joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff65423e770
Capabilities:
Create thread

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x7ff6543ef840]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x7ff6543ced00]
movdqu xmmword [rbp + 7], xmm0
movdqa xmm1, xmmword [0x7ff6543cedb0]
movdqu xmmword [rbp + 0x17], xmm1
mov dword [rbp + 0x27], 0x756e65
mov dword [rbp + 0x37], 0x6c65437d
mov word [rbp + 0x3b], 0x7865
mov byte [rbp + 0x3d], 0
mov dword [rsp + 0x20], 0x7d0
xor r9d, r9d
lea r8, [rbp + 8]
lea rdx, [rbp + 0x38]
call fcn.7ff65424a210
mov ecx, 1
call fcn.7ff6543776d0
mov qword [rbp + 0x37], rax
lea rcx, [rbp - 1]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff65423f100]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rbp - 9], rax
test rax, rax
je 0x7ff65423e852
cmp dword [rbp - 1], 0
je 0x7ff65423e846
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp + 0x37], xmm0
lea rcx, [rbp + 0x37]
call qword [sym.imp.msvcp140.dll__Thrd_detach]
test eax, eax
jne 0x7ff65423e846
mov al, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.7ff6543776b0
add rsp, 0x90
pop rbp
ret
mov ecx, 1
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 1], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x7ff65425b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x7ff65425b621
cmp eax, r10d
jge 0x7ff65425b60f
call fcn.7ff65425adf0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x14], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x7ff65425b662
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x14], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x7ff65425b640
mov dword [rbx + 0x10], eax
jns 0x7ff65425b688
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, [0x7ff6543c15a8]
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x7ff65425b6b7
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x7ff65425b6a1
xor dl, dl
jmp 0x7ff65425b6aa
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x7ff65425b695
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x7ff65425b664
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x7ff65425b721
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, [0x7ff6543c1590]
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x7ff65425b73b
mov rcx, rbx
call fcn.7ff65425af30
test eax, eax
je 0x7ff65425b714
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x7ff6542749d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x7ff654274a81
mov rax, qword [r11]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x7ff654274a83
nop
cmp rcx, r8
je 0x7ff654274a81
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x7ff654274a70
jmp 0x7ff654274a83
xor ecx, ecx
test rcx, rcx
je 0x7ff654274ade
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x7ff654274aa9
cmp rax, rcx
jne 0x7ff654274a9f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x7ff654274ab4
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x7ff654274ab4
cmp rax, rcx
jne 0x7ff654274ab4
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.7ff654377954
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x7ff65427f270
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
xor r10d, r10d
mov qword [rsp + 0x30], rdx
mov rbx, rdx
test r8, r8
je 0x7ff65427f39e
cmp qword [0x7ff65448be30], r10
je 0x7ff65427f39e
movabs r9, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov rax, r8
imul rdx, r9
shr rax, 8
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
imul rdx, r9
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [0x7ff65448be50]
imul rdx, r9
xor rdx, rax
imul rdx, r9
mov r9, qword [0x7ff65448be38]
and rcx, rdx
mov rdx, qword [0x7ff65448be28]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x7ff65427f371
mov rcx, qword [r9 + rcx*8]
cmp r8, qword [rax + 0x10]
je 0x7ff65427f374
nop dword [rax]
cmp rax, rcx
je 0x7ff65427f371
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x7ff65427f360
jmp 0x7ff65427f374
mov rax, r10
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
je 0x7ff65427f39e
cmp byte [rcx + 0x18], r10b
lea rdx, [rcx + 0x18]
je 0x7ff65427f39e
mov rcx, rbx
call fcn.7ff65427f430
mov rax, rbx
add rsp, 0x40
pop rbx
ret
mov byte [rbx], 1
xor eax, eax
mov qword [rbx + 8], r10
xorps xmm0, xmm0
mov qword [rbx + 0x10], r10
mov dword [rbx + 0x18], 0x42c80000
mov dword [rbx + 0x1c], 0x42c80000
mov dword [rbx + 0x20], 0x64
mov byte [rbx + 0x24], r10b
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], rax
mov rax, rbx
mov qword [rbx + 0x40], r10
mov qword [rbx + 0x48], r10
mov qword [rbx + 0x50], r10
mov qword [rbx + 0x58], r10
mov qword [rbx + 0x60], r10
mov qword [rbx + 0x68], r10
mov qword [rbx + 0x70], r10
mov qword [rbx + 0x78], r10
mov qword [rbx + 0x80], r10
mov qword [rbx + 0x88], r10
mov qword [rbx + 0x90], r10
mov qword [rbx + 0x98], r10
mov qword [rbx + 0xa0], r10
mov qword [rbx + 0xa8], r10
mov qword [rbx + 0xb0], r10
mov qword [rbx + 0xb8], r10
add rsp, 0x40
pop rbx
ret
Function at 0x7ff65427f430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rdx]
mov byte [rcx], al
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0x1c]
mov dword [rcx + 0x1c], eax
mov eax, dword [rdx + 0x20]
mov dword [rcx + 0x20], eax
movzx eax, byte [rdx + 0x24]
mov byte [rcx + 0x24], al
mov eax, dword [rdx + 0x28]
mov dword [rcx + 0x28], eax
mov eax, dword [rdx + 0x2c]
mov dword [rcx + 0x2c], eax
mov eax, dword [rdx + 0x30]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x34]
mov dword [rcx + 0x34], eax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
movsd xmm0, qword [rdx + 0x3c]
movsd qword [rcx + 0x3c], xmm0
movsd xmm1, qword [rdx + 0x44]
movsd qword [rcx + 0x44], xmm1
movsd xmm0, qword [rdx + 0x4c]
movsd qword [rcx + 0x4c], xmm0
movsd xmm1, qword [rdx + 0x54]
movsd qword [rcx + 0x54], xmm1
mov rax, qword [rdx + 0x60]
mov qword [rcx + 0x60], rax
movups xmm0, xmmword [rdx + 0x68]
movups xmmword [rcx + 0x68], xmm0
movups xmm1, xmmword [rdx + 0x78]
movups xmmword [rcx + 0x78], xmm1
movsd xmm0, qword [rdx + 0x88]
movsd qword [rcx + 0x88], xmm0
lea r14, [rcx + 0x90]
xor ebp, ebp
mov qword [r14], rbp
mov qword [r14 + 8], rbp
mov qword [r14 + 0x10], rbp
mov rdx, qword [rdx + 0x98]
sub rdx, qword [rsi + 0x90]
sar rdx, 3
movabs r12, 0x1fffffffffffffff
test rdx, rdx
je 0x7ff65427f55e
cmp rdx, r12
ja 0x7ff65427f5df
mov rcx, r14
call fcn.7ff654280ba0
mov rdi, qword [r14]
mov rbx, qword [rsi + 0x98]
mov rdx, qword [rsi + 0x90]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
sar rbx, 3
lea rax, [rdi + rbx*8]
mov qword [r14 + 8], rax
lea r14, [r15 + 0xa8]
mov qword [r14], rbp
mov qword [r14 + 8], rbp
mov qword [r14 + 0x10], rbp
mov rdx, qword [rsi + 0xb0]
sub rdx, qword [rsi + 0xa8]
sar rdx, 3
test rdx, rdx
je 0x7ff65427f5bf
cmp rdx, r12
ja 0x7ff65427f5d9
mov rcx, r14
call fcn.7ff654280ba0
mov rdi, qword [r14]
mov rbx, qword [rsi + 0xb0]
mov rdx, qword [rsi + 0xa8]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy_1
sar rbx, 3
lea rcx, [rdi + rbx*8]
mov qword [r14 + 8], rcx
mov rax, r15
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.7ff65420e630
nop
call fcn.7ff65420e630
int3
Function at 0x7ff654281180
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x7ff6543ef840]
xor rax, rsp
mov qword [rbp + 0xf0], rax
movdqa xmm0, xmmword [0x7ff6543cedc0]
lea r8, [rsp + 0x41]
movdqa xmm1, xmmword [0x7ff6543cee70]
lea rdx, [rsp + 0x31]
xor r9d, r9d
mov byte [rsp + 0x60], 0
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x30], 0x6c654361
movdqu xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x34], 0x7865
mov byte [rsp + 0x36], 0
mov dword [rsp + 0x20], 0xbb8
call fcn.7ff65424a210
lea r8, [0x7ff6543c2ac0]
mov edx, 0x24
lea rcx, [0x7ff6543c2af0]
call fcn.7ff654238170
xor esi, esi
xor edx, edx
mov ecx, 2
mov edi, esi
call qword [sym.imp.kernel32.dll_CreateToolhelp32Snapshot]
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.kernel32.dll_Process32First]
test eax, eax
je 0x7ff65428126e
lea rdx, [0x7ff6543c2b38]
lea rcx, [rbp - 0x14]
call qword [sym.imp.ucrtbase.dll__stricmp]
test eax, eax
je 0x7ff65428126b
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_Process32Next]
test eax, eax
jne 0x7ff654281243
jmp 0x7ff65428126e
mov edi, dword [rbp - 0x38]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_CloseHandle]
lea rcx, [0x7ff6543c28a8]
mov dword [0x7ff65448bb50], edi
call qword [sym.imp.kernel32.dll_LoadLibraryA]
lea rcx, [0x7ff6543c28d8]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
lea rcx, [0x7ff6543c28e8]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov ecx, 0x7d0
call qword [sym.imp.kernel32.dll_Sleep]
lea rcx, [0x7ff6543c28d8]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x7ff6543c28b8]
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov ecx, 0x1f4
mov qword [0x7ff65448bb48], rax
call qword [sym.imp.kernel32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
xor r9d, r9d
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rsp + 0x40]
mov qword [rsp + 0x58], rsi
mov edx, 0x22f3a434
mov qword [rsp + 0x60], rsi
xor ecx, ecx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x74], rsi
mov dword [rsp + 0x70], 0x2edf6508
mov qword [rsp + 0x20], rsi
call qword [0x7ff65448bb48]
xorps xmm0, xmm0
mov qword [rbp - 0x70], rsi
xor r9d, r9d
movdqa xmmword [rbp - 0x80], xmm0
lea r8, [rbp - 0x80]
mov qword [rbp - 0x68], rsi
mov edx, 0x22f3a434
mov qword [rbp - 0x60], rsi
xor ecx, ecx
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x4c], rsi
mov dword [rbp - 0x50], 0xe64eca51
mov qword [rsp + 0x20], rsi
call qword [0x7ff65448bb48]
mov ecx, 0x64
call qword [sym.imp.kernel32.dll_Sleep]
lea r8, [0x7ff6543c2ad8]
mov edx, 0x2b
lea rcx, [0x7ff6543c2af0]
call fcn.7ff654238170
xor edx, edx
lea rcx, [0x7ff65448aa15]
call fcn.7ff65427a860
test al, al
setne al
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.7ff6543776b0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x7ff654283360
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x7ff6542833bd
lea rbx, [0x7ff6543b9aa0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x7ff6542833a4
cmp r10, 2
jb 0x7ff6542833a4
cmp byte [r9], r8b
jne 0x7ff6542833a4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x7ff654283380
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x7ff6542833ff
lea rbx, [0x7ff6543b9aa0]
cmp r8b, 0x23
jne 0x7ff6542833e3
cmp byte [r9], r8b
jne 0x7ff6542833e3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x7ff6542833d0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x7ff654283540
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x7ff65428355a
mov qword [r8], 0
lea rdx, [0x7ff6543c133c]
call fcn.7ff654283410
mov rbx, rax
test rax, rax
jne 0x7ff65428357a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ucrtbase.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x7ff654283653
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff654283653
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x7ff654283653
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x7ff654283653
cmp rdi, 0xffffffffffffffff
je 0x7ff654283653
mov rax, qword [0x7ff65448aac0]
test rax, rax
je 0x7ff6542835f0
inc dword [rax + 0xec]
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_malloc]
mov rsi, rax
test rax, rax
je 0x7ff654283653
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x7ff654283640
call qword [sym.imp.ucrtbase.dll_fclose]
mov rax, qword [0x7ff65448aac0]
test rax, rax
je 0x7ff654283635
dec dword [rax + 0xec]
mov rcx, rsi
call qword [sym.imp.ucrtbase.dll_free]
jmp 0x7ff65428365c
call qword [sym.imp.ucrtbase.dll_fclose]
test r14, r14
je 0x7ff65428364e
mov qword [r14], rdi
mov rax, rsi
jmp 0x7ff65428365e
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x7ff654286a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov r11, rcx
lea rdi, [0x7ff6543b9aa0]
movsxd rcx, dword [rcx + 0xf0]
mov r10d, edx
shr r10d, 0x18
mov r8d, edx
shr r8d, 8
mov r9d, edx
mov rax, qword [r11 + 0xf8]
shr r9d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r8b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
movzx ecx, bl
xor rcx, r10
shr ebx, 8
xor ebx, dword [rdi + rcx*4]
mov rcx, qword [r11]
not ebx
cmp dword [rcx + 0x3f20], ebx
jne 0x7ff654286ae4
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.7ff65429b040
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff654286b00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0x110]
lea r10, [0x7ff6543b9aa0]
mov rax, qword [rcx + 0xf8]
movss xmm1, dword [rcx + 0x114]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xf0]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
shr r8, 0x18
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx edx, r9b
shr r9d, 8
xor r8, rdx
xor r9d, dword [r10 + r8*4]
not r9d
mov eax, r9d
add rsp, 0x18
ret
Function at 0x7ff65428a440
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x7ff65448aac0]
movzx esi, r9b
mov r12d, dword [rsp + 0x90]
mov r15d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
mov eax, dword [rbx + 0x14]
movss xmm2, dword [rbx + 0x250]
and eax, 4
movss xmm3, dword [rbx + 0x254]
or eax, 0x1000103
or r12d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x7ff65428a4aa
cmp qword [rdi + 0x4b38], 0
je 0x7ff65428a4b2
movss xmm2, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
subss xmm2, dword [rbx + 0x100]
subss xmm3, dword [rbx + 0x104]
xorps xmm5, xmm5
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
jp 0x7ff65428a4ec
jne 0x7ff65428a4ec
mov eax, 1
jmp 0x7ff65428a4ee
xor eax, eax
ucomiss xmm0, xmm5
jp 0x7ff65428a4fd
jne 0x7ff65428a4fd
mov r14d, 2
jmp 0x7ff65428a500
xor r14d, r14d
movss xmm4, dword [0x7ff6543cd698]
or r14d, eax
comiss xmm5, xmm1
jb 0x7ff65428a51b
addss xmm2, xmm1
movaps xmm1, xmm2
maxss xmm1, xmm4
comiss xmm5, xmm0
jb 0x7ff65428a52b
addss xmm3, xmm0
movaps xmm0, xmm3
maxss xmm0, xmm4
or dword [rdi + 0x47b8], 2
xor edx, edx
movss dword [rdi + 0x47d8], xmm1
movss dword [rdi + 0x47dc], xmm0
mov dword [rdi + 0x47c0], 1
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x7ff65428a574
mov dword [rsp + 0x28], r15d
lea r8, [0x7ff6543c2db8]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.7ff654283240
jmp 0x7ff65428a58a
lea r8, [0x7ff6543c2db0]
mov dword [rsp + 0x20], r15d
lea rcx, [rsp + 0x70]
call fcn.7ff654283240
movss xmm6, dword [rdi + 0x37f8]
test sil, sil
jne 0x7ff65428a5a1
mov dword [rdi + 0x37f8], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r12d
xor edx, edx
call fcn.7ff65428d2e0
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r15d
mov byte [rsi + 0xd2], r14b
jne 0x7ff65428a5e7
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r15d
lea rdx, [0x7ff6543c2da9]
not r9d
lea r10, [0x7ff6543b9aa0]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x7ff65428a614
cmp byte [rdx], r8b
jne 0x7ff65428a614
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x7ff65428a601
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x7ff65428a644
xor edx, edx
xor ecx, ecx
call fcn.7ff654286cf0
cmp dword [rdi + 0x48d0], r15d
jne 0x7ff65428a691
bt r12d, 0x17
jb 0x7ff65428a691
cmp word [rsi + 0x15c], 0
jne 0x7ff65428a667
cmp byte [rsi + 0x162], 0
je 0x7ff65428a691
xor edx, edx
mov rcx, rsi
call fcn.7ff65428f7b0
xor edx, edx
mov rcx, rsi
call fcn.7ff654295e00
mov rdx, rsi
mov ecx, ebx
call fcn.7ff654286cf0
mov eax, dword [rdi + 0x48f4]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff654293c50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6543ef840]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff65448aac0]
mov edi, ecx
cmp byte [rbx + 0x4a81], 0
jne 0x7ff654293cb1
cmp byte [rbx + 0x4a82], 0
jne 0x7ff654293cb1
movsx r9d, word [rbx + 0x5bb2]
lea r8, [0x7ff6543c3510]
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff6542831c0
test dil, 2
je 0x7ff654293ddf
jmp 0x7ff654293d3c
movss xmm1, dword [rbx + 0x3894]
lea r8, [0x7ff6543c3510]
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x7ff6543cd6e8]
mov edx, 0x10
mulss xmm1, dword [0x7ff6543cd6d4]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47d0], rax
mov dword [rbx + 0x47bc], 1
movss dword [rbx + 0x47c8], xmm0
movss dword [rbx + 0x47cc], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x7ff6543cd57c]
or dword [rbx + 0x47b8], 0x41
movss dword [rbx + 0x4818], xmm0
call fcn.7ff6542831c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff654293d90
lea r11, [0x7ff6543b9aa0]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff654293d73
cmp byte [r8], r9b
jne 0x7ff654293d73
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff654293d60
not ecx
call fcn.7ff65428ab80
test rax, rax
je 0x7ff654293ddf
cmp byte [rax + 0xb6], 0
je 0x7ff654293ddf
mov byte [rax + 0xbb], 1
lea r8, [0x7ff6543c3510]
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.7ff6542831c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff65428d2e0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff6543776b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret