joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467580
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404463
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a440
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404440
cmp byte [0x006ec94d], 0
je 0x467595
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4647c0
jmp 0x404440

Function at 0x4675a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006ecc80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006ec94d], 0
je 0x4675d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006ecfa0]
aesenc xmm0, xmmword [0x006ecfb0]
aesenc xmm0, xmmword [0x006ecfc0]
movq rax, xmm0
ret
jmp 0x40a660

Function at 0x4675e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006ecc80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006ec94d], 0
je 0x467616
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006ecfa0]
aesenc xmm0, xmmword [0x006ecfb0]
aesenc xmm0, xmmword [0x006ecfc0]
movq rax, xmm0
ret
jmp 0x40a6c0

Function at 0x4693a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4693d4
mov rcx, 0x28
jmp 0x4693df
shl rcx, 3
add rcx, 0x1480
mov qword [0x006ecb78], rcx
pop rbp
ret
Function at 0x4740e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4741aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403940
xorps xmm15, xmm15
mov r14, qword [0x006ecb78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47418f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d3f60]
xor ebx, ebx
mov rcx, rdx
call fcn.0044c880
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00474940
inc rbx
cmp rcx, rbx
jae 0x47417e
mov edi, 1
lea rsi, [0x004d3f60]
call fcn.0044c960
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00521f78]
lea rsi, [0x00521590]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004740e0
Function at 0x4adae0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4adbb5
movdqa xmm0, xmmword [0x005216b0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4adb21
movdqa xmm0, xmmword [0x005216c0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4adc37
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4adc0b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00521530]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005216d0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret

Function at 0x4b2b20
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b325f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4b2b4d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4b2dd1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4b2dfd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00523ca0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004d3e60]
lea rbx, [0x00521d30]
call fcn.00437280
inc rax
cmp rax, r8
jge 0x4b2e22
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4b2e57
lea rdi, [0x004d3ee0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4b2b43
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4b2e3b
jmp 0x4b2e10
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00465780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004b2b20
Function at 0x4b3400
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4b3417
inc rax
cmp rax, 4
jge 0x4b342f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4b3414
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4b3440
inc rax
cmp rax, 4
jge 0x4b344e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4b3477
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4b345b
jmp 0x4b343d

Function at 0x4b51e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b52dc
push rbp
mov rbp, rsp
sub rsp, 0x38
mov qword [rsp + 0x48], rax
lea r8, [rsi + rdi]
test rsi, rsi
cmovge rbx, r8
cmp rcx, rbx
jb 0x4b52d0
cmp rdi, rbx
ja 0x4b52c5
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rcx
sub rcx, rdi
mov rsi, rbx
sub rbx, rdi
mov r8, rcx
neg rcx
sar rcx, 0x3f
and rcx, rdi
add rax, rcx
mov qword [rsp + 0x30], rax
sub rsi, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], r8
mov byte [rsp + 0x18], 0
call fcn.00403920
xorps xmm15, xmm15
mov r14, qword [0x006ecb78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xffffffffffffffff
mov rax, qword [rsp + 0x28]
cmove rcx, rax
mov rax, qword [rsp + 0x60]
lea rdx, [rcx + rax]
mov rbx, qword [rsp + 0x58]
cmp rbx, rdx
jb 0x4b52b7
cmp rax, rdx
ja 0x4b52af
xor eax, eax
mov rbx, qword [rsp + 0x30]
nop
call fcn.004509a0
xor ecx, ecx
xor edi, edi
add rsp, 0x38
pop rbp
ret
mov rcx, rdx
call fcn.00467b20
mov rcx, rdx
mov rdx, rbx
nop dword [rax]
call fcn.00467ae0
mov rax, rdi
mov rcx, rbx
call fcn.00467b20
mov rdx, rcx
mov rcx, rbx
call fcn.00467ae0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
call fcn.00465780
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
jmp fcn.004b51e0
Function at 0x1400090c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000911d
lea rbx, [0x140054fe0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140009104
cmp r10, 2
jb 0x140009104
cmp byte [r9], r8b
jne 0x140009104
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400090e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000915f
lea rbx, [0x140054fe0]
cmp r8b, 0x23
jne 0x140009143
cmp byte [r9], r8b
jne 0x140009143
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140009130
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140009320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x14000933e
mov qword [r8], r14
lea rdx, [0x14005a760]
call fcn.140009170
mov rbx, rax
test rax, rax
jne 0x140009363
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14000948d
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000948d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000948d
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000948d
cmp rdi, 0xffffffffffffffff
je 0x14000948d
mov rcx, rdi
call fcn.14000dce0
mov rbp, rax
test rax, rax
je 0x14000948d
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000947a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x140064800]
test r8, r8
je 0x14000946f
movsx rdx, word [r8 + 0x6130]
lea rcx, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140009464
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rcx, [r8 + 0x6134]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x612c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140009496
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x140009488
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140009498
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140010e80
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140064008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140064800]
mov ebp, edx
mov r10, rcx
mov r9d, dword [rdi + 0x4a50]
mov rbx, qword [rdi + 0x4040]
bts r9d, 8
mov dword [rdi + 0x4a50], r9d
mov dword [rdi + 0x4a88], 1
cmp qword [rbx + 0x1c0], 0
jne 0x140010ef7
cmp qword [rdi + 0x4e50], 0
mov eax, 0x268
je 0x140010efc
mov eax, 0x238
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x11c]
subss xmm2, dword [rbx + 0x118]
mov rdx, qword [r8]
call fcn.14001ab80
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rdi + 0x4a70], xmm0
xor edx, edx
mov dword [rdi + 0x4a50], r9d
mov dword [rdi + 0x4a58], 1
mov r9, qword [rbx + 8]
test r10, r10
je 0x140010f6e
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.140008f20
jmp 0x140010f7e
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.140008f20
mov rcx, qword [rsp + 0x30]
xor edx, edx
movss xmm6, dword [rdi + 0x3918]
mov r8d, 0x1000107
call fcn.140014040
mov rsi, qword [rdi + 0x4040]
movzx r14d, al
movss dword [rdi + 0x3918], xmm6
cmp word [rsi + 0xd8], 1
mov dword [rsi + 0x90], ebp
jne 0x140010fc8
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x118], xmm0
mov r9d, ebp
lea rdx, [0x1400599c1]
not r9d
lea r10, [0x140054fe0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x140010ff5
cmp byte [rdx], r8b
jne 0x140010ff5
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x140010fe2
not ebx
cmp dword [rdi + 0x40ac], ebx
jne 0x140011025
xor edx, edx
xor ecx, ecx
call fcn.14000d680
cmp dword [rdi + 0x4b7c], ebp
jne 0x14001106a
cmp word [rsi + 0x174], 0
jne 0x140011040
cmp byte [rsi + 0x17a], 0
je 0x14001106a
xor edx, edx
mov rcx, rsi
call fcn.140016a60
xor edx, edx
mov rcx, rsi
call fcn.14001d890
mov rdx, rsi
mov ecx, ebx
call fcn.14000d680
mov eax, dword [rdi + 0x4bb0]
mov dword [rdi + 0x40d8], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140051a40
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x140017540
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
lea r11, [0x140054fe0]
mov rax, qword [rcx + 0x110]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4094], ebx
jne 0x1400175d6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140022730
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400175e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x110]
lea r9, [0x140054fe0]
movss xmm2, dword [rcx + 0x128]
movss xmm3, dword [rcx + 0x12c]
movsxd rcx, dword [rcx + 0x108]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14001b940
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140064008]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140064800]
mov edi, ecx
cmp byte [rbx + 0x4d85], 0
jne 0x14001b9a1
cmp byte [rbx + 0x4d86], 0
jne 0x14001b9a1
movsx r9d, word [rbx + 0x5ef8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140008ea0
test dil, 2
je 0x14001bacf
jmp 0x14001ba2a
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5ef8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14005b704]
mulss xmm1, dword [0x14005b6f8]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xf8]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a68], rax
mov dword [rbx + 0x4a54], 1
movss dword [rbx + 0x4a60], xmm0
movss dword [rbx + 0x4a64], xmm1
movss xmm0, dword [rbx + 0x3a20]
mulss xmm0, dword [0x14005b654]
or dword [rbx + 0x4a50], 0x41
movss dword [rbx + 0x4ab0], xmm0
call fcn.140008ea0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001ba80
lea r11, [0x140054fe0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x14001ba63
cmp byte [r8], r9b
jne 0x14001ba63
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001ba50
not ecx
call fcn.1400112a0
test rax, rax
je 0x14001bacf
cmp byte [rax + 0xca], 0
je 0x14001bacf
mov byte [rax + 0xcf], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd2], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xec], 1
mov edx, 0x10
inc word [rbx + 0x5ef8]
movsx r9d, word [rbx + 0x5ef8]
call fcn.140008ea0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140014040
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140051a40
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400211b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x6050], 0
lea rbx, [rcx + 0x6058]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140021257
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002120a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140023890
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140009a80
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x6050]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6060]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400647e4]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002125f
mov rcx, rbx
call fcn.140009a80
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400214c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140064800]
xor ebp, ebp
cmp byte [rbx + 0x5fa8], bpl
jne 0x14002159f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140021598
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.140009320
mov rsi, rax
test rax, rax
je 0x140021598
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140021524
mov rcx, rax
call fcn.1400216f0
mov r8, qword [0x140064800]
test r8, r8
je 0x14002158f
movsx rdx, word [r8 + 0x6130]
lea rcx, [r8 + 0x6134]
mov r9d, dword [r8 + 0x3f88]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140021584
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6130], cx
movsx rax, cx
lea rcx, [r8 + 0x6134]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x612c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x5fa8], 1
movss xmm0, dword [rbx + 0x5fac]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14002162e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x5fac], xmm0
jb 0x14002162e
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140021621
mov rax, qword [0x140064800]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x5fac], ebp
call fcn.140021950
lea rdx, [0x14005a764]
mov rcx, rdi
mov rsi, rax
call fcn.140009170
mov rdi, rax
test rax, rax
je 0x140021628
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x140021628
mov byte [rbx + 0xce], 1
mov dword [rbx + 0x5fac], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140021650
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140064800]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400216b3
mov qword [rsp], rbx
lea rbx, [0x140054fe0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140021693
cmp byte [r8], r9b
jne 0x140021693
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140021680
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5fc0]
not eax
mov r8, qword [r10 + 0x5fc8]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1400216df
cmp dword [r8 + 8], eax
je 0x1400216e6
add r8, 0x48
cmp r8, rcx
jne 0x1400216d0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret