joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20c298f
Capabilities:
Authenticate hmac

Disassembly:
mov rsi, r8
sar di, 0x82
mov qword [rsp], rdi
mov rdi, rdx
cld
rep movsb byte [rdi], byte [rsi]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.0249226e

Function at 0x20fdfe2
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
dec rdx
lea rax, [rsp + rax + 0x10]
mov r9, qword [rdx + rax - 0x8012]
jg 0x26108b8
and rdi, rcx
mov r9d, dword [rsp + rsi - 0xa63bf7]
mov qword [rsp + rsi - 0xa63bf9], r11
sar byte [rsp + rsi*2 - 0x14c77fb], 0xc4
xor dword [rsp + rsi*4 - 0x298effc], r8d
shr qword [rsp + rsi - 0xa63c01], cl
shl esi, cl
mov r11, qword [rsp + rsi - 0x3fffff8]
call fcn.01de994f
mov ecx, 0xbab5df29
not cx
mov edx, dword [rbp + riz]
add rbp, 4
movzx esi, cl
push rsi
xor edx, r11d
dec edx
mov edi, 0xb4232b1f
movzx r8d, si
bswap edx
lea rax, [rdi*2 - 0x42d4ace4]
bts cx, di
and byte [rsp + rsi - 0xd0], 0
xor edx, 0x7f0d8a33
rol si, 0xa1
pop rax
not edx
movzx r9d, ax
xor r9, r8
cmovnp rcx, rsi
inc edx
imul eax, esi
btr eax, esi
shr dword [rsp + rdx*4 - 0x2003f], 0xd9
mov qword [rbx + rdx*2 - 0x10034], r9
mov word [rsp + rdx*2 - 0x10016], 0x8791
lea rbx, [rbx + rdx - 0x8022]
neg word [rsp + rdx*2 - 0x10018]
pop rsi
pop rdx
jne fcn.0268705d

Function at 0x2100e97
Capabilities:
Authenticate hmac

Disassembly:
cmp rbx, r8
lea rsp, [rsp + 0x10]
ja 0x20c29ab
mov r8, rsp
mov edx, 0x283c0189
lea ecx, [rdx - 0x283c0061]
mov esi, edx
lea rdx, [rbx + rdx - 0x283c0209]
bts rsi, rsi
movsx edi, sil
and rdx, 0xfffffffffffffff0
neg esi
ror rdi, 0x18
inc esi
sub rdx, rcx
not sil
call fcn.020cae08
call fcn.021192ee
bts rdi, rax
bswap r8d
lea rdi, [rsi*2 - 0x14681df1]
neg di
ror r8d, 3
and eax, 0x4485ee81
push r11
or rdx, rax
lea r11, [rcx + rax - 0x7b4825c3]
xor dword [rsp + rax], r8d
neg dil
inc r11b
inc dl
pop r11
call fcn.020ab9b0

Function at 0x2105afc
Capabilities:
Encode data using base64

Disassembly:
add r9d, r9d
jbe 0x211b0cd
movzx r8d, word [rbp + rax*2 - 0x3851ffdc]
lea r9, [r9*2 - 0x636480e0]
bt eax, ecx
mov qword [rsp + rax*2 - 0x3851ffe0], 0x4024d933
xor r8w, r11w
not r8w
mov edx, dword [rsp + rax - 0x1c28fff0]
add r8w, 0x9b01
ror dl, 0xa7
ror r8w, 1
shl di, 0x6e
neg r8w
xadd word [rsp + rax*4 - 0x70a3ffbf], di
xor word [rsp + rcx - 0x17ef2193], r9w
inc r8w
inc edi
mov byte [rsp + rax*2 - 0x3851ffda], al
xchg ch, cl
not r8w
xor r11w, r8w
or qword [rsp + rax - 0x1c28fff0], 0xffffffffd53abd24
shl dword [rsp + rax*4 - 0x70a3ffbe], cl
setae al
lea r8, [rsp + r8 + 8]
not dl
setg dl
or qword [rsp + rax - 0x1c28ff00], rax
mov dword [r8 + rax - 0x1c28ff00], esi
push rax
mov r8d, eax
mov rcx, qword [rax + rbx - 0x1c28fefc]
adc word [rsp + rax - 0x1c28feff], di
movzx ax, byte [rcx + rax - 0x1c28ff00]
sar byte [rsp + rdi*2 - 0x1e49ab], 0x41
push rdx
jle 0x26ccc22
Function at 0x2692294
Capabilities:
Authenticate hmac

Disassembly:
movsx edi, cx
or word [rsp + rcx - 0x9e06], 0x5218
xor r9d, r11d
neg r9d
dec r9d
pop rcx
movzx esi, ax
lea rax, [rdx + rdi + 0x5f1a5317]
neg r9d
btc rdx, 0xa5
movsx r8d, cl
setb sil
lea eax, [rax + rcx + 0x37605e4a]
and r9w, 0x5406
lea r9, [r9 + 0x46307a03]
xor eax, 0x3485598d
btr ecx, ecx
adc di, 0x2fa5
imul dx, si
mov r11, qword [rsp + rax - 0x6bea3338]
lea r9, [rdx + rdi + 0x1a00bea6]
movsxd rcx, ecx
mul r9d
add r10, rcx
or dl, dil
movzx r9d, word [rbp + rdi - 0x4e9f21bd]
rol si, 0x6b
lea rbp, [rbp + rdx - 0x2c1a89fd]
xor r9w, r11w
sal edi, 0x8c
btc ax, 0x91
inc r9w
rol r9w, 1
mov qword [rsp + rdx*2 - 0x583513f6], 0x1e2acea2
movsx ecx, word [rsp + rax - 0x7d29d1b8]
sub r9w, 0x5a28
dec r8b
xor r9w, 0x7c38
neg cx
not r9w
adc r9w, 0x63aa
xor eax, edi
cbw
xor r11w, r9w
mov qword [rsp + rdx*2 - 0x583513fe], 0xffffffffb713a0a5
xadd dword [rsp + rdx - 0x2c1a89f7], edx
lea r9, [rsp + r9 + 0x10]
cbw
and rdi, 0xffffffffa8b79f03
imul edx, edx
mov rcx, qword [rsi + r9 - 0x4e9f6218]
sal qword [rsp + rsi - 0x4e9f6218], 0x5d
xadd dword [rsp + rdx - 0x6bf11e7f], esi
sbb dword [rsp + rdx - 0x6bf11e7e], edi
lea rbx, [rbx + r8*4 - 0xcd04]
jnp 0x26b697d
mov qword [rbx + r8*2 - 0x667e], rcx
movzx ecx, word [rsp + rdx - 0x6bf11e80]
xor dword [rsp + r8*4 - 0xccfb], edi
and r8w, word [rsp + rdx - 0x6bf11e7e]
pop rsi
pop rsi
jae fcn.0268705d
movsxd r9, r9d
add si, 0x791c
imul r8d, edx
sbb dil, sil
add r10, r9
mov qword [rsp + rax - 0x14a3544], rdx
mul rdx
movzx esi, word [rcx + rbp]
sub cl, 0x94
div rcx
lea rbp, [rbp + rcx - 0x6a]
xor si, r11w
mul al
imul dl
rol si, 1
ror r8b, 0x23
xadd rax, r8
sal qword [rsp + rcx - 0x54], cl
sbb si, 0x562e
div ecx
rol si, 1
sar qword [rsp + rcx*2 - 0xc0], cl
movsx r9d, ax
adc si, 0xf12b
xor r11w, si
lea rsi, [rsp + rsi + 0x20]
cwd
call fcn.01de345a
mov edx, 0xe0069e08
movzx eax, dx
mov r9d, dword [rbp + rax*4 - 0x27820]
push rdx
rol byte [rsp + rax*8 - 0x4f03f], 0x64
mov ecx, eax
lea rbp, [rbp + rax - 0x9e04]
jb 0x2622a9a
xor dword [rsp + rax*2 - 0x2946aa8], r9d
sar r8d, 0xe7
push rax
sal dword [rsp + rax - 0x14a3555], 0x67
mov r11, qword [rsp + rcx*2 + 0x18]
neg r8w
and dx, 0xb533
jle 0x26b42d8
mov ecx, 0x8330e7bc
mov esi, 0x712bb724
lea rdi, [rcx*4 + 0x18889b8c]
mov eax, dword [rsi + rbp - 0x712bb724]
movsx r9d, cx
ror r9d, cl
add cl, dil
lea rbp, [rbp + rsi - 0x712bb720]
inc sil
xor eax, r11d
add cl, 0xa3
sbb eax, 0xf4286128
sub rsi, rsi
lea rdx, [rsi*4 - 0x224d2cdb]
rol eax, 2
neg eax
sub rsi, rcx
cmovl edx, esi
not eax
bts edi, esi
jb 0x2692045
and r11d, 0xff
mov qword [rsp], 0x4227a986
add byte [rsp + 4], 0xb4
mov r11d, dword [rsi + r11*4]
shr qword [rsp], 0x31
jne 0x2103f0f
shr r8d, 8
call fcn.020aa1c0

Function at 0x26a59f2
Capabilities:
Authenticate hmac

Disassembly:
mov al, byte [rbx + 2]
mov esi, dword [rsp + 0xa]
mov qword [rsp], rsi
push rsi
or dl, al
mov r9d, 0x13088a21
not dl
movsx r8d, si
jmp 0x260370a
Function at 0x26addae
Capabilities:
Encode data using xor

Disassembly:
call fcn.026addae
mov eax, 0x3588af8d
mov eax, dword [rax + rbp - 0x3588af8d]
sub rbp, 0xfffffffffffffffc
xor eax, r11d
mov r8d, 0xcbacef86
inc r8
neg eax
lea rsi, [r8 + r8*2 + 0x5e0c1085]
movzx edi, sil
lea rsi, [r8 + rdi*2 - 0x1f42efcb]
rol eax, 1
lea eax, [rdi + rax + 0x2992437e]
movzx ecx, sil
rol eax, 1
movzx edx, cl
push rsi
and cl, r8b
bswap eax
not eax
rol qword [rsp + rdi - 0x1a], 0x16
bswap eax
sar word [rsp + rdi - 0x18], 0x24
mov qword [rsp + rdi - 0x1a], 0x573d6dac
ror eax, 2
push rdx
shl qword [rsp + rdi*2 - 0x2c], 0x66
mov qword [rsp + rdi - 0x12], r11
movzx r9d, dl
pop rsi
movsx r11d, r8b
xor dword [rsp + rsi*8 - 0x780], eax
and dil, r9b
imul r8d, ecx
pop r11
not ecx
movsxd rax, eax
add r10, rax
jmp fcn.020dada1
mov si, 0x22bc
pushfq
xor esi, 0x823c4c21
mov qword [rsp + 0x18], 0xfffffffffef88e93
mov rsi, qword [rsp + 0x10]
jb 0x26addb3
jb 0x211d0ae
popfq
lea rsp, [rsp + 0x10]
call fcn.026818a3
movabs al, byte [0x51a1bc5e2d0f9149]
mov bl, 0x81
add al, 0x94
invalid

Function at 0x26b4370
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
xor dword [rsp + rax + 0x5ed26c30], edx
add r9, r8
pop r11
shl cx, 0x84
js 0x20d86aa
movsxd rdx, edx
bts r9d, 0xb
rol al, 0xc4
and r9b, r8b
adc r10, rdx
dec r8w
jmp r10
mov qword [rsp + r9 - 0x329206bb], 0x5a93df13
ror edx, 1
rol word [rsp + rdi - 0xa158], 0xc
sub qword [rsp + r9*2 - 0x65240d76], 0x4135fb8d
mov qword [rsp + r9 - 0x329206bb], r11
shr r8d, 0x22
not al
jnp 0x1de97e4

Function at 0x2711389
Capabilities:
Encode data using xor

Disassembly:
add rdi, rsp
and r9b, cl
mov qword [rdi + rsi - 0x330229fd], rdx
rol r8, cl
mov esi, dword [rbp + rcx - 0x7ab88f4a]
xor r9b, al
lea rbp, [rax + rbp - 0x5fbc6c53]
mul r8b
movzx edx, ax
xor esi, r11d
call fcn.0271d206
xor dil, 0xbf
xor r11b, dil
lea rdi, [rsp + rdi + 8]
inc dx
neg cl
mov cx, word [rdi + rsi - 0x9d]
jg 0x2608389
mov rdx, qword [rbx + rsi*4 - 0xc0]
lea rax, [r8 + rcx*4 - 0x7d5996da]
lea rbx, [rbx + rsi - 0x22]
cdqe
lea rsi, [rax*8 + 0x351ec72d]
bt ax, si
movzx edi, word [rbp + rax - 0x5fbc6c59]
xor di, r11w
neg r8
and esi, esi
inc di
rol di, 1
add di, 0x2ea5
not di
sub r8, rax
bswap r8d
xor r11w, di
jmp 0x20e5094
Function at 0x2724748
Capabilities:
Encode data using xor

Disassembly:
xor edx, r11d
rol edx, 1
not edx
inc edx
xadd r9, r8
mov eax, 0x10cb687
xor edx, 0x64b9b185
lea edx, [rdx + rsi - 0x7a8a2f5]
push r11
call fcn.02679599
lea rax, [r8 + rcx*2 + 0x41b9ebb7]
push rcx
xor sil, r11b
neg sil
mov qword [rsp + rcx + 3], 0xffffffffe091878e
ror cl, 0xc1
movsx edi, r9b
rol sil, 1
pop rdi
dec sil
xor sil, 0x24
or r9, rcx
add cl, 0x94
xor r11b, sil
cqo
ror al, 0x22
xchg dword [rsp + rcx*8 - 0xca], eax
mov word [rbx + rcx - 0x1c], si
jb 0x268b146
adc ax, 0x3f94
ror ax, 1
xor ax, 0xed06
xchg edi, esi
rol cx, 0x41
shr r8w, 0x8a
xor r11w, ax
and edi, edi
lea rax, [rsp + rax + 0x18]
mov qword [rsi + rax - 0x11b9f00], rdx
push r8
mov rcx, qword [rbx + rsi*4 - 0x46e7bf8]
shl r8b, 0xa1
xchg qword [rsp + 8], rsi
adc rsi, 0x543713
jmp rsi
mov r9d, dword [r8 + r9*4]
shr edi, 8
neg qword [rsp]
and byte [rsp + 7], 0xb9
xor edi, r9d
jmp 0x268dc2b
call fcn.020be22e
not dword [rsp]
inc rax
call fcn.02123f86
and qword [rsp + rdx*2 + 0x10], 0x2110308e
btr ecx, eax
xor esi, r11d
xadd word [rsp + rdx + 0xb], r8w
neg esi
xor qword [rsp + rdx*4 + 9], 0x339a3a9c
inc esi
neg r8d
push r8
push rdx
xor esi, 0x3d360ab3
inc esi
pop rdi
xadd rcx, rax
pop r9
rol esi, 2
rol rdi, 0x23
mov qword [rsp + rax + 0x10], r11
xor dword [rsp + rax + 0x10], esi
lea r11, [rdi + r9 - 0x45788751]
xor edx, eax
mov r11, qword [rsp + rax + 0x10]
movsxd rsi, esi
mul rcx
adc r10, rsi
inc r9w
add dl, byte [rbp + rax + 6]
lea rbp, [rbp + rax*2 + 7]
pop rsi
xor dl, r11b
dec dword [rsp + rax*2 + 4]
mov qword [rsp + rax + 8], r8
setnp al
add dl, al
idiv r8b
lea rcx, [r9 + r8*2 - 0x2b6019e3]
ror dl, 1
inc dl
mov word [rsp + rax - 0xf6], di
rol qword [rsp + rax - 0xf9], cl
sar cx, 0x8f
rol dl, 1
xor r11b, dl
add rsi, 0x3607451e
sar r8, cl
lea rdx, [rsp + rdx + 0x10]
add r9w, 0x8d90
mov r9, qword [rax + rdx - 0x100]
bt edi, ecx
btr esi, r8d
mov qword [rax + rbx - 0x106], r9
btc rsi, rcx
movzx edx, cl
lea rbx, [rbx + rax - 0x106]
ror dword [rsp + rax*2 - 0x1fa], cl
pop rcx
pop rdi
jae fcn.0268705d
mov edx, 0x7f87d109
mov rax, qword [rbx + rdx - 0x7f87d109]
mov r9, qword [rdx + rbx - 0x7f87d101]
lea rcx, [rdx*4 + 0x43007c0d]
add rax, r9
lea rsi, [rdx*2 - 0xdc3adf7]
movsx r9d, dx
mov qword [rbx + rdx - 0x7f87d101], rax
movzx edi, si
xor ecx, 0xf71d8ea6
sal edi, cl
mov edx, dword [rdx + rbp - 0x7f87d109]
not rcx
mov r8d, r9d
lea rbp, [rbp + rdi*2 - 0x1afffffc]
ror dil, 0x85
xor rsi, rdi
jae 0x20af5d5
movzx eax, si
mov qword [rbx + rsi - 0x278a1441], r9
bts rcx, rdi
push rax
bts si, ax
mov eax, dword [rbp + rsi*2 - 0x4f142886]
not cx
xchg qword [rsp + rsi*2 - 0x4f142886], rdi
movzx r9d, sil
lea rbp, [rbp + rsi*2 - 0x4f142882]
movsx r8d, r9b
and cl, sil
xor eax, r11d
not eax
jmp 0x2490447
mov r9d, 0x8ab7c33
mov qword [rsp + r9*2 - 0x1156f866], r9
movzx r9d, byte [rax + r9 - 0x8ab7c33]
shl qword [rsp], 0x53
xor r9d, edi
and r9d, 0xff
sar word [rsp + 4], 0xe1
jbe 0x20b1f06
Function at 0x180044550
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800445ad
lea rbx, [0x1801c1c80]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180044594
cmp r10, 2
jb 0x180044594
cmp byte [r9], r8b
jne 0x180044594
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180044570
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800445ef
lea rbx, [0x1801c1c80]
cmp r8b, 0x23
jne 0x1800445d3
cmp byte [r9], r8b
jne 0x1800445d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800445c0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1800447a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x1800447be
mov qword [r8], r14
lea rdx, [0x1801c1720]
call fcn.180044600
mov rbx, rax
test rax, rax
jne 0x1800447e3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18004490f
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18004490f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18004490f
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18004490f
cmp rdi, 0xffffffffffffffff
je 0x18004490f
mov rcx, rdi
call fcn.180048450
mov rbp, rax
test rax, rax
je 0x18004490f
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1800448fc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x180242b30]
test r8, r8
je 0x1800448f1
movsx rdx, word [r8 + 0x34e0]
lea rcx, [r8 + 0x34e4]
mov r9d, dword [r8 + 0x1278]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x1800448e6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x34e0], cx
movsx rax, cx
lea rcx, [r8 + 0x34e4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x34dc]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180044918
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18004490a
mov qword [rsi], rdi
mov rax, rbp
jmp 0x18004491a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18004ba90
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18004bae0
lea r11, [0x1801c1c80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18004bac3
cmp byte [r8], r9b
jne 0x18004bac3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18004bab0
mov rcx, qword [0x180242b30]
not eax
movsxd rdx, dword [rcx + 0x1310]
mov r9, qword [rcx + 0x1318]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18004bb41
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18004bb39
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18004bb3c
mov rdx, r8
test rdx, rdx
jne 0x18004bb10
cmp r9, r10
je 0x18004bb50
cmp dword [r9], eax
jne 0x18004bb50
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180051d10
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x108]
lea r11, [0x1801c1c80]
mov rax, qword [rcx + 0x110]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
sar eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
sar eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov eax, r10d
xor rdx, rcx
sar eax, 0x18
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x1384], ebx
jne 0x180051da8
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.18005d0e0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180051db0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
vmovss xmm2, dword [rcx + 0x128]
vmovss xmm0, dword [rdx]
vmovss xmm1, dword [rdx + 4]
mov rax, qword [rcx + 0x110]
lea r10, [0x1801c1c80]
vmovss xmm3, dword [rcx + 0x12c]
movsxd rcx, dword [rcx + 0x108]
vsubss xmm4, xmm0, xmm2
vmovss xmm0, dword [rdx + 8]
vmovd r8d, xmm4
mov r9d, dword [rax + rcx*4 - 4]
not r9d
movzx ecx, r9b
shr r9d, 8
vsubss xmm5, xmm1, xmm3
vmovss xmm1, dword [rdx + 0xc]
vmovss dword [rsp], xmm4
movzx eax, byte [rsp]
xor rcx, rax
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
vsubss xmm0, xmm0, xmm2
vmovss dword [rsp + 4], xmm5
vmovss dword [rsp + 8], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 0xc], xmm2
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm5
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
vmovd r8d, xmm2
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x18005ba30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3400], 0
lea rbx, [rcx + 0x3408]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18005bad7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x18005ba8a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18005e1e0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180045130
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3400]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3410]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180242b28]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18005badf
mov rcx, rbx
call fcn.180045130
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18005bd40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x180242b30]
xor ebp, ebp
cmp byte [rbx + 0x3350], bpl
jne 0x18005be1f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18005be18
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.1800447a0
mov rsi, rax
test rax, rax
je 0x18005be18
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x18005bda4
mov rcx, rax
call fcn.18005bf70
mov r8, qword [0x180242b30]
test r8, r8
je 0x18005be0f
movsx rdx, word [r8 + 0x34e0]
lea rcx, [r8 + 0x34e4]
mov r9d, dword [r8 + 0x1278]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18005be04
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x34e0], cx
movsx rax, cx
lea rcx, [r8 + 0x34e4]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x34dc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x3350], 1
vmovss xmm0, dword [rbx + 0x3354]
vxorps xmm1, xmm1, xmm1
vcomiss xmm0, xmm1
jbe 0x18005beb5
vsubss xmm0, xmm0, dword [rbx + 0x18]
vcomiss xmm1, xmm0
vmovss dword [rbx + 0x3354], xmm0
jb 0x18005beb5
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x18005bea8
mov rax, qword [0x180242b30]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x3354], ebp
call fcn.18005c1d0
lea rdx, [0x1801c1724]
mov rcx, rdi
mov rsi, rax
call fcn.180044600
mov rdi, rax
test rax, rax
je 0x18005beaf
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x18005beaf
mov byte [rbx + 0xe6], 1
mov dword [rbx + 0x3354], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x18005bed0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180242b30]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x18005bf33
mov qword [rsp], rbx
lea rbx, [0x1801c1c80]
nop dword [rax]
cmp r9b, 0x23
jne 0x18005bf13
cmp byte [r8], r9b
jne 0x18005bf13
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x18005bf00
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x3368]
not eax
mov r8, qword [r10 + 0x3370]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x18005bf5f
cmp dword [r8 + 8], eax
je 0x18005bf66
add r8, 0x48
cmp r8, rcx
jne 0x18005bf50
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret