joyce8/EMBER2024-capa huggingface dataset:
Function at 0x694430
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, ecx
movzx rsi, word [0x00694480]
mov ecx, 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x694454
or si, 1
mov ecx, 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x694468
or si, 4
test ebx, 0x20000000
je 0x694474
or si, 2
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6a2c00
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push rbp
sub rsp, 0x510
mov rbp, rsp
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x58], rbp
mov qword [rbp + 0x520], rcx
nop
mov rax, qword [rbp + 0x520]
cmp qword [rax + 0x80], 0
jne 0x6a2e32
mov rcx, qword [0x004d1068]
mov dl, 1
call fcn.00503010
mov rcx, qword [rbp + 0x520]
mov qword [rcx + 0x80], rax
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
call fcn.0040f550
mov ecx, 0x40
lea rdx, [rbp + 0x2f0]
call sub.user32.dll_GetKeyboardLayoutList
mov dword [rbp + 0x4fc], eax
xor rax, rax
mov ecx, dword [rbp + 0x4fc]
sub ecx, 1
mov dword [rbp + 0x3c], ecx
mov dword [rbp + 0x4f8], eax
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jg 0x6a2e0a
mov eax, dword [rbp + 0x3c]
add eax, 1
mov dword [rbp + 0x3c], eax
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + rax*8 + 0x2f0]
call fcn.005bfbb0
test al, al
je 0x6a2df4
movsxd rax, dword [rbp + 0x4f8]
lea rax, [rbp + rax*8 + 0x2f0]
mov qword [rbp + 0x48], rax
mov byte [rbp + 0x50], 0x10
lea rcx, [rbp + 0x70]
lea rdx, [0x006a2ec4]
lea r8, [rbp + 0x48]
xor r9, r9
call fcn.00432360
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x508]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x6a2df4
nop
mov dword [rbp + 0x4f4], 0x200
mov rcx, qword [rbp + 0x508]
lea rdx, [0x006a2f32]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0x4f4]
mov qword [rsp + 0x28], rax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x6a2de7
lea rcx, [rbp + 0x40]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004109b0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov rcx, rax
mov rdx, qword [rbp + 0x40]
movsxd r8, dword [rbp + 0x4f8]
mov r8, qword [rbp + r8*8 + 0x2f0]
mov rax, qword [rax]
call qword [rax + 0x80]
movsxd rax, dword [rbp + 0x4f8]
mov rcx, qword [rbp + 0x520]
mov rax, qword [rbp + rax*8 + 0x2f0]
cmp rax, qword [rcx + 0x90]
jne 0x6a2de7
mov rax, qword [rbp + 0x520]
lea rcx, [rax + 0x88]
lea rdx, [rbp + 0xf0]
mov r8d, pe_nt_image_headers64
call fcn.004109b0
nop
mov rcx, qword [rbp + 0x508]
call sub.advapi32.dll_RegCloseKey_1
add dword [rbp + 0x4f8], 1
mov eax, dword [rbp + 0x3c]
cmp dword [rbp + 0x4f8], eax
jne 0x6a2ca8
nop
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov byte [rax + 0x61], 0
mov rax, qword [rbp + 0x520]
mov rcx, qword [rax + 0x80]
mov dl, 1
call fcn.00502ec0
mov rax, qword [rbp + 0x520]
mov rax, qword [rax + 0x80]
mov qword [rbp + 0x500], rax
nop
lea rcx, [rbp + 0x40]
call fcn.0040f550
mov rax, qword [rbp + 0x500]
lea rsp, [rbp + 0x510]
pop rbp
ret
Function at 0x6a41c0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x007264e0]
cmp byte [rax + 0x159], 0
jne 0x6a4263
cmp qword [0x00726518], 0
jne 0x6a4206
call sub.kernel32.dll_GetCurrentThreadId_1
mov ecx, 3
mov rdx, qword [0x00717b58]
xor r8, r8
mov r9d, eax
call sub.user32.dll_SetWindowsHookExW
mov qword [0x00726518], rax
cmp qword [0x00726510], 0
jne 0x6a4228
xor rcx, rcx
xor rdx, rdx
xor r8, r8
xor r9, r9
call sub.kernel32.dll_CreateEventW
mov qword [0x00726510], rax
cmp qword [0x00726520], 0
jne 0x6a4263
xor rcx, rcx
mov edx, 0x3e8
mov r8, qword [0x00717b50]
xor r9, r9
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
call sub.kernel32.dll_CreateThread_1
mov qword [0x00726520], rax
add rsp, 0x48
ret

Function at 0x6a54b0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov rbx, rcx
cmp qword [rbx + 0x2d0], 0
je 0x6a5596
cmp dword [rbx + 0x128], 0
jne 0x6a558c
mov rax, qword [rbx + 0x2d0]
mov qword [rbp + 0x40], rax
mov byte [rbp + 0x48], dl
lea rcx, [0x006a5390]
lea rdx, [rbp + 0x40]
call sub.user32.dll_EnumWindows
mov rax, qword [rbx + 0x120]
cmp dword [rax + 0x10], 0
je 0x6a558c
mov rcx, qword [rbp + 0x40]
mov edx, 3
call sub.user32.dll_GetWindow
mov qword [rbp + 0x40], rax
mov rcx, qword [rbp + 0x40]
mov edx, 0xffffffec
call sub.user32.dll_GetWindowLongPtrW
test rax, 8
je 0x6a553a
mov qword [rbp + 0x40], 0xfffffffffffffffe
mov rax, qword [rbx + 0x120]
mov esi, dword [rax + 0x10]
sub esi, 1
test esi, esi
jl 0x6a558b
mov rcx, qword [rbx + 0x120]
mov edx, esi
call fcn.004fb5d0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x213
call sub.user32.dll_SetWindowPos
sub esi, 1
cmp esi, 0xffffffff
jne 0x6a554b
nop
lea rax, [rbx + 0x128]
add dword [rax], 1
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6a58e0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, rsp
mov rbx, rcx
mov esi, edx
mov rax, qword [0x007264e0]
cmp qword [rax + 0x2d0], 0
je 0x6a5aba
test sil, sil
jne 0x6a59d9
cmp dword [rbx + 0x138], 0
jne 0x6a59ca
mov rcx, rbx
call fcn.006aa020
lea rcx, [0x006a5780]
mov rdx, rax
call sub.user32.dll_EnumWindows
cmp qword [rbx + 0xa8], 0
je 0x6a598c
mov rax, qword [0x007264e0]
cmp byte [rax + 0x193], 0
je 0x6a598c
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
test rax, rax
je 0x6a5965
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6a598b
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
xor rdx, rdx
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a596d
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a59c9
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fb5d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a599d
nop
lea rax, [rbx + 0x138]
add dword [rax], 1
jmp 0x6a5aba
cmp dword [rbx + 0x138], 0
jle 0x6a5aba
lea rax, [rbx + 0x138]
sub dword [rax], 1
cmp dword [rbx + 0x138], 0
jne 0x6a5aba
cmp qword [rbx + 0xa8], 0
je 0x6a5a59
mov rax, qword [0x007264e0]
cmp byte [rax + 0x193], 0
je 0x6a5a59
mov rax, qword [rbx + 0x1a0]
mov qword [rbp + 0x20], rax
mov rax, qword [rbp + 0x20]
test rax, rax
je 0x6a5a2f
mov rax, qword [rax - 8]
lea rdi, [rax - 1]
test edi, edi
jl 0x6a5a58
mov rax, qword [rbx + 0x1a0]
movsxd rcx, edi
mov rcx, qword [rax + rcx*8]
mov edx, 5
call sub.user32.dll_ShowWindow
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5a37
nop
mov rax, qword [rbx + 0x130]
mov edi, dword [rax + 0x10]
sub edi, 1
test edi, edi
jl 0x6a5a96
mov rcx, qword [rbx + 0x130]
mov edx, edi
call fcn.004fb5d0
mov rcx, rax
test sil, sil
setne al
movzx rax, al
neg eax
mov edx, eax
call sub.user32.dll_ShowOwnedPopups
sub edi, 1
cmp edi, 0xffffffff
jne 0x6a5a6a
nop
mov rax, qword [rbx + 0x130]
mov rcx, rax
mov rsi, qword [rax]
call qword [rsi + 0x10]
lea rcx, [rbx + 0x1a0]
mov rdx, qword [0x0068f5d0]
call fcn.004127b0
lea rsp, [rbp + 0x38]
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x6a6cc0
Capabilities:
Get graphical window text

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x220
mov rbp, rsp
mov rbx, rcx
mov rsi, rdx
cmp byte [rbx + 0x158], 0
je 0x6a6d2f
cmp byte [rbx + 0x193], 0
jne 0x6a6d2f
mov rcx, qword [rbx + 0x2d0]
lea rdx, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
call sub.user32.dll_GetWindowTextW
mov rcx, rsi
lea rdx, [rbp + 0x20]
mov r8d, eax
call fcn.0040f810
xor rax, rax
cmp qword [rsi], 0
je 0x6a6d1a
mov rax, qword [rsi]
mov eax, dword [rax - 4]
test eax, eax
jne 0x6a6d3e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040fb80
jmp 0x6a6d3e
mov rcx, rsi
mov rdx, qword [rbx + 0x118]
call fcn.0040fb80
mov rax, rsi
lea rsp, [rbp + 0x220]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6b35a0
Capabilities:
Hide graphical window

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp qword [rbx + 0xc0], 0
jne 0x6b3656
mov rcx, qword [rbx + 0x10]
call fcn.005b5990
mov rcx, qword [0x005c8f18]
mov dl, 1
mov r8, rax
call fcn.005ac640
mov qword [rbx + 0xc0], rax
mov rsi, qword [rbx + 0xc0]
mov rcx, rsi
xor rdx, rdx
call fcn.005cfc70
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006b2bd0]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xc0]
call fcn.005b5990
mov rsi, rax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xc0]
call fcn.005b5990
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xe0], 0
jne 0x6b3701
mov rcx, qword [rbx + 0x10]
call fcn.005b5990
mov rcx, qword [0x005c8f18]
mov dl, 1
mov r8, rax
call fcn.005ac640
mov qword [rbx + 0xe0], rax
mov rsi, qword [rbx + 0xe0]
mov rcx, rsi
mov dl, 1
call fcn.005cfc70
lea rax, [rsi + 0x4b0]
mov qword [rax + 8], rbx
lea rcx, [0x006b2c30]
mov qword [rax], rcx
mov rcx, qword [rbx + 0xe0]
call fcn.005b5990
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xe0]
call fcn.005b5990
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
cmp qword [rbx + 0xd0], 0
jne 0x6b379d
mov rcx, qword [rbx + 0x10]
call fcn.005b5990
mov rcx, qword [0x005c9ef0]
mov dl, 1
mov r8, rax
call fcn.005ac640
mov qword [rbx + 0xd0], rax
mov rax, qword [rbx + 0xd0]
mov byte [rax + 0x480], 1
mov rcx, qword [rbx + 0xd0]
call fcn.005b5990
mov rsi, rax
mov ecx, 2
call sub.user32.dll_GetSystemMetrics
mov edi, eax
mov ecx, 3
call sub.user32.dll_GetSystemMetrics
mov rcx, rsi
xor rdx, rdx
xor r8, r8
xor r9, r9
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x30], 8
call sub.user32.dll_SetWindowPos
mov rcx, qword [rbx + 0xd0]
call fcn.005b5990
mov rcx, rax
xor rdx, rdx
call sub.user32.dll_ShowWindow
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x6b8de0
Capabilities:
Get common file path

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov ecx, 0x105
call fcn.004321f0
mov rsi, rax
mov ecx, 0x105
mov rdx, rsi
call sub.kernel32.dll_GetTempPathW
mov rcx, rbx
mov rdx, rsi
call fcn.00410980
mov rcx, rsi
call fcn.00432260
mov rax, rbx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6bbf90
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x50
mov rbp, rsp
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x40], 0
nop
xor rax, rax
mov byte [rbp + 0x37], al
lea rcx, [rbp + 0x40]
mov rdx, qword [0x006bbf58]
mov r8d, 1
mov r9d, 0x104
call fcn.004125d0
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x6bbfdc
mov rbx, qword [rbx - 8]
mov rcx, qword [rbp + 0x38]
call fcn.004108e0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, ebx
lea r9, [rbp + 0x4c]
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
test eax, eax
jne 0x6bc068
lea rcx, [rbp + 0x40]
mov rdx, qword [0x006bbf58]
mov r8d, 1
mov r9d, dword [rbp + 0x4c]
call fcn.004125d0
cmp dword [rbp + 0x4c], 0
jne 0x6bc021
mov al, 1
jmp 0x6bc04f
mov rbx, qword [rbp + 0x40]
test rbx, rbx
je 0x6bc02e
mov rbx, qword [rbx - 8]
mov rcx, qword [rbp + 0x38]
call fcn.004108e0
mov rcx, rax
mov rdx, qword [rbp + 0x40]
mov r8d, ebx
lea r9, [rbp + 0x4c]
call sub.kernel32.dll_GetVolumePathNamesForVolumeNameW
test eax, eax
sete al
test al, al
je 0x6bc068
lea rcx, [rbp + 0x40]
mov rdx, qword [0x006bbf58]
call fcn.004127b0
jmp 0x6bc120
mov rcx, qword [rbp + 0x28]
mov edx, dword [rbp + 0x4c]
call fcn.00410b40
xor rbx, rbx
mov rax, qword [rbp + 0x40]
movsxd rcx, ebx
cmp word [rax + rcx*2], 0
je 0x6bc0f5
mov esi, ebx
add ebx, 1
mov rax, qword [rbp + 0x40]
movsxd rcx, ebx
cmp word [rax + rcx*2], 0
jne 0x6bc087
xor rax, rax
mov rcx, qword [rbp + 0x28]
cmp qword [rcx], 0
je 0x6bc0af
mov rax, qword [rbp + 0x28]
mov rax, qword [rax]
mov eax, dword [rax - 4]
mov ecx, ebx
sub ecx, esi
cmp ecx, eax
jge 0x6bc0f0
mov rcx, qword [rbp + 0x28]
call fcn.0040fe30
mov rcx, qword [rbp + 0x40]
movsxd rdx, esi
lea rcx, [rcx + rdx*2]
mov rdx, rax
mov r8d, ebx
sub r8d, esi
add r8d, 1
add r8d, r8d
movsxd r8, r8d
call fcn.00409150
mov rcx, qword [rbp + 0x28]
mov edx, ebx
sub edx, esi
call fcn.00410b40
add ebx, 1
jmp 0x6bc0f8
add ebx, 1
mov rax, qword [rbp + 0x40]
movsxd rcx, ebx
cmp word [rax + rcx*2], 0
jne 0x6bc077
lea rcx, [rbp + 0x40]
mov rdx, qword [0x006bbf58]
call fcn.004127b0
mov al, 1
mov byte [rbp + 0x37], al
nop
lea rcx, [rbp + 0x40]
mov rdx, qword [0x006bbf58]
call fcn.004127b0
movzx rax, byte [rbp + 0x37]
lea rsp, [rbp + 0x50]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6cd0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.004108e0
mov rcx, rax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6cd0de
test eax, 0x10
jne 0x6cd0e3
xor rax, rax
jmp 0x6cd0e5
mov al, 1
add rsp, 0x28
ret
Function at 0x180009510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, r8
cmp rcx, 2
jne 0x1800095a6
movdqa xmm0, xmmword [rdx]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x180174750]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.180039370
test rdi, rdi
je 0x180009626
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x18000963f
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x180009737
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1800097b8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r8, r9
and r8, 7
je 0x180009744
xor r10d, r10d
movzx r11d, byte [rcx + r10]
xor rax, r11
imul rax, rdx
inc r10
cmp r8, r10
jne 0x180009600
add r8, rcx
cmp r9, 8
jae 0x18000974d
jmp 0x1800097b8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.180039370
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1800097b8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1800097b8
mov r8, rcx
cmp r9, 8
jb 0x1800097b8
add rcx, r9
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x180009750
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x180028bb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x180028dcd
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x180174b40]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x180028c20
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x180174b50]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x180028d4a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x180028d20
movdqa xmm1, xmmword [0x180174b50]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x180174b60], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x180028deb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.180028740
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180039370
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1800393b2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x1800393ba
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x1800393cb
jmp 0x1800393e2
xor r10d, r10d
jmp 0x18003946d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1800393e2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1800393f9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x180039419
add r11, r8
jmp 0x18003954a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1800394e2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x180039490
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x180039500
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x180039512
jmp 0x18003952c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x18003952c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x180039546
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x180050360
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1800503f6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x180174750]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.180039370
test rdi, rdi
je 0x180050485
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x18005049e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x180050596
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x180050618
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1800505a3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x180050460
cmp r9, 8
jae 0x1800505ac
jmp 0x180050618
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.180039370
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x180050618
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x180050618
mov r8, rcx
cmp r9, 8
jb 0x180050618
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1800505b0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret