joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010060
Capabilities:
Create process on windows
Spoof parent pid

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x47]
sub rsp, 0xe0
mov rsi, qword [rbp + 0x7f]
xor r12d, r12d
mov rbx, r8
mov r15, rdx
mov r14d, r12d
test rsi, rsi
je 0x14001009e
mov qword [rsi], r12
xor eax, eax
lea rdi, [rbp - 0x71]
lea ecx, [rax + 0x18]
rep stosb byte [rdi], al
lea rdi, [rbp - 0x51]
lea ecx, [rax + 0x70]
rep stosb byte [rdi], al
test rbx, rbx
jne 0x1400100c0
mov r8, r12
jmp 0x1400100cc
add r8, 2
cmp word [r8], r12w
jne 0x1400100bc
sub r8, rbx
sar r8, 1
mov rcx, qword [0x14002fa70]
lea r8, [r8*2 + 2]
mov edx, 8
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140010242
mov rdx, rbx
mov rcx, rax
call fcn.140001af4
mov r8d, 0x30
mov dword [rbp - 0x51], 0x70
mov qword [rbp + 0x67], r8
lea ebx, [r8 - 0x28]
cmp r8, 0x400
ja 0x14001022c
mov rcx, qword [0x14002fa70]
mov edx, ebx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov qword [rbp + 0x17], rax
test rax, rax
je 0x140010218
xor r8d, r8d
lea r9, [rbp + 0x67]
mov rcx, rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
je 0x140010201
mov rcx, qword [rbp + 0x17]
lea r9, [rbp + 0x4f]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov r8d, 0x20000
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
je 0x1400101ef
lea rax, [rbp - 0x71]
mov dword [rbp - 0x15], 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rbp - 0x51]
mov word [rbp - 0x11], r12w
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], r12
mov rdx, rdi
mov qword [rsp + 0x30], r12
mov rcx, r15
mov dword [rsp + 0x28], 0xc080024
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400101ef
mov r14, qword [rbp - 0x71]
test rsi, rsi
je 0x1400101e5
mov rax, qword [rbp - 0x69]
mov qword [rsi], rax
jmp 0x1400101ef
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, qword [rbp + 0x17]
test r8, r8
je 0x140010205
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov r8, qword [rbp + 0x17]
mov rcx, qword [0x14002fa70]
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001022c
mov r8, qword [rbp + 0x67]
jmp 0x140010116
mov rcx, qword [0x14002fa70]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
lea r11, [rsp + 0xe0]
mov rax, r14
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400104a4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5a8]
sub rsp, 0x690
mov r15d, 0x104
mov r8, rcx
mov rsi, rcx
mov ebx, 1
mov r9d, r15d
lea rcx, [rbp + 0x380]
mov edx, r15d
mov edi, ebx
call fcn.140001b34
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14001050e
mov r8d, r15d
lea rdx, [0x140028ba8]
lea rcx, [rbp + 0x380]
call fcn.1400103a8
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x380]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400105a7
test ebx, ebx
je 0x1400105a7
mov r9, r15
lea rcx, [rsp + 0x20]
mov r8, rsi
mov rdx, r15
call fcn.140001b34
mov r8, r15
lea rdx, [rbp + 0x15c]
lea rcx, [rsp + 0x20]
call fcn.1400103a8
test byte [rbp + 0x130], 0x10
je 0x140010588
cmp word [rbp + 0x15c], 0x2e
je 0x140010593
lea rcx, [rsp + 0x20]
call fcn.1400104a4
lea rcx, [rsp + 0x20]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg ebx
sbb eax, eax
and edi, eax
jmp 0x140010593
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x130]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
jmp 0x14001052b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1400105cc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb ecx, ecx
and edi, ecx
lea r11, [rsp + 0x690]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400105ec
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
xor esi, esi
lea r8, [rbp - 0x10]
lea rdx, [0x14001c980]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x20], rsi
mov rbx, rcx
call qword [sym.imp.SHELL32.dll_SHAssocEnumHandlersForProtocolByApplication]
test eax, eax
js 0x1400107b8
mov rcx, qword [rbp - 0x10]
lea r9, [rbp + 0x28]
mov dword [rbp + 0x28], esi
lea r8, [rbp - 0x18]
mov qword [rbp - 0x18], rsi
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x1400107a5
cmp dword [rbp + 0x28], esi
je 0x1400107ae
mov rcx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
lea rdx, [0x14001c970]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x14001079b
mov rcx, qword [rbp - 0x20]
lea rdx, [rbp + 0x38]
mov qword [rbp + 0x38], rsi
mov rax, qword [rcx]
call qword [rax + 0x20]
test eax, eax
js 0x140010791
mov rdx, qword [rbp + 0x38]
test rdx, rdx
je 0x140010791
mov rax, rbx
test rbx, rbx
jne 0x1400106a4
mov rax, rsi
jmp 0x1400106b8
cmp word [rbx], si
je 0x1400106b2
add rax, 2
cmp word [rax], si
jne 0x1400106a9
sub rax, rbx
sar rax, 1
mov rcx, rdx
cmp word [rdx], si
je 0x1400106c9
add rcx, 2
cmp word [rcx], si
jne 0x1400106c0
sub rcx, rdx
mov edx, 8
sar rcx, 1
lea r8, [rcx + rax]
mov rcx, qword [0x14002fa70]
lea r8, [r8*2 + 8]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rdi, rax
test rax, rax
je 0x140010787
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x140010726
cmp rax, rcx
je 0x140010726
mov rdx, rax
jmp 0x14001071b
mov word [rdx], ax
lea rcx, [rcx + 2]
add rdx, 2
movzx eax, word [rcx]
test ax, ax
jne 0x140010710
mov word [rdx], si
lea rdx, [0x140028bb0]
mov rcx, rdi
call fcn.140001ab8
mov rdx, rbx
mov rcx, rdi
call fcn.140001ab8
lea rax, [rbp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
mov r8, rdi
mov dword [rbp + 0x30], esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApplicationAssociationToasts
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [0x14002fa70]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
cmp dword [rbp + 0x28], esi
jne 0x140010625
mov rcx, qword [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + InitCommonControls]
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140010f30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140010f58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140010f58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140011168
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400111d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400111d7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400111d7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400111d7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400111d7
cmp dword [rcx + 0x84], 0xe
jbe 0x1400111d7
cmp dword [rcx + 0xf8], 0
je 0x1400111d7
mov ecx, ebx
call fcn.140011288
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140011064
nop
cmp dword [rbp + 0x20], 0
je 0x140011225
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140011230
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x140011168
Function at 0x14002d030
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x14009d040]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor esi, esi
mov dword [rsp + 0x30], esi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], sil
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.ExaGameBooster_Update_Agent_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x14002d1ba
lea rdx, str.https:__
lea rdi, str.https:__cdn.exatek.de_exagamebooster_version.txt
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov ecx, 0x4800000
mov r8d, 0x4000000
cmp rax, rdi
cmovne ecx, r8d
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbp, rax
test rax, rax
je 0x14002d1b1
mov dword [rsp + 0x40], esi
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14002d195
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14002d195
mov esi, eax
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14002d163
lea rax, [rcx + rsi]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14002d149
mov rax, qword [rbx]
lea rdi, [rax + rcx]
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rsi], 0
jmp 0x14002d178
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
call fcn.14002e0b0
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14002d118
lea rdx, str.success__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14002c290
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.14002e400
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14002eef0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002ef3a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002ef3a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002ef3a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002ef3a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002ef3a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002ef3c
xor al, al
add rsp, 0x28
ret
Function at 0x140d23058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d231df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d23089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d2306f
add dl, dl
jne 0x140d23096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d230f6
xor eax, eax
add dl, dl
jne 0x140d230a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d231ad
add dl, dl
jne 0x140d230b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d230c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d230d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d230dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d230ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d2307e
mov eax, 1
add dl, dl
jne 0x140d23106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d23113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d230fb
sub eax, ebx
mov ebx, 1
jne 0x140d2314c
mov ecx, 1
add dl, dl
jne 0x140d2312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d2313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d23123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d2307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d23168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d23175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d2315d
cmp eax, 0x7d00
jae 0x140d2319b
cmp eax, 0x500
jb 0x140d23196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d2307e
cmp eax, 0x7f
ja 0x140d2319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d2307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d231d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d2307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001509c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14001511a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140015111
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140015111
mov rax, qword [rbp - 8]
jmp 0x14001512f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1400150e4
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001c0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c56
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c56
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c56
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c56
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c56
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c58
xor al, al
add rsp, 0x28
ret
Function at 0x180016df0
Capabilities:
Create thread
Get common file path

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1800b7040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
cmp edx, 1
jne 0x180016e9c
mov qword [0x1800e0300], rcx
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, str.dinput8.dll
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1800e0530], rax
cmp rax, 0x1f
jbe 0x180016e74
lea rdx, [0x18007f788]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800e0528], rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180015f90]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180076f10
add rsp, 0x150
pop rbx
ret
Function at 0x18001c5f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001c64d
lea rbx, [0x180080e60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001c634
cmp r10, 2
jb 0x18001c634
cmp byte [r9], r8b
jne 0x18001c634
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001c610
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001c68f
lea rbx, [0x180080e60]
cmp r8b, 0x23
jne 0x18001c673
cmp byte [r9], r8b
jne 0x18001c673
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001c660
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18001c7d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001c7ea
mov qword [r8], 0
lea rdx, [0x180080a00]
call fcn.18001c6a0
mov rbx, rax
test rax, rax
jne 0x18001c80a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x18001c8e1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001c8e1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001c8e1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18001c8e1
cmp rdi, 0xffffffffffffffff
je 0x18001c8e1
mov rax, qword [0x1800e0320]
test rax, rax
je 0x18001c87e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x18001c8e1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18001c8ce
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1800e0320]
test rax, rax
je 0x18001c8c3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001c8ea
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18001c8dc
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001c8ec
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180020420
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x180080e60]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1800e0320]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x1800204b6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.180032f60
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1800204c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf0]
lea r9, [0x180080e60]
movss xmm2, dword [rcx + 0x108]
movss xmm3, dword [rcx + 0x10c]
movsxd rcx, dword [rcx + 0xe8]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret