joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461da0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.0045bf80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret

Function at 0x461e60
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
call fcn.0045c0c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret

Function at 0x461f60
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xc0
mov qword [rsp + 0xb8], rbp
lea rbp, [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
nop
call fcn.0045c200
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
Function at 0x483980
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x483998
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x483989
ret

Function at 0x4b4840
Capabilities:
Create process on windows
Self delete

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x1a8
movabs rax, 0x75206c6974757366
movabs rdx, 0x74656c6564206e73
mov r12, rcx
mov qword [rsp + 0xa0], rax
lea r13, [rsp + 0xa0]
movabs rax, 0x6c616e72756f6a65
mov qword [rsp + 0xa8], rdx
lea rcx, [rsp + 0xbc]
mov rdx, r12
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xb8], 0x20642f20
call sym.strcpy
mov r8, r13
xor r9d, r9d
xor ecx, ecx
lea rdx, str.open
mov dword [rsp + 0x28], 0
xor r13d, r13d
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, r12
xor r9d, r9d
mov edx, 0xc0000000
mov qword [rsp + 0x30], 0
mov r8d, 3
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4b49be
lea rax, [rsp + 0x60]
lea rsi, [rsp + 0x4c]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rbx, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov edx, 0x900f4
mov rcx, r12
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0x38
mov qword [rsp + 0x20], rax
call rbx
mov r13d, eax
test eax, eax
je 0x4b49b5
mov rdx, qword [rsp + 0x60]
lea rcx, str.deleting_journal_id_0x_x_n
mov dword [rsp + 0x58], 3
xor r13d, r13d
mov qword [rsp + 0x50], rdx
call sym.printf.constprop.0
mov qword [rsp + 0x30], rsi
mov r9d, 0x10
mov rcx, r12
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x50]
mov edx, 0x900f8
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbx
test eax, eax
setne r13b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r13d
add rsp, 0x1a8
pop rbx
pop rsi
pop r12
pop r13
ret

Function at 0x4b49d0
Capabilities:
Get disk size

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rax, [rsp + 0x3c]
mov rdi, rdx
mov rsi, r8
mov rbx, r9
lea r8, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov r8d, eax
mov eax, 1
test r8d, r8d
je 0x4b4a46
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
xor edx, edx
imul rcx, rax
mov eax, dword [rsp + 0x34]
imul rcx, rax
mov qword [rdi], rcx
mov rax, rcx
mov rdi, qword [rsp + 0x80]
shr rax, 0x14
div qword [rdi]
mov qword [rsi], rax
shl rax, 0x14
sub rcx, rax
xor eax, eax
mov qword [rbx], rcx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret

Function at 0x4b4bd0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8, rdx
xor edx, edx
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x4b4bec
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [dbg.__acrt_iob_func]
lea rdx, [0x00594c60]
mov rcx, rax
mov r8d, ebx
call dbg.fprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x4b4ef0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8, rcx
lea rcx, [dbg.threadentry]
call qword [sym.imp.msvcrt.dll__beginthread]
cmp rax, 0xffffffffffffffff
je 0x4b4f13
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, 2
mov ebx, dword [rax]
call qword [dbg.__acrt_iob_func]
lea rdx, str.runtime:_failed_to_create_new_OS_thread___d__n
mov rcx, rax
mov r8d, ebx
call sym.fprintf.constprop.0_1
call sym.abort
nop
nop
nop

Function at 0x4ba040
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x4ba0b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x005f3184]
mov r12, rcx
test ebx, ebx
jle 0x4ba1e0
mov rax, qword [0x005f3188]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x4ba0fc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4ba183
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x4ba0e0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x4ba202
mov rax, qword [0x005f3188]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x005f3188]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4ba1e7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4ba17c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x4ba190
add dword [0x005f3184], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x005f3188]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4ba17c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x4ba107
mov rax, qword [0x005f3188]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x4ba6d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x005f31e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x005f31c0]
test rbx, rbx
je 0x4ba724
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4ba71b
test r12, r12
je 0x4ba71b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4ba700
lea rcx, [0x005f31e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4ba940
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x4ba958
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x4ba960
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x4ba970
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4ba9bc
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x4ba9b3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x4ba9be
add rax, 0x28
cmp rax, r9
jne 0x4ba9a0
xor eax, eax
ret

Function at 0x4ba9c0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x4baa50
mov rdx, qword [0x00595400]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x4baa3e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x4baa3e
cmp word [rax + 0x18], 0x20b
jne 0x4baa3e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x4baa50
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x4baa29
add r12, 0x28
cmp r12, rsi
je 0x4baa50
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x4baa20
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x4baa60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00595400]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x4baa80
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x4baa88
ret
cmp word [r8 + 0x18], 0x20b
jne 0x4baa80
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x4baad5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4baacc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4baa80
add rax, 0x28
cmp rax, r9
jne 0x4baab8
xor eax, eax
ret
Function at 0x4baae0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00595400]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4bab00
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4bab08
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x4bab00
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x4bab20
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00595400]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x4bab40
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x4bab48
ret
cmp word [rdx + 0x18], 0x20b
jne 0x4bab40
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4bab88
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x4bab7f
test rcx, rcx
je 0x4bab40
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x4bab70
xor eax, eax
ret

Function at 0x4bab90
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00595400]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4babb0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4babb8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x4babd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x00595400]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x4babf0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x4babf8
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x4babf0
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x4babf0
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4bac34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4bac48
add rax, 0x28
cmp r9, rax
jne 0x4bac20
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x4bac60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00595400]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x4bac82
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x4bac90
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x4bac82
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x4bac82
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x4bac82
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x4bacdd
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x4bacf0
add rdx, 0x28
cmp r10, rdx
jne 0x4bacc8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x4bacff
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x4bad0f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x4bace6
test ecx, ecx
jg 0x4bacf8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x180005bd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180005c2d
lea rbx, [0x1800f7020]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180005c14
cmp r10, 2
jb 0x180005c14
cmp byte [r9], r8b
jne 0x180005c14
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180005bf0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180005c6f
lea rbx, [0x1800f7020]
cmp r8b, 0x23
jne 0x180005c53
cmp byte [r9], r8b
jne 0x180005c53
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180005c40
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180005e30
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x180005e4e
mov qword [r8], r14
lea rdx, [0x1800f61f0]
call fcn.180005c80
mov rbx, rax
test rax, rax
jne 0x180005e73
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x180005f9f
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005f9f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180005f9f
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x180005f9f
cmp rdi, 0xffffffffffffffff
je 0x180005f9f
mov rcx, rdi
call fcn.180009d40
mov rbp, rax
test rax, rax
je 0x180005f9f
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x180005f8c
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x18014d0c0]
test r8, r8
je 0x180005f81
movsx rdx, word [r8 + 0x6360]
lea rcx, [r8 + 0x6364]
mov r9d, dword [r8 + 0x40c8]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x180005f76
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6360], cx
movsx rax, cx
lea rcx, [r8 + 0x6364]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x635c]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x180005fa8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x180005f9a
mov qword [rsi], rdi
mov rax, rbp
jmp 0x180005faa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18000dfe0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x18000e030
lea r11, [0x1800f7020]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000e013
cmp byte [r8], r9b
jne 0x18000e013
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18000e000
mov rcx, qword [0x18014d0c0]
not edx
add rcx, 0x4160
jmp fcn.1800065e0
Function at 0x180015410
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd rdx, dword [rcx + 0x138]
lea r8, [0x18014d0e0]
mov rax, qword [rcx + 0x140]
lea r10, [0x1800f7020]
mov r9, rcx
mov ebx, dword [rax + rdx*4 - 4]
not ebx
movzx eax, r8b
movzx edx, bl
xor rdx, rax
shr ebx, 8
mov rax, r8
shr rax, 8
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
xor ebx, dword [r10 + rdx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x41d4], ebx
jne 0x180015503
mov edx, 0xc
mov ecx, ebx
call fcn.18002bea0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180015510
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x1800f7020]
movsxd rcx, dword [rcx + 0x138]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0x140]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x41d4], ebx
jne 0x1800155a4
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.18002bea0
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800155c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x158]
lea r10, [0x1800f7020]
mov rax, qword [rcx + 0x140]
movss xmm1, dword [rcx + 0x15c]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0x138]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret