joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x180007e83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x180007e70
mov byte [rcx + 8], 0
ret

Function at 0x180007e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x180007eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x180007ea0
mov byte [rcx + 0x17], 0
ret

Function at 0x180007ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x180007ee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x180007ed0
mov byte [rcx + 7], 0
ret

Function at 0x180007ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x180007f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x180007f00
mov byte [rcx + 0x16], 0
ret

Function at 0x180007f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x180007f43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x180007f30
mov byte [rcx + 0xe], 0
ret

Function at 0x180007f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180007f73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x180007f60
mov byte [rcx + 0x11], 0
ret

Function at 0x180007f80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180007fa3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x180007f90
mov byte [rcx + 0xc], 0
ret

Function at 0x180007fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x180007fd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x180007fc0
mov byte [rcx + 0xa], 0
ret

Function at 0x180008020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x180008043
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x180008030
mov byte [rcx + 3], 0
ret

Function at 0x180008050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x180008073
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xe]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x180008060
mov byte [rcx + 5], 0
ret
Function at 0x180009250
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [0x1801f6260]
mov rsi, rcx
test rax, rax
jne 0x180009334
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180009307
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180009307
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180009302
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800092e0
cmp r8d, 0x558c274d
je 0x18000930c
test r9d, r9d
jne 0x1800092c0
mov rax, qword [rax]
jmp 0x180009290
mov ecx, dword [rbx + 0x24]
mov rdi, qword [rsp + 0x38]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1801f6260], rax
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp rax

Function at 0x180009340
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [0x1801f6258]
mov rsi, rcx
test rax, rax
jne 0x180009424
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800093f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800093f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800093f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800093d0
cmp r8d, 0x99b3eedb
je 0x1800093fc
test r9d, r9d
jne 0x1800093b0
mov rax, qword [rax]
jmp 0x180009380
mov ecx, dword [rbx + 0x24]
mov rdi, qword [rsp + 0x38]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov qword [0x1801f6258], rax
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp rax
Function at 0x1800099a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1800099fd
lea rbx, [0x1801e5fa0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1800099e4
cmp r10, 2
jb 0x1800099e4
cmp byte [r9], r8b
jne 0x1800099e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1800099c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180009a3f
lea rbx, [0x1801e5fa0]
cmp r8b, 0x23
jne 0x180009a23
cmp byte [r9], r8b
jne 0x180009a23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180009a10
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x18000ba80
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [0x1801f6110]
mov rdx, qword [rcx + 0x1a50]
test rdx, rdx
je 0x18000bc55
mov r8d, dword [rcx + 0x1a80]
mov dword [rcx + 0x1a84], r8d
cmp dword [rcx + 0x1ab4], r8d
jne 0x18000bab5
mov byte [rcx + 0x1ab8], 1
cmp byte [rcx + 0x138], 0
mov rdx, qword [rdx + 0x360]
je 0x18000bc2c
lea rax, [rcx + 0x130]
mov r9, rax
test rax, rax
jne 0x18000badf
lea r9, [rcx + 0x130]
movss xmm0, dword [r9]
movss xmm1, dword [0x1801eb130]
comiss xmm0, xmm1
movss xmm2, dword [r9 + 4]
jb 0x18000bc2c
comiss xmm2, xmm1
jb 0x18000bc2c
movss xmm2, dword [rax]
subss xmm2, dword [rcx + 0x1a9c]
movss xmm0, dword [rdx + 0x10]
movss xmm3, dword [rax + 4]
subss xmm3, dword [rcx + 0x1aa0]
ucomiss xmm0, xmm2
jp 0x18000bb39
jne 0x18000bb39
movss xmm0, dword [rdx + 0x14]
ucomiss xmm0, xmm3
jp 0x18000bb39
je 0x18000bc20
test dword [rdx + 0xc], 0x100
jne 0x18000bb57
xorps xmm0, xmm0
comiss xmm0, dword [rcx + 0x2f08]
jb 0x18000bb57
mov eax, dword [rcx + 0x1c]
mov dword [rcx + 0x2f08], eax
mov eax, dword [rdx + 0xa4]
test al, 1
je 0x18000bc20
movss xmm0, dword [rdx + 0x10]
and eax, 0xfffffff1
movss xmm1, dword [rdx + 0x14]
mov dword [rdx + 0xa4], eax
mov dword [rdx + 0xb0], 0x7f7fffff
mov dword [rdx + 0xb4], 0x7f7fffff
cvttss2si eax, xmm2
movd xmm2, eax
cvtdq2ps xmm2, xmm2
cvttss2si eax, xmm3
movss dword [rdx + 0x10], xmm2
subss xmm2, xmm0
movd xmm3, eax
cvtdq2ps xmm3, xmm3
movaps xmm0, xmm2
movss dword [rdx + 0x14], xmm3
subss xmm3, xmm1
addss xmm0, dword [rdx + 0xd0]
movaps xmm1, xmm3
addss xmm1, dword [rdx + 0xd4]
movss dword [rdx + 0xd0], xmm0
movaps xmm0, xmm2
addss xmm0, dword [rdx + 0xe8]
addss xmm2, dword [rdx + 0xe0]
movss dword [rdx + 0xd4], xmm1
movaps xmm1, xmm3
addss xmm1, dword [rdx + 0xec]
addss xmm3, dword [rdx + 0xe4]
movss dword [rdx + 0xe8], xmm0
movss dword [rdx + 0xe0], xmm2
movss dword [rdx + 0xec], xmm1
movss dword [rdx + 0xe4], xmm3
mov rcx, qword [rcx + 0x1a50]
jmp fcn.180013430
test r8d, r8d
setne al
mov byte [rcx + 0x1a8c], al
xor eax, eax
test r8d, r8d
je 0x18000bc4c
mov dword [rcx + 0x1a88], eax
mov word [rcx + 0x1a8e], ax
mov qword [rcx + 0x1a50], rax
jmp 0x18000bca8
mov rax, qword [rcx + 0x1aa8]
test rax, rax
je 0x18000bcc8
mov edx, dword [rcx + 0x1a80]
cmp dword [rax + 0x4c], edx
jne 0x18000bcc8
mov dword [rcx + 0x1a84], edx
cmp dword [rcx + 0x1ab4], edx
jne 0x18000bc81
mov byte [rcx + 0x1ab8], 1
cmp byte [rcx + 0x138], 0
jne 0x18000bcc8
test edx, edx
setne al
mov byte [rcx + 0x1a8c], al
xor eax, eax
test edx, edx
je 0x18000bca8
mov dword [rcx + 0x1a88], eax
mov word [rcx + 0x1a8e], ax
mov byte [rcx + 0x1a90], al
mov qword [rcx + 0x1aa8], rax
mov byte [rcx + 0x1a8d], al
mov qword [rcx + 0x1a94], rax
mov dword [rcx + 0x1a80], eax
ret
Function at 0x18000d650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov r8, qword [0x1801f6110]
xor ebx, ebx
mov dword [r8 + 0x2f78], ebx
cmp byte [r8 + 0x2f74], bl
je 0x18000d7e2
mov dword [r8 + 0x1ea8], 7
mov ecx, dword [r8 + 0x74]
mov qword [rsp + 0x70], rdi
mov edi, dword [r8 + 0x1a74]
test ecx, ecx
js 0x18000d6a9
call fcn.18000e490
test al, al
je 0x18000d6a9
mov byte [r8 + 0x2f74], bl
movss xmm1, dword [r8 + 0x444]
xorps xmm0, xmm0
ucomiss xmm1, xmm0
jp 0x18000d6ce
jne 0x18000d6ce
test edi, edi
je 0x18000d6ce
mov dword [r8 + 0x2f78], edi
mov byte [r8 + 0x2f74], bl
or dword [r8 + 0x1ad0], 0x40
mov dword [r8 + 0x1b28], 0x3f19999a
call fcn.180013e10
movdqa xmm0, xmmword [str.F_ft_vp_r_8_b___Beqgs_aa]
mov rcx, rbx
movdqu xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], 0x46
mov byte [rbp - 0x2e], 1
lea eax, [rcx + 0xe]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x11
jb 0x18000d700
mov edx, edi
mov byte [rbp - 0x2e], bl
lea rcx, [rbp - 0x40]
call fcn.180028f30
movdqa xmm0, xmmword [0x1801eb220]
mov rcx, rbx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x26752021
mov dword [rbp - 0x2c], 0x33323b3e
mov dword [rbp - 0x28], 0x733b35
mov byte [rbp - 0x24], 1
nop word [rax + rax]
lea eax, [rcx + 0x43]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0x1b
jb 0x18000d750
lea rcx, [rbp - 0x40]
mov byte [rbp - 0x24], bl
call fcn.180028f30
movdqa xmm0, xmmword [0x1801eb210]
mov rcx, rbx
movdqu xmmword [rbp - 0x23], xmm0
mov dword [rbp - 0x13], 0x3331743d
mov dword [rbp - 0xf], 0x3d3e2d35
mov dword [rbp - 0xb], 0x7c2e3e
mov byte [rbp - 7], 1
nop word [rax + rax]
lea eax, [rcx + 0x43]
xor byte [rbp + rcx - 0x23], al
inc rcx
cmp rcx, 0x1b
jb 0x18000d7a0
mov rcx, qword [0x1801f6110]
lea rdx, [rbp - 0x23]
mov eax, 0x10
mov byte [rbp - 7], bl
test edi, edi
cmove rbx, rax
add rcx, 0x1618
add rcx, rbx
call fcn.180029030
call fcn.180013030
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x18000d7f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
xor edx, edx
mov dword [rbp + 0x10], 0x757e6659
mov dword [rbp - 0x24], edx
mov r8d, edx
mov qword [rbp - 8], rdx
mov rbx, rcx
mov dword [rbp + 0x14], 0x100647d
nop
lea eax, [r8 + 0xe]
xor byte [rbp + r8 + 0x10], al
inc r8
cmp r8, 6
jb 0x18000d820
lea rax, [rbp + 0x10]
mov dword [rbp + 0x10], 0x757e6659
mov qword [rbp - 0x30], rax
mov dword [rbp + 0x14], 0x100647d
nop dword [rax + rax]
lea eax, [rdx + 0xe]
xor byte [rbp + rdx + 0x10], al
inc rdx
cmp rdx, 6
jb 0x18000d850
movzx r9d, byte [rbp + 0x10]
lea r8, [rbp + 0x11]
mov byte [rbp + 0x17], 0
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x18000d8b2
lea r11, [0x1801e5fa0]
cmp r9b, 0x23
jne 0x18000d895
cmp byte [r8], r9b
jne 0x18000d895
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x18000d882
mov ecx, dword [rbx + 0x2f24]
lea rax, [0x180017e60]
mov edi, dword [rbx + 0x2f20]
not edx
mov qword [rbp - 0x20], rax
lea rax, [0x180017f30]
mov qword [rbp - 0x18], rax
lea rax, [0x180018080]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x28], edx
cmp edi, ecx
jne 0x18000d99f
inc edi
test ecx, ecx
je 0x18000d8fd
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18000d902
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x18000d99f
mov rax, qword [0x1801f6110]
mov qword [rsp + 0x68], rsi
test rax, rax
je 0x18000d926
inc dword [rax + 0x3c0]
mov rdx, qword [0x1801f6108]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call fcn.180009250
mov rdx, qword [rbx + 0x2f28]
mov rsi, rax
test rdx, rdx
je 0x18000d98d
movsxd rcx, dword [rbx + 0x2f20]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.180036d80
mov rcx, qword [rbx + 0x2f28]
test rcx, rcx
je 0x18000d981
mov rax, qword [0x1801f6110]
test rax, rax
je 0x18000d981
dec dword [rax + 0x3c0]
mov rdx, qword [0x1801f6108]
call fcn.180009340
mov qword [rbx + 0x2f28], rsi
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2f24], edi
movsxd rax, dword [rbx + 0x2f20]
movups xmm0, xmmword [rbp - 0x30]
mov rdi, qword [rsp + 0x78]
movups xmm1, xmmword [rbp - 0x20]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f28]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f20]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x18000e530
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x18000e580
lea r11, [0x1801e5fa0]
nop dword [rax]
cmp r9b, 0x23
jne 0x18000e563
cmp byte [r8], r9b
jne 0x18000e563
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x18000e550
mov rcx, qword [0x1801f6110]
not eax
movsxd rdx, dword [rcx + 0x1a20]
mov r9, qword [rcx + 0x1a28]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x18000e5e1
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x18000e5d9
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x18000e5dc
mov rdx, r8
test rdx, rdx
jne 0x18000e5b0
cmp r9, r10
je 0x18000e5f0
cmp dword [r9], eax
jne 0x18000e5f0
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x180013280
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov r14, qword [0x1801f6110]
mov rbp, rcx
movsxd r8, dword [r14 + 0x19e0]
mov r9, qword [r14 + 0x19e8]
mov rdx, qword [r9 + r8*8 - 8]
cmp rdx, rcx
je 0x18001341a
cmp qword [rdx + 0x360], rcx
je 0x18001341a
mov qword [rsp + 0x40], rdi
lea edi, [r8 - 2]
test edi, edi
js 0x180013415
movsxd rax, edi
lea rcx, [r9 + rax*8]
cmp qword [rcx], rbp
je 0x1800132f8
dec edi
sub rcx, 8
sub rax, 1
jns 0x1800132d6
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov r11, qword [0x1801f6250]
test r11, r11
jne 0x1800133d5
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800133a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800133a7
mov esi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800133a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180013380
cmp r8d, 0x1081b8b
je 0x1800133ac
test r9d, r9d
jne 0x180013360
mov rax, qword [rax]
jmp 0x180013330
mov ecx, dword [rbx + 0x24]
mov rsi, qword [rsp + 0x38]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
mov rbx, qword [rsp + 0x30]
add rcx, r10
mov r11d, dword [rcx + rdx*4]
add r11, r10
mov qword [0x1801f6250], r11
mov r10, qword [r14 + 0x19e8]
mov eax, dword [r14 + 0x19e0]
sub eax, edi
movsxd r9, edi
dec eax
movsxd r8, eax
lea eax, [rdi + 1]
movsxd rcx, eax
shl r8, 3
lea rdx, [r10 + rcx*8]
lea rcx, [r10 + r9*8]
call r11
movsxd rcx, dword [r14 + 0x19e0]
mov rax, qword [r14 + 0x19e8]
mov qword [rax + rcx*8 - 8], rbp
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180013e10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1801f6110]
xor ecx, ecx
cmp byte [rax + 0x1ead], cl
je 0x180013e9b
movss xmm1, dword [rax + 0x160c]
mov dl, 1
movaps xmm0, xmm1
mulss xmm1, dword [0x1801eb084]
mulss xmm0, dword [0x1801eb0a4]
addss xmm1, dword [rax + 0x134]
addss xmm0, dword [rax + 0x130]
mov qword [rax + 0x1ae8], rcx
mov dword [rax + 0x1ad4], 1
movss dword [rax + 0x1ae4], xmm1
movss dword [rax + 0x1ae0], xmm0
movss xmm0, dword [rax + 0x1664]
mulss xmm0, dword [0x1801eafd0]
or dword [rax + 0x1ad0], 0x41
movss dword [rax + 0x1b28], xmm0
add rsp, 0x48
jmp fcn.180013ef0
mov dword [rsp + 0x20], 0x62712c2d
mov dword [rsp + 0x24], 0x677576
mov byte [rsp + 0x28], 1
lea eax, [rcx + 0xe]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 7
jb 0x180013eb0
lea r8, [rsp + 0x20]
mov byte [rsp + 0x28], 0
mov edx, 0x10
lea rcx, [rsp + 0x30]
call fcn.180009920
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x20c0347
call fcn.180010b50
add rsp, 0x48
ret

Function at 0x180013ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp - 0x20], 0x62712c2d
mov ecx, ebx
mov dword [rbp - 0x1c], 0x677576
movzx edi, dl
mov byte [rbp - 0x18], 1
nop dword [rax + rax]
lea eax, [rcx + 0xe]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 7
jb 0x180013f20
lea r8, [rbp - 0x20]
mov byte [rbp - 0x18], bl
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.180009920
test dil, dil
je 0x180013fa6
lea rcx, [rbp - 0x10]
call fcn.18000e530
test rax, rax
je 0x180013fa6
cmp byte [rax + 0x7e], bl
je 0x180013fa6
mov byte [rax + 0x85], 1
mov dword [rax + 0x9c], 1
mov dword [rbp + 0x20], 0x62712c2d
mov dword [rbp + 0x24], 0x1007576
nop dword [rax]
lea eax, [rbx + 0xe]
xor byte [rbp + rbx + 0x20], al
inc rbx
cmp rbx, 6
jb 0x180013f80
lea r8, [rbp + 0x20]
mov byte [rbp + 0x27], 0
mov edx, 0x10
lea rcx, [rbp - 0x10]
call fcn.180009920
xor edx, edx
lea rcx, [rbp - 0x10]
mov r8d, 0x20c0347
call fcn.180010b50
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x180017a10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, qword [0x1801f6110]
mov rbx, r8
mov r13, rdx
mov r8, rcx
mov r9, qword [r14 + 0x1a38]
test rbx, rbx
jne 0x180017a6d
mov rbx, rdx
cmp rdx, 0xffffffffffffffff
jae 0x180017a6d
nop
movzx ecx, byte [rbx]
test cl, cl
je 0x180017a6d
lea rax, [rbx + 1]
cmp cl, 0x23
jne 0x180017a64
cmp byte [rax], cl
je 0x180017a6d
mov rbx, rax
cmp rax, 0xffffffffffffffff
jb 0x180017a50
mov qword [rsp + 0x88], r15
lea rax, [r8 + 4]
lea rcx, [r14 + 0x2f60]
test r8, r8
je 0x180017a9f
movss xmm1, dword [rcx]
addss xmm1, dword [0x1801eaff8]
movss xmm0, dword [rax]
comiss xmm0, xmm1
jbe 0x180017a9f
mov r15b, 1
jmp 0x180017aa7
xor r15b, r15b
test r8, r8
je 0x180017ab8
mov eax, dword [rax]
mov dword [rcx], eax
test r15b, r15b
je 0x180017ab8
mov byte [r14 + 0x2f64], 1
mov ecx, dword [r14 + 0x2f68]
mov rdi, r13
mov eax, dword [r9 + 0x108]
cmp ecx, eax
jle 0x180017ad6
mov dword [r14 + 0x2f68], eax
mov ecx, eax
mov r12d, dword [r9 + 0x108]
sub r12d, ecx
mov r8, rbx
mov edx, 0xa
sub r8, rdi
mov rcx, rdi
call fcn.18004e110
test rax, rax
mov rsi, rbx
cmovne rsi, rax
cmp rsi, rbx
jne 0x180017b0b
cmp rdi, rsi
je 0x180017bfb
mov r9d, esi
sub r9d, edi
test r15b, r15b
jne 0x180017b95
cmp rdi, r13
jne 0x180017b95
xor ecx, ecx
cmp byte [r14 + 0x2f64], cl
je 0x180017b5a
mov dword [rbp - 0x20], 0x3463252b
mov dword [rbp - 0x1c], 0x67393c
mov byte [rbp - 0x18], 1
nop dword [rax]
lea eax, [rcx + 0xe]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 7
jb 0x180017b40
mov byte [rbp - 0x18], 0
lea rcx, [rbp - 0x20]
jmp 0x180017bc8
mov dword [rbp + 0x30], 0x3b3e2a2e
mov word [rbp + 0x34], 0x61
mov byte [rbp + 0x36], 1
nop dword [rax + rax]
lea eax, [rcx + 0xe]
xor byte [rbp + rcx + 0x30], al
inc rcx
cmp rcx, 5
jb 0x180017b70
mov r8, rdi
mov byte [rbp + 0x36], 0
mov edx, r9d
lea rcx, [rbp + 0x30]
call fcn.180017980
jmp 0x180017be1
mov dword [rbp - 0x17], 0x3b350503
xor ecx, ecx
mov dword [rbp - 0x13], 0x3f3a3661
mov word [rbp - 0xf], 0x65
mov byte [rbp - 0xd], 1
nop
lea eax, [rcx + 0xe]
xor byte [rbp + rcx - 0x17], al
inc rcx
cmp rcx, 9
jb 0x180017bb0
mov byte [rbp - 0xd], 0
lea rcx, [rbp - 0x17]
lea r8, [0x18005afcd]
mov qword [rsp + 0x20], rdi
lea edx, [r12*4]
call fcn.180017980
mov rax, r14
mov ecx, 0x2f64
mov byte [rax + rcx], 0
cmp rsi, rbx
je 0x180017c0c
lea rdi, [rsi + 1]
jmp 0x180017ae0
test r15b, r15b
je 0x180017c0c
lea rcx, [0x1801e7028]
call fcn.180017980
mov r15, qword [rsp + 0x88]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
Function at 0x180017c30
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov rdi, qword [0x1801f6110]
mov qword [rax + 0x10], rbx
xor ebx, ebx
mov qword [rax + 0x18], rbp
mov qword [rax - 0x10], rsi
mov rsi, rcx
mov ecx, dword [rdi + 0x2f34]
mov ebp, dword [rdi + 0x2f30]
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov dword [rax - 0x28], ebx
mov byte [rax - 0x24], bl
cmp ebp, ecx
jne 0x180017d1e
inc ebp
test ecx, ecx
je 0x180017c83
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180017c88
mov eax, 8
cmp eax, ebp
cmovg ebp, eax
cmp ebp, ecx
jle 0x180017d1e
mov qword [rsp + 0x40], r14
test rdi, rdi
je 0x180017ca5
inc dword [rdi + 0x3c0]
mov rdx, qword [0x1801f6108]
movsxd rax, ebp
lea rcx, [rax + rax*2]
shl rcx, 3
call fcn.180009250
mov rdx, qword [rdi + 0x2f38]
mov r14, rax
test rdx, rdx
je 0x180017d0c
movsxd rcx, dword [rdi + 0x2f30]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 3
call fcn.180036d80
mov rcx, qword [rdi + 0x2f38]
test rcx, rcx
je 0x180017d00
mov rax, qword [0x1801f6110]
test rax, rax
je 0x180017d00
dec dword [rax + 0x3c0]
mov rdx, qword [0x1801f6108]
call fcn.180009340
mov qword [rdi + 0x2f38], r14
mov r14, qword [rsp + 0x40]
mov dword [rdi + 0x2f34], ebp
movsxd rax, dword [rdi + 0x2f30]
movups xmm0, xmmword [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
movsd xmm1, qword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov dword [rsp + 0x60], 0x332c2d
mov rax, qword [rdi + 0x2f38]
mov byte [rsp + 0x64], 1
movups xmmword [rax + rcx*8], xmm0
movsd qword [rax + rcx*8 + 0x10], xmm1
movsxd rcx, dword [rdi + 0x2f30]
lea eax, [rcx + 1]
mov dword [rdi + 0x2f30], eax
lea rcx, [rcx + rcx*2]
mov rax, qword [rdi + 0x2f38]
lea rdi, [rax + rcx*8]
nop word [rax + rax]
lea eax, [rbx + 0xe]
xor byte [rsp + rbx + 0x60], al
inc rbx
cmp rbx, 3
jb 0x180017d80
lea rdx, [rsp + 0x60]
mov byte [rsp + 0x64], 0
mov rcx, rsi
call fcn.180033ef0
test rax, rax
mov rbx, 0xffffffffffffffff
cmovne rsi, rax
cmp byte [rsi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x180017db0
mov rax, qword [0x1801f6110]
test rax, rax
je 0x180017dcd
inc dword [rax + 0x3c0]
mov rdx, qword [0x1801f6108]
lea rcx, [rbx + 1]
call fcn.180009250
lea r8, [rbx + 1]
mov rdx, rsi
mov rcx, rax
call fcn.180036d80
mov rbx, qword [rsp + 0x68]
lea r8, [rsi + 1]
mov qword [rdi], rax
mov r10d, 0xffffffff
movzx r9d, byte [rsi]
mov ecx, r10d
mov rsi, qword [rsp + 0x48]
test r9b, r9b
je 0x180017e46
lea r11, [0x1801e5fa0]
cmp r9b, 0x23
jne 0x180017e29
cmp byte [r8], r9b
jne 0x180017e29
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180017e16
not ecx
mov rax, rdi
mov dword [rdi + 8], ecx
add rsp, 0x50
pop rdi
ret