joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077f80
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x120
lea rdi, [rsp + 0x30]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140078028
cmp dword [rsp + 0x40], 0x12
jne 0x140078010
mov rax, qword [0x140100e90]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x14007800e
mov rcx, qword [rsp + 0x80]
call fcn.1400752b0
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x80], rax
jmp 0x140077fe1
jmp 0x140078026
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140077fac
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
je 0x1400781b6
lea rdx, str.GLFW
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetPropW]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x1400781b6
mov dword [rsp + 0x98], 0xa0
mov dword [rsp + 0x9c], 0x154
mov dword [rsp + 0xa0], 0xa1
mov dword [rsp + 0xa4], 0x158
mov dword [rsp + 0xa8], 0x5b
mov dword [rsp + 0xac], 0x157
mov dword [rsp + 0xb0], 0x5c
mov dword [rsp + 0xb4], 0x15b
mov dword [rsp + 0x88], 0
jmp 0x1400780dd
mov eax, dword [rsp + 0x88]
inc eax
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 4
jge 0x1400781b6
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 0
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc4], eax
movsxd rax, dword [rsp + 0x88]
lea rax, [rsp + rax*8 + 0x98]
mov ecx, 4
imul rcx, rcx, 1
mov eax, dword [rax + rcx]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rsp + 0xc8]
lea rcx, [0x140102578]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0xcc], eax
mov ecx, dword [rsp + 0xc4]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140078167
jmp 0x1400780cd
movsxd rax, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
movsx eax, byte [rcx + rax + 0x90]
cmp eax, 1
je 0x140078189
jmp 0x1400780cd
call fcn.140079660
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, dword [rsp + 0xcc]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0x80]
call fcn.14007e180
jmp 0x1400780cd
mov rax, qword [0x140102f18]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140078259
lea r8, [rsp + 0xf4]
lea rdx, [rsp + 0xd4]
mov rcx, qword [rsp + 0x80]
call fcn.140076bc0
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x394], eax
jne 0x140078229
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
mov rcx, qword [rsp + 0x80]
cmp dword [rcx + 0x398], eax
je 0x140078259
mov eax, dword [rsp + 0xf4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm0, eax
mov eax, dword [rsp + 0xd4]
cdq
sub eax, edx
sar eax, 1
cvtsi2sd xmm1, eax
movaps xmm2, xmm0
mov rcx, qword [rsp + 0x80]
call fcn.140075ee0
mov rcx, rsp
lea rdx, [0x1400a6f00]
call fcn.14008a7b0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.140089d60
add rsp, 0x120
pop rdi
ret
Function at 0x140079010
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 0
mov rax, qword [rsp + 0x60]
mov rax, qword [rax + 0x358]
mov qword [rsp + 0x30], rax
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140079088
lea rdx, str.Win32:_Failed_to_register_raw_input_device
mov ecx, 0x10008
call fcn.1400811e0
mov rcx, rsp
lea rdx, [0x1400a71f0]
call fcn.14008a7b0
add rsp, 0x50
pop rdi
ret

Function at 0x1400790b0
Capabilities:
Register raw input devices

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
lea rdi, [rsp + 0x20]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x60]
mov eax, 1
mov word [rsp + 0x28], ax
mov eax, 2
mov word [rsp + 0x2a], ax
mov dword [rsp + 0x2c], 1
mov qword [rsp + 0x30], 0
mov r8d, 0x10
mov edx, 1
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x140079120
lea rdx, str.Win32:_Failed_to_remove_raw_input_device
mov ecx, 0x10008
call fcn.1400811e0
mov rcx, rsp
lea rdx, [0x1400a7240]
call fcn.14008a7b0
add rsp, 0x50
pop rdi
ret

Function at 0x140079660
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov dword [rsp + 0x20], 0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x14007968e
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400796ae
mov eax, dword [rsp + 0x20]
or eax, 2
mov dword [rsp + 0x20], eax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400796ce
mov eax, dword [rsp + 0x20]
or eax, 4
mov dword [rsp + 0x20], eax
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov dword [rsp + 0x24], eax
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
mov ecx, dword [rsp + 0x24]
or ecx, eax
mov eax, ecx
and eax, 0x8000
test eax, eax
je 0x140079706
mov eax, dword [rsp + 0x20]
or eax, 8
mov dword [rsp + 0x20], eax
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140079724
mov eax, dword [rsp + 0x20]
or eax, 0x10
mov dword [rsp + 0x20], eax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
je 0x140079742
mov eax, dword [rsp + 0x20]
or eax, 0x20
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x14007f500
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0
je 0x14007f530
mov r8d, 0x29
lea rdx, [0x1400e8b40]
lea rcx, str.tls__win32.allocated__GLFW_FALSE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 4], eax
mov rax, qword [rsp + 0x30]
cmp dword [rax + 4], 0xffffffff
jne 0x14007f55e
lea rdx, str.Win32:_Failed_to_allocate_TLS_index
mov ecx, 0x10008
call fcn.1400811e0
xor eax, eax
jmp 0x14007f56e
mov rax, qword [rsp + 0x30]
mov dword [rax], 1
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x14007f5c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14007f5f0
mov r8d, 0x40
lea rdx, [0x1400e8c10]
lea rcx, [0x1400e8c70]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x20
pop rdi
ret

Function at 0x14007f610
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [rsp + 0x30]
cmp dword [rax], 1
je 0x14007f645
mov r8d, 0x46
lea rdx, [0x1400e8cc0]
lea rcx, str.tls__win32.allocated__GLFW_TRUE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov ecx, dword [rax + 4]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x20
pop rdi
ret
Function at 0x140081330
Capabilities:
Log keystrokes

Disassembly:
push rdi
sub rsp, 0x220
lea rdi, [rsp + 0x40]
mov ecx, 0x78
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0x210], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x100
rep stosb byte [rdi], al
mov r8d, 0x6d1
xor edx, edx
lea rcx, [0x140102832]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x40], 0x20
jmp 0x140081395
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0x15c
jg 0x140081599
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x140102578]
movsx eax, word [rcx + rax*2]
mov dword [rsp + 0x168], eax
cmp dword [rsp + 0x168], 0xffffffff
jne 0x1400813c6
jmp 0x14008138b
cmp dword [rsp + 0x40], 0x140
jl 0x1400814a2
cmp dword [rsp + 0x40], 0x14e
jg 0x1400814a2
mov dword [rsp + 0x1b8], 0x60
mov dword [rsp + 0x1bc], 0x61
mov dword [rsp + 0x1c0], 0x62
mov dword [rsp + 0x1c4], 0x63
mov dword [rsp + 0x1c8], 0x64
mov dword [rsp + 0x1cc], 0x65
mov dword [rsp + 0x1d0], 0x66
mov dword [rsp + 0x1d4], 0x67
mov dword [rsp + 0x1d8], 0x68
mov dword [rsp + 0x1dc], 0x69
mov dword [rsp + 0x1e0], 0x6e
mov dword [rsp + 0x1e4], 0x6f
mov dword [rsp + 0x1e8], 0x6a
mov dword [rsp + 0x1ec], 0x6d
mov dword [rsp + 0x1f0], 0x6b
mov eax, dword [rsp + 0x40]
sub eax, 0x140
cdqe
mov eax, dword [rsp + rax*4 + 0x1b8]
mov dword [rsp + 0x164], eax
jmp 0x1400814bb
mov edx, 1
mov ecx, dword [rsp + 0x168]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x164], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 0xffffffff
jne 0x140081535
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10
lea r9, [rsp + 0x178]
lea r8, [rsp + 0x60]
mov edx, dword [rsp + 0x168]
mov ecx, dword [rsp + 0x164]
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x16c], eax
cmp dword [rsp + 0x16c], 1
jge 0x140081544
jmp 0x14008138b
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 5
lea rcx, [0x140102832]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, [rsp + 0x178]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x14008138b
mov rcx, rsp
lea rdx, [0x1400a83e0]
call fcn.14008a7b0
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140089d60
add rsp, 0x220
pop rdi
ret
Function at 0x140088b40
Capabilities:
Link many functions at runtime

Disassembly:
push rdi
sub rsp, 0x70
lea rdi, [rsp + 0x20]
mov ecx, 0x14
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400eef00]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rax, str.libOSMesa.dll
mov qword [rsp + 0x38], rax
lea rax, str.OSMesa.dll
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
cmp qword [0x140103188], 0
je 0x140088b9b
mov eax, 1
jmp 0x140088d1b
mov dword [rsp + 0x20], 0
jmp 0x140088baf
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + rax*8 + 0x38], 0
je 0x140088be1
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + rax*8 + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x140103188], rax
cmp qword [0x140103188], 0
je 0x140088bdf
jmp 0x140088be1
jmp 0x140088ba5
cmp qword [0x140103188], 0
jne 0x140088c03
lea rdx, str.OSMesa:_Library_not_found
mov ecx, 0x10006
call fcn.140075690
xor eax, eax
jmp 0x140088d1b
lea rdx, str.OSMesaCreateContextExt
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140103190], rax
lea rdx, str.OSMesaCreateContextAttribs
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140103198], rax
lea rdx, str.OSMesaDestroyContext
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401031a0], rax
lea rdx, str.OSMesaMakeCurrent
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401031a8], rax
lea rdx, str.OSMesaGetColorBuffer
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401031b0], rax
lea rdx, str.OSMesaGetDepthBuffer
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401031b8], rax
lea rdx, str.OSMesaGetProcAddress
mov rcx, qword [0x140103188]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401031c0], rax
cmp qword [0x140103190], 0
je 0x140088cfc
cmp qword [0x1401031a0], 0
je 0x140088cfc
cmp qword [0x1401031a8], 0
je 0x140088cfc
cmp qword [0x1401031b0], 0
je 0x140088cfc
cmp qword [0x1401031b8], 0
je 0x140088cfc
cmp qword [0x1401031c0], 0
jne 0x140088d16
lea rdx, str.OSMesa:_Failed_to_load_required_entry_points
mov ecx, 0x10008
call fcn.140075690
call fcn.140088d50
xor eax, eax
jmp 0x140088d1b
mov eax, 1
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1400a92a0]
call fcn.14008a7b0
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140089d60
add rsp, 0x70
pop rdi
ret
Function at 0x140089938
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400899bc
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400a9660]
cmp byte [rcx + rax], 0
je 0x1400899bc
dec r8
sub rdx, 1
jne 0x1400899a2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140089c3c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400899d4
mov ebx, eax
test eax, eax
jne 0x140089c6c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140089ccf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140089cc6
test al, 0x10
je 0x140089cc6
bt eax, 0xa
jae 0x140089cbf
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140089ce0
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140089cbb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140089cbb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
test edi, edi
jne 0x140089cc6
and dword [rsp + 0x3c], 0
jmp 0x140089ccb
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14008ac38
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008ac82
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008ac82
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008ac82
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008ac82
cmp dword [rcx + 0x84], 0xe
jbe 0x14008ac82
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14008ac84
xor al, al
add rsp, 0x28
ret
Function at 0x180003024
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18000307e
mov r11b, 0x23
lea rdi, [0x180081a30]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x180003068
cmp rdx, 2
jb 0x180003068
cmp byte [r10], r11b
jne 0x180003068
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x180003046
jmp 0x1800030bf
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x1800030bf
mov r11b, 0x23
lea rdi, [0x180081a30]
cmp dl, r11b
jne 0x1800030a3
cmp byte [r10], r11b
jne 0x1800030a3
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x180003091
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x1800031f4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x180003214
and qword [r8], 0
lea rdx, [0x18007f95c]
call fcn.1800030d0
mov rbx, rax
test rax, rax
je 0x180003305
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800032fc
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800032fc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800032fc
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800032fc
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1800032fc
mov rax, qword [0x1800a3030]
test rax, rax
je 0x180003299
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1800032fc
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1800032e9
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800a3030]
test rax, rax
je 0x1800032de
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180003305
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800032f7
mov qword [rsi], rbp
mov rax, rdi
jmp 0x180003307
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180007500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18009e010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0xf0]
mov r8, rdx
mov qword [rsp + 0x20], rdx
mov r9d, 8
movsxd rdx, dword [rcx + 0xe8]
mov ebx, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x20]
not ebx
movzx eax, byte [rdx]
inc rdx
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180081a30]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x18000753c
mov rcx, qword [0x1800a3030]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x180007577
lea edx, [r9 + 0xc]
mov ecx, ebx
call fcn.18001f29c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007b7d0
add rsp, 0x30
pop rbx
ret

Function at 0x18000758c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18009e010]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xe8]
mov r10d, 4
mov rax, qword [rcx + 0xf0]
mov r9d, r10d
mov dword [rsp + 0x20], edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x180081a30]
xor ebx, dword [rax + rcx*4]
sub r9, 1
jne 0x1800075c8
mov rcx, qword [0x1800a3030]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x180007606
movsxd r8, edx
mov ecx, ebx
mov edx, r10d
call fcn.18001f29c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007b7d0
add rsp, 0x30
pop rbx
ret

Function at 0x18000761c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18009e010]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x108]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x10c]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf0]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xe8]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x180081a30]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x180007699
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18007b7d0
add rsp, 0x28
ret
Function at 0x180018204
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c10], 0
lea rbx, [rcx + 0x5c18]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001829d
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x180018255
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18002083c
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.180003f14
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c10]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1800a3028]
movsxd r8, eax
mov rax, qword [rdi + 0x5c20]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x1800182a5
mov rcx, rbx
call fcn.180003f14
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180018d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800a3030]
mov rbx, rcx
and dword [rax + 0x5b74], 0
test rcx, rcx
je 0x180018de9
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.180018df4
lea rdx, [0x18007f960]
mov rcx, rbx
mov rdi, rax
call fcn.1800030d0
mov rbx, rax
test rax, rax
je 0x180018de9
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret