joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017350
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400174ff
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140017fb0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x1400174f2
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x1400173f1
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x1400174f2
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rcx
movzx r11d, byte [rdx + 0x13]
xor r11, r8
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x1400173e0
mov r14, qword [r9 + rbx*8]
mov ebp, dword [rdx + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x140017490
mov r10, qword [r14]
cmp r10, rdx
je 0x1400173e4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x1400173e4
cmp r11, r14
je 0x1400174c8
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x140017490
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400173e8
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x1400173e8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140171bf4
int3
Function at 0x140025750
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1400257e6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400257ed
mov r15, rsi
jmp 0x1400257ab
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.1403766a0
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x1400257de
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400257c3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x140025780
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400257de
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x1400257ab
sub rsi, r15
jmp 0x1400258da
xor esi, esi
jmp 0x1400258da
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140025840
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140025840
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.1403766a0
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140025851
jmp 0x1400258d7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x1400258d7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140025880
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x1400258b3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.1403586d8
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140025880
jmp 0x1400258d7
test r14, r14
je 0x1400258d4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.1403586d8
sub r14, rax
jmp 0x1400258d7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14002a940
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14002aaef
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140017fb0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x14002aae2
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x14002a9e1
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x14002aae2
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x13]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x14002a9d0
mov r14, qword [r9 + rbx*8]
mov ebp, dword [rdx + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x14002aa80
mov r10, qword [r14]
cmp r10, rdx
je 0x14002a9d4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x14002a9d4
cmp r11, r14
je 0x14002aab8
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x14002aa80
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x14002a9d8
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x14002a9d8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140171bf4
int3
Function at 0x14002e9e0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
call fcn.1400644a0
mov rsi, rax
mov rbx, qword [0x1406b9500]
mov edx, dword [rbx + 0x48]
cmp edx, 0xffffffff
je 0x14002ea49
cmp dword [rsi + 0x6b4], edx
je 0x14002ea49
lea rdi, [0x1406b9508]
mov rcx, rdi
call fcn.14003a4c0
mov eax, dword [rbx + 0x48]
mov dword [rsi + 0x6b4], eax
mov dword [rsi + 0x6b8], 0
lea rdx, [rsi + 0xd0]
lea rcx, [rsi + 0x3a0]
mov r8d, 0x2d0
call fcn.1403766a0
mov rcx, rdi
call fcn.140047700
movss xmm0, dword [0x140378014]
ucomiss xmm0, dword [rsi + 0x6b8]
jbe 0x14002eaaf
add rsi, 0x6b8
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x3c23d70a
mov dword [rsp + 0x20], 0x3f800000
movss xmm1, dword [0x140378014]
movss xmm2, dword [0x1403785d8]
xorps xmm3, xmm3
mov rcx, rsi
call fcn.14006ce20
lea rcx, [0x1406b9508]
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.140034750
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140034750
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x300
mov edi, r9d
mov rsi, r8
mov ebx, edx
mov r14, rcx
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
test r8, r8
je 0x1400348b8
cmp ebx, 0xffffffff
jne 0x14003478b
mov ebx, dword [r14]
mov rdx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
sub rax, rdx
shr rax, 4
imul eax, eax, 0x677d46cf
cmp ebx, eax
jge 0x1400347b6
movsxd rax, ebx
imul rax, rax, 0x2f0
add rdx, rax
jmp 0x140034847
mov eax, ebx
shr eax, 0x18
mov ecx, ebx
shr ecx, 0x10
movzx edx, bl
movabs r8, 0xcbf29ce484222325
xor r8, rdx
movabs rdx, 0x100000001b3
imul r8, rdx
movzx ebp, bh
xor rbp, r8
imul rbp, rdx
movzx ecx, cl
xor rcx, rbp
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and rcx, qword [r14 + 0x50]
mov rax, qword [r14 + 0x28]
mov r8, qword [r14 + 0x38]
mov rdx, rcx
shl rdx, 4
mov rdx, qword [r8 + rdx + 8]
cmp rdx, rax
je 0x140034899
cmp ebx, dword [rdx + 0x10]
je 0x14003483e
add rcx, rcx
mov rcx, qword [r8 + rcx*8]
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x140034899
mov rdx, qword [rdx + 8]
cmp ebx, dword [rdx + 0x10]
jne 0x140034830
cmp rdx, rax
je 0x140034899
add rdx, 0x18
lea rcx, [rsp + 0x28]
mov r8d, 0x2d0
call fcn.1403766a0
test dil, dil
je 0x1400348ce
add rsi, 0xf0
lea rax, [rsp + 0x48]
xor ecx, ecx
nop word [rax + rax]
movups xmm0, xmmword [rax + rcx - 0x20]
movups xmmword [rsi + rcx - 0x20], xmm0
movups xmm0, xmmword [rax + rcx - 0x10]
movups xmmword [rsi + rcx - 0x10], xmm0
movups xmm0, xmmword [rax + rcx]
movups xmmword [rsi + rcx], xmm0
add rcx, 0x30
cmp rcx, 0x2d0
jne 0x140034870
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.140170e40
nop
add rsp, 0x300
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.1400644a0
mov rsi, rax
cmp ebx, 0xffffffff
je 0x140034788
jmp 0x14003478b
xor eax, eax
movups xmm0, xmmword [rsp + rax + 0x28]
movups xmm1, xmmword [rsi + rax + 0x3a0]
subps xmm0, xmm1
movss xmm2, dword [rsi + 0x6b8]
shufps xmm2, xmm2, 0
mulps xmm2, xmm0
addps xmm2, xmm1
movups xmmword [rsi + rax + 0xd0], xmm2
cmp rax, 0x2c0
je 0x140034899
movups xmm0, xmmword [rsp + rax + 0x38]
movups xmm1, xmmword [rsi + rax + 0x3b0]
subps xmm0, xmm1
movss xmm2, dword [rsi + 0x6b8]
shufps xmm2, xmm2, 0
mulps xmm2, xmm0
addps xmm2, xmm1
movups xmmword [rsi + rax + 0xe0], xmm2
add rax, 0x20
jmp 0x1400348d0
Function at 0x14004b1b0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x14004b22a
mov rdi, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14004b22a
movsxd rax, dword [rdi + 0x3c]
cmp rax, 0x400
jg 0x14004b22a
cmp dword [rdi + rax], 0x4550
jne 0x14004b22a
mov ecx, dword [rdi + rax + 0x90]
test rcx, rcx
je 0x14004b22a
mov edx, dword [rdi + rax + 0x94]
mov al, 1
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x14004b22c
add rcx, rdi
xor edx, edx
movabs rbp, 0x8000000080000000
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rcx
jmp 0x14004b259
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x30]
add rdx, 0x14
cmp rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jae 0x14004b2ef
mov esi, dword [rcx + rdx]
mov r13d, dword [rcx + rdx + 0x10]
mov eax, r13d
or eax, esi
je 0x14004b2ef
mov qword [rsp + 0x30], rdx
mov ebx, dword [rdx + rcx + 0xc]
add rbx, rdi
test rsi, rsi
cmove rsi, r13
add r13, rdi
add rsi, rdi
jmp 0x14004b298
add r13, 8
add rsi, 8
mov rax, qword [rsi]
test rax, rbp
je 0x14004b2c0
movzx r14d, ax
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
test rax, rax
jne 0x14004b2cd
jmp 0x14004b240
mov rax, qword [r13]
test rax, rax
je 0x14004b240
cmp rax, qword [rsi]
jne 0x14004b290
lea r14, [rax + rdi]
add r14, 2
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
jmp 0x14004b290
mov al, 1
jmp 0x14004b22c
Function at 0x14005ea10
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, edx
mov r8d, ecx
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14005ea4a
mov rdi, rax
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x14005ea4c
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140066520
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rdx
mov rdx, r8
sub rdx, rax
test r8, r8
cmove rdx, r8
mov r8, qword [rcx + 0xe0]
movsxd rcx, dword [rcx + 0xd8]
mov r8d, dword [r8 + rcx*4 - 4]
mov rcx, rax
jmp fcn.14006ad30

Function at 0x1400688c0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdx, qword [0x1406b9cb8]
mov rdi, qword [rdx + 0x1ed0]
mov rsi, qword [rdi + 0xe0]
movsxd rax, dword [rdi + 0xd8]
mov r8d, dword [rsi + rax*4 - 4]
not r8d
mov r9d, r8d
shr r9d, 8
xor r8d, ecx
movzx r10d, r8b
lea r8, [0x14037bf20]
xor r9d, dword [r8 + r10*4]
mov r10d, ecx
shr r10d, 8
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10d, ecx
shr r10d, 0x10
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
movzx r10d, r9b
shr r9d, 8
mov r11d, ecx
shr r11d, 0x18
xor r11d, r10d
xor r9d, dword [r8 + r11*4]
mov r10, rcx
shr r10, 0x20
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10, rcx
shr r10, 0x28
xor r10d, r9d
shr r9d, 8
movzx r10d, r10b
xor r9d, dword [r8 + r10*4]
mov r10, rcx
shr r10, 0x30
xor r10d, r9d
mov ebx, r9d
shr ebx, 8
movzx r9d, r10b
xor ebx, dword [r8 + r9*4]
movzx r9d, bl
shr rcx, 0x38
xor ecx, r9d
mov ebp, dword [r8 + rcx*4]
cmp eax, dword [rdi + 0xdc]
jne 0x140068a49
lea r14d, [rax + 1]
test eax, eax
je 0x1400689bd
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x1400689c2
mov ecx, 8
cmp ecx, r14d
cmovg r14d, ecx
cmp eax, r14d
jge 0x140068a49
movsxd rcx, r14d
shl rcx, 2
inc dword [rdx + 0x3c8]
mov rdx, qword [0x1406b9cc8]
call qword [0x140462d80]
mov rsi, rax
mov rdx, qword [rdi + 0xe0]
test rdx, rdx
je 0x140068a35
movsxd r8, dword [rdi + 0xd8]
shl r8, 2
mov rcx, rsi
call fcn.1403766a0
mov rcx, qword [rdi + 0xe0]
test rcx, rcx
je 0x140068a28
mov rax, qword [0x1406b9cb8]
test rax, rax
je 0x140068a28
dec dword [rax + 0x3c8]
mov rdx, qword [0x1406b9cc8]
call qword [0x140462d88]
mov qword [rdi + 0xe0], rsi
mov dword [rdi + 0xdc], r14d
mov eax, dword [rdi + 0xd8]
shr ebx, 8
xor ebp, ebx
not ebp
cdqe
mov dword [rsi + rax*4], ebp
inc dword [rdi + 0xd8]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14006a0c0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rdx, qword [0x1406b9cb8]
mov rdi, qword [rdx + 0x1ed0]
mov r9d, ecx
shr r9d, 8
mov r8d, ecx
shr r8d, 0x10
mov rsi, qword [rdi + 0xe0]
movsxd rax, dword [rdi + 0xd8]
mov r10d, dword [rsi + rax*4 - 4]
not r10d
mov r11d, r10d
shr r11d, 8
xor r10d, ecx
movzx r10d, r10b
lea r14, [0x14037bf20]
xor r11d, dword [r14 + r10*4]
mov r10d, r11d
shr r10d, 8
xor r11d, r9d
movzx r9d, r11b
xor r10d, dword [r14 + r9*4]
shr ecx, 0x18
mov ebx, r10d
shr ebx, 8
xor r10d, r8d
movzx r8d, r10b
xor ebx, dword [r14 + r8*4]
movzx r8d, bl
xor r8d, ecx
mov ebp, dword [r14 + r8*4]
cmp eax, dword [rdi + 0xdc]
jne 0x14006a1f3
lea r14d, [rax + 1]
test eax, eax
je 0x14006a167
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14006a16c
mov ecx, 8
cmp ecx, r14d
cmovg r14d, ecx
cmp eax, r14d
jge 0x14006a1f3
movsxd rcx, r14d
shl rcx, 2
inc dword [rdx + 0x3c8]
mov rdx, qword [0x1406b9cc8]
call qword [0x140462d80]
mov rsi, rax
mov rdx, qword [rdi + 0xe0]
test rdx, rdx
je 0x14006a1df
movsxd r8, dword [rdi + 0xd8]
shl r8, 2
mov rcx, rsi
call fcn.1403766a0
mov rcx, qword [rdi + 0xe0]
test rcx, rcx
je 0x14006a1d2
mov rax, qword [0x1406b9cb8]
test rax, rax
je 0x14006a1d2
dec dword [rax + 0x3c8]
mov rdx, qword [0x1406b9cc8]
call qword [0x140462d88]
mov qword [rdi + 0xe0], rsi
mov dword [rdi + 0xdc], r14d
mov eax, dword [rdi + 0xd8]
shr ebx, 8
xor ebp, ebx
not ebp
cdqe
mov dword [rsi + rax*4], ebp
inc dword [rdi + 0xd8]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14006ad30
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov edi, r8d
mov rbx, rcx
mov rax, qword [0x140462cc0]
xor rax, rsp
mov qword [rsp + 0x50], rax
not edi
test rdx, rdx
je 0x14006ae8d
mov r12, rdx
movabs r13, 0xd197de6aa4da15ee
lea r14, [rsp + 0x30]
lea rsi, [0x14037bf20]
mov dword [rsp + 0x2c], edi
jmp 0x14006ad9b
movzx ecx, dil
shr edi, 8
xor ecx, eax
xor edi, dword [rsi + rcx*4]
mov r12, rbp
mov rbx, r15
test rbp, rbp
je 0x14006af97
lea rbp, [r12 - 1]
lea r15, [rbx + 1]
movzx eax, byte [rbx]
cmp eax, 7
jne 0x14006ae50
movabs rax, 0xcdafad660531fb05
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], r13
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
movabs rax, 0xcdfbe1334477be41
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], r13
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
mov r8d, 7
mov rcx, r15
mov rdx, r14
call fcn.14035e8a0
test eax, eax
je 0x14006ae7a
cmp rbp, 8
jb 0x14006ad8c
add rbx, 9
add r12, 0xfffffffffffffff7
jmp 0x14006ae82
cmp al, 0x23
jne 0x14006ad80
cmp rbp, 2
jb 0x14006ad80
cmp byte [r15], 0x23
jne 0x14006ad80
cmp byte [rbx + 2], 0x23
cmove edi, dword [rsp + 0x2c]
jmp 0x14006ad80
add rbx, 8
add r12, 0xfffffffffffffff8
mov r15, rbx
mov rbp, r12
jmp 0x14006ad8c
movzx eax, byte [rbx]
test al, al
je 0x14006af97
movabs rsi, 0xd197de6aa4da15ee
xor r13d, r13d
lea rbp, [rsp + 0x40]
lea r14, [rsp + 0x30]
mov r12d, 8
mov dword [rsp + 0x2c], edi
jmp 0x14006af57
movabs rax, 0xcdafad660531fb05
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
movabs rax, 0xcdfbe1334477be41
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
mov r8d, 7
mov rcx, r15
mov rdx, r14
call fcn.14035e8a0
add rbx, 8
test eax, eax
cmovne r13d, r12d
cmove r15, rbx
mov ecx, r13d
movzx eax, byte [r15]
mov rbx, r15
mov r13d, ecx
test al, al
je 0x14006af97
lea r15, [rbx + 1]
cmp al, 7
je 0x14006aec0
lea ecx, [r13 - 1]
test r13d, r13d
jg 0x14006af49
cmp al, 0x23
jne 0x14006af7f
cmp byte [r15], 0x23
jne 0x14006af7f
cmp byte [rbx + 2], 0x23
cmove edi, dword [rsp + 0x2c]
movzx eax, al
movzx edx, dil
shr edi, 8
xor edx, eax
lea rax, [0x14037bf20]
xor edi, dword [rax + rdx*4]
jmp 0x14006af49
not edi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140170e40
mov eax, edi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14006ef00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov rsi, r8
test r8, r8
je 0x14006ef20
mov qword [rsi], 0
call fcn.14006e0f0
test rax, rax
je 0x14006ef58
mov rdi, rax
mov rcx, rax
call fcn.140358a9c
cmp eax, 0xffffffff
je 0x14006ef50
mov ebp, eax
mov rcx, rdi
xor edx, edx
mov r8d, 2
call fcn.140350568
test eax, eax
je 0x14006ef6d
mov rcx, rdi
call fcn.1403576d0
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call fcn.140358a9c
cmp eax, 0xffffffff
je 0x14006ef50
mov r14d, eax
xor r15d, r15d
mov rcx, rdi
mov edx, ebp
xor r8d, r8d
call fcn.140350568
neg eax
sbb r15d, r15d
or r15d, r14d
cmp r15d, 0xffffffff
je 0x14006ef50
movsxd r15, r15d
movsxd r12, ebx
lea rcx, [r15 + r12]
mov rax, qword [0x1406b9cb8]
test rax, rax
je 0x14006efb7
inc dword [rax + 0x3c8]
mov rdx, qword [0x1406b9cc8]
call qword [0x140462d80]
test rax, rax
je 0x14006ef50
mov r14, rax
mov edx, 1
mov rcx, rax
mov r8, r15
mov r9, rdi
call fcn.1403586d8
cmp rax, r15
jne 0x14006f011
test ebx, ebx
jle 0x14006eff8
mov rcx, r14
add rcx, r15
xor edx, edx
mov r8, r12
call fcn.140376d40
mov rcx, rdi
call fcn.1403576d0
test rsi, rsi
je 0x14006ef5b
mov qword [rsi], r15
jmp 0x14006ef5b
mov rcx, rdi
call fcn.1403576d0
mov rax, qword [0x1406b9cb8]
test rax, rax
je 0x14006f02b
dec dword [rax + 0x3c8]
mov rdx, qword [0x1406b9cc8]
mov rcx, r14
call qword [0x140462d88]
jmp 0x14006ef58
Function at 0x140080f90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0xa8
movdqa xmmword [rsp + 0x90], xmm15
movdqa xmmword [rsp + 0x80], xmm14
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm12
movaps xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
shufps xmm1, xmm1, 0
movdqa xmm5, xmmword [0x14037eee0]
movdqa xmm6, xmmword [0x14037eef0]
movdqa xmm3, xmmword [0x14037ef00]
movdqa xmm4, xmmword [0x14037ef10]
xor eax, eax
movdqa xmm11, xmmword [0x14037ef70]
movdqa xmm13, xmmword [0x14037ef90]
movaps xmm12, xmmword [0x14037ef50]
nop dword [rax]
movdqa xmm0, xmm3
movdqa xmm8, xmmword [0x14037ef20]
pand xmm0, xmm8
movdqa xmm9, xmmword [0x14037ef30]
por xmm0, xmm9
movdqa xmm14, xmm3
psrld xmm14, 0x10
movdqa xmm10, xmmword [0x14037ef40]
por xmm14, xmm10
subps xmm14, xmm12
addps xmm14, xmm0
movdqa xmm0, xmm4
pand xmm0, xmm8
por xmm0, xmm9
movdqa xmm15, xmm4
psrld xmm15, 0x10
por xmm15, xmm10
subps xmm15, xmm12
addps xmm15, xmm0
movdqa xmm2, xmm5
pand xmm2, xmm8
por xmm2, xmm9
movdqa xmm0, xmm5
psrld xmm0, 0x10
por xmm0, xmm10
subps xmm0, xmm12
addps xmm0, xmm2
movdqa xmm7, xmm6
pand xmm7, xmm8
por xmm7, xmm9
movdqa xmm2, xmm6
psrld xmm2, 0x10
por xmm2, xmm10
subps xmm2, xmm12
addps xmm2, xmm7
mulps xmm2, xmm1
mulps xmm0, xmm1
mulps xmm15, xmm1
mulps xmm14, xmm1
cvttps2dq xmm8, xmm14
movdqa xmm7, xmm8
psrad xmm7, 0x1f
movaps xmm10, xmmword [0x14037ef60]
subps xmm14, xmm10
cvttps2dq xmm14, xmm14
pand xmm14, xmm7
por xmm14, xmm8
cvttps2dq xmm7, xmm15
movdqa xmm8, xmm7
psrad xmm8, 0x1f
subps xmm15, xmm10
cvttps2dq xmm15, xmm15
pand xmm15, xmm8
por xmm15, xmm7
cvttps2dq xmm9, xmm0
movdqa xmm8, xmm9
psrad xmm8, 0x1f
subps xmm0, xmm10
cvttps2dq xmm7, xmm0
pand xmm7, xmm8
por xmm7, xmm9
cvttps2dq xmm0, xmm2
movdqa xmm8, xmm0
psrad xmm8, 0x1f
subps xmm2, xmm10
cvttps2dq xmm2, xmm2
pand xmm2, xmm8
por xmm2, xmm0
movdqa xmm8, xmm2
movdqa xmm9, xmmword [0x14037c580]
pxor xmm8, xmm9
movdqa xmm0, xmm11
pcmpgtd xmm0, xmm8
pand xmm2, xmm0
movdqa xmm10, xmmword [0x14037ef80]
pandn xmm0, xmm10
por xmm0, xmm2
movdqa xmm2, xmm7
pxor xmm2, xmm9
movdqa xmm8, xmm11
pcmpgtd xmm8, xmm2
pand xmm7, xmm8
pandn xmm8, xmm10
por xmm8, xmm7
packuswb xmm0, xmm8
movdqa xmm2, xmm15
pxor xmm2, xmm9
movdqa xmm7, xmm11
pcmpgtd xmm7, xmm2
pand xmm15, xmm7
pandn xmm7, xmm10
por xmm7, xmm15
movdqa xmm2, xmm14
pxor xmm2, xmm9
movdqa xmm8, xmm11
pcmpgtd xmm8, xmm2
pand xmm14, xmm8
pandn xmm8, xmm10
por xmm8, xmm14
packuswb xmm7, xmm8
packuswb xmm7, xmm0
movdqu xmmword [rcx + rax], xmm7
add rax, 0x10
paddd xmm4, xmm13
paddd xmm3, xmm13
paddd xmm6, xmm13
paddd xmm5, xmm13
cmp rax, 0x100
jne 0x140081020
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
movaps xmm12, xmmword [rsp + 0x60]
movaps xmm13, xmmword [rsp + 0x70]
movaps xmm14, xmmword [rsp + 0x80]
movaps xmm15, xmmword [rsp + 0x90]
add rsp, 0xa8
ret