joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov eax, 0x3312695d
std
sti
lodsb al, byte [rsi]
imul edx, dword [rdx], 0xacfbfd33
mov edi, 0x55bd046d
xor bh, bl
xor al, 0x74
pop rbx
cwde
mov edx, 0xe87fa908
cmp ebx, edi
fist word [rcx + 0x50]
cmp byte [rcx - 0x3a], 0x9b
or esi, esi
idiv byte [rsi - 0x28]
idiv byte [rsi - 0x28]
cmp dword [rsp + rbx*4 - 0x4b], edi
or byte [rdx + 0x4d], bh
cmp bh, byte [0x14403bda2]
pop rax
mov bl, 0xd9
cld
push rsp
mov bl, 0x39
adc dword [rcx - 0x45afa1c2], esp
mov ecx, 0x523b2ee
leave
jg 0x1400232e2
ficomp word [0x13f6117ae]
jnp 0x14002326d
ror edi, cl
mov eax, 0xeb9ccd16
sbb cl, byte [rsp]
invalid
xor byte [rdx - 0x7d939366], ah
sbb ebx, dword [rcx - 0x211ecafc]
sbb al, 0xde
lea ebp, [rbx]
add bh, bh
mov edx, 0xe3b2b6fc
int 0x72
invalid
Function at 0x1800011a0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800011e2
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x18000120c
xor al, al
jmp 0x180001260
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x180001258
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x180001258
mov al, 1
jmp 0x180001260
xor al, al
jmp 0x180001260
add rsp, 0x68
ret

Function at 0x1800012f0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1800df780]
mov qword [rsp + 0x20], rax
jmp 0x180001310
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001335
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x180001302
add rsp, 0x38
ret
Function at 0x180001340
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1800df798], eax
je 0x18000135c
mov eax, 0x10dd
jmp 0x180001479
mov rax, qword [0x1800df7b0]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x180001402
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1800013d2
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1800013d2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.1800014f0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1800145d0
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x180001368
mov qword [0x1800df7b0], 0
call fcn.180001480
mov rax, qword [0x1800df7a8]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180001462
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1800145d0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x18000141e
mov qword [0x1800df7a8], 0
mov dword [0x1800df798], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180001bf0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x180001c0d
xor eax, eax
jmp 0x180001ca5
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x180001c47
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x180001ca0
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x180001c9e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x180001c9e
xor eax, eax
jmp 0x180001ca5
jmp 0x180001c3d
mov eax, 1
add rsp, 0x28
ret

Function at 0x180001d90
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x1800df79c], 0
je 0x180001dad
mov eax, dword [0x1800df79c]
jmp 0x180001e71
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp qword [rsp + 0x50], rax
jne 0x180001dc1
xor eax, eax
jmp 0x180001e71
mov ecx, 0x10
call fcn.18004bc30
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180001e2a
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180001e0f
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.1800145d0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x1800df79c], eax
mov qword [0x1800df7a0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180001e71
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x180001e46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
jmp 0x180001dea
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x1800df7a8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x1800df7a8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x1800029a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180002aa0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180002a98
cmp qword [rsp + 0x20], 0x50000000
jb 0x1800029f0
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1800029f0
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18006fd90
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002a1f
jmp 0x180002a98
cmp dword [rsp + 0x48], 0x10000
jne 0x180002a76
cmp qword [rsp + 0x40], 0x10000
jb 0x180002a76
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002a64
mov rax, qword [rsp + 0x58]
jmp 0x180002a9a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002a93
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180002aa0
mov qword [rsp + 0x20], rax
jmp 0x1800029bd
xor eax, eax
add rsp, 0x68
ret

Function at 0x180002af0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180002beb
cmp qword [rsp + 0x20], 0x50000000
jb 0x180002b48
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x180002b48
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x180002b16
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18006fd90
mov r8d, 0x30
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180002b77
jmp 0x180002beb
cmp dword [rsp + 0x48], 0x10000
jne 0x180002bce
cmp qword [rsp + 0x40], 0x10000
jb 0x180002bce
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x180002bbc
mov rax, qword [rsp + 0x58]
jmp 0x180002bed
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180002be6
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.180002c00
mov qword [rsp + 0x20], rax
jmp 0x180002b16
xor eax, eax
add rsp, 0x68
ret
Function at 0x180010e00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rbx, rcx
movabs rdx, 0xcbf29ce484222325
mov rax, qword [0x1800e0d28]
mov r8, qword [rax + 8]
movzx eax, byte [r8]
test al, al
je 0x180011047
movabs rcx, 0x100000001b3
nop word [rax + rax]
movsx rax, al
lea r8, [r8 + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8]
test al, al
jne 0x180010e50
movabs rax, 0x2ab3cf33ff5b8d12
cmp rdx, rax
jne 0x180011047
test rbx, rbx
je 0x180011047
mov rcx, rbx
call fcn.18000fe60
mov rdi, qword [rax]
test rdi, rdi
je 0x180011047
mov rcx, qword [0x1800e0c90]
add rcx, 0x40
mov r8d, 7
lea rdx, str.Chicken
call fcn.180011a40
mov rcx, rdi
call fcn.180010040
mov rdx, qword [0x1800e0c90]
mov ecx, dword [rax]
mov dword [rdx], ecx
mov ecx, dword [rax + 4]
mov dword [rdx + 4], ecx
mov eax, dword [rax + 8]
mov dword [rdx + 8], eax
mov r8, rbx
call fcn.180009c80
mov rcx, qword [0x1800e0c90]
mov byte [rcx + 0x38], al
mov r9, qword [0x1800e0c90]
movsd xmm1, qword [r9]
mov eax, dword [r9 + 8]
mov dword [rsp + 0x38], eax
movss dword [rsp + 0x20], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rsp + 0x30], xmm1
movss dword [rsp + 0x24], xmm0
movd xmm1, eax
addss xmm1, dword [0x1800837e4]
movss dword [rsp + 0x28], xmm1
xorps xmm6, xmm6
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x74], 0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
call fcn.180004f50
test eax, eax
je 0x180010fd0
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
call fcn.180004f50
test eax, eax
je 0x180010fd0
movss xmm4, dword [rsp + 0x74]
comiss xmm6, xmm4
ja 0x180010fd0
movss xmm0, dword [rsp + 0x6c]
mov rax, qword [0x1800e0b70]
comiss xmm0, dword [rax + 0x14]
ja 0x180010fd0
movaps xmm3, xmm4
subss xmm3, xmm0
andps xmm3, xmmword [0x180083cd0]
cvtps2pd xmm0, xmm3
mulsd xmm0, qword [0x180083758]
cvtpd2ps xmm2, xmm0
movaps xmm1, xmm2
mulss xmm1, dword [0x1800836f0]
movss xmm0, dword [rsp + 0x68]
subss xmm0, xmm1
shufps xmm0, xmm0, 0xe1
movss xmm0, xmm4
shufps xmm0, xmm0, 0xc6
movss xmm0, xmm2
shufps xmm0, xmm0, 0x27
movss xmm0, xmm3
shufps xmm0, xmm0, 0x39
jmp 0x180010fd3
xorps xmm0, xmm0
movups xmmword [r9 + 0xc], xmm0
mov rsi, qword [0x1800df410]
mov rdi, qword [rsi + 8]
cmp rdi, qword [rsi + 0x10]
je 0x180011035
mov qword [rsp + 0x68], rdi
mov rbx, qword [0x1800e0c90]
movsd xmm0, qword [rbx]
movsd qword [rdi], xmm0
mov eax, dword [rbx + 8]
mov dword [rdi + 8], eax
movups xmm0, xmmword [rbx + 0xc]
movups xmmword [rdi + 0xc], xmm0
lea rcx, [rdi + 0x20]
lea rdx, [rbx + 0x20]
call fcn.1800134d0
nop
movzx eax, byte [rbx + 0x38]
mov byte [rdi + 0x38], al
lea rcx, [rdi + 0x40]
lea rdx, [rbx + 0x40]
call fcn.18000ebc0
nop
add qword [rsi + 8], 0x60
jmp 0x180011047
mov r8, qword [0x1800e0c90]
mov rdx, rdi
mov rcx, rsi
call fcn.180012140
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x180011060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rax, qword [0x1800e0d28]
movabs rsi, 0xcbf29ce484222325
mov rdi, rcx
mov rdx, rsi
mov r8, qword [rax + 8]
movzx eax, byte [r8]
test al, al
je 0x1800112c0
mov qword [rsp + 0x40], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movsx rax, al
lea r8, [r8 + 1]
xor rdx, rax
movzx eax, byte [r8]
imul rdx, rbx
test al, al
jne 0x1800110b0
movabs rax, 0x5597d0d77a2af3ae
cmp rdx, rax
jne 0x1800112bb
test rdi, rdi
je 0x1800112bb
mov dword [rsp + 0x48], edi
call fcn.180009fa0
cmp byte [rax], 0
je 0x1800111e8
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call fcn.180011bd0
mov ecx, dword [0x1800dfd84]
mov edx, 4
mov rbx, qword [rax]
mov rax, qword gs:[0x58]
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1800e0abc], ecx
jle 0x18001118c
lea rcx, [0x1800e0abc]
call fcn.18004bbb8
cmp dword [0x1800e0abc], 0xffffffff
jne 0x18001118c
mov rcx, qword [0x1800df420]
mov rax, qword [0x1800df428]
cmp rcx, rax
je 0x180011178
movabs rdx, 0xdfdb76de21756f27
nop dword [rax]
cmp qword [rcx], rdx
je 0x18001116e
add rcx, 0x10
cmp rcx, rax
jne 0x180011160
cmp rcx, rax
je 0x180011178
mov ecx, dword [rcx + 8]
jmp 0x18001117a
xor ecx, ecx
mov dword [0x1800e0ad4], ecx
lea rcx, [0x1800e0abc]
call fcn.18004bb4c
mov ecx, dword [0x1800e0ad4]
mov eax, dword [rcx + rdi]
mov dword [rbx + 0x30], eax
mov eax, dword [rcx + rdi + 4]
mov dword [rbx + 0x34], eax
mov eax, dword [rcx + rdi + 8]
mov dword [rbx + 0x38], eax
cmp qword [rbx + 0x20], 0
mov qword [rbx + 0x28], rdi
jne 0x1800112bb
lea rcx, [rsp + 0x50]
call fcn.180009ec0
mov rcx, qword [rax]
mov qword [rbx + 0x20], rcx
mov ecx, dword [0x1800e0aa4]
mov dword [rbx + 0x18], ecx
mov rbx, qword [rsp + 0x40]
lea eax, [rcx + 1]
mov dword [0x1800e0aa4], eax
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
movzx eax, byte [rsp + 0x49]
mov r8d, dword [rsp + 0x48]
mov r9, qword [0x1800df578]
mov r10, qword [0x1800df568]
movzx edx, r8b
xor rdx, rsi
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rsp + 0x4a]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rsp + 0x4b]
imul rdx, rbx
xor rdx, rax
imul rdx, rbx
and rdx, qword [0x1800df590]
add rdx, rdx
mov r11, qword [r9 + rdx*8 + 8]
mov rcx, r11
cmp r11, r10
je 0x180011261
mov rax, qword [r9 + rdx*8]
cmp r8d, dword [r11 + 0x10]
je 0x180011263
nop dword [rax + rax]
cmp rcx, rax
je 0x180011261
mov rcx, qword [rcx + 8]
cmp r8d, dword [rcx + 0x10]
jne 0x180011250
jmp 0x180011263
xor ecx, ecx
test rcx, rcx
je 0x1800112bb
mov rax, qword [r9 + rdx*8]
cmp r11, rcx
jne 0x18001128c
cmp rax, rcx
jne 0x180011281
mov qword [r9 + rdx*8], r10
mov qword [r9 + rdx*8 + 8], r10
jmp 0x180011298
mov r10, qword [rcx + 8]
mov qword [r9 + rdx*8 + 8], r10
jmp 0x180011298
cmp rax, rcx
jne 0x180011298
mov rax, qword [rcx]
mov qword [r9 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [0x1800df570]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x40
call fcn.18004c0ac
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180011f80
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001212e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800df568]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800df578]
lea rdx, [rdi + rdi]
call fcn.180006330
mov rax, qword [0x1800df568]
lea r9, [rdi - 1]
mov qword [0x1800df590], r9
mov qword [0x1800df598], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180012123
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800df578]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001206f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800120e4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800120ac
mov r10, qword [rdx]
cmp r10, rax
je 0x1800120a6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800120e4
cmp r9, rdx
je 0x1800120c0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800120f8
cmp r9, rdx
jne 0x1800120b1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18001211e
mov r9, qword [0x1800df590]
jmp 0x180012020
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800120e4
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18004b9e0
int3
Function at 0x180014e00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180014e5d
lea rbx, [0x18007ebd0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180014e44
cmp r10, 2
jb 0x180014e44
cmp byte [r9], r8b
jne 0x180014e44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180014e20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180014e9f
lea rbx, [0x18007ebd0]
cmp r8b, 0x23
jne 0x180014e83
cmp byte [r9], r8b
jne 0x180014e83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180014e70
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180015080
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x18001509a
mov qword [r8], 0
lea rdx, [0x18007ea28]
call fcn.180014eb0
mov rbx, rax
test rax, rax
jne 0x1800150ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.180053398
mov esi, eax
cmp eax, 0xffffffff
je 0x18001518a
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.180053d80
test eax, eax
jne 0x18001518a
mov rcx, rbx
call fcn.180053398
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001518a
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.180053d80
test eax, eax
jne 0x18001518a
cmp rdi, 0xffffffffffffffff
je 0x18001518a
mov rax, qword [0x1800e0b70]
test rax, rax
je 0x18001512c
inc dword [rax + 0x3bc]
mov rcx, rdi
call fcn.18005bf58
mov rsi, rax
test rax, rax
je 0x18001518a
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1800569a8
mov rcx, rbx
cmp rax, rdi
je 0x180015178
call fcn.180053a78
mov rax, qword [0x1800e0b70]
test rax, rax
je 0x18001516e
dec dword [rax + 0x3bc]
mov rcx, rsi
call fcn.180056734
jmp 0x180015192
call fcn.180053a78
test r14, r14
je 0x180015185
mov qword [r14], rdi
mov rax, rsi
jmp 0x180015194
mov rcx, rbx
call fcn.180053a78
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x180016e50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 0xc8]
movss xmm0, dword [rdx]
subss xmm0, dword [rcx + 0x10]
movss xmm1, dword [rdx + 8]
subss xmm1, dword [rcx + 0x10]
cvttss2si r8d, xmm0
movss xmm0, dword [rdx + 4]
subss xmm0, dword [rcx + 0x14]
mov r10d, r8d
cvttss2si ebx, xmm1
cvttss2si r9d, xmm0
mov edi, ebx
movss xmm0, dword [rdx + 0xc]
subss xmm0, dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0xc0]
mov r11d, r9d
shr r11, 0x18
mov r14d, dword [rax + rcx*4 - 4]
not r14d
movzx eax, r8b
movzx ecx, r14b
lea r8, [0x18007ebd0]
xor rcx, rax
shr r14d, 8
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
shr r10, 0x18
cvttss2si esi, xmm0
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, r9b
mov ebp, esi
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor r10, rcx
xor r14d, dword [r8 + r10*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
xor rdx, rcx
movzx eax, bl
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
xor r11, rcx
shr r14d, 8
xor r14d, dword [r8 + r11*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, ebx
shr eax, 8
movzx edx, al
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
xor rdx, rcx
shr r14d, 8
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
mov eax, ebx
shr r14d, 8
shr eax, 0x10
movzx edx, al
xor rdx, rcx
movzx eax, sil
shr rdi, 0x18
shr rbp, 0x18
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rdi, rcx
xor r14d, dword [r8 + rdi*4]
movzx ecx, r14b
xor rcx, rax
shr r14d, 8
mov eax, esi
shr eax, 8
movzx edx, al
mov eax, esi
xor r14d, dword [r8 + rcx*4]
movzx ecx, r14b
shr r14d, 8
xor rdx, rcx
shr eax, 0x10
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
movzx edx, al
mov rax, qword [0x1800e0b70]
xor rdx, rcx
xor r14d, dword [r8 + rdx*4]
movzx ecx, r14b
shr r14d, 8
xor rbp, rcx
xor r14d, dword [r8 + rbp*4]
not r14d
cmp dword [rax + 0x1a60], r14d
jne 0x180017033
mov dword [rax + 0x1a64], r14d
cmp dword [rax + 0x1a9c], r14d
jne 0x180017043
mov byte [rax + 0x1aa0], 1
mov rbx, qword [rsp + 0x10]
mov eax, r14d
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret