joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002d140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rsi, rdx
mov r14, rcx
xor ebp, ebp
lea rdi, [rcx + 8]
mov qword [rdi], rbp
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
mov byte [rdi], bpl
lea rax, [0x1800f9838]
mov qword [rcx], rax
mov byte [rcx + 0x28], r8b
mov rcx, rdx
cmp qword [rdx + 0x18], 0x10
jb 0x18002d18d
mov rcx, qword [rdx]
mov r8d, 0x84222325
movzx eax, byte [rcx]
test al, al
je 0x18002d1b8
nop word [rax + rax]
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rcx, [rcx + 1]
movzx eax, byte [rcx]
test al, al
jne 0x18002d1a0
lea r9, [rsp + 0x35]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x18002d1c0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x48], rbp
mov eax, 0xf
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x35]
cmp r9, rcx
je 0x18002d222
lea r8, [rsp + 0x35]
sub r8, r9
mov rdx, r9
lea rcx, [rsp + 0x38]
call fcn.18005d8e0
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
cmp rdi, rcx
je 0x18002d290
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x18002d266
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18002d261
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d37e
mov rcx, r8
call fcn.1800e6850
mov byte [rdi], 0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 0xf
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x10], xmm1
mov eax, 0xf
mov byte [rsp + 0x38], 0
cmp rax, 0x10
jb 0x18002d2c9
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002d2c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002d37e
call fcn.1800e6850
mov qword [rsp + 0xa8], r14
mov rdx, qword [0x180114af0]
cmp rdx, qword [0x180114af8]
je 0x18002d2ee
mov qword [rdx], r14
add qword [0x180114af0], 8
jmp 0x18002d302
lea r8, [rsp + 0xa8]
lea rcx, [0x180114ae8]
call fcn.1800299d0
movzx ebx, byte [r14 + 0x28]
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.18002c8f0
movzx r8d, bl
mov rdx, rax
lea rcx, [0x18010e060]
call fcn.1800d4c70
mov byte [r14 + 0x28], al
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x18002d361
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x18002d35c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002d384
mov rcx, r8
call fcn.1800e6850
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, r14
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005beb0
nop
call fcn.18005beb0
int3
Function at 0x18005bec0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18005c06f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18005bcb0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18005c034
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18005bfad
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18005c023
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18005bfea
mov r10, qword [rdx]
cmp r10, rax
je 0x18005bfe4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18005c023
cmp r9, rdx
je 0x18005bfff
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18005c049
cmp r9, rdx
jne 0x18005bff0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18005bf60
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18005c023
lea rcx, [0x1800f9b38]
call fcn.1800e9e30
int3
Function at 0x18005c080
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18005c25f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18005bcb0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18005c224
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18005c19c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18005c213
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18005c1d9
mov r10, qword [rdx]
cmp r10, rax
je 0x18005c1d3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18005c213
cmp r9, rdx
je 0x18005c1ef
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18005c239
cmp r9, rdx
jne 0x18005c1e0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18005c120
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18005c213
lea rcx, [0x1800f9b38]
call fcn.1800e9e30
int3
Function at 0x18005c270
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18005c44f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18005bcb0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18005c414
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18005c389
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18005c403
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18005c3c6
mov r10, qword [rdx]
cmp r10, rax
je 0x18005c3c0
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18005c403
cmp r9, rdx
je 0x18005c3df
nop dword [rax + rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18005c429
cmp r9, rdx
jne 0x18005c3d0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18005c310
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18005c403
lea rcx, [0x1800f9b38]
call fcn.1800e9e30
int3
Function at 0x18005da40
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x18005daf8
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x18005daef
nop dword [rax + rax]
cmp rax, rdx
je 0x18005daf8
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18005dae0
add rax, 0x18
add rsp, 0x28
ret
lea rcx, [0x1800f9b38]
call fcn.1800e9e54
int3
Function at 0x18005de40
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rbp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
movzx eax, byte [r11 + 9]
movabs rbp, 0x100000001b3
movzx r8d, cl
movabs r14, 0xcbf29ce484222325
xor r8, r14
mov rdi, rcx
mov rcx, qword [0x1801149e0]
mov rbx, rdx
mov rdx, qword [0x1801149c8]
xor esi, esi
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xa]
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xb]
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xc]
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xd]
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xe]
imul r8, rbp
xor r8, rax
movzx eax, byte [r11 + 0xf]
imul r8, rbp
xor r8, rax
imul r8, rbp
and rcx, r8
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [0x1801149b8]
je 0x18005df13
mov rcx, qword [rdx + rcx*8]
cmp rdi, qword [rax + 0x10]
je 0x18005df16
cmp rax, rcx
je 0x18005df13
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x18005df02
jmp 0x18005df16
mov rax, rsi
test rax, rax
jne 0x18005df26
mov qword [rbx], rsi
mov dword [rbx + 8], esi
jmp 0x18005e000
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x20]
lea rcx, [0x1801149b0]
call fcn.18002a7a0
mov r8d, dword [rsp + 0x70]
movzx ecx, r8b
xor rcx, r14
mov rdx, qword [rax]
movzx eax, byte [rsp + 0x71]
imul rcx, rbp
mov r9, qword [rdx + 0x48]
xor rcx, rax
movzx eax, byte [rsp + 0x72]
imul rcx, rbp
xor rcx, rax
movzx eax, byte [rsp + 0x73]
imul rcx, rbp
xor rcx, rax
imul rcx, rbp
and r9, rcx
mov rcx, qword [rdx + 0x30]
add r9, r9
mov rax, qword [rcx + r9*8 + 8]
cmp rax, qword [rdx + 0x20]
je 0x18005dfb1
mov rcx, qword [rcx + r9*8]
cmp r8d, dword [rax + 0x10]
je 0x18005dfb4
nop dword [rax + rax]
cmp rax, rcx
je 0x18005dfb1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x18005dfa0
jmp 0x18005dfb4
mov rax, rsi
test rax, rax
je 0x18005df1b
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x20]
lea rcx, [0x1801149b0]
call fcn.18002a7a0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x30]
mov rcx, qword [rax]
add rcx, 0x18
call fcn.18002a260
mov rcx, qword [rax]
movsd xmm0, qword [rcx + 0x14]
mov eax, dword [rcx + 0x1c]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
mov rbp, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18006dc90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call fcn.18005f040
mov edx, 0x84222325
mov r8d, edx
movzx ecx, byte [rax]
test cl, cl
je 0x18006dcc8
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r8d
imul r8d, ecx, 0x1b3
movzx ecx, byte [rax]
test cl, cl
jne 0x18006dcb0
movzx eax, byte [rbx]
test al, al
je 0x18006dce6
nop
movsx eax, al
lea rbx, [rbx + 1]
xor eax, edx
imul edx, eax, 0x1b3
movzx eax, byte [rbx]
test al, al
jne 0x18006dcd0
cmp r8d, edx
sete al
add rsp, 0x20
pop rbx
ret
Function at 0x18006f350
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x38
movzx edx, cl
mov r8, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [r11 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xf]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x180114960]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x180114948]
mov rax, qword [rcx + 8]
cmp rax, qword [0x180114938]
je 0x18006f411
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x18006f413
nop dword [rax + rax]
cmp rax, rcx
je 0x18006f411
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x18006f400
jmp 0x18006f413
xor eax, eax
test rax, rax
jne 0x18006f41d
add rsp, 0x38
ret
mov qword [rsp + 0x40], r8
lea rdx, [rsp + 0x20]
lea r8, [rsp + 0x40]
lea rcx, [0x180114930]
call fcn.18002adc0
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x18]
add rsp, 0x38
ret
Function at 0x18009c0b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180116800]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18009c113
mov qword [rsp], rbx
lea rbx, [0x1800fa2d0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18009c0f3
cmp byte [r8], r9b
jne 0x18009c0f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18009c0e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b98]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x18009c147
mov r10, qword [r10 + 0x5ba0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x18009c14e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x18009c134
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret

Function at 0x18009c160
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18009c1b0
lea r11, [0x1800fa2d0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18009c193
cmp byte [r8], r9b
jne 0x18009c193
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18009c180
mov rcx, qword [0x180116800]
not eax
movsxd rdx, dword [rcx + 0x3e90]
mov r9, qword [rcx + 0x3e98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18009c211
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18009c209
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18009c20c
mov rdx, r8
test rdx, rdx
jne 0x18009c1e0
cmp r9, r10
je 0x18009c220
cmp dword [r9], eax
jne 0x18009c220
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x18009c820
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xf0]
mov r9, r8
movsxd r8, dword [rcx + 0xe8]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.18009d580
Function at 0x18009c850
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf0]
lea r9, [0x1800fa2d0]
movss xmm2, dword [rcx + 0x108]
movss xmm3, dword [rcx + 0x10c]
movsxd rcx, dword [rcx + 0xe8]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret

Function at 0x18009d580
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18009d5dd
lea rbx, [0x1800fa2d0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18009d5c4
cmp r10, 2
jb 0x18009d5c4
cmp byte [r9], r8b
jne 0x18009d5c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18009d5a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18009d61f
lea rbx, [0x1800fa2d0]
cmp r8b, 0x23
jne 0x18009d603
cmp byte [r9], r8b
jne 0x18009d603
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18009d5f0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18009d830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x180000000]
mov r13, rax
test rbx, rbx
je 0x18009d870
cmp rax, rbx
jae 0x18009da1c
movzx r8d, byte [rax]
test r8b, r8b
je 0x18009da1c
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0xfad30]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x18009d8a8
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x18009d8c1
movzx r12d, byte [rcx]
jmp 0x18009d8c4
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x18009d8d2
movzx ebp, byte [rcx]
jmp 0x18009d8d5
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x18009d8e3
movzx esi, byte [rcx]
jmp 0x18009d8e6
xor sil, sil
lea r10, [r9*4]
movzx ecx, dil
mov r15d, dword [r10 + r15 + 0xfad50]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r9d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r9d
shl r15d, 6
and ecx, 0x3f
shr r9d, 2
or r9d, edx
or r15d, ecx
shr r9d, 2
lea rcx, [0x180000000]
mov ecx, dword [r10 + rcx + 0xfad80]
or r9d, r8d
shr r15d, cl
lea rcx, [0x180000000]
shr r9d, 2
mov edx, r15d
cmp r15d, dword [r10 + rcx + 0xfad68]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r9d, ecx
mov ecx, pe_nt_image_headers64
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r9d, r8d
mov ecx, 0x100
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x180000000]
mov ecx, dword [r10 + rcx + 0xfad98]
or r9d, edx
xor r9d, 0x2a
sar r9d, cl
test r9d, r9d
je 0x18009da06
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x18009d858
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x18009da1c
xor r10d, r10d
inc r14d
jmp 0x18009d858
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret