joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016fa00
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14014afdc
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14016fa8a
cmp byte [rbp - 0x21], r15b
je 0x14016fa85
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14016fac0
call fcn.140161af0
test eax, eax
jne 0x14016faac
cmp byte [rbp - 0x21], r15b
je 0x14016faa4
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14016fac0
cmp byte [rbp - 0x21], r15b
je 0x14016fabd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140153d70
test eax, eax
jne 0x14016fb60
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14014afdc
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14016faff
cmp byte [rbp - 0x21], r15b
je 0x14016fb34
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14016fb34
call fcn.140161af0
test eax, eax
jne 0x14016fb20
cmp byte [rbp - 0x21], r15b
je 0x14016fb19
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14016fb34
cmp byte [rbp - 0x21], r15b
je 0x14016fb31
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140153d70
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14016fb60
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14016fb63
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14016fb71
mov rcx, rdi
call fcn.14015f340
cmp byte [rbp + 0x3f], r15b
je 0x14016fb80
mov rcx, qword [rbp + 0x27]
call fcn.14015f340
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140173a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r9, rcx
mov r10, rdx
mov rdx, qword [r8 + 0x1b8]
mov ecx, 0x3020100
mov dword [r8 + 0x1c4], ecx
mov r11, r8
mov eax, 1
add ecx, 0x4040404
mov dword [r8 + rax*4 + 0x1c4], ecx
inc rax
cmp rax, rdx
jbe 0x140173a31
xor r8d, r8d
test r10, r10
je 0x140173a93
nop
movzx eax, byte [r9]
or r8, rax
movzx ecx, byte [rax + r11 + 0x1c4]
mov byte [r9], cl
mov byte [r11 + 0x1c3], cl
nop word [rax + rax]
movzx ecx, byte [rax + r11 + 0x1c3]
mov rdx, rax
sub rax, 1
mov byte [rdx + r11 + 0x1c4], cl
jns 0x140173a70
inc r9
sub r10, 1
jne 0x140173a50
shr r8, 2
mov qword [r11 + 0x1b8], r8
ret

Function at 0x14017b830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14017b858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14017b858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x18001247e
Capabilities:
Parse pe header

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov rbp, rsp
mov r14, rdx
mov rdi, rcx
mov eax, dword [0x180014084]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x180014080], 0xa
setl cl
or cl, al
movzx edx, word [rdi]
xor r8d, r8d
mov eax, 0x10
call fcn.180012dd0
sub rsp, rax
mov rbx, rsp
mov dword [rbx], 0
cmp edx, 0x5a4d
jne 0x1800124e4
movsxd rax, dword [rdi + 0x3c]
lea rsi, [rdi + rax]
cmp dword [rdi + rax], 0x4550
cmovne rsi, r8
jmp 0x1800124e6
xor esi, esi
test cl, cl
je 0x1800124b1
test rsi, rsi
je 0x1800125b7
sub rsp, 0x30
mov byte [rsp + 0x20], 0
mov rcx, rdi
mov dl, 1
mov r8d, 5
mov r9, rbx
call fcn.1800128ea
add rsp, 0x30
mov ecx, dword [0x180014084]
mov r9d, dword [0x180014080]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp r9d, 0xa
setl r8b
or r8b, dl
test rax, rax
je 0x1800125bb
cmp dword [rbx], 0
je 0x1800125bb
test r8b, r8b
je 0x1800125b5
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete dl
cmp r9d, 0xa
setl cl
or cl, dl
test cl, cl
je 0x18001255b
mov ecx, dword [rbx]
mov sil, 1
test ecx, ecx
je 0x1800125cb
mov edx, dword [rax + 4]
sub ecx, edx
mov dword [rbx], ecx
add edx, 0xfffffff8
shr edx, 1
mov ecx, dword [rax]
add rax, 8
add rcx, rdi
sub rsp, 0x20
mov r8, rax
mov r9, r14
call fcn.180012aac
add rsp, 0x20
mov ecx, dword [0x180014084]
mov r9d, dword [0x180014080]
test rax, rax
jne 0x180012546
cmp r9d, 0xa
jl 0x1800125cb
lea eax, [rcx - 1]
imul eax, ecx
and eax, 1
je 0x1800125cb
jmp 0x1800125b3
jmp 0x1800125b5
xor esi, esi
jmp 0x1800125cb
test r8b, r8b
je 0x1800125d7
mov sil, byte [rsi + 0x16]
not sil
and sil, 1
mov eax, esi
mov rsp, rbp
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
jmp 0x1800125d7
Function at 0x1800128ea
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov r14b, byte [rsp + 0x58]
mov ebp, dword [0x1800140a8]
mov r10d, dword [0x1800140ac]
lea r15d, [rbp - 1]
imul r15d, ebp
and r15d, 1
sete al
cmp r10d, 0xa
setl bl
or bl, al
movzx edi, word [rcx]
xor ebp, ebp
cmp edi, 0x5a4d
jne 0x18001293e
movsxd rax, dword [rcx + 0x3c]
lea rsi, [rcx + rax]
cmp dword [rcx + rax], 0x4550
cmovne rsi, rbp
jmp 0x180012940
xor esi, esi
test bl, bl
je 0x180012921
test rsi, rsi
je 0x180012a42
movzx ebp, word [rsi + 4]
cmp ebp, 0x8664
je 0x180012996
movzx eax, bp
cmp eax, 0x14c
jne 0x180012a42
mov edi, r8d
mov r11d, dword [rsi + rdi*8 + 0x78]
test r11, r11
je 0x180012a42
cmp dword [rsi + 0x74], r8d
jbe 0x1800129f4
test r9, r9
je 0x18001298a
mov eax, dword [rsi + rdi*8 + 0x7c]
mov dword [r9], eax
test dl, dl
je 0x1800129f8
add rcx, r11
jmp 0x180012a58
mov edi, r8d
mov r11d, dword [rsi + rdi*8 + 0x88]
test r11, r11
je 0x180012a42
cmp dword [rsi + 0x84], r8d
jbe 0x1800129f4
test r9, r9
je 0x1800129c2
mov eax, dword [rsi + rdi*8 + 0x8c]
mov dword [r9], eax
test dl, dl
je 0x1800129f8
mov eax, dword [0x1800140a8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete dl
cmp dword [0x1800140ac], 0xa
setl al
or al, dl
test al, al
je 0x1800129e4
add rcx, r11
test r14b, r14b
cmovne rcx, r11
jmp 0x180012a58
xor ecx, ecx
jmp 0x180012a58
movzx eax, word [rsi + 0x14]
lea r8, [rsi + rax]
add r8, 0x18
movzx ebx, word [rsi + 6]
mov eax, dword [0x1800140a8]
mov r10d, dword [0x1800140ac]
lea r15d, [rax - 1]
imul r15d, eax
and r15d, 1
sete al
cmp r10d, 0xa
setl dl
or dl, al
test dl, dl
je 0x180012a2d
sub ebx, 1
jb 0x180012a42
cmp dword [r8 + 0xc], r11d
je 0x180012a51
add r8, 0x28
jmp 0x180012a2d
xor ecx, ecx
cmp r10d, 0xa
jl 0x180012a58
test r15d, r15d
je 0x180012a58
jmp 0x180012a4f
mov eax, dword [r8 + 0x14]
add rcx, rax
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1800013a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
movzx ecx, byte [rcx]
test cl, cl
je 0x18000144c
movsx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x1800013b3
not eax
ret

Function at 0x1800015c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov rbx, r8
mov r14, rdx
mov r13, rcx
test r8b, 0xf
jne 0x1800016ec
mov r15, rbx
shr r15, 4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsi], rax
mov rdi, rax
test rax, rax
je 0x1800016ec
lea rsi, [r13 + 0xf0]
test r15, r15
je 0x1800016d8
mov qword [rsp + 0x60], rbp
mov rbx, rsi
mov qword [rsp + 0x68], r12
lea rbp, [rax + 0xf]
lea r12, [rsi + 0xf]
sub rbx, rax
nop dword [rax]
mov r8d, 0x10
lea rcx, [rsp + 0x20]
mov rdx, r14
call fcn.180001520
mov r9, r14
mov r8, rdi
mov edx, 0xe
mov rcx, r13
call fcn.180001740
cmp rdi, r12
ja 0x180001692
cmp rbp, rsi
jb 0x180001692
mov rax, rdi
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x180001680
jmp 0x1800016a1
movdqu xmm1, xmmword [rdi]
movdqu xmm0, xmmword [rsi]
xorps xmm1, xmm0
movdqu xmmword [rdi], xmm1
mov r8d, 0x10
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180001520
add rdi, 0x10
add rbp, 0x10
sub rbx, 0x10
add r14, 0x10
sub r15, 1
jne 0x180001640
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x70]
xor al, al
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x180002b20
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
xor edi, edi
cmp qword [0x180005088], rdi
mov qword [rsp + 0x250], rdi
je 0x180002d32
cmp dword [0x180005090], edi
je 0x180002d32
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea edx, [rdi + 8]
mov r8d, 0xff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180002b78
mov dword [rax], 0x29
mov rbx, rax
cmp dword [rbx], 0x15e
jle 0x180002bed
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowVisible]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.180001590
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r9 + 0xe]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov ecx, 0x6ae69f02
call fcn.180001000
mov rcx, rax
mov edx, 0x91765761
call fcn.180001130
mov ecx, 0x6ae69f02
mov rbx, rax
call fcn.180001000
mov rcx, rax
mov edx, 0x8670f6ca
call fcn.180001130
mov rdi, rax
test rbx, rbx
je 0x180002d32
test rax, rax
je 0x180002d32
lea rcx, [0x180005020]
call fcn.180001480
test eax, eax
je 0x180002d32
movss xmm0, dword [0x180005004]
mulss xmm0, dword [0x180004100]
mov rdx, qword [0x180005078]
mov ecx, dword [0x180005070]
cvttss2si rax, xmm0
imul eax, eax, 0x2710
neg rax
mov qword [rsp + 0x258], rax
call fcn.180003a90
lea rdx, [rsp + 0x258]
xor ecx, ecx
call fcn.180003ab2
lea rdx, [0x1800039e0]
mov ecx, 1
call rbx
mov rbx, rax
test rax, rax
je 0x180002d32
call fcn.180003600
mov rcx, rbx
call rdi
test eax, eax
je 0x180002d32
mov edx, dword [0x180005090]
lea r8, [rsp + 0x250]
mov rcx, qword [0x180005088]
call fcn.180003280
test eax, eax
je 0x180002d32
mov rcx, qword [rsp + 0x250]
call fcn.180003160
xor eax, eax
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret
mov rbx, qword [rsp + 0x260]
mov eax, 0xffffffff
add rsp, 0x240
pop rdi
ret
Function at 0x140010f20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401b3fd8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor ebx, ebx
mov edi, ebx
mov dword [rbp + 0x1f], ebx
cmp byte [0x1401b6b58], bl
je 0x140011014
lea edx, [rbx + 6]
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x140011014
lea rcx, [rbp + 0x27]
call fcn.14004fdf0
nop
mov r8, qword [rbp + 0x37]
test r8, r8
je 0x140010fcd
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rdx, qword [rbp + 0x27]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
lea rcx, [rbp - 1]
call fcn.1400032e0
lea edi, [rbx + 6]
lea rdx, [rbp - 1]
lea rcx, [section..data]
call fcn.1400095b0
lea rcx, [rbp - 1]
call fcn.14000c920
mov byte [0x1401b6b58], bl
mov byte [0x1401b6b59], 1
call qword [sym.imp.ole32.dll_CoUninitialize]
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x140011014
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001100f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011164
call fcn.1400b7d68
cmp byte [0x1401b6b59], 0
je 0x14001104b
lea rdx, [section..data]
lea rcx, [rbp - 1]
call fcn.140006dd0
lea rcx, [rbp - 1]
call fcn.1400501e0
test al, al
je 0x14001106c
call fcn.140014190
call fcn.140012d10
mov byte [0x1401b6b59], 0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400b80d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
movdqa xmm0, xmmword [0x1400f6f80]
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 0x37], 0x2a76323f
mov dword [rbp + 0x3b], 0x22330476
mov dword [rbp + 0x3f], 0x77762f24
mov byte [rbp + 0x43], 0x56
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], reloc.WS2_32.dll_ntohs
mov byte [rbp - 1], 0
or edi, 1
mov dword [rbp + 0x1f], edi
mov byte [rsp + 0x20], 0
mov r9d, 0x1d
movzx r8d, byte [rbp - 9]
mov edx, r9d
lea rcx, [rbp - 1]
call fcn.140004610
cmp rbx, 0x1d
jae 0x14001115a
movzx ecx, byte [rbp + rbx + 0x27]
xor cl, 0x56
cmp qword [rbp + 0xf], rbx
jbe 0x140011154
lea rax, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rax, qword [rbp - 1]
mov byte [rax + rbx], cl
inc rbx
cmp rbx, 0x1d
jl 0x1400110cf
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call fcn.1400500e0
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140011148
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140011143
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001116a
call fcn.1400b7d68
mov byte [0x1401b6b58], 1
jmp 0x140011044
call fcn.14000cb10
int3
lea rcx, [rbp + 0x27]
call fcn.14000cb30
nop
call fcn.1400beaf4
int3
call fcn.1400beaf4
int3
Function at 0x140014c50
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140014c72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140014cec
mov rdi, r14
mov rcx, rbx
call fcn.14000b630
test rax, rax
jle 0x140014cc4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400b9e40
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140014cdc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140014ce4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140014c86
sub r14, rdi
jmp 0x140014dcf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140014d03
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140014d05
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140014d37
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400b9e40
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140014dcc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140014d72
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140014dad
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400bfd30
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140014dcc
cmp rbp, rax
ja 0x140014d80
test rbp, rbp
je 0x140014dcc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400bfd30
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14001ae40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401b3fd8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401b6bb8]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a75], 0
jne 0x14001aea8
cmp byte [rbx + 0x4a76], 0
jne 0x14001aea8
movsx r9d, word [rbx + 0x5b9a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140021850
test sil, 1
je 0x14001afe0
jmp 0x14001af41
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400fd608]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400fd600]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
or dword [rbx + 0x47a8], 1
mov qword [rbx + 0x47c0], rax
movss dword [rbx + 0x47b8], xmm0
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mov rax, qword [0x1401b6bb8]
mulss xmm0, dword [0x1400fd5b8]
or dword [rax + 0x47a8], 0x40
movss dword [rax + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b9a]
call fcn.140021850
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001af91
lea r11, [0x1400f73b0]
cmp r9b, 0x23
jne 0x14001af74
cmp byte [r8], r9b
jne 0x14001af74
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001af61
not ecx
call fcn.14001fc70
test rax, rax
je 0x14001afe0
cmp byte [rax + 0xb6], 0
je 0x14001afe0
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, reloc.WS2_32.dll_recv
inc word [rbx + 0x5b9a]
movsx r9d, word [rbx + 0x5b9a]
call fcn.140021850
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140018490
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400b80d0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14001fb50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1401b6bb8]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001fbb4
lea r10, [0x1400f73b0]
cmp r8b, 0x23
jne 0x14001fb97
cmp byte [rdx], r8b
jne 0x14001fb97
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001fb84
mov eax, dword [r14 + 0x5bf8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001fc14
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001fbda
cmp edi, eax
jl 0x14001fbf3
mov r8d, 0x709
lea rdx, str.D:ProjetsInstallerInstaller_masterInstallerimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1400c75bc
mov rax, qword [r14 + 0x5c00]
cmp dword [rax + rbp + 8], ebx
je 0x14001fc31
mov eax, dword [r14 + 0x5bf8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001fbd1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001fc3e
cmp edi, dword [r14 + 0x5bf8]
jl 0x14001fc57
mov r8d, 0x709
lea rdx, str.D:ProjetsInstallerInstaller_masterInstallerimguiimgui.h
lea rcx, str.i___0__i___Size
call fcn.1400c75bc
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5c00]
lea rax, [rax + rcx*8]
jmp 0x14001fc16

Function at 0x14001fcf0
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x14001fd40
lea r11, [0x1400f73b0]
cmp r9b, 0x23
jne 0x14001fd23
cmp byte [r8], r9b
jne 0x14001fd23
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001fd10
not ecx
jmp fcn.14001fc70

Function at 0x140020790
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rdi, edx
mov r15, rcx
mov esi, edi
mov ebp, edi
mov r14d, edi
shr esi, 0x18
shr ebp, 0x10
shr r14d, 8
cmp dword [rcx + 0xf0], 0
jg 0x1400207d9
mov r8d, 0x712
lea rdx, str.D:ProjetsInstallerInstaller_masterInstallerimguiimgui.h
lea rcx, str.Size___0
call fcn.1400c75bc
movsxd rcx, dword [r15 + 0xf0]
lea rdx, [0x1400f73b0]
mov rax, qword [r15 + 0xf8]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r14b
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, bpl
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, esi
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [r15]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140020850
xor r9d, r9d
mov r8, rdi
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.14001d450
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret