joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034d00
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x530
mov rax, qword [0x180118100]
xor rax, rsp
mov qword [rsp + 0x520], rax
mov r14, rdx
mov r15, rcx
mov bpl, 1
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov rbx, r12
nop word [rax + rax]
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
mov r8d, 0x81a
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_NtGetNextThread]
mov edi, eax
test rbx, rbx
je 0x180034d8f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x180034e53
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov edi, eax
test eax, eax
je 0x180034d50
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
je 0x180034d50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x180034d50
test eax, eax
je 0x180034dda
test bpl, bpl
jne 0x180034dda
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x180034d50
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call fcn.1800bf860
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x80], 0x10000b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x180034d50
mov rcx, qword [r14 + 0x38]
test rcx, rcx
je 0x180034e3e
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x38]
mov dword [rsp + 0x48], edi
lea r8, [rsp + 0x40]
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax + 0x10]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
inc esi
jmp 0x180034d50
xor bpl, bpl
test esi, esi
jne 0x180034d40
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x180034e6d
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, r12
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
mov r8d, 0x81a
mov rcx, rax
mov rdx, rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ntdll.dll_NtGetNextThread]
mov edi, eax
test rbx, rbx
je 0x180034eaf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
js 0x180034edc
mov rbx, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov edi, eax
test eax, eax
je 0x180034e70
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp edi, eax
je 0x180034e70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x180034e70
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.1800921e0
lea r11, [rsp + 0x530]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180034f10
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180118100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov qword [rsp + 0x40], rcx
mov rdi, rdx
lea r9, [rsp + 0x40]
mov rbx, rcx
xor ebp, ebp
mov rdx, rsi
mov dword [rsp + 0x40], ebp
mov rcx, rdi
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180034f60
mov byte [rbx + 0x18], bpl
jmp 0x180034fa8
mov r8d, dword [rsp + 0x40]
lea rax, [rsp + 0x28]
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov dword [rbx + 0x10], ebp
cmp rbx, rax
je 0x180034f8a
mov qword [rbx], rdi
mov qword [rbx + 8], rsi
mov dword [rbx + 0x10], r8d
mov byte [rbx + 0x18], 1
jmp 0x180034fa8
mov byte [rbx + 0x18], 1
test rdi, rdi
je 0x180034fa8
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800921e0
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x180035b00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
movzx eax, byte [rdx + 1]
mov rsi, rcx
movzx ecx, byte [rdx]
movabs rbp, 0x100000001b3
mov r8, qword [0x1801bd918]
mov rdi, rdx
movabs r14, 0xcbf29ce484222325
xor ebx, ebx
xor rcx, r14
imul rcx, rbp
xor rcx, rax
movzx eax, byte [rdx + 2]
imul rcx, rbp
xor rcx, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [0x1801bd940]
imul rcx, rbp
xor rcx, rax
imul rcx, rbp
and rdx, rcx
mov rcx, qword [0x1801bd928]
add rdx, rdx
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, r8
je 0x180035ba0
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi]
cmp ecx, dword [rax + 0x10]
je 0x180035ba3
nop dword [rax]
cmp rax, rdx
je 0x180035ba0
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180035b90
jmp 0x180035ba3
mov rax, rbx
test rax, rax
mov rcx, r8
cmovne rcx, rax
cmp rcx, r8
jne 0x180035c4c
mov eax, dword [rdi]
lea r8, [rsp + 0x20]
movaps xmm0, xmm2
mov dword [rsp + 0x20], eax
unpcklps xmm0, xmm2
lea rdx, [rsp + 0x30]
movsd qword [rsp + 0x24], xmm0
mov dword [rsp + 0x2c], eax
call fcn.180035e80
movzx eax, byte [rdi + 1]
movzx r8d, byte [rdi]
mov rdx, qword [0x1801bd928]
xor r8, r14
mov rcx, qword [0x1801bd918]
imul r8, rbp
xor r8, rax
movzx eax, byte [rdi + 2]
imul r8, rbp
xor r8, rax
movzx eax, byte [rdi + 3]
imul r8, rbp
xor r8, rax
imul r8, rbp
and r8, qword [0x1801bd940]
add r8, r8
mov rax, qword [rdx + r8*8 + 8]
cmp rax, rcx
je 0x180035c45
mov r8, qword [rdx + r8*8]
mov edx, dword [rdi]
cmp edx, dword [rax + 0x10]
je 0x180035c42
cmp rax, r8
je 0x180035c45
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180035c34
mov rbx, rax
test rbx, rbx
cmovne rcx, rbx
movsd xmm0, qword [rcx + 0x14]
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
movsd qword [rsi], xmm0
mov ecx, dword [rcx + 0x1c]
mov dword [rsi + 8], ecx
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180035ca0
Capabilities:
Hash data using fnv

Disassembly:
movss dword [rsp + 0x20], xmm3
movss dword [rsp + 0x10], xmm1
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rdx, rcx
movaps xmmword [rsp + 0x50], xmm7
lea rcx, [rsp + 0x30]
movaps xmmword [rsp + 0x40], xmm8
movaps xmm7, xmm3
movaps xmm8, xmm2
movaps xmm6, xmm1
xorps xmm2, xmm2
call fcn.180035b00
mov edx, dword [rsp + 0x38]
movabs r8, 0x100000001b3
mov r9, qword [0x1801bd940]
movabs rax, 0xcbf29ce484222325
movzx ecx, dl
xor rcx, rax
movzx eax, byte [rsp + 0x39]
imul rcx, r8
xor rcx, rax
movzx eax, byte [rsp + 0x3a]
imul rcx, r8
xor rcx, rax
movzx eax, byte [rsp + 0x3b]
imul rcx, r8
xor rcx, rax
imul rcx, r8
mov r8, qword [0x1801bd918]
and r9, rcx
mov rcx, qword [0x1801bd928]
add r9, r9
mov rax, qword [rcx + r9*8 + 8]
cmp rax, r8
je 0x180035d60
mov rcx, qword [rcx + r9*8]
cmp edx, dword [rax + 0x10]
je 0x180035d62
nop
cmp rax, rcx
je 0x180035d60
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180035d50
jmp 0x180035d62
xor eax, eax
test rax, rax
lea rcx, [rsp + 0x20]
movaps xmm1, xmm7
xorps xmm1, xmmword [0x1800fe7a0]
cmovne r8, rax
comiss xmm1, xmm6
lea rax, [rsp + 0x88]
movss dword [rsp + 0x20], xmm1
movss xmm2, dword [r8 + 0x14]
cmovbe rcx, rax
lea rax, [rsp + 0x98]
comiss xmm6, xmm7
cmovbe rax, rcx
ucomiss xmm2, dword [rax]
jp 0x180035da9
je 0x180035e00
movss xmm0, dword [0x1800fe1e8]
subss xmm6, xmm2
mov rax, qword [0x1801bd7c0]
lea rcx, [rsp + 0x24]
divss xmm0, xmm8
movss dword [rsp + 0x24], xmm1
mulss xmm0, dword [rax + 0x18]
lea rax, [rsp + 0x28]
mulss xmm0, xmm6
addss xmm0, xmm2
comiss xmm1, xmm0
movss dword [rsp + 0x28], xmm0
cmovbe rcx, rax
lea rax, [rsp + 0x98]
comiss xmm0, xmm7
cmovbe rax, rcx
mov eax, dword [rax]
mov dword [r8 + 0x14], eax
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x40]
add rsp, 0x78
ret
Function at 0x180036170
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18003631e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1801bd918]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801bd928]
lea rdx, [rdi + rdi]
call fcn.18001cc50
mov rax, qword [0x1801bd918]
lea r9, [rdi - 1]
mov qword [0x1801bd940], r9
mov qword [0x1801bd948], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180036313
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1801bd928]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18003625f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800362d4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18003629c
mov r10, qword [rdx]
cmp r10, rax
je 0x180036296
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800362d4
cmp r9, rdx
je 0x1800362b0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800362e8
cmp r9, rdx
jne 0x1800362a1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18003630e
mov r9, qword [0x1801bd940]
jmp 0x180036210
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800362d4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800903fc
int3
Function at 0x180036e90
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, byte [rcx]
test al, al
jne 0x180036e9a
mov eax, edx
ret
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.180036e90

Function at 0x180036eb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x48], 0xf
lea rdi, [rcx + 0x30]
movzx eax, byte [rcx + 0x99]
mov rsi, rcx
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rdi
movd xmm8, eax
cvtdq2ps xmm8, xmm8
jbe 0x180036eee
mov rcx, qword [rdi]
movsx eax, byte [rcx]
mov ebx, 0x811c9dc5
test al, al
jne 0x180036efe
mov ebp, ebx
jmp 0x180036f10
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
mov ebp, eax
cmp qword [rsi + 0x68], 0xf
lea rcx, [rsi + 0x50]
jbe 0x180036f1e
mov rcx, qword [rcx]
movsx edx, byte [rcx]
test dl, dl
jne 0x180036f29
mov eax, ebx
jmp 0x180036f3b
mov eax, edx
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
movss xmm3, dword [0x1800fe340]
lea rcx, [rsp + 0x40]
movss xmm2, dword [0x1800fe174]
add eax, 0xf489185f
add eax, ebp
movaps xmm1, xmm8
mov dword [rsp + 0x40], eax
call fcn.180035ca0
cmp qword [rdi + 0x18], 0xf
mov rax, qword [rsi + 0xd0]
movzx ecx, byte [rax]
movd xmm8, ecx
cvtdq2ps xmm8, xmm8
jbe 0x180036f81
mov rdi, qword [rdi]
movsx eax, byte [rdi]
test al, al
jne 0x180036f8c
mov edi, ebx
jmp 0x180036f9f
xor eax, ebx
lea rcx, [rdi + 1]
imul edx, eax, 0x1000193
call fcn.180036e90
mov edi, eax
cmp qword [rsi + 0x68], 0xf
lea rcx, [rsi + 0x50]
jbe 0x180036fad
mov rcx, qword [rcx]
movsx edx, byte [rcx]
test dl, dl
je 0x180036fc8
mov eax, edx
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
mov ebx, eax
movss xmm3, dword [0x1800fe340]
lea eax, [rbx - 0x386a7032]
movss xmm2, dword [0x1800fe174]
lea rcx, [rsp + 0x40]
add eax, edi
movaps xmm1, xmm8
mov dword [rsp + 0x40], eax
call fcn.180035ca0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x180037670
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm8
mov rbp, rcx
movss xmm8, dword [rcx + 0xec]
lea rbx, [rcx + 0x50]
lea rdi, [rcx + 0x30]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rbx + 0x10]
movabs r14, 0x7fffffffffffffff
mov rax, r14
sub rax, rcx
cmp rax, rdx
jb 0x180037832
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800376ca
mov r9, qword [rdi]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800376d7
mov rax, qword [rbx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.18002e9e0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
movsx eax, byte [rcx]
mov esi, 0x811c9dc5
test al, al
jne 0x180037712
mov eax, esi
jmp 0x180037722
xor eax, esi
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
add eax, 0xe4e70b08
mov dword [rsp + 0x90], eax
movss xmm3, dword [0x1800fe340]
movss xmm2, dword [0x1800fe174]
movaps xmm1, xmm8
lea rcx, [rsp + 0x90]
call fcn.180035ca0
nop
lea rcx, [rsp + 0x40]
call fcn.1800304d0
movzx eax, byte [rbp + 0xf5]
movd xmm8, eax
cvtdq2ps xmm8, xmm8
mov rax, qword [rdi + 0x10]
mov rcx, qword [rbx + 0x10]
sub r14, rax
cmp r14, rcx
jb 0x18003782c
cmp qword [rdi + 0x18], 0xf
jbe 0x180037788
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 0xf
jbe 0x180037792
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
mov r9, rdi
lea rcx, [rsp + 0x40]
call fcn.18002e9e0
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rcx, qword [rsp + 0x40]
movsx eax, byte [rcx]
test al, al
je 0x1800377d9
xor eax, esi
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
mov esi, eax
lea eax, [rsi + 0x4518e1c2]
mov dword [rsp + 0x90], eax
movss xmm3, dword [0x1800fe340]
movss xmm2, dword [0x1800fe174]
movaps xmm1, xmm8
lea rcx, [rsp + 0x90]
call fcn.180035ca0
nop
lea rcx, [rsp + 0x40]
call fcn.1800304d0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180030260
int3
call fcn.180030260
int3
Function at 0x180038140
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x48], 0xf
lea rdi, [rcx + 0x30]
movzx eax, byte [rcx + 0x99]
mov rsi, rcx
movaps xmmword [rsp + 0x40], xmm6
mov rcx, rdi
movaps xmmword [rsp + 0x30], xmm7
movd xmm6, eax
cvtdq2ps xmm6, xmm6
jbe 0x18003817b
mov rcx, qword [rdi]
movsx eax, byte [rcx]
mov ebx, 0x811c9dc5
test al, al
jne 0x18003818b
mov eax, ebx
jmp 0x18003819b
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
movss xmm3, dword [0x1800fe340]
lea rcx, [rsp + 0x60]
movss xmm2, dword [0x1800fe174]
add eax, 0xa265daa1
movaps xmm1, xmm6
mov dword [rsp + 0x60], eax
call fcn.180035ca0
cmp qword [rdi + 0x18], 0xf
movzx eax, byte [rsi + 0x13a]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
jbe 0x1800381d9
mov rdi, qword [rdi]
movsx eax, byte [rdi]
test al, al
jne 0x1800381e4
mov eax, ebx
jmp 0x1800381f5
xor eax, ebx
lea rcx, [rdi + 1]
imul edx, eax, 0x1000193
call fcn.180036e90
movss xmm3, dword [0x1800fe340]
lea rcx, [rsp + 0x60]
movss xmm2, dword [0x1800fe154]
add eax, 0x2d3f9080
movaps xmm1, xmm6
mov dword [rsp + 0x60], eax
call fcn.180035ca0
cmp qword [rsi + 0x48], 0xf
lea rcx, [rsi + 0x30]
jbe 0x180038229
mov rcx, qword [rcx]
movsx eax, byte [rcx]
test al, al
jne 0x180038234
mov eax, ebx
jmp 0x180038244
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
add eax, 0x2d3f9080
lea rdx, [rsp + 0x60]
xorps xmm2, xmm2
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x20]
call fcn.180035b00
movzx eax, byte [rsi + 0x13a]
test al, al
je 0x180038274
movss xmm6, dword [0x1800fe184]
jmp 0x18003827c
movss xmm6, dword [0x1800fe170]
cmp qword [rsi + 0x48], 0xf
lea rcx, [rsi + 0x30]
movd xmm7, eax
cvtdq2ps xmm7, xmm7
jbe 0x180038291
mov rcx, qword [rcx]
movsx eax, byte [rcx]
test al, al
je 0x1800382aa
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
mov ebx, eax
movss xmm3, dword [0x1800fe340]
lea eax, [rbx + 0x78a83b8e]
movaps xmm2, xmm6
mov dword [rsp + 0x60], eax
movaps xmm1, xmm7
lea rcx, [rsp + 0x60]
call fcn.180035ca0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x180038ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rdi
push r14
sub rsp, 0xf0
movaps xmmword [rax - 0x28], xmm6
mov r14, rcx
movaps xmmword [rax - 0x48], xmm8
xor dil, dil
movss xmm8, dword [rax + 0x1c]
mulss xmm8, dword [0x1800fe1ac]
movaps xmmword [rax - 0x58], xmm9
movss xmm9, dword [rax + 0x18]
movaps xmmword [rax - 0x68], xmm10
movaps xmm1, xmm8
movaps xmmword [rax - 0x78], xmm11
movaps xmm0, xmm9
movaps xmmword [rax - 0x88], xmm12
movaps xmmword [rsp + 0x70], xmm13
movaps xmmword [rsp + 0x60], xmm14
call fcn.1800be040
movss xmm12, dword [rsp + 0x11c]
movaps xmm13, xmm0
movss xmm14, dword [rsp + 0x118]
xorps xmm11, xmm11
movss xmm10, dword [0x1800fe320]
xorps xmm6, xmm6
mov qword [rsp + 0x110], rbx
xor ebp, ebp
mov qword [rsp + 0x128], rsi
movaps xmmword [rsp + 0xd0], xmm7
nop dword [rax]
comiss xmm9, xmm6
jbe 0x1800390a6
movaps xmm0, xmm9
subss xmm0, xmm8
comiss xmm6, xmm0
jbe 0x180038f6e
movaps xmm7, xmm13
jmp 0x180038f72
movaps xmm7, xmm8
mov rcx, qword [r14]
call fcn.180036c00
lea rcx, [0x1801bdcc0]
test dil, dil
je 0x180038fac
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.180036aa0
movss xmm0, dword [rax]
mulss xmm0, xmm10
cvttss2si eax, xmm0
movzx eax, al
or eax, 0x64646400
jmp 0x180038fd0
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.180036aa0
movss xmm0, dword [rax]
mulss xmm0, xmm10
cvttss2si eax, xmm0
movzx eax, al
or eax, 0xf0f0f00
mov rcx, qword [0x1801b42e8]
movaps xmm0, xmm14
cvttss2si ebx, xmm7
mov dword [rsp + 0x38], ebp
movss dword [rsp + 0x30], xmm11
addss xmm0, xmm6
mov dword [rsp + 0x28], eax
mov r9d, ebx
cvttss2si r8d, xmm12
mov dword [rsp + 0x20], ebx
cvttss2si esi, xmm0
mov edx, esi
call fcn.18008e580
mov rcx, qword [r14]
call fcn.180036c00
lea rcx, [0x1801bdcc0]
test dil, dil
je 0x180039043
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.180036aa0
movss xmm0, dword [rax]
mulss xmm0, xmm10
cvttss2si eax, xmm0
movzx eax, al
or eax, 0xf0f0f00
jmp 0x180039067
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.180036aa0
movss xmm0, dword [rax]
mulss xmm0, xmm10
cvttss2si eax, xmm0
movzx eax, al
or eax, 0x64646400
mov rcx, qword [0x1801b42e8]
movaps xmm0, xmm12
mov dword [rsp + 0x38], ebp
addss xmm0, xmm7
movss dword [rsp + 0x30], xmm11
mov r9d, ebx
mov dword [rsp + 0x28], eax
mov edx, esi
mov dword [rsp + 0x20], ebx
cvttss2si r8d, xmm0
call fcn.18008e580
xor dil, 1
addss xmm6, xmm8
jmp 0x180038f50
movaps xmm7, xmmword [rsp + 0xd0]
lea r11, [rsp + 0xf0]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x110]
movaps xmm14, xmmword [rsp + 0x60]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18003c080
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov r8, qword [0x1801b42e8]
lea r9, [rcx + 0xd8]
movaps xmmword [rsp + 0x30], xmm6
lea rdx, [rsp + 0x60]
movaps xmmword [rsp + 0x20], xmm7
mov rsi, rcx
mov r8, qword [r8 + 0x78]
call fcn.18008daa0
movss xmm7, dword [rsp + 0x60]
xor r14d, r14d
subss xmm7, dword [0x1800fe234]
addss xmm7, dword [0x1800fe27c]
cmp byte [rsi + 0x99], r14b
jne 0x18003c0e9
cmp qword [0x1801bdb08], rsi
mov ebp, r14d
jne 0x18003c0ee
mov ebp, 1
cmp qword [rsi + 0x48], 0xf
lea rdi, [rsi + 0x30]
mov rcx, rdi
jbe 0x18003c0ff
mov rcx, qword [rdi]
movsx eax, byte [rcx]
mov ebx, 0x811c9dc5
test al, al
jne 0x18003c10f
mov eax, ebx
jmp 0x18003c11f
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
movss xmm6, dword [0x1800fe340]
lea rcx, [rsp + 0x60]
movss xmm2, dword [0x1800fe174]
add eax, 0x318d4ac6
movd xmm1, ebp
movaps xmm3, xmm6
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x60], eax
call fcn.180035ca0
cmp dword [rsi + 0xd0], 1
jne 0x18003c15e
cmp qword [0x1801bdb08], rsi
je 0x18003c167
cmp byte [rsi + 0x99], r14b
je 0x18003c16d
mov r14d, 1
cmp qword [rdi + 0x18], 0xf
jbe 0x18003c177
mov rdi, qword [rdi]
movsx eax, byte [rdi]
test al, al
jne 0x18003c182
mov eax, ebx
jmp 0x18003c193
xor eax, ebx
lea rcx, [rdi + 1]
imul edx, eax, 0x1000193
call fcn.180036e90
movss xmm2, dword [0x1800fe174]
lea rcx, [rsp + 0x60]
movd xmm1, r14d
add eax, 0x873b4e55
cvtdq2ps xmm1, xmm1
mov dword [rsp + 0x60], eax
movaps xmm3, xmm6
call fcn.180035ca0
cmp qword [rsi + 0x48], 0xf
lea rcx, [rsi + 0x30]
jbe 0x18003c1c7
mov rcx, qword [rcx]
movsx eax, byte [rcx]
test al, al
jne 0x18003c1d2
mov eax, ebx
jmp 0x18003c1e2
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
movss xmm2, dword [0x1800fe184]
lea rcx, [rsp + 0x60]
add eax, 0x88d586aa
movaps xmm3, xmm6
movaps xmm1, xmm7
mov dword [rsp + 0x60], eax
call fcn.180035ca0
cmp qword [rsi + 0x48], 0xf
lea rcx, [rsi + 0x30]
movzx eax, byte [rsi + 0xfa]
movd xmm7, eax
cvtdq2ps xmm7, xmm7
jbe 0x18003c21f
mov rcx, qword [rcx]
movsx eax, byte [rcx]
test al, al
je 0x18003c238
xor eax, ebx
imul edx, eax, 0x1000193
inc rcx
call fcn.180036e90
mov ebx, eax
movss xmm2, dword [0x1800fe18c]
lea eax, [rbx + 0x5d923616]
movaps xmm3, xmm6
mov dword [rsp + 0x60], eax
movaps xmm1, xmm7
lea rcx, [rsp + 0x60]
call fcn.180035ca0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret