joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov qword [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
jne 0x10001599
xor eax, eax
jmp 0x10001767
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov rax, qword [rsp + 0x80]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
add rax, 0x88
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x88]
and eax, 0xffff0000
test eax, eax
jne 0x100016bc
mov eax, dword [rsp + 0x88]
and eax, 0xffff
mov rcx, qword [rsp + 0x28]
sub eax, dword [rcx + 0x10]
mov eax, eax
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x10001762
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
sub ecx, 1
mov dword [rsp + 0x58], ecx
test eax, eax
je 0x10001762
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x60]
call fcn.10036f80
test eax, eax
jne 0x10001741
mov rax, qword [rsp + 0x40]
movzx eax, word [rax]
mov rcx, qword [rsp + 0x48]
lea rax, [rcx + rax*4]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
jmp 0x10001762
mov rax, qword [rsp + 0x38]
add rax, 4
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x40]
add rax, 2
mov qword [rsp + 0x40], rax
jmp 0x100016c8
mov rax, qword [rsp + 0x20]
add rsp, 0x78
ret
Function at 0x1000cf30
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x228
mov rax, qword [0x1007bcb0]
xor rax, rsp
mov qword [rsp + 0x218], rax
mov rax, qword [rsp + 0x230]
mov dword [rax + 0xc], 0xffffffff
mov rax, qword [rsp + 0x230]
mov dword [rax + 8], 0xffffffff
lea rdx, [rsp + 0x30]
mov cx, 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x1000cf8a
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
jmp 0x1000d1aa
mov rax, qword [rsp + 0x230]
mov rax, qword [rax]
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x1e0]
call sub.WSOCK32.dll_gethostbyname
mov qword [rsp + 0x1d0], rax
cmp qword [rsp + 0x1d0], 0
jne 0x1000cfc9
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
jmp 0x1000d1aa
mov rax, qword [rsp + 0x230]
add rax, 0x38
mov r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rax
call fcn.1001ddfc
mov rax, qword [rsp + 0x230]
add rax, 0x10
mov r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rax
call fcn.1001ddfc
mov dword [rsp + 0x1d8], 0
jmp 0x1000d021
mov eax, dword [rsp + 0x1d8]
add eax, 1
mov dword [rsp + 0x1d8], eax
movsxd rax, dword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 0x18]
cmp qword [rcx + rax*8], 0
je 0x1000d0ca
movsxd rax, dword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax]
call sub.WSOCK32.dll_inet_ntoa
mov qword [rsp + 0x1f8], rax
mov rax, qword [rsp + 0x230]
add rax, 0x38
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1e8], rax
mov r8, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1f0]
call fcn.1001dfc4
mov rax, qword [rsp + 0x230]
mov eax, dword [rax + 0xc]
add eax, 1
mov rcx, qword [rsp + 0x230]
mov dword [rcx + 0xc], eax
jmp 0x1000d010
mov rax, qword [rsp + 0x1d0]
mov rax, qword [rax + 8]
cmp qword [rax], 0
je 0x1000d1a0
mov dword [rsp + 0x1dc], 0
jmp 0x1000d0fe
mov eax, dword [rsp + 0x1dc]
add eax, 1
mov dword [rsp + 0x1dc], eax
movsxd rax, dword [rsp + 0x1dc]
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 8]
cmp qword [rcx + rax*8], 0
je 0x1000d1a0
movsxd rax, dword [rsp + 0x1dc]
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 8]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x210], rax
mov rax, qword [rsp + 0x230]
add rax, 0x10
mov qword [rsp + 0x208], rax
mov rax, qword [rsp + 0x208]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x200], rax
mov r8, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x208]
call fcn.1001dfc4
mov rax, qword [rsp + 0x230]
mov eax, dword [rax + 8]
add eax, 1
mov rcx, qword [rsp + 0x230]
mov dword [rcx + 8], eax
jmp 0x1000d0ed
call sub.WSOCK32.dll_WSACleanup
mov eax, 1
mov rcx, qword [rsp + 0x218]
xor rcx, rsp
call fcn.10037240
add rsp, 0x228
ret
Function at 0x100116c4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
test rdx, 0xffffffffffff0000
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rcx + 0xb0], rdx
jne 0x100116f8
cmp dword [rcx + 0xa8], 0
jne 0x100116f8
movzx eax, dx
mov dword [rcx + 0xa8], eax
call fcn.1001c0f4
mov r8d, 5
mov rdx, rdi
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r9, rbx
mov r8, rbp
mov rdx, rax
mov rcx, rsi
mov rdi, rax
call fcn.10011674
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1001a748
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor edi, edi
xor ebx, ebx
test rdx, rdx
mov rsi, rdx
mov rbp, rcx
je 0x1001a7a2
call fcn.1001c0f4
mov r8d, pe_nt_image_headers64
mov rdx, rsi
mov r12, qword [rax + 0x18]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindResourceA]
test rax, rax
je 0x1001a7a2
mov rdx, rax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
mov rbx, rax
je 0x1001a7c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
mov rdx, rdi
mov rcx, rbp
call fcn.1001a1c8
test rdi, rdi
mov esi, eax
je 0x1001a7c2
test rbx, rbx
je 0x1001a7c2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1001b010
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
movsxd rsi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0xa0], 0
jne 0x1001b046
mov r8d, esi
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001b0fd
call fcn.1001c37c
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1001b065
mov ecx, 0x80004005
call fcn.1000c4b0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov rcx, qword [rbx + 0xa0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x118]
mov rdx, rsi
mov rsi, 0xffffffffffffffff
mov r9, rsi
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.100398d0
test eax, eax
je 0x1001b0d0
cmp eax, 0xc
je 0x1001b0ca
cmp eax, 0x16
je 0x1001b0c4
cmp eax, 0x22
je 0x1001b0c4
cmp eax, 0x50
je 0x1001b0d0
call fcn.1001e748
int3
call fcn.1001e748
int3
call fcn.1001e700
int3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x1001b0fb
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.oledlg.dll_OleUIBusyA + 8]
mov eax, ebx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1003d8b7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1007bcb0]
jne 0x1003725a
rol rcx, 0x10
test cx, 0xffff
jne 0x10037256
repz ret
ror rcx, 0x10
jmp 0x1003d810
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10081630]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10081728]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1003d895
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10081630]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1003d8b7
mov rax, qword [rsp + 0x88]
mov qword [0x10081728], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100816c8], rax
mov rax, qword [0x10081728]
mov qword [0x100815a0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100816b0], rax
mov dword [0x10081590], 0xc0000409
mov dword [0x10081594], 1
mov rax, qword [0x1007bcb0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1007bcb8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10081628], eax
mov ecx, 1
call fcn.10048ab0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x10063238]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10081628], 0
jne 0x1003d93e
mov ecx, 1
call fcn.10048ab0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x10048ac0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.1003b610
xor ebx, ebx
cmp qword [0x10082360], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x10048bf1
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x10048b23
xor eax, eax
jmp 0x10048cd1
lea rdx, [0x10064480]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x10048b1c
mov rcx, rax
call fcn.1003b5a0
lea rdx, [0x10064470]
mov rcx, rbp
mov qword [0x10082360], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1003b5a0
lea rdx, [0x10064458]
mov rcx, rbp
mov qword [0x10082368], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1003b5a0
lea rcx, [rsp + 0x30]
mov qword [0x10082370], rax
call fcn.10038450
test eax, eax
je 0x10048ba7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1003da70
cmp dword [rsp + 0x30], 2
jne 0x10048bf1
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1003b5a0
test rax, rax
mov qword [0x10082380], rax
je 0x10048bf1
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.1003b5a0
mov qword [0x10082378], rax
mov rcx, qword [0x10082378]
cmp rcx, rsi
je 0x10048c83
cmp qword [0x10082380], rsi
je 0x10048c83
call fcn.1003b670
call rax
test rax, rax
mov rbp, rax
je 0x10048c4e
mov rcx, qword [0x10082380]
call fcn.1003b670
lea rcx, [rsp + 0x38]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x10048c4e
test byte [rsp + 0x48], 1
jne 0x10048c83
lea rcx, [rsp + 0x34]
call fcn.100384a0
test eax, eax
je 0x10048c70
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.1003da70
cmp dword [rsp + 0x34], 4
jb 0x10048c7d
bts edi, 0x15
jmp 0x10048cb7
bts edi, 0x12
jmp 0x10048cb7
mov rcx, qword [0x10082368]
cmp rcx, rsi
je 0x10048cb7
call fcn.1003b670
call rax
test rax, rax
mov rbx, rax
je 0x10048cb7
mov rcx, qword [0x10082370]
cmp rcx, rsi
je 0x10048cb7
call fcn.1003b670
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x10082360]
call fcn.1003b670
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x14002c920
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.14002d8d0
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x140032d50
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140032d72
mov rcx, qword [rsp + 0x40]
call fcn.140032e20
jmp 0x140032d89
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140032d89
mov rcx, qword [rsp + 0x40]
call fcn.140032ed0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140032e20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140032e41
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140032ec5
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140032e90
mov dword [rsp + 4], 0x9908b0df
jmp 0x140032e98
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140032e34
add rsp, 0x18
ret
Function at 0x140032ed0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140032f00
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140032f82
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140032f4e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140032f56
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140032ef5
mov qword [rsp + 8], 0xe3
jmp 0x140032f9a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140033021
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140032feb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140032ff3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140032f8d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140033075
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14003307d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140049d40
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14012c350]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140049dce
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140049d72
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140049de0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14012c350]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140049ee4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140049edf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140049eb4
cmp qword [rsp + 0x38], 2
jb 0x140049eb4
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140049eb4
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140049eb4
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140049e27
jmp 0x140049f76
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140049f76
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140049f4c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140049f4c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140049f4c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140049ee4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400a6e50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x3c20]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.14000aa20
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x30], rax
jae 0x1400a6f9f
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400a6f61
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.140072c20
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x1400a6f5c
jmp 0x1400a6f9f
jmp 0x1400a6ed2
cmp dword [rsp + 0x28], 0xd
jne 0x1400a6f6d
jmp 0x1400a6ed2
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.14009d6f0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x1400a6ed2
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x1400a6fbe
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x98], 0
je 0x1400a6ffa
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.14000aa20
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x14013a3b0]
ja 0x1400a7017
mov rax, qword [rsp + 0x70]
xorps xmm0, xmm0
ucomiss xmm0, dword [rax + 4]
jne 0x1400a7031
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x90], 0
je 0x1400a704c
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret