joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ee420
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1800e7a0e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.180182790
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1800e7a1a
cmp rbx, rbp
jne 0x1800e79c0
cmp qword [rsp + 0x68], r14
jne 0x1800e79ed
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1800e7a29
mov qword [r15], r12
mov rax, r12
jmp 0x1800e7a2c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1800e79ed
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.180182790
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1800e7ac6
cmp rbx, rbp
jne 0x1800e7aa0
jmp 0x1800e79ea
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1800e7a40
jmp 0x1800e79ed
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800ee4cc
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1800ee45a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1800e7910
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800ee49a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.180182790
mov rcx, rbx
test rbx, rbx
jne 0x1800ee480
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1800e22d0
add rsp, 0x20
pop rdi
ret
Function at 0x180101f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xa0
mov rdi, rcx
mov rcx, qword [0x18019d6d0]
call fcn.180114a10
mov rcx, rax
call fcn.1801032c0
mov rcx, rax
call fcn.1801007a0
mov rbx, rax
test rax, rax
je 0x180102234
mov rcx, rdi
call fcn.18011fe90
cmp eax, 2
jne 0x180102234
mov rcx, rdi
call fcn.180114a10
mov rcx, rax
call fcn.1801032c0
mov rcx, rax
call fcn.1801007a0
mov rcx, rax
test rax, rax
je 0x180102234
movzx r8d, word [rbx]
mov r9d, 0x84222325
mov qword [rsp + 0xb0], rbp
mov rdx, rbx
mov qword [rsp + 0xc0], rsi
mov r10d, r9d
test r8w, r8w
je 0x18010201c
nop dword [rax]
nop word [rax + rax]
movzx eax, r8w
lea rdx, [rdx + 2]
movzx r8d, word [rdx]
xor eax, r10d
imul r10d, eax, 0x1b3
test r8w, r8w
jne 0x180102000
movzx eax, word [rcx]
mov edx, r9d
test ax, ax
je 0x180102047
nop word [rax + rax]
movzx eax, ax
lea rcx, [rcx + 2]
xor eax, edx
imul edx, eax, 0x1b3
movzx eax, word [rcx]
test ax, ax
jne 0x180102030
movabs rax, 0x8e992baa241ea547
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xb8], rax
movabs rdi, 0x93e8cbcb24d100b0
mov rax, qword [rsp + 0xb8]
movabs rbp, 0x8e992baa241ea577
mov qword [rsp + 0x20], rax
mov esi, r9d
mov qword [rsp + 0xb8], rdi
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0xb8], rbp
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xb8], rdi
mov rax, qword [rsp + 0xb8]
vmovdqu xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x68], rax
vpxor xmm1, xmm0, xmmword [rsp + 0x60]
vmovq r8, xmm1
vmovdqu xmmword [rsp + 0x20], xmm1
test r8w, r8w
je 0x1801020fc
nop
movzx eax, r8w
lea rcx, [rcx + 2]
xor eax, esi
imul esi, eax, 0x1b3
movzx eax, word [rcx]
movzx r8d, ax
test ax, ax
jne 0x1801020e0
movzx eax, word [rbx]
mov rcx, rbx
mov r11d, r9d
test ax, ax
je 0x180102129
nop word [rax + rax]
movzx eax, ax
lea rcx, [rcx + 2]
xor eax, r11d
imul r11d, eax, 0x1b3
movzx eax, word [rcx]
test ax, ax
jne 0x180102110
mov qword [rsp + 0xb8], rbp
lea rcx, [rsp + 0x40]
mov rax, qword [rsp + 0xb8]
mov r8d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xb8], rdi
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xb8], rbp
mov rax, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xb8]
vmovdqu xmm0, xmmword [rsp + 0x40]
mov qword [rsp + 0x88], rax
vpxor xmm1, xmm0, xmmword [rsp + 0x80]
vmovq rdi, xmm1
vmovdqu xmmword [rsp + 0x40], xmm1
test di, di
je 0x1801021ce
movzx eax, di
lea rcx, [rcx + 2]
xor eax, r8d
imul r8d, eax, 0x1b3
movzx eax, word [rcx]
movzx edi, ax
test ax, ax
jne 0x1801021b2
movzx eax, word [rbx]
test ax, ax
je 0x1801021ef
movzx eax, ax
lea rbx, [rbx + 2]
xor eax, r9d
imul r9d, eax, 0x1b3
movzx eax, word [rbx]
test ax, ax
jne 0x1801021d6
cmp r10d, edx
jne 0x180102219
cmp r9d, r8d
je 0x180102219
cmp r11d, esi
je 0x180102219
mov rsi, qword [rsp + 0xc0]
mov al, 1
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rdi
ret
mov rsi, qword [rsp + 0xc0]
xor al, al
mov rbx, qword [rsp + 0xc8]
add rsp, 0xa0
pop rdi
ret
mov rbx, qword [rsp + 0xc8]
xor al, al
add rsp, 0xa0
pop rdi
ret
Function at 0x18011aaf0
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
sub rsp, 0x28
mov r9, qword [0x18019d570]
movabs rax, 0xcbf29ce484222325
mov r10, qword [0x18019d548]
mov r8, rcx
movzx edx, cl
movabs rcx, 0x100000001b3
xor rdx, rax
movzx eax, byte [r11 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r11 + 0xf]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and r9, rdx
shl r9, 4
add r9, qword [0x18019d558]
mov rcx, qword [r9 + 8]
mov rax, rcx
cmp rcx, r10
je 0x18011abb2
mov rdx, qword [r9]
cmp r8, qword [rcx + 0x10]
je 0x18011abb4
cmp rax, rdx
je 0x18011abb2
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x18011aba1
jmp 0x18011abb4
xor eax, eax
test rax, rax
jne 0x18011abc3
mov eax, 0x12
add rsp, 0x28
ret
cmp rcx, r10
je 0x18011abe8
mov rax, qword [r9]
cmp r8, qword [rcx + 0x10]
je 0x18011abe0
cmp rcx, rax
je 0x18011abe8
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x18011abd1
mov eax, dword [rcx + 0x18]
add rsp, 0x28
ret
lea rcx, [0x1800a9538]
call fcn.1800e6e30
int3
Function at 0x180120340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
call fcn.1800ee350
mov rsi, rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r15b
jne 0x180120385
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.1800db380
lea r8, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
cmp r13, 0xf
cmova r8, r14
movabs rdx, 0xcbf29ce484222325
mov rcx, r15
mov rbp, qword [rsp + 0x40]
test rbp, rbp
je 0x1801203f4
movabs r9, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rbp
jb 0x1801203e0
mov rcx, qword [0x18019c020]
and rcx, rdx
add rcx, rcx
mov rax, qword [0x18019c008]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [0x18019bff8]
je 0x18012045e
mov r12, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x180120432
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
cmp r13, 0xf
cmova rcx, r14
cmp rbp, rax
jne 0x180120450
mov r8, rbp
call fcn.180184e00
test eax, eax
je 0x18012045b
cmp rbx, r12
je 0x18012045e
mov rbx, qword [rbx + 8]
jmp 0x180120420
mov r15, rbx
cmp r13, 0xf
jbe 0x180120495
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x18012048d
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18012054a
mov rcx, r14
call fcn.180182790
test r15, r15
jne 0x1801204a1
xor eax, eax
jmp 0x180120526
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x50], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x60], xmm1
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1801204b5
mov r8, rdi
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.1800db380
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x20]
lea rcx, [0x18019bff0]
call fcn.1800e0f30
mov rcx, qword [rax]
mov ebx, dword [rcx + 0x30]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x180120524
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18012051f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180120544
call fcn.180182790
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1800e6e30
int3
call fcn.1800e6e30
int3
Function at 0x180139020
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1801a8400]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180139083
mov qword [rsp], rbx
lea rbx, [0x1800aa760]
nop dword [rax]
cmp r9b, 0x23
jne 0x180139063
cmp byte [r8], r9b
jne 0x180139063
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180139050
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bc8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1801390b7
mov r10, qword [r10 + 0x5bd0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1801390be
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1801390a4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret

Function at 0x1801390d0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x180139120
lea r11, [0x1800aa760]
nop dword [rax]
cmp r9b, 0x23
jne 0x180139103
cmp byte [r8], r9b
jne 0x180139103
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1801390f0
mov rcx, qword [0x1801a8400]
not eax
movsxd rdx, dword [rcx + 0x3ec0]
mov r9, qword [rcx + 0x3ec8]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x180139181
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x180139179
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18013917c
mov rdx, r8
test rdx, rdx
jne 0x180139150
cmp r9, r10
je 0x180139190
cmp dword [r9], eax
jne 0x180139190
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret

Function at 0x180139820
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rcx + 0xe8]
mov r9, r8
mov r8, qword [rcx + 0xf0]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [r8 + rax*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.18013a4d0
Function at 0x180139850
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf0]
lea r9, [0x1800aa760]
vmovss xmm3, dword [rcx + 0x108]
vmovss xmm4, dword [rcx + 0x10c]
movsxd rcx, dword [rcx + 0xe8]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret

Function at 0x18013a4d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18013a52d
lea rbx, [0x1800aa760]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18013a514
cmp r10, 2
jb 0x18013a514
cmp byte [r9], r8b
jne 0x18013a514
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18013a4f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18013a56f
lea rbx, [0x1800aa760]
cmp r8b, 0x23
jne 0x18013a553
cmp byte [r9], r8b
jne 0x18013a553
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18013a540
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18013a8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r13
push r15
sub rsp, 0x10
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov qword [rsp + 0x40], rbp
mov rdi, rdx
mov qword [rsp + 0x48], rsi
mov r15d, r10d
mov qword [rsp + 8], r12
mov qword [rsp], r14
mov qword [rsp + 0x38], rcx
lea r13, [0x180000000]
test rdi, rdi
je 0x18013a915
cmp rcx, rdi
jae 0x18013aab2
movzx r8d, byte [rcx]
test r8b, r8b
je 0x18013aab2
mov ebx, r10d
mov eax, r8d
shr rax, 3
mov rdx, rdi
movsx r9, byte [rax + r13 + 0xab0f0]
test r9d, r9d
sete bl
add ebx, r9d
test rdi, rdi
jne 0x18013a94c
movsxd rdx, ebx
add rdx, rcx
cmp rcx, rdx
lea rax, [rcx + 1]
mov esi, r8d
cmovae esi, r10d
cmp rax, rdx
jae 0x18013a965
movzx r12d, byte [rax]
jmp 0x18013a968
xor r12b, r12b
lea rax, [rcx + 2]
cmp rax, rdx
jae 0x18013a977
movzx r14d, byte [rax]
jmp 0x18013a97a
xor r14b, r14b
lea rax, [rcx + 3]
cmp rax, rdx
jae 0x18013a988
movzx ebp, byte [rax]
jmp 0x18013a98b
xor bpl, bpl
lea r11, [r9*4]
movzx eax, sil
mov edx, dword [r11 + r13 + 0xab110]
and edx, eax
movzx r9d, r12b
shl edx, 6
mov eax, r9d
and eax, 0x3f
movzx r8d, r14b
or edx, eax
movzx r10d, bpl
shl edx, 6
and r9d, 0xc0
mov eax, r8d
and r8d, 0xc0
and eax, 0x3f
or edx, eax
mov eax, r10d
and eax, 0x3f
shr r10d, 2
or r10d, r8d
shl edx, 6
or edx, eax
shr r10d, 2
mov eax, dword [r11 + r13 + 0xab140]
or r10d, r9d
shrx r13d, edx, eax
shr r10d, 2
lea r9, [0x180000000]
cmp r13d, dword [r11 + r9 + 0xab128]
sbb eax, eax
xor r8d, r8d
and eax, 0x40
mov edx, r8d
or r10d, eax
mov eax, r13d
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r8d
or r10d, edx
mov edx, 0x100
cmp r13d, 0xffff
cmova eax, edx
or r10d, eax
mov eax, dword [r11 + r9 + 0xab158]
xor r10d, 0x2a
sarx edx, r10d, eax
test edx, edx
je 0x18013aa9c
test sil, sil
mov ecx, r8d
mov eax, r8d
setne cl
test bpl, bpl
setne al
add ecx, eax
mov eax, r8d
test r14b, r14b
setne al
add ecx, eax
mov eax, r8d
test r12b, r12b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
inc r15d
movsxd rcx, ecx
add rcx, qword [rsp + 0x38]
xor r10d, r10d
jmp 0x18013a8fb
movsxd rax, ebx
add rcx, rax
test r13d, r13d
je 0x18013aab2
inc r15d
xor r10d, r10d
jmp 0x18013a8fb
mov r14, qword [rsp]
mov eax, r15d
mov r12, qword [rsp + 8]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x10
pop r15
pop r13
pop rdi
ret
Function at 0x18013ab30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x20], rsi
xor edx, edx
mov rsi, r9
lea rax, [rcx + rax*2]
mov qword [rsp + 8], rax
cmp rcx, rax
jae 0x18013ad53
mov qword [r11 + 0x18], rbp
lea rbp, [0x180000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
nop
mov qword [rsp], r8
test rsi, rsi
je 0x18013ab92
cmp r8, rsi
jae 0x18013ad30
movzx edx, byte [r8]
test dl, dl
je 0x18013ad2e
mov eax, edx
mov rcx, rsi
shr rax, 3
movsx r9, byte [rax + rbp + 0xab0f0]
xor eax, eax
test r9d, r9d
mov ebx, eax
sete bl
add ebx, r9d
test rsi, rsi
jne 0x18013abc8
movsxd rcx, ebx
add rcx, r8
cmp r8, rcx
mov r14d, edx
cmovae r14d, eax
lea rax, [r8 + 1]
cmp rax, rcx
jae 0x18013abe1
movzx r13d, byte [rax]
jmp 0x18013abe4
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x18013abf3
movzx r12d, byte [rax]
jmp 0x18013abf6
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x18013ac05
movzx r15d, byte [rax]
jmp 0x18013ac08
xor r15b, r15b
lea r11, [r9*4]
movzx eax, r14b
mov ecx, dword [r11 + rbp + 0xab110]
and ecx, eax
movzx r9d, r13b
shl ecx, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or ecx, eax
movzx r10d, r15b
shl ecx, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or ecx, eax
mov eax, r10d
and eax, 0x3f
shr r10d, 2
or r10d, edx
shl ecx, 6
or ecx, eax
shr r10d, 2
mov eax, dword [r11 + rbp + 0xab140]
or r10d, r9d
shrx ebp, ecx, eax
shr r10d, 2
lea r9, [0x180000000]
cmp ebp, dword [r11 + r9 + 0xab128]
sbb eax, eax
xor edx, edx
and eax, 0x40
mov ecx, edx
or r10d, eax
mov eax, ebp
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove ecx, eax
mov eax, edx
or r10d, ecx
mov ecx, 0x100
cmp ebp, 0xffff
cmova eax, ecx
or r10d, eax
mov eax, dword [r11 + r9 + 0xab158]
xor r10d, 0x2a
sarx ecx, r10d, eax
test ecx, ecx
je 0x18013ad09
test r14b, r14b
mov eax, edx
mov ecx, edx
mov ebp, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, edx
test r12b, r12b
setne al
add ecx, eax
mov eax, edx
test r13b, r13b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
movsxd r8, ecx
add r8, qword [rsp]
jmp 0x18013ad13
movsxd rax, ebx
add r8, rax
test ebp, ebp
je 0x18013ad30
mov word [rdi], bp
add rdi, 2
lea rbp, [0x180000000]
cmp rdi, qword [rsp + 8]
jb 0x18013ab80
jmp 0x18013ad30
xor edx, edx
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov word [rdi], dx
test rax, rax
je 0x18013ad68
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x1801418a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801a8400]
lea rdx, [0x1800aa760]
mov r8d, ecx
mov rbx, qword [rax + 0x3ee0]
add rbx, 0xe8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x180141957
lea ecx, [r9 + 1]
test r8d, r8d
je 0x180141943
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x180141948
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.180149fc0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180160e10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801a8400]
mov rcx, qword [rax + 0x4b28]
mov r10, qword [rax + 0x3ee0]
movsxd rax, dword [rcx + 0x7c]
vmovss xmm4, dword [rcx + 0x170]
vmovss xmm3, dword [rcx + 0x174]
vmovss xmm2, dword [rcx + 0x178]
vmovss xmm1, dword [rcx + 0x17c]
vmovups xmm0, xmmword [rcx + 0x170]
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x290]
add r9, qword [rcx + 0x18]
vmovups xmmword [r10 + 0x230], xmm0
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x290]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x290]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp 0x180157460

Function at 0x180160ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1801a8400]
mov rcx, qword [rax + 0x4b28]
mov r9, qword [rax + 0x3ee0]
vmovups xmm0, xmmword [r9 + 0x230]
vmovups xmmword [rcx + 0x170], xmm0
vmovss xmm4, dword [rcx + 0x150]
vmovss xmm3, dword [rcx + 0x154]
vmovss xmm2, dword [rcx + 0x158]
vmovss xmm1, dword [rcx + 0x15c]
vmovups xmm0, xmmword [rcx + 0x150]
mov rax, qword [r9 + 0x290]
vmovups xmmword [r9 + 0x230], xmm0
vmovss dword [rsp + 0x20], xmm4
vmovss dword [rsp + 0x24], xmm3
vmovss dword [rsp + 0x28], xmm2
vmovss dword [rsp + 0x2c], xmm1
vmovss dword [rax + 0x88], xmm4
vmovss dword [rax + 0x8c], xmm3
vmovss dword [rax + 0x90], xmm2
vmovss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x290]
vmovups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
vmovups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x20f]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x290]
add rsp, 0x38
jmp 0x180157460