joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482de0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x482e01
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x482df2
mov dword [rsp + 0x28], edx
ret

Function at 0x140001d40
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov ecx, 2
call fcn.140002290
lea rcx, str.Mingw_w64_runtime_failure:_n
mov edx, 0x1b
mov r8d, 1
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 2
call fcn.140002290
mov r8, qword [rsp + 0x28]
mov rcx, rax
mov rdx, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
int3

Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x140006008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x140006008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140006008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x140f37ee4
Capabilities:
Execute anti-debugging instructions

Disassembly:
xor ebp, r10d
cmp r8w, 0x380
cmp bl, bpl
test spl, 0xc8
bswap ebp
cmp r12b, 0x98
add ebp, 0x57331c7d
bswap ebp
rol ebp, 1
jmp 0x140ff4a97
push r8
push rax
xchg r8b, r8b
mov r8b, 0x40
push r11
movzx rax, r11w
cwde
mov ax, r13w
push r10
not ah
cmovge ax, r11w
movsx r8, di
push rsi
cmovne r8w, dx
cwde
push r9
cbw
jmp 0x140fbc76a
push r14
rdtsc
cmovge r8, rsi
cdqe
push r13
movzx ax, ch
not ax
push rbp
lahf
jmp 0x140f7282b
push rbx
movsx rbx, r9w
rdtsc
push r15
bswap edx
mov r8b, 0x64
push rdi
movzx r10, r8w
movsx di, r14b
pushfq
dec r10b
cwd
not dx
push r12
cwd
movabs rax, 0
dec ebp
push rax
bswap r10w
mov rbx, qword [rsp + 0x90]
dec ebx
cdq
btc r10, rsi
bts di, r14w
rol ebx, 1
not dx
xor ebx, 0x13f24652
neg ebx
cqo
sub ebx, 0xefd5373
dec r8b
bts edi, edi
setp r8b
add rbx, rax
xchg rdi, r10
movabs rdx, 0x100000000
or bp, dx
dec r10
add rbx, rdx
btr edi, r8d
xchg r8w, r10w
jmp 0x14100fc4c
jmp rdi
push rdx
not al
push rcx
cdq
movsx rdx, r13w
jmp 0x140f5ba95
push r10
xor r10w, 0x6af5
and r10, 0x150169fa
xor dword [rsp], ebp
pop r10
test r10b, bl
test r14b, 0xb0
movsxd rbp, ebp
cmc
cmp rax, 0x130e2039
add rdi, rbp
jmp 0x140faea46
mov r8, rsp
clc
or rbp, r14
btc r10, rax
sub rsp, 0x180
test dil, bpl
and rsp, 0xfffffffffffffff0
mov r10, rbx
movabs rdx, 0
sub r10, rdx
lea rdi, [0x14100fc78]
mov ebp, dword [rbx]
stc
test r10b, al
add rbx, 4
test bpl, 0x74
stc
jmp 0x140f2b85e
Function at 0x1000117cc
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100083350]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov r11, qword [0x100083448]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100011851
xor ecx, ecx
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100083350]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100011873
mov rax, qword [rsp + 0x88]
mov qword [0x100083448], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000833e8], rax
xor ecx, ecx
mov rax, qword [0x100083448]
mov qword [0x100082300], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000833d0], rax
mov dword [0x1000822f0], 0xc0000409
mov dword [0x1000822f4], 1
mov rax, qword [0x100083348]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100083328]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100010f68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x100083348]
jne 0x100060d6b
rol rcx, 0x10
test cx, 0xffff
jne 0x100060d67
ret 0
ror rcx, 0x10
jmp 0x1000117cc
Function at 0x1000155a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r14, rdx
mov r12, rcx
mov rcx, qword [rcx + 0x10]
lea rdi, [rcx + 1]
mov rdx, rdi
mov qword [rsp + 0x20], rdi
mov eax, 0x9c87078c
mov r8d, dword [rdi + 0xc]
lea r10, [0x100000000]
mov rsi, 0xfffffffffffff000
mov rcx, r10
mov r9d, dword [rdi + 4]
mov eax, 0xfffffff
and qword [rsp + 0xa0], 0
and r9, rax
and r8, rax
mov rax, qword [0x100033ac0]
add r9, r10
sub rcx, rax
mov qword [rsp + 0x28], rcx
jne 0x100015681
xor r10d, r10d
test r8, r8
je 0x10001593b
mov edx, dword [rsp + 0xa0]
mov r13d, 0x5092316a
mov ecx, dword [rsp + 0xa4]
movzx eax, byte [r10 + r9]
inc r10
sub eax, r13d
add edx, eax
add eax, ecx
mov ecx, eax
imul ecx, ecx, 0x537a
rol ecx, 6
ror eax, 6
xor ecx, eax
imul ecx, ecx, 0xaf6dce96
ror ecx, 0x1a
imul ecx, ecx, 0xaf6dce96
ror ecx, 0x1a
add edx, ecx
cmp r10, r8
jb 0x100015636
mov dword [rsp + 0xa4], ecx
mov dword [rsp + 0xa0], edx
jmp 0x10001593b
lea rax, [r9 + r8]
movsxd rdx, dword [0x10000003c]
mov qword [rsp + 0x38], rax
lea rax, [0x1000000b0]
add rdx, rax
mov ebp, dword [rdx + 4]
mov eax, r9d
sub eax, r10d
mov r11d, eax
mov ebx, eax
lea rdi, [rax + r8]
and r11, rsi
mov r8d, dword [rdx]
mov r15, rdi
and r15, rsi
add r8, r10
sub rbx, r11
sub rdi, r15
mov qword [rsp + 0x30], rdi
add rbp, r8
jmp 0x1000156db
mov eax, dword [r8]
cmp rax, r11
jae 0x1000156e0
mov eax, dword [r8 + 4]
add r8, rax
cmp r8, rbp
jne 0x1000156cc
xor r10d, r10d
cmp r8, rbp
je 0x10001571a
mov eax, dword [r8]
cmp rax, r11
jne 0x10001571a
mov ecx, dword [r8 + 4]
sub rcx, 8
shr rcx, 1
je 0x10001571a
lea rdx, [r8 + 8]
movzx eax, word [rdx]
and eax, 0xfff
cmp rax, rbx
jae 0x10001571a
inc r10
add rdx, 2
cmp r10, rcx
jne 0x100015701
mov r13d, 0x5092316a
mov r14, qword [rsp + 0x28]
mov edx, dword [rsp + 0xa4]
mov esi, dword [rsp + 0xa0]
lea r12, [0x100000000]
Function at 0x100030aa8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
rdtsc
shl rdx, 0x20
or rax, rdx
cdqe
mov qword [0x100082270], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
lea rbp, [0x100000000]
xor ebx, ebx
and eax, 0x80000000
mov dword [0x1000824f4], eax
cmp dword [0x1000821b8], ebx
jne 0x100030b06
lea rcx, [0x100082460]
call fcn.100015b00
cmp eax, ebx
jl 0x100030cf4
mov dword [0x1000821b8], 1
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea rcx, [0x100000000]
mov rdi, qword [rsp + 0x28]
movsxd rdx, dword [0x10000003c]
mov r8d, 0x80000000
mov edx, dword [rdx + rbp + 0x50]
lea rax, [rdi + r8]
add rdx, rcx
cmp rdx, rax
jb 0x100030b41
lea rdi, [rdx - 0x80000000]
lea rdx, [rdi + 0xffff]
mov rdi, qword [rsp + 0x30]
and rdx, 0xffffffffffff0000
mov qword [0x100083340], rdx
lea rax, [rdi - 0x80000000]
cmp rcx, rax
jbe 0x100030b70
mov qword [0x100082170], rdi
jmp 0x100030b7a
add rcx, r8
mov qword [0x100082170], rcx
mov word [0x100082170], bx
mov rax, qword [0x100082170]
sub rax, rdx
shr rax, 0x10
mov qword [0x100083848], rax
mov eax, ebx
cmp eax, ebx
jl 0x100030cf4
mov rax, qword [0x100082238]
cmp rax, 2
jae 0x100030be6
lea rax, [rax + rax*4]
lea rcx, [rbp + rax*8 + 0x82290]
call fcn.100015b00
mov edx, eax
cmp eax, ebx
jl 0x100030bdf
mov rax, qword [0x100082238]
inc rax
mov qword [0x100082238], rax
cmp rax, 2
jb 0x100030bad
cmp edx, ebx
jge 0x100030be6
mov eax, edx
jmp 0x100030cf4
mov eax, dword [0x10001c66c]
cmp eax, ebx
je 0x100030c7f
mov eax, dword [0x10001c66c]
mov r8d, 0x40
lea r9, [rsp + 0x78]
lea rsi, [0x100079010]
mov edx, dword [0x10000dfa4]
imul edx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, ebx
jne 0x100030c41
call sub.KERNEL32.dll_GetLastError
cmp eax, ebx
mov ecx, 0x54f
cmove eax, ecx
movzx ecx, ax
or ecx, 0x80070000
cmp eax, ebx
cmovle ecx, eax
jmp 0x100030c81
mov r8, rbx
mov eax, dword [0x10001c66c]
cmp eax, ebx
jbe 0x100030c7f
mov edi, dword [0x10000dfa4]
xor eax, eax
mov ecx, dword [0x10000dfa4]
mov dword [rbp + r8*4 + 0x82500], 0xe941
imul rdi, r8
add rdi, rsi
rep stosb byte [rdi], al
mov eax, dword [0x10001c66c]
inc r8
cmp r8, rax
jb 0x100030c4e
mov ecx, ebx
cmp ecx, ebx
jge 0x100030c89
mov eax, ecx
jmp 0x100030cf4
mov ecx, dword [0x1000838a0]
cmp ecx, ebx
je 0x100030cdb
mov edx, dword [0x100083898]
lea rdi, [0x1000838c8]
lea rax, [rdx + rbp + 0x838c8]
mov qword [0x1000838a8], rdi
mov qword [0x1000838b0], rax
mov eax, dword [0x10008389c]
add rdx, rax
add rcx, rdx
add rcx, rdi
lea rax, [rdx + rbp + 0x838c8]
mov qword [0x1000838b8], rax
mov qword [0x1000838c0], rcx
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov eax, 0x221e4321
cmp dword [rsp + 0x70], ebx
cmovl ebx, dword [rsp + 0x70]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x100060d50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100083350]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov r11, qword [0x100083448]
mov qword [rsp + 0x58], r11
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100011851
xor ecx, ecx
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100083350]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x60]
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100011873
mov rax, qword [rsp + 0x88]
mov qword [0x100083448], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1000833e8], rax
xor ecx, ecx
mov rax, qword [0x100083448]
mov qword [0x100082300], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000833d0], rax
mov dword [0x1000822f0], 0xc0000409
mov dword [0x1000822f4], 1
mov rax, qword [0x100083348]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100083328]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100010f68]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
cmp rcx, qword [0x100083348]
jne 0x100060d6b
rol rcx, 0x10
test cx, 0xffff
jne 0x100060d67
ret 0
ror rcx, 0x10
jmp 0x1000117cc

Function at 0x100073bbc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, r8
mov r10d, edx
movzx eax, dl
mov r8, rcx
test dl, dl
je 0x100073c27
mov r11, rax
mov r9d, dword [rbx]
mov ecx, r10d
mov eax, r10d
shl eax, 3
xor r9d, r10d
shr ecx, 3
mov r10d, ecx
movzx edx, r9b
add rbx, 4
xor r10d, eax
mov eax, r9d
shr eax, 8
add r10d, r9d
movzx ecx, al
mov rax, qword [r8 + rdx*8]
mov qword [r8 + rcx*8], rax
mov eax, r9d
shr r9d, 0x18
shr eax, 0x10
sub r11, 1
movzx ecx, r9b
movzx eax, al
mov rax, qword [r8 + rax*8]
mov qword [r8 + rcx*8], rax
jne 0x100073bd4
mov rbx, qword [rsp + 8]
ret

Function at 0x1000741c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100074211
cmp rcx, 0xffffffffffffffff
je 0x100074211
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x100074209
cmp dword [rcx + 0x3c], edx
jl 0x100074209
cmp dword [rcx + 0x3c], 0x10000000
jae 0x100074209
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100074211
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400072a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403228c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403229f0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x140007308
cmp byte [rbx + 0x424e], 0
jne 0x140007308
movsx r9d, word [rbx + 0x5342]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000c1a0
test sil, 1
je 0x140007439
jmp 0x1400073a1
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400650b8]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x1400650ac]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x3fa0], 1
mov qword [rbx + 0x3fb8], rax
movss dword [rbx + 0x3fb0], xmm0
mov dword [rbx + 0x3fa4], 1
movss dword [rbx + 0x3fb4], xmm1
movss xmm0, dword [rbx + 0x38f4]
mov rax, qword [0x1403229f0]
mulss xmm0, dword [0x140065060]
or dword [rax + 0x3fa0], 0x40
movss dword [rax + 0x4000], xmm0
movsx r9d, word [rbx + 0x5342]
call fcn.14000c1a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400073f1
lea r11, [0x140063810]
cmp r9b, 0x23
jne 0x1400073d4
cmp byte [r8], r9b
jne 0x1400073d4
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400073c1
not ecx
call fcn.14000ae80
test rax, rax
je 0x140007439
cmp byte [rax + 0x96], 0
je 0x140007439
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5342]
mov edx, 0x10
movsx r9d, word [rbx + 0x5342]
call fcn.14000c1a0
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400040c0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005f540
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000add0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1403229f0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000ae33
mov qword [rsp], rbx
lea rbx, [0x140063810]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000ae13
cmp byte [r8], r9b
jne 0x14000ae13
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000ae00
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x53a0]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000ae67
mov r10, qword [r10 + 0x53a8]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000ae6e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000ae54
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14000b5d0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140063810]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x1403229f0]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ed4], ebx
jne 0x14000b668
mov r8, r9
mov ecx, ebx
xor r9d, r9d
lea edx, [r9 + 4]
call fcn.140009220
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b6f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x140063810]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14000c3f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000c44d
lea rbx, [0x140063810]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000c434
cmp r10, 2
jb 0x14000c434
cmp byte [r9], r8b
jne 0x14000c434
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000c410
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000c48f
lea rbx, [0x140063810]
cmp r8b, 0x23
jne 0x14000c473
cmp byte [r9], r8b
jne 0x14000c473
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000c460
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14000c760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r13
push r14
push r15
mov qword [rsp + 0x28], rbp
xor r10d, r10d
mov qword [rsp + 0x30], rsi
mov rbx, rdx
mov qword [rsp + 0x38], rdi
mov rax, rcx
mov qword [rsp + 0x40], r12
mov r14d, r10d
lea r15, [0x140000000]
mov r13, rax
test rbx, rbx
je 0x14000c7a0
cmp rax, rbx
jae 0x14000c94c
movzx r8d, byte [rax]
test r8b, r8b
je 0x14000c94c
mov r11d, r10d
mov ecx, r8d
shr rcx, 3
mov rdx, rbx
movsx r9, byte [rcx + r15 + 0x64250]
test r9d, r9d
sete r11b
add r11d, r9d
test rbx, rbx
jne 0x14000c7d8
movsxd rdx, r11d
add rdx, rax
cmp rax, rdx
lea rcx, [rax + 1]
mov edi, r8d
cmovae edi, r10d
cmp rcx, rdx
jae 0x14000c7f1
movzx r12d, byte [rcx]
jmp 0x14000c7f4
xor r12b, r12b
lea rcx, [rax + 2]
cmp rcx, rdx
jae 0x14000c802
movzx ebp, byte [rcx]
jmp 0x14000c805
xor bpl, bpl
lea rcx, [rax + 3]
cmp rcx, rdx
jae 0x14000c813
movzx esi, byte [rcx]
jmp 0x14000c816
xor sil, sil
lea r9, [r9*4]
movzx ecx, dil
mov r15d, dword [r9 + r15 + 0x64270]
and r15d, ecx
movzx r8d, r12b
shl r15d, 6
mov ecx, r8d
and ecx, 0x3f
movzx edx, bpl
or r15d, ecx
movzx r10d, sil
shl r15d, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or r15d, ecx
and r8d, 0xc0
mov ecx, r10d
shl r15d, 6
and ecx, 0x3f
shr r10d, 2
or r10d, edx
or r15d, ecx
shr r10d, 2
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x642a0]
or r10d, r8d
shr r15d, cl
lea rcx, [0x140000000]
shr r10d, 2
mov edx, r15d
cmp r15d, dword [r9 + rcx + 0x64288]
sbb ecx, ecx
and edx, 0xfffff800
and ecx, 0x40
xor r8d, r8d
or r10d, ecx
mov ecx, 0x80
cmp edx, 0xd800
cmove r8d, ecx
xor edx, edx
or r10d, r8d
mov ecx, 0x100
cmp r15d, 0xffff
cmova edx, ecx
lea rcx, [0x140000000]
mov ecx, dword [r9 + rcx + 0x642b8]
or r10d, edx
xor r10d, 0x2a
sar r10d, cl
test r10d, r10d
je 0x14000c936
xor r10d, r10d
test dil, dil
mov eax, r10d
mov ecx, r10d
setne cl
test sil, sil
setne al
add ecx, eax
mov eax, r10d
test bpl, bpl
setne al
add ecx, eax
mov eax, r10d
test r12b, r12b
setne al
add ecx, eax
cmp r11d, ecx
cmovl ecx, r11d
movsxd rax, ecx
add rax, r13
inc r14d
jmp 0x14000c788
movsxd rcx, r11d
add rax, rcx
test r15d, r15d
je 0x14000c94c
xor r10d, r10d
inc r14d
jmp 0x14000c788
mov r12, qword [rsp + 0x40]
mov eax, r14d
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
pop r15
pop r14
pop r13
pop rbx
ret