joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14088
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
xor edi, edi
lea rcx, [rax - 0x30]
xor edx, edx
lea r8d, [rdi + 0x28]
mov qword [rax + 8], rdi
call fcn.00016910
lea edx, [rdi + 0x3c]
lea eax, [rdi + 0x3e]
mov word [rsp + 0x32], ax
lea rax, [0x00017720]
mov word [rsp + 0x30], dx
mov qword [rsp + 0x38], rax
lea eax, [rdi + 0xe]
lea r8, [rsp + 0x50]
mov word [rsp + 0x40], ax
lea eax, [rdi + 0x10]
lea rcx, [rsp + 0x90]
mov word [rsp + 0x42], ax
lea rax, [0x00017760]
mov edx, 0xf003f
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x14163
or rcx, 0xffffffffffffffff
lea rdx, [0x00017770]
xor eax, eax
mov rdi, rdx
mov r9d, 7
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x80
pop rdi
ret

Function at 0x142b8
Capabilities:
Persist via winlogon helper dll registry key
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
xor edi, edi
lea rcx, [rax - 0x30]
xor edx, edx
lea r8d, [rdi + 0x28]
mov qword [rax + 8], rdi
call fcn.00016910
mov edx, 0x8e
lea r8, [rsp + 0x50]
lea eax, [rdx + 2]
mov word [rsp + 0x30], dx
lea rcx, [rsp + 0x90]
mov word [rsp + 0x32], ax
lea rax, [0x00017930]
mov edx, 0xf003f
mov qword [rsp + 0x38], rax
lea eax, [rdi + 0xa]
mov dword [rsp + 0x50], 0x30
mov word [rsp + 0x40], ax
lea eax, [rdi + 0xc]
mov qword [rsp + 0x58], rdi
mov word [rsp + 0x42], ax
lea rax, [0x000179c0]
mov dword [rsp + 0x68], 0x240
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rdi
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, edi
jl 0x14395
or rcx, 0xffffffffffffffff
lea rdx, [0x000179d0]
xor eax, eax
mov rdi, rdx
mov r9d, 1
xor r8d, r8d
repne scasw ax, word [rdi]
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x80
pop rdi
ret

Function at 0x157b4
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
and qword [rsp + 0x68], 0
lea rdx, [0x00015764]
xor r8d, r8d
call qword [sym.imp.ntoskrnl.exe_IoRegisterDriverReinitialization]
and qword [rsp + 0x30], 0
lea rax, [0x000143b4]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x68]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1fffff
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
js 0x1580b
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0x48
ret
Function at 0x15e28
Capabilities:
Enumerate processes via ntquerysysteminformation
Find process by pid
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, rdx
xor edx, edx
mov r12, rcx
lea edi, [rdx + 5]
lea r9, [rax + 0x18]
xor r13d, r13d
mov ecx, edi
xor r8d, r8d
mov dword [rax + 0x18], r13d
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov ebx, dword [rsp + 0x50]
cmp ebx, r13d
jne 0x15e73
mov eax, 0xc0000001
jmp 0x15ef4
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
cmp rax, r13
je 0x15e69
lea r9, [rsp + 0x50]
mov r8d, ebx
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, r13d
mov ebx, eax
jl 0x15ee7
mov ebx, 0xc0000001
mov rdi, rsi
mov eax, dword [rdi]
add rdi, rax
je 0x15ed1
cmp qword [rdi + 0x50], r13
je 0x15ed1
cmp word [rdi + 0x38], r13w
je 0x15ed1
mov rcx, qword [rdi + 0x40]
cmp rcx, r13
je 0x15ed1
mov rdx, r12
call sub.ntoskrnl.exe__wcsicmp
cmp eax, r13d
je 0x15ed8
cmp dword [rdi], r13d
je 0x15ee7
jmp 0x15ea7
mov rcx, qword [rdi + 0x50]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x15f14
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, dil
jne 0x15f4b
xor eax, eax
jmp 0x15fd3
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x15f44
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x15f44
mov eax, dword [rax + rbx + 0x88]
mov esi, edi
add rax, rbx
mov r13d, dword [rax + 0x1c]
mov r12d, dword [rax + 0x20]
mov r14d, dword [rax + 0x24]
mov r15d, dword [rax + 0x18]
add r13, rbx
add r12, rbx
add r14, rbx
cmp r15d, edi
jbe 0x15fd0
mov ebp, dword [r12]
add rbp, rbx
je 0x15fb4
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
cmp al, dil
je 0x15fb4
mov rcx, qword [rsp + 0x58]
mov rdx, rbp
call sub.ntoskrnl.exe__stricmp
cmp eax, edi
je 0x15fc1
inc esi
add r12, 4
cmp esi, r15d
jae 0x15fd0
jmp 0x15f8c
mov eax, esi
movzx ecx, word [r14 + rax*2]
mov edi, dword [r13 + rcx*4]
add rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x15ff8
Capabilities:
Delete file
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xd0
xor edi, edi
xor eax, eax
mov rbx, rcx
mov word [rsp + 0x78], di
lea rcx, [r11 - 0x38]
lea r8d, [rdi + 0x28]
xor edx, edx
mov qword [r11 + 0x20], rdi
mov qword [r11 - 0x5e], rax
mov dword [r11 - 0x56], eax
mov word [r11 - 0x52], ax
mov dword [r11 - 0x40], edi
call fcn.00016910
xor eax, eax
lea rcx, [rsp + 0x78]
mov rdx, rbx
mov dword [rsp + 0x88], edi
mov dword [rsp + 0x8c], eax
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x70], edi
mov dword [rsp + 0x74], eax
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x78]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0xa8], rax
mov dword [rsp + 0x98], 0x30
mov qword [rsp + 0xa0], rdi
mov dword [rsp + 0xb0], 0x240
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
mov dword [rsp + 0x68], 0x100
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], 0x68
mov dword [rsp + 0x38], 3
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x98]
lea rcx, [rsp + 0xf8]
mov edx, 0x40100000
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ntoskrnl.exe_IoCreateFile]
cmp eax, edi
mov ebx, eax
jl 0x1615a
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [0x0001a3c0]
mov dword [rsp + 0x30], 0x1f4dd0
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x88]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
mov rcx, qword [rsp + 0xf8]
cmp rcx, rdi
je 0x1616d
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x16188
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
and qword [rax - 0x28], 0
and qword [rax - 0x20], 0
mov qword [rax - 0x38], rcx
mov qword [rax - 0x40], rdx
lea rcx, [rax + 0x10]
lea r8, [rax - 0x48]
mov edx, 0xf003f
mov dword [rax - 0x48], 0x30
mov dword [rax - 0x30], 0x240
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov ebx, eax
test eax, eax
js 0x16396
mov rcx, qword [rsp + 0x98]
xor r9d, r9d
lea rax, [rsp + 0x90]
lea esi, [r9 + 2]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, esi
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x16388
mov edx, dword [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rdi, rax
test rax, rax
je 0x16388
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.00016910
mov r9d, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
lea r11, [rsp + 0x90]
mov r8, rdi
mov edx, esi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ntoskrnl.exe_ZwQueryKey]
mov ebx, eax
test eax, eax
js 0x1637d
mov eax, dword [rdi + 0x14]
test eax, eax
je 0x1635f
xor esi, esi
test eax, eax
je 0x1635f
cmp esi, 0xa
jae 0x1637d
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov ebx, eax
cmp eax, 0xc0000023
jne 0x1637d
mov edx, dword [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rbp, rax
test rax, rax
je 0x1637d
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
call fcn.00016910
mov ecx, dword [rsp + 0x90]
lea r11, [rsp + 0x90]
mov qword [rsp + 0x28], r11
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x98]
mov r9, rbp
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov ebx, eax
test eax, eax
js 0x16349
movzx eax, word [rbp + 0xc]
mov rdx, qword [rsp + 0x98]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], ax
movzx eax, word [rbp + 0xc]
mov word [rsp + 0x32], ax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
call fcn.00016188
mov ebx, eax
xor edx, edx
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
inc esi
cmp esi, dword [rdi + 0x14]
jb 0x1627b
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
mov rcx, qword [rsp + 0x98]
mov ebx, eax
call qword [sym.imp.ntoskrnl.exe_ZwFlushKey]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x16704
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
and qword [rax + 0x20], 0
mov rbx, rdx
mov rdx, rcx
lea rcx, [rax - 0x58]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rsp + 0x88], 0
and qword [rsp + 0xa0], 0
and qword [rsp + 0xa8], 0
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0xd8]
mov edx, 0x100001
mov dword [rsp + 0x28], 0x4021
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x240
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
js 0x167fd
mov rcx, qword [rsp + 0xd8]
cmp rcx, 0xffffffffffffffff
je 0x167fd
mov byte [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov byte [rsp + 0x40], 1
mov dword [rsp + 0x38], 3
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], 0xc8060
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwQueryDirectoryFile]
test eax, eax
js 0x167ef
mov rax, qword [rsp + 0xd8]
jmp 0x16801
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
or rax, 0xffffffffffffffff
add rsp, 0xb0
pop rbx
ret

Function at 0x211064
Capabilities:
Create device object

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r9, rcx
call fcn.00211008
mov rdx, r8
mov rcx, r9
add rsp, 0x28
jmp fcn.0001583c
Function at 0x1800bc000
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1800bc0ad
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1800bc0af
cmp rax, rdx
je 0x1800bc0ad
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800bc097
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret

Function at 0x1800bd3f0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1800bd4a8
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1800bd49f
nop dword [rax + rax]
cmp rax, rdx
je 0x1800bd4a8
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800bd490
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1801dbaf0
int3
Function at 0x18011cf60
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x18011d02c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x18011d02c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x18011d045
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x18011d01c
cmp byte [rax], 0x5c
jne 0x18011d016
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x18011d016
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x18011d002
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x18011d013
test r8b, 0x10
jne 0x18011d016
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x18011d016
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.18011fce0
test edi, edi
jne 0x18011cf80
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.18011e390
int3

Function at 0x180120b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180120b74
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180120b60
ret
Function at 0x18012b650
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
imul r8, rcx
lea rcx, [r10 + 8]
and r8, qword [r10 + 0x30]
shl r8, 4
add r8, qword [r10 + 0x18]
mov rdx, qword [r8 + 8]
cmp rdx, qword [rcx]
je 0x18012b6d8
mov eax, dword [r11]
mov r9, qword [r8]
cmp eax, dword [rdx + 0x10]
je 0x18012b6da
nop
cmp rdx, r9
je 0x18012b6d4
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x18012b6c0
lea rcx, [r10 + 8]
jmp 0x18012b6da
lea rcx, [r10 + 8]
xor edx, edx
test rdx, rdx
je 0x18012b733
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x18012b703
cmp rax, rdx
jne 0x18012b6f9
mov rax, qword [rcx]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x18012b70e
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
jmp 0x18012b70e
cmp rax, rdx
jne 0x18012b70e
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
dec qword [rcx + 8]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.18012abb0
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1801508f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12d, edx
mov r13, rcx
xor r9d, r9d
lea r8, [rsp + 0x70]
xor edx, edx
lea rcx, [0x1803cd1c0]
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x180150ac4
xor edi, edi
lea rax, [0x1803cd1d0]
cmp dword [rsp + 0x70], edi
je 0x180150a09
mov r8d, edi
mov r9, rax
nop word [rax + rax]
mov ecx, r8d
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov eax, r8d
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
neg ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
neg eax
and eax, 0xedb88320
shr ecx, 1
xor eax, ecx
mov edx, eax
and edx, 1
neg edx
and edx, 0xedb88320
shr eax, 1
xor edx, eax
mov eax, edx
and eax, 1
neg eax
and eax, 0xedb88320
shr edx, 1
xor eax, edx
mov dword [r9], eax
inc r8d
lea r9, [r9 + 4]
cmp r8d, 0x100
jb 0x180150950
xor r8d, r8d
xor edx, edx
lea rcx, [0x1803cd1c0]
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x180150ab8
not r12d
mov ebx, r12d
mov r14, qword [r13 + 8]
test r14, r14
je 0x180150a97
mov r13, qword [r13]
mov esi, 1
lea rbp, [r13 + 1]
movzx r15d, byte [rdi + r13]
cmp r15b, 0x23
jne 0x180150a76
cmp r14, rsi
jb 0x180150abe
mov rax, r14
sub rax, rsi
mov r8d, 2
cmp rax, r8
cmovb r8, rax
cmp r8, 2
jne 0x180150a76
lea rdx, [0x18028e028]
mov rcx, rbp
call fcn.18020f020
test eax, eax
jne 0x180150a76
mov ebx, r12d
add rdi, 2
add rsi, 2
add rbp, 2
jmp 0x180150a89
movzx ecx, bl
xor rcx, r15
shr ebx, 8
lea rax, [0x1803cd1d0]
xor ebx, dword [rax + rcx*4]
inc rdi
inc rsi
inc rbp
cmp rdi, r14
jb 0x180150a25
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1800f2590
int3
call fcn.18014edf0
int3
call fcn.1801e6808
int3
Function at 0x180192110
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1801922ef
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800bcba0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1801922b4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18019222c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1801922a3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180192269
mov r10, qword [rdx]
cmp r10, rax
je 0x180192263
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1801922a3
cmp r9, rdx
je 0x18019227f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1801922c9
cmp r9, rdx
jne 0x180192270
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1801921b0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1801922a3
lea rcx, str.invalid_hash_bucket_count
call fcn.1801dbacc
int3
Function at 0x180192300
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x180192361
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180192320
mov ecx, dword [r9]
jmp 0x18019244b
cmp ecx, 0x4e0
jb 0x18019244b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180192380
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1801923d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret