joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180051460
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f900]
mov rcx, rdi
lea r8, [0x1800e6640]
call fcn.1800abf78
test eax, eax
jne 0x1800515f1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e6638], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x1800514d8
cmp rbx, 0x20
jae 0x1800514c1
xor ecx, ecx
jmp 0x1800514c3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x1800514b7
cmp qword [0x1800e65c0], r15
je 0x1800515cf
test rdi, rdi
jne 0x1800514f8
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x1800515d4
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x18005151f
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051529
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051510
mov ebp, 4
jmp 0x1800515d4
cmp ebx, 0xffffffff
je 0x18005151f
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x1800515c8
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x1800515d4
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x1800515d4
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800515b2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800515a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051580
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1800515d4
mov ebp, 5
jmp 0x1800515d4
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051600
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f860]
mov rcx, rdi
lea r8, [0x1800e6630]
call fcn.1800abf78
test eax, eax
jne 0x180051791
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e6628], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051678
cmp rbx, 0x20
jae 0x180051661
xor ecx, ecx
jmp 0x180051663
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051657
cmp qword [0x1800e65c0], r15
je 0x18005176f
test rdi, rdi
jne 0x180051698
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051774
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x1800516bf
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x1800516c9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800516b0
mov ebp, 4
jmp 0x180051774
cmp ebx, 0xffffffff
je 0x1800516bf
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051768
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051774
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051774
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051752
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180051748
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051720
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051774
mov ebp, 5
jmp 0x180051774
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1800517a0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f7b0]
mov rcx, rdi
lea r8, [0x1800e6620]
call fcn.1800abf78
test eax, eax
jne 0x180051931
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e6618], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051818
cmp rbx, 0x20
jae 0x180051801
xor ecx, ecx
jmp 0x180051803
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x1800517f7
cmp qword [0x1800e65c0], r15
je 0x18005190f
test rdi, rdi
jne 0x180051838
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051914
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x18005185f
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051869
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051850
mov ebp, 4
jmp 0x180051914
cmp ebx, 0xffffffff
je 0x18005185f
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051908
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051914
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051914
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800518f2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800518e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x1800518c0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051914
mov ebp, 5
jmp 0x180051914
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051940
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f720]
mov rcx, rdi
lea r8, [0x1800e6610]
call fcn.1800abf78
test eax, eax
jne 0x180051ad1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e6608], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x1800519b8
cmp rbx, 0x20
jae 0x1800519a1
xor ecx, ecx
jmp 0x1800519a3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051997
cmp qword [0x1800e65c0], r15
je 0x180051aaf
test rdi, rdi
jne 0x1800519d8
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051ab4
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x1800519ff
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051a09
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1800519f0
mov ebp, 4
jmp 0x180051ab4
cmp ebx, 0xffffffff
je 0x1800519ff
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051aa8
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051ab4
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051ab4
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051a92
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180051a88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051a60
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051ab4
mov ebp, 5
jmp 0x180051ab4
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051ae0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f660]
mov rcx, rdi
lea r8, [0x1800e6600]
call fcn.1800abf78
test eax, eax
jne 0x180051c71
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e65f8], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051b58
cmp rbx, 0x20
jae 0x180051b41
xor ecx, ecx
jmp 0x180051b43
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051b37
cmp qword [0x1800e65c0], r15
je 0x180051c4f
test rdi, rdi
jne 0x180051b78
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051c54
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x180051b9f
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051ba9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051b90
mov ebp, 4
jmp 0x180051c54
cmp ebx, 0xffffffff
je 0x180051b9f
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051c48
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051c54
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051c54
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051c32
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180051c28
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051c00
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051c54
mov ebp, 5
jmp 0x180051c54
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051c80
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f5c0]
mov rcx, rdi
lea r8, [0x1800e65f0]
call fcn.1800abf78
test eax, eax
jne 0x180051e11
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e65e8], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051cf8
cmp rbx, 0x20
jae 0x180051ce1
xor ecx, ecx
jmp 0x180051ce3
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051cd7
cmp qword [0x1800e65c0], r15
je 0x180051def
test rdi, rdi
jne 0x180051d18
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051df4
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x180051d3f
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051d49
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051d30
mov ebp, 4
jmp 0x180051df4
cmp ebx, 0xffffffff
je 0x180051d3f
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051de8
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051df4
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051df4
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051dd2
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180051dc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051da0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051df4
mov ebp, 5
jmp 0x180051df4
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051e20
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f530]
mov rcx, rdi
lea r8, [0x1800e65e0]
call fcn.1800abf78
test eax, eax
jne 0x180051fb1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e65d8], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180051e98
cmp rbx, 0x20
jae 0x180051e81
xor ecx, ecx
jmp 0x180051e83
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180051e77
cmp qword [0x1800e65c0], r15
je 0x180051f8f
test rdi, rdi
jne 0x180051eb8
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180051f94
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x180051edf
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180051ee9
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180051ed0
mov ebp, 4
jmp 0x180051f94
cmp ebx, 0xffffffff
je 0x180051edf
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180051f88
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180051f94
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180051f94
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180051f72
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180051f68
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x180051f40
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180051f94
mov ebp, 5
jmp 0x180051f94
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180051fc0
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
lea rdx, [0x18004f4a0]
mov rcx, rdi
lea r8, [0x1800e65d0]
call fcn.1800abf78
test eax, eax
jne 0x180052151
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov esi, 1
mov qword [rsp + 0x58], r15
xor r15d, r15d
mov ebx, r15d
mov qword [0x1800e65c8], rdi
lock cmpxchg dword [0x1800e65b8], esi
je 0x180052038
cmp rbx, 0x20
jae 0x180052021
xor ecx, ecx
jmp 0x180052023
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800e65b8], esi
jne 0x180052017
cmp qword [0x1800e65c0], r15
je 0x18005212f
test rdi, rdi
jne 0x180052058
mov ecx, esi
call fcn.1800abdc4
mov ebp, eax
jmp 0x180052134
mov ecx, dword [0x1800e6a3c]
mov ebx, r15d
test ecx, ecx
je 0x18005207f
mov r8, qword [0x1800e6a30]
mov rax, r8
nop
cmp rdi, qword [rax]
je 0x180052089
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180052070
mov ebp, 4
jmp 0x180052134
cmp ebx, 0xffffffff
je 0x18005207f
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x180052128
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800ab908
mov ebp, eax
test eax, eax
jne 0x180052134
mov edx, esi
mov ecx, ebx
call fcn.1800abcb4
mov ebp, eax
cmp qword [rsp + 0x20], r15
je 0x180052134
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180052112
mov rbx, qword [rsp + 0x20]
mov esi, eax
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x180052108
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rsi, 1
jne 0x1800520e0
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800e65c0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180052134
mov ebp, 5
jmp 0x180052134
mov ebp, 2
xchg dword [0x1800e65b8], r15d
mov r15, qword [rsp + 0x58]
mov eax, ebp
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180054070
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800540cd
lea rbx, [0x1800c9820]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800540b4
cmp r10, 2
jb 0x1800540b4
cmp byte [r9], r8b
jne 0x1800540b4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180054090
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18005410f
lea rbx, [0x1800c9820]
cmp r8b, 0x23
jne 0x1800540f3
cmp byte [r9], r8b
jne 0x1800540f3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800540e0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180054210
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x18005422e
mov qword [r8], r14
lea rdx, [0x1800c8eb8]
call fcn.180054120
mov rbx, rax
test rax, rax
jne 0x180054253
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18005437d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18005437d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18005437d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18005437d
cmp rdi, 0xffffffffffffffff
je 0x18005437d
mov rcx, rdi
call fcn.180058770
mov rbp, rax
test rax, rax
je 0x18005437d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18005436a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1800e6580]
test r8, r8
je 0x18005435f
movsx rdx, word [r8 + 0x3300]
lea rcx, [r8 + 0x3304]
mov r9d, dword [r8 + 0x1218]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180054354
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x3300], cx
movsx rax, cx
lea rcx, [r8 + 0x3304]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x32fc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180054386
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180054378
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180054388
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180057f30
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x1800c9820]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x130c], ebx
jne 0x180057fc6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18006c840
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180057fd0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x1800c9820]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret