joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100003a58
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x270
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rdx
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ebp, ebp
bt eax, 0x1f
lea r12d, [rbp + 1]
jb 0x100003ace
cmp al, 6
jb 0x100003ace
lea rcx, [0x1000016c0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, rbp
je 0x100003ace
lea rdx, [0x1000016e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbp
je 0x100003ace
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call rax
mov ecx, 0x1090
mov dword [rsp + 0x230], ebp
mov byte [rsp + 0x30], bpl
mov dword [rsp + 0x250], ebp
mov qword [rsp + 0x258], rbp
mov qword [rsp + 0x238], rbp
mov byte [0x100011ce0], bpl
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
cmp rax, rbp
jne 0x100003b26
lea rdx, [0x1000016f8]
lea rcx, [rsp + 0x30]
call fcn.100002688
mov ecx, r12d
call qword [sym.imp.msvcrt.dll_exit]
int3
lea rcx, [0x100001720]
mov qword [0x100011de0], rax
mov dword [rax + 0x14], ebp
mov dword [rax + 0x10], ebp
mov dword [rax + 0x870], ebp
mov dword [rax + 0x868], ebp
mov dword [rax + 0x86c], ebp
mov dword [rax + 0x1c], ebp
mov qword [rax + 8], rbp
mov qword [rax + 0x38], rbp
mov dword [rax + 0x18], ebp
mov dword [rax + 0x4c], ebp
mov dword [rax + 0x50], ebp
mov dword [rax + 0x60], ebp
mov byte [rax + 0xe7c], bpl
mov dword [rax + 0x107c], ebp
mov dword [rax + 0x1088], ebp
call qword [sym.imp.msvcrt.dll_printf]
lea r9, [rsp + 0x30]
mov r8, rsi
mov edx, ebx
mov rcx, rdi
call fcn.1000055b0
cmp eax, ebp
jne 0x100003ba7
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.100005e00
mov eax, r12d
jmp 0x100003c8e
cmp dword [rdi], r12d
jne 0x100003bcb
lea rcx, [0x10000179c]
call qword [sym.imp.msvcrt.dll_printf]
lea rcx, [0x1000017a0]
call qword [sym.imp.msvcrt.dll_printf]
jmp 0x100003c8c
cmp dword [rdi], 5
lea rdx, [rsp + 0x30]
mov rcx, rdi
jne 0x100003be7
call fcn.100003cbc
cmp eax, ebp
jne 0x100003c8c
jmp 0x100003b92
call fcn.100003e1c
cmp eax, ebp
jne 0x100003c11
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.100005e00
mov rcx, qword [0x100011cc8]
cmp rcx, 0xffffffffffffffff
je 0x100003b9f
call fcn.100006014
jmp 0x100003b9f
mov ecx, dword [rdi + 0x4c]
cmp ecx, ebp
jne 0x100003c32
lea r8, [0x100001b70]
lea rcx, [rdi + 0x168]
mov edx, 0x200
call fcn.1000032d0
jmp 0x100003c6f
cmp dword [rdi], 3
jne 0x100003c83
lea rax, [0x100001b98]
cmp ecx, r12d
lea r8, [0x100001bb0]
cmove r8, rax
mov eax, dword [rdi + 0x50]
lea r9, [0x100001b88]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rdi + 0x168]
mov edx, 0x200
call fcn.1000032d0
lea rdx, [rdi + 0x168]
lea rcx, [0x100001b84]
call qword [sym.imp.msvcrt.dll_printf]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.10000d2f0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1000064cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call qword [sym.imp.msvcrt.dll__read]
mov ebx, eax
cmp rdi, qword [0x10000f410]
jne 0x1000064fa
mov ecx, dword [0x10000fa00]
add ecx, eax
mov dword [0x10000fa00], ecx
jmp 0x100006511
cmp rdi, qword [0x10000f418]
jne 0x100006524
mov ecx, dword [0x10000f9f8]
add ecx, eax
mov dword [0x10000f9f8], ecx
cmp ecx, dword [0x10000fa04]
jbe 0x100006524
mov dword [0x10000fa04], ecx
call fcn.1000066a4
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x10000ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x10
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 8], rax
cmp r8d, 6
mov r9, rcx
jg 0x10000ac8a
add dword [rcx + 0x2ed8], r8d
jmp 0x10000ad7e
mov ecx, dword [rcx + 0x2ed8]
add ecx, r8d
cmp ecx, 0xa
jae 0x10000aca4
mov dword [r9 + 0x2ed8], ecx
jmp 0x10000ad7e
lea rcx, [rsp]
movsxd r10, r8d
add r10, rdx
mov eax, dword [r10 - 6]
mov dword [rcx], eax
movzx eax, word [r10 - 2]
mov word [rcx + 4], ax
lea eax, [r8 - 6]
movsxd rcx, eax
movabs rax, 0xe8e8e8e8e8e8e8e8
mov dword [rcx + rdx], eax
mov word [rcx + rdx + 4], ax
mov eax, dword [r9 + 0x2ed8]
lea r11d, [rax + r8 - 0xa]
jmp 0x10000acee
inc rdx
inc dword [r9 + 0x2ed8]
cmp byte [rdx], 0xe8
jne 0x10000ace4
mov r8d, dword [r9 + 0x2ed8]
cmp r8d, r11d
jae 0x10000ad60
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 4]
mov ebx, dword [r9 + 0x2ed4]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
cmp ecx, ebx
jae 0x10000ad2e
sub ecx, r8d
jmp 0x10000ad39
mov eax, ecx
neg eax
cmp eax, r8d
ja 0x10000ad52
add ecx, ebx
mov eax, ecx
mov byte [rdx + 1], cl
shr eax, 8
mov byte [rdx + 2], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdx + 4], cl
mov byte [rdx + 3], al
add rdx, 5
add dword [r9 + 0x2ed8], 5
jmp 0x10000acee
lea eax, [r11 + 0xa]
lea rcx, [rsp]
mov dword [r9 + 0x2ed8], eax
mov eax, dword [rcx]
mov dword [r10 - 6], eax
movzx eax, word [rcx + 4]
mov word [r10 - 2], ax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.10000d2f0
add rsp, 0x10
pop rbx
ret

Function at 0x10000d528
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x10000d575
cmp rcx, 0xffffffffffffffff
je 0x10000d575
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000d56d
cmp dword [rcx + 0x3c], edx
jl 0x10000d56d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000d56d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000d575
mov rax, rdx
add rsp, 0x18
ret
Function at 0x14000125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140006df0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400012f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140008140
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140008160
xor al, al
jmp 0x1400081e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140008173
xor al, al
jmp 0x1400081e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14000819d
xor al, al
jmp 0x1400081e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400081b1
xor al, al
jmp 0x1400081e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400081c3
xor al, al
jmp 0x1400081e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400081df
xor al, al
jmp 0x1400081e1
mov al, 1
add rsp, 0x38
ret
Function at 0x100039ae8
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
xor ebp, ebp
lea rax, [rax + 0x10]
mov rbx, rcx
mov dword [rax], ebp
mov dword [rax + 8], ebp
lea r9, [0x100006ffc]
lea r8, [0x100007020]
lea edx, [rbp + 0x3c]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::constructor_unsigned_long_int__char_const__const___ptr64__char_const__const___ptr64__long_int_const____ptr64____ptr64
cmp dword [0x100058b24], ebp
je 0x100039b84
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea r9, [rsp + 0x90]
mov rdx, rbx
not rcx
mov qword [rsp + 0x20], rbp
lea r8, [rcx - 1]
mov rcx, qword [0x1000591f0]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
cmp eax, ebp
jne 0x100039c4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x88], ecx
jmp 0x100039c4a
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
lea ecx, [rdx + 1]
or r9d, 0xffffffff
mov r8, rbx
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
cmp esi, ebp
je 0x100039b64
mov rdx, rsi
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
cmp rax, rbp
jne 0x100039bd3
mov dword [rsp + 0x88], 0x8007000e
jmp 0x100039c3c
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x30], rbp
lea ecx, [rdx + 1]
or r9d, 0xffffffff
mov r8, rbx
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, ebp
je 0x100039c21
mov rcx, qword [0x1000591f0]
lea r8d, [rax - 1]
lea r9, [rsp + 0x90]
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, ebp
jne 0x100039c3c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebp
cmovle ecx, eax
mov dword [rsp + 0x88], ecx
cmp rdi, rbp
je 0x100039c4a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x100058b20], ebp
jbe 0x100039c5a
mov rcx, rbx
call fcn.1000399b4
mov edi, dword [rsp + 0x88]
lea rcx, [rsp + 0x40]
call sym.diskraid.exe_public:_void___cdecl_CDrCallTracer::destructor_void____ptr64
mov rbx, qword [rsp + 0x80]
mov eax, edi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405520]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405530]
mov dword [rax], 1
mov rax, qword [0x00405540]
mov dword [rax], 1
mov rax, qword [0x00405510]
mov dword [rax], 1
mov rax, qword [0x004053d0]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00405500]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00405460]
mov qword [rdx], rax
mov rdx, qword [0x00405450]
mov qword [rdx], rax
mov rax, qword [0x004054c0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00405380]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401fc0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408524]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x4020da
mov rax, qword [0x00408528]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x40200e
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x4020c0
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401ff2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x402112
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408528]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408528]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4020f5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4020b9
sub eax, 0x40
and eax, 0xffffffbf
je 0x4020b9
mov r9, rbp
add r9, qword [0x00408528]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x4020e1
add dword [0x00408524], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x40201b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408528]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x402cf0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x402d00
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x402d10
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402d51
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x402d48
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402d53
add rax, 0x28
cmp rax, r9
jne 0x402d34
xor eax, eax
repz ret

Function at 0x402e00
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x004053d0]
cmp word [rbx], 0x5a4d
je 0x402e20
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402e14
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection
Function at 0x403070
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408e80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00408e60]
test rbx, rbx
je 0x4030c4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x4030bb
test rsi, rsi
je 0x4030bb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4030a0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x00408e80]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x140006ca0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140006cfd
lea rbx, [0x1400eb8c0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140006ce4
cmp r10, 2
jb 0x140006ce4
cmp byte [r9], r8b
jne 0x140006ce4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140006cc0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140006d3f
lea rbx, [0x1400eb8c0]
cmp r8b, 0x23
jne 0x140006d23
cmp byte [r9], r8b
jne 0x140006d23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140006d10
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140006e80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140006e9a
mov qword [r8], 0
lea rdx, [0x1400eac48]
call fcn.140006d50
mov rbx, rax
test rax, rax
jne 0x140006eba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140006fa5
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006fa5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140006fa5
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140006fa5
cmp rdi, 0xffffffffffffffff
je 0x140006fa5
mov rax, qword [0x1408509f0]
test rax, rax
je 0x140006f36
inc dword [rax + 0x3b0]
mov rdx, qword [0x1408509e0]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140006fa5
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140006f92
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1408509f0]
test rax, rax
je 0x140006f81
dec dword [rax + 0x3b0]
mov rdx, qword [0x1408509e0]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140006fae
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140006fa0
mov qword [r14], rdi
mov rax, rsi
jmp 0x140006fb0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140014b50
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1408509f0]
mov r8, rcx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
movzx eax, r8b
lea r8, [0x1400eb8c0]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140014c5e
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140014c44
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140014c49
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140026490
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140014c80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1408509f0]
mov r8d, ecx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
movzx eax, r8b
lea r8, [0x1400eb8c0]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140014d40
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140014d26
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140014d2b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140026490
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400157e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14015e098]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1408509f0]
mov edi, edx
cmp byte [rbx + 0x1ef5], 0
jne 0x140015840
cmp byte [rbx + 0x1ef6], 0
jne 0x140015840
mov r9d, dword [rbx + 0x2f38]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140006b90
test dil, 1
je 0x140015977
jmp 0x1400158cf
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2f38]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140148f64]
mulss xmm1, dword [0x140148f3c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1c5c], rax
mov dword [rbx + 0x1c44], 1
movss dword [rbx + 0x1c54], xmm0
mov byte [rbx + 0x1c7c], 1
movss dword [rbx + 0x1c58], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x140148e70]
or dword [rbx + 0x1c40], 0x41
movss dword [rbx + 0x1ca0], xmm0
call fcn.140006b90
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140015920
lea r11, [0x1400eb8c0]
nop
cmp r9b, 0x23
jne 0x140015903
cmp byte [r8], r9b
jne 0x140015903
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x1400158f0
mov rcx, qword [0x1408509f0]
not edx
add rcx, 0x1b78
call fcn.140007300
test rax, rax
je 0x140015977
cmp byte [rax + 0xbf], 0
je 0x140015977
mov byte [rax + 0xc6], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0xdc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2f38]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x2f38]
call fcn.140006b90
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.1400112f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d64d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001a4f0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1408509f0]
cmp byte [rbx + 0x3000], 0
je 0x14001a5dc
cmp qword [rbx + 0x3008], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3010]
je 0x14001a5c4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001a56b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400261d0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.1400076e0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3008]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3018]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x1408509e8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.1400076e0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret

Function at 0x14001a980
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x14001a9d2
lea r11, [0x1400eb8c0]
cmp r9b, 0x23
jne 0x14001a9b5
cmp byte [r8], r9b
jne 0x14001a9b5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a9a2
mov r11, qword [0x1408509f0]
mov r10, qword [r11 + 0x2fe8]
test r10, r10
je 0x14001aa19
lea r9, [r10 + 4]
test r9, r9
je 0x14001aa19
not eax
cmp dword [r9], eax
je 0x14001aa22
movsxd r8, dword [r9 - 4]
lea rdx, [r10 + 4]
movsxd rcx, dword [r11 + 0x2fe0]
add r8, r9
xor r9d, r9d
add rdx, rcx
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x14001a9f0
mov rcx, rbx
pop rbx
jmp fcn.14001a890
mov rax, r9
pop rbx
ret