joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180132970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rcx + 8]
xor r8d, r8d
mov r13, qword [rdx + 8]
dec r15
mov r12, rdx
mov r14, rcx
mov r9d, 0x811c9dc5
test r13, r13
je 0x1801329c7
mov r10, qword [rdx]
nop
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r13
jb 0x1801329b0
mov rcx, qword [rcx]
mov ebx, r9d
and rbx, r15
xor ebp, ebp
nop dword [rax]
nop word [rax + rax]
lea rax, [rbx + rbx*2]
mov rdi, qword [rcx + rax*8]
lea rsi, [rcx + rax*8]
test rdi, rdi
je 0x180132a1b
mov rdx, qword [r14 + 0x18]
test rdx, rdx
je 0x180132a1b
mov r8, qword [rsi + 8]
cmp r8, qword [r14 + 0x20]
jne 0x180132a17
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180132a17
mov eax, 1
jmp 0x180132a22
xor eax, eax
jmp 0x180132a22
cmp rdi, qword [r14 + 0x18]
sete al
test al, al
jne 0x180132a7b
test rdi, rdi
je 0x180132a54
mov rdx, qword [r12]
test rdx, rdx
je 0x180132a54
mov r8, qword [rsi + 8]
cmp r8, r13
jne 0x180132a50
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180132a50
mov eax, 1
jmp 0x180132a5b
xor eax, eax
jmp 0x180132a5b
cmp rdi, qword [r12]
sete al
test al, al
jne 0x180132a87
mov rcx, qword [r14]
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
jbe 0x1801329e0
xor eax, eax
jmp 0x180132a8a
movups xmm0, xmmword [r12]
movups xmmword [rsi], xmm0
inc qword [r14 + 0x10]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180132ab0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x180132b62
mov r10d, dword [rdx]
mov r11d, dword [rbx + 0x18]
mov edx, r10d
mov r8d, r10d
shr edx, 0x18
mov ecx, r10d
shr r8d, 0x10
shr ecx, 8
cmp r10d, r11d
je 0x180132b62
mov r9, qword [rbx + 8]
mov rbx, qword [rbx]
dec r9
movzx ecx, cl
mov qword [rsp + 0x10], rdi
movabs rdi, 0xcbf29ce484222325
movzx eax, r10b
xor rax, rdi
movabs rdi, 0x100000001b3
imul rax, rdi
xor rax, rcx
movzx ecx, r8b
imul rax, rdi
xor rax, rcx
mov ecx, edx
imul rax, rdi
xor rax, rcx
imul rax, rdi
mov rdi, qword [rsp + 0x10]
and rax, r9
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
cmp edx, r10d
je 0x180132b66
cmp edx, r11d
je 0x180132b62
inc rax
add rax, rcx
inc rcx
and rax, r9
cmp rcx, r9
jbe 0x180132b40
xor eax, eax
pop rbx
ret
mov rax, r8
pop rbx
ret
Function at 0x180132b70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 8]
mov rsi, rcx
movzx eax, byte [rdx]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
dec r10
mov rbx, qword [rsi]
movzx ecx, byte [r11 + 2]
movzx r8d, byte [r11 + 1]
mov edi, dword [rsi + 0x18]
imul rax, rdx
xor rax, r8
imul rax, rdx
xor rax, rcx
movzx ecx, byte [r11 + 3]
imul rax, rdx
xor rax, rcx
imul rax, rdx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
mov r9d, dword [r11]
cmp edx, edi
je 0x180132c16
cmp edx, r9d
je 0x180132c1d
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x180132be0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [r8], r9d
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 8]
mov rax, r8
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x180132c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov rdi, rcx
je 0x180132d37
mov r12d, dword [rdx + 0x80]
lea rax, [rcx + 0x18]
mov ecx, dword [rax + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], ecx
cmp r12d, ecx
jne 0x180132c8f
lea r8, [r12*4]
mov rdx, rax
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132d37
mov r15, qword [rdi + 8]
xor ebp, ebp
dec r15
mov eax, 0x811c9dc5
mov ecx, ebp
test r12, r12
je 0x180132cc3
nop dword [rax]
nop dword [rax + rax]
xor eax, dword [r13 + rcx*4]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, r12
jb 0x180132cb0
mov ebx, eax
mov rax, qword [rdi]
and rbx, r15
mov qword [rsp + 0x78], rax
imul rsi, rbx, 0x88
add rsi, rax
mov r14d, dword [rsi + 0x80]
mov edi, r14d
shl rdi, 2
cmp r14d, r12d
jne 0x180132cff
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132d32
cmp r14d, dword [rsp + 0x60]
jne 0x180132d1a
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132d37
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
ja 0x180132d37
mov rax, qword [rsp + 0x78]
jmp 0x180132cd0
mov rax, rsi
jmp 0x180132d39
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180132d50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [rcx + 8]
xor ebp, ebp
mov r13d, dword [rdx + 0x80]
dec r12
mov r14, rdx
mov eax, 0x811c9dc5
mov r8d, ebp
test r13, r13
je 0x180132da2
nop dword [rax]
xor eax, dword [rdx + r8*4]
inc r8
imul eax, eax, 0x1000193
cmp r8, r13
jb 0x180132d90
mov edi, eax
mov rax, qword [rcx]
and rdi, r12
add rcx, 0x18
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
imul rbx, rdi, 0x88
add rbx, rax
mov r15d, dword [rbx + 0x80]
mov esi, r15d
shl rsi, 2
cmp r15d, dword [rcx + 0x80]
jne 0x180132df3
mov rdx, rcx
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132e27
cmp r15d, r13d
jne 0x180132e0a
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x180132e83
inc rdi
add rdi, rbp
inc rbp
and rdi, r12
cmp rbp, r12
ja 0x180132e88
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
jmp 0x180132dc0
movups xmm0, xmmword [r14]
mov rax, qword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r14 + 0x60]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r14 + 0x70]
movups xmmword [rbx + 0x70], xmm1
mov ecx, dword [r14 + 0x80]
mov dword [rbx + 0x80], ecx
inc qword [rax + 0x10]
mov rax, rbx
jmp 0x180132e8a
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801334d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbx, rdx
mov r14, rcx
je 0x180133615
mov r15, qword [rdx]
test r15, r15
je 0x18013352f
mov rdx, qword [rcx + 0x18]
test rdx, rdx
je 0x18013352f
mov r8, qword [rbx + 8]
cmp r8, qword [rcx + 0x20]
jne 0x18013352b
mov rcx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18013352b
mov eax, 1
jmp 0x180133536
xor eax, eax
jmp 0x180133536
cmp r15, qword [rcx + 0x18]
sete al
test al, al
jne 0x180133615
mov r12, qword [r14 + 8]
xor ecx, ecx
mov r13, qword [rbx + 8]
dec r12
mov edx, 0x811c9dc5
test r13, r13
je 0x180133575
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r13
jb 0x180133560
mov rcx, qword [r14]
mov ebx, edx
and rbx, r12
xor ebp, ebp
nop
lea rax, [rbx + rbx*2]
mov rdi, qword [rcx + rax*8]
lea rsi, [rcx + rax*8]
test rdi, rdi
je 0x1801335b9
test r15, r15
je 0x1801335b9
mov r8, qword [rsi + 8]
cmp r8, r13
jne 0x1801335b5
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1801335b5
mov eax, 1
jmp 0x1801335bf
xor eax, eax
jmp 0x1801335bf
cmp rdi, r15
sete al
test al, al
jne 0x180133634
test rdi, rdi
je 0x1801335f2
mov rdx, qword [r14 + 0x18]
test rdx, rdx
je 0x1801335f2
mov r8, qword [rsi + 8]
cmp r8, qword [r14 + 0x20]
jne 0x1801335ee
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1801335ee
mov eax, 1
jmp 0x1801335f9
xor eax, eax
jmp 0x1801335f9
cmp rdi, qword [r14 + 0x18]
sete al
test al, al
jne 0x180133615
mov rcx, qword [r14]
inc rbx
add rbx, rbp
inc rbp
and rbx, r12
cmp rbp, r12
jbe 0x180133580
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rsi
jmp 0x180133617
Function at 0x180133640
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbx
mov rbx, rcx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x50], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov edi, dword [rcx + 0x18]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
lea r15, [rcx + 0x18]
mov r14, r15
test rsi, rsi
jne 0x18013368e
mov esi, reloc.WS2_32.dll_recv
lea ecx, [rsi + 0x70]
call fcn.1803940a0
mov r11, rax
xor ecx, ecx
mov ebp, esi
jmp 0x1801336c0
xor r11d, r11d
xor ebp, ebp
add rsi, rsi
je 0x1801336d7
lea rcx, [rsi*8]
call fcn.1803940a0
xor ecx, ecx
mov r11, rax
mov rbp, rsi
test rsi, rsi
je 0x1801336d7
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14]
mov dword [r11 + rcx*8], eax
xor eax, eax
mov word [r11 + rcx*8 + 4], ax
inc rcx
cmp rcx, rsi
jb 0x1801336c0
xor esi, esi
cmp qword [rbx + 8], rsi
jbe 0x1801337a1
mov qword [rsp + 0x40], r12
movabs r14, 0x100000001b3
movabs r12, 0xcbf29ce484222325
nop dword [rax]
mov rax, qword [rbx]
mov r9d, dword [rax + rsi*8]
mov edx, r9d
mov r8d, r9d
mov ecx, r9d
shr edx, 0x18
shr r8d, 0x10
shr ecx, 8
cmp r9d, dword [r15]
je 0x18013378f
movzx ecx, cl
lea r10, [rbp - 1]
movzx eax, r9b
xor rax, r12
imul rax, r14
xor rax, rcx
movzx ecx, r8b
imul rax, r14
xor rax, rcx
mov ecx, edx
imul rax, r14
xor rax, rcx
imul rax, r14
and rax, r10
xor ecx, ecx
mov r8d, dword [r11 + rax*8]
lea rdx, [r11 + rax*8]
cmp r8d, edi
je 0x180133778
cmp r8d, r9d
je 0x18013377b
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x180133751
xor edx, edx
jmp 0x18013377b
mov dword [rdx], r9d
mov rax, qword [rbx]
lea rcx, [rax + rsi*8]
mov eax, dword [rax + rsi*8]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
inc rsi
cmp rsi, qword [rbx + 8]
jb 0x180133700
mov r12, qword [rsp + 0x40]
mov rcx, qword [rbx]
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [rbx + 8], rbp
mov rbp, qword [rsp + 0x70]
mov qword [rbx], r11
mov rbx, qword [rsp + 0x68]
test rcx, rcx
je 0x1801337d7
add rsp, 0x58
jmp fcn.180394110
add rsp, 0x58
ret
Function at 0x18014a6f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
mov esi, ebp
cmp qword [rdx + 0x40], rbp
jbe 0x18014a77b
mov qword [rsp + 0x40], r14
movabs r14, 0x8080808080808080
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rdi + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8, qword [r8 + rsi*8]
call fcn.180149d30
inc rsi
mov r8, qword [rax]
add r8, qword [rbx + 0x38]
mov rdx, r8
mov qword [rbx + 0x40], rbp
and rdx, r14
mov rax, rdx
mov rcx, rdx
shr rax, 7
xor rdx, r8
sub rcx, rax
or rcx, rdx
mov qword [rbx + 0x38], rcx
cmp rsi, qword [rdi + 0x40]
jb 0x18014a730
mov r14, qword [rsp + 0x40]
mov rdx, qword [rdi + 0x48]
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], 1
mov r9d, 3
mov qword [rsp + 0x28], rbp
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.18014a300
mov rbx, qword [rsp + 0x48]
xor al, al
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x18014dee0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov r12, rcx
je 0x18014dfc2
mov r15d, dword [rdx + 8]
cmp r15d, dword [rcx + 0x20]
jne 0x18014df2f
mov rdx, qword [rcx + 0x18]
mov r8d, r15d
mov rcx, qword [r13]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014dfc2
mov r14, qword [r12 + 8]
xor esi, esi
dec r14
mov edx, 0x811c9dc5
mov ecx, esi
test r15, r15
je 0x18014df65
mov r8, qword [r13]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r15
jb 0x18014df50
mov edi, edx
and rdi, r14
nop word [rax + rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, r15d
jne 0x18014df96
mov rdx, qword [r13]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014dfe1
cmp ebp, dword [r12 + 0x20]
jne 0x18014dfb1
mov rdx, qword [r12 + 0x18]
mov r8, rbp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014dfc2
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x18014df70
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x18014dfc4
Function at 0x18014dff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
xor esi, esi
mov r15d, dword [rdx + 8]
dec r14
mov r13, rdx
mov r12, rcx
mov r9d, 0x811c9dc5
mov r8d, esi
test r15, r15
je 0x18014e047
mov r10, qword [rdx]
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r15
jb 0x18014e030
mov edi, r9d
and rdi, r14
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, dword [r12 + 0x20]
jne 0x18014e079
mov rdx, qword [r12 + 0x18]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e0c1
cmp ebp, r15d
jne 0x18014e091
mov rdx, qword [r13]
mov r8, rbp
mov rcx, qword [rbx]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18014e0ce
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x18014e050
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [r13]
movups xmmword [rbx], xmm0
inc qword [r12 + 0x10]
mov rax, rbx
jmp 0x18014e0a4
Function at 0x180172a80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
xor r10d, r10d
mov r9, rdx
mov rbx, rcx
mov r11d, r10d
mov r8d, edx
cmp rdx, 0x20
jb 0x180172b0a
add rdx, 0xffffffffffffffec
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff4
add r9, rax
nop word [rax + rax]
add r8d, dword [rbx + 8]
movsd xmm0, qword [rbx]
mov ecx, r8d
ror ecx, 0xe
add rbx, 0xc
movsd qword [rsp], xmm0
add r10d, dword [rsp]
mov rax, qword [rsp]
xor r10d, r8d
sub r10d, ecx
shr rax, 0x20
add r11d, eax
mov ecx, r10d
ror ecx, 0xb
xor r11d, r10d
sub r11d, ecx
xor r8d, r11d
mov eax, r11d
rol eax, 7
sub r8d, eax
sub rdx, 1
jne 0x180172ac0
test r9, r9
je 0x180172b2f
nop
movzx ecx, byte [rbx + r9 - 1]
mov eax, r8d
shl eax, 5
add ecx, eax
mov eax, r8d
shr eax, 2
add ecx, eax
xor r8d, ecx
sub r9, 1
jne 0x180172b10
mov eax, r8d
add rsp, 0x10
pop rbx
ret

Function at 0x180172b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rbp, edx
movabs rax, 0x1fffffffffffffff
mov r14, rcx
cmp rbp, rax
ja 0x180172c40
lea rdi, [rbp*8]
mov qword [rsp + 0x30], rbx
mov rdx, rdi
mov qword [rsp + 0x38], rsi
xor r8d, r8d
call fcn.180170ab0
mov rbx, qword [r14 + 0x30]
mov rsi, rax
add rbx, r14
test ebp, ebp
jle 0x180172ba5
and rdi, 0xfffffffffffffff8
xor edx, edx
mov r8, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [rbx + 0x38]
xor r10d, r10d
test eax, eax
jle 0x180172c08
mov r11d, r10d
mov rax, qword [rbx + 0x30]
mov rax, qword [r11 + rax]
test rax, rax
je 0x180172bf9
lea r9, [rbp - 1]
nop dword [rax]
nop word [rax + rax]
movsxd rdx, dword [rax + 0x10]
lea rcx, [rax + 0x10]
mov r8, qword [rax + 8]
movsxd rcx, ecx
xor rdx, rcx
and rdx, r9
mov rcx, qword [rsi + rdx*8]
mov qword [rax + 8], rcx
mov qword [rsi + rdx*8], rax
mov rax, r8
test r8, r8
jne 0x180172bd0
mov eax, dword [rbx + 0x38]
inc r10d
add r11, 8
cmp r10d, eax
jl 0x180172bb2
mov rdx, qword [rbx + 0x30]
xor r9d, r9d
movsxd r8, eax
mov rcx, r14
shl r8, 3
call fcn.180170d70
mov rdi, qword [rsp + 0x48]
mov dword [rbx + 0x38], ebp
mov rbp, qword [rsp + 0x40]
mov qword [rbx + 0x30], rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
call fcn.180170970
int3
Function at 0x180177890
Capabilities:
Hash data using murmur3

Disassembly:
sub rsp, 0x18
mov r8d, dword [rdx + 0xc]
mov r10, rdx
mov r11, rcx
sub r8d, 1
je 0x180177a5f
sub r8d, 1
je 0x180177a11
sub r8d, 1
je 0x18017797d
sub r8d, 1
je 0x180177902
cmp r8d, 1
jne 0x180177a11
mov rax, qword [rdx]
lea r9, [rcx + 0x18]
movsxd rdx, dword [rax + 0x10]
add rax, 0x10
movzx ecx, byte [rcx + 6]
mov r11d, r8d
cdqe
xor rax, rdx
shl r11d, cl
dec r11d
movsxd r8, r11d
and rax, r8
shl rax, 5
sub rax, qword [r9]
add rax, r9
add rsp, 0x18
ret
movsd xmm0, qword [rdx]
lea r10, [r11 + 0x18]
movsd qword [rsp + 0x28], xmm0
mov rax, qword [rsp + 0x28]
mov rdx, rax
shr rdx, 0x20
btr edx, 0x1f
mov ecx, edx
shr ecx, 0x12
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
movzx ecx, byte [r11 + 6]
mov eax, r9d
shr eax, 0x16
xor eax, edx
imul r8d, eax, 0x5bd1e995
mov eax, 1
shl eax, cl
dec eax
cdqe
mov ecx, r8d
shr ecx, 0x11
xor ecx, r9d
imul edx, ecx, 0x5bd1e995
shr edx, 0x13
xor edx, r8d
imul ecx, edx, 0x5bd1e995
movsxd rdx, ecx
and rax, rdx
shl rax, 5
sub rax, qword [r10]
add rax, r10
add rsp, 0x18
ret
mov ecx, dword [rdx + 8]
lea r10, [r11 + 0x18]
movsd xmm0, qword [rdx]
xor eax, eax
movsd qword [rsp], xmm0
mov r8d, dword [rsp]
cmp r8d, 0x80000000
mov edx, dword [rsp + 4]
cmove r8d, eax
cmp edx, 0x80000000
cmove edx, eax
cmp ecx, 0x80000000
cmove ecx, eax
mov eax, ecx
shr eax, 0x11
xor eax, ecx
imul eax, eax, 0x4f9ffb7
movsxd r9, eax
mov eax, r8d
shr eax, 0x11
xor eax, r8d
imul eax, eax, 0x466f45d
movsxd rcx, eax
mov eax, edx
shr eax, 0x11
xor r9, rcx
movzx ecx, byte [r11 + 6]
xor eax, edx
imul eax, eax, 0x127409f
mov r11d, 1
shl r11d, cl
dec r11d
movsxd rcx, r11d
cdqe
xor rax, r9
and rax, rcx
shl rax, 5
sub rax, qword [r10]
add rax, r10
add rsp, 0x18
ret
mov ecx, dword [rdx]
lea r9, [r11 + 0x18]
shr ecx, 0x10
xor ecx, dword [rdx]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
mov eax, 1
imul r8d, ecx, 0xc2b2ae35
movzx ecx, byte [r11 + 6]
shl eax, cl
dec eax
cdqe
mov edx, r8d
shr rdx, 0x10
movsxd rcx, r8d
xor rdx, rcx
and rax, rdx
shl rax, 5
sub rax, qword [r9]
add rax, r9
add rsp, 0x18
ret
lea rdx, [rcx + 0x18]
mov eax, 1
movzx ecx, byte [rcx + 6]
shl eax, cl
movsxd rcx, dword [r10]
dec eax
cdqe
and rax, rcx
shl rax, 5
sub rax, qword [rdx]
add rax, rdx
add rsp, 0x18
ret
Function at 0x180181f70
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x18048aea8]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor esi, esi
mov dword [rbp - 0x29], esi
call fcn.180393464
lea rcx, str.calibri_workspace
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], reloc.WS2_32.dll_recvfrom
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.18017fa10
nop
lea rcx, str.localappdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x180181fe0
call fcn.180393464
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rbx
lea r8, [rbp - 0x29]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.18017fa10
mov dword [rbp - 0x29], reloc.WS2_32.dll_ntohs
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.180180120
mov dword [rbp - 0x29], 0x1f
lea rdx, [rbp + 7]
lea rcx, [rbp + 0x27]
call fcn.18017fca0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x180182071
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018206c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18018206c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803940dc
movdqa xmm0, xmmword [0x18045d430]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], si
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x1801820c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801820c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801820c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803940dc
movdqa xmm0, xmmword [0x18045d430]
movdqu xmmword [rbp + 0x17], xmm0
mov word [rbp + 7], si
lea rcx, [rbp + 0x27]
call fcn.180181210
test al, al
jne 0x1801820fe
lea rcx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae rcx, qword [rbp + 0x27]
call fcn.18039394c
shr rax, 0x20
test eax, eax
jne 0x180182166
mov rdx, qword [rbp + 0x3f]
cmp rdx, 8
jb 0x180182141
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018213c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18018213c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803940dc
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180394080
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
lea r8, [rbp + 0x27]
mov edx, eax
lea rcx, str.create_directory
call fcn.180180ac0
int3
Function at 0x180182180
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x90
mov rsi, rcx
mov qword [rax - 0x18], rcx
xor ebp, ebp
mov dword [rax - 0x78], ebp
call fcn.180393464
lea rcx, str.calibri_workspace
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], reloc.WS2_32.dll_recvfrom
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.18017fa10
nop
lea rcx, str.localappdata
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdi, rax
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x1801821e6
call fcn.180393464
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.18017fa10
mov dword [rsp + 0x20], 0x1e
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.180180120
mov dword [rsp + 0x20], 0x3e
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.18017fca0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x18018227f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18018227a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18018227a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803940dc
movdqa xmm0, xmmword [0x18045d430]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], bp
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1801822d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801822d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1801822d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1803940dc
mov rax, rsi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret