joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180039110
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
vmovss xmm2, dword [rcx + 0x120]
vmovss xmm0, dword [rdx]
vmovss xmm1, dword [rdx + 4]
mov rax, qword [rcx + 0x108]
lea r10, [0x1800e7720]
vmovss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
vsubss xmm4, xmm0, xmm2
vmovss xmm0, dword [rdx + 8]
vmovd r8d, xmm4
mov r9d, dword [rax + rcx*4 - 4]
not r9d
movzx ecx, r9b
shr r9d, 8
vsubss xmm5, xmm1, xmm3
vmovss xmm1, dword [rdx + 0xc]
vmovss dword [rsp], xmm4
movzx eax, byte [rsp]
xor rcx, rax
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
vsubss xmm0, xmm0, xmm2
vmovss dword [rsp + 4], xmm5
vmovss dword [rsp + 8], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 0xc], xmm2
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm5
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm2
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x180046cb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x180346a60]
mov edi, ecx
cmp byte [rbx + 0x4d01], 0
jne 0x180046d02
cmp byte [rbx + 0x4d02], 0
jne 0x180046d02
movsx r9d, word [rbx + 0x5e58]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1800352d0
test dil, 2
je 0x180046e2f
jmp 0x180046d8a
vmovss xmm1, dword [rbx + 0x39c4]
vmulss xmm0, xmm1, dword [0x1800ecffc]
vaddss xmm2, xmm0, dword [rbx + 0xe48]
vmulss xmm1, xmm1, dword [0x1800ecff0]
vaddss xmm0, xmm1, dword [rbx + 0xe4c]
movsx r9d, word [rbx + 0x5e58]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x49cc], 1
vmovss dword [rbx + 0x49dc], xmm0
vmovss dword [rbx + 0x49d8], xmm2
mov qword [rbx + 0x49e0], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3a20]
vmulss xmm1, xmm0, dword [0x1800ecf68]
or dword [rbx + 0x49c8], 0x41
mov edx, 0x10
vmovss dword [rbx + 0x4a28], xmm1
call fcn.1800352d0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180046de0
lea r11, [0x1800e7720]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x180046dc3
cmp byte [r8], r9b
jne 0x180046dc3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180046db0
not ecx
call fcn.18003d200
test rax, rax
je 0x180046e2f
cmp byte [rax + 0xbe], 0
je 0x180046e2f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5e58]
movsx r9d, word [rbx + 0x5e58]
call fcn.1800352d0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.18003fc40
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x18004c160
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180346a60]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18004c1c3
mov qword [rsp], rbx
lea rbx, [0x1800e7720]
nop dword [rax]
cmp r9b, 0x23
jne 0x18004c1a3
cmp byte [r8], r9b
jne 0x18004c1a3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18004c190
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f20]
not eax
mov r8, qword [r10 + 0x5f28]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18004c1ef
cmp dword [r8 + 8], eax
je 0x18004c1f6
add r8, 0x48
cmp r8, rcx
jne 0x18004c1e0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret

Function at 0x18004c200
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [0x1800e7220]
call fcn.180035590
mov rbx, rax
test rax, rax
je 0x18004c37c
mov qword [rsp + 0x30], rsi
mov rcx, rax
mov qword [rsp + 0x38], rdi
call fcn.18008ef60
mov esi, eax
cmp eax, 0xffffffff
je 0x18004c36a
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.18008f8ac
test eax, eax
jne 0x18004c36a
mov rcx, rbx
call fcn.18008ef60
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18004c36a
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18008f8ac
test eax, eax
jne 0x18004c36a
cmp rdi, 0xffffffffffffffff
je 0x18004c36a
mov rcx, rdi
call fcn.180039910
mov rsi, rax
test rax, rax
je 0x18004c36a
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.180092e6c
mov rcx, rbx
cmp rax, rdi
je 0x18004c2d1
call fcn.18008f5a4
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp fcn.1800399b0
call fcn.18008f5a4
test rdi, rdi
je 0x18004c2e6
mov rdx, rdi
mov rcx, rsi
call fcn.18004c390
mov r8, qword [0x180346a60]
test r8, r8
je 0x18004c353
movsx rdx, word [r8 + 0x6078]
lea rcx, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18004c348
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rcx, [r8 + 0x607c]
lea rcx, [rcx + rax*8]
xor eax, eax
mov dword [rcx], r9d
mov dword [rcx + 4], eax
inc word [rcx + 6]
inc dword [r8 + 0x6074]
mov rcx, rsi
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
jmp fcn.18008e058
mov rcx, rbx
call fcn.18008f5a4
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x18005f4a0
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180346a60]
test rax, rax
je 0x18005f4bb
mov rbx, qword [rax + 0x90]
jmp 0x18005f4bd
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x18005f4e8
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret
Function at 0x180064c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov rax, qword [0x180346a60]
xor r11d, r11d
mov rbx, qword [rax + 0x4dc8]
mov eax, dword [rbx + 4]
bt eax, 0x18
jae 0x180064c2c
mov ecx, dword [rbx + 0x6c]
mov edx, 1
cmp ecx, edx
cmovg cx, dx
jmp 0x180064c30
movzx ecx, r11w
mov r8, qword [rbx + 0x188]
mov word [rbx + 0x22a], cx
vxorps xmm1, xmm1, xmm1
vmovss xmm0, dword [r8 + 0x8c]
vucomiss xmm0, xmm1
jp 0x180064c57
movzx edx, r11w
je 0x180064c5a
movzx edx, cx
shr eax, 0x19
and ax, 1
mov word [rbx + 0x22c], dx
mov word [rbx + 0x226], ax
vmovss xmm0, dword [r8 + 0x90]
vucomiss xmm0, xmm1
jp 0x180064c84
jne 0x180064c84
movzx eax, r11w
mov word [rbx + 0x228], ax
xor al, 1
mov byte [rbx + 0x242], al
cmp r11w, cx
jge 0x180064d2a
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rdi, r11
nop word [rax + rax]
mov rsi, qword [rbx + 0x28]
movsx r8, word [rdi + rsi]
mov rdx, r8
cmp r8d, r11d
je 0x180064d0a
movsx eax, cx
cmp edx, eax
jl 0x180064d0a
movsx rax, word [rsi + rdx*2]
mov r10, rdx
mov r9, qword [rbx + 0x18]
imul r8, r8, 0x70
imul rdx, rax, 0x70
movzx eax, word [r8 + r9 + 0x52]
movzx ecx, word [rdx + r9 + 0x52]
mov word [rdx + r9 + 0x52], ax
mov word [r8 + r9 + 0x52], cx
mov rdx, qword [rbx + 0x28]
movzx eax, word [rdi + rdx]
movzx ecx, word [rdx + r10*2]
mov word [rdx + r10*2], ax
mov word [rdi + rdx], cx
movsx eax, word [rbx + 0x22a]
inc r11d
add rdi, 2
movzx ecx, ax
cmp r11d, eax
jl 0x180064cb0
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x1800657c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x180346a60]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
vmovss xmm3, dword [rbx + 0x34]
je 0x180065803
vaddss xmm3, xmm3, dword [rcx + 0x90]
lea rsi, [r9 + 0x110]
vmovss dword [rsi], xmm3
vmovss xmm0, dword [rcx + 0x88]
vaddss xmm2, xmm0, dword [rcx + 0x7c]
vsubss xmm0, xmm3, dword [r9 + 0x28]
vsubss xmm1, xmm0, dword [r9 + 0x154]
vmovss dword [r9 + 0x158], xmm1
vmovss dword [r9 + 0x114], xmm2
vmovss dword [r9 + 0x128], xmm3
vmovss dword [r9 + 0x118], xmm3
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x148], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x168], eax
vmovss dword [r9 + 0x22c], xmm2
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x228], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1cc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xc3], al
cmp byte [rbx + 0x68], 0
je 0x1800658ac
xor eax, eax
mov dword [rdi + 0x4978], eax
mov dword [rdi + 0x4980], eax
test dword [rcx + 4], 0x100000
je 0x1800658c0
mov r8d, 2
jmp 0x180065944
vmovss xmm4, dword [rbx + 0x20]
vmovss xmm3, dword [rbx + 0x24]
vmovss xmm2, dword [rbx + 0x28]
vmovss xmm1, dword [rbx + 0x2c]
vmovups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2a8]
vmovups xmmword [r9 + 0x248], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
vmovups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2a8]
mov rcx, qword [r10 + 0x1a0]
call fcn.180059520
cmp byte [rdi + 0x5fa8], 0
je 0x180065982
cmp byte [rbx + 0x68], 0
jne 0x180065982
xor r8d, r8d
lea rdx, [0x1800ecac4]
mov rcx, rsi
call fcn.18004bda0
mov dword [rdi + 0x5fd8], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180065df0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180346a60]
mov rcx, qword [rax + 0x4dc8]
mov r9, qword [rax + 0x4008]
vmovups xmm0, xmmword [r9 + 0x248]
vmovups xmmword [rcx + 0x170], xmm0
vmovss xmm4, dword [rcx + 0x150]
vmovss xmm3, dword [rcx + 0x154]
vmovss xmm2, dword [rcx + 0x158]
vmovss xmm1, dword [rcx + 0x15c]
vmovups xmm0, xmmword [rcx + 0x150]
mov rax, qword [r9 + 0x2a8]
vmovups xmmword [r9 + 0x248], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.180059520

Function at 0x180065ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180346a60]
mov rcx, qword [rax + 0x4dc8]
mov r10, qword [rax + 0x4008]
movsxd rax, dword [rcx + 0x74]
vmovss xmm4, dword [rcx + 0x170]
vmovss xmm3, dword [rcx + 0x174]
vmovss xmm2, dword [rcx + 0x178]
vmovss xmm1, dword [rcx + 0x17c]
vmovups xmm0, xmmword [rcx + 0x170]
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
vmovups xmmword [r10 + 0x248], xmm0
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.180059520

Function at 0x180068190
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x180346a60]
mov rdx, qword [rax + 0x4dc8]
cmp ecx, 0xffffffff
jne 0x1800681aa
cmp dword [rdx + 0x74], ecx
cmovne ecx, dword [rdx + 0x74]
cmp ecx, dword [rdx + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x180068227
mov r10d, dword [rdx]
lea r8, [0x1800ecb09]
movzx eax, word [rdx + 0x78]
lea r11, [0x1800e7720]
not r10d
mov word [rdx + 0x224], cx
mov ecx, r10d
mov byte [rdx + 0x23b], 1
mov word [rdx + 0x7a], ax
mov r9b, 0x23
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x180068203
cmp byte [r8], r9b
jne 0x180068203
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1800681f0
not ecx
jmp fcn.180046f90
ret
Function at 0x18006d5c0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rbx, qword [0x180346a60]
mov r14, rdx
movsxd r9, dword [rbx + 0x4ab0]
cmp dword [rbx + 0x4aa0], r9d
jle 0x18006d848
mov rax, qword [rbx + 0x4aa8]
imul r8, r9, 0x38
cmp dword [r8 + rax], ecx
jne 0x18006d848
vmovss xmm0, dword [rdx + 8]
mov eax, dword [rbx + 0x49c8]
xor esi, esi
mov qword [r11 + 8], rdi
vsubss xmm2, xmm0, dword [rdx]
vmovaps xmmword [r11 - 0x28], xmm6
vxorps xmm6, xmm6, xmm6
test al, 0x10
je 0x18006d642
vmovss xmm0, dword [rbx + 0x4a08]
vmaxss xmm1, xmm0, xmm2
vmovss dword [rbx + 0x4a08], xmm1
jmp 0x18006d696
vxorps xmm1, xmm1, xmm1
test al, 2
je 0x18006d654
vcomiss xmm6, dword [rbx + 0x49e8]
jb 0x18006d658
vmovaps xmm1, xmm2
vinsertps xmm1, xmm1, xmm6, 0x10
vinsertps xmm1, xmm1, dword [0x1800ed060], 0x20
vinsertps xmm1, xmm1, dword [0x1800ed060], 0x30
or eax, 0x10
mov qword [rbx + 0x4a18], rsi
vmovups xmmword [rbp - 1], xmm1
vmovups xmmword [rbx + 0x4a08], xmm1
mov dword [rbx + 0x49c8], eax
mov qword [rbx + 0x4a20], rsi
lea r8, str.Combo__02d
mov edx, 0x10
lea rcx, [rbp + 0xf]
call fcn.1800352d0
movzx r9d, byte [rbp + 0xf]
lea r8, [rbp + 0x10]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x18006d700
lea r11, [0x1800e7720]
nop dword [rax]
cmp r9b, 0x23
jne 0x18006d6e3
cmp byte [r8], r9b
jne 0x18006d6e3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18006d6d0
not ecx
call fcn.18003d200
mov rdi, rax
test rax, rax
je 0x18006d7df
cmp byte [rax + 0xbf], sil
je 0x18006d7df
lea r8, [rbp + 0x7f]
mov rcx, rax
lea rdx, [rbp - 1]
vmovss dword [rbp + 0x7f], xmm6
vmovss dword [rbp + 0x83], xmm6
call fcn.18003d980
mov rdx, rcx
lea r8, [rbp + 0x7f]
lea rcx, [rbp - 9]
call fcn.18003daa0
lea r8, [rbp - 9]
mov rdx, rdi
lea rcx, [rbp - 1]
call fcn.18003d810
lea r9, [rdi + 0xe0]
lea rcx, [rbp + 0x1f]
mov dword [r9], 3
call fcn.1800477d0
vmovss xmm0, dword [r14]
vmovss xmm1, dword [r14 + 0xc]
lea rax, [rbp + 0x1f]
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
lea r8, [rbp - 1]
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea rcx, [rbp - 9]
vmovss dword [rbp + 0x7f], xmm0
vmovss dword [rbp + 0x83], xmm1
call fcn.1800474b0
mov rax, qword [0x180346a60]
vmovsd xmm0, qword [rbp - 9]
or dword [rax + 0x49c8], 1
vmovsd qword [rax + 0x49d8], xmm0
mov qword [rax + 0x49e0], rsi
mov dword [rax + 0x49cc], 1
vmovss xmm0, dword [rbx + 0x392c]
vmovss xmm1, dword [rbx + 0x38fc]
lea rdx, [rbp + 0x7f]
mov ecx, 2
vmovss dword [rbp + 0x7f], xmm0
vmovss dword [rbp + 0x83], xmm1
call fcn.180036610
xor edx, edx
lea rcx, [rbp + 0xf]
mov r8d, 0x4000147
call fcn.18003fc40
mov ecx, 1
movzx ebx, al
call fcn.1800366a0
mov rdi, qword [rsp + 0xb0]
vmovaps xmm6, xmmword [rsp + 0x80]
test bl, bl
jne 0x18006d844
call fcn.180047440
jmp 0x18006d850
mov al, 1
jmp 0x18006d852
xor esi, esi
mov dword [rbx + 0x49c8], esi
xor al, al
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop r14
pop rsi
pop rbp
ret
Function at 0x180077800
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x18007788c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180077860
lea r11, [0x1800e7720]
nop
cmp r9b, 0x23
jne 0x180077843
cmp byte [r8], r9b
jne 0x180077843
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180077830
mov rcx, qword [0x180346a60]
not eax
cmp dword [rcx + 0x406c], eax
jne 0x180077877
mov dword [rcx + 0x4070], eax
cmp dword [rcx + 0x4098], eax
jne 0x1800778e9
mov byte [rcx + 0x409c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180346a60]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov rcx, rdi
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4008]
movsxd rax, dword [rbx + 0x100]
mov r8, qword [rbx + 0x108]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.1800354e0
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x4054], eax
jne 0x1800778e2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.18004d660
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18007c8f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov r10, rcx
mov eax, r11d
test r9b, r9b
je 0x18007c94b
mov qword [rsp], rbx
lea rbx, [0x1800e7720]
cmp r9b, 0x23
jne 0x18007c92b
cmp byte [r8], r9b
jne 0x18007c92b
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18007c918
mov rbx, qword [rsp]
movsxd rdx, dword [r10 + 0x90]
not eax
mov r9, qword [r10 + 0x98]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18007c9a1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18007c999
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18007c99c
mov rdx, r8
test rdx, rdx
jne 0x18007c970
cmp r9, r10
je 0x18007c9b4
cmp dword [r9], eax
jne 0x18007c9b4
mov eax, dword [r9 + 8]
add rsp, 8
ret
mov eax, 0xffffffff
add rsp, 8
ret

Function at 0x18007e690
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18007e8e0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18007e7aa
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007e6f4
mov rax, qword [0x180102008]
cmp qword [rsp + 0x20], rax
ja 0x18007e6f4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007e6b6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800aff10
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18007e725
jmp 0x18007e7aa
cmp dword [rsp + 0x50], 0x10000
jne 0x18007e78d
cmp qword [rsp + 0x48], 0x10000
jb 0x18007e78d
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007e76b
mov rax, qword [rsp + 0x28]
jmp 0x18007e7ac
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18007e77b
xor eax, eax
jmp 0x18007e7ac
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007e7a5
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18007e8e0
mov qword [rsp + 0x20], rax
jmp 0x18007e6b6
xor eax, eax
add rsp, 0x68
ret
Function at 0x18007e7c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18007e920
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18007e8d6
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18007e81b
mov rax, qword [0x180102008]
cmp qword [rsp + 0x20], rax
ja 0x18007e81b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18007e7dd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1800aff10
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x18007e84c
jmp 0x18007e8d6
cmp dword [rsp + 0x50], 0x10000
jne 0x18007e8b4
cmp qword [rsp + 0x48], 0x10000
jb 0x18007e8b4
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18007e892
mov rax, qword [rsp + 0x28]
jmp 0x18007e8d8
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x18007e8a2
xor eax, eax
jmp 0x18007e8d8
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18007e8d1
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18007e920
mov qword [rsp + 0x20], rax
jmp 0x18007e7dd
xor eax, eax
add rsp, 0x68
ret