joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800055c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rax - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rax - 0x38], xmm1
mov r8d, 0x1c
lea rdx, str.keyboard_type_0_key.forward:
lea rcx, [rax - 0x48]
call fcn.180001540
nop
lea rcx, [rsp + 0x20]
call fcn.180072de0
mov ecx, eax
call fcn.180072b90
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180005661
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000565c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000565c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18007c3b0
test bx, bx
je 0x1800057c0
mov rdi, qword [0x180187dd8]
test rdi, rdi
je 0x1800057c0
mov rax, qword [rdi]
mov rdx, qword [rax + 0xe8]
mov rcx, rdi
call rdx
mov rbx, rax
test rax, rax
je 0x1800057c0
mov r8, qword [rax]
mov dl, 1
mov rcx, rax
call qword [r8 + 0x4c8]
mov rcx, qword [rdi + 0xd0]
mov rdx, qword [rcx + 0xd8]
mov ecx, dword [rsi + 0xb0]
mov dword [rdx], ecx
mov rdi, qword [rbx + 0x290]
test rdi, rdi
je 0x1800057c0
mov rax, qword [rbx + 0x2a0]
movss xmm7, dword [rax + 4]
mov rcx, rbx
call fcn.180017020
movzx ebp, al
xorps xmm6, xmm6
test al, al
je 0x1800056fd
movss xmm0, dword [rsi + 0xb8]
comiss xmm0, xmm6
jbe 0x1800056fd
mov rcx, rbx
call fcn.180016ea0
mov ecx, dword [0x180187dcc]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1801883a0], ecx
jle 0x180005751
lea rcx, [0x1801883a0]
call fcn.18007c4d0
cmp dword [0x1801883a0], 0xffffffff
jne 0x180005751
movss xmm0, dword [rsi + 0xb4]
movss dword [0x1801883a4], xmm0
lea rcx, [0x1801883a0]
call fcn.18007c464
movss xmm0, dword [rsi + 0xb8]
comiss xmm0, xmm6
jbe 0x180005786
test bpl, bpl
je 0x180005786
mov rcx, rbx
call fcn.180016ea0
mov eax, dword [rsi + 0xb8]
mov dword [rdi + 0x1c], eax
movss xmm6, dword [rsi + 0xb4]
movss dword [0x1801883a4], xmm6
jmp 0x18000578e
movss xmm6, dword [0x1801883a4]
addss xmm7, dword [0x180107f4c]
mulss xmm7, dword [0x180107db0]
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
mulss xmm0, xmm6
movss dword [rdi + 0x20], xmm0
movaps xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm0, xmm6
movss dword [rdi + 0x18], xmm0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rdi
ret
Function at 0x18000b410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
movaps xmmword [rsp + 0x30], xmm6
xor ecx, ecx
mov rdi, rdx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
cmp qword [rdi + 0x18], 0xf
xorps xmm6, xmm6
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cvtsi2ss xmm6, rax
jbe 0x18000b44b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000b483
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x18000b470
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0xe8]
call fcn.180012780
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x18000b4a7
mov rcx, qword [rbx + 0xf0]
cmp rcx, qword [rbx + 0xf0]
je 0x18000b4ea
mov rax, qword [rcx + 0x30]
movss xmm1, dword [0x180107ed8]
cmp rax, 3
jae 0x18000b4db
movaps xmm0, xmm6
subss xmm0, dword [rcx + 0x38]
comiss xmm1, xmm0
jb 0x18000b4db
inc rax
mov qword [rcx + 0x30], rax
jmp 0x18000b560
movaps xmm0, xmm6
subss xmm0, dword [rcx + 0x38]
comiss xmm0, xmm1
jbe 0x18000b560
jmp 0x18000b501
lea rcx, [rbx + 0xe8]
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180011300
mov rcx, qword [rax]
add rbx, 0xd0
mov qword [rcx + 0x30], 1
movss dword [rcx + 0x38], xmm6
mov r8, qword [rbx]
mov rax, qword [rbx + 8]
sub rax, r8
sar rax, 5
cmp rax, 0x64
jb 0x18000b536
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180010a40
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x18000b552
mov rdx, rdi
mov rcx, rax
call fcn.180001840
add qword [rbx + 8], 0x20
jmp 0x18000b560
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.180012850
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x180014610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x180118240]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x48], r12
mov rsi, rcx
mov qword [rsp + 0x40], r13
mov r14, r9
mov qword [rsp + 0x38], r15
mov r13, r8
lea r15, [r8 - 1]
mov rdi, rdx
sar r15, 1
mov rbp, rdx
mov rcx, rdx
cmp rdx, r15
jge 0x18001468f
lea rbx, [rcx + rcx]
mov r8, qword [rsi + rbx*8 + 8]
lea rcx, [rsp + 0xa0]
mov rdx, qword [rsi + rbx*8 + 0x10]
call fcn.180008bc0
movzx ecx, al
xor rcx, 1
inc rcx
add rcx, rbx
mov rax, qword [rsi + rcx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rcx
cmp rcx, r15
jl 0x180014657
cmp rcx, r15
mov rdi, rcx
mov r15, qword [rsp + 0x38]
jne 0x1800146af
test r13b, 1
jne 0x1800146af
mov rax, qword [rsi + r13*8 - 8]
lea rdi, [r13 - 1]
mov qword [rsi + rcx*8], rax
movss xmm0, dword [rsp + 0xa0]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
movss dword [rsp + 0x20], xmm0
cmp rbp, rdi
jge 0x180014705
nop dword [rax]
mov r8, qword [r14]
lea rbx, [rdi - 1]
sar rbx, 1
lea rcx, [rsp + 0x20]
mov rdx, qword [rsi + rbx*8]
call fcn.180008bc0
test al, al
je 0x180014705
mov rax, qword [rsi + rbx*8]
mov qword [rsi + rdi*8], rax
mov rdi, rbx
cmp rbp, rbx
jl 0x1800146d0
mov rax, qword [r14]
mov qword [rsi + rbx*8], rax
jmp 0x18001470c
mov rax, qword [r14]
mov qword [rsi + rdi*8], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18007c390
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18001b210
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18001b2bc
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x18001b24a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp fcn.18001b330
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x18001b28a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.18007c3b0
mov rcx, rbx
test rbx, rbx
jne 0x18001b270
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180011650
add rsp, 0x30
pop rdi
ret
Function at 0x18001b330
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x18001b53b
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
xor rcx, rax
mov qword [rsp + 0x30], rdx
movzx eax, byte [r14 + 0x11]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x14]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x15]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x16]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x17]
imul rcx, r8
xor rcx, rax
mov rax, qword [rsi + 0x30]
imul rcx, r8
and rax, rcx
shl rax, 4
add rax, rdx
mov qword [rsp + 0x20], rax
mov rcx, qword [rax]
mov r15, qword [rax + 8]
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18007c3b0
dec qword [rsi + 0x10]
cmp rdi, r15
je 0x18001b449
cmp rbx, rbp
jne 0x18001b410
cmp qword [rsp + 0x28], r14
jne 0x18001b514
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rbx
jmp 0x18001b514
mov rcx, qword [rsp + 0x20]
cmp qword [rsp + 0x28], r14
jne 0x18001b45d
mov qword [rcx], r12
mov rax, r12
jmp 0x18001b460
mov rax, r13
mov qword [rcx + 8], rax
cmp rbx, rbp
je 0x18001b514
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x14]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x15]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x16]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x17]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18007c3b0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x18001b547
cmp rbx, rbp
jne 0x18001b4f0
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x18001b470
jmp 0x18001b514
Function at 0x18001b9d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x18001ba01
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x40], rdi
mov rdi, qword [0x1801881a8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x1801881b8]
lea rdx, [rbx + rbx]
call fcn.180010f50
mov rcx, qword [0x1801881a8]
lea r9, [rbx - 1]
mov qword [0x1801881d0], r9
mov qword [0x1801881d8], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x18001bba2
mov qword [rsp + 0x30], rsi
mov rax, rcx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x1801881b8]
mov r9, qword [r11]
cmp r9, rdi
jne 0x18001baec
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001bb63
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18001bb29
mov r10, qword [rdx]
cmp r10, rax
je 0x18001bb23
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001bb63
cmp r9, rdx
je 0x18001bb3f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18001bb77
cmp r9, rdx
jne 0x18001bb30
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
je 0x18001bb9d
mov r9, qword [0x1801881d0]
jmp 0x18001ba71
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001bb63
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x18001ce80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov rax, qword [0x180118240]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x98], r12
mov r14, rcx
lea rcx, [r8 - 1]
mov qword [rsp + 0x40], r13
mov r12, rcx
mov qword [rsp + 0x28], rcx
sar r12, 1
mov rax, r8
mov qword [rsp + 0x20], rax
mov r15, r9
mov r13, rdx
mov rbp, rdx
mov r10, rdx
cmp rdx, r12
jge 0x18001cf30
nop dword [rax]
nop dword [rax + rax]
lea rbx, [r10 + r10]
lea rsi, [r14 + 0x10]
lea rsi, [rsi + rbx*8]
lea rdi, [rsi - 8]
mov rdx, rsi
mov r8, rdi
lea rcx, [rsp + 0xa0]
call fcn.18001c9f0
movzx r10d, al
xor r10, 1
inc r10
add r10, rbx
test al, al
cmove rdi, rsi
mov rax, qword [rdi]
mov qword [r14 + r13*8], rax
mov r13, r10
cmp r10, r12
jl 0x18001cee0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r13, qword [rsp + 0x40]
cmp r10, r12
mov r12, qword [rsp + 0x98]
mov rdi, r10
jne 0x18001cf55
test al, 1
jne 0x18001cf55
mov rax, qword [r14 + rax*8 - 8]
mov rdi, rcx
mov qword [r14 + r10*8], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
cmp rbp, rdi
jge 0x18001cfa7
nop word [rax + rax]
lea rbx, [rdi - 1]
mov r8, r15
sar rbx, 1
lea rcx, [rsp + 0x28]
lea rsi, [r14 + rbx*8]
mov rdx, rsi
call fcn.18001c9f0
test al, al
je 0x18001cfa7
mov rax, qword [rsi]
mov qword [r14 + rdi*8], rax
mov rdi, rbx
cmp rbp, rbx
jl 0x18001cf70
mov rax, qword [r15]
mov qword [r14 + rbx*8], rax
jmp 0x18001cfae
mov rax, qword [r15]
mov qword [r14 + rdi*8], rax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007c390
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18002b120
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
mov ecx, dword [rcx + 0xa0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18002b257
mov rcx, qword [0x180187dd8]
test rcx, rcx
je 0x18002b251
mov rax, qword [rcx]
mov qword [rsp + 0x80], rdi
mov rdx, qword [rax + 0xe8]
call rdx
mov rdi, rax
test rax, rax
je 0x18002b249
mov rcx, qword [rax + 0x2a0]
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
movaps xmmword [rsp + 0x40], xmm9
movss xmm9, dword [rcx]
mulss xmm9, dword [0x180107db0]
movaps xmmword [rsp + 0x30], xmm10
movaps xmmword [rsp + 0x20], xmm11
movss xmm11, dword [rcx + 4]
mulss xmm11, dword [0x180107db0]
movaps xmm0, xmm11
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
movaps xmm10, xmm0
movaps xmm0, xmm9
xorps xmm10, xmmword [0x180108470]
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mulss xmm10, xmm0
movaps xmm0, xmm9
mulss xmm10, dword [rbx + 0xb0]
call sub.api_ms_win_crt_math_l1_1_0.dll_sinf
movaps xmm7, xmm0
movaps xmm0, xmm9
xorps xmm7, xmmword [0x180108470]
mulss xmm7, dword [rbx + 0xb0]
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
movaps xmm6, xmm0
movaps xmm0, xmm11
call sub.api_ms_win_crt_math_l1_1_0.dll_cosf
mov rax, qword [rdi + 0x290]
movaps xmm11, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x40]
mulss xmm6, xmm0
mulss xmm6, dword [rbx + 0xb0]
movss dword [rax + 0x18], xmm10
movaps xmm10, xmmword [rsp + 0x30]
movss dword [rax + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x60]
movss dword [rax + 0x1c], xmm7
movaps xmm7, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x80]
add rsp, 0x70
pop rbx
ret
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x30]
mov byte [rbx + 0x98], 0
add rsp, 0x70
pop rbx
ret

Function at 0x180036360
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800363bd
lea rbx, [0x180101930]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800363a4
cmp r10, 2
jb 0x1800363a4
cmp byte [r9], r8b
jne 0x1800363a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180036380
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1800363ff
lea rbx, [0x180101930]
cmp r8b, 0x23
jne 0x1800363e3
cmp byte [r9], r8b
jne 0x1800363e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1800363d0
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x180036540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18003655a
mov qword [r8], 0
lea rdx, [0x180106dd0]
call fcn.180036410
mov rbx, rax
test rax, rax
jne 0x18003657a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x180036653
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180036653
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180036653
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180036653
cmp rdi, 0xffffffffffffffff
je 0x180036653
mov rax, qword [0x180187ee8]
test rax, rax
je 0x1800365f0
inc dword [rax + 0xf0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x180036653
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180036640
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x180187ee8]
test rax, rax
je 0x180036635
dec dword [rax + 0xf0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18003665c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18003664e
mov qword [r14], rdi
mov rax, rsi
jmp 0x18003665e
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180039060
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
lea r15, [0x180101930]
movsxd rcx, dword [rcx + 0xf0]
mov r14, rdx
mov rdi, rdx
mov rbx, rdx
mov r11, rdx
shr rbx, 0x30
mov rax, qword [rsi + 0xf8]
mov r10, rdx
mov r9, rdx
shr r10, 0x20
mov r8, rdx
shr r9, 0x18
shr rdx, 8
mov ebp, dword [rax + rcx*4 - 4]
not ebp
movzx eax, r14b
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, dl
shr r8, 0x10
shr r11, 0x28
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, r8b
shr rdi, 0x38
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, r9b
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, r10b
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, r11b
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
movzx eax, bl
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rax
shr ebp, 8
xor ebp, dword [r15 + rcx*4]
movzx ecx, bpl
xor rcx, rdi
shr ebp, 8
xor ebp, dword [r15 + rcx*4]
mov rcx, qword [rsi]
not ebp
cmp dword [rcx + 0x3f50], ebp
jne 0x180039165
mov r8, r14
mov edx, 0xc
mov ecx, ebp
call fcn.18004c8c0
mov rbx, qword [rsp + 0x60]
mov eax, ebp
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180039180
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x180101930]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f50], ebx
jne 0x180039214
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.18004c8c0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180039230
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x180101930]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret