joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7e1a371e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff7e1a37280
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff7e1a37280
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x7ff7e1a37300
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x7ff7e1a37340
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x7ff7e1a37340
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x7ff7e1a37db0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.7ff7e1a37e20
shl edx, 4
test eax, eax
jne 0x7ff7e1a37e16
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x7ff7e1a37ddb
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x7ff7e1a38f00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x7ff7e1a39020
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x7ff7e1a38f60
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x7ff7e1a38f60
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x7ff7e1a38f60
Function at 0x7ff7e1a45980
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x7ff7e1a459b5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x7ff7e1a45990
and r10, 0xf
je 0x7ff7e1a459e5
mov r9d, 0x10
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x7ff7e1a459c0
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x7ff7e1a459d9
mov rax, r8
repz ret

Function at 0x7ff7e1a459f0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x7ff7e1a45a2d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x7ff7e1a45a00
pxor xmm1, xmm1
and r10, 0xf
je 0x7ff7e1a45a63
mov r9d, 0x10
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x7ff7e1a45a3b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x7ff7e1a45a57
mov rax, r8
repz ret
Function at 0x7ff7e1a4b9c0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
test r8, r8
je 0x7ff7e1a4ba52
test rcx, rcx
jne 0x7ff7e1a4ba0e
lea r8d, [rcx + 0x4f]
lea rcx, [0x7ff7e1d4b0b8]
lea rdx, [0x7ff7e1d4b040]
call fcn.7ff7e1c744f8
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff7e1c64cb0
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x7ff7e1a4b9f9
test rdx, rdx
jne 0x7ff7e1a4ba31
lea r8d, [rdx + 0x56]
lea rdx, [0x7ff7e1d4b040]
lea rcx, [0x7ff7e1d4b0c8]
jmp 0x7ff7e1a4b9f4
xor eax, eax
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_WriteFile]
cmp eax, 1
jne 0x7ff7e1a4b9f9
cmp dword [rsp + 0x30], ebx
jne 0x7ff7e1a4b9f9
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff7e1c64cb0
add rsp, 0x40
pop rbx
ret

Function at 0x7ff7e1a4ba70
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x7ff7e1a4bab3
lea r8d, [rdx + 0x62]
lea rdx, [0x7ff7e1d4b040]
lea rcx, [0x7ff7e1d4b0c8]
call fcn.7ff7e1c744f8
xor al, al
jmp 0x7ff7e1a4bb79
test rbx, rbx
jne 0x7ff7e1a4bad6
lea r8d, [rbx + 0x67]
lea rdx, [0x7ff7e1d4b040]
lea rcx, [0x7ff7e1d4b0b8]
call fcn.7ff7e1c744f8
xor al, al
jmp 0x7ff7e1a4bb79
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x78], rbp
cmp rcx, 0xffffffffffffffff
je 0x7ff7e1a4bb72
xor ebp, ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
mov dword [rsp + 0x30], ebp
call qword [sym.imp.kernel32.dll_PeekNamedPipe]
test eax, eax
je 0x7ff7e1a4bb5d
mov eax, dword [rsp + 0x30]
cmp rax, rdi
jb 0x7ff7e1a4bb72
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x34]
mov r8d, edi
mov dword [rsp + 0x34], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.kernel32.dll_ReadFile]
cmp eax, 1
jne 0x7ff7e1a4bb5d
cmp edi, dword [rsp + 0x34]
je 0x7ff7e1a4bb59
lea r8d, [rbp + 0x74]
lea rdx, [0x7ff7e1d4b040]
lea rcx, [0x7ff7e1d4b0d8]
call fcn.7ff7e1c744f8
mov al, 1
jmp 0x7ff7e1a4bb74
mov rcx, qword [rbx + 8]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov byte [rbx], bpl
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov rbp, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff7e1c64cb0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff7e1a4d380
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdi, rdx
mov ecx, 0xb0
lea rdx, [0x7ff7e1d38e4f]
call fcn.7ff7e1c64f74
mov rbx, rax
test rax, rax
je 0x7ff7e1a4d5b1
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0xaf
call fcn.7ff7e1c67c50
lea rcx, [rbx + 8]
mov byte [rbx], 1
mov edx, 2
call fcn.7ff7e1c62b50
lea rcx, [rbx + 0x58]
call fcn.7ff7e1c62c88
xorps xmm0, xmm0
mov qword [0x7ff7e1d9c3d8], rbx
movups xmmword [rbx + 0xa0], xmm0
lea rax, [rsp + 0xa0]
mov dword [rsp + 0x28], 0x20
lea rbx, [0x7ff7e1d4af48]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
xor edx, edx
lea rcx, [rsp + 0xa0]
call fcn.7ff7e1a4bcc0
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
lea rcx, [0x7ff7e1d9b320]
mov dword [0x7ff7e1dcc5d8], eax
call fcn.7ff7e1c62b80
test eax, eax
jne 0x7ff7e1a4d5ea
test rdi, rdi
je 0x7ff7e1a4d47c
movups xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [0x7ff7e1dcc940], xmm0
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [0x7ff7e1dcc950], xmm1
jmp 0x7ff7e1a4d49c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [0x7ff7e1dcc940], xmm0
movups xmmword [0x7ff7e1dcc950], xmm0
movups xmmword [0x7ff7e1dcc960], xmm0
lea rcx, [0x7ff7e1d9b320]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [0x7ff7e1dccb70], xmm0
movups xmmword [0x7ff7e1dccb80], xmm0
movups xmmword [0x7ff7e1dccb90], xmm0
call fcn.7ff7e1c62ba4
cmp qword [0x7ff7e1dcc738], 0
jne 0x7ff7e1a4d5ba
mov r8d, 1
lea rax, [0x7ff7e1d90360]
mov edx, r8d
mov qword [0x7ff7e1dbc430], rax
sub rdx, rbx
lea rcx, [0x7ff7e1dbc450]
nop dword [rax + rax]
lea rax, [rdx + rbx]
cmp rax, 0x40
jae 0x7ff7e1a4d52a
movzx eax, byte [rbx]
inc rbx
mov byte [rcx], al
inc rcx
cmp byte [rbx], 0
jne 0x7ff7e1a4d510
mov rdi, qword [0x7ff7e1d9c3d8]
lea rax, [0x7ff7e1dbc430]
mov byte [rcx], 0
mov ecx, 8
mov qword [0x7ff7e1dcc738], rax
lea rax, [0x7ff7e1a4d9c0]
mov qword [0x7ff7e1dbc440], rax
lea rax, [0x7ff7e1a4d9d0]
mov qword [0x7ff7e1dbc448], rax
xchg byte [rdi], r8b
call fcn.7ff7e1c64f38
lea rcx, [rsp + 0x38]
xor ebx, ebx
mov qword [rsp + 0x28], rcx
lea r8, [0x7ff7e1a4de10]
xor ecx, ecx
mov dword [rsp + 0x20], ebx
mov r9, rax
mov qword [rax], rdi
xor edx, edx
call fcn.7ff7e1c78d28
mov qword [rsp + 0x30], rax
test rax, rax
je 0x7ff7e1a4d5db
cmp dword [rdi + 0xa8], ebx
jne 0x7ff7e1a4d5f2
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi + 0xa0], xmm0
jmp 0x7ff7e1a4d5ba
xor ebx, ebx
mov qword [0x7ff7e1d9c3d8], rbx
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.7ff7e1c64cb0
mov rbx, qword [rsp + 0x100]
add rsp, 0xf0
pop rdi
ret
mov ecx, 6
mov dword [rsp + 0x38], ebx
call fcn.7ff7e1c62edc
int3
mov ecx, eax
call fcn.7ff7e1c62ea0
int3
call fcn.7ff7e1c79130
int3
Function at 0x7ff7e1a4df40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x7ff7e1a4dfb2
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x7ff7e1a4df70
mov ecx, dword [r10]
jmp 0x7ff7e1a4e0b3
cmp ecx, 0x270
jb 0x7ff7e1a4e0b3
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x7ff7e1a4dfe0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x7ff7e1a4e030
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x7ff7e1a543b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x7ff7e1a5440d
lea rbx, [0x7ff7e1d52f40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x7ff7e1a543f4
cmp r10, 2
jb 0x7ff7e1a543f4
cmp byte [r9], r8b
jne 0x7ff7e1a543f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x7ff7e1a543d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x7ff7e1a5444f
lea rbx, [0x7ff7e1d52f40]
cmp r8b, 0x23
jne 0x7ff7e1a54433
cmp byte [r9], r8b
jne 0x7ff7e1a54433
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x7ff7e1a54420
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x7ff7e1a54600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x7ff7e1a5462e
mov r8d, 0x611
lea rdx, [0x7ff7e1d4ce90]
lea rcx, [0x7ff7e1d4cef8]
call fcn.7ff7e1c744f8
test rsi, rsi
je 0x7ff7e1a5463a
mov qword [rsi], 0
lea rdx, [0x7ff7e1d50df0]
mov rcx, rbx
call fcn.7ff7e1a54460
mov rbx, rax
test rax, rax
jne 0x7ff7e1a5465c
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.7ff7e1c7972c
mov ebp, eax
cmp eax, 0xffffffff
je 0x7ff7e1a5473c
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.7ff7e1c79ee8
test eax, eax
jne 0x7ff7e1a5473c
mov rcx, rbx
call fcn.7ff7e1c7972c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x7ff7e1a5473c
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.7ff7e1c79ee8
test eax, eax
jne 0x7ff7e1a5473c
cmp rdi, 0xffffffffffffffff
je 0x7ff7e1a5473c
mov rax, qword [0x7ff7e1d9b2a0]
test rax, rax
je 0x7ff7e1a546d0
inc dword [rax + 0x3b0]
mov rdx, qword [0x7ff7e1d9b290]
mov rcx, rdi
call fcn.7ff7e1a53b90
mov rbp, rax
test rax, rax
je 0x7ff7e1a5473c
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.7ff7e1c7ab7c
mov rcx, rbx
cmp rax, rdi
je 0x7ff7e1a5472a
call fcn.7ff7e1c79c74
mov rax, qword [0x7ff7e1d9b2a0]
test rax, rax
je 0x7ff7e1a54719
dec dword [rax + 0x3b0]
mov rdx, qword [0x7ff7e1d9b290]
mov rcx, rbp
call fcn.7ff7e1a53ba0
jmp 0x7ff7e1a54744
call fcn.7ff7e1c79c74
test rsi, rsi
je 0x7ff7e1a54737
mov qword [rsi], rdi
mov rax, rbp
jmp 0x7ff7e1a54746
mov rcx, rbx
call fcn.7ff7e1c79c74
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x7ff7e1a56b70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x108]
mov rbx, rcx
mov edi, edx
test eax, eax
jg 0x7ff7e1a56bac
mov r8d, 0x5d0
lea rdx, [0x7ff7e1d4cc90]
lea rcx, [0x7ff7e1d52ce8]
call fcn.7ff7e1c744f8
mov eax, dword [rbx + 0x108]
movsxd rcx, eax
lea r8, [0x7ff7e1d52f40]
mov rax, qword [rbx + 0x110]
mov edx, dword [rax + rcx*4 - 4]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x7ff7e1d9b2a0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1be8], edx
jne 0x7ff7e1a56c21
mov dword [rax + 0x1bec], edx
cmp dword [rax + 0x1c28], edx
jne 0x7ff7e1a56c30
mov byte [rax + 0x1c2c], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7e1a63950
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x7ff7e1d9b2a0]
mov rsi, rcx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
mov eax, dword [rbx]
mov edx, eax
test eax, eax
jg 0x7ff7e1a639a1
mov r8d, 0x5d0
lea rdx, [0x7ff7e1d4cc90]
lea rcx, [0x7ff7e1d52ce8]
call fcn.7ff7e1c744f8
mov eax, dword [rbx]
mov edx, eax
mov r9, qword [rbx + 8]
lea r8, [0x7ff7e1d52f40]
cdqe
mov edi, dword [r9 + rax*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x7ff7e1a63a86
lea ecx, [rdx + 1]
test r8d, r8d
je 0x7ff7e1a63a6c
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff7e1a63a71
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.7ff7e1a79750
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff7e1a63aa0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x7ff7e1d9b2a0]
mov esi, ecx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
mov eax, dword [rbx]
mov edx, eax
test eax, eax
jg 0x7ff7e1a63aef
mov r8d, 0x5d0
lea rdx, [0x7ff7e1d4cc90]
lea rcx, [0x7ff7e1d52ce8]
call fcn.7ff7e1c744f8
mov eax, dword [rbx]
mov edx, eax
mov r9, qword [rbx + 8]
lea r8, [0x7ff7e1d52f40]
cdqe
mov edi, dword [r9 + rax*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x7ff7e1a63b88
lea ecx, [rdx + 1]
test r8d, r8d
je 0x7ff7e1a63b6e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff7e1a63b73
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.7ff7e1a79750
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7e1a65550
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff7e1d8f600]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff7e1d9b2a0]
mov edi, edx
cmp byte [rbx + 0x1ef5], 0
jne 0x7ff7e1a655b0
cmp byte [rbx + 0x1ef6], 0
jne 0x7ff7e1a655b0
mov r9d, dword [rbx + 0x2f38]
lea r8, [0x7ff7e1d50448]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff7e1a542a0
test dil, 1
je 0x7ff7e1a656e7
jmp 0x7ff7e1a6563f
movss xmm1, dword [rbx + 0x16ec]
lea r8, [0x7ff7e1d50448]
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x7ff7e1d5deb0]
xor eax, eax
mulss xmm1, dword [0x7ff7e1d5de98]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1c5c], rax
mov dword [rbx + 0x1c44], 1
movss dword [rbx + 0x1c54], xmm0
mov byte [rbx + 0x1c7c], 1
movss dword [rbx + 0x1c58], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x7ff7e1d5ddd8]
or dword [rbx + 0x1c40], 0x41
movss dword [rbx + 0x1ca0], xmm0
mov r9d, dword [rbx + 0x2f38]
call fcn.7ff7e1a542a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x7ff7e1a65690
lea r11, [0x7ff7e1d52f40]
nop
cmp r9b, 0x23
jne 0x7ff7e1a65673
cmp byte [r8], r9b
jne 0x7ff7e1a65673
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x7ff7e1a65660
mov rcx, qword [0x7ff7e1d9b2a0]
not edx
add rcx, 0x1b78
call fcn.7ff7e1a54a90
test rax, rax
je 0x7ff7e1a656e7
cmp byte [rax + 0xbf], 0
je 0x7ff7e1a656e7
mov byte [rax + 0xc6], 1
lea r8, [0x7ff7e1d50448]
mov dword [rax + 0xdc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2f38]
mov edx, 0x10
mov r9d, dword [rbx + 0x2f38]
call fcn.7ff7e1a542a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.7ff7e1a5f6e0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff7e1c64cb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff7e1a6af60
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x7ff7e1d9b2a0]
cmp byte [rbx + 0x3000], 0
je 0x7ff7e1a6b04b
cmp qword [rbx + 0x3008], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3010]
je 0x7ff7e1a6b033
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x7ff7e1a6afdb
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.7ff7e1a794a0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.7ff7e1a54da0
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3008]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3018]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x7ff7e1d9b298]
cmovne rcx, rax
call fcn.7ff7e1c7a6f0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.7ff7e1a54da0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret

Function at 0x7ff7e1a6b4f0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x7ff7e1a6b546
lea r11, [0x7ff7e1d52f40]
cmp r9b, 0x23
jne 0x7ff7e1a6b529
cmp byte [r8], r9b
jne 0x7ff7e1a6b529
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff7e1a6b516
not ecx
call fcn.7ff7e1a6b400
test rax, rax
jne 0x7ff7e1a6b55f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.7ff7e1a6b310
add rsp, 0x20
pop rbx
ret