joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021ab10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbp
xor eax, eax
mov rbp, rsp
push r14
push r13
push r12
push rdi
push rsi
push rbx
mov rbx, rcx
mov ecx, 8
mov rdi, rbx
sub rsp, 0x30
rep stosd dword [rdi], eax
mov eax, 0x57
test rdx, rdx
je 0x14021ad04
mov rsi, r8
mov r8d, 0x7fffffff
mov r12, rdx
mov r13d, r9d
call sub.msvcrt.dll_mbstowcs
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0x7ffe
jbe 0x14021ab6b
mov eax, 0x7b
jmp 0x14021ad04
lea r8, [rdi + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r12
lea r14, [rsp + 0x30]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, rdi
jne 0x14021ab61
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14021abf6
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 2
jne 0x14021ad04
test r13w, r13w
je 0x14021ad04
mov edx, dword [rsi]
bt edx, 0x11
jb 0x14021ad04
bt edx, 0xe
jb 0x14021ac08
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14021ac08
call rdi
cmp eax, 0xb7
jne 0x14021ad04
jmp 0x14021ac08
mov edx, dword [rsi]
or dh, 0x40
test al, 0x10
lea ecx, [rdx - 0x4000]
cmovne edx, ecx
mov dword [rsi], edx
mov rcx, r12
call sub.msvcrt.dll_strlen
mov edi, dword [rsi]
mov qword [rbx + 0x18], rax
bt edi, 0xe
jae 0x14021ac4c
cmp rax, 8
jbe 0x14021ac4c
lea r13, [rax - 9]
mov r8d, 9
lea rcx, str._mdbx.dat
lea rdx, [r12 + r13]
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14021ac4c
sub edi, 0x4000
mov dword [rsi], edi
mov qword [rbx + 0x18], r13
mov esi, dword [rsi]
mov r13, qword [rbx + 0x18]
and esi, 0x4000
lea rdx, [r13 + r13]
cmp esi, 1
sbb rax, rax
and eax, 0xe
lea rcx, [rax + rdx + 6]
call sub.msvcrt.dll_malloc
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xe
test rcx, rcx
je 0x14021ad04
mov qword [rbx + 8], rcx
test esi, esi
je 0x14021acb9
lea rax, [rcx + r13 + 5]
lea r9, str._lck
mov r8, r12
mov qword [rbx + 0x10], rax
lea rdx, [0x1402b056c]
call fcn.14021aae0
mov rcx, qword [rbx + 0x10]
mov rdx, r12
call sub.msvcrt.dll_strcpy
jmp 0x14021ad02
lea rax, [rcx + r13 + 0xa]
mov r8d, r13d
lea r13, [0x1402b0571]
mov r9, r12
mov qword [rbx + 0x10], rax
lea rax, str._mdbx.lck
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021aae0
mov rcx, qword [rbx + 0x10]
mov r8d, dword [rbx + 0x18]
mov r9, r12
lea rax, str._mdbx.dat
mov rdx, r13
mov qword [rsp + 0x20], rax
call fcn.14021aae0
xor eax, eax
lea rsp, [rbp - 0x30]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop rbp
ret
Function at 0x14021ad20
Capabilities:
Set file attributes

Disassembly:
push rbp
mov rbp, rsp
push r15
mov r15, r8
mov r8d, 0x7fffffff
push r14
push r13
push r12
push rdi
mov rdi, rdx
mov rdx, r15
push rsi
mov rsi, r9
push rbx
mov ebx, ecx
xor ecx, ecx
sub rsp, 0x88
mov r12d, dword [rbp + 0x30]
mov qword [r9], 0xffffffffffffffff
call sub.msvcrt.dll_mbstowcs
mov r13, rax
dec rax
cmp rax, 0x7ffe
jbe 0x14021ad75
mov r12d, 0x7b
jmp 0x14021aece
lea r8, [r13 + 1]
lea rax, [r8 + r8]
add rax, 0xf
shr rax, 4
shl rax, 4
call fcn.140035990
sub rsp, rax
mov rdx, r15
lea r14, [rsp + 0x40]
mov rcx, r14
call sub.msvcrt.dll_mbstowcs
cmp rax, r13
jne 0x14021ad6a
mov edx, dword [rdi + 4]
cmp r12w, 1
sbb eax, eax
and edx, 0x400000
add eax, 4
cmp edx, 1
sbb r8d, r8d
dec ebx
and r8d, 3
cmp ebx, 4
ja case.default.0x14021add8
lea rcx, [0x1402b0578]
movsxd rdx, dword [rcx + rbx*4]
add rdx, rcx
jmp rdx
mov edx, 0xc0000080
mov ebx, 0x1002000
jmp 0x14021ae56
or r8d, 1
mov edx, 0x80000080
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021ae56
mov edx, 0x40000080
mov ebx, 0x81002000
mov eax, 3
jmp 0x14021ae56
mov eax, dword [rdi + 0x88]
xor ebx, ebx
cmp dword [rdi + 0x78], eax
mov edx, 0x40000080
setae bl
mov eax, 1
xor r8d, r8d
shl ebx, 0x1d
or ebx, 0x1002000
jmp 0x14021ae56
or r8d, 4
mov edx, 0x110180
mov ebx, 0x1002000
mov eax, 3
jmp 0x14021ae56
mov edx, 0xc0000080
mov ebx, 0x1002102
mov eax, 4
mov rcx, r14
mov dword [rsp + 0x28], ebx
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
jne 0x14021ae8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021aece
lea rdx, [rbp - 0x74]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14021aeb3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsi]
mov r12d, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0xffffffffffffffff
jmp 0x14021aece
mov edx, dword [rbp - 0x74]
xor r12d, r12d
xor ebx, edx
and ebx, 0x2902
je 0x14021aece
xor edx, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rsp, [rbp - 0x38]
mov eax, r12d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14021aef0
Capabilities:
Get disk information

Disassembly:
push r14
mov r14, rcx
push r13
push r12
push rsi
push rbx
mov ebx, edx
sub rsp, 0x1e0
cmp qword [0x1403e9468], 0
jne 0x14021af1e
bt edx, 0x16
mov r12d, 0x307
jae 0x14021b19e
mov rcx, r14
mov r12d, 0x10fe
call qword [sym.imp.KERNEL32.dll_GetFileType]
dec eax
jne 0x14021b19e
mov rax, qword [0x1403e94a0]
test rax, rax
je 0x14021af85
mov r9d, 0x74
lea r8, [rsp + 0x60]
mov edx, 0xd
mov rcx, r14
call rax
test eax, eax
je 0x14021af85
mov eax, dword [rsp + 0x70]
test al, 2
je 0x14021af6c
bt ebx, 0x11
jae 0x14021b19e
mov edx, ebx
and eax, 1
mov r12d, 0x1100
and edx, 0x400000
or edx, eax
je 0x14021b19e
mov rax, qword [0x1403e9480]
test rax, rax
je 0x14021b017
lea rdx, [rsp + 0x60]
mov rcx, r14
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
xor edx, edx
mov dword [rsp + 0x48], 0x180
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x90310
call rax
mov ecx, eax
test eax, eax
js 0x14021afee
bt ebx, 0x16
mov r12d, 0x1100
jb 0x14021b017
jmp 0x14021b19e
cmp eax, 0xc000046d
setne dl
cmp eax, 0xc0000010
setne al
test dl, al
je 0x14021b017
cmp ecx, 0xc00000bb
je 0x14021b017
call fcn.14021a640
mov r12d, eax
jmp 0x14021b19e
mov rsi, qword [0x1403e9498]
xor r12d, r12d
test rsi, rsi
je 0x14021b19e
cmp qword [0x1403e9490], 0
je 0x14021b19e
mov ecx, 0xfffe
mov r12d, 0xe
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x14021b19e
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov rdx, r13
mov rcx, r14
mov dword [rsp + 0x38], 0
mov r8d, 0x7fff
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x14021b0bf
mov esi, ebx
and esi, 0x20000
jne 0x14021b0a3
test dword [rsp + 0x60], 0x188000
jne 0x14021b0f5
mov r9d, 2
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403e9490]
test eax, eax
jne 0x14021b0cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r12d, eax
jmp 0x14021b196
mov r12, qword [sym.imp.msvcrt.dll__wcsnicmp]
mov r8d, 0xc
lea rdx, str.DeviceMup_
mov rcx, r13
call r12
test eax, eax
jne 0x14021b100
bt ebx, 0x16
jb 0x14021b17b
mov r12d, 0x1100
jmp 0x14021b196
xor r9d, r9d
mov r8d, 0x7fff
mov rdx, r13
mov rcx, r14
call qword [0x1403e9490]
test eax, eax
je 0x14021b17b
mov r14, qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, r13
call r14
cmp eax, 1
jne 0x14021b168
mov r8d, 4
lea rdx, [0x1402b05a6]
mov rcx, r13
call r12
test eax, eax
jne 0x14021b0eb
lea rcx, [r13 + 0xa]
mov r8d, 2
lea rdx, [0x1402b05b0]
call r12
test eax, eax
jne 0x14021b0eb
mov word [r13 + 0xe], 0
lea rcx, [r13 + 8]
call r14
cmp eax, 5
je 0x14021b18d
ja 0x14021b180
sub eax, 2
cmp eax, 1
ja 0x14021b0eb
xor r12d, r12d
jmp 0x14021b196
xor r12d, r12d
cmp eax, 6
je 0x14021b196
jmp 0x14021b0eb
test esi, esi
jne 0x14021b17b
jmp 0x14021b0eb
mov rcx, r13
call sub.msvcrt.dll_free
add rsp, 0x1e0
mov eax, r12d
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
Function at 0x14021c340
Capabilities:
Print debug messages

Disassembly:
push r13
mov r13, r9
push r12
mov r12, rdx
push rsi
push rbx
mov ebx, r8d
sub rsp, 0x38
mov rax, qword [0x1403e8a00]
mov rsi, qword [rsp + 0x80]
test rax, rax
je 0x14021c373
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
jmp rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021c440
mov qword [rsp + 0x20], 0
test r12, r12
je 0x14021c3c7
test ebx, ebx
jle 0x14021c3ac
lea rcx, [rsp + 0x20]
mov r9d, ebx
mov r8, r12
lea rdx, str._s:_d
call fcn.14021c310
jmp 0x14021c3df
test r12, r12
je 0x14021c3c7
lea rcx, [rsp + 0x20]
mov r8, r12
lea rdx, [0x1402b05ea]
call fcn.14021c310
jmp 0x14021c3df
test ebx, ebx
jle 0x14021c3fe
lea rcx, [rsp + 0x20]
mov r8d, ebx
lea rdx, str._d:
call fcn.14021c310
test eax, eax
jle 0x14021c3fe
mov r12, qword [rsp + 0x20]
test r12, r12
je 0x14021c3fe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, r12
call sub.msvcrt.dll_free
lea rcx, [rsp + 0x28]
mov r8, rsi
mov rdx, r13
mov qword [rsp + 0x28], 0
call fcn.14021a030
test eax, eax
jle 0x14021c440
mov r12, qword [rsp + 0x28]
test r12, r12
je 0x14021c440
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x38
mov rcx, r12
pop rbx
pop rsi
pop r12
pop r13
jmp sub.msvcrt.dll_free
add rsp, 0x38
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x14021d420
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x48
cmp qword [0x1403e8a00], 0
je 0x14021d443
mov qword [rsp + 0x20], rcx
lea r9, str.assert:__s_n
xor ecx, ecx
call fcn.14021c450
jmp 0x14021d4aa
mov qword [rsp + 0x38], 0
test rdx, rdx
jne 0x14021d458
lea rdx, [0x1402b0db6]
mov dword [rsp + 0x20], r8d
lea r10, [rsp + 0x38]
mov r9, rdx
mov r8, rcx
lea rdx, str._r_nMDBX_ASSERTION:__s___s:_u
mov rcx, r10
call fcn.14021c310
test eax, eax
jle 0x14021d483
cmp qword [rsp + 0x38], 0
jne 0x14021d48f
lea rax, str._troubles_with_assertion_message_preparation_
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14021d4aa
call qword [sym.imp.KERNEL32.dll_DebugBreak]
or ecx, 0xffffffff
add rsp, 0x48
jmp qword [sym.imp.KERNEL32.dll_FatalExit]

Function at 0x14021d4c0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsFree]
test eax, eax
jne 0x14021d4eb
mov r8d, 0x124e
lea rdx, str.thread_key_delete
lea rcx, str.TlsFree_key_
add rsp, 0x28
jmp fcn.14021d420
add rsp, 0x28
ret

Function at 0x14021d720
Capabilities:
Print debug messages

Disassembly:
mov r8d, 0x125f
lea rdx, str.thread_rthc_set
lea rcx, str.TlsSetValue_key___void__value_
jmp fcn.14021d420
Function at 0x18000a1d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000a22d
lea rbx, [0x1802c83f0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18000a214
cmp r10, 2
jb 0x18000a214
cmp byte [r9], r8b
jne 0x18000a214
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18000a1f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000a26f
lea rbx, [0x1802c83f0]
cmp r8b, 0x23
jne 0x18000a253
cmp byte [r9], r8b
jne 0x18000a253
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18000a240
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18000a3b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18000a3ca
mov qword [r8], 0
lea rdx, [0x1802c7698]
call fcn.18000a280
mov rbx, rax
test rax, rax
jne 0x18000a3ea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18000a4c1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000a4c1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18000a4c1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000a4c1
cmp rdi, 0xffffffffffffffff
je 0x18000a4c1
mov rax, qword [0x180316360]
test rax, rax
je 0x18000a45e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x18000a4c1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18000a4ae
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180316360]
test rax, rax
je 0x18000a4a3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000a4ca
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18000a4bc
mov qword [r14], rdi
mov rax, rsi
jmp 0x18000a4cc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000e720
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x128]
lea r11, [0x1802c83f0]
mov rax, qword [rcx + 0x130]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4080], ebx
jne 0x18000e7b6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.180030250
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x18000e7c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x130]
lea r9, [0x1802c83f0]
movss xmm2, dword [rcx + 0x148]
movss xmm3, dword [rcx + 0x14c]
movsxd rcx, dword [rcx + 0x128]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x180012ad0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x180316360]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r14d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x4038]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1200103
or r12d, eax
cmp qword [rbx + 0x1e0], 0
jne 0x180012b2f
cmp qword [rdi + 0x4d20], 0
mov eax, 0x288
je 0x180012b34
mov eax, 0x258
movss xmm4, dword [rax + rbx]
xorps xmm3, xmm3
movss xmm5, dword [rax + rbx + 4]
cvttss2si eax, dword [r8]
subss xmm4, dword [rbx + 0x138]
subss xmm5, dword [rbx + 0x13c]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
jp 0x180012b79
jne 0x180012b79
mov eax, 1
jmp 0x180012b7b
xor eax, eax
ucomiss xmm0, xmm3
jp 0x180012b8a
jne 0x180012b8a
mov r15d, 2
jmp 0x180012b8d
xor r15d, r15d
movss xmm2, dword [0x1803043d8]
or r15d, eax
comiss xmm3, xmm1
jb 0x180012ba9
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x180012ba9
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x180012bba
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x180012bba
movaps xmm0, xmm2
or dword [rdi + 0x4918], 2
xor edx, edx
movss dword [rdi + 0x493c], xmm1
movss dword [rdi + 0x4940], xmm0
mov dword [rdi + 0x4920], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x180012c03
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.18000a0b0
jmp 0x180012c19
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x70]
call fcn.18000a0b0
movss xmm6, dword [rdi + 0x3908]
test sil, sil
jne 0x180012c30
mov dword [rdi + 0x3908], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.180015f00
mov rsi, qword [rdi + 0x4038]
movzx ebp, al
movss dword [rdi + 0x3908], xmm6
cmp word [rsi + 0xf8], 1
mov dword [rsi + 0xb4], r14d
mov byte [rsi + 0x10a], r15b
jne 0x180012c76
movsd xmm0, qword [rsi + 0x50]
movsd qword [rbx + 0x138], xmm0
mov r9d, r14d
lea rdx, [0x1802c6af1]
not r9d
lea r10, [0x1802c83f0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x180012ca3
cmp byte [rdx], r8b
jne 0x180012ca3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x180012c90
not ebx
cmp dword [rdi + 0x4098], ebx
jne 0x180012cd3
xor edx, edx
xor ecx, ecx
call fcn.18000e980
cmp dword [rdi + 0x4ab8], r14d
jne 0x180012d20
bt r12d, 0x17
jb 0x180012d20
cmp word [rsi + 0x194], 0
jne 0x180012cf6
cmp byte [rsi + 0x19a], 0
je 0x180012d20
xor edx, edx
mov rcx, rsi
call fcn.180018fa0
xor edx, edx
mov rcx, rsi
call fcn.18001fa90
mov rdx, rsi
mov ecx, ebx
call fcn.18000e980
mov eax, dword [rdi + 0x4adc]
mov dword [rdi + 0x40c0], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18001d570
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180315280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x180316360]
mov edi, ecx
cmp byte [rbx + 0x4c69], 0
jne 0x18001d5d1
cmp byte [rbx + 0x4c6a], 0
jne 0x18001d5d1
movsx r9d, word [rbx + 0x5d9a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.18000a030
test dil, 2
je 0x18001d700
jmp 0x18001d661
movss xmm1, dword [rbx + 0x39a8]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5d9a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x180304418]
mulss xmm1, dword [0x180304400]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x4934], rax
mov dword [rbx + 0x491c], 1
movss dword [rbx + 0x492c], xmm0
mov byte [rbx + 0x4954], 1
movss dword [rbx + 0x4930], xmm1
movss xmm0, dword [rbx + 0x3a04]
mulss xmm0, dword [0x180304260]
or dword [rbx + 0x4918], 0x41
movss dword [rbx + 0x4978], xmm0
call fcn.18000a030
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18001d6b1
lea r11, [0x1802c83f0]
cmp r9b, 0x23
jne 0x18001d694
cmp byte [r8], r9b
jne 0x18001d694
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18001d681
not ecx
call fcn.180013050
test rax, rax
je 0x18001d700
cmp byte [rax + 0xeb], 0
je 0x18001d700
mov byte [rax + 0xf0], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0x110], 1
mov edx, 0x10
inc word [rbx + 0x5d9a]
movsx r9d, word [rbx + 0x5d9a]
call fcn.18000a030
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.180015f00
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800a9a10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800237c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ed8], 0
lea rbx, [rcx + 0x5ee0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180023867
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18002381a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180031740
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.18000ada0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ed8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5ee8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180316358]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18002386f
mov rcx, rbx
call fcn.18000ada0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180023bc0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180316360]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180023c23
mov qword [rsp], rbx
lea rbx, [0x1802c83f0]
nop dword [rax]
cmp r9b, 0x23
jne 0x180023c03
cmp byte [r8], r9b
jne 0x180023c03
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180023bf0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5e40]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180023c57
mov r10, qword [r10 + 0x5e48]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x180023c5e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x180023c44
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret