joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400033d0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
lea rax, [0x14000b680]
mov rdi, rcx
lea rcx, [0x14000b658]
mov qword [0x14000b688], rax
mov qword [0x14000b680], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
call fcn.140004930
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x14000344b
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000359f
mov cl, 1
call fcn.140002734
test eax, eax
jns 0x14000345d
xor ecx, ecx
call fcn.140002734
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400046fc
mov ebx, eax
test eax, eax
jns 0x1400034e4
cmp dword [section..data], 2
jbe 0x1400034dd
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x1400034dd
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x1400034dd
mov dword [rbp + 0x20], eax
lea rdx, [0x140008c31]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23b
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x14000359f
mov r8, rdi
lea rdx, [0x1400026c0]
lea rcx, str.GameInputSvc
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_RegisterServiceCtrlHandlerExW]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000359d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140003583
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140003583
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140003583
mov dword [rbp + 0x20], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23e
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000358e
mov eax, 0x8000ffff
jmp 0x14000359f
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14000359f
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000384c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14000396d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14000392d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000391d
mov rcx, qword [rbx + 0x78]
mov edx, 0x5b4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [section..data], 2
jbe 0x14000391d
mov edx, 0x800
test qword [0x14000b010], rdx
je 0x14000391d
mov rax, qword [0x14000b018]
and rax, rdx
cmp rax, qword [0x14000b018]
jne 0x14000391d
lea rax, str.GameInput_Instance_timeout_during_Session_deletion
mov dword [rsp + 0x50], 0x45
mov qword [rsp + 0x58], rax
lea rdx, [0x140008d7d]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001168
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14000395d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.1400062b4
Function at 0x140004c68
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140004d26
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140004d09
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004d09
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004d09
mov dword [rbp + 0x28], eax
lea rdx, [0x140008cbe]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x5d
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140004d17
mov eax, 0x8000ffff
jmp 0x140004da4
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140004da4
mov r8, rdi
mov rcx, rbx
call fcn.140004ad8
mov ebx, eax
test eax, eax
jns 0x140004da2
cmp dword [section..data], 2
jbe 0x140004d9e
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004d9e
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004d9e
mov dword [rbp + 0x28], eax
lea rdx, [0x140008c31]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x62
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x140004da4
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140005ca0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
mov r15, rcx
mov rcx, qword [rdx]
mov r12, rdx
mov qword [rdx], rbx
test rcx, rcx
je 0x140005cd5
call fcn.1400062b4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
je 0x140005e01
or rcx, 0xffffffffffffffff
test r15, r15
je 0x140005d08
mov rbp, rcx
inc rbp
cmp word [r15 + rbp*2], bx
jne 0x140005cfc
jmp 0x140005d0b
mov rbp, rbx
lea rax, [r14 + 1]
mov rdi, r14
add rax, rbp
test r15, r15
cmovne rdi, rax
mov eax, 2
mul rdi
cmovo rax, rcx
mov rcx, qword gs:[0x60]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140005d58
mov ebx, 0x8007000e
jmp 0x140005df8
mov edx, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
nop dword [rax + rax]
mov edi, eax
lea rax, [r14 - 1]
cmp rdi, rax
jne 0x140005de6
mov r14, rbx
test rdi, rdi
je 0x140005d9a
movzx ecx, word [rsi + r14*2]
call qword [sym.imp.ntdll.dll_towlower]
nop dword [rax + rax]
mov word [rsi + r14*2], ax
inc r14
cmp r14, rdi
jb 0x140005d7c
test r15, r15
je 0x140005dd3
mov eax, 0x5c
mov r14, rbx
mov word [rsi + rdi*2], ax
inc rdi
test rbp, rbp
je 0x140005dd3
movzx ecx, word [r15 + r14*2]
call qword [sym.imp.ntdll.dll_towlower]
nop dword [rax + rax]
mov word [rsi + rdi*2], ax
inc r14
inc rdi
cmp r14, rbp
jb 0x140005db3
mov word [rsi + rdi*2], bx
mov rcx, qword [r12]
mov qword [r12], rsi
test rcx, rcx
je 0x140005df8
jmp 0x140005df3
mov rcx, rsi
test rdi, rdi
je 0x140005dfc
mov ebx, 0x8000ffff
call fcn.1400062b4
mov eax, ebx
jmp 0x140005e27
call fcn.1400062b4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x140005e1a
mov eax, 0x8000ffff
jmp 0x140005e27
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400060c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, dword [rcx]
mov r15d, edx
mov r14, rcx
xor esi, esi
test ebp, ebp
jne 0x140006278
lea rdi, [rcx + 0x28]
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov ebp, dword [r14]
test ebp, ebp
jne 0x140006269
lea eax, [r15 - 1]
cmp eax, 1
ja 0x140006269
lea rax, str.GameInputInbox.dll
mov qword [rsp + 0x60], rsi
cmp r15d, 1
lea rcx, str.GameInputRedist.dll
lea rdx, [rsp + 0x60]
cmove rcx, rax
call fcn.140005ca0
mov ebx, eax
test eax, eax
jns 0x140006171
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000615b
call fcn.1400062b4
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov eax, ebx
jmp 0x14000628e
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140006256
test eax, 0x550
jne 0x140006256
mov rcx, rbx
call fcn.140005e50
test eax, eax
js 0x140006256
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov rbp, rax
test rax, rax
je 0x140006256
mov rcx, rax
call fcn.140006004
test al, al
je 0x140006242
lea rdx, str.GameInputCreate
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x140006242
lea rdx, str.DllCanUnloadNow
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x140006242
lea rdx, str.DllGetClassObject
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x140006242
mov qword [r14 + 0x20], rbp
mov rbp, rsi
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], rax
test rbp, rbp
je 0x140006256
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
mov dword [r14], r15d
mov ebp, r15d
test rbx, rbx
je 0x140006269
mov rcx, rbx
call fcn.1400062b4
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
cmp ebp, r15d
jne 0x140006289
cmp qword [r14 + 0x20], rsi
sete sil
mov eax, esi
jmp 0x14000628e
mov eax, 0x8000ffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140006790
Capabilities:
Check for peb beingdebugged flag
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword gs:[0x60]
movzx eax, byte [rax + 2]
test eax, eax
jne 0x1400067c3
mov eax, 0x2d4
add rax, 0x7ffe0000
movzx eax, byte [rax]
and eax, 3
cmp eax, 3
jne 0x1400067c4
int3
lea rcx, [0x14000b690]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
nop dword [rax + rax]
mov rax, qword [rsp + 0x28]
mov qword [0x14000b788], rax
lea rax, [rsp + 0x28]
add rax, 8
mov qword [0x14000b728], rax
mov dword [0x14000bb60], 0x40000015
mov dword [0x14000bb64], 1
mov qword [0x14000bb68], 0
mov rax, qword [0x14000b788]
mov qword [0x14000bb70], rax
mov dword [0x14000bb78], 2
movsxd rax, dword [rsp + 0x30]
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x14000bb80]
mov qword [rdx + rcx], rax
mov eax, dword [rsp + 0x38]
mov ecx, 8
imul rcx, rcx, 1
lea rdx, [0x14000bb80]
mov qword [rdx + rcx], rax
mov r8d, 2
lea rdx, [0x14000b690]
lea rcx, [0x14000bb60]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_2.dll_RaiseFailFastException]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
nop dword [rax + rax]
add rsp, 0x28
ret

Function at 0x1400068b4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov byte [0x14000bc0a], dil
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x14000698c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140006972
test byte [0x14000b010], 2
je 0x140006972
mov rcx, qword [0x14000b018]
and ecx, 2
cmp rcx, qword [0x14000b018]
jne 0x140006972
mov dword [rsp + 0x40], eax
lea rdx, [0x140008ecf]
lea rax, str.onecorexboxgameinput2commonPlatformInfo.cpp
mov dword [rsp + 0x44], 0x17
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000697d
mov eax, 0x8000ffff
jmp 0x1400069f1
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400069f1
lea r8, [rsp + 0x50]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
inc rax
cmp word [rcx + rax*2], di
jne 0x14000699a
movsxd rcx, eax
mov ebx, 1
test eax, eax
js 0x1400069ce
cmp word [rsp + rcx*2 + 0x50], 0x5c
je 0x1400069c0
sub eax, ebx
sub rcx, rbx
jns 0x1400069af
jmp 0x1400069ce
inc eax
lea r8, [rsp + 0x50]
movsxd rcx, eax
lea r8, [r8 + rcx*2]
lea rdx, str.dwm.exe
mov rcx, r8
call sub.ntdll.dll__wcsicmp
movzx ecx, byte [0x14000bc0a]
test eax, eax
cmove ecx, ebx
xor eax, eax
mov byte [0x14000bc0a], cl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140006f60
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x140006d60
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.140006a1c
xor edi, edi
test eax, eax
js 0x140006efc
call fcn.140006410
call fcn.1400062e8
test eax, eax
js 0x140006efc
mov rax, qword [0x14000b008]
lea r9, [0x14000b020]
xorps xmm1, xmm1
lea r8, [section..data]
lea rdx, [0x140001340]
lea rcx, [rsp + 0xa0]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [0x14000b028], xmm1
movdqu xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.ntdll.dll_EtwEventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x140006e13
mov rax, qword [0x14000b5f8]
test rax, rax
je 0x140006e13
mov r8, qword [0x14000b008]
lea edx, [rdi + 2]
mov rcx, qword [0x14000b020]
movzx r9d, word [r8]
call qword [0x1400084c8]
mov eax, edi
test eax, eax
js 0x140006efc
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
mov dl, dil
movzx eax, word [rax]
test ax, ax
je 0x140006e75
movzx ecx, ax
cmp cx, 0x20
ja 0x140006e47
movzx eax, cx
test dl, dl
je 0x140006e70
cmp cx, 0x22
jne 0x140006e52
test dl, dl
sete dl
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
test ax, ax
jne 0x140006e3a
jmp 0x140006e70
cmp ax, 0x20
ja 0x140006e75
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x140006e63
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop dword [rax + rax]
lea rdx, str._install
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140006eba
lea rdx, str._uninstall
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006ec1
mov ebx, 0x80004001
jmp 0x140006ef2
mov r8d, 0x17
lea rdx, str.GlobalGameInputSession
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006eeb
mov rcx, rbx
call fcn.1400059f8
jmp 0x140006ef0
call fcn.1400036a4
mov ebx, eax
call fcn.140006c74
shr ebx, 0x1f
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140006f60
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
sub rsp, 0x28
call fcn.14017c000
add rsp, 0x28
jmp 0x140006d60
Function at 0x7ff65d147600
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff65d260f40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff65d261908]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x7ff65d147668
cmp byte [rbx + 0x424e], 0
jne 0x7ff65d147668
movsx r9d, word [rbx + 0x532e]
lea r8, [0x7ff65d1ff1a0]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff65d14c640
test sil, 1
je 0x7ff65d147799
jmp 0x7ff65d147701
movss xmm1, dword [rbx + 0x38b0]
lea r8, [0x7ff65d1ff1a0]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff65d1ff3e8]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x7ff65d1ff3d8]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
or dword [rbx + 0x3fb0], 1
mov qword [rbx + 0x3fc8], rax
movss dword [rbx + 0x3fc0], xmm0
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mov rax, qword [0x7ff65d261908]
mulss xmm0, dword [0x7ff65d1ff388]
or dword [rax + 0x3fb0], 0x40
movss dword [rax + 0x4010], xmm0
movsx r9d, word [rbx + 0x532e]
call fcn.7ff65d14c640
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff65d147751
lea r11, [0x7ff65d1fe060]
cmp r9b, 0x23
jne 0x7ff65d147734
cmp byte [r8], r9b
jne 0x7ff65d147734
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff65d147721
not ecx
call fcn.7ff65d14afa0
test rax, rax
je 0x7ff65d147799
cmp byte [rax + 0x96], 0
je 0x7ff65d147799
mov byte [rax + 0x9d], 1
lea r8, [0x7ff65d1ff1a0]
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x532e]
mov edx, 0x10
movsx r9d, word [rbx + 0x532e]
call fcn.7ff65d14c640
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.7ff65d144480
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff65d1f8c80
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x7ff65d14aef0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x7ff65d261908]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x7ff65d14af53
mov qword [rsp], rbx
lea rbx, [0x7ff65d1fe060]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff65d14af33
cmp byte [r8], r9b
jne 0x7ff65d14af33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x7ff65d14af20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5390]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x7ff65d14af87
mov r10, qword [r10 + 0x5398]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x7ff65d14af8e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x7ff65d14af74
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x7ff65d14b020
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x7ff65d14b070
lea r11, [0x7ff65d1fe060]
cmp r9b, 0x23
jne 0x7ff65d14b053
cmp byte [r8], r9b
jne 0x7ff65d14b053
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff65d14b040
not ecx
jmp fcn.7ff65d14afa0

Function at 0x7ff65d14b770
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xd0]
mov rax, qword [rcx + 0xd8]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x7ff65d1fe060]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x7ff65d261908]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3edc], ebx
jne 0x7ff65d14b808
mov r8, r9
mov ecx, ebx
xor r9d, r9d
lea edx, [r9 + 4]
call fcn.7ff65d149560
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x7ff65d14b890
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xd8]
lea r9, [0x7ff65d1fe060]
movss xmm2, dword [rcx + 0xf0]
movss xmm3, dword [rcx + 0xf4]
movsxd rcx, dword [rcx + 0xd0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret