x1da8], ebx
jne 0x140007733
mov byte [rax + 0x1dac], 1
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140014730
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1402738d0]
mov esi, ecx
mov rbx, qword [rax + 0x1d18]
add rbx, 0x108
cmp dword [rbx], 0
jg 0x140014779
mov r8d, 0x6d1
lea rdx, [0x14023d8f0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x140244040]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14001480c
lea ecx, [rdx + 1]
test r8d, r8d
je 0x1400147f8
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400147fd
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.14002be50
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140016040
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140273040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1402738d0]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x1400160a0
cmp byte [rbx + 0x20d6], 0
jne 0x1400160a0
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003fb0
test dil, 1
je 0x1400161c6
jmp 0x14001612f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14026a1f8]
xor eax, eax
mulss xmm1, dword [0x14026a1e4]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x14026a138]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140003fb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140016180
lea r11, [0x140244040]
nop
cmp r9b, 0x23
jne 0x140016163
cmp byte [r8], r9b
jne 0x140016163
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140016150
not ecx
call fcn.14000d680
test rax, rax
je 0x1400161c6
cmp byte [rax + 0xcf], 0
je 0x1400161c6
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.140003fb0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.1400103e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14023a330
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001b520
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, qword [0x1402738d0]
xor r14d, r14d
mov r15d, ecx
mov ebx, r14d
mov rbp, qword [rsi + 0x1d18]
test cl, 0x10
jne 0x14001b6a3
mov edi, dword [rbp + 0x164]
test edi, edi
je 0x14001b593
cmp dword [rsi + 0x1d6c], edi
jne 0x14001b69c
mov ecx, dword [rsi + 0x1da4]
cmp ecx, 0xffffffff
cmove ecx, r14d
movsxd rax, ecx
cmp byte [rax + rsi + 0x128], bl
je 0x14001b69c
mov r14d, ecx
jmp 0x14001b637
cmp byte [rsi + 0x128], bl
je 0x14001b69c
test r15b, 8
jne 0x14001b5c6
mov r8d, 0x28fe
lea rdx, [0x14023db40]
lea rcx, [0x14023db08]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor al, al
jmp 0x14001b7a8
test byte [rbp + 0x168], 1
jne 0x14001b5e8
cmp dword [rsi + 0x1d6c], ebx
je 0x14001b69c
cmp qword [rsi + 0x1d98], rbp
jne 0x14001b69c
lea rdx, [rbp + 0x16c]
mov rcx, rbp
call fcn.140007550
mov edx, eax
mov dword [rbp + 0x164], eax
lea rcx, [rbp + 0x16c]
mov edi, eax
call fcn.140007ab0
movzx ebx, al
test al, al
je 0x14001b62f
cmp byte [rsi + 0x418], r14b
je 0x14001b62f
mov rdx, rbp
mov ecx, edi
call fcn.140007820
mov rcx, rbp
call fcn.140013c60
cmp dword [rsi + 0x1d6c], edi
jne 0x14001b69c
mov byte [rsi + 0x1d79], bl
cmp dword [rbp + 0x108], 0
jg 0x14001b660
mov r8d, 0x6d1
lea rdx, [0x14023d8f0]
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rcx, dword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
movss xmm1, dword [0x14026a2c8]
mov ebx, dword [rax + rcx*4 - 4]
mov ecx, r14d
call fcn.14000d140
mov qword [rsi + 0x1d80], 0xffffffffffffffff
mov qword [rsi + 0x1d88], 0xffffffffffffffff
test al, al
jne 0x14001b6f3
xor al, al
jmp 0x14001b7a8
mov r9d, 0xffffffff
lea rdx, [0x140241ce9]
mov edi, r9d
lea r10, [0x140244040]
mov rbp, r14
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14001b6d3
cmp byte [rdx], r8b
jne 0x14001b6d3
cmp byte [rdx + 1], r8b
cmove edi, r9d
movzx ecx, dil
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr edi, 8
inc rdx
xor edi, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001b6c0
not edi
cmp byte [rsi + 0x20d4], 0
jne 0x14001b74f
test edi, edi
jne 0x14001b71a
mov r8d, 0x2929
lea rdx, [0x14023db40]
lea rcx, str.source_id___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
call fcn.14001b460
mov dword [rsi + 0x20f4], edi
mov dword [rsi + 0x20f8], ebx
mov byte [rsi + 0x20d4], 1
mov dword [rsi + 0x20d8], r15d
mov dword [rsi + 0x20e0], r14d
cmp edi, dword [rsi + 0x1d6c]
jne 0x14001b74f
mov byte [rsi + 0x1d7a], 1
mov eax, dword [rsi + 0x1c90]
mov dword [rsi + 0x20dc], eax
mov byte [rsi + 0x20d5], 1
test r15b, 1
jne 0x14001b799
xor edx, edx
call fcn.140016040
cmp dword [rsi + 0x2148], 0
je 0x14001b799
test dword [rsi + 0x213c], 0x1000
je 0x14001b799
mov rax, qword [rsi + 0x1d18]
mov byte [rax + 0xd4], 1
mov byte [rax + 0xf0], 1
test r15b, 0x12
jne 0x14001b7a6
and dword [rbp + 0x168], 0xfffffffe
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14001bd80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001be27
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001bdda
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002ba40
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004c70
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1402738c8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001be2f
mov rcx, rbx
call fcn.140004c70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c380
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x14001c3d6
lea r11, [0x140244040]
cmp r9b, 0x23
jne 0x14001c3b9
cmp byte [r8], r9b
jne 0x14001c3b9
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001c3a6
not ecx
call fcn.14001c290
test rax, rax
jne 0x14001c3ef
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14001c1a0
add rsp, 0x20
pop rbx
ret
Function at 0x140020e50
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14002108e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140273040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140244040]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140021056
mov rcx, rbp
call fcn.140020110
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140020f21
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140020f11
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140020f09
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140020f0c
mov rdx, rcx
test rdx, rdx
jne 0x140020ee0
cmp r8, r10
je 0x140020f21
cmp dword [r8], r9d
jne 0x140020f21
mov rcx, qword [r8 + 8]
jmp 0x140020f23
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140020fb7
cmp qword [rcx + 0x18], 0
jne 0x140020fac
mov qword [rcx + 0x18], rbx
jmp 0x140020fb7
cmp qword [rcx + 0x20], 0
jne 0x140020fb7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140020fec
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140020fe0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140003fb0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140021048
cmp r9b, 0x23
jne 0x14002102b
cmp byte [r8], r9b
jne 0x14002102b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140021018
not ecx
call fcn.14000d680
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140020ea0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14023a330
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14005bbf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140273040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test al, al
je 0x14005bc37
nop
cmp al, 0x25
jne 0x14005bc2c
cmp byte [rcx + 1], al
jne 0x14005bc37
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14005bc20
cmp byte [rcx], 0x25
jne 0x14005bd1a
cmp byte [rcx + 1], 0x25
je 0x14005bd1a
lea rdx, [rsp + 0x20]
call fcn.14004a2e0
xorps xmm3, xmm3
lea r8, [rsp + 0x20]
cvtss2sd xmm3, xmm6
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140003fb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14005bc88
inc rcx
cmp byte [rcx], 0x20
je 0x14005bc80
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14005bd08
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14005bca3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14005bcb9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14005bcf6
movss xmm2, dword [0x14026a1e8]
cmp al, 0x39
ja 0x14005bcf6
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14005bcd0
cmp r9b, 0x2d
jne 0x14005bd15
xorps xmm1, xmmword [0x14026a420]
movaps xmm0, xmm1
jmp 0x14005bd1d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14005bd1d
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14023a330
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x14005bd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140273040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test al, al
je 0x14005bd87
nop
cmp al, 0x25
jne 0x14005bd7c
cmp byte [rcx + 1], al
jne 0x14005bd87
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14005bd70
cmp byte [rcx], 0x25
jne 0x14005be64
cmp byte [rcx + 1], 0x25
je 0x14005be64
lea rdx, [rsp + 0x20]
call fcn.14004a2e0
movaps xmm3, xmm6
lea r8, [rsp + 0x20]
movq r9, xmm6
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.140003fb0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14005bdd8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14005bdd0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14005be56
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14005bdf3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14005be09
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14005be44
movsd xmm2, qword [0x14026a1b0]
cmp al, 0x39
ja 0x14005be44
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14005be20
cmp r9b, 0x2d
jne 0x14005be5f
xorps xmm1, xmmword [0x14026a410]
movaps xmm0, xmm1
jmp 0x14005be67
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14005be67
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14023a330
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x14023aef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14023af3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14023af3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14023af3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14023af3e
cmp dword [rcx + 0x84], 0xe
jbe 0x14023af3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14023af40
xor al, al
add rsp, 0x28
ret