joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000bc00
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1400332d0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov rdi, rcx
xor edx, edx
lea r8d, [rax + 1]
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rsi, rax
test rax, rax
jne 0x14000bc60
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.14000ff50
jmp 0x14000bd4d
mov r8d, 0x24
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x68], rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14000bca3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x424
je 0x14000bd31
lea rcx, str.OpenService_failed_w_err_0x_08lx_n
mov edx, eax
call fcn.14000ff50
jmp 0x14000bd31
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14000bd31
lea rcx, str.Stopping__s.
mov rdx, rdi
call fcn.14000ff50
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x14000bd12
nop dword [rax + rax]
mov eax, dword [rsp + 0x24]
cmp eax, 3
jne 0x14000bd16
lea rcx, [0x14002b3d4]
call fcn.14000ff50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x14000bce0
mov eax, dword [rsp + 0x24]
mov rdx, rdi
lea rcx, str._n_s_is_stopped._n
cmp eax, 1
je 0x14000bd2c
lea rcx, str._n_s_failed_to_stop._n
call fcn.14000ff50
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x14000bd48
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000e920
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000bd70
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov ebp, edx
mov rsi, rcx
test edx, edx
je 0x14000bd97
neg r8d
sbb ebx, ebx
add ebx, 3
jmp 0x14000bda1
mov ebx, 4
call fcn.14000bc00
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14000bdd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenSCManager_failed___d__n
mov edx, eax
call fcn.14000ff50
jmp 0x14000be84
mov r8d, 2
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
test rax, rax
jne 0x14000be00
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.OpenService_failed___d__n
mov edx, eax
call fcn.14000ff50
jmp 0x14000be7b
xor eax, eax
or r9d, 0xffffffff
mov r8d, ebx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
or edx, r9d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x14000be52
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.ChangeServiceConfig_failed___d__n
mov edx, eax
call fcn.14000ff50
jmp 0x14000be72
lea rax, str.enabled
test ebp, ebp
lea rdx, str.disabled
lea rcx, str.Service__s_successfully._n
cmovne rdx, rax
call fcn.14000ff50
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x14000cf50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x280
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov ebp, r8d
mov rdi, rdx
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov eax, dword [0x140035300]
test al, 1
jne 0x14000cfba
or eax, 1
mov dword [0x140035300], eax
mov qword [0x1400352f8], 7
mov qword [0x1400352f0], r14
mov word [0x1400352e0], r14w
lea rcx, [0x140022cd0]
call fcn.14000f048
cmp qword [0x1400352f0], 0
jne 0x14000d0d4
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000d6e0
nop
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x38]
call fcn.14000d950
test eax, eax
je 0x14000d0ca
mov word [rsp + 0x70], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x72]
call fcn.1400113d0
mov dword [rsp + 0x2c8], 0x208
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x2c8]
lea r8, [rsp + 0x70]
lea rdx, str.ProgDir
lea rcx, [rsp + 0x40]
call fcn.14000dec0
test eax, eax
je 0x14000d0ca
cmp word [rsp + 0x70], 0
jne 0x14000d05e
mov r8, r14
jmp 0x14000d07b
lea rax, [rsp + 0x70]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000d070
lea rdx, [rsp + 0x70]
lea rcx, [0x1400352e0]
call fcn.140006850
mov edx, 0x5c
or r8, 0xffffffffffffffff
lea rcx, [0x1400352e0]
call fcn.140006030
mov rcx, qword [0x1400352f0]
dec rcx
cmp rax, rcx
je 0x14000d0ca
mov r8d, 1
lea rdx, [0x14002b308]
lea rcx, [0x1400352e0]
call fcn.1400073f0
nop
lea rcx, [rsp + 0x38]
call fcn.14000d800
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov dword [rsp + 0x30], 1
cmp qword [0x1400352f0], 0
je 0x14000d183
mov r8, rdi
lea rdx, [0x1400352e0]
lea rcx, [rsp + 0x38]
call fcn.1400070f0
mov rsi, rax
cmp rbx, rax
je 0x14000d140
cmp qword [rbx + 0x18], 8
jb 0x14000d125
mov rcx, qword [rbx]
call fcn.14000e8fc
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov rdx, rsi
mov rcx, rbx
call fcn.140006410
cmp qword [rsp + 0x50], 8
jb 0x14000d152
mov rcx, qword [rsp + 0x38]
call fcn.14000e8fc
test ebp, ebp
je 0x14000d183
cmp qword [rbx + 0x18], 8
jb 0x14000d162
mov rcx, qword [rbx]
jmp 0x14000d165
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14000d183
xor r8d, r8d
lea rdx, [0x14002b30c]
mov rcx, rbx
call fcn.140006850
nop
cmp qword [rdi + 0x18], 8
jb 0x14000d192
mov rcx, qword [rdi]
call fcn.14000e8fc
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r14
mov word [rdi], r14w
mov rax, rbx
add rsp, 0x280
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000ddb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov rdi, r9
mov rsi, r8
mov r15, rdx
mov r14d, ebx
test r9, r9
je 0x14000ddd9
mov r14d, dword [r9]
test rdx, rdx
je 0x14000dea3
test r8, r8
je 0x14000dea3
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000de94
mov qword [rsp + 0x30], rcx
cmp qword [rsp + 0x80], rbx
je 0x14000de31
mov rdx, qword [rsp + 0x80]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000de94
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x78]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r15
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
cmp qword [rsp + 0x80], rbx
je 0x14000de71
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x14000de94
mov eax, dword [rsp + 0x78]
cmp eax, 4
je 0x14000de8b
cmp eax, 3
jne 0x14000de90
cmp dword [rsp + 0x68], 4
jne 0x14000de90
mov ebx, 1
mov eax, ebx
jmp 0x14000dea5
test rdi, rdi
je 0x14000dea3
mov dword [rsi], r14d
mov eax, 1
jmp 0x14000dea5
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14000dec0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r12, r9
mov rsi, r8
mov r15, rdx
mov rdi, rcx
cmp r8, rbx
jne 0x14000df08
lea rdx, str.RegistryEx.cpp
lea rcx, str.pszValue___pszDefaultValue
mov r8d, 0x126
call fcn.1400072a0
xor ebp, ebp
mov r13d, ebp
test r15, r15
je 0x14000e0a0
test rsi, rsi
je 0x14000e0a0
test r12, r12
je 0x14000e0a0
mov rcx, qword [rdi + 0x10]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], r14
test rcx, rcx
je 0x14000e055
mov r14, qword [rsp + 0x88]
mov r13d, dword [r12]
mov qword [rsp + 0x68], rcx
test r14, r14
je 0x14000df7d
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e055
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test r14, r14
je 0x14000dfae
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x80]
cmp ecx, 2
jne 0x14000e020
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.14000e8f4
mov r14, rax
test rax, rax
je 0x14000e019
mov r8d, r13d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rsi
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14000dff0
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000e004
mov rcx, r14
mov dword [r12], eax
call fcn.14000fc40
mov ecx, dword [rsp + 0x80]
test r15d, r15d
jne 0x14000e055
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14000e032
cmp ecx, 7
jne 0x14000e037
mov ebp, 1
mov eax, ebp
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14000e09c
nop word [rax + rax]
cmp word [rbx + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x14000e060
lea ecx, [rdi*2 + 2]
cmp ecx, r13d
ja 0x14000e09c
sub rsi, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rsi + rbx - 2], ax
test ax, ax
jne 0x14000e080
mov dword [r12], ecx
mov eax, 1
jmp 0x14000e039
xor eax, eax
jmp 0x14000e039
xor eax, eax
jmp 0x14000e03e
Function at 0x14000e250
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x60
mov rcx, qword [rcx + 0x10]
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
test rcx, rcx
je 0x14000e333
test rdx, rdx
je 0x14000e333
test r9, r9
je 0x14000e333
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rcx
cmp qword [rsp + 0x98], rbx
je 0x14000e2f4
mov rdx, qword [rsp + 0x98]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000e2ef
xor eax, eax
mov rbx, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp qword [rsp + 0x98], rbx
je 0x14000e32a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x14000e2d7
lea r11, [rsp + 0x60]
xor eax, eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140bcd058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140bcd1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140bcd089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bcd06f
add dl, dl
jne 0x140bcd096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bcd0f6
xor eax, eax
add dl, dl
jne 0x140bcd0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140bcd1ad
add dl, dl
jne 0x140bcd0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bcd0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bcd0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bcd0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140bcd0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140bcd07e
mov eax, 1
add dl, dl
jne 0x140bcd106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140bcd113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bcd0fb
sub eax, ebx
mov ebx, 1
jne 0x140bcd14c
mov ecx, 1
add dl, dl
jne 0x140bcd12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bcd13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bcd123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bcd07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140bcd168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140bcd175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140bcd15d
cmp eax, 0x7d00
jae 0x140bcd19b
cmp eax, 0x500
jb 0x140bcd196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bcd07e
cmp eax, 0x7f
ja 0x140bcd19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140bcd07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140bcd1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140bcd07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180002b60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180002bbd
lea rbx, [0x180040870]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180002ba4
cmp r10, 2
jb 0x180002ba4
cmp byte [r9], r8b
jne 0x180002ba4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180002b80
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180002bff
lea rbx, [0x180040870]
cmp r8b, 0x23
jne 0x180002be3
cmp byte [r9], r8b
jne 0x180002be3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180002bd0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180002d40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180002d5a
mov qword [r8], 0
lea rdx, [0x1800403d0]
call fcn.180002c10
mov rbx, rax
test rax, rax
jne 0x180002d7a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180002e51
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002e51
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180002e51
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180002e51
cmp rdi, 0xffffffffffffffff
je 0x180002e51
mov rax, qword [0x18004c9c0]
test rax, rax
je 0x180002dee
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180002e51
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180002e3e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18004c9c0]
test rax, rax
je 0x180002e33
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180002e5a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180002e4c
mov qword [r14], rdi
mov rax, rsi
jmp 0x180002e5c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800062c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x180040870]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x180006356
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.180019840
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180009900
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x18004c9c0]
mov r14d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
cmp qword [rbx + 0x1a8], 0
movss xmm3, dword [rbx + 0x250]
movss xmm5, dword [rbx + 0x254]
jne 0x180009952
cmp qword [rdi + 0x4b30], 0
je 0x18000995a
movss xmm3, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
xor r15d, r15d
subss xmm3, dword [rbx + 0x100]
subss xmm5, dword [rbx + 0x104]
xorps xmm4, xmm4
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm4
cvtdq2ps xmm0, xmm0
jp 0x180009994
lea eax, [r15 + 1]
je 0x180009997
mov eax, r15d
ucomiss xmm0, xmm4
jp 0x1800099a4
jne 0x1800099a4
mov r15d, 2
movss xmm2, dword [0x180045318]
or r15d, eax
comiss xmm4, xmm1
jb 0x1800099c0
addss xmm1, xmm3
comiss xmm1, xmm2
jae 0x1800099c0
movaps xmm1, xmm2
comiss xmm4, xmm0
jb 0x1800099d1
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x1800099d1
movaps xmm0, xmm2
or dword [rdi + 0x47b0], 2
xor edx, edx
movss dword [rdi + 0x47d0], xmm1
movss dword [rdi + 0x47d4], xmm0
mov dword [rdi + 0x47b8], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x180009a1a
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
call fcn.180002a40
jmp 0x180009a30
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x60]
call fcn.180002a40
mov rcx, qword [rsp + 0x60]
xor edx, edx
movss xmm6, dword [rdi + 0x37f8]
mov r8d, 0x1000107
call fcn.18000c5d0
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r14d
mov byte [rsi + 0xd2], r15b
jne 0x180009a81
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r14d
lea rdx, [0x18003f8e1]
not r9d
lea r10, [0x180040870]
mov ebx, r9d
mov r8b, 0x23
nop dword [rax + rax]
cmp r8b, 0x23
jne 0x180009ab3
cmp byte [rdx], r8b
jne 0x180009ab3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x180009aa0
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x180009ae3
xor edx, edx
xor ecx, ecx
call fcn.180006360
cmp dword [rdi + 0x48c8], r14d
jne 0x180009b29
cmp word [rsi + 0x15c], 0
jne 0x180009aff
cmp byte [rsi + 0x162], 0
je 0x180009b29
xor edx, edx
mov rcx, rsi
call fcn.18000eaa0
xor edx, edx
mov rcx, rsi
call fcn.1800148d0
mov rdx, rsi
mov ecx, ebx
call fcn.180006360
mov eax, dword [rdi + 0x48ec]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x68]
movzx eax, bpl
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180012c70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18004c010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x18004c9c0]
mov edi, ecx
cmp byte [rbx + 0x4a79], 0
jne 0x180012cd1
cmp byte [rbx + 0x4a7a], 0
jne 0x180012cd1
movsx r9d, word [rbx + 0x5bb2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1800029c0
test dil, 2
je 0x180012dff
jmp 0x180012d5a
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x180045344]
mulss xmm1, dword [0x180045334]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47c8], rax
mov dword [rbx + 0x47b4], 1
movss dword [rbx + 0x47c0], xmm0
movss dword [rbx + 0x47c4], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x180045278]
or dword [rbx + 0x47b0], 0x41
movss dword [rbx + 0x4810], xmm0
call fcn.1800029c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180012db0
lea r11, [0x180040870]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180012d93
cmp byte [r8], r9b
jne 0x180012d93
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180012d80
not ecx
call fcn.180009e60
test rax, rax
je 0x180012dff
cmp byte [rax + 0xb6], 0
je 0x180012dff
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.1800029c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18000c5d0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18003cdf0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180018180
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180018227
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800181da
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001a460
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180003260
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x18004c9b8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001822f
mov rcx, rbx
call fcn.180003260
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800186b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18004c9c0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180018713
mov qword [rsp], rbx
lea rbx, [0x180040870]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800186f3
cmp byte [r8], r9b
jne 0x1800186f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800186e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c10]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180018747
mov r10, qword [r10 + 0x5c18]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18001874e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x180018734
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret