joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400324e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0xa4], 1
je 0x140029342
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0xa4], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400324e0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, qword [rcx + 0x18]
mov rsi, rcx
mov rcx, qword [rcx + 0x78]
mov rbp, r8
mov r14, rdx
test rcx, rcx
jne 0x1400325c5
cmp dword [rsi + 0xa0], 0xffffffff
jne 0x14003264b
cmp qword [rsi + 0x80], 0xffffffffffffffff
je 0x140032642
xor r12d, r12d
mov rdi, r8
mov ebx, r12d
mov rcx, qword [rsi + 0x80]
lea rdx, [rbx + r14]
mov r8d, 0x2000000
mov qword [rsp + 0x20], r12
cmp rdi, r8
lea r9, [rsp + 0x60]
cmovl r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003257b
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140032573
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jl 0x140032534
mov rax, rbx
jmp 0x140032659
test rbx, rbx
jne 0x140032573
lea edx, [rbx - 1]
lea rcx, [rsp + 0x78]
call fcn.140029ec0
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r15
call fcn.140027a30
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
test eax, eax
je 0x140032633
cmp eax, 0xffffffff
je 0x140032642
sub eax, 1
mov dword [rcx], eax
jne 0x140032642
mov rcx, qword [rsp + 0x78]
jmp 0x140032633
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
cmp rax, 0xffffffffffffffff
je 0x14003264b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x14003264b
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x14003264b
mov edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.14002a030
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.140027a30
mov rcx, qword [rsp + 0x60]
mov edx, dword [rcx]
test edx, edx
je 0x140032633
cmp edx, 0xffffffff
je 0x140032642
sub edx, 1
mov dword [rcx], edx
jne 0x140032642
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.140003e30
mov rax, 0xffffffffffffffff
jmp 0x140032659
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140029360
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140032b70
Capabilities:
Clear file content

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rax + 0x80]
cmp rbx, 0xffffffffffffffff
jne 0x140032ce0
cmp dword [rax + 0xa0], ebx
jne 0x140032cb2
cmp qword [rax + 0x78], 0
jne 0x140032cb2
lea rcx, [rax + 0x20]
mov rax, qword [rax + 0x20]
cmp dword [rax + 4], 0
jne 0x140032bcd
mov rax, qword [rcx + 8]
cmp dword [rax + 4], 0
je 0x140032ca0
lea rdx, [rsp + 0x40]
call fcn.140027be0
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000e450
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140032c00
cmp eax, 0xffffffff
je 0x140032c0e
sub eax, 1
mov dword [rcx], eax
jne 0x140032c0e
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
mov edx, 3
lea rcx, [rsp + 0x20]
call fcn.14000e600
lea rcx, [rsp + 0x20]
test al, al
je 0x140032c9b
mov rdx, rsi
call fcn.14000e7b0
movzx ebx, al
test al, al
jne 0x140032c7e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000ca20
mov r8, rax
mov edx, 0xc
mov rcx, rdi
call fcn.140027a30
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x140032c70
cmp eax, 0xffffffff
je 0x140032c7e
sub eax, 1
mov dword [rcx], eax
jne 0x140032c7e
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140003e30
lea rcx, [rsp + 0x20]
call fcn.14000e4d0
movzx eax, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.14000e4d0
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp rbx, 0xffffffffffffffff
jne 0x140032ce0
mov rcx, qword [rax + 0x78]
test rcx, rcx
je 0x140032ccb
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fileno]
mov ecx, eax
jmp 0x140032cd1
mov ecx, dword [rax + 0xa0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140032ca0
mov rax, qword [rdi]
mov rcx, rdi
mov qword [rsp + 0x48], rbp
call qword [rax + 0x30]
mov rcx, qword [rdi]
mov rdx, rsi
mov rbp, rax
mov r8, qword [rcx + 0x38]
mov rcx, rdi
call r8
test al, al
je 0x140032d29
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140032d29
mov rax, qword [rdi]
cmp rbp, rsi
mov rcx, rdi
cmovl rsi, rbp
mov rdx, rsi
call qword [rax + 0x38]
mov al, 1
jmp 0x140032d37
mov rax, qword [rdi]
mov rdx, rbp
mov rcx, rdi
call qword [rax + 0x38]
xor al, al
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400019c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
call fcn.14005d1b0
mov rbx, rax
test rax, rax
je 0x140001aa9
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov r8b, 0xa
mov byte [rbp + 0x20], 0x7d
mov r9b, Ordinal_33
lea rdx, [rbp + 0x21]
xor r8b, 0x7d
xor r9b, 0x7d
xor eax, eax
mov byte [rbp + 0x21], r8b
mov rcx, rdi
mov byte [rbp + 0x22], r9b
mov byte [rbp + 0x23], al
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rdi, rax
test rax, rax
je 0x140001b51
mov r8, rsi
mov edx, 0x2712
mov rcx, rbx
call fcn.1400615b0
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x40]
call fcn.1400615b0
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 0x51]
call fcn.1400615b0
lea r8, [0x1400019b0]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.1400615b0
mov r8, rdi
mov edx, 0x2711
mov rcx, rbx
call fcn.1400615b0
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov rcx, rbx
lea r8d, [rdx - 0x2c]
call fcn.1400615b0
mov rcx, rbx
call fcn.14005d220
mov rcx, rdi
mov esi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test esi, esi
jne 0x140001aca
mov rcx, rbx
call fcn.14005d180
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
jmp fcn.14005d3b0
mov ecx, esi
call fcn.14005de40
xor ebx, ebx
mov byte [rbp - 0x30], reloc.WS2_32.dll_recvfrom
mov byte [rbp - 0x28], bl
movzx edx, byte [rax + 4]
movzx r11d, byte [rax]
xor dl, 0x11
movzx r10d, byte [rax + 1]
xor dl, 0x11
movzx r9d, byte [rax + 2]
xor r11b, 0x11
movzx r8d, byte [rax + 3]
xor r10b, 0x11
movzx ecx, byte [rax + 5]
xor r9b, 0x11
movzx eax, byte [rax + 6]
xor r8b, 0x11
xor cl, 0x11
mov byte [rbp - 0x2b], dl
xor al, 0x11
lea rdx, [rbp - 0x2f]
xor r11b, 0x11
xor r10b, 0x11
xor r9b, 0x11
mov byte [rbp - 0x2f], r11b
xor r8b, 0x11
mov byte [rbp - 0x2e], r10b
xor cl, 0x11
mov byte [rbp - 0x2d], r9b
xor al, 0x11
mov byte [rbp - 0x2c], r8b
mov byte [rbp - 0x2a], cl
mov byte [rbp - 0x29], al
call fcn.14005c900
call fcn.14005cf40
int3
movdqa xmm1, xmmword [0x1400d1010]
mov dl, 0xb
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8b, 4
mov r9b, 1
xor dl, cl
psrldq xmm0, 1
xor byte [rbp - 0x1e], cl
mov r10b, 8
xor byte [rbp - 0x1d], cl
mov r11b, 0x4c
xor byte [rbp - 0x1c], cl
xor r8b, cl
xor byte [rbp - 0x1b], cl
xor r9b, cl
xor byte [rbp - 0x1a], cl
xor r10b, cl
xor byte [rbp - 0x19], cl
xor r11b, cl
xor byte [rbp - 0x18], cl
xor byte [rbp - 0x17], cl
xor byte [rbp - 0x16], cl
xor byte [rbp - 0x15], cl
xor byte [rbp - 0x14], cl
xor byte [rbp - 0x13], cl
xor byte [rbp - 0x12], cl
xor byte [rbp - 0x11], cl
movd eax, xmm0
mov byte [rbp - 0x10], dl
lea rdx, [rbp - 0x1f]
mov byte [rbp - 0xf], r8b
xor al, cl
mov byte [rbp - 0xe], r9b
mov byte [rbp - 0x1f], al
mov byte [rbp - 0xd], r10b
mov byte [rbp - 0xc], r11b
mov byte [rbp - 0xb], 0
call fcn.14005c900
call fcn.14005cf40
int3
Function at 0x1400074e0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Encrypt data using rc4 prga
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports
Terminate thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xorps xmm0, xmm0
xor esi, esi
movups xmmword [rsp + 0x50], xmm0
mov qword [r11 - 0x80], rsi
mov ebx, esi
movups xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x30], sil
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x40], esi
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x30]
lea r8, [0x1400074a0]
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + rbx*8 + 0x50], rax
inc rbx
cmp rbx, 3
jle 0x140007532
mov edi, esi
cmp byte [rsp + 0x30], 1
je 0x140007646
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax]
mov rax, qword [0x1401d5128]
mov r9, qword [rcx + 0x30]
test rax, rax
jne 0x140007616
movsxd rax, dword [r9 + 0x3c]
mov r8d, esi
mov r11d, dword [rax + r9 + 0x88]
mov ebx, dword [r11 + r9 + 0x20]
nop dword [rax + rax]
mov r10d, r8d
mov edx, 0xec33c24d
lea rax, [rbx + r10*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400075ef
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400075d0
cmp edx, 0x84d3002
je 0x1400075f4
inc r8d
jmp 0x1400075b0
mov ecx, dword [r11 + r9 + 0x24]
add rcx, r9
movzx edx, word [rcx + r10*2]
mov ecx, dword [r11 + r9 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
mov qword [0x1401d5128], rax
mov r9d, 8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x38]
mov rcx, 0xffffffffffffffff
lea edx, [r9 - 1]
call rax
inc edi
cmp edi, 0x13337
jl 0x140007561
lea rdi, [rsp + 0x50]
mov esi, 4
mov rbx, qword [rdi]
test rbx, rbx
je 0x14000766c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 8
sub rsi, 1
jne 0x140007650
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400b8870
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000af20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000af7d
lea rbx, [0x1400cbc20]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000af64
cmp r10, 2
jb 0x14000af64
cmp byte [r9], r8b
jne 0x14000af64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000af40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000afbf
lea rbx, [0x1400cbc20]
cmp r8b, 0x23
jne 0x14000afa3
cmp byte [r9], r8b
jne 0x14000afa3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000af90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000b100
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000b11a
mov qword [r8], 0
lea rdx, [0x1400cb65c]
call fcn.14000afd0
mov rbx, rax
test rax, rax
jne 0x14000b13a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000b211
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b211
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000b211
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b211
cmp rdi, 0xffffffffffffffff
je 0x14000b211
mov rax, qword [0x1401d5160]
test rax, rax
je 0x14000b1ae
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000b211
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000b1fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1401d5160]
test rax, rax
je 0x14000b1f3
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000b21a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000b20c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000b21c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140019890
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword [0x1401d5160]
lea r10, [0x1400cbc20]
mov r9, qword [rax + 0x1d18]
movsxd rdx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx eax, cl
movzx edx, r8b
shr r8d, 8
xor rdx, rax
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r10 + rdx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r10 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r10 + rcx*4]
lea rcx, [r9 + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.14002b3d0
add rsp, 0x28
ret

Function at 0x14001a7f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401d5160]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x14001a850
cmp byte [rbx + 0x20d6], 0
jne 0x14001a850
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000aea0
test dil, 1
je 0x14001a976
jmp 0x14001a8df
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400d048c]
mulss xmm1, dword [0x1400d0474]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400d03a8]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.14000aea0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001a930
lea r11, [0x1400cbc20]
nop
cmp r9b, 0x23
jne 0x14001a913
cmp byte [r8], r9b
jne 0x14001a913
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a900
not ecx
call fcn.140013380
test rax, rax
je 0x14001a976
cmp byte [rax + 0xcf], 0
je 0x14001a976
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.14000aea0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140015e60
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b8870
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001f6d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001f777
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001f72a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002bce0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000b7d0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1401d5158]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001f77f
mov rcx, rbx
call fcn.14000b7d0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001fbc0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x14001fc12
lea r11, [0x1400cbc20]
cmp r9b, 0x23
jne 0x14001fbf5
cmp byte [r8], r9b
jne 0x14001fbf5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001fbe2
mov r11, qword [0x1401d5160]
mov r10, qword [r11 + 0x3228]
test r10, r10
je 0x14001fc59
lea r9, [r10 + 4]
test r9, r9
je 0x14001fc59
not eax
cmp dword [r9], eax
je 0x14001fc62
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x14001fc30
mov rcx, rbx
pop rbx
jmp fcn.14001fad0
mov rax, r9
pop rbx
ret
Function at 0x1400230b0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x1400232ee
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400cbc20]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x1400232b6
mov rcx, rbp
call fcn.140022740
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140023181
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140023171
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140023169
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14002316c
mov rdx, rcx
test rdx, rdx
jne 0x140023140
cmp r8, r10
je 0x140023181
cmp dword [r8], r9d
jne 0x140023181
mov rcx, qword [r8 + 8]
jmp 0x140023183
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140023217
cmp qword [rcx + 0x18], 0
jne 0x14002320c
mov qword [rcx + 0x18], rbx
jmp 0x140023217
cmp qword [rcx + 0x20], 0
jne 0x140023217
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov rcx, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002324c
nop
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140023240
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.14000aea0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x1400232a8
cmp r9b, 0x23
jne 0x14002328b
cmp byte [r8], r9b
jne 0x14002328b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140023278
not ecx
call fcn.140013380
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140023100
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b8870
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140051510
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400b8890
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140051970]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140051580
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b8870
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140058480
Capabilities:
Check for debugger via api

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400e1700]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [0x1401d51b0]
mov eax, 1
movzx edi, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
xchg byte [rcx + 1], al
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140058621
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp eax, 1
jne 0x1400584f1
cmp dword [rsp + 0x68], eax
je 0x140058621
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140058557
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140058557
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x6c]
mov rcx, rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 3]
call rbx
test eax, eax
js 0x140058552
cmp dword [rsp + 0x6c], 0xffffffff
jne 0x140058552
mov dil, 1
jmp 0x140058621
xor dil, dil
jmp 0x140058560
test dil, dil
jne 0x140058621
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400585c3
lea rdx, str.NtQueryInformationProcess
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400585c3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x70]
mov rcx, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1b]
call rbx
test eax, eax
js 0x1400585be
cmp dword [rsp + 0x70], 0
jne 0x1400585be
mov sil, 1
jmp 0x140058621
xor sil, sil
jmp 0x1400585c8
test sil, sil
jne 0x140058621
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_HeapWalk]
test eax, eax
je 0x140058612
cmp word [rsp + 0x4e], 4
jne 0x1400585e0
mov ecx, dword [rsp + 0x48]
mov rax, qword [rsp + 0x40]
cmp dword [rcx + rax], 0xabababab
je 0x140058621
test byte [0x7ffe02d4], 3
jne 0x140058621
call fcn.1400580f0
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], 1
call fcn.140006c70
jmp 0x1400584c0