joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c0120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov r11, qword [rcx]
mov rsi, rdx
mov r10, qword [rcx + 8]
mov rbx, rcx
mov r9, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov rax, qword [rcx + 0x20]
shl r11, 0x38
cmp dword [rcx + 0x30], 0
je 0x1402c039e
test r8, r8
je 0x1402c039e
mov r14d, dword [rcx + 0x2c]
cmp r8, r14
jne 0x1402c039e
mov ecx, dword [rcx + 0x28]
dec ecx
cmp ecx, 6
ja case.default.0x1402c018d
lea r8, [0x140000000]
mov edx, dword [r8 + rcx*4 + 0x2c03b8]
add rdx, r8
jmp rdx
movzx ecx, byte [rbx + 0x3e]
shl rcx, 0x30
or r11, rcx
movzx ecx, byte [rbx + 0x3d]
shl rcx, 0x28
or r11, rcx
movzx ecx, byte [rbx + 0x3c]
shl rcx, 0x20
or r11, rcx
movzx ecx, byte [rbx + 0x3b]
shl rcx, 0x18
or r11, rcx
movzx ecx, byte [rbx + 0x3a]
shl rcx, 0x10
or r11, rcx
movzx ecx, byte [rbx + 0x39]
shl rcx, 8
or r11, rcx
movzx ecx, byte [rbx + 0x38]
or r11, rcx
xor rax, r11
cmp dword [rbx + 0x30], 0
jbe 0x1402c0236
mov r8d, dword [rbx + 0x30]
nop word [rax + rax]
add rdi, rax
add r10, r9
ror r9, 0x33
xor r9, r10
ror rax, 0x30
xor rax, rdi
ror r10, 0x20
add rdi, r9
add r10, rax
mov rdx, rdi
ror r9, 0x2f
mov rcx, rdi
shr rdx, 0x20
xor r9, rdi
ror rax, 0x2b
shl rcx, 0x20
mov rdi, rdx
or rdi, rcx
xor rax, r10
sub r8, 1
jne 0x1402c01f0
xor r10, r11
mov ecx, 0xff
cmp r14d, 0x10
mov r8d, 0xee
cmovne r8d, ecx
mov ecx, dword [rbx + 0x34]
xor r8, rdi
test ecx, ecx
je 0x1402c02a6
mov r11d, ecx
nop dword [rax]
add r8, rax
add r10, r9
ror r9, 0x33
xor r9, r10
ror rax, 0x30
xor rax, r8
ror r10, 0x20
add r8, r9
add r10, rax
mov rdx, r8
ror r9, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r9, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r10
sub r11, 1
jne 0x1402c0260
mov rdx, rax
xor rdx, r8
xor rdx, r9
xor rdx, r10
mov ecx, edx
mov byte [rsi], dl
shr ecx, 8
mov byte [rsi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rsi + 2], cl
mov ecx, edx
shr ecx, 0x18
shr rdx, 0x20
mov byte [rsi + 3], cl
mov ecx, edx
shr ecx, 8
mov byte [rsi + 5], cl
mov ecx, edx
mov byte [rsi + 4], dl
shr ecx, 0x10
shr edx, 0x18
mov byte [rsi + 6], cl
mov byte [rsi + 7], dl
cmp dword [rbx + 0x2c], 8
je 0x1402c0397
mov ecx, dword [rbx + 0x34]
xor r9, 0xdd
test ecx, ecx
je 0x1402c0356
mov r11d, ecx
nop dword [rax]
nop dword [rax + rax]
add r8, rax
add r10, r9
ror r9, 0x33
xor r9, r10
ror rax, 0x30
xor rax, r8
ror r10, 0x20
add r8, r9
add r10, rax
mov rdx, r8
ror r9, 0x2f
mov rcx, r8
shr rdx, 0x20
xor r9, r8
ror rax, 0x2b
shl rcx, 0x20
mov r8, rdx
or r8, rcx
xor rax, r10
sub r11, 1
jne 0x1402c0310
xor rax, r8
xor rax, r9
xor rax, r10
mov ecx, eax
mov byte [rsi + 8], al
shr ecx, 8
mov byte [rsi + 9], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xa], cl
mov ecx, eax
shr ecx, 0x18
shr rax, 0x20
mov byte [rsi + 0xb], cl
mov ecx, eax
shr ecx, 8
mov byte [rsi + 0xd], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 0xc], al
shr eax, 0x18
mov byte [rsi + 0xf], al
mov byte [rsi + 0xe], cl
mov eax, 1
jmp 0x1402c03a0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
Function at 0x1402d1d10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1402d8e70
sub rsp, rax
mov r14, qword [rsp + 0xa8]
lea r10, [rax - 0x51]
mov rbp, qword [rsp + 0xb0]
xor r11d, r11d
cmp r14, 1
mov eax, r11d
mov r13, r9
mov r12, r8
mov r9, qword [rcx]
setne al
add rax, rbp
mov rsi, rcx
cmp rax, r9
jbe 0x1402d1d6e
xor eax, eax
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x80], rbx
cmp r14, 1
je 0x1402d1e73
lea r10, [r8 - 1]
add r10, r9
movzx ebx, byte [r10]
cmp dword [rsp + 0xb8], r11d
je 0x1402d1dab
sub r9, rbx
mov eax, 1
sub r9, rbp
dec r9
mov qword [rcx], r9
jmp 0x1402d1eaa
lea rcx, [rbx + rax]
mov qword [rsp + 0x98], r15
mov r15d, 0x100
mov r8, r9
sub r8, rcx
mov rax, r9
xor r8, rcx
xor rax, rcx
or r8, rax
xor r8, r9
shr r8, 0x3f
dec r8
cmp r9, r15
cmovb r15, r9
test r15, r15
je 0x1402d1e4d
mov qword [rsp + 0x90], rdi
mov rdi, rbx
shr rdi, 0x3f
nop dword [rax]
nop dword [rax + rax]
mov rax, r11
lea r10, [r10 - 1]
shr rax, 0x3f
mov rcx, rbx
sub rcx, r11
inc r11
shr rcx, 0x3f
xor cl, al
xor al, dil
or cl, al
xor cl, dil
dec cl
movzx edx, cl
movzx ecx, byte [r10 + 1]
xor rcx, rbx
and rdx, rcx
not rdx
and r8, rdx
cmp r11, r15
jb 0x1402d1e00
mov rdi, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov r15, qword [rsp + 0x98]
lea rax, [rbx + 1]
not r8
movzx r10d, r8b
dec r10
shr r10, 0x3f
neg r10
and rax, r10
sub r9, rax
mov qword [rsi], r9
mov rax, qword [rsp + 0xc0]
mov r9, r13
mov qword [rsp + 0x40], rax
mov r8, r12
mov rax, qword [rsp + 0xa0]
mov rcx, rsi
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
call fcn.1402d1940
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1402d6350
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
mov eax, 0x68
call fcn.1402d8e70
sub rsp, rax
mov rax, qword [0x1403bfb80]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [rcx + 0x3c]
mov rdi, r9
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test eax, eax
je 0x1402d6483
movups xmm0, xmmword [rcx + 0x10]
mov r15, qword [rcx + 0x20]
lea rbx, [rcx + 0x10]
dec eax
mov dword [rsp + 0x28], 1
mov dword [rcx + 0x3c], eax
xor r9d, r9d
mov eax, dword [rbx + 8]
xor r8d, r8d
and al, 0x7f
mov dword [rsp + 0x30], edi
movups xmmword [rsp + 0x48], xmm0
and byte [rsp + 0x54], 0x7f
xor edx, edx
mov byte [rsp + 0x50], al
mov rcx, r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140169780
test eax, eax
je 0x1402d6483
mov eax, dword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov r9, r14
mov dword [rsp + 0x20], eax
mov rdx, rbp
mov rcx, r15
call fcn.14016a4f0
test eax, eax
je 0x1402d6483
mov r9, rdi
lea rdx, [rsp + 0x38]
mov r8, rbp
mov rcx, rsi
call fcn.1402d6a80
test eax, eax
je 0x1402d6483
lea rax, [rbx + 0xf]
xor r8d, r8d
lea rcx, [rsp + 0x38]
cmp rcx, rax
ja 0x1402d6459
lea rax, [rsp + 0x47]
cmp rax, rbx
jb 0x1402d6459
lea rcx, [rsp + 0x38]
mov eax, r8d
sub rbx, rcx
nop
lea rdx, [rsp + 0x38]
add rdx, rax
inc rax
movzx ecx, byte [rbx + rdx]
xor byte [rdx], cl
cmp rax, 0x10
jl 0x1402d6440
jmp 0x1402d646c
movdqu xmm1, xmmword [rsp + 0x38]
movdqu xmm0, xmmword [rbx]
xorps xmm1, xmm0
movdqu xmmword [rsp + 0x38], xmm1
mov rax, qword [rsp + 0x38]
or rax, qword [rsp + 0x40]
je 0x1402d649f
mov rdx, rdi
mov rcx, rbp
call fcn.140001240
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1402d88b0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsi + 0x38], r8d
mov eax, edi
jmp 0x1402d6485

Function at 0x1402d9540
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1402d958a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402d958a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402d958a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402d958a
cmp dword [rcx + 0x84], 0xe
jbe 0x1402d958a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1402d958c
xor al, al
add rsp, 0x28
ret
Function at 0xa9726b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x20
sal r12d, cl
xor ebp, ebp
movzx rbx, ax
movsx si, r15b
mov r12, rdx
movsx ax, r11b
seta ah
mov r13, rcx
setl dil
cdqe
mov rsi, rbp
dec rbx
not edi
nop
movzx rbx, r14w
movzx edi, bx
dec dil
movsd dword [rdi], dword [rsi]
add cl, ch
invalid
jns 0xab2725
movsd dword [rdi], dword [rsi]
add byte [rax + rcx*2 - 0x44176945], bl
pushfq
movabs rbx, 0xb32a483b80bbe896
mov bx, 0x9bbc
call fcn.014ff337
mov ecx, 0x16ac0389
mov r8, qword [rsi + rcx*2 - 0x2d580712]
not ecx
mov rcx, qword gs:[r8 + riz]
mov qword [rsi], rcx
push 0x5c0a5ead
push 0x40be079f
push 0x4310f0c
lea rsp, [rsp + 0x18]
jmp fcn.0158e9d7
invalid
sbb dl, 0xc
neg dl
dec dl
call fcn.01502f67
mov ah, 0x63
adc byte [rdx - 0x2d3201fb], bl
push rbp
sbb ah, byte [rcx - 0x4a]
cdq
loop 0xab2707
jne 0xab27c3
movabs r13, 0xd4f7a4e3c8d31176
mov ebx, 0x472433dc
insb byte [rdi], dx
sbb eax, dword [rcx + rbx + 0x2f]
jns 0xab26ec
xchg byte [rcx], dl
clc
jo 0xab2774
ret
pop rsp
jo 0xab27d8
add esp, dword [rbp + 0x1cebede3]
mov cl, 0xbc
jbe 0xab2783
movabs al, byte [0xfabdc3449cec155a]
pop rcx
sbb dword [rbp + 0xe], 0x11227398
add esp, dword es:[rdx - 0x5512e3a6]
jl 0xab27fc
adc eax, 0xc3449cec
mov ebp, 0x5d8159fa
invalid
cwde
xor eax, 0xb202773c
invalid
stosd dword [rdi], eax
sub dword [0xffffffffc6d509a7], ecx
pop rbp
jae 0xab2752
xor esi, dword [rax]
movzx r8d, word [r11]
mov ecx, 0x17901ea3
dec ecx
lea r11, [rcx + r11 - 0x17901ea0]
btc ecx, ecx
jae 0xab71ed
mov r9d, 0x992bc203
movzx edx, byte [r11 + riz]
sal r9, 0xe8
adc r11, 0
or r9d, r9d
rol dword [rax], cl
add byte [rax], al
add byte [rbp + 0xb], al
leave
setnp r9b
xor dl, bl
push r9
ror dl, 1
dec r9w
xor r9, qword [rsp + r9 - 0xffff]
adc dl, r9b
xor dl, 0x26
or byte [rsp + r9*8 - 0x7fff6], r9b
xor dl, r9b
sub dl, 0x17
neg r9b
sar byte [rsp + r9*2 - 0x1fdfd], 0x81
neg dl
lea r9, [r9 + r9*4 + 0x502ba710]
pop r9
xor bl, dl
not r9
add rdx, rsp
and r9b, r9b
btc r9w, r9w
lea r9, [r9*4 - 0x1a68cb4b]
movzx r9w, byte [r9 + rdx + 0x1e66cb4f]
jb 0x150110c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
bsr ax, r8w
mov qword [rsp + 0x18], rsi
rcl eax, cl
or sil, 0xa5
push rdi
test r15b, cl
movsx di, r9b
push r12
rol r12w, cl
movzx r12d, sp
push r13
bt rdi, 0x90
jmp 0xa9726b
xor r8w, bx
bts ecx, 0x8c
inc cl
sbb ecx, ecx
xor r8w, cx
imul ecx, ecx
sar cl, cl
sbb cl, ch
adc r8w, 0x4123
shl cl, 0x87
shl rcx, 0x7b
ror ecx, 0xa2
rol r8w, 1
shr cl, 6
inc ecx
or ecx, ecx
adc r8w, 0x9220
imul rcx, rcx
sbb cl, cl
xor r8w, 0xa390
neg r8w
xor bx, r8w
sar cx, 0x4c
adc cl, cl
xor ecx, 0x77123fa2
adc r8, rsp
btc rcx, rcx
mov rcx, qword [r8 + riz]
sbb rsi, 8
mov qword [rsi], rcx
jmp fcn.00aa0ea5
Function at 0x14fc029
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
inc ecx
or edi, eax
inc r9
cmp r12b, 0xb5
cmp ecx, 5
jmp 0x1592d53
xor bl, al
call fcn.01582aa0
mov dword [rsp + 4], r12d
jmp 0x158887e
je 0x15888b2
mov ecx, eax
movsxd rdi, ebx
mov eax, 0x400
mov rdi, r15
bswap r13d
movzx r13w, bl
sets r9b
movzx eax, ax
cmovg r9w, bp
movsx r13, bp
rep stosw word [rdi], ax
inc r9b
adc rdi, r15
mov r9, r8
shl r13b, cl
movsx rdi, r15w
bswap r13d
lea r13, [r8 - 1]
rcr di, cl
adc cl, 3
mov edi, ebx
btr cx, 0xa
dec cl
add cl, r9b
or r8d, 0xffffffff
dec ch
and cl, r12b
shld cx, r10w, 0x91
mov ecx, ebx
stc
cmc
cmp r9, r13
je 0x14fb912
movzx eax, byte [r9]
cmp al, 0x3c
shl edi, 8
jmp 0x14fc029
jl 0x15888e8
mov qword [rsp + 0x28], rsi
sub bl, 0x81
nop
rol rsi, cl
sal si, 0x1d
movzx rsi, r10w
Function at 0x140f72ff8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f73002
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f7302b
pop rbp
sub rbp, 0x33
sub rbp, 0xf72ff8
sub rsp, 0x20
jmp 0x140f7304a
mov rax, 0xf72ff8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xfffffffff1aed12b
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f73069
jmp 0x140f73080
invalid
Function at 0x140006480
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1400c7880]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400c7de8]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a85], 0
jne 0x1400064e8
cmp byte [rbx + 0x4a86], 0
jne 0x1400064e8
movsx r9d, word [rbx + 0x5baa]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000b450
test sil, 1
je 0x140006620
jmp 0x140006581
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140050180]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x140050174]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
or dword [rbx + 0x47b8], 1
mov qword [rbx + 0x47d0], rax
movss dword [rbx + 0x47c8], xmm0
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mov rax, qword [0x1400c7de8]
mulss xmm0, dword [0x140050128]
or dword [rax + 0x47b8], 0x40
movss dword [rax + 0x4818], xmm0
movsx r9d, word [rbx + 0x5baa]
call fcn.14000b450
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400065d1
lea r11, [0x14004e8e0]
cmp r9b, 0x23
jne 0x1400065b4
cmp byte [r8], r9b
jne 0x1400065b4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400065a1
not ecx
call fcn.140009b90
test rax, rax
je 0x140006620
cmp byte [rax + 0xb6], 0
je 0x140006620
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5baa]
movsx r9d, word [rbx + 0x5baa]
call fcn.14000b450
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400040c0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14004a740
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140009ae0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1400c7de8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140009b43
mov qword [rsp], rbx
lea rbx, [0x14004e8e0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140009b23
cmp byte [r8], r9b
jne 0x140009b23
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140009b10
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c08]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140009b77
mov r10, qword [r10 + 0x5c10]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x140009b7e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140009b64
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140009c10
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x140009c60
lea r11, [0x14004e8e0]
cmp r9b, 0x23
jne 0x140009c43
cmp byte [r8], r9b
jne 0x140009c43
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140009c30
not ecx
jmp fcn.140009b90

Function at 0x14000a510
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14004e8e0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f2c], ebx
jne 0x14000a5a8
xor r9d, r9d
mov r8, r10
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.140007fe0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000a630
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x14004e8e0]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14000b1a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x14000b1bb
mov qword [r8], 0
call fcn.14000b300
mov rbx, rax
test rax, rax
jne 0x14000b1d1
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
mov rcx, rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000b2d9
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b2d9
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000b2d9
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000b2d9
cmp rdi, 0xffffffffffffffff
je 0x14000b2d9
mov rax, qword [0x1400c7de8]
test rax, rax
je 0x14000b252
inc dword [rax + 0xf4]
mov rdx, qword [0x1400c7df8]
lea rcx, [rdi + rbp]
call qword [0x1400ad218]
mov rsi, rax
test rax, rax
je 0x14000b2d9
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x14000b2b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400c7de8]
test rax, rax
je 0x14000b29f
dec dword [rax + 0xf4]
mov rdx, qword [0x1400c7df8]
mov rcx, rsi
call qword [0x1400ad220]
jmp 0x14000b2e2
test ebp, ebp
jle 0x14000b2c3
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000b2d4
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000b2e4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret

Function at 0x14000b5f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000b64d
lea rbx, [0x14004e8e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000b634
cmp r10, 2
jb 0x14000b634
cmp byte [r9], r8b
jne 0x14000b634
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000b610
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000b68f
lea rbx, [0x14004e8e0]
cmp r8b, 0x23
jne 0x14000b673
cmp byte [r9], r8b
jne 0x14000b673
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000b660
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000d210
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c90], 0
lea rbx, [rcx + 0x5c98]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14000d2b7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14000d26a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c190
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14001bc40
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c90]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5ca0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400c7df0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14000d2bf
mov rcx, rbx
call fcn.14001bc40
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret