joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000f910
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180060108]
test rax, rax
jne 0x18000fb20
movups xmm1, xmmword [0x180050228]
mov qword [rsp + 0x80], rbx
movups xmm0, xmmword [0x180050218]
mov qword [rsp + 0x70], rdi
movups xmmword [rsp + 0x50], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x40], xmm0
test al, al
je 0x18000fadd
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x18000faa6
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051a80]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180051880]
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x18000f9a0
movaps xmm6, xmmword [rsp + 0x60]
jmp 0x18000fadd
lea r8, [rsp + 0x40]
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x18000fab0
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x180060108], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x180013660
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x18005075c]
mov r8, rdx
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x50]
movzx eax, word [0x180050760]
mov rbx, rcx
xor byte [rsp + 0x51], 0x35
mov rcx, r8
xor byte [rsp + 0x52], 0x36
xor byte [rsp + 0x53], 0x37
mov word [rsp + 0x54], ax
xor al, 0x38
xor byte [rsp + 0x55], 0x39
mov byte [rsp + 0x54], al
mov byte [rsp + 0x50], 0x46
call fcn.180013420
test rax, rax
jne 0x1800136b9
add rsp, 0x30
pop rbx
ret
xor ecx, ecx
mov r9, rbx
mov qword [rsp + 0x28], rcx
mov r8, rax
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
add rsp, 0x30
pop rbx
ret
Function at 0x180013f10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180060150]
test rax, rax
jne 0x1800140df
cmp byte [0x180050793], 0
movsd xmm0, qword [0x180050788]
mov eax, dword [0x180050790]
mov qword [rsp + 0x50], rbx
movsd qword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], eax
je 0x18001409f
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x180014065
movdqa xmm2, xmmword [0x180051840]
mov ecx, 8
movdqa xmm3, xmmword [0x180051850]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x180051b00]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800518a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x180050788]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800518a0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xc
jl 0x180014070
lea rcx, [rsp + 0x30]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov qword [0x180060150], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret

Function at 0x1800145a0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180014637
mov qword [0x18005f9b0], rcx
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
xor ecx, ecx
mov qword [0x18005f9b8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [0x18005075c]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], ecx
movzx ecx, word [0x180050760]
xor byte [rsp + 0x59], 0x35
xor byte [rsp + 0x5a], 0x36
xor byte [rsp + 0x5b], 0x37
mov word [rsp + 0x5c], cx
xor cl, 0x38
xor byte [rsp + 0x5d], 0x39
mov byte [rsp + 0x5c], cl
mov rcx, rax
mov byte [rsp + 0x58], 0x46
call fcn.180013420
test rax, rax
je 0x180014637
xor ecx, ecx
lea r9, [0x1800144e0]
mov qword [rsp + 0x28], rcx
mov r8, rax
xor edx, edx
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180014760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
mov rax, qword [0x180060158]
test rax, rax
jne 0x180014992
cmp byte [0x1800507ad], 0
mov eax, dword [0x1800507a8]
movups xmm0, xmmword [0x180050798]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1800507ac]
mov qword [rsp + 0x80], rbx
movups xmmword [rsp + 0x40], xmm0
mov word [rsp + 0x54], ax
mov qword [rsp + 0x70], rdi
je 0x18001494f
xor ecx, ecx
cmp dword [0x18005a0d0], 2
jl 0x180014911
movdqa xmm0, xmmword [0x1800518f0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x180051840]
movdqa xmm4, xmmword [0x180051b00]
movdqa xmmword [rsp + 0x30], xmm0
mov r8d, dword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800518a0]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x180014800
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x16
jge 0x18001494f
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x16
jl 0x180014920
lea rcx, [rsp + 0x40]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x70]
mov rax, rbx
mov qword [0x180060158], rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x180016340
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r8d, edx
mov eax, edx
shr eax, 8
movabs r9, 0x100000001b3
movzx edx, al
movabs rcx, 0xcbf29ce484222325
movzx eax, r8b
xor rax, rcx
mov dword [rsp + 0x30], r8d
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x18005ff90]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x18005ff68]
shl rcx, 4
add rcx, qword [0x18005ff78]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800163e8
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1800163ea
cmp rax, rcx
je 0x1800163e8
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800163d7
jmp 0x1800163ea
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x180016414
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180020610
mov rcx, qword [rax]
mov byte [rcx + 0x14], 0
mov r8d, dword [rsp + 0x30]
mov ecx, r8d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
shr ebx, 0xf
and bl, 1
jne 0x180016469
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180020610
mov rcx, qword [rax]
cmp byte [rcx + 0x14], bl
je 0x180016469
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180020610
mov rcx, qword [rax]
mov al, 1
mov byte [rcx + 0x14], bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x40
pop rbx
ret
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.180020610
mov rcx, qword [rax]
xor al, al
mov byte [rcx + 0x14], bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x40
pop rbx
ret

Function at 0x1800171e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx + 0x30]
mov rdi, rcx
mov rcx, qword [rcx + 0x28]
call fcn.180017000
test al, al
je 0x180017245
mov ecx, 1
mov qword [rsp + 0x48], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov rcx, rdi
shr ebx, 0xf
and bl, 1
call fcn.180016870
movzx eax, bl
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.180016870
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x30
pop rdi
ret
Function at 0x180017260
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp qword [0x180060170], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
jne 0x18001729d
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180060170], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [0x180060170]
jne 0x18001736f
mov eax, dword [0x1800602bc]
test eax, eax
jg 0x180017367
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x30]
mov rbx, qword [0x18005f9b8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x30]
movss xmm4, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
movd xmm3, eax
shr rax, 0x20
cvtdq2ps xmm3, xmm3
movd xmm2, eax
comiss xmm3, xmm4
cvtdq2ps xmm2, xmm2
jbe 0x180017361
movss xmm1, dword [rsp + 0x24]
comiss xmm2, xmm1
jbe 0x180017361
movss xmm0, dword [rsp + 0x28]
addss xmm0, xmm4
comiss xmm0, xmm3
jbe 0x180017361
movss xmm0, dword [rsp + 0x2c]
addss xmm0, xmm1
comiss xmm0, xmm2
jbe 0x180017361
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180017361
mov dword [0x1800602bc], 0x1e
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x48
ret
mov eax, dword [0x1800602bc]
dec eax
mov dword [0x1800602bc], eax
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x48
ret
Function at 0x180017390
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x138
mov rax, qword [0x18005a080]
xor rax, rsp
mov qword [rsp + 0x110], rax
movsxd rax, dword [0x18005fb10]
test eax, eax
jle 0x18001761b
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
test rax, rax
cmovne rdx, qword [0x18005fb08]
call fcn.180016930
mov eax, dword [rsp + 0x30]
cmp dword [0x18005fd00], eax
jne 0x180017583
cmp dword [0x18005fb20], 0xffffffff
jne 0x180017583
mov ecx, dword [0x18005f498]
mov rax, qword gs:[0x58]
mov edx, 4
mov qword [rsp + 0x130], rbx
movaps xmmword [rsp + 0x120], xmm6
xorps xmm6, xmm6
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1800602c0], eax
jle 0x180017451
lea rcx, [0x1800602c0]
call fcn.18004c9bc
cmp dword [0x1800602c0], 0xffffffff
jne 0x180017451
lea rcx, [0x1800602c0]
mov qword [0x1800602c8], 0
call fcn.18004c950
mov rcx, qword [0x18005f550]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rcx]
call fcn.180017000
mov rcx, qword [0x18005f550]
movzx ebx, al
movss xmm1, dword [rsp + 0x6c]
movss xmm0, dword [rsp + 0x68]
unpcklps xmm0, xmm1
movss xmm2, dword [rcx + 4]
movq rdx, xmm0
movss xmm1, dword [rcx]
unpcklps xmm1, xmm2
movq rcx, xmm1
call fcn.180017000
test al, al
je 0x1800174af
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
jmp 0x1800174b4
movzx eax, byte [rsp + 0x20]
test bl, bl
je 0x180017568
test al, al
je 0x180017568
mov rbx, qword [0x18005f9b8]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x28]
movss xmm1, dword [0x1800602c8]
movd xmm2, eax
shr rax, 0x20
ucomiss xmm1, xmm6
movd xmm3, eax
mov rax, qword [0x18005f550]
cvtdq2ps xmm3, xmm3
cvtdq2ps xmm2, xmm2
subss xmm3, dword [rsp + 0x6c]
subss xmm2, dword [rsp + 0x68]
jp 0x18001754d
jne 0x18001754d
movss xmm0, dword [0x1800602cc]
ucomiss xmm0, xmm6
jp 0x180017555
jne 0x180017555
movaps xmm1, xmm2
movaps xmm0, xmm3
subss xmm1, dword [rax]
subss xmm0, dword [rax + 4]
movss dword [0x1800602c8], xmm1
movss dword [0x1800602cc], xmm0
jmp 0x180017555
movss xmm0, dword [0x1800602cc]
subss xmm2, xmm1
subss xmm3, xmm0
movss dword [rax], xmm2
movss dword [rax + 4], xmm3
jmp 0x180017573
mov qword [0x1800602c8], 0
mov rbx, qword [rsp + 0x130]
movaps xmm6, xmmword [rsp + 0x120]
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x1800175c2
mov rcx, qword [rsp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800175bd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001760f
call fcn.18004c45c
mov rdx, qword [rsp + 0x50]
movdqa xmm0, xmmword [0x180051830]
movdqa xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
cmp rdx, 0xf
jbe 0x18001761b
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180017616
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180017616
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004c45c
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.18004c400
add rsp, 0x138
ret
Function at 0x180020ad0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180020b01
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18005ff68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18005ff78]
lea rdx, [rdi + rdi]
call fcn.180020210
mov rax, qword [0x18005ff68]
lea r9, [rdi - 1]
mov qword [0x18005ff90], r9
mov qword [0x18005ff98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180020c74
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18005ff78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180020bc0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180020c35
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180020bfd
mov r10, qword [rdx]
cmp r10, rax
je 0x180020bf7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180020c35
cmp r9, rdx
je 0x180020c11
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180020c49
cmp r9, rdx
jne 0x180020c02
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180020c6f
mov r9, qword [0x18005ff90]
jmp 0x180020b71
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180020c35
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180021310
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180021341
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18005ff28]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18005ff38]
lea rdx, [rdi + rdi]
call fcn.180020210
mov rax, qword [0x18005ff28]
lea r9, [rdi - 1]
mov qword [0x18005ff50], r9
mov qword [0x18005ff58], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800214b4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18005ff38]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180021400
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180021475
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18002143d
mov r10, qword [rdx]
cmp r10, rax
je 0x180021437
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180021475
cmp r9, rdx
je 0x180021451
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180021489
cmp r9, rdx
jne 0x180021442
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800214af
mov r9, qword [0x18005ff50]
jmp 0x1800213b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180021475
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180021b50
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x1800601a8]
test rax, rax
jne 0x180021d1f
mov eax, dword [0x180050d28]
xor ecx, ecx
cmp dword [0x18005a0d0], 2
movsd xmm0, qword [0x180050d20]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x180050d2c]
mov qword [rsp + 0x50], rbx
mov byte [rsp + 0x3c], al
mov qword [rsp + 0x40], rdi
movsd qword [rsp + 0x30], xmm0
jl 0x180021ca3
movdqa xmm2, xmmword [0x180051840]
mov ecx, 8
movdqa xmm3, xmmword [0x180051850]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x180051ae0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800518c0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x180050d20]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800518c0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x34]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800518d0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800518f0]
xorps xmm2, xmm0
movd dword [rsp + 0x34], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x180021cb0
lea rcx, [rsp + 0x30]
call fcn.1800137d0
mov rcx, qword [0x18005f918]
mov r9, rax
mov rdi, rax
call fcn.18000ef00
mov edx, 2
mov rcx, rdi
mov rbx, rax
call fcn.18004c45c
mov rdi, qword [rsp + 0x40]
mov rax, rbx
mov qword [0x1800601a8], rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret