joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e0c8], edx
jle 0x180011016
lea rcx, [0x18004e0c8]
call fcn.18002e0f4
cmp dword [0x18004e0c8], 0xffffffff
jne 0x180011016
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x24
lea rdx, str.CTopLevelWindow::TreatAsActiveWindow
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180010fd8
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180010fbb
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18001102a
mov rax, qword [rax + 0x30]
mov qword [0x18004e0b8], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e0c8]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e0b8]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3

Function at 0x180011038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e0b4], edx
jle 0x18001112e
lea rcx, [0x18004e0b4]
call fcn.18002e0f4
cmp dword [0x18004e0b4], 0xffffffff
jne 0x18001112e
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x1e
lea rdx, str.CTopLevelWindow::OnClipUpdated
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x1800110f0
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800110d3
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x180011142
mov rax, qword [rax + 0x30]
mov qword [0x18004e0a8], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e0b4]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e0a8]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3
Function at 0x180011150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e0b0], edx
jle 0x180011246
lea rcx, [0x18004e0b0]
call fcn.18002e0f4
cmp dword [0x18004e0b0], 0xffffffff
jne 0x180011246
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x24
lea rdx, str.CTopLevelWindow::OnBlurBehindUpdated
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180011208
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800111eb
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18001125a
mov rax, qword [rax + 0x30]
mov qword [0x18004e098], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e0b0]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e098]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3

Function at 0x180011268
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e0a0], edx
jle 0x18001135e
lea rcx, [0x18004e0a0]
call fcn.18002e0f4
cmp dword [0x18004e0a0], 0xffffffff
jne 0x18001135e
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x26
lea rdx, str.CTopLevelWindow::OnAccentPolicyUpdated
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180011320
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180011303
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x180011372
mov rax, qword [rax + 0x30]
mov qword [0x18004e088], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e0a0]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e088]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3
Function at 0x180011380
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e090], edx
jle 0x180011476
lea rcx, [0x18004e090]
call fcn.18002e0f4
cmp dword [0x18004e090], 0xffffffff
jne 0x180011476
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x28
lea rdx, str.CTopLevelWindow::OnSystemBackdropUpdated
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180011438
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18001141b
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18001148a
mov rax, qword [rax + 0x30]
mov qword [0x18004e078], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e090]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e078]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3

Function at 0x180011498
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov bl, r9b
mov dil, r8b
mov rsi, rdx
mov r14, rcx
mov r10d, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r10*8]
mov r10d, dword [rcx + rax]
cmp dword [0x18004e080], r10d
jle 0x1800115a8
lea rcx, [0x18004e080]
call fcn.18002e0f4
cmp dword [0x18004e080], 0xffffffff
jne 0x1800115a8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x24
lea rdx, str.CTopLevelWindow::GetActualWindowRect
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x18001156a
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18001154d
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x1800115d7
mov rax, qword [rax + 0x30]
mov qword [0x18004e068], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e080]
call fcn.18002e088
mov r10, qword [0x18004e068]
mov r9b, bl
mov r8b, dil
mov rdx, rsi
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
jmp r10
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3
Function at 0x180011744
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rcx
mov edx, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x18004e070], edx
jle 0x18001183a
lea rcx, [0x18004e070]
call fcn.18002e0f4
cmp dword [0x18004e070], 0xffffffff
jne 0x18001183a
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x2a
lea rdx, str.CTopLevelWindow::GetSolidColorCaptionColor
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x1800117fc
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1800117df
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18001184e
mov rax, qword [rax + 0x30]
mov qword [0x18004e058], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e070]
call fcn.18002e088
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
jmp qword [0x18004e058]
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3

Function at 0x18001185c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov bl, dl
mov rdi, rcx
mov r8d, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x18004e060], r8d
jle 0x18001195c
lea rcx, [0x18004e060]
call fcn.18002e0f4
cmp dword [0x18004e060], 0xffffffff
jne 0x18001195c
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x2b
lea rdx, str.CTopLevelWindow::GetWindowColorizationColor
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x18001191e
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180011901
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x18001197a
mov rax, qword [rax + 0x30]
mov qword [0x18004e048], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e060]
call fcn.18002e088
mov rax, qword [0x18004e048]
mov dl, bl
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
jmp rax
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3
Function at 0x180011988
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov r8d, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x18004e050], r8d
jle 0x180011a89
lea rcx, [0x18004e050]
call fcn.18002e0f4
cmp dword [0x18004e050], 0xffffffff
jne 0x180011a89
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x33
lea rdx, str.CTopLevelWindow::GetCurrentDefaultColorizationFlags
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180011a4b
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180011a2e
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x180011aa8
mov rax, qword [rax + 0x30]
mov qword [0x18004e040], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e050]
call fcn.18002e088
mov rax, qword [0x18004e040]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
jmp rax
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3

Function at 0x180011ab8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
mov rdi, rcx
mov r8d, dword [0x18004daf8]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x18004e038], r8d
jle 0x180011bb9
lea rcx, [0x18004e038]
call fcn.18002e0f4
cmp dword [0x18004e038], 0xffffffff
jne 0x180011bb9
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov r8d, 0x25
lea rdx, str.CWindowList::GetShellWindowForDesktop
lea rcx, [rbp - 0x20]
call fcn.18001aa44
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0xf
cmova rdx, qword [rbp - 0x20]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rbp - 0x10]
test r8, r8
je 0x180011b7b
movzx eax, byte [rdx + rcx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180011b5e
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x30]
lea rcx, [0x180048190]
call fcn.180019578
mov rax, qword [rbp - 0x28]
test rax, rax
je 0x180011bd8
mov rax, qword [rax + 0x30]
mov qword [0x18004e030], rax
lea rcx, [rbp - 0x20]
call fcn.18000a888
nop
lea rcx, [0x18004e038]
call fcn.18002e088
mov rax, qword [0x18004e030]
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
jmp rax
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.18002db48
int3
Function at 0x180018ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov r13, rcx
cmp rdx, r8
je 0x180018bb0
mov rax, qword [rcx + 8]
mov rbx, rdx
mov rbp, qword [rcx + 0x18]
movabs rdi, 0xcbf29ce484222325
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
movabs rdx, 0x100000001b3
movzx eax, byte [r15 + rcx + 0x10]
inc rcx
xor rdi, rax
imul rdi, rdx
cmp rcx, 8
jb 0x180018b28
and rdi, qword [r13 + 0x30]
add rdi, rdi
mov rax, qword [rbp + rdi*8 + 8]
mov r12, qword [rbp + rdi*8]
mov qword [rsp + 0x28], rax
mov rax, rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov rbx, qword [rbx]
lea rcx, [rax + 0x18]
cmp qword [rcx], 0
je 0x180018b78
call fcn.1800078b8
mov rax, qword [rsp + 0x38]
mov rcx, qword [0x18004e268]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x28]
dec qword [r13 + 0x10]
cmp qword [rsp + 0x30], rax
je 0x180018bd1
cmp rbx, rsi
jne 0x180018b54
cmp r12, r15
jne 0x180018ba9
mov qword [rbp + rdi*8], rbx
mov qword [r14], rbx
mov qword [rbx + 8], r14
lea r11, [rsp + 0x40]
mov rax, rsi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp r12, r15
jne 0x180018be5
mov r12, qword [rsp + 0x20]
mov qword [rbp + rdi*8], r12
mov rax, r12
jmp 0x180018be8
mov rax, r14
mov qword [rbp + rdi*8 + 8], rax
jmp 0x180018c79
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
movabs r12, 0x100000001b3
movzx eax, byte [rbx + rcx + 0x10]
inc rcx
xor rdi, rax
imul rdi, r12
cmp rcx, 8
jb 0x180018c08
and rdi, qword [r13 + 0x30]
mov r12, qword [rsp + 0x20]
add rdi, rdi
mov rax, qword [rbp + rdi*8 + 8]
mov qword [rsp + 0x30], rax
mov r15, rbx
mov rbx, qword [rbx]
lea rcx, [r15 + 0x18]
cmp qword [rcx], 0
je 0x180018c48
call fcn.1800078b8
mov rcx, qword [0x18004e268]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
dec qword [r13 + 0x10]
cmp r15, qword [rsp + 0x30]
je 0x180018c6f
cmp rbx, rsi
jne 0x180018c33
jmp 0x180018ba4
mov qword [rbp + rdi*8], r12
mov qword [rbp + rdi*8 + 8], r12
cmp rbx, rsi
jne 0x180018bf2
jmp 0x180018ba9

Function at 0x180018f7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r10, rdx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r8 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 8
jb 0x180018f8c
mov rdx, qword [0x18004de20]
mov r9, qword [0x18004de08]
and rdx, rcx
mov rcx, qword [0x18004ddf8]
add rdx, rdx
mov rax, qword [r9 + rdx*8 + 8]
cmp rax, rcx
je 0x180018fea
mov r9, qword [r9 + rdx*8]
mov rdx, qword [r8]
jmp 0x180018fe2
cmp rax, r9
je 0x180018fea
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x180018fd9
jmp 0x180018fec
xor eax, eax
test rax, rax
cmovne rcx, rax
mov rax, r10
mov qword [r10], rcx
ret
Function at 0x180018ffc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r9
mov r12, r8
mov r14, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 8
jb 0x180019025
mov rax, qword [0x18004de20]
and rax, r15
add rax, rax
mov rcx, qword [0x18004de08]
mov rbx, qword [rcx + rax*8 + 8]
mov rbp, qword [0x18004ddf8]
cmp rbx, rbp
jne 0x1800190db
mov rbx, rbp
mov rsi, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [0x18004de00], rax
je 0x18001924f
lea rax, [0x18004ddf8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18001bb70
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13]
xor r12d, r12d
mov qword [r13], r12
mov qword [rax + 0x18], rcx
mov r8, qword [0x18004de00]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18001911f
cvtsi2ss xmm0, rcx
jmp 0x180019134
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x1800190ed
cmp rbx, rdx
je 0x180019115
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1800190e4
mov rbp, qword [rbx]
mov rsi, rbp
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18001906f
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x180019237
mov rbp, rbx
xor eax, eax
mov rsi, rbx
jmp 0x1800190ff
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x18004de28]
xorps xmm1, xmm1
test rcx, rcx
js 0x18001914a
cvtsi2ss xmm1, rcx
jmp 0x18001915f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x18004ddf0]
seta al
test al, al
je 0x1800191ce
call fcn.180019a0c
mov rcx, qword [0x18004de20]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x18004de08]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x18004ddf8]
cmp rax, rbx
je 0x1800191ba
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1800191b1
mov rbx, rax
cmp rax, r8
je 0x180019211
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800191a5
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rsi, rbx
mov rbp, qword [rsp + 0x20]
mov r8, qword [0x18004de00]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x18004de00], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x18004de08]
mov rax, qword [0x18004de20]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x18004ddf8]
jne 0x180019218
mov qword [rcx + rax*8], rdi
jmp 0x18001922a
mov qword [rsp + 0x20], rax
jmp 0x1800191bf
cmp r8, rsi
jne 0x180019223
mov qword [rcx + rax*8], rdi
jmp 0x18001922f
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18001922f
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18002db24
int3
Function at 0x18001925c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [r8 + rcx]
xor rbp, rax
movabs rdx, 0x100000001b3
imul rbp, rdx
inc rcx
cmp rcx, 8
jb 0x180019281
mov rcx, qword [0x18004de20]
and rcx, rbp
add rcx, rcx
mov rdx, qword [0x18004de08]
mov rax, qword [rdx + rcx*8 + 8]
mov rsi, qword [0x18004ddf8]
cmp rax, rsi
je 0x1800192f8
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x1800192d7
cmp rax, r8
je 0x1800192f1
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800192ce
mov rsi, qword [rax]
test rax, rax
je 0x1800192f8
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x18001947f
mov rsi, rax
xor eax, eax
jmp 0x1800192e0
movabs rax, 0x7ffffffffffffff
cmp qword [0x18004de00], rax
je 0x180019493
lea rax, [0x18004ddf8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18001bb70
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r14]
mov qword [rax + 0x10], rcx
mov rcx, qword [r15]
mov qword [rax + 0x18], rcx
test rcx, rcx
je 0x18001934d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [0x18004de00]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x180019367
cvtsi2ss xmm0, rcx
jmp 0x18001937c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x18004de28]
xorps xmm1, xmm1
test rcx, rcx
js 0x180019392
cvtsi2ss xmm1, rcx
jmp 0x1800193a7
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x18004ddf0]
seta al
test al, al
je 0x180019417
call fcn.180019a0c
mov rax, qword [0x18004de20]
and rax, rbp
add rax, rax
mov r8, qword [0x18004de08]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x18004ddf8]
cmp rcx, rdx
jne 0x1800193ea
mov qword [rsp + 0x20], rdx
jmp 0x18001940b
mov rdx, qword [r8 + rax*8]
mov rax, qword [rbx + 0x10]
jmp 0x1800193fd
cmp rcx, rdx
je 0x18001945a
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x1800193f4
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rsi, qword [rsp + 0x20]
mov rdx, qword [0x18004de00]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x18004de00], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rcx, qword [0x18004de08]
mov rax, qword [0x18004de20]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x18004ddf8]
jne 0x180019461
mov qword [rcx + rax*8], rbx
jmp 0x180019473
mov qword [rsp + 0x20], rcx
jmp 0x18001940b
cmp rdx, rsi
jne 0x18001946c
mov qword [rcx + rax*8], rbx
jmp 0x180019478
cmp qword [rcx + rax*8 + 8], r8
jne 0x180019478
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18002db24
int3