joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004530
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.18003f400
sub rsp, rax
mov rax, qword [0x180097088]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov r10, r8
mov r9, rdx
mov r11, rcx
cmp rax, 0x10
jae 0x180004724
mov byte [rsp + rax + 0x50], 0
inc rax
cmp rax, 0x10
jb 0x180004561
xor r8b, r8b
xor edx, edx
mov qword [rsp + 0x70], rbx
lea rbx, str._.C
test r10, r10
je 0x1800045b4
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
movzx eax, r8b
xor rcx, rax
mov rax, rdx
inc rdx
movzx r8d, byte [rcx + rbx]
and eax, 0xf
mov byte [rsp + rax + 0x50], r8b
cmp rdx, r10
jb 0x180004590
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
test r10, r10
je 0x18000469a
lea rax, [rsp + 0x30]
sub r9, rax
add r9, 2
dec r10
shr r10, 4
inc r10
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
add rdx, r8
add r8, 4
movzx ecx, byte [rdx + r9 - 2]
movzx eax, byte [rdx - 0x10]
xor al, cl
mov byte [rdx], cl
movzx ecx, byte [rdx + r9 - 1]
mov byte [rdx + 0x10], al
movzx eax, byte [rdx - 0xf]
mov byte [rdx + 1], cl
xor al, cl
movzx ecx, byte [rdx + r9]
mov byte [rdx + 0x11], al
movzx eax, byte [rdx - 0xe]
mov byte [rdx + 2], cl
xor al, cl
movzx ecx, byte [rdx + r9 + 1]
mov byte [rdx + 0x12], al
movzx eax, byte [rdx - 0xd]
mov byte [rdx + 3], cl
xor al, cl
mov byte [rdx + 0x13], al
cmp r8, 0x10
jb 0x180004603
xor ecx, ecx
xor r8d, r8d
xor eax, eax
movzx edx, byte [rcx + rbx]
movzx ecx, byte [rsp + rax + 0x20]
inc rax
xor edx, ecx
mov byte [rsp + rax + 0x1f], dl
movzx ecx, dl
cmp rax, 0x2f
jb 0x180004662
lea rax, [rcx + r8]
inc r8
movzx ecx, al
cmp r8, 0x11
jb 0x180004660
add r9, 0x10
dec r10
jne 0x180004600
xor edx, edx
nop dword [rax]
movzx ecx, byte [rsp + rdx + 0x50]
movzx eax, byte [rsp + rdx + 0x20]
inc rdx
xor al, cl
mov byte [rsp + rdx + 0x2f], cl
mov byte [rsp + rdx + 0x3f], al
cmp rdx, 0x10
jb 0x1800046a0
xor eax, eax
xor r8d, r8d
nop word [rax + rax]
xor edx, edx
movzx ecx, byte [rax + rbx]
movzx eax, byte [rsp + rdx + 0x20]
inc rdx
xor ecx, eax
mov byte [rsp + rdx + 0x1f], cl
movzx eax, cl
cmp rdx, 0x2f
jb 0x1800046d2
add rax, r8
inc r8
movzx eax, al
cmp r8, 0x11
jb 0x1800046d0
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
mov qword [r11], rax
mov rax, qword [rsp + 0x28]
mov qword [r11 + 8], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18003e960
add rsp, 0x78
ret
call fcn.18003f558
int3
Function at 0x18000aaa0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x40
call fcn.18003f400
sub rsp, rax
mov rsi, qword [rdx]
lea r14, [rcx + 0x60]
mov rbx, rdx
mov edx, dword [r14]
mov rdi, rcx
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.180003c50
test rax, rax
je 0x18000ab23
mov rax, qword [rax]
test rax, rax
je 0x18000ab23
mov rax, qword [rax + 0x10]
cmp byte [rax + 4], 0
je 0x18000ab11
cmp byte [rbx + 0x1c], 0
je 0x18000ab11
mov edx, 1
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi + 0xf8]
lea r8, [rsp + 0x28]
xor r9d, r9d
call fcn.180003c50
test rax, rax
je 0x18000ab45
mov rax, qword [rax]
mov rdi, qword [rax + 0x10]
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdi + 8]
call qword [0x1800a7430]
cmp eax, 0x1f4
je 0x18000acbe
test eax, eax
je 0x18000ab7d
mov ecx, eax
call fcn.180003860
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x18
call fcn.18000ca20
test rax, rax
je 0x18000accb
mov edx, dword [rbx + 0x18]
mov r9, qword [rsp + 0x38]
movzx r8d, byte [rbx + 0x1c]
mov dword [rax], edx
lea rdx, [rsp + 0x28]
mov rcx, r14
mov byte [rax + 4], r8b
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.18000b350
mov ecx, dword [rdi + 0x60]
test ecx, ecx
jne 0x18000abe0
lea edx, [rcx + 1]
lea rcx, [rdi + 0x60]
call fcn.18000bac0
mov ecx, dword [rdi + 0x60]
test ecx, ecx
je 0x18000accb
mov r8, qword [rdi + 0x70]
test ecx, ecx
jne 0x18000abf3
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
jmp 0x18000ac82
movzx eax, byte [rsp + 0x21]
movzx ebp, sil
xor edx, edx
xor ebp, 0x811c9dc5
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x22]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x23]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x24]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x25]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x26]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x27]
imul ebp, ebp, 0x1000193
xor ebp, eax
imul ebp, ebp, 0x1000193
mov eax, ebp
div ecx
mov rax, qword [r8 + rdx*8]
lea rbx, [r8 + rdx*8]
test rax, rax
je 0x18000ac82
cmp qword [rax + 8], rsi
je 0x18000ac82
mov rbx, rax
mov rax, qword [rax]
test rax, rax
jne 0x18000ac71
cmp qword [rbx], 0
jne 0x18000acbe
mov ecx, 0x18
call fcn.18000ca20
test rax, rax
je 0x18000aca5
mov qword [rax], 0
mov qword [rax + 8], rsi
mov dword [rax + 0x10], ebp
mov qword [rbx], rax
test rax, rax
je 0x18000accb
inc qword [rdi + 0x68]
mov rdx, qword [rdi + 0x68]
lea rcx, [rdi + 0x60]
call fcn.18000bac0
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 2
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000d620
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x68
call fcn.18003f400
sub rsp, rax
lea rax, [rcx + 0x30]
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rbx, r8
mov rbp, rdx
mov qword [rsp + 0x38], rdx
xor edi, edi
mov qword [rsp + 0x48], rax
call fcn.18000c930
mov r14, qword [rbx + 0x10]
mov eax, dword [rbx]
lea rax, [r14 + rax*8]
mov r12d, edi
mov qword [rsp + 0x50], rax
cmp r14, rax
je 0x18000d689
cmp qword [r14], rdi
jne 0x18000d686
add r14, 8
cmp r14, rax
jne 0x18000d673
jmp 0x18000d860
mov r12, qword [r14]
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x60], r15
mov r15d, dword [rsp + 0x20]
nop dword [rax + rax]
test r12, r12
je 0x18000d853
mov rbx, qword [r12 + 8]
mov rbx, qword [rbx + 0x40]
test rbx, rbx
je 0x18000d820
nop dword [rax + rax]
mov r8, qword [rbx]
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbp
call fcn.18000b2d0
test eax, eax
jne 0x18000d851
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x18000d80e
mov ecx, dword [rsi + 0x58]
mov rbp, qword [r13 + 8]
mov qword [rsp + 0x28], rbp
test ecx, ecx
jne 0x18000d710
lea edx, [rax + 1]
lea rcx, [rsi + 0x58]
call fcn.18000ddd0
mov ecx, dword [rsi + 0x58]
test ecx, ecx
je 0x18000d84a
mov r8, qword [rsi + 0x68]
test ecx, ecx
je 0x18000d7c1
movzx eax, byte [rsp + 0x29]
movzx r15d, bpl
xor edx, edx
xor r15d, 0x811c9dc5
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2a]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2b]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2c]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2d]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2e]
imul r15d, r15d, 0x1000193
xor r15d, eax
movzx eax, byte [rsp + 0x2f]
imul r15d, r15d, 0x1000193
xor r15d, eax
imul r15d, r15d, 0x1000193
mov eax, r15d
div ecx
mov rax, qword [r8 + rdx*8]
lea rdi, [r8 + rdx*8]
test rax, rax
je 0x18000d7c1
nop dword [rax + rax]
cmp qword [rax + 8], rbp
je 0x18000d7c1
mov rdi, rax
mov rax, qword [rax]
test rax, rax
jne 0x18000d7b0
cmp qword [rdi], 0
jne 0x18000d802
mov ecx, 0x20
call fcn.18000ca20
test rax, rax
je 0x18000d7e9
mov qword [rax], 0
mov qword [rax + 8], rbp
mov qword [rax + 0x10], r13
mov dword [rax + 0x18], r15d
mov qword [rdi], rax
test rax, rax
je 0x18000d84a
inc qword [rsi + 0x60]
mov rdx, qword [rsi + 0x60]
lea rcx, [rsi + 0x58]
call fcn.18000ddd0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x20]
xor edi, edi
mov rbx, qword [rbx + 0x50]
test rbx, rbx
jne 0x18000d6c0
mov rax, qword [rsp + 0x50]
mov r12, qword [r12]
test r12, r12
jne 0x18000d6a9
nop dword [rax]
add r14, 8
cmp r14, rax
je 0x18000d6a0
mov r12, qword [r14]
test r12, r12
je 0x18000d830
jmp 0x18000d6a0
mov edi, 2
jmp 0x18000d853
mov edi, eax
mov r13, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
call fcn.18000ca00
mov eax, edi
add rsp, 0x68
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000f5c0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x180097088]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor eax, eax
mov dword [rsp + 0x20], 0x6a09e667
mov rbx, rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x50], rax
lea r8, [r8*8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x24], 0xbb67ae85
mov dword [rsp + 0x28], 0x3c6ef372
mov dword [rsp + 0x2c], 0xa54ff53a
mov dword [rsp + 0x30], 0x510e527f
mov dword [rsp + 0x34], 0x9b05688c
mov dword [rsp + 0x38], 0x1f83d9ab
mov qword [rsp + 0x3c], 0x5be0cd19
call fcn.18000f680
mov r9b, 1
lea rcx, [rsp + 0x20]
mov r8b, 0x81
mov rdx, rbx
call fcn.18000f360
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.18003e960
add rsp, 0xb0
pop rbx
ret
Function at 0x18002a8f0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
test ecx, ecx
jle 0x18002a9d4
mov qword [rsp + 0x40], rbx
movsxd rbx, ecx
cmp ecx, 0x64
jle 0x18002a964
imul rax, rbx, 0xfffffffffffffff6
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x58], rax
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
xor r9d, r9d
lea rdx, [rsp + 0x58]
mov rbx, rax
xor r8d, r8d
xor eax, eax
mov rcx, rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
lea rcx, [rsp + 0x68]
movaps xmmword [rsp + 0x30], xmm6
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
movss xmm6, dword [0x18006d56c]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x58]
xorps xmm1, xmm1
sub rax, qword [rsp + 0x60]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [rsp + 0x68]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
mulss xmm1, xmm6
cvttss2si rax, xmm1
cmp rax, rbx
jl 0x18002a987
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
Function at 0x18004a058
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x180049f2f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180049f2f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180049f2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x180049f2f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x180049f2f
cmp dword [rcx + 0x84], 0xe
jbe 0x180049f2f
cmp dword [rcx + 0xf8], 0
je 0x180049f2f
mov ecx, ebx
call fcn.180049fd0
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180049dc0
cmp dword [rbp + 0x20], 0
je 0x180049f7c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180049f84
int3
xor r8d, r8d
xor edx, edx
jmp 0x180049ec8
Function at 0x1406f80b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406f8237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406f80e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f80c7
add dl, dl
jne 0x1406f80ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f814e
xor eax, eax
add dl, dl
jne 0x1406f80fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406f8205
add dl, dl
jne 0x1406f810e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f811b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f8128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f8135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406f8142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406f80d6
mov eax, 1
add dl, dl
jne 0x1406f815e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406f816b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f8153
sub eax, ebx
mov ebx, 1
jne 0x1406f81a4
mov ecx, 1
add dl, dl
jne 0x1406f8186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f8193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f817b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f80d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406f81c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406f81cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406f81b5
cmp eax, 0x7d00
jae 0x1406f81f3
cmp eax, 0x500
jb 0x1406f81ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f80d6
cmp eax, 0x7f
ja 0x1406f81f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406f80d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406f822a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406f80d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180004530
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180004556
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180004530
movzx edx, word [rdi + rbx*2]
mov ecx, eax
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
movzx ecx, dl
lea rdx, [0x18002b810]
shr eax, 8
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x180004590
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x1800045b6
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180004590
movsx edx, byte [rbx + rdi]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cl, 0x19
mov ecx, edx
lea rdx, [0x18002b810]
cmovbe r8d, r9d
or r8, rcx
xor r8, rax
shr eax, 8
movzx ecx, r8b
xor eax, dword [rdx + rcx*4]
add rsp, 0x20
pop rdi
ret

Function at 0x180004600
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x180004626
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
dec rcx
call fcn.180004600
movzx edx, word [rdi + rbx*2]
xor r8d, r8d
mov rbx, qword [rsp + 0x30]
mov r9d, 0x20
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea rcx, [0x18002b810]
cmovbe r8d, r9d
or r8, rdx
movzx edx, al
movzx r9d, r8b
xor r9, rdx
shr eax, 8
xor eax, dword [rcx + r9*4]
add rsp, 0x20
pop rdi
ret
Function at 0x180004670
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r15d, r15d
mov dword [rbp - 0x39], 0x7b3c5e82
mov rdi, r8
mov qword [rbp + 0x1f], r15
mov r14, rdx
mov dword [rbp - 0x35], 0xd74fb5a9
mov rsi, rcx
mov dword [rbp - 0x31], 0xc9cdf4e0
mov eax, 0x74c9
mov dword [rbp - 0x2d], 0x7888d4e0
lea r9d, [r15 + 0x2a]
mov dword [rbp - 0x29], 0xb50a02f
lea r8d, [r15 + 0x43]
mov dword [rbp - 0x25], 0x2224d013
lea rdx, [rbp - 0x39]
mov dword [rbp - 0x21], 0xab3147cf
lea rcx, [rbp - 9]
mov dword [rbp - 0x1d], 0x422b7b8c
mov dword [rbp - 0x19], 0x2d5c0ce6
mov word [rbp - 0x15], ax
mov word [rsp + 0x20], 0x4e
call fcn.1800047f0
lea rax, [rbp - 9]
mov qword [rdi], r15
mov qword [rbp - 0x11], rax
mov r8, 0xffffffffffffffff
mov rbx, qword [rbp - 0x11]
inc r8
cmp word [rbx + r8*2], r15w
jne 0x180004720
dec r8
cmp r8, 0xffffffffffffffff
jne 0x18000473a
mov eax, 0xffffffff
jmp 0x180004760
lea rcx, [r8 - 1]
mov rdx, rbx
call fcn.180004530
movzx edx, word [rbx + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx ecx, dl
lea rdx, [0x18002b810]
xor eax, dword [rdx + rcx*4]
not eax
mov ecx, eax
call fcn.180005ab0
test rax, rax
jne 0x180004776
mov rcx, rbx
call fcn.1800057a0
mov edx, 0x7afc5d9d
mov rcx, rax
call fcn.180005c90
test rax, rax
je 0x1800047c2
mov qword [rsp + 0x38], r15
lea rcx, [rbp + 0x1f]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov dword [rsp + 0x28], r15d
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], r15
lea r8d, [r9 + 1]
call rax
test eax, eax
jne 0x1800047c2
mov rcx, qword [rbp + 0x1f]
mov qword [rdi], rcx
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x1800047c4
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180006f50
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180004c60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x30]
mov rax, qword [rcx + 0x60]
cmp byte [rax + 2], bl
jne 0x180004ceb
cmp dword [rax + 0xb8], 2
jb 0x180004ceb
lea r9d, [rbx + 8]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x30]
lea edx, [rbx + 7]
lea rcx, [rbx - 1]
call fcn.180006b95
test eax, eax
jne 0x180004cd6
cmp qword [rsp + 0x30], rbx
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180006f50
add rsp, 0x40
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180006f50
add rsp, 0x40
pop rbx
ret
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180006f50
add rsp, 0x40
pop rbx
ret
Function at 0x180004d10
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, 1
call fcn.180004b80
mov rdi, rax
test rax, rax
je 0x180004ee5
mov qword [rsp + 0x48], rbp
mov edx, 0x100
mov qword [rsp + 0x50], r12
mov rcx, rax
mov qword [rsp + 0x20], r15
call fcn.180010d78
cmp eax, 7
jne 0x180004dcd
mov r10, 0xffffffffffffffff
inc r10
cmp word [rdi + r10*2], 0
jne 0x180004d55
dec r10
xor ebp, ebp
cmp r10, 0xffffffffffffffff
jne 0x180004d73
mov r9d, 0xffffffff
jmp 0x180004db8
lea rcx, [r10 - 1]
mov rdx, rdi
call fcn.180004600
movzx ecx, word [rdi + r10*2]
lea r12, [0x18002b810]
mov r9d, eax
mov rdx, rbp
mov r15d, 0x20
lea eax, [rcx - 0x41]
cmp ax, 0x19
cmovbe rdx, r15
or rdx, rcx
movzx ecx, r9b
movzx r8d, dl
xor r8, rcx
shr r9d, 8
xor r9d, dword [r12 + r8*4]
not r9d
mov esi, ebp
cmp r9d, 0x3fc856fc
setne sil
jmp 0x180004ec2
jbe 0x180004ec2
mov qword [rsp + 0x40], rbx
add eax, 0xfffffff9
mov r10, 0xffffffffffffffff
mov qword [rsp + 0x58], r14
mov rbx, r10
lea r14, [rdi + rax*2]
nop
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x180004df0
xor ebp, ebp
lea r12, [0x18002b810]
dec rbx
lea r15d, [rbp + 0x20]
cmp rbx, r10
je 0x180004e57
lea rcx, [rbx - 1]
mov rdx, r14
call fcn.180004600
movzx ecx, word [r14 + rbx*2]
mov edx, ebp
mov r11d, eax
lea eax, [rcx - 0x41]
cmp ax, 0x19
cmovbe edx, r15d
or rdx, rcx
movzx ecx, r11b
shr r11d, 8
movzx r8d, dl
xor r8, rcx
xor r11d, dword [r12 + r8*4]
not r11d
cmp r11d, 0x3fc856fc
jne 0x180004e57
mov esi, ebp
jmp 0x180004eb8
mov word [rdi + 0xe], bp
nop dword [rax + rax]
inc r10
cmp word [rdi + r10*2], bp
jne 0x180004e60
dec r10
cmp r10, 0xffffffffffffffff
je 0x180004eb8
lea rcx, [r10 - 1]
mov rdx, rdi
call fcn.180004600
movzx ecx, word [rdi + r10*2]
mov rdx, rbp
mov r11d, eax
lea eax, [rcx - 0x41]
cmp ax, 0x19
cmovbe rdx, r15
or rdx, rcx
movzx ecx, r11b
shr r11d, 8
movzx r8d, dl
xor r8, rcx
xor r11d, dword [r12 + r8*4]
not r11d
cmp r11d, 0x3fc856fc
cmove esi, ebp
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180004ef0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r15
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x180030010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r9d, 0x28
mov dword [rbp - 0x19], 0xb40ad43f
mov eax, 0xea6d
mov dword [rbp - 0x15], 0x2a5353bb
lea rdx, [rbp - 0x19]
mov dword [rbp - 0x11], 0x891aa915
lea rcx, [rbp + 0x17]
mov dword [rbp - 0xd], 0xaf14991a
lea r8d, [r9 - 0x1a]
mov dword [rbp - 9], 0xa91700d2
mov word [rbp - 5], ax
mov word [rsp + 0x20], 0x11
call fcn.180001690
lea rax, [rbp + 0x17]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x3f], rax
mov r8, rbx
mov rsi, qword [rbp + 0x3f]
nop
inc r8
cmp word [rsi + r8*2], 0
jne 0x180004f80
dec r8
lea r15, [0x18002b810]
mov edi, 0xffffffff
cmp r8, rbx
jne 0x180004fa3
mov eax, edi
jmp 0x180004fc4
lea rcx, [r8 - 1]
mov rdx, rsi
call fcn.180004530
movzx edx, word [rsi + r8*2]
mov ecx, eax
xor rdx, rcx
shr eax, 8
movzx r8d, dl
xor eax, dword [r15 + r8*4]
not eax
mov ecx, eax
call fcn.180005ab0
test rax, rax
jne 0x180004fda
mov rcx, rsi
call fcn.1800057a0
mov edx, 0x1bb06e09
mov rcx, rax
call fcn.180005c90
test rax, rax
je 0x1800050dd
lea r8, [rbp + 0x3f]
mov qword [rbp + 0x2f], 0
lea rdx, [rbp + 0x2f]
mov dword [rbp + 0x3f], 0
xor ecx, ecx
call rax
cmp dword [rbp + 0x3f], 3
je 0x1800050dd
mov r9d, 0x2a
mov dword [rbp - 1], 0x7b7c5e82
lea rdx, [rbp - 1]
mov dword [rbp + 3], 0xd749b5bf
lea rcx, [rbp - 0x19]
mov dword [rbp + 7], 0xc98ef4e8
mov dword [rbp + 0xb], 0x788dd4f4
lea r8d, [r9 + 0x19]
mov dword [rbp + 0xf], 0xb35a02f
mov word [rsp + 0x20], 0x4e
call fcn.180005110
lea rax, [rbp - 0x19]
mov qword [rbp + 0x2f], rax
mov rsi, qword [rbp + 0x2f]
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x180005062
dec rbx
cmp rbx, 0xffffffffffffffff
je 0x180005097
lea rcx, [rbx - 1]
mov rdx, rsi
call fcn.180004530
movzx edx, word [rsi + rbx*2]
mov ecx, eax
xor rdx, rcx
mov edi, eax
movzx r8d, dl
shr edi, 8
xor edi, dword [r15 + r8*4]
not edi
mov ecx, edi
call fcn.180005ab0
test rax, rax
jne 0x1800050ad
mov rcx, rsi
call fcn.1800057a0
mov edx, 0xb70a5108
mov rcx, rax
call fcn.180005c90
test rax, rax
je 0x1800050dd
lea rdx, [rbp + 0x37]
mov qword [rbp + 0x37], 0
xor ecx, ecx
call rax
cmp qword [rbp + 0x37], 0
jne 0x1800050dd
mov eax, 1
jmp 0x1800050df
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180006f50
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r15, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret