joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180039800
Capabilities:
Set thread local storage value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rsi, rcx
and dword [rbp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsi + 0x90], eax
lea r14, [rsi + 0x10]
mov rcx, r14
call fcn.180031e54
mov rdi, qword [rsi + 0x48]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.180023a4c
lea rdx, [rbp + 0x30]
mov rcx, rdi
call rbx
nop
mov dword [rbp + 0x20], 1
mov edx, 9
mov rcx, rax
call fcn.180033ae4
test eax, eax
jne 0x180039881
call fcn.180027f50
cmp eax, 6
jne 0x180039881
mov dil, 1
jmp 0x180039884
xor dil, dil
lea rcx, [rbp + 0x30]
call fcn.180033ab0
test dil, dil
je 0x18003989c
mov ecx, 1
call fcn.1800367b0
mov rcx, r14
call fcn.180019ff0
and dword [rsi + 0x120], 0
xor bl, bl
mov rcx, rsi
call fcn.180039a28
test al, al
je 0x1800398cb
mov rcx, rsi
call fcn.180039f28
mov bl, al
test al, al
jne 0x180039986
and dword [rbp - 0x38], 0
and qword [rbp - 0x28], 0
and byte [rsi + 0x127], 0xfd
mov rcx, qword [rsi + 0x108]
test rcx, rcx
je 0x1800399ac
cmp byte [rsi + 0x126], 0
jne 0x18003991d
mov rcx, qword [rsi + 0x108]
call fcn.1800381bc
test al, al
je 0x18003991d
mov rcx, r14
call fcn.180019ff0
mov rcx, qword [rsi + 0x48]
call fcn.18002b938
mov rcx, r14
call fcn.180019ff0
lea rdx, [rbp - 0x38]
mov rcx, rsi
call fcn.18003ab74
mov rcx, rsi
test al, al
je 0x180039959
cmp dword [rbp - 0x38], 1
jne 0x180039944
xor r8d, r8d
mov rdx, qword [rbp - 0x28]
call fcn.18003a6c8
jmp 0x18003997c
lea rdx, [rbp - 0x38]
call fcn.1800399d0
mov rcx, rsi
call fcn.180039f28
mov bl, al
jmp 0x18003997e
call fcn.180039f28
test al, al
jne 0x18003997c
mov rcx, rsi
call fcn.18003aa14
mov al, byte [rsi + 0x124]
test al, al
je 0x18003997e
mov rcx, rsi
call fcn.1800397d8
mov bl, 1
test bl, bl
je 0x1800398cb
test dil, dil
je 0x180039990
call fcn.1800367e8
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
jmp fcn.180031494
mov rcx, r14
call fcn.180019ff0
lea rcx, [rbp - 0x20]
call fcn.180025880
lea rdx, [0x180093fb8]
lea rcx, [rbp - 0x20]
call fcn.1800422c0
int3
Function at 0x180042e94
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x18007a438]
xor ecx, ecx
lea r8, [0x18007a430]
lea rdx, [0x180075828]
call fcn.180042cbc
mov rbx, rax
test rax, rax
je 0x180042ed4
mov rcx, rax
call fcn.180023a4c
mov rcx, rdi
call rbx
jmp 0x180042eda
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180042f3c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18007a448]
mov ecx, 2
lea r8, [0x18007a440]
lea rdx, str.FlsGetValue
call fcn.180042cbc
mov rdi, rax
test rax, rax
je 0x180042f7d
mov rcx, rax
call fcn.180023a4c
mov ecx, ebx
call rdi
jmp 0x180042f85
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180042f90
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x18007a450]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x18007a448]
call fcn.180042cbc
mov rsi, rax
test rax, rax
je 0x180042fdc
mov rcx, rax
call fcn.180023a4c
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x180042fe7
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18004ccb8
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18004ccd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180048184
or eax, 0xffffffff
jmp 0x18004ccda
xor eax, eax
add rsp, 0x28
ret
jmp 0x18004ccb8

Function at 0x18004cce0
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18004ccd8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180048184
or eax, 0xffffffff
jmp 0x18004ccda
xor eax, eax
add rsp, 0x28
ret
jmp 0x18004ccb8
Function at 0x18005c168
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x18005bfce
call fcn.1800481f4
mov dword [rax], 0x16
call fcn.1800452cc
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18005bfb0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x18005bfb0
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x18005c000
lock or dword [rax + 0x14], 0x10
jmp 0x18005bfb0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x18005c01d
mov rcx, qword [rbp + 0x20]
call fcn.18006406c
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x18005c032
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x18005c038
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.180059948
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.18005b854
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x18005c08b
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x18005bfb0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18005c0f7
mov rcx, qword [rbp + 0x20]
call fcn.180059948
cmp eax, 0xffffffff
je 0x18005c0de
mov rcx, qword [rbp + 0x20]
call fcn.180059948
cmp eax, 0xfffffffe
je 0x18005c0de
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.180059948
movsxd rdi, eax
lea r15, [0x18009aae0]
mov rcx, rbx
sar rdi, 6
call fcn.180059948
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x18005c0e5
lea rax, [0x180096580]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18005c0f7
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x18005c12d
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x18005c129
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x18005c129
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x18005c14b
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x18005c156
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x18005bfb5
jmp 0x18005bf7c
Function at 0x18005e4f0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x18005be1c
call fcn.1800481f4
mov dword [rax], 0x16
call fcn.1800452cc
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x18005be04
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x18005be04
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x18005be4e
lock or dword [rax + 0x14], 0x10
jmp 0x18005be04
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x18005be6b
mov rcx, qword [rbp + 0x10]
call fcn.18006406c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180059948
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.18005b854
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x18005bec2
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x18005be04
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x18005bf2e
mov rcx, qword [rbp + 0x10]
call fcn.180059948
cmp eax, 0xffffffff
je 0x18005bf15
mov rcx, qword [rbp + 0x10]
call fcn.180059948
cmp eax, 0xfffffffe
je 0x18005bf15
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180059948
movsxd rdi, eax
lea rsi, [0x18009aae0]
mov rcx, rbx
sar rdi, 6
call fcn.180059948
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x18005bf1c
lea rax, [0x180096580]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x18005bf2e
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x18005bf64
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x18005bf60
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x18005bf60
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x18005be07
jmp 0x18005bdd4
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x18005e4cd
call fcn.1800481f4
mov dword [rax], 0x16
call fcn.1800452cc
or eax, 0xffffffff
jmp 0x18005e4ea
sub dword [rcx + 0x10], 1
jns 0x18005e4dc
add rsp, 0x28
jmp 0x18005c160
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x18005e4ac
Function at 0x140001d30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13e8
call fcn.140069540
sub rsp, rax
movaps xmmword [rsp + 0x13d0], xmm6
movaps xmmword [rsp + 0x13c0], xmm7
mov rax, qword [0x1400b0020]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
movaps xmm6, xmm1
movaps xmm7, xmm0
call fcn.140048ed8
mov edx, eax
mov ecx, 1
movabs rax, 0x5555555555555555
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x13a8], rax
movabs r8, 0x5851f42d4c957f2d
mov r9d, 0x138
nop dword [rax + rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x28], rdx
inc rcx
cmp rcx, r9
jb 0x140001da0
mov dword [rsp + 0x20], r9d
lea r8, [rsp + 0x30]
xorps xmm1, xmm1
movabs r10, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140001dd5
mov eax, dword [rsp + 0x20]
movabs rdx, 0x38eb3ffff6d3
xorps xmm0, xmm0
mov rcx, qword [rsp + rax*8 + 0x28]
mov rax, rcx
shr rax, 0x1d
and rax, qword [rsp + 0x13a8]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x140001e6a
cvtsi2ss xmm0, rdx
jmp 0x140001e7f
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
subss xmm0, xmm1
subss xmm6, xmm7
addss xmm0, xmm1
mulss xmm0, dword [0x1400a1af0]
mulss xmm0, xmm6
addss xmm0, xmm7
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140049f10
movaps xmm6, xmmword [rsp + 0x13d0]
movaps xmm7, xmmword [rsp + 0x13c0]
add rsp, 0x13e8
ret

Function at 0x1400039e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140003a3d
lea rbx, [0x140079fb0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003a24
cmp r10, 2
jb 0x140003a24
cmp byte [r9], r8b
jne 0x140003a24
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003a00
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140003a7f
lea rbx, [0x140079fb0]
cmp r8b, 0x23
jne 0x140003a63
cmp byte [r9], r8b
jne 0x140003a63
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003a50
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140003bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140003bda
mov qword [r8], 0
lea rdx, [0x1400a08dc]
call fcn.140003a90
mov rbx, rax
test rax, rax
jne 0x140003bfa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400511bc
mov esi, eax
cmp eax, 0xffffffff
je 0x140003cc8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.140051cb4
test eax, eax
jne 0x140003cc8
mov rcx, rbx
call fcn.1400511bc
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140003cc8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140051cb4
test eax, eax
jne 0x140003cc8
cmp rdi, 0xffffffffffffffff
je 0x140003cc8
mov rax, qword [0x1400b2718]
test rax, rax
je 0x140003c6a
inc dword [rax + 0xec]
mov rcx, rdi
call fcn.140059fc0
mov rsi, rax
test rax, rax
je 0x140003cc8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.140054954
mov rcx, rbx
cmp rax, rdi
je 0x140003cb6
call fcn.1400519ac
mov rax, qword [0x1400b2718]
test rax, rax
je 0x140003cac
dec dword [rax + 0xec]
mov rcx, rsi
call fcn.1400546e0
jmp 0x140003cd0
call fcn.1400519ac
test r14, r14
je 0x140003cc3
mov qword [r14], rdi
mov rax, rsi
jmp 0x140003cd2
mov rcx, rbx
call fcn.1400519ac
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400065c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xc8]
mov rax, qword [rcx + 0xd0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140079fb0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
mov rax, qword [0x1400b2718]
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rax + 0x3e74], ebx
jne 0x14000664d
mov dword [rax + 0x3e78], ebx
cmp dword [rax + 0x3ec0], ebx
jne 0x14000665c
mov byte [rax + 0x3ec4], 1
cmp dword [rax + 0x3e5c], ebx
jne 0x140006673
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.1400185a0
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x1400109a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1400b2718]
lea r10, [0x140079fb0]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3e28]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3e5c], edi
jne 0x140010a45
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.1400185a0
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x140010a79
inc r8d
test ecx, ecx
je 0x140010a62
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140010a67
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.140019530
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400124e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b0020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400b2718]
mov edi, ecx
cmp byte [rbx + 0x41cd], 0
jne 0x140012541
cmp byte [rbx + 0x41ce], 0
jne 0x140012541
movsx r9d, word [rbx + 0x52ae]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003960
test dil, 1
je 0x140012668
jmp 0x1400125ca
movss xmm1, dword [rbx + 0x3830]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x52ae]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400a1c1c]
mulss xmm1, dword [0x1400a1bfc]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f48], rax
mov dword [rbx + 0x3f34], 1
movss dword [rbx + 0x3f40], xmm0
movss dword [rbx + 0x3f44], xmm1
movss xmm0, dword [rbx + 0x388c]
mulss xmm0, dword [0x1400a1b40]
or dword [rbx + 0x3f30], 0x41
movss dword [rbx + 0x3f90], xmm0
call fcn.140003960
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140012620
lea r11, [0x140079fb0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140012603
cmp byte [r8], r9b
jne 0x140012603
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400125f0
not ecx
call fcn.14000b570
test rax, rax
je 0x140012668
cmp byte [rax + 0x8e], 0
je 0x140012668
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52ae]
mov edx, 0x10
movsx r9d, word [rbx + 0x52ae]
call fcn.140003960
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000dcf0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140049f10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400398e0
Capabilities:
Hash data with crc32

Disassembly:
test dword [rcx + 0x10], 0x100000
je 0x14003995d
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140039936
lea r11, [0x140079fb0]
cmp r9b, 0x23
jne 0x140039919
cmp byte [r8], r9b
jne 0x140039919
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140039906
mov rcx, qword [0x1400b2718]
not eax
cmp dword [rcx + 0x3e74], eax
jne 0x14003994d
mov dword [rcx + 0x3e78], eax
cmp dword [rcx + 0x3ec0], eax
jne 0x140039970
mov byte [rcx + 0x3ec4], 1
ret
mov rax, qword [0x1400b2718]
mov rcx, qword [rax + 0x3e28]
jmp fcn.140006540
ret

Function at 0x14003e870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400b0020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14003e8b6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14003e8a6
cmp byte [rax], cl
jne 0x14003e8b6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14003e897
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14003ea19
cmp byte [r8 + 1], dl
je 0x14003ea19
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003e8f2
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14003e91a
sub dl, 0x61
cmp dl, 0x19
ja 0x14003e90c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14003e91a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14003e8d5
jmp 0x14003e91d
inc r9
cmp r8, r9
jae 0x14003e94f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14003e944
bt rdx, rax
jb 0x14003e94a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14003e930
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140003960
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14003e988
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14003e980
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14003ea08
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003e9a3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14003e9b9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14003e9f6
movss xmm2, dword [0x1400a1c04]
cmp al, 0x39
ja 0x14003e9f6
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14003e9d0
cmp r9b, 0x2d
jne 0x14003ea14
xorps xmm1, xmmword [0x1400a1e40]
movaps xmm0, xmm1
jmp 0x14003ea1c
call fcn.14005a9dc
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003ea1c
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140049f10
add rsp, 0x90
pop rbx
ret
Function at 0x14003ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1400b0020]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x14003ea86
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x14003ea76
cmp byte [rax], cl
jne 0x14003ea86
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x14003ea67
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14003ebe3
cmp byte [r8 + 1], dl
je 0x14003ebe3
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14003eac2
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14003eaea
sub dl, 0x61
cmp dl, 0x19
ja 0x14003eadc
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14003eaea
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14003eaa5
jmp 0x14003eaed
inc r9
cmp r8, r9
jae 0x14003eb1f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14003eb14
bt rdx, rax
jb 0x14003eb1a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14003eb00
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140003960
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14003eb58
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14003eb50
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14003ebd6
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14003eb73
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14003eb89
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14003ebc4
movsd xmm2, qword [0x1400a1bb8]
cmp al, 0x39
ja 0x14003ebc4
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14003eba0
cmp r9b, 0x2d
jne 0x14003ebde
xorps xmm1, xmmword [0x1400a1e30]
movaps xmm0, xmm1
jmp 0x14003ebe6
call fcn.14005a9dc
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14003ebe6
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140049f10
add rsp, 0x90
pop rbx
ret