joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092fc0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x140093008
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x140092fda
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a5ac0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400a5ae8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400a5b30
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400a5b00
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400a5b3c
call rbp
cmp dword [rax], 4
je 0x1400a5b00
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400b1fc0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0x80000000
mov dword [rbp - 0x18], 0x7fffffff
mov qword [rbp - 8], 0
jmp 0x1400b2052
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x24], eax
mov rax, qword [rbp - 8]
lea rdx, [rax + 0x18d]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x24]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x24]
and eax, 1
test eax, eax
je 0x1400b2039
mov eax, 0x9908b0df
jmp 0x1400b203e
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 8]
mov dword [rax + rdx*4], ecx
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0xe2
jbe 0x1400b1fe4
mov qword [rbp - 0x10], 0xe3
jmp 0x1400b20d4
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x80000000
mov ecx, eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax + 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
and eax, 0x7fffffff
or eax, ecx
mov dword [rbp - 0x20], eax
mov rax, qword [rbp - 0x10]
lea rdx, [rax - 0xe3]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov edx, dword [rbp - 0x20]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x20]
and eax, 1
test eax, eax
je 0x1400b20bb
mov eax, 0x9908b0df
jmp 0x1400b20c0
mov eax, 0
xor eax, edx
mov ecx, eax
mov rax, qword [rbp + 0x10]
mov rdx, qword [rbp - 0x10]
mov dword [rax + rdx*4], ecx
add qword [rbp - 0x10], 1
cmp qword [rbp - 0x10], 0x26e
jbe 0x1400b2066
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x9bc]
and eax, 0x80000000
mov edx, eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax]
and eax, 0x7fffffff
or eax, edx
mov dword [rbp - 0x1c], eax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x630]
mov edx, dword [rbp - 0x1c]
shr edx, 1
xor edx, eax
mov eax, dword [rbp - 0x1c]
and eax, 1
test eax, eax
je 0x1400b2121
mov eax, 0x9908b0df
jmp 0x1400b2126
mov eax, 0
xor edx, eax
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x9bc], edx
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x1400b2150
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov eax, dword [rbp + 0x18]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov dword [rdx], eax
mov qword [rbp - 8], 1
jmp 0x1400b21c8
mov rax, qword [rbp - 8]
lea rdx, [rax - 1]
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + rdx*4]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
shr eax, 0x1e
xor dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
imul eax, eax, 0x6c078965
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 8]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__624u__1u__0u__unsigned_int_
add dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, eax
call method.unsigned_int_std::__detail.__mod_unsigned_int__0u__1u__0u__unsigned_int_
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov dword [rdx + rcx*4], eax
add qword [rbp - 8], 1
cmp qword [rbp - 8], 0x26f
jbe 0x1400b2179
mov rax, qword [rbp + 0x10]
mov qword [rax + 0x9c0], 0x270
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1400b2220
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
cmp rax, 0x26f
jbe 0x1400b224b
mov rax, qword [rbp + 0x10]
mov rcx, rax
call sym._ZNSt23mersenne_twister_engineIjLy32ELy624ELy397ELy31ELj2567483615ELy11ELj4294967295ELy7ELj2636928640ELy15ELj4022730752ELy18EL
mov rax, qword [rbp + 0x10]
mov rax, qword [rax + 0x9c0]
lea rcx, [rax + 1]
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 0x9c0], rcx
mov rdx, qword [rbp + 0x10]
mov eax, dword [rdx + rax*4]
mov dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0xb
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shl eax, 0xf
and eax, 0xefc60000
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
shr eax, 0x12
xor dword [rbp - 4], eax
mov eax, dword [rbp - 4]
add rsp, 0x30
pop rbp
ret

Function at 0x1400b7700
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rcx, rdx
test rdx, rdx
js 0x1400b7718
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
call method.std.__throw_bad_alloc__
nop
nop
nop

Function at 0x1400ba2f0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rcx, 0x3fffffffffffffff
mov rax, qword [rdx]
cmp rcx, rax
jb 0x1400ba34b
lea r9, [rax + 1]
cmp r8, rax
jae 0x1400ba329
add r8, r8
cmp rax, r8
jae 0x1400ba329
cmp rcx, r8
jae 0x1400ba338
movabs r9, 0x4000000000000000
mov qword [rdx], rcx
mov rcx, r9
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
lea r9, [r8 + 1]
mov qword [rdx], r8
mov rcx, r9
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
lea rcx, [0x1400e3b30]
call method.std.__throw_length_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400bbbf0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, rdx
shr rax, 0x3e
jne 0x1400bbc10
lea rcx, [rdx + rdx]
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
test rdx, rdx
js 0x1400bbc20
call method.std.__throw_bad_alloc__
nop word [rax + rax]
call method.std.__throw_bad_array_new_length__
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400be3e0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
movabs rax, 0x1fffffffffffffff
mov rcx, qword [rdx]
cmp rax, rcx
jb 0x1400be441
cmp r8, rcx
jb 0x1400be410
add rcx, 1
add rcx, rcx
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
add r8, r8
cmp rcx, r8
jae 0x1400be3fb
cmp rax, r8
jae 0x1400be438
movabs rcx, 0x4000000000000000
mov qword [rdx], rax
add rsp, 0x28
jmp sym.operator_new_unsigned_long_long_
mov qword [rdx], r8
lea rcx, [r8 + 1]
jmp 0x1400be3ff
lea rcx, str.basic_string::_M_create
call method.std.__throw_length_error_char_const_
nop
nop
nop

Function at 0x1400d3120
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400d3178
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400d3150
and edx, 7
je 0x1400d31ad
sub edx, 1
movsxd rax, edx
xor edx, edx
nop dword [rax]
movzx ecx, byte [r11 + rax]
shl rdx, 8
sub rax, 1
add rdx, rcx
test eax, eax
jns 0x1400d3188
xor rdx, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rdx
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x1400d3d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x1400d3d5c
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400d3d48
ret

Function at 0x1400db5e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, 1
test rcx, rcx
cmovne rax, rcx
mov rbx, rax
mov rcx, rbx
call sym.malloc
test rax, rax
je 0x1400db607
add rsp, 0x20
pop rbx
ret
call method.std.get_new_handler__
test rax, rax
je sym.operator_new_unsigned_long_long___clone_cold_
call rax
jmp 0x1400db5f4

Function at 0x1400dbf70
Capabilities:
Write file on windows

Disassembly:
call sym.abort
mov rcx, rax
call sym.__cxa_begin_catch
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400dbf90
Capabilities:
Write file on windows

Disassembly:
mov ecx, 8
call sym.__cxa_allocate_exception
lea r8, [method.std::bad_alloc.bad_alloc__]
lea rdx, [0x1400ebde0]
mov rcx, rax
mov rax, qword [0x1400e86b0]
add rax, 0x10
mov qword [rcx], rax
call sym.__cxa_throw
nop
nop
Function at 0x1400dbfc0
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400dc03c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400dc02a

Function at 0x1400dd740
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400df860]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400df878], 0
movups xmmword [0x1400df868], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400dd7f5
jmp 0x1400dd89f
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400dd850
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x1400dd7e0
cmp qword [rbx + 7], r12
jne 0x1400dd7e0
cmp byte [rbx + 0xf], 0x2e
jne 0x1400dd7e0
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x1400dd83b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400dd845
cmp byte [rbx + rsi], 0x3d
je 0x1400dd8d5
add rbp, 0x18
cmp rbp, r13
jne 0x1400dd81f
jmp 0x1400dd7e0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400df878], rbx
jne 0x1400dd8af
lea rcx, [sym.__tcf_0_3]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400df878], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400df870], rax
test rax, rax
je 0x1400dd90c
xor edx, edx
mov qword [0x1400df868], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400dd887
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400dd8fc
test dl, dl
jne 0x1400dd7e0
test eax, eax
js 0x1400dd7e0
mov dword [rbp + 0x10], eax
jmp 0x1400dd7e0
xor ecx, ecx
mov qword [0x1400df878], rcx
jmp 0x1400dd887
Function at 0x180004290
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
lea rbx, [rcx + 0x58]
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18009d5d0]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x18000438e
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.180012330
mov rdi, rax
cmp rbx, rax
je 0x180004341
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x180004313
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000430e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004416
mov rcx, r8
call fcn.18006ddfc
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 7
mov word [rbx], ax
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 7
mov word [rdi], ax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004383
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000437e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004416
call fcn.18006ddfc
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
call fcn.18006c12c
lea rcx, [0x1800a88f0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0xa
lea r8, [rsp + 0x20]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.180003b40
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180003da0
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004405
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800043ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004410
call fcn.18006ddfc
nop
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.18007cf80
int3
call fcn.18007cf80
int3

Function at 0x18001b780
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18001b7dd
lea rbx, [0x1800a9e00]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18001b7c4
cmp r10, 2
jb 0x18001b7c4
cmp byte [r9], r8b
jne 0x18001b7c4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18001b7a0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18001b81f
lea rbx, [0x1800a9e00]
cmp r8b, 0x23
jne 0x18001b803
cmp byte [r9], r8b
jne 0x18001b803
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18001b7f0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18001b960
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001b97a
mov qword [r8], 0
lea rdx, [0x1800af574]
call fcn.18001b830
mov rbx, rax
test rax, rax
jne 0x18001b99a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.18007d620
mov esi, eax
cmp eax, 0xffffffff
je 0x18001ba68
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18007cb40
test eax, eax
jne 0x18001ba68
mov rcx, rbx
call fcn.18007d620
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001ba68
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18007cb40
test eax, eax
jne 0x18001ba68
cmp rdi, 0xffffffffffffffff
je 0x18001ba68
mov rax, qword [0x1800f8668]
test rax, rax
je 0x18001ba0a
inc dword [rax + 0x3b0]
mov rcx, rdi
call fcn.1800804e8
mov rsi, rax
test rax, rax
je 0x18001ba68
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18007c770
mov rcx, rbx
cmp rax, rdi
je 0x18001ba56
call fcn.1800787f8
mov rax, qword [0x1800f8668]
test rax, rax
je 0x18001ba4c
dec dword [rax + 0x3b0]
mov rcx, rsi
call fcn.18007c34c
jmp 0x18001ba70
call fcn.1800787f8
test r14, r14
je 0x18001ba63
mov qword [r14], rdi
mov rax, rsi
jmp 0x18001ba72
mov rcx, rbx
call fcn.1800787f8
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180027490
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1800f8668]
lea rdx, [0x1800a9e00]
mov r8, rcx
mov rbx, qword [rax + 0x1c08]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180027591
lea ecx, [r9 + 1]
test r8d, r8d
je 0x18002757d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180027582
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18002e880
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180028400
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1800f8668]
mov edi, edx
cmp byte [rbx + 0x1f75], 0
jne 0x180028451
cmp byte [rbx + 0x1f76], 0
jne 0x180028451
mov r9d, dword [rbx + 0x3054]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.18001b700
test dil, 1
je 0x180028576
jmp 0x1800284d9
movss xmm1, dword [rbx + 0x1610]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3054]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1800b195c]
mulss xmm1, dword [0x1800b194c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d08], rax
mov dword [rbx + 0x1cf4], 1
movss dword [rbx + 0x1d00], xmm0
movss dword [rbx + 0x1d04], xmm1
movss xmm0, dword [rbx + 0x166c]
mulss xmm0, dword [0x1800b18cc]
or dword [rbx + 0x1cf0], 0x41
movss dword [rbx + 0x1d50], xmm0
call fcn.18001b700
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180028530
lea r11, [0x1800a9e00]
nop dword [rax]
cmp r9b, 0x23
jne 0x180028513
cmp byte [r8], r9b
jne 0x180028513
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180028500
not ecx
call fcn.180022090
test rax, rax
je 0x180028576
cmp byte [rax + 0x8e], 0
je 0x180028576
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3054]
mov edx, 0x10
mov r9d, dword [rbx + 0x3054]
call fcn.18001b700
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1800245d0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18004d8f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test dword [rcx + 0x10], 0x100000
mov r10, rdx
je 0x18004d97b
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18004d950
lea r10, [0x1800a9e00]
nop dword [rax]
cmp r9b, 0x23
jne 0x18004d933
cmp byte [r8], r9b
jne 0x18004d933
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x18004d920
mov rcx, qword [0x1800f8668]
not eax
cmp dword [rcx + 0x1c50], eax
jne 0x18004d967
mov dword [rcx + 0x1c54], eax
cmp dword [rcx + 0x1c90], eax
jne 0x18004d9cd
mov byte [rcx + 0x1c94], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x1800f8668]
mov rcx, r10
mov r8, qword [rbx + 0x1c08]
movsxd rax, dword [r8 + 0xc8]
mov r8, qword [r8 + 0xd0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.18001b780
cmp dword [rbx + 0x1c50], eax
jne 0x18004d9b9
mov dword [rbx + 0x1c54], eax
cmp dword [rbx + 0x1c90], eax
jne 0x18004d9c8
mov byte [rbx + 0x1c94], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180052da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rax, qword [rcx]
mov r9, qword [rax]
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
mov r10, qword [0x1800f6598]
test r9, r9
je 0x180052e5a
cmp dword [r10 + 0xc], 0
jle 0x180052e5a
mov rax, qword [0x1800f8640]
mov r9, qword [r9 + rax + 0x18]
mov r8, r12
nop dword [rax + rax]
movsx rdx, byte [r9]
lea r9, [r9 + 1]
xor r8, rdx
imul r8, r15
test dl, dl
jne 0x180052e00
mov qword [rsp + 0x50], r8
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1800f65b0]
call fcn.180053140
mov rcx, qword [0x1800f6598]
movsxd rdx, dword [rcx + 0xc]
lea rcx, [rdx + rdx*2]
add rcx, rcx
mov rax, qword [rax]
mov r9, qword [r14]
mov r8d, dword [rax + rcx*8 - 8]
mov rdx, qword [rax + rcx*8 - 0x30]
mov rcx, qword [r9]
call fcn.1800692f0
mov r10, qword [0x1800f6598]
mov rax, qword [r14]
mov rcx, qword [rax]
test rcx, rcx
je 0x180052e6a
mov ebp, dword [rcx + 0x3c]
jmp 0x180052e6f
mov ebp, 0x64
xor esi, esi
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
cmp dword [rdx + 0x10], esi
jbe 0x180052f79
movabs r13, 0x96380e6f20703d36
nop dword [rax + rax]
mov rax, qword [rdx + 8]
mov rdi, qword [rax + rsi*8]
mov rax, qword [r14]
cmp rdi, qword [rax]
je 0x180052f67
mov rax, qword [0x1800f8640]
mov r8, qword [rax + rdi + 0x18]
mov rdx, r12
nop dword [rax]
nop word [rax + rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
xor rdx, rcx
imul rdx, r15
test cl, cl
jne 0x180052ec0
mov qword [rsp + 0x50], rdx
cmp rdx, r13
je 0x180052f67
cmp ebp, dword [rdi + 0x3c]
lea rax, [r10 + 0x38]
jne 0x180052eee
lea rax, [r10 + 0x28]
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov rbx, rcx
cmp byte [rax + 0x19], 0
jne 0x180052f18
nop
cmp qword [rax + 0x20], rdx
jae 0x180052f0c
mov rax, qword [rax + 0x10]
jmp 0x180052f12
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180052f00
cmp byte [rbx + 0x19], 0
jne 0x180052f67
cmp rdx, qword [rbx + 0x20]
jb 0x180052f67
cmp rbx, rcx
je 0x180052f67
cmp dword [rbx + 0x28], 0
jle 0x180052f67
lea rdx, [rsp + 0x50]
mov rcx, qword [0x1800f65b0]
call fcn.180053140
movsxd rdx, dword [rbx + 0x28]
lea rdx, [rdx + rdx*2]
add rdx, rdx
mov rax, qword [rax]
mov r8d, dword [rax + rdx*8 - 8]
mov rdx, qword [rax + rdx*8 - 0x30]
mov rcx, rdi
call fcn.1800692f0
mov r10, qword [0x1800f6598]
inc esi
mov rax, qword [r14 + 8]
mov rdx, qword [rax]
cmp esi, dword [rdx + 0x10]
jb 0x180052e90
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret