joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a280
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x14057e538]
cmp byte [rbx + 0x5ba1], 0
jne 0x14001a3eb
cmp dword [rbx + 0x5bc8], 0
je 0x14001a2ca
mov r8d, 0x30d6
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.cpp
lea rcx, str.g.SettingsWindows.empty__
call fcn.14004e214
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a3e4
lea rdx, [0x140070d38]
call fcn.140003160
mov rdi, rax
test rax, rax
je 0x14001a3e4
mov rcx, rax
call fcn.140043234
mov ebp, eax
cmp eax, 0xffffffff
je 0x14001a3dc
xor edx, edx
mov r8d, 2
mov rcx, rdi
call fcn.140043a28
test eax, eax
jne 0x14001a3dc
mov rcx, rdi
call fcn.140043234
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x14001a3dc
xor r8d, r8d
mov edx, ebp
mov rcx, rdi
call fcn.140043a28
test eax, eax
jne 0x14001a3dc
cmp rsi, 0xffffffffffffffff
je 0x14001a3dc
mov rax, qword [0x14057e538]
test rax, rax
je 0x14001a35f
inc dword [rax + 0xf4]
mov rcx, rsi
call fcn.14004e5cc
mov rbp, rax
test rax, rax
je 0x14001a3dc
mov r9, rdi
mov r8, rsi
mov edx, 1
mov rcx, rax
call fcn.140048514
mov rcx, rdi
cmp rax, rsi
je 0x14001a3ab
call fcn.1400437bc
mov rax, qword [0x14057e538]
test rax, rax
je 0x14001a3a1
dec dword [rax + 0xf4]
mov rcx, rbp
call fcn.1400482a0
jmp 0x14001a3e4
call fcn.1400437bc
test rsi, rsi
je 0x14001a3c0
mov rdx, rsi
mov rcx, rbp
call fcn.14001a8e0
mov rax, qword [0x14057e538]
test rax, rax
je 0x14001a3d2
dec dword [rax + 0xf4]
mov rcx, rbp
call fcn.1400482a0
jmp 0x14001a3e4
mov rcx, rdi
call fcn.1400437bc
mov byte [rbx + 0x5ba1], 1
movss xmm0, dword [rbx + 0x5ba4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001a47a
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5ba4], xmm0
jb 0x14001a47a
mov rdi, qword [rbx + 0x20]
xor ebp, ebp
test rdi, rdi
je 0x14001a46d
mov rax, qword [0x14057e538]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5ba4], ebp
call fcn.14001ac90
lea rdx, [0x140070d3c]
mov rcx, rdi
mov rsi, rax
call fcn.140003160
mov rdi, rax
test rax, rax
je 0x14001a474
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call fcn.140048144
mov rcx, rdi
call fcn.1400437bc
jmp 0x14001a474
mov byte [rbx + 0xdc], 1
mov dword [rbx + 0x5ba4], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001a7c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x14057e538]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001a824
lea r10, [0x1400714f0]
cmp r8b, 0x23
jne 0x14001a807
cmp byte [rdx], r8b
jne 0x14001a807
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001a7f4
mov eax, dword [r14 + 0x5bb8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001a884
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001a84a
cmp edi, eax
jl 0x14001a863
mov r8d, 0x6fb
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.h
lea rcx, str.i___0__i___Size
call fcn.14004e214
mov rax, qword [r14 + 0x5bc0]
cmp dword [rax + rbp + 8], ebx
je 0x14001a8a1
mov eax, dword [r14 + 0x5bb8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001a841
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001a8ae
cmp edi, dword [r14 + 0x5bb8]
jl 0x14001a8c7
mov r8d, 0x6fb
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.h
lea rcx, str.i___0__i___Size
call fcn.14004e214
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5bc0]
lea rax, [rax + rcx*8]
jmp 0x14001a886
Function at 0x140038900
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.140010810
cmp byte [rax], 0
je 0x140038994
mov ecx, 0x210
call fcn.1400022b0
cmp byte [rax + 8], 0
jne 0x140038994
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140038994
mov rbx, qword [0x14057e538]
test rbx, rbx
jne 0x140038963
mov r8d, 0xfe3
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.14004e214
mov rbx, qword [0x14057e538]
cmp byte [rbx + 0x37a9], 0
je 0x140038980
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002860
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.140010810
cmp byte [rax], 0
je 0x140038a22
mov ecx, 0x214
call fcn.1400022b0
cmp byte [rax + 8], 0
jne 0x140038a22
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140038a22
mov rbx, qword [0x14057e538]
test rbx, rbx
jne 0x1400389f1
mov r8d, 0xfe3
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.14004e214
mov rbx, qword [0x14057e538]
cmp byte [rbx + 0x37a9], 0
je 0x140038a0e
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002860
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.140010810
cmp byte [rax], 0
je 0x140038ab0
mov ecx, 0x212
call fcn.1400022b0
cmp byte [rax + 8], 0
jne 0x140038ab0
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140038ab0
mov rbx, qword [0x14057e538]
test rbx, rbx
jne 0x140038a7f
mov r8d, 0xfe3
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.14004e214
mov rbx, qword [0x14057e538]
cmp byte [rbx + 0x37a9], 0
je 0x140038a9c
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002860
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.140010810
cmp byte [rax], 0
je 0x140038b3e
mov ecx, 0x216
call fcn.1400022b0
cmp byte [rax + 8], 0
jne 0x140038b3e
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140038b3e
mov rbx, qword [0x14057e538]
test rbx, rbx
jne 0x140038b0d
mov r8d, 0xfe3
lea rdx, str.C:UsersQDownloadsBlue_loader__1___1_Blue_loaderimgui.cpp
lea rcx, str.GImGui___0___No_current_context._Did_you_call_ImGui::CreateContext___and_ImGui::SetCurrentContext_____
call fcn.14004e214
mov rbx, qword [0x14057e538]
cmp byte [rbx + 0x37a9], 0
je 0x140038b2a
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002860
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x14003b5c0
Capabilities:
Create process on windows
Create process suspended
Resume thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
xorps xmm0, xmm0
mov dword [rbp - 0x19], 0x68
xor eax, eax
xor esi, esi
mov rdi, rcx
mov dword [rsp + 0x28], esi
mov r8, rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0xffffffff
mov dword [rbp + 0x4b], eax
xor edx, edx
mov qword [rbp - 0x49], rax
mov ecx, 0xfde9
movups xmmword [rbp - 0x15], xmm0
movups xmmword [rbp - 5], xmm0
movups xmmword [rbp + 0xb], xmm0
movups xmmword [rbp + 0x1b], xmm0
movups xmmword [rbp + 0x2b], xmm0
movups xmmword [rbp + 0x3b], xmm0
movups xmmword [rbp - 0x59], xmm0
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
xorps xmm1, xmm1
lea rcx, [rbp - 0x41]
mov r8, rbx
movups xmmword [rbp - 0x41], xmm0
movdqu xmmword [rbp - 0x31], xmm1
call fcn.14003e7b0
cmp qword [rbp - 0x29], 7
lea rdx, [rbp - 0x41]
mov dword [rsp + 0x28], ebx
mov r9d, 0xffffffff
cmova rdx, qword [rbp - 0x41]
mov r8, rdi
mov qword [rsp + 0x20], rdx
mov ecx, 0xfde9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp qword [rbp - 0x29], 7
lea rax, [rbp - 0x59]
mov qword [rsp + 0x48], rax
lea rcx, [rbp - 0x41]
cmova rcx, qword [rbp - 0x41]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov qword [rsp + 0x38], rsi
xor r8d, r8d
mov qword [rsp + 0x30], rsi
xor edx, edx
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14003b6e0
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_launch_the_application
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x14003b740
mov rdx, qword [rbp - 0x59]
mov rcx, qword [0x14057e580]
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14003b722
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_assign_process_to_job_object
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, qword [rbp - 0x59]
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x14003b72c
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x51]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x29]
cmp rdx, 7
jbe 0x14003b77c
mov rcx, qword [rbp - 0x41]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b777
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003b795
call fcn.14003ee4c
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14004e554
int3
Function at 0x14003f5c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f60a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f60a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003f60a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003f60a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003f60a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003f60c
xor al, al
add rsp, 0x28
ret

Function at 0x14004e978
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14004e80b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004e80b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004e80b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004e80b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004e80b
cmp dword [rcx + 0x84], 0xe
jbe 0x14004e80b
cmp dword [rcx + 0xf8], 0
je 0x14004e80b
mov ecx, ebx
call fcn.14004e8ac
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14004e69c
cmp dword [rbp + 0x20], 0
je 0x14004e858
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004e860
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004e7a4

Function at 0x14005ea90
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005eab8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005eab8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call [r14]
xor edi, dword [rdx]
call [rsi]
xor dword [rbx], edi
jmp qword [rax]
cmp eax, 0x403721ff
call [0x15b0332d3]
xor byte [rax], bh
call qword [rdi]
sub dh, byte [rax]
dec dword [rsi]
sbb ebx, dword [rdi]
dec dword [rbx]
invalid
sbb eax, 0x2c271aff
jmp qword [rsi]
or byte [rcx], bl
sbb edi, edi
sbb ch, byte [0x1782af606]
dec dword [0x14e030ef1]
sbb byte [rdi], dl
invalid
dec dword [rdi]
sbb ebx, dword [rbx]
dec dword [rsi]
sbb bl, byte [rbx]
dec dword [rbx]
adc eax, 0x120aff15
invalid
adc edi, edi
or dl, byte [rax]
adc bh, bh
or edx, dword [rcx]
ud0
movups xmm1, xmmword [rdi]
call [0x166031330]
and al, 0x1e
invalid
jmp qword [rbx + riz]
and al, 0x23
and al, 0x23
sbb al, 0xff
and ah, byte [rdx]
sbb edi, edi
and ah, byte [rcx]
sbb bh, bh
and dword [rax], esp
sbb bh, bh
adc al, 0x14
invalid
Function at 0x1400059b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140005a0d
lea rbx, [0x14008d040]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400059f4
cmp r10, 2
jb 0x1400059f4
cmp byte [r9], r8b
jne 0x1400059f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400059d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140005a4f
lea rbx, [0x14008d040]
cmp r8b, 0x23
jne 0x140005a33
cmp byte [r9], r8b
jne 0x140005a33
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140005a20
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140005c10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x140005c2e
mov qword [r8], r14
lea rdx, [0x1400d31e0]
call fcn.140005a60
mov rbx, rax
test rax, rax
jne 0x140005c53
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140005d7f
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005d7f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140005d7f
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140005d7f
cmp rdi, 0xffffffffffffffff
je 0x140005d7f
mov rcx, rdi
call fcn.14000a050
mov rbp, rax
test rax, rax
je 0x140005d7f
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140005d6c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x140182e00]
test r8, r8
je 0x140005d61
movsx rdx, word [r8 + 0x6228]
lea rcx, [r8 + 0x622c]
mov r9d, dword [r8 + 0x3fc0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140005d56
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6228], cx
movsx rax, cx
lea rcx, [r8 + 0x622c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x6224]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140005d88
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140005d7a
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140005d8a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140013d00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x14008d040]
movsxd rcx, dword [rcx + 0x108]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x110]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x40cc], ebx
jne 0x140013d94
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.14001e850
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140013db0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x128]
lea r10, [0x14008d040]
mov rax, qword [rcx + 0x110]
movss xmm1, dword [rcx + 0x12c]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0x108]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x140018030
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400e5040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140182e00]
mov edi, ecx
cmp byte [rbx + 0x4dc5], 0
jne 0x140018091
cmp byte [rbx + 0x4dc6], 0
jne 0x140018091
movsx r9d, word [rbx + 0x5fe8]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140005790
test dil, 2
je 0x1400181bf
jmp 0x14001811c
movss xmm1, dword [rbx + 0x39e0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5fe8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400d5418]
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400d5408]
addss xmm0, dword [rbx + 0x110]
addss xmm1, dword [rbx + 0x114]
mov qword [rbx + 0x4aa8], rax
mov dword [rbx + 0x4a94], 1
movss dword [rbx + 0x4aa0], xmm0
movss dword [rbx + 0x4aa4], xmm1
movss xmm0, dword [rbx + 0x3a3c]
mulss xmm0, dword [0x1400d5380]
or dword [rbx + 0x4a90], 0x41
movss dword [rbx + 0x4af0], xmm0
call fcn.140005790
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140018170
lea r11, [0x14008d040]
nop dword [rax]
cmp r9b, 0x23
jne 0x140018153
cmp byte [r8], r9b
jne 0x140018153
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140018140
not ecx
call fcn.14000da30
test rax, rax
je 0x1400181bf
cmp byte [rax + 0xca], 0
je 0x1400181bf
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5fe8]
movsx r9d, word [rbx + 0x5fe8]
call fcn.140005790
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140010930
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140085f80
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret