joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d45f0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401450c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400d4673
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1400d4695
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006b8d0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.140079540
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x1400d46f4
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400d4704
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400d4716
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x1400d4678

Function at 0x1400e1b64
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400e1c94

Function at 0x1400eee00
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400eee28
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400eee28
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400fb13c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400fb15c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400e4214
or eax, 0xffffffff
jmp 0x1400fb15e
xor eax, eax
add rsp, 0x28
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x1800144d0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x180056090]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
mov qword [r11 - 0x38], rcx
or esi, 0xffffffff
mov qword [r11 - 0x58], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
lea edx, [rsi + 5]
lea r8d, [rsi + 3]
lea rcx, str.C:WindowsTempiislog.txt
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800145b3
lea r9d, [rsi + 3]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x1800145a9
lea r8, [0x18004b1a4]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.18000c3a0
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rdx, qword [rsp + 0x58]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor esi, esi
lea rcx, [rsp + 0x58]
call fcn.180001c80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call fcn.180001c80
mov eax, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800198f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180014f10
Capabilities:
Timestomp file

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180056090]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x407e6
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x4e], 0x90007
mov dword [rsp + 0x52], 0x170025
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
cmp qword [0x180058b40], 8
lea rcx, [0x180058b28]
mov qword [rsp + 0x30], 0
mov edx, 0x100
cmovae rcx, qword [0x180058b28]
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180014fc4
lea r9, [rsp + 0x40]
mov rcx, rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetFileTime]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800198f0
add rsp, 0x60
pop rbx
ret
Function at 0x1800168e0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x2070
call fcn.18001a7e0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20a8], rbx
mov rax, qword [0x180056090]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
xor edx, edx
mov r8d, 0x2000
lea rcx, [rsp + 0x60]
call fcn.18001cf10
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.180014800
lea rcx, [0x180058b28]
cmp qword [0x180058b40], 8
cmovae rcx, qword [0x180058b28]
cmp qword [rax + 0x18], 8
jb 0x180016963
mov rax, qword [rax]
cmp qword [rsi + 0x18], 8
jb 0x18001696d
mov rsi, qword [rsi]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x60]
lea r8, [0x18004b35c]
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, eax
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x1800169b1
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.180009aa0
test ebx, ebx
je 0x180016a18
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bp
lea rax, [rsp + 0x60]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bp
jne 0x1800169d1
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800090b0
nop
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180014880
nop
mov r8, qword [rsp + 0x58]
cmp r8, 8
jb 0x180016a39
inc r8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call fcn.180009aa0
jmp 0x180016a39
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
xor r8d, r8d
lea rdx, [0x18004b3c4]
mov rcx, rdi
call fcn.1800090b0
mov rax, rdi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.1800198f0
mov rbx, qword [rsp + 0x20a8]
add rsp, 0x2070
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001d5e8
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18003fff8]
xor ecx, ecx
lea r8, [0x18003fff0]
lea rdx, str.FlsAlloc
call fcn.18001d410
mov rbx, rax
test rax, rax
je 0x18001d628
mov rcx, rax
call fcn.18001a6cc
mov rcx, rdi
call rbx
jmp 0x18001d62e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001d690
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x180040008]
mov ecx, 2
lea r8, [0x180040000]
lea rdx, str.FlsGetValue
call fcn.18001d410
mov rdi, rax
test rax, rax
je 0x18001d6d1
mov rcx, rax
call fcn.18001a6cc
mov ecx, ebx
call rdi
jmp 0x18001d6d9
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18001d6e4
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x180040010]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x180040008]
call fcn.18001d410
mov rsi, rax
test rax, rax
je 0x18001d730
mov rcx, rax
call fcn.18001a6cc
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x18001d73b
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140041200
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004120d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004121d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140041205
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140041235
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140041222
sub eax, 3
jb 0x14004124f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140041286
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140041276
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140041274
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140041263
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400411c2
jmp 0x14004120d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa800
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400412d2
cmp rsi, rcx
jae 0x1400412da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400412b9
cmp al, 0x8f
ja 0x1400412b9
cmp byte [rsi - 2], 0xf
je 0x1400412bf
sub al, 0xe8
cmp al, 1
ja 0x1400412a3
cmp rsi, rcx
jae 0x1400412da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400412a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400412da
lodsb al, byte [rsi]
jmp 0x1400412b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x3e000]
mov eax, dword [rdi]
or eax, eax
je 0x140041343
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6171c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400412e7
jns 0x14004131c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140041326
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004133d
mov qword [rbx], rax
add rbx, 8
jmp 0x140041307
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14004137d
cmp al, 0xef
ja 0x14004136f
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14004134f
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14004135e
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400413d1
sub rsp, 0xffffffffffffff80
jmp 0x140009e30
Function at 0x140242c70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140242c7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140242c8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140242c75
lea eax, [rcx + 1]
jmp 0x140242c9b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140242cae
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140242c94
sub eax, 3
jb 0x140242cce
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140242d1d
sar eax, 1
movsxd rbp, eax
jb 0x140242d04
jmp 0x140242cdc
add ebx, ebx
jne 0x140242cda
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140242d04
inc ecx
add ebx, ebx
jne 0x140242cea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140242d04
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140242cfd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140242cec
add ecx, 2
jmp 0x140242d09
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140242c32
jmp 0x140242c7d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x156e00
mov dl, 0x27
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140242d6d
cmp rsi, rcx
jae 0x140242d75
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140242d54
cmp al, 0x8f
ja 0x140242d54
cmp byte [rsi - 2], 0xf
je 0x140242d5a
sub al, 0xe8
cmp al, 1
ja 0x140242d3e
cmp rsi, rcx
jae 0x140242d75
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140242d44
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140242d75
lodsb al, byte [rsi]
jmp 0x140242d54
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x23d000]
mov eax, dword [rdi]
or eax, eax
je 0x140242dde
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x24e690]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140242d82
jns 0x140242db7
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140242dc1
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140242dd8
mov qword [rbx], rax
add rbx, 8
jmp 0x140242da2
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140242e22
cmp al, 0xef
ja 0x140242e0a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140242dea
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140242df9
mov eax, dword [rdi]
add rdi, 4
jmp 0x140242df9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140242e76
sub rsp, 0xffffffffffffff80
jmp 0x1400296d4
Function at 0x140005e20
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140005e7d
lea rbx, [0x140069d30]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140005e64
cmp r10, 2
jb 0x140005e64
cmp byte [r9], r8b
jne 0x140005e64
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140005e40
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140005ebf
lea rbx, [0x140069d30]
cmp r8b, 0x23
jne 0x140005ea3
cmp byte [r9], r8b
jne 0x140005ea3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140005e90
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140009410
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r11, [0x140069d30]
mov rax, qword [rcx + 0x108]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x404c], ebx
jne 0x1400094a6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14001d9d0
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400094b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x140069d30]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x14000ceb0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140079da0]
mov ebp, edx
mov r10, rcx
mov r9d, dword [rdi + 0x4a00]
mov rbx, qword [rdi + 0x4000]
bts r9d, 8
mov dword [rdi + 0x4a00], r9d
mov dword [rdi + 0x4a38], 1
cmp qword [rbx + 0x1b8], 0
jne 0x14000cf27
cmp qword [rdi + 0x4e18], 0
mov eax, 0x260
je 0x14000cf2c
mov eax, 0x230
movss xmm2, dword [rbx + rax]
lea rcx, [rsp + 0x30]
movss xmm3, dword [rbx + rax + 4]
subss xmm3, dword [rbx + 0x114]
subss xmm2, dword [rbx + 0x110]
mov rdx, qword [r8]
call fcn.140016550
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
or r9d, 2
movsd qword [rdi + 0x4a20], xmm0
xor edx, edx
mov dword [rdi + 0x4a00], r9d
mov dword [rdi + 0x4a08], 1
mov r9, qword [rbx + 8]
test r10, r10
je 0x14000cf9e
mov dword [rsp + 0x28], ebp
lea r8, str._s__s__08X
mov qword [rsp + 0x20], r10
call fcn.140005cb0
jmp 0x14000cfae
lea r8, str._s__08X
mov dword [rsp + 0x20], ebp
call fcn.140005cb0
mov rcx, qword [rsp + 0x30]
xor edx, edx
movss xmm6, dword [rdi + 0x3918]
mov r8d, 0x1000107
call fcn.140010110
mov rsi, qword [rdi + 0x4000]
movzx r14d, al
movss dword [rdi + 0x3918], xmm6
cmp word [rsi + 0xcc], 1
mov dword [rsi + 0x88], ebp
jne 0x14000cff8
movsd xmm0, qword [rsi + 0x28]
movsd qword [rbx + 0x110], xmm0
mov r9d, ebp
lea rdx, [0x140068801]
not r9d
lea r10, [0x140069d30]
mov ebx, r9d
mov r8b, 0x23
cmp r8b, 0x23
jne 0x14000d025
cmp byte [rdx], r8b
jne 0x14000d025
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14000d012
not ebx
cmp dword [rdi + 0x4064], ebx
jne 0x14000d055
xor edx, edx
xor ecx, ecx
call fcn.140009670
cmp dword [rdi + 0x4b38], ebp
jne 0x14000d09a
cmp word [rsi + 0x16c], 0
jne 0x14000d070
cmp byte [rsi + 0x172], 0
je 0x14000d09a
xor edx, edx
mov rcx, rsi
call fcn.1400128b0
xor edx, edx
mov rcx, rsi
call fcn.140019350
mov rdx, rsi
mov ecx, ebx
call fcn.140009670
mov eax, dword [rdi + 0x4b64]
mov dword [rdi + 0x4090], eax
movzx eax, r14b
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140065230
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x1400172f0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140079010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140079da0]
mov edi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x140017351
cmp byte [rbx + 0x4d4e], 0
jne 0x140017351
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140005c60
test dil, 2
je 0x14001747f
jmp 0x1400173da
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5eb8]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x14006ff64]
mulss xmm1, dword [0x14006ff54]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
mov qword [rbx + 0x4a18], rax
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a10], xmm0
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mulss xmm0, dword [0x14006feac]
or dword [rbx + 0x4a00], 0x41
movss dword [rbx + 0x4a60], xmm0
call fcn.140005c60
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140017430
lea r11, [0x140069d30]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140017413
cmp byte [r8], r9b
jne 0x140017413
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140017400
not ecx
call fcn.14000d3b0
test rax, rax
je 0x14001747f
cmp byte [rax + 0xbe], 0
je 0x14001747f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.140005c60
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.140010110
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140065230
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140046d10
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x140046d9c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140046d70
lea r11, [0x140069d30]
nop
cmp r9b, 0x23
jne 0x140046d53
cmp byte [r8], r9b
jne 0x140046d53
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140046d40
mov rcx, qword [0x140079da0]
not eax
cmp dword [rcx + 0x4064], eax
jne 0x140046d87
mov dword [rcx + 0x4068], eax
cmp dword [rcx + 0x4094], eax
jne 0x140046df9
mov byte [rcx + 0x4098], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x140079da0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x4000]
movsxd rcx, dword [rbx + 0x100]
mov rax, qword [rbx + 0x108]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, rdi
call fcn.140005e20
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x404c], eax
jne 0x140046df2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.14001d9d0
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret