joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001340
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800dc7d0], eax
je 0x18000135c
mov eax, 0x10dd
jmp 0x180001479
mov rax, qword [0x1800dc7e8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001402
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1800013d2
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1800013d2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.1800014f0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.180012400
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x180001368
mov qword [0x1800dc7e8], 0
call fcn.180001480
mov rax, qword [0x1800dc7e0]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180001462
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.180012400
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000141e
mov qword [0x1800dc7e0], 0
mov dword [0x1800dc7d0], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001bf0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180001c0d
xor eax, eax
jmp 0x180001ca5
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180001c47
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180001ca0
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x180001c9e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9e
xor eax, eax
jmp 0x180001ca5
jmp 0x180001c3d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180001d90
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800dc7d4], 0
je 0x180001dad
mov eax, dword [0x1800dc7d4]
jmp 0x180001e71
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180001dc1
xor eax, eax
jmp 0x180001e71
mov ecx, 0x10
call fcn.180049c20
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001e2a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180001e0f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.180012400
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800dc7d4], eax
mov qword [0x1800dc7d8], 0
mov eax, dword [rsp + 0x20]
jmp 0x180001e71
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180001e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180001dea
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800dc7e0]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800dc7e0], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x1800029a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180002aa0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180002a98
cmp qword [rsp + 0x20], 0x50000000
jb 0x1800029f0
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1800029f0
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18006d520
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002a1f
jmp 0x180002a98
cmp dword [rsp + 0x48], 0x10000
jne 0x180002a76
cmp qword [rsp + 0x40], 0x10000
jb 0x180002a76
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002a64
mov rax, qword [rsp + 0x58]
jmp 0x180002a9a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002a93
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180002aa0
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
xor eax, eax
add rsp, 0x68
ret

Function at 0x180002af0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180002beb
cmp qword [rsp + 0x20], 0x50000000
jb 0x180002b48
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x180002b48
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x180002b16
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18006d520
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b77
jmp 0x180002beb
cmp dword [rsp + 0x48], 0x10000
jne 0x180002bce
cmp qword [rsp + 0x40], 0x10000
jb 0x180002bce
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002bbc
mov rax, qword [rsp + 0x58]
jmp 0x180002bed
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002be6
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
jmp 0x180002b16
xor eax, eax
add rsp, 0x68
ret
Function at 0x18000c600
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
mov rdi, rdx
movabs rax, 0xcbf29ce484222325
mov rdx, qword [0x1800dc590]
xor r9, rax
movzx eax, byte [r8 + 0x11]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [0x1800dc578]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x18000c68e
cmp rax, r8
jne 0x18000c684
mov rax, qword [0x1800dc568]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x18000c699
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x18000c699
cmp rax, r8
jne 0x18000c699
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, 0x40
dec qword [0x1800dc570]
mov rcx, r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov rax, qword [r8 + 8]
mov qword [rbx + 8], rax
call fcn.18004a09c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000eab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
movabs rdx, 0xcbf29ce484222325
mov rax, qword [0x1800ddda8]
mov r8, qword [rax + 8]
movzx eax, byte [r8]
test al, al
je 0x18000ecf7
movabs rcx, 0x100000001b3
nop word [rax + rax]
movsx rax, al
lea r8, [r8 + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8]
test al, al
jne 0x18000eb00
movabs rax, 0x2ab3cf33ff5b8d12
cmp rdx, rax
jne 0x18000ecf7
test rbx, rbx
je 0x18000ecf7
mov rcx, rbx
call fcn.18000d510
mov rdi, qword [rax]
test rdi, rdi
je 0x18000ecf7
mov rcx, qword [0x1800ddd10]
add rcx, 0x40
mov r8d, 7
lea rdx, str.Chicken
call fcn.18000f900
mov rcx, rdi
call fcn.18000d830
mov rdx, qword [0x1800ddd10]
mov ecx, dword [rax]
mov dword [rdx], ecx
mov ecx, dword [rax + 4]
mov dword [rdx + 4], ecx
mov eax, dword [rax + 8]
mov dword [rdx + 8], eax
mov r8, rbx
call fcn.180008de0
mov rcx, qword [0x1800ddd10]
mov byte [rcx + 0x38], al
mov r9, qword [0x1800ddd10]
movsd xmm1, qword [r9]
mov eax, dword [r9 + 8]
mov dword [rsp + 0x38], eax
movss dword [rsp + 0x20], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rsp + 0x30], xmm1
movss dword [rsp + 0x24], xmm0
movd xmm1, eax
addss xmm1, dword [0x180080c1c]
movss dword [rsp + 0x28], xmm1
xorps xmm6, xmm6
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x74], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
call fcn.180004f20
test eax, eax
je 0x18000ec80
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
call fcn.180004f20
test eax, eax
je 0x18000ec80
movss xmm4, dword [rsp + 0x74]
comiss xmm6, xmm4
ja 0x18000ec80
movss xmm0, dword [rsp + 0x6c]
mov rax, qword [0x1800ddbf0]
comiss xmm0, dword [rax + 0x14]
ja 0x18000ec80
movaps xmm3, xmm4
subss xmm3, xmm0
andps xmm3, xmmword [0x180081100]
cvtps2pd xmm0, xmm3
mulsd xmm0, qword [0x180080b90]
cvtpd2ps xmm2, xmm0
movaps xmm1, xmm2
mulss xmm1, dword [0x180080b20]
movss xmm0, dword [rsp + 0x68]
subss xmm0, xmm1
shufps xmm0, xmm0, 0xe1
movss xmm0, xmm4
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm2
shufps xmm0, xmm0, 0x27
movss xmm0, xmm3
shufps xmm0, xmm0, 0x39
jmp 0x18000ec83
xorps xmm0, xmm0
movups xmmword [r9 + 0xc], xmm0
mov rsi, qword [0x1800dc410]
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
je 0x18000ece5
mov qword [rsp + 0x68], rdi
mov rbx, qword [0x1800ddd10]
movsd xmm0, qword [rbx]
movsd qword [rdi], xmm0
mov eax, dword [rbx + 8]
mov dword [rdi + 8], eax
movups xmm0, xmmword [rbx + 0xc]
movups xmmword [rdi + 0xc], xmm0
lea rcx, [rdi + 0x20]
lea rdx, [rbx + 0x20]
call fcn.180011300
nop
movzx eax, byte [rbx + 0x38]
mov byte [rdi + 0x38], al
lea rcx, [rdi + 0x40]
lea rdx, [rbx + 0x40]
call fcn.18000c080
nop
add qword [rsi + 8], 0x60
jmp 0x18000ecf7
mov r8, qword [0x1800ddd10]
mov rdx, rdi
mov rcx, rsi
call fcn.180010000
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x18000ed10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rax, qword [0x1800ddda8]
movabs rsi, 0xcbf29ce484222325
mov rdi, rcx
mov rdx, rsi
mov r8, qword [rax + 8]
movzx eax, byte [r8]
test al, al
je 0x18000ef70
mov qword [rsp + 0x40], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movsx rax, al
lea r8, [r8 + 1]
xor rdx, rax
movzx eax, byte [r8]
imul rdx, rbx
test al, al
jne 0x18000ed60
movabs rax, 0x5597d0d77a2af3ae
cmp rdx, rax
jne 0x18000ef6b
test rdi, rdi
je 0x18000ef6b
mov dword [rsp + 0x48], edi
call fcn.1800095d0
cmp byte [rax], 0
je 0x18000ee98
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call fcn.18000fa90
mov ecx, dword [0x1800dcdc4]
mov edx, 4
mov rbx, qword [rax]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800ddb10], ecx
jle 0x18000ee3c
lea rcx, [0x1800ddb10]
call fcn.180049ba8
cmp dword [0x1800ddb10], 0xffffffff
jne 0x18000ee3c
mov rcx, qword [0x1800dc420]
mov rax, qword [0x1800dc428]
cmp rcx, rax
je 0x18000ee28
movabs rdx, 0xdfdb76de21756f27
nop dword [rax]
cmp qword [rcx], rdx
je 0x18000ee1e
add rcx, 0x10
cmp rcx, rax
jne 0x18000ee10
cmp rcx, rax
je 0x18000ee28
mov ecx, dword [rcx + 8]
jmp 0x18000ee2a
xor ecx, ecx
mov dword [0x1800ddb24], ecx
lea rcx, [0x1800ddb10]
call fcn.180049b3c
mov ecx, dword [0x1800ddb24]
mov eax, dword [rcx + rdi]
mov dword [rbx + 0x30], eax
mov eax, dword [rcx + rdi + 4]
mov dword [rbx + 0x34], eax
mov eax, dword [rcx + rdi + 8]
mov dword [rbx + 0x38], eax
cmp qword [rbx + 0x20], 0
mov qword [rbx + 0x28], rdi
jne 0x18000ef6b
lea rcx, [rsp + 0x50]
call fcn.1800094f0
mov rcx, qword [rax]
mov qword [rbx + 0x20], rcx
mov ecx, dword [0x1800ddae4]
mov dword [rbx + 0x18], ecx
mov rbx, qword [rsp + 0x40]
lea eax, [rcx + 1]
mov dword [0x1800ddae4], eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
movzx eax, byte [rsp + 0x49]
mov r8d, dword [rsp + 0x48]
mov r9, qword [0x1800dc578]
mov r10, qword [0x1800dc568]
movzx edx, r8b
xor rdx, rsi
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rsp + 0x4a]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rsp + 0x4b]
imul rdx, rbx
xor rdx, rax
imul rdx, rbx
and rdx, qword [0x1800dc590]
add rdx, rdx
mov r11, qword [r9 + rdx*8 + 8]
mov rcx, r11
cmp r11, r10
je 0x18000ef11
mov rax, qword [r9 + rdx*8]
cmp r8d, dword [r11 + 0x10]
je 0x18000ef13
nop dword [rax + rax]
cmp rcx, rax
je 0x18000ef11
mov rcx, qword [rcx + 8]
cmp r8d, dword [rcx + 0x10]
jne 0x18000ef00
jmp 0x18000ef13
xor ecx, ecx
test rcx, rcx
je 0x18000ef6b
mov rax, qword [r9 + rdx*8]
cmp r11, rcx
jne 0x18000ef3c
cmp rax, rcx
jne 0x18000ef31
mov qword [r9 + rdx*8], r10
mov qword [r9 + rdx*8 + 8], r10
jmp 0x18000ef48
mov r10, qword [rcx + 8]
mov qword [r9 + rdx*8 + 8], r10
jmp 0x18000ef48
cmp rax, rcx
jne 0x18000ef48
mov rax, qword [rcx]
mov qword [r9 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [0x1800dc570]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x40
call fcn.18004a09c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18000fe40
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18000ffee
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800dc568]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800dc578]
lea rdx, [rdi + rdi]
call fcn.180006290
mov rax, qword [0x1800dc568]
lea r9, [rdi - 1]
mov qword [0x1800dc590], r9
mov qword [0x1800dc598], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000ffe3
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800dc578]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18000ff2f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18000ffa4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000ff6c
mov r10, qword [rdx]
cmp r10, rax
je 0x18000ff66
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18000ffa4
cmp r9, rdx
je 0x18000ff80
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18000ffb8
cmp r9, rdx
jne 0x18000ff71
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000ffde
mov r9, qword [0x1800dc590]
jmp 0x18000fee0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000ffa4
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800499d0
int3
Function at 0x180012c30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180012c8d
lea rbx, [0x18007c000]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180012c74
cmp r10, 2
jb 0x180012c74
cmp byte [r9], r8b
jne 0x180012c74
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180012c50
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180012ccf
lea rbx, [0x18007c000]
cmp r8b, 0x23
jne 0x180012cb3
cmp byte [r9], r8b
jne 0x180012cb3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180012ca0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180012eb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180012eca
mov qword [r8], 0
lea rdx, [0x18007be50]
call fcn.180012ce0
mov rbx, rax
test rax, rax
jne 0x180012eea
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800511f8
mov esi, eax
cmp eax, 0xffffffff
je 0x180012fba
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.180051b48
test eax, eax
jne 0x180012fba
mov rcx, rbx
call fcn.1800511f8
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180012fba
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.180051b48
test eax, eax
jne 0x180012fba
cmp rdi, 0xffffffffffffffff
je 0x180012fba
mov rax, qword [0x1800ddbf0]
test rax, rax
je 0x180012f5c
inc dword [rax + 0x3bc]
mov rcx, rdi
call fcn.180059d28
mov rsi, rax
test rax, rax
je 0x180012fba
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180054778
mov rcx, rbx
cmp rax, rdi
je 0x180012fa8
call fcn.180051840
mov rax, qword [0x1800ddbf0]
test rax, rax
je 0x180012f9e
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.180054504
jmp 0x180012fc2
call fcn.180051840
test r14, r14
je 0x180012fb5
mov qword [r14], rdi
mov rax, rsi
jmp 0x180012fc4
mov rcx, rbx
call fcn.180051840
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180014c80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 0xc8]
movss xmm0, dword [rdx]
subss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rdx + 8]
subss xmm1, dword [rcx + 0x10]
cvttss2si r8d, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x14]
mov r10d, r8d
cvttss2si ebx, xmm1
cvttss2si r9d, xmm0
mov edi, ebx
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0xc0]
mov r11d, r9d
shr r11, 0x18
mov r14d, dword [rax + rcx*4 - 4]
not r14d
movzx eax, r8b
movzx ecx, r14b
lea r8, [0x18007c000]
xor rcx, rax
shr r14d, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
shr r10, 0x18
cvttss2si esi, xmm0
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
mov ebp, esi
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor r10, rcx
xor r14d, dword [r8 + r10*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, bl
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
xor r11, rcx
shr r14d, 8
xor r14d, dword [r8 + r11*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, ebx
shr eax, 8
movzx edx, al
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
mov eax, ebx
shr r14d, 8
shr eax, 0x10
movzx edx, al
xor rdx, rcx
movzx eax, sil
shr rdi, 0x18
shr rbp, 0x18
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rdi, rcx
xor r14d, dword [r8 + rdi*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, esi
shr eax, 8
movzx edx, al
mov eax, esi
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
shr r14d, 8
xor rdx, rcx
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
mov rax, qword [0x1800ddbf0]
xor rdx, rcx
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rbp, rcx
xor r14d, dword [r8 + rbp*4]
not r14d
cmp dword [rax + 0x1a60], r14d
jne 0x180014e63
mov dword [rax + 0x1a64], r14d
cmp dword [rax + 0x1a9c], r14d
jne 0x180014e73
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x10]
mov eax, r14d
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x180017230
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x18007bd8d]
mov dword [rsp + 0x2c], eax
lea r11, [0x18007c000]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x180017283
cmp byte [r8], r9b
jne 0x180017283
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180017270
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180023760]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x180023820]
mov qword [rsp + 0x38], rax
lea rax, [0x1800238f0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180017383
inc edi
test ecx, ecx
je 0x1800172ef
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1800172f4
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180017383
mov rax, qword [0x1800ddbf0]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x180017318
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call fcn.180059d28
mov rdx, qword [rbx + 0x2f18]
mov rsi, rax
test rdx, rdx
je 0x180017371
movsxd rcx, dword [rbx + 0x2f10]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.18006ce80
mov rcx, qword [rbx + 0x2f18]
test rcx, rcx
je 0x18001736c
mov rax, qword [0x1800ddbf0]
test rax, rax
je 0x18001736c
dec dword [rax + 0x3bc]
call fcn.180054504
mov qword [rbx + 0x2f18], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1800187c0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180018810
lea r11, [0x18007c000]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800187f3
cmp byte [r8], r9b
jne 0x1800187f3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800187e0
mov rcx, qword [0x1800ddbf0]
not eax
movsxd rdx, dword [rcx + 0x1a00]
mov r9, qword [rcx + 0x1a08]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180018871
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180018869
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18001886c
mov rdx, r8
test rdx, rdx
jne 0x180018840
cmp r9, r10
je 0x180018880
cmp dword [r9], eax
jne 0x180018880
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret