joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141ddcc6c
Capabilities:
Encode data using xor

Disassembly:
xadd qword [rsp + r11 - 0x8280], rbx
lea rdi, [rdi + r11 - 0x827c]
mov qword [rsp + r11*4 - 0x20a00], rbp
ret
mov r8d, 0x530226ab
sar r8w, 0x24
jmp rbp
jns 0x141fca28f
ror r8b, 1
xadd ecx, edx
neg rsi
sbb rsi, rcx
neg r8b
ror rax, 0x3a
jae 0x141e34151
xchg r8b, sil
mov qword [rsp + r11*2 - 0xea], 0xffffffff9b81f1ae
mov r9, qword [rsp + r11*4 - 0x1cc]
movsxd rdx, edx
mov qword [rsp + r11*2 - 0xe2], rax
movsx ebx, si
xor r8w, 0x2d15
adc rbp, rdx
bt ax, 0x10
shl byte [rsp + r11 - 0x74], 0x21
mov si, word [rdi + r11*2 - 0xea]
mov bx, word [rdi + r11*2 - 0xe8]
sub byte [rsp + r11 - 0x6e], 0x2d
sub rax, r8
not si
not bx
shr dword [rsp + r11*2 - 0xe4], cl
and si, bx
lea rax, [r8 + rax*8 - 0x2cd6ca54]
pop r11
mov ax, si
rol byte [rsp + rcx - 0x200075], 0x61
movzx esi, r8b
xor cl, byte [rsp + rcx - 0x200071]
mov dx, word [rcx + rdi - 0x200071]
not cx
xchg qword [rsp + rcx*4 - 0x83fe28], r11
not ax
lea rbx, [r8 + rcx - 0x69599ef9]
add dword [rsp + r11*4 + 2], r8d
not dx
rol dword [rsp + r11*8 + 1], 0x91
jae 0x141daea3b
invalid
not r8b
rol r8b, 1
and rax, 0xfffffffff3147e3e
sbb dl, cl
xor r8b, 9
lea r11, [rcx + r11*2 - 0x3cf9e163]
xadd dx, r11w
neg r8b
and dx, 0x24b0
idiv rsi
xor r11d, ecx
xor r9b, r8b
sub sil, dl
cmovbe ax, cx
xadd al, sil
add r8, rsp
mov word [r8 + rdx*4 - 0x2d2627dc], bx
jmp 0x14195267d
and ax, dx
dec cx
rol word [rsp + r11*2 + 6], cl
sub r11w, r8w
mov word [rdi + r11 - 0x827c], ax
shl dword [rsp + rcx*4 - 0x83fe24], 0x61
js 0x1414c26c2

Function at 0x141e04315
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.141e32e74
movsx ebx, dx
or r8b, dl
lea r10, [r10 + rdx*4 - 0x80]
or rdx, 0x373d6624
movsx r11d, dx
xor esi, r9d
sub rbx, r8
bts r11w, 0x2a
movzx eax, r11w
lea esi, [rsi + rdx + 0x766d347e]
bswap esi
sub bx, 0xc394
inc ebx
neg esi
call fcn.141e4e612
mov rdx, qword [rdi + riz + 8]
lea rsi, [rcx*4 + 0x1b980606]
push rsi
shr word [rsp + 3], 0x46
mov cl, byte [rdi + riz + 0x10]
lea rbx, [rsi*2 + 0x1ba3a89e]
jbe 0x141d9df56
mov esi, 0xe12ec721
mov rax, qword [rdi + riz]
mov rcx, qword [rdi + riz + 8]
bt esi, 0x8b
adc rdi, 0x10
movzx edx, sil
mov r8d, edx
shl rsi, 0xef
mov qword [rdx + rax - 0x21], rcx
add esi, dword [rdx + r10 - 0x21]
jmp 0x141df4700

Function at 0x141e20515
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + rax*8 - 0x7fc00], r8
mov qword [rsp + rax - 0xff70], r9
lea rdx, [rax + r8*4 + 0x2a3aec21]
ror si, 0x4b
xor dword [rsp + rax*4 - 0x3fdf0], r11d
shl byte [rsp + rbx - 0x7777fab9], 0xc1
sar rax, 0xe2
lea r9, [rax + rbx*4 - 0x49d1734c]
mov r9, qword [rsp + rax + 0x10]
sal eax, cl
movsxd r11, r11d
adc rbp, r11
xadd byte [rsp + rax*2 + 7], dh
add rdx, qword [rsp + rax*2]
sub dl, 0xab
movzx esi, word [rax + r10 + 5]
lea r11, [rcx + rbx*2 + 0x391d1a12]
mov qword [rsp + rax + 0x10], rcx
lea r10, [r10 + rax + 7]
xor si, r9w
int1
inc si
rol dl, 0xa4
call fcn.1414f78d6
cmc
inc r11b
jp 0x141e2052d
loopne 0x141e205cb
push 0xffffffffffffffc3
cmp bl, byte [rdx - 0x1b36c920]
xchg edx, eax
invalid
sbb dl, cl
xor al, 0x4b
jp 0x141e20581
xchg ecx, eax
invalid
Function at 0x141e212f8
Capabilities:
Authenticate hmac

Disassembly:
not dl
jge 0x141fdfa07
mov qword [rsp], rbx
push rdx
mov qword [rsp + 8], r9
xor dword [rsp + 8], r8d
mov r9, qword [rsp + 8]
mov qword [rsp + 8], rdx
shr ebx, 0xa6
movsxd r8, r8d
adc rbp, r8
imul dx, bx
shr rbx, 0x4f
movzx edx, byte [r10 + rbx*8 - 0x3ce8]
lea r10, [r10 + rbx*2 - 0xf39]
sbb bx, 0xd301
shr bx, 0x89
xor dl, r9b
sub dword [rsp + rbx*2 - 0x28], ebx
or bx, bx
sar bx, 0xd
xor dl, 0x25
sar qword [rsp + rbx*8 + 3], 0xed
or bl, bl
ror dl, 1
rol bl, 0xc2
setae bl
adc dl, bl
pop rbx
sub bx, bx
jp 0x1414f3c2d
adc dl, byte [rdi - 2]
ret
sbb dl, 0x20
btc rbx, 0xa7
neg dl
xor r9b, dl
and byte [rsp + 5], bh
lea rbx, [rbx + rbx + 0x7792ba33]
mov qword [rsp], r10
push rbp
jge 0x141daa46b
adc rbp, r8
call fcn.141d9c380
movabs rsi, 0x3a1336ff65c3c3e1
and dword [rbp - 1], 0x36
xchg ecx, eax
mov edx, 0x36ff6543
xor byte [0x178fd5f89], cl
or eax, edx
push qword gs:[rsi]
mov esi, 0xff65d36a
cmp dword ss:[rdx], 0xffffffc3
push qword gs:[rsi]
int1
jb 0x141fdfa81
insd dword [rdi], dx
out 0x98, eax
adc al, 0xb8
sub al, 0x9d
movabs al, byte [0x6d356e4bcedbc90e]
jmp 0xc7c0b578
fcom qword [rsi + 0x7d]
invalid

Function at 0x141e2e4d8
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + r8 + 8], ebx
pop r9
mov r11d, ecx
sal r11b, 0x66
pop r9
bts rdx, 0x21
rol r11w, cl
add edx, r8d
movsxd rbx, ebx
adc rbp, rbx
or r11d, ecx
movzx ecx, byte [r8 + r10]
sal r11w, 0xa5
dec dx
lea r10, [r8 + r10 + 1]
dec sil
cmove rsi, r11
xor cl, r9b
lea r11, [r11*2 - 0x1d73a745]
xor cl, 0x8d
sar r8d, 0xfe
xadd dx, si
dec cl
not cl
btr rsi, rdx
mov ebx, 0xa9b98097
neg sil
adc cl, 0xac
neg r8b
xchg r8b, dl
movzx eax, bl
not cl
bt rdx, rbx
xadd esi, r11d
xadd esi, ebx
btr ax, bx
rol cl, 1
cbw
xor r9b, cl
fcom st(0)
shl dword [rsi - 0x68], 0x44
xor cl, cl
call fcn.141e13b32
sbb ah, byte [rcx + 0x7a95c3fe]
loopne 0x141e2e5a0
pop r12
movsd dword [rdi], dword [rsi]
jp 0x141e2e54f
adc byte ss:[rbx], ch
pop rbp
jp 0x141e2e555
outsd dx, dword ss:[rsi]
retf
cli
popfq
sub al, 0xad
sub al, 0x85
call 0x178916475
movabs al, byte [0x42a32cbf14e9dba1]
mov ds, word [rdi + 0x4e]
sbb dword [rsi + 0x78], esi
or eax, 0x5728d6d6
invalid

Function at 0x141e347aa
Capabilities:
Hash data using murmur3

Disassembly:
xchg byte [rsp + rcx + 0x433c], dl
inc bl
imul rsi, qword [rsp + rcx*2 + 0x8678]
setae byte [rsp + rcx*2 + 0x8679]
rol bl, 1
cwde
not bl
pop r8
xor rax, r8
rol bl, 1
xor r9b, bl
add rbx, rsp
and cl, 0x90
mul rsi
mov dx, word [rbx + rcx*2 + 0x8700]
lea rdi, [rdi + rcx + 0x437e]
mov word [rdi + rcx*8 + 0x21c00], dx
movzx ebx, r8b
jb fcn.1414bc614
mov qword [rsp + rcx + 0x433c], 0x29b0882f
movzx ebx, byte [r10 + rcx + 0x433c]
dec byte [rsp + rcx*2 + 0x8679]
lea r10, [r10 + rcx + 0x433d]
lea rax, [r8 + rdx - 0x2cc4c342]
div qword [rsp + rcx + 0x433c]
rol qword [rsp + rcx + 0x433c], 0xd
xor bl, r9b
jmp 0x141de01d7
Function at 0x141fd9c7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.141d9df5b
mov ebx, 0x2f174aa4
mov r11d, dword [r10 + rbx - 0x2f174aa4]
sar rbx, 0xe
xor r11d, r9d
jmp 0x141e57a63
push 0xffffffffe22f2c83
mov rax, qword [rbp + rbx*8 + 0x20]
inc qword [rsp]
mov qword [rsp], rax
call fcn.141e20356
cmp ebx, 4
mov qword [rsp], 0xffffffff8f2f2bac
push 0x7ab2311f
lea rsp, [rsp + 0x10]
jne 0x1414e776c
jmp 0x1414e3e4d

Function at 0x141fee4e3
Capabilities:
Encode data using xor

Disassembly:
xor dword [rsp + r8 - 0x6251], ecx
cwde
btc bx, r11w
jb 0x141df4033
mov qword [rsp + r8*2 - 0xc4a0], r8
dec ecx
ror word [rsp + r8*4 - 0x1893f], 0xa8
not ecx
sub dl, 0x30
lea r11, [rax + rsi + 0x3aacb4ab]
btc r8w, ax
dec ecx
not qword [rsp + rbx*8 - 0x17010]
neg dword [rsp + r8 - 0x6251]
bswap ecx
sar word [rsp + r8 - 0x624c], 0xef
mov qword [rsp + r8 - 0x6251], r9
js 0x1414e3ed5
not r11w
inc esi
add dl, r11b
push r9
idiv r11b
mov r9d, eax
xor dword [rsp + rcx - 5], esi
xor bl, 0xa4
setae dl
pop r9
mul r8w
dec dx
and bx, 0x4d04
movsxd rsi, esi
bswap edx
adc rbp, rsi
btr rbx, r11
movd ecx, xmm1
lea rsi, [r8 + r8*4 + 0x7b4e69f]
sub sil, r11b
or eax, 0xe6acc1b8
lea rdi, [rdi + rbx + 0x6a4ebaf8]
btc ax, ax
not r11d
lea rbx, [rax + rax*8 - 0x53f77c66]
mov dword [rdi + riz], ecx
mov ecx, r8d
rol rbx, 0x38
jae fcn.1414bc614
Function at 0x1400064a0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1401bb040]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x1401c0920]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1400066be
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400066be
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x1401c0920]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x140006574
movsx rdx, word [r8 + 0x6938]
lea rax, [r8 + 0x693c]
mov r9d, dword [r8 + 0x3fd0]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x140006569
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6938], cx
movsx rax, cx
lea rax, [rax*8 + 0x693c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6930]
test rdi, rdi
je 0x140006591
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x140006594
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140092248]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x1400065d7
mov rsi, qword [r8 + 0x90]
jmp 0x1400065da
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140006605
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x1401c0920]
mov rcx, qword [rax + 0x4b88]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14000667e
inc rbx
cmp rbx, 5
jl 0x140006660
jmp 0x1400066aa
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x1400066c0
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006fc80
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14000aa20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000aa7d
lea rbx, [0x140093730]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000aa64
cmp r10, 2
jb 0x14000aa64
cmp byte [r9], r8b
jne 0x14000aa64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000aa40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000aabf
lea rbx, [0x140093730]
cmp r8b, 0x23
jne 0x14000aaa3
cmp byte [r9], r8b
jne 0x14000aaa3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000aa90
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000ac80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x14000ac9e
mov qword [r8], r14
lea rdx, [0x140093240]
call fcn.14000aad0
mov rbx, rax
test rax, rax
jne 0x14000acc3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000adef
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000adef
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000adef
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000adef
cmp rdi, 0xffffffffffffffff
je 0x14000adef
mov rcx, rdi
call fcn.14000ea10
mov rbp, rax
test rax, rax
je 0x14000adef
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000addc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x1401c0920]
test r8, r8
je 0x14000add1
movsx rdx, word [r8 + 0x6938]
lea rcx, [r8 + 0x693c]
mov r9d, dword [r8 + 0x3fd0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x14000adc6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6938], cx
movsx rax, cx
lea rcx, [r8 + 0x693c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x6934]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000adf8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14000adea
mov qword [rsi], rdi
mov rax, rbp
jmp 0x14000adfa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400183e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x140093730]
movsxd rcx, dword [rcx + 0x100]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x108]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x40c4], ebx
jne 0x140018474
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140022a20
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140018490
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x120]
lea r10, [0x140093730]
mov rax, qword [rcx + 0x108]
movss xmm1, dword [rcx + 0x124]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0x100]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x14001c390
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1401bb040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401c0920]
mov edi, ecx
cmp byte [rbx + 0x4d9d], 0
jne 0x14001c3f1
cmp byte [rbx + 0x4d9e], 0
jne 0x14001c3f1
movsx r9d, word [rbx + 0x6700]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000a800
test dil, 2
je 0x14001c51f
jmp 0x14001c47c
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x6700]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1401aaf24]
mov edx, 0x10
mulss xmm1, dword [0x1401aaf0c]
addss xmm0, dword [rbx + 0xf8]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a90], rax
mov dword [rbx + 0x4a7c], 1
movss dword [rbx + 0x4a88], xmm0
movss dword [rbx + 0x4a8c], xmm1
movss xmm0, dword [rbx + 0x3a30]
mulss xmm0, dword [0x1401aae88]
or dword [rbx + 0x4a78], 0x41
movss dword [rbx + 0x4ad8], xmm0
call fcn.14000a800
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001c4d0
lea r11, [0x140093730]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001c4b3
cmp byte [r8], r9b
jne 0x14001c4b3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001c4a0
not ecx
call fcn.140012410
test rax, rax
je 0x14001c51f
cmp byte [rax + 0xbe], 0
je 0x14001c51f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc6], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x6700]
movsx r9d, word [rbx + 0x6700]
call fcn.14000a800
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140015090
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14006fc80
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140021250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6858], 0
lea rbx, [rcx + 0x6860]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400212f7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400212aa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140023bb0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000b300
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6858]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6868]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1401c0918]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400212ff
mov rcx, rbx
call fcn.14000b300
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140021620
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x1401c0920]
xor ebp, ebp
cmp byte [rbx + 0x67b0], bpl
jne 0x1400216ff
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400216f8
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.14000ac80
mov rsi, rax
test rax, rax
je 0x1400216f8
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140021684
mov rcx, rax
call fcn.140021850
mov r8, qword [0x1401c0920]
test r8, r8
je 0x1400216ef
movsx rdx, word [r8 + 0x6938]
lea rcx, [r8 + 0x693c]
mov r9d, dword [r8 + 0x3fd0]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1400216e4
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6938], cx
movsx rax, cx
lea rcx, [r8 + 0x693c]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x6934]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x67b0], 1
movss xmm0, dword [rbx + 0x67b4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14002178e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x67b4], xmm0
jb 0x14002178e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140021781
mov rax, qword [0x1401c0920]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x67b4], ebp
call fcn.140021aa0
lea rdx, [0x140093244]
mov rcx, rdi
mov rsi, rax
call fcn.14000aad0
mov rdi, rax
test rax, rax
je 0x140021788
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140021788
mov byte [rbx + 0xd0], 1
mov dword [rbx + 0x67b4], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400217b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1401c0920]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140021813
mov qword [rsp], rbx
lea rbx, [0x140093730]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400217f3
cmp byte [r8], r9b
jne 0x1400217f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400217e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x67c8]
not eax
mov r8, qword [r10 + 0x67d0]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14002183f
cmp dword [r8 + 8], eax
je 0x140021846
add r8, 0x48
cmp r8, rcx
jne 0x140021830
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret