joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d010
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
lea r14, [0x1801030e0]
mov qword [rsp + 0x88], r14
mov rcx, r14
call fcn.1800833e4
test eax, eax
jne 0x18000d189
cmp dword [0x18010312c], 0x7fffffff
je 0x18000d151
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18000d06b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d0a3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d090
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180013cf0
cmp qword [rax + 8], 0
je 0x18000d0ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180012ec0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d0ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18000d0db
mov rdx, qword [rdi]
mov rcx, qword [0x1803468b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180012ec0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180012ec0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d166
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180012ec0
mov rdx, qword [rax]
mov rax, qword [rdx + 0x30]
mov rdx, rsi
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, r14
call fcn.1800833ec
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov dword [0x18010312c], 0x7ffffffe
mov ecx, 6
call fcn.1800827ac
nop
lea rdx, str.Not_find_function
lea rcx, [rsp + 0x30]
call fcn.180001920
lea rdx, [0x180100100]
lea rcx, [rsp + 0x30]
call fcn.180086440
nop
mov ecx, 5
call fcn.1800827ac
int3
Function at 0x180012ec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x180012ef5
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x180012f33
movabs r9, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x180012f20
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x30]
call fcn.180013cf0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x180012f59
mov qword [rsi], rax
mov byte [rsi + 8], r12b
jmp 0x18001311b
movabs rax, 0x492492492492492
cmp qword [0x180346bb0], rax
je 0x180013138
lea rax, [0x180346ba8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x28], r12
mov ecx, 0x38
call fcn.180083e58
mov rdi, rax
mov qword [rsp + 0x28], rax
lea r15, [rax + 0x10]
mov qword [rsp + 0x60], r15
mov rdx, r14
mov rcx, r15
call fcn.18000b910
nop
mov qword [r15 + 0x20], r12
mov r8, qword [0x180346bb0]
lea rcx, [r8 + 1]
vxorps xmm1, xmm1, xmm1
test rcx, rcx
js 0x180012fcc
vcvtsi2ss xmm1, xmm1, rcx
jmp 0x180012fe1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
vcvtsi2ss xmm1, xmm1, rax
vaddss xmm1, xmm1, xmm1
mov rdx, qword [0x180346bd8]
vxorps xmm0, xmm0, xmm0
test rdx, rdx
js 0x180012ff8
vcvtsi2ss xmm0, xmm0, rdx
jmp 0x180013010
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
vcvtsi2ss xmm0, xmm0, rcx
vaddss xmm0, xmm0, xmm0
vdivss xmm0, xmm1, xmm0
vmovss xmm2, dword [0x180346ba0]
vcomiss xmm0, xmm2
jbe 0x1800130b3
vdivss xmm0, xmm1, xmm2
vxorps xmm1, xmm1, xmm1
vroundss xmm1, xmm1, xmm0, 2
xor ecx, ecx
vmovss xmm0, dword [0x1800ed05c]
vcomiss xmm1, xmm0
jb 0x18001305b
vsubss xmm1, xmm1, xmm0
vcomiss xmm1, xmm0
jae 0x18001305b
movabs rax, 0x8000000000000000
mov rcx, rax
vcvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18001308d
cmp rdx, 0x200
jae 0x18001308a
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x18001308d
mov rdx, rcx
call fcn.1800137a0
mov r9, rbx
mov r8, r15
lea rdx, [rsp + 0x30]
call fcn.180013cf0
vmovups xmm0, xmmword [rax]
vmovups xmmword [rsp + 0x30], xmm0
mov r8, qword [0x180346bb0]
mov qword [rsp + 0x28], r12
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x180346bb0], r8
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rcx + 8], rdi
mov rax, qword [0x180346bb8]
and rbx, qword [0x180346bd0]
add rbx, rbx
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x180346ba8]
jne 0x1800130fd
mov qword [rax + rbx*8], rdi
jmp 0x18001310f
cmp r8, rcx
jne 0x180013108
mov qword [rax + rbx*8], rdi
jmp 0x180013114
cmp qword [rax + rbx*8 + 8], rdx
jne 0x180013114
mov qword [rax + rbx*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180082a08
int3
Function at 0x1800137a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov r8d, 1
shlx rax, r8, rcx
cmp rdx, rax
ja 0x180013a07
lea rax, [rdx - 1]
or rax, r8
bsr rcx, rax
inc ecx
shlx rbx, r8, rcx
mov rbp, qword [0x180346ba8]
lea rdx, [rbx + rbx]
mov r8, rbp
lea rcx, [0x180346bb8]
call fcn.18000c170
lea rax, [rbx - 1]
mov qword [0x180346bd0], rax
mov qword [0x180346bd8], rbx
lea rax, [0x180346ba0]
mov qword [rsp + 0x68], rax
mov rdi, qword [0x180346ba8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x1800139c3
movabs rax, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
mov rsi, qword [rsi]
mov r8, qword [rdi + 0x20]
lea r9, [rdi + 0x10]
mov r12, qword [rdi + 0x28]
cmp r12, 0xf
jbe 0x180013869
mov r9, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
mov r10, r8
mov r11, r12
test r8, r8
je 0x180013894
nop dword [rax]
movzx eax, byte [r9 + rdx]
xor rcx, rax
imul rcx, rbx
inc rdx
cmp rdx, r8
jb 0x180013880
and rcx, qword [0x180346bd0]
shl rcx, 4
mov rax, qword [0x180346bb8]
add rax, rcx
mov qword [rsp + 0x60], rax
mov r13, qword [rax]
cmp r13, rbp
jne 0x1800138c2
mov qword [rax], rdi
mov qword [rax + 8], rdi
jmp 0x1800139ad
mov rbx, qword [rax + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1800138d8
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
mov r15, r8
cmp r12, 0xf
jbe 0x1800138ef
mov rcx, qword [rdi + 0x10]
mov r15, r10
mov r12, r11
cmp r8, rax
jne 0x180013931
call fcn.1800b0350
test eax, eax
jne 0x180013931
mov r8, qword [rbx]
cmp r8, rdi
je 0x180013926
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 8], rdi
jmp 0x1800139a3
cmp r13, rbx
je 0x18001397a
nop word [rax + rax]
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180013956
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r12, 0xf
jbe 0x180013964
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180013975
mov r8, r15
call fcn.1800b0350
test eax, eax
je 0x1800139e1
cmp r13, rbx
jne 0x180013940
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax], rdi
movabs rbx, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
movabs rax, 0xcbf29ce484222325
jne 0x180013850
mov qword [rsp + 0x68], 0
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rbx]
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
jmp 0x1800139a3
lea rcx, str.invalid_hash_bucket_count
call fcn.180082a08
int3
Function at 0x180013dd0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x180346b70]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x180346b58]
mov rax, qword [rdx + 8]
cmp rax, qword [0x180346b48]
je 0x180013e86
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x180013e88
nop dword [rax]
cmp rax, rdx
je 0x180013e86
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180013e70
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret
Function at 0x1800142b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov r8d, 1
shlx rax, r8, rcx
cmp rdx, rax
ja 0x18001449f
lea rax, [rdx - 1]
or rax, r8
bsr rcx, rax
inc ecx
shlx rdi, r8, rcx
mov rbx, qword [0x180346b48]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [0x180346b58]
call fcn.18000c170
lea rax, [rdi - 1]
mov qword [0x180346b70], rax
mov qword [0x180346b78], rdi
lea rax, [0x180346b40]
mov qword [rsp + 0x30], rax
mov rax, qword [0x180346b48]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180014460
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop word [rax + rax]
mov rcx, qword [rcx]
movzx r11d, byte [rax + 0x10]
xor r11, rsi
imul r11, rdi
movzx edx, byte [rax + 0x11]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x12]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x13]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x14]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x15]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x16]
xor r11, rdx
imul r11, rdi
movzx edx, byte [rax + 0x17]
xor r11, rdx
imul r11, rdi
and r11, qword [0x180346b70]
shl r11, 4
add r11, qword [0x180346b58]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800143df
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180014454
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18001441c
mov r10, qword [rdx]
cmp r10, rax
je 0x180014416
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180014454
cmp r9, rdx
je 0x180014430
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180014479
cmp r9, rdx
jne 0x180014421
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180014360
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180014454
lea rcx, str.invalid_hash_bucket_count
call fcn.180082a08
int3
Function at 0x180032df0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov r8d, 1
shlx rax, r8, rcx
cmp rdx, rax
ja 0x180033057
lea rax, [rdx - 1]
or rax, r8
bsr rcx, rax
inc ecx
shlx rbx, r8, rcx
mov rbp, qword [0x180346c08]
lea rdx, [rbx + rbx]
mov r8, rbp
lea rcx, [0x180346c18]
call fcn.18000c170
lea rax, [rbx - 1]
mov qword [0x180346c30], rax
mov qword [0x180346c38], rbx
lea rax, [0x180346c00]
mov qword [rsp + 0x68], rax
mov rdi, qword [0x180346c08]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x180033013
movabs rax, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
mov rsi, qword [rsi]
mov r8, qword [rdi + 0x20]
lea r9, [rdi + 0x10]
mov r12, qword [rdi + 0x28]
cmp r12, 0xf
jbe 0x180032eb9
mov r9, qword [rdi + 0x10]
mov rcx, rax
xor edx, edx
mov r10, r8
mov r11, r12
test r8, r8
je 0x180032ee4
nop dword [rax]
movzx eax, byte [r9 + rdx]
xor rcx, rax
imul rcx, rbx
inc rdx
cmp rdx, r8
jb 0x180032ed0
and rcx, qword [0x180346c30]
shl rcx, 4
mov rax, qword [0x180346c18]
add rax, rcx
mov qword [rsp + 0x60], rax
mov r13, qword [rax]
cmp r13, rbp
jne 0x180032f12
mov qword [rax], rdi
mov qword [rax + 8], rdi
jmp 0x180032ffd
mov rbx, qword [rax + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180032f28
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
mov r15, r8
cmp r12, 0xf
jbe 0x180032f3f
mov rcx, qword [rdi + 0x10]
mov r15, r10
mov r12, r11
cmp r8, rax
jne 0x180032f81
call fcn.1800b0350
test eax, eax
jne 0x180032f81
mov r8, qword [rbx]
cmp r8, rdi
je 0x180032f76
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax + 8], rdi
jmp 0x180032ff3
cmp r13, rbx
je 0x180032fca
nop word [rax + rax]
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180032fa6
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r12, 0xf
jbe 0x180032fb4
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x180032fc5
mov r8, r15
call fcn.1800b0350
test eax, eax
je 0x180033031
cmp r13, rbx
jne 0x180032f90
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x60]
mov qword [rax], rdi
movabs rbx, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
movabs rax, 0xcbf29ce484222325
jne 0x180032ea0
mov qword [rsp + 0x68], 0
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rbx]
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
jmp 0x180032ff3
lea rcx, str.invalid_hash_bucket_count
call fcn.180082a08
int3
Function at 0x1800354e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18003553d
lea rbx, [0x1800e7720]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180035524
cmp r10, 2
jb 0x180035524
cmp byte [r9], r8b
jne 0x180035524
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180035500
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18003557f
lea rbx, [0x1800e7720]
cmp r8b, 0x23
jne 0x180035563
cmp byte [r9], r8b
jne 0x180035563
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180035550
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180035870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x20], rsi
xor edx, edx
mov rsi, r9
lea rax, [rcx + rax*2]
mov qword [rsp], rax
cmp rcx, rax
jae 0x180035a83
mov qword [r11 - 0x18], r13
lea r13, [0x180000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
nop
test rsi, rsi
je 0x1800358ce
cmp r8, rsi
jae 0x180035a60
movzx edx, byte [r8]
test dl, dl
je 0x180035a5e
xor ebx, ebx
mov eax, edx
shr rax, 3
mov rcx, rsi
movsx r9, byte [rax + r13 + 0xe7410]
test r9d, r9d
sete bl
add ebx, r9d
test rsi, rsi
jne 0x180035902
movsxd rcx, ebx
add rcx, r8
xor ebp, ebp
lea rax, [r8 + 1]
cmp r8, rcx
cmovb ebp, edx
cmp rax, rcx
jae 0x180035919
movzx r12d, byte [rax]
jmp 0x18003591c
xor r12b, r12b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x18003592b
movzx r15d, byte [rax]
jmp 0x18003592e
xor r15b, r15b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x18003593d
movzx r14d, byte [rax]
jmp 0x180035940
xor r14b, r14b
lea r11, [r9*4]
movzx eax, bpl
mov ecx, dword [r11 + r13 + 0xec458]
and ecx, eax
movzx r9d, r12b
shl ecx, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r15b
or ecx, eax
movzx r10d, r14b
shl ecx, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or ecx, eax
mov eax, r10d
and eax, 0x3f
shr r10d, 2
or r10d, edx
shl ecx, 6
or ecx, eax
shr r10d, 2
mov eax, dword [r11 + r13 + 0xe73f8]
or r10d, r9d
shrx r13d, ecx, eax
shr r10d, 2
lea r9, [0x180000000]
cmp r13d, dword [r11 + r9 + 0xe73e0]
sbb eax, eax
xor edx, edx
and eax, 0x40
mov ecx, edx
or r10d, eax
mov eax, r13d
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove ecx, eax
mov eax, edx
or r10d, ecx
mov ecx, 0x100
cmp r13d, 0xffff
cmova eax, ecx
or r10d, eax
mov eax, dword [r11 + r9 + 0xec440]
xor r10d, 0x2a
sarx ecx, r10d, eax
test ecx, ecx
je 0x180035a3d
test r14b, r14b
mov eax, edx
mov ecx, edx
mov r13d, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, edx
test r12b, r12b
setne al
add ecx, eax
mov eax, edx
test bpl, bpl
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
mov ebx, ecx
mov word [rdi], r13w
add rdi, 2
movsxd rax, ebx
lea r13, [0x180000000]
add r8, rax
cmp rdi, qword [rsp]
jb 0x1800358c0
jmp 0x180035a60
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov word [rdi], dx
test rax, rax
je 0x180035a98
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x180035ab0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push r13
sub rsp, 0x18
mov qword [rsp + 0x30], rbx
lea r9, [0x180000000]
mov qword [rsp + 0x38], rbp
mov rsi, rdx
mov qword [rsp + 0x40], rdi
xor r13d, r13d
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r14
mov qword [rsp], r15
test rsi, rsi
je 0x180035af0
cmp rcx, rsi
jae 0x180035c72
movzx r8d, byte [rcx]
test r8b, r8b
je 0x180035c72
xor edi, edi
mov eax, r8d
shr rax, 3
mov rdx, rsi
movsx r9, byte [rax + r9 + 0xe7410]
test r9d, r9d
sete dil
add edi, r9d
test rsi, rsi
jne 0x180035b27
movsxd rdx, edi
add rdx, rcx
xor ebp, ebp
lea rax, [rcx + 1]
cmp rcx, rdx
cmovb ebp, r8d
cmp rax, rdx
jae 0x180035b3f
movzx r12d, byte [rax]
jmp 0x180035b42
xor r12b, r12b
lea rax, [rcx + 2]
cmp rax, rdx
jae 0x180035b51
movzx r15d, byte [rax]
jmp 0x180035b54
xor r15b, r15b
lea rax, [rcx + 3]
cmp rax, rdx
jae 0x180035b63
movzx r14d, byte [rax]
jmp 0x180035b66
xor r14b, r14b
lea rbx, [r9*4]
movzx eax, bpl
lea r8, [0x180000000]
movzx r9d, r15b
mov edx, dword [rbx + r8 + 0xec458]
and edx, eax
movzx r10d, r12b
shl edx, 6
mov eax, r10d
and eax, 0x3f
movzx r11d, r14b
or edx, eax
and r10d, 0xc0
shl edx, 6
mov eax, r9d
and eax, 0x3f
and r9d, 0xc0
or edx, eax
mov eax, r11d
and eax, 0x3f
shr r11d, 2
or r11d, r9d
shl edx, 6
or edx, eax
shr r11d, 2
mov eax, dword [rbx + r8 + 0xe73f8]
lea r9, [0x180000000]
shrx r8d, edx, eax
or r11d, r10d
shr r11d, 2
cmp r8d, dword [rbx + r9 + 0xe73e0]
sbb eax, eax
xor edx, edx
and eax, 0x40
or r11d, eax
mov eax, r8d
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
xor eax, eax
or r11d, edx
mov edx, 0x100
cmp r8d, 0xffff
cmova eax, edx
or r11d, eax
mov eax, dword [rbx + r9 + 0xec440]
xor r11d, 0x2a
sarx edx, r11d, eax
test edx, edx
je 0x180035c64
xor edx, edx
test r14b, r14b
setne dl
xor eax, eax
test r15b, r15b
setne al
add edx, eax
xor eax, eax
test r12b, r12b
setne al
add edx, eax
xor eax, eax
test bpl, bpl
setne al
add edx, eax
cmp edi, edx
cmovl edx, edi
mov edi, edx
movsxd rax, edi
add rcx, rax
inc r13d
jmp 0x180035ae2
mov r15, qword [rsp]
mov eax, r13d
mov r14, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x18
pop r13
pop rsi
ret
Function at 0x180038f70
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x1800e7720]
mov rax, qword [rcx + 0x108]
mov r10, rdx
mov r9, rcx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dl
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov rax, rdx
sar rax, 8
movzx edx, al
mov rax, r10
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar rax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r10
xor rdx, rcx
sar rax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r10
xor rdx, rcx
sar rax, 0x20
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r10
xor rdx, rcx
sar rax, 0x28
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r10
xor rdx, rcx
sar rax, 0x30
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r10
xor rdx, rcx
sar rax, 0x38
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x180039066
mov r8, r10
mov edx, 0xc
mov ecx, ebx
call fcn.18004d660
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180039070
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x1800e7720]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x4054], ebx
jne 0x180039108
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18004d660
mov eax, ebx
add rsp, 0x20
pop rbx
ret