joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018a8d0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14017c678
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14017c678
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14018aa20
cmp rax, 0xffffffffffffffff
je 0x14018aa20
xor edi, edi
test rbp, rbp
jle 0x14018a9cb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14017bb2c
mov rbx, rax
test rax, rax
jne 0x14018a958
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14018a9c1
mov edx, 0x8000
mov ecx, r14d
call fcn.1401797c4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14017e9a4
cmp eax, 0xffffffff
je 0x14018a9a1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14018a968
mov edx, r15d
mov ecx, r14d
call fcn.1401797c4
jmp 0x14018a9c1
cmp byte [rsi + 0x38], dil
je 0x14018a9b8
cmp dword [rsi + 0x34], 5
jne 0x14018a9b8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
cmp byte [rsi + 0x30], dil
je 0x14018a9c1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14017c3a4
jmp 0x14018aa34
jns 0x14018aa34
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14017c678
cmp rax, 0xffffffffffffffff
jne 0x14018a9ec
cmp byte [rsi + 0x30], dil
je 0x14018aa34
mov edi, dword [rsi + 0x2c]
jmp 0x14018aa34
mov ecx, r14d
call fcn.1401843e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14018aa34
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, reloc.WS2_32.dll_listen
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], reloc.WS2_32.dll_listen
jmp 0x14018aa34
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14018aa2d
mov eax, dword [rsi + 0x2c]
jmp 0x14018aa32
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14017c678
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14018df60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov r9, rcx
mov r10, rdx
mov rdx, qword [r8 + 0x1b8]
mov ecx, 0x3020100
mov dword [r8 + 0x1c4], ecx
mov r11, r8
mov eax, 1
add ecx, 0x4040404
mov dword [r8 + rax*4 + 0x1c4], ecx
inc rax
cmp rax, rdx
jbe 0x14018df81
xor r8d, r8d
test r10, r10
je 0x14018dfe3
nop
movzx eax, byte [r9]
or r8, rax
movzx ecx, byte [rax + r11 + 0x1c4]
mov byte [r9], cl
mov byte [r11 + 0x1c3], cl
nop word [rax + rax]
movzx ecx, byte [rax + r11 + 0x1c3]
mov rdx, rax
sub rax, 1
mov byte [rdx + r11 + 0x1c4], cl
jns 0x14018dfc0
inc r9
sub r10, 1
jne 0x14018dfa0
shr r8, 2
mov qword [r11 + 0x1b8], r8
ret

Function at 0x140195ec0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140195ee8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140195ee8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1401a2d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1401a2dc1
test byte [rbx + 6], 0xf
jne 0x1401a2db4
xor edi, edi
cmp word [rbx + 4], di
jne 0x1401a2db4
cmp word [rbx + 2], di
jne 0x1401a2db4
cmp word [rbx], di
jne 0x1401a2db4
lea esi, [rdi + 1]
jmp 0x1401a2db9
mov esi, 2
movzx eax, si
jmp 0x1401a2fb9
xor edi, edi
test cx, cx
jne 0x1401a2ddc
mov rcx, rbx
call fcn.1401a320c
movzx ecx, ax
cmp di, ax
jl 0x1401a2fb6
movsx edx, cx
test esi, esi
jle 0x1401a2e0c
sub ebp, edx
cmp ebp, esi
jg 0x1401a2e0c
movsd xmm0, qword [0x140200430]
cmp word [rbx + 6], di
jge 0x1401a2dfe
xorps xmm0, xmmword [0x140276540]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1401a2fb9
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1401a2e39
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1401a2fb9
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, select
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1401a2fab
test ebp, ebp
jns 0x1401a2fab
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1401a2ece
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x1401a2ea0
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x1401a2f4d
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1401a2f63
jne 0x1401a2f82
test byte [rbx], sil
je 0x1401a2f82
add word [rbx], si
jne 0x1401a2f82
add word [rbx + 2], si
jne 0x1401a2f82
add word [rbx + 4], si
jne 0x1401a2f82
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1401a2e31
cmp r11w, r15w
jne 0x1401a2e31
cmp word [rbx + 4], di
jne 0x1401a2e31
cmp word [rbx + 2], di
jne 0x1401a2e31
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x1401a2fb9
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180002e20
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
movsx eax, byte [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
ret

Function at 0x180003070
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
movabs rax, 0x100000001b3
mov qword [rsp + 0x10], rax
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x18], rax
mov qword [rsp], 0
jmp 0x1800030bb
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp], rax
jae 0x1800030ed
mov rax, qword [rsp + 0x10]
imul rax, qword [rsp + 8]
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x18]
add rdx, rcx
mov rcx, rdx
movzx ecx, byte [rcx]
xor rax, rcx
mov qword [rsp + 8], rax
jmp 0x1800030b0
mov rax, qword [rsp + 8]
add rsp, 0x28
ret
Function at 0x180003160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x60], 0
jne 0x180003181
xor eax, eax
jmp 0x180003394
mov dword [rsp + 0x24], 0x522d6f4e
mov dword [rsp + 0x28], 0xb0000b9
mov dword [rsp + 0x2c], 0x6174535c
mov dword [rsp + 0x30], 0x20736968
mov dword [rsp + 0x34], 0x89182444
mov dword [rsp + 0x38], 0xe801e283
mov dword [rsp + 0x3c], 0xc35b5d5f
mov r8d, dword [rsp + 0x24]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800031f9
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 6
jmp 0x180003394
mov r8d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003239
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 7
jmp 0x180003394
mov r8d, dword [rsp + 0x2c]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003279
mov eax, dword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 8
jmp 0x180003394
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1800032cd
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov eax, eax
mov ecx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
add rdx, rcx
mov rcx, rdx
mov edx, eax
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 9
jmp 0x180003394
cmp dword [rsp + 0x58], 0x185d
jbe 0x18000338f
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003317
mov edx, 0x185d
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xa
jmp 0x180003394
mov r8d, dword [rsp + 0x38]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x180003353
mov edx, 0x1810
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xb
jmp 0x180003394
mov r8d, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.180003100
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x18000338f
mov edx, 0x1810
mov rcx, qword [rsp + 0x50]
call fcn.180003070
mov rcx, qword [rsp + 0x60]
mov qword [rcx], rax
mov eax, 0xb
jmp 0x180003394
mov eax, 1
add rsp, 0x48
ret
Function at 0x180005440
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800ea020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003020
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002eb0
lea rcx, [rsp + 0x30]
call fcn.180002f20
movzx eax, al
test eax, eax
je 0x1800054d7
lea rcx, [rsp + 0x30]
call fcn.180002f60
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x1800054d7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002f80
mov rcx, rax
call fcn.180005a40
cmp eax, 0x3285501
jne 0x1800054d5
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002fc0
jmp 0x1800054ee
jmp 0x18000548f
lea rcx, [rsp + 0x28]
call fcn.180003040
movzx eax, al
test eax, eax
jne 0x18000545d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c31e0
add rsp, 0x58
ret

Function at 0x18000aa10
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800ea020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003020
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002eb0
lea rcx, [rsp + 0x30]
call fcn.180002f20
movzx eax, al
test eax, eax
je 0x18000aaa7
lea rcx, [rsp + 0x30]
call fcn.180002f60
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18000aaa7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002f80
mov rcx, rax
call fcn.180005a40
cmp eax, 0x2fa62ca8
jne 0x18000aaa5
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002fc0
jmp 0x18000aabe
jmp 0x18000aa5f
lea rcx, [rsp + 0x28]
call fcn.180003040
movzx eax, al
test eax, eax
jne 0x18000aa2d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c31e0
add rsp, 0x58
ret

Function at 0x18000c440
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1800ea020]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x28]
call fcn.180003020
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x30]
lea rcx, [rsp + 0x30]
call fcn.180002eb0
lea rcx, [rsp + 0x30]
call fcn.180002f20
movzx eax, al
test eax, eax
je 0x18000c4d7
lea rcx, [rsp + 0x30]
call fcn.180002f60
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x24], 0
je 0x18000c4d7
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002f80
mov rcx, rax
call fcn.180005a40
cmp eax, 0x820621f3
jne 0x18000c4d5
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180002fc0
jmp 0x18000c4ee
jmp 0x18000c48f
lea rcx, [rsp + 0x28]
call fcn.180003040
movzx eax, al
test eax, eax
jne 0x18000c45d
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800c31e0
add rsp, 0x58
ret
Function at 0x180014ad0
Capabilities:
Enumerate pe sections

Disassembly:
push rdi
sub rsp, 0x80
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x21]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x24]
lea rcx, [rsp + 0x60]
call fcn.180014c90
mov rcx, rax
call fcn.1800156e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x180014b3b
xor eax, eax
jmp 0x180014c86
mov rcx, qword [rsp + 0x30]
call fcn.180014a70
mov dword [0x180ccc878], eax
cmp dword [0x180ccc878], 0
jne 0x180014b5b
xor eax, eax
jmp 0x180014c86
mov dword [rsp + 0x50], 0x5f000000
cmp dword [0x180ccc878], 0x5f000000
ja 0x180014b76
xor eax, eax
jmp 0x180014c86
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x180014b96
xor eax, eax
jmp 0x180014c86
mov rax, qword [rsp + 0x48]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x40]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x28], 0
jmp 0x180014bdb
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x28], eax
jae 0x180014c84
lea rax, [rsp + 0x22]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rsp + 0x23]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rsp + 0x22]
movzx r8d, byte [rsp + 0x23]
movzx edx, byte [rsp + 0x25]
lea rcx, [rsp + 0x70]
call fcn.180014cc0
mov rcx, rax
call fcn.1800156a0
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x180014c53
inc rcx
test dl, dl
jne 0x180014c40
xor eax, eax
jmp 0x180014c58
sbb eax, eax
or eax, 1
test eax, eax
jne 0x180014c71
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
jmp 0x180014c86
mov rax, qword [rsp + 0x38]
add rax, 0x28
mov qword [rsp + 0x38], rax
jmp 0x180014bd1
xor eax, eax
add rsp, 0x80
pop rdi
ret
Function at 0x180038d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x180038d61
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.180038360
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x180038dbc
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x180038d69
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x180038dd8
lea rcx, [0x1800c7fa0]
call fcn.18002baf0
jmp 0x180038f1c
cmp dword [rsp + 0x20], 4
jge 0x180038dfe
mov rcx, qword [rsp + 0x50]
call fcn.180038250
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x180038dd8
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x180038e6e
lea rcx, str.zlib_corrupt
call fcn.18002baf0
jmp 0x180038f1c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x180038e97
lea rcx, str.read_past_buffer
call fcn.18002baf0
jmp 0x180038f1c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x180038ed0
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.1800385f0
test eax, eax
jne 0x180038ed0
xor eax, eax
jmp 0x180038f1c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x18004a5d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800cb400]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x18004a65e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x18004a602
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x18004a670
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1800cb400]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x18004a774
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x18004a76f
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x18004a744
cmp qword [rsp + 0x38], 2
jb 0x18004a744
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004a744
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004a744
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004a6b7
jmp 0x18004a806
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x18004a806
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x18004a7dc
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004a7dc
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18004a7dc
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x18004a774
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x180093aa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1800ea020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [0x180ccc890]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x1988]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x1990]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
lea rcx, [rsp + 0x60]
call fcn.18000ff40
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x90]
cmp qword [rsp + 0x30], rax
jae 0x180093bef
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x180093bb1
movss xmm1, dword [rsp + 0x20]
movss xmm0, dword [rsp + 0x60]
call fcn.18006afd0
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa8]
test eax, eax
je 0x180093baf
jmp 0x180093bef
jmp 0x180093b33
cmp dword [rsp + 0x28], 0xd
jne 0x180093bbd
jmp 0x180093b33
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.18008bd80
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x180093b33
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rsp + 0x60]
jbe 0x180093c08
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x60], xmm0
cmp qword [rsp + 0xa0], 0
je 0x180093c40
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.18000ff40
mov rax, qword [rax]
mov rcx, qword [rsp + 0xa0]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1800e3510]
ja 0x180093c60
movss xmm0, dword [rsp + 0x64]
ucomiss xmm0, dword [0x1800e3510]
jp 0x180093c72
jne 0x180093c72
movss xmm0, dword [rsp + 0x64]
addss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x64], xmm0
cmp qword [rsp + 0x98], 0
je 0x180093c8d
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
mov qword [rax], rcx
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800c31e0
add rsp, 0x78
ret