joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b560
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x69
mov dword [rbp - 0x20], 0x2c0018
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x2e004c
mov dword [rbp - 0x14], 0x220020
mov dword [rbp - 0x10], 0x36005a
call fcn.140005e60
mov rcx, rax
call 0x14000b560
mov ebx, 9
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], bx
mov dword [rbp - 0x20], 0x2c0018
mov dword [rbp - 0x1c], 0x2b0026
mov dword [rbp - 0x18], 0x2e004c
mov dword [rbp - 0x14], 0x510051
call fcn.140002590
mov rcx, rax
call 0x14000b560
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x1d003d
mov dword [rbp - 0x1c], 0x90010
mov dword [rbp - 0x18], 0x620065
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000b560
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000b5c2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000b7b0
test al, al
jne 0x14000b5d4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000b590
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ded0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x10000
mov dword [rbp - 0x1c], 0x90011
mov dword [rbp - 0x18], 0x510065
mov dword [rbp - 0x14], 0x4d0050
mov dword [rbp - 0x10], 0x1f006d
mov dword [rbp - 0xc], 0x6e0005
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], 0xc001a
mov dword [rbp - 0x18], 0x70067
mov dword [rbp - 0x14], 0x4d0016
mov dword [rbp - 0x10], 0x1f006d
mov dword [rbp - 0xc], 0x6e0005
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015400]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x3b7f
mov byte [rbp - 0xe], 0x61
call fcn.140005220
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x9110100
mov dword [rbp - 0x1c], 0x61a2765
mov dword [rbp - 0x18], 0xb1d066a
mov word [rbp - 0x14], 0x615e
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x71a
mov dword [rbp - 0x1c], 0x17070c7b
mov dword [rbp - 0x18], 0xc0346
mov word [rbp - 0x14], 0x6148
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400154d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 9
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015450]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x7204006d
call fcn.1400029f0
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400153e0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 9
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015390]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x330f0360
mov byte [rbp - 0xc], 0x72
call fcn.140003790
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015470]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x2d67
mov byte [rbp - 0xe], 0x61
call fcn.140005220
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000f710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000f93e
mov word [rbp + 0x50], 0x6953
mov word [rbp + 0x58], 0x6953
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f7c4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000f7b0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000f7f5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000f7e0
cmp rdi, rbx
jne 0x14000f912
mov r13, rsi
mov word [rbp - 0x50], 0x6953
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000f836
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000f822
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000f938
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x690032
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000f8a8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x690029
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000f8a8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x690032
mov dword [rbp - 0x42], 0x690012
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x690032
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000f905
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x690029
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000f905
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x690032
mov dword [rbp - 0x32], 0x690012
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000f912
inc r14
jmp 0x14000f810
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000f93e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000f780
mov rax, qword [rbp - 8]
jmp 0x14000f940
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140012cc0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x108
lea rbp, [rsp + 0x60]
mov rsi, qword [0x14010b028]
mov eax, dword [0x140113388]
mov r13d, dword gs:[0x48]
mov qword [rbp + 0x30], rsi
mov dword [rbp + 0x48], eax
mov dword [rbp + 0x54], r13d
mov r14, r9
mov r12d, r8d
mov r15d, edx
mov rbx, rcx
test edx, edx
jne 0x140012d39
lea r8d, [rdx + 7]
lea rdx, str.Blind
push rsi
call 0x140252535
test eax, eax
jne 0x140012d39
mov byte [0x140113748], 1
add rbx, 0xe
jmp 0x140012d45
mov byte [0x140113748], 0
test r15d, r15d
jne 0x140012d70
lea rdx, [0x1400ec320]
mov r8d, 6
mov rcx, rbx
push rax
call 0x14027bb80
test eax, eax
jne 0x140012d70
mov r15d, 2
add rbx, 0xc
mov dword [rbp + 0xf8], r15d
mov eax, dword [rsi + 0x7c]
mov dword [rbp + 0x4c], eax
mov eax, dword [rsi + 0x84]
mov dword [rbp + 0x50], eax
lea eax, [r12 - 1]
test eax, 0xfffffffd
jne 0x140012e5c
mov rcx, qword [0x14010f4a8]
test rcx, rcx
je 0x140012da1
push rdx
call 0x1401751ee
lea r8, str.Microsoft
xor edx, edx
xor ecx, ecx
call 0x1402722a2
int3
xor edi, edi
mov byte [rbp + 8], 0
test r14, r14
je 0x140012ebd
xor edx, edx
mov rcx, r14
push rbx
call 0x1402a3f3b
mov r13d, eax
mov dword [rbp + 0x24], eax
test eax, eax
je 0x140012fd8
cmp eax, dword [0x140111718]
je 0x140012fd8
mov rcx, r14
call fcn.1400b5750
test al, al
jne 0x140012fd8
mov ecx, dword [0x140111718]
lea r8d, [rdi + 1]
mov edx, r13d
push rcx
call 0x1401ade23
mov edi, r13d
test eax, eax
setne byte [rbp + 8]
jmp 0x140012fd8
test byte [0x14011333e], 0xc0
je 0x140012fbf
push rax
call 0x140177969
sub eax, dword [0x140113334]
cmp eax, 0x32
jae 0x140012fbf
cmp r12d, 2
je 0x140012fbf
cmp byte [0x140113748], dil
jne 0x140012fbf
cmp r15d, 2
je 0x140012fbf
cmp byte [0x1401135a3], dil
je 0x140012fbf
cmp r13d, dword [0x140111718]
jne 0x140012fbf
lea rdx, [0x1400ec820]
mov rcx, rbx
call fcn.14000c3d0
test r15d, r15d
je 0x140012f86
test rax, rax
setne al
test al, al
je 0x140012fbf
mov edi, 0x8000
mov ecx, 0x5b
push rsi
call 0x140251e20
test di, ax
jne 0x140012f61
mov ecx, 0x5c
push rcx
call 0x1401dfd0d
test di, ax
je 0x140012fbf
mov edx, 1
mov ecx, 0x8000012f
mov dword [0x14010b020], 0
call fcn.140001be0
mov dword [0x14010b020], 1
jmp 0x140012f41
test rax, rax
je 0x140012fbf
nop dword [rax + rax]
lea rcx, [rax + 2]
lea rdx, [0x1400ec828]
call fcn.14000c3d0
test rax, rax
je 0x140012f3c
cmp word [rax], 0x7b
je 0x140012f3c
lea rdx, [0x1400ec820]
mov rcx, rax
call fcn.14000c3d0
test rax, rax
jne 0x140012f90
call 0x1402ee5d8
int3
mov ecx, edi
call 0x140216416
int3
Function at 0x14001ab40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, r8d
mov r9, rdx
not ecx
lea rbx, [0x1400da4d0]
cmp r8d, 8
jb 0x14001ac37
mov r11d, r10d
shr r11, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
shr ecx, 8
xor rdx, rax
add r9, 8
add r10d, 0xfffffff8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 - 7]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 1]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
dec r11
jne 0x14001ab70
test r10d, r10d
je 0x14001ac5f
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
lea r9, [r9 + 1]
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
dec r10d
jne 0x14001ac40
mov rbx, qword [rsp + 8]
not ecx
mov eax, ecx
ret
Function at 0x14001ea50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
call fcn.14001e970
mov r8d, dword [rbx + 0x1af88]
lea eax, [r8 + 3]
cmp eax, dword [rbx + 0x1af8c]
jb 0x14001ea99
mov rdx, qword [rbx + 0x1af80]
mov rcx, qword [rbx]
call fcn.14001ffc0
mov dword [rbx + 0x1af88], 0
mov ecx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
mov byte [rcx + rax], dil
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, di
shr cx, 8
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, dil
not cl
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov edx, dword [rbx + 0x1af88]
mov rax, qword [rbx + 0x1af80]
movzx ecx, di
not cx
shr cx, 8
mov byte [rdx + rax], cl
inc dword [rbx + 0x1af88]
mov r8d, dword [rbx + 0x1af88]
mov rdx, qword [rbx + 0x1af80]
mov rcx, qword [rbx]
call fcn.14001ffc0
mov rcx, qword [rbx]
mov r8d, edi
mov rdx, rsi
mov dword [rbx + 0x1af88], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001ffc0

Function at 0x14001f310
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 0x8074b50
mov rcx, rbx
call fcn.14001fe20
mov edx, 0x807
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14001fe20
mov esi, 0xffffffff
mov rcx, rbx
cmp qword [rdi + 0x10], rsi
jb 0x14001f36f
mov edx, esi
call fcn.14001fe20
mov edx, esi
jmp 0x14001f37f
mov edx, dword [rdi + 0x10]
call fcn.14001fe20
mov rdx, qword [rdi + 0x10]
shr rdx, 0x10
mov rcx, rbx
call fcn.14001fe20
mov rcx, rbx
cmp qword [rdi + 0x18], rsi
jb 0x14001f39b
mov edx, esi
call fcn.14001fe20
mov edx, esi
jmp 0x14001f3ab
mov edx, dword [rdi + 0x18]
call fcn.14001fe20
mov rdx, qword [rdi + 0x18]
shr rdx, 0x10
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001fe20
Function at 0x14001f3d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov edx, dword [rcx + 4]
mov rdi, rcx
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14001fe20
mov esi, 0xffffffff
mov rcx, rbx
cmp qword [rdi + 0x10], rsi
jb 0x14001f42c
mov edx, esi
call fcn.14001fe20
mov edx, esi
jmp 0x14001f43c
mov edx, dword [rdi + 0x10]
call fcn.14001fe20
mov rdx, qword [rdi + 0x10]
shr rdx, 0x10
mov rcx, rbx
call fcn.14001fe20
mov rcx, rbx
cmp qword [rdi + 0x18], rsi
jb 0x14001f458
mov edx, esi
call fcn.14001fe20
mov edx, esi
jmp 0x14001f468
mov edx, dword [rdi + 0x18]
call fcn.14001fe20
mov rdx, qword [rdi + 0x18]
shr rdx, 0x10
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 0x20]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14001fe20
Function at 0x14001f490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test dword [rdx], 0x80000000
mov rdi, rcx
mov rbx, rdx
mov rcx, rdx
je 0x14001f503
mov edx, 0x8b1f
call fcn.14001fe20
mov edx, 0x808
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14001fe20
mov edx, 0xb02
mov rcx, rbx
call fcn.14001fe20
mov r8d, dword [rdi + 0x20]
lea rdx, [rdi + 0x50]
inc r8d
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001ffc0
mov edx, 0x4034b50
call fcn.14001fe20
mov edx, 0x403
mov rcx, rbx
call fcn.14001fe20
mov edx, 0x2d
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 0x30]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 2]
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 4]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 6]
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 8]
mov rcx, rbx
call fcn.14001fe20
movzx edx, word [rdi + 0xa]
mov rcx, rbx
call fcn.14001fe20
or edx, 0xffffffff
mov rcx, rbx
call fcn.14001fe20
or edx, 0xffffffff
mov rcx, rbx
call fcn.14001fe20
or edx, 0xffffffff
mov rcx, rbx
call fcn.14001fe20
or edx, 0xffffffff
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 0x20]
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 0x24]
mov rcx, rbx
add edx, 0x14
call fcn.14001fe20
mov r8d, dword [rdi + 0x20]
lea rdx, [rdi + 0x50]
mov rcx, rbx
call fcn.14001ffc0
mov edx, 1
mov rcx, rbx
call fcn.14001fe20
mov edx, 0x10
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 0x18]
mov rcx, rbx
call fcn.14001fe20
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
shr rdx, 0x10
call fcn.14001fe20
mov rdx, qword [rdi + 0x18]
mov rcx, rbx
shr rdx, 0x20
call fcn.14001fe20
movzx edx, word [rdi + 0x1e]
mov rcx, rbx
call fcn.14001fe20
mov edx, dword [rdi + 0x10]
mov rcx, rbx
call fcn.14001fe20
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
shr rdx, 0x10
call fcn.14001fe20
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
shr rdx, 0x20
call fcn.14001fe20
movzx edx, word [rdi + 0x16]
mov rcx, rbx
call fcn.14001fe20
mov r8d, dword [rdi + 0x24]
test r8d, r8d
je 0x14001f65f
mov rdx, qword [rdi + 0x40]
mov rcx, rbx
call fcn.14001ffc0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001fce0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x14001fcf6
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
not ecx
lea rbx, [0x1400da4d0]
cmp r10d, 8
jb 0x14001fde7
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
shr ecx, 8
xor rdx, rax
add r9, 8
add r10d, 0xfffffff8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 - 7]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 1]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
dec r11
jne 0x14001fd20
test r10d, r10d
je 0x14001fe0f
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
lea r9, [r9 + 1]
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
dec r10d
jne 0x14001fdf0
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x14001fe20
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x28], 0
movsxd r11, edx
mov rbx, rcx
jne 0x14001ffac
mov r10d, r11d
mov byte [rsp + 0x40], r11b
shr r10d, 8
test byte [rcx], 0x10
mov byte [rsp + 0x41], r10b
je 0x14001ff34
mov r8d, dword [rcx + 0x50]
mov edx, dword [rcx + 0x48]
movsx rax, r11b
mov ecx, edx
shr edx, 8
mov r9d, r8d
xor rcx, rax
and r9d, 0xfffd
mov qword [rsp + 0x48], rdi
movzx eax, cl
lea rdi, [0x1400da4d0]
or r9d, 2
mov ecx, dword [rdi + rax*4]
xor ecx, edx
mov dword [rbx + 0x48], ecx
movzx eax, cl
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x4c], ecx
movzx eax, byte [rbx + 0x4f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rdi + rcx*4]
xor eax, r8d
mov dword [rbx + 0x50], eax
mov edx, dword [rbx + 0x48]
mov r8d, dword [rbx + 0x50]
mov eax, r9d
mov ecx, edx
shr edx, 8
xor eax, 1
imul eax, r9d
mov r9d, r8d
and r9d, 0xfffd
shr eax, 8
or r9d, 2
xor al, r11b
mov byte [rsp + 0x40], al
movsx rax, r10b
xor rcx, rax
movzx eax, cl
mov ecx, dword [rdi + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [rbx + 0x48], ecx
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x4c], ecx
movzx eax, byte [rbx + 0x4f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rdi + rcx*4]
mov rdi, qword [rsp + 0x48]
xor eax, r8d
mov dword [rbx + 0x50], eax
mov eax, r9d
xor eax, 1
imul eax, r9d
shr eax, 8
xor r10b, al
mov byte [rsp + 0x41], r10b
test byte [rbx], 1
je 0x14001ff68
mov rdx, qword [rbx + 0x38]
lea rax, [rdx + 2]
cmp rax, qword [rbx + 0x40]
jb 0x14001ff54
mov dword [rbx + 0x28], SafeArrayDestroy
add rsp, 0x30
pop rbx
ret
mov rcx, qword [rbx + 8]
movzx eax, word [rsp + 0x40]
mov word [rdx + rcx], ax
add qword [rbx + 0x38], 2
jmp 0x14001ff9d
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x40]
mov r8d, 2
mov qword [rsp + 0x20], 0
push rbx
call 0x140208c43
test eax, eax
je 0x14001ff96
cmp dword [rsp + 0x50], 2
je 0x14001ff9d
mov dword [rbx + 0x28], 3
test dword [rbx], 0x40000000
je 0x14001ffac
mov dword [rbx + 0x28], 0x14
add rsp, 0x30
pop rbx
ret
Function at 0x14001ffc0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
je 0x140020173
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x28], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x140020164
test byte [rcx], 0x10
je 0x1400200f5
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x140020010
cmp dword [rbx + 0x60], edi
jae 0x140020010
call fcn.14021c3a8
int3
cmp qword [rbx + 0x58], 0
jne 0x14002003c
lea eax, [rdi + rdi]
xor ecx, ecx
mov edx, eax
mov dword [rbx + 0x60], eax
call fcn.1401fd458
int3
mov rcx, qword [rbx + 0x58]
mov r8, rdi
mov rdx, rsi
mov qword [rsp + 0x40], rbp
mov rbp, rdi
call fcn.1400cc4c0
test edi, edi
je 0x1400200ec
xor r11d, r11d
lea rsi, [0x1400da4d0]
nop word [rax + rax]
mov rax, qword [rbx + 0x58]
mov edx, dword [rbx + 0x48]
mov r8d, dword [rbx + 0x50]
movsx r10, byte [r11 + rax]
mov ecx, edx
shr edx, 8
xor rcx, r10
mov r9d, r8d
lea r11, [r11 + 1]
movzx eax, cl
and r9d, 0xfffd
mov ecx, dword [rsi + rax*4]
or r9d, 2
xor ecx, edx
movzx eax, cl
mov dword [rbx + 0x48], ecx
add eax, dword [rbx + 0x4c]
imul ecx, eax, 0x8088405
inc ecx
mov dword [rbx + 0x4c], ecx
movzx eax, byte [rbx + 0x4f]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
mov eax, dword [rsi + rcx*4]
mov ecx, r9d
xor ecx, 1
xor eax, r8d
mov dword [rbx + 0x50], eax
mov rax, qword [rbx + 0x58]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
dec rbp
jne 0x140020070
mov rsi, qword [rbx + 0x58]
mov rbp, qword [rsp + 0x40]
test byte [rbx], 1
je 0x140020126
mov rcx, qword [rbx + 0x38]
lea rax, [rcx + rdi]
cmp rax, qword [rbx + 0x40]
jb 0x140020111
mov dword [rbx + 0x28], SafeArrayDestroy
jmp 0x140020155
add rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1400cc4c0
add qword [rbx + 0x38], rdi
jmp 0x140020155
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x50]
mov r8d, edi
mov rdx, rsi
mov qword [rsp + 0x20], 0
push rcx
call fcn.140272f39
test eax, eax
je 0x14002014e
cmp dword [rsp + 0x50], edi
je 0x140020155
mov dword [rbx + 0x28], 3
test dword [rbx], 0x40000000
je 0x140020164
mov dword [rbx + 0x28], 0x14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret