joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140037be0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, r8
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp rdx, 0xffffffffffffffff
je case.default.0x140037c22
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, eax
lea rcx, [0x140037dec]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140037d99
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000009
jmp 0x140037d43
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je case.default.0x140037c22
mov r9, qword [rsp + 0x4c]
mov rcx, qword [rsp + 0x40]
mov r10d, dword [rsp + 0x3c]
movdqu xmm0, xmmword [rsp + 0x2c]
pshufd xmm0, xmm0, 0xb1
mov ebx, dword [rsp + 0x20]
test bl, 1
mov r8d, 0x1ff
mov eax, 0x16d
cmove eax, r8d
mov edx, dword [rsp + 0x48]
and ebx, 0x10
cmp ebx, 1
mov ebx, 3
sbb ebx, 0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], rcx
mov dword [rdi + 0x18], ebx
mov dword [rdi + 0x1c], eax
mov dword [rdi + 0x20], edx
mov dword [rdi + 0x24], r10d
mov qword [rdi + 0x28], r9
jmp 0x140037d4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
and ecx, 0xfffffffe
pxor xmm0, xmm0
cmp ecx, 2
jne 0x140037cef
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi + 0x18], 1
jmp 0x140037d89
cmp eax, 0x20
jne 0x140037d80
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov dword [rdi + 0x18], 9
jmp 0x140037d89
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000006
jmp 0x140037d43
pxor xmm0, xmm0
movdqu xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
movabs rax, 0xffff00000007
mov qword [rdi + 0x18], rax
movdqu xmmword [rdi + 0x20], xmm0
mov dword [rsi], 0
mov eax, dword [0x14019c710]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x140037dbb
lea rax, [0x14019a518]
mov qword [rsi + 8], rax
jmp 0x140037da3
movdqu xmmword [rdi + 0xc], xmm0
movdqu xmmword [rdi], xmm0
mov dword [rdi + 0x1c], 0xffff
pxor xmm0, xmm0
movdqu xmmword [rdi + 0x20], xmm0
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x14019c710]
call fcn.14016a3dc
cmp dword [0x14019c710], 0xffffffff
jne 0x140037d73
lea rcx, [0x14003a600]
call fcn.14016a724
lea rcx, [0x14019c710]
call fcn.14016a37c
jmp 0x140037d73
Function at 0x140038170
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400381ec
mov rax, qword [rsi]
cmp rax, 2
jae 0x140038201
mov dil, 1
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test dil, dil
jne 0x1400381e2
cmp dword [rsi + 0x18], 1
jne 0x1400381e2
mov eax, dword [0x14019db60]
mov ecx, dword [0x14019dd7c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x14]
jg 0x14003824c
cmp byte [0x14019db5c], 0
je 0x1400381e2
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, qword [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14016a260
nop
add rsp, 0x38
pop rdi
pop rsi
ret
movzx edi, word [rcx]
xor edx, edx
cmp edi, 0x5a4d
setne r8b
cmp rax, 0x40
jb 0x14003819a
mov dl, r8b
test edx, edx
jne 0x14003819a
mov edx, dword [rcx + 0x3c]
cmp rax, rdx
cmovb rdx, rax
sub rax, rdx
cmp rax, 4
jb 0x14003819a
cmp dword [rcx + rdx], 0x4550
jne 0x14003819a
xor edi, edi
jmp 0x14003819d
lea rcx, [0x14019db60]
call fcn.14016a3dc
cmp dword [0x14019db60], 0xffffffff
jne 0x1400381cf
lea rcx, [rsp + 0x20]
call fcn.140030840
mov ecx, dword [rsp + 0x20]
mov al, 1
cmp ecx, 0xa
jb 0x1400382aa
xor eax, eax
cmp ecx, 0xa
jne 0x1400382aa
mov ecx, 0x7fffffff
and ecx, dword [rsp + 0x24]
jne 0x1400382aa
mov eax, dword [rsp + 0x2c]
and eax, 0x7fffffff
test dword [rsp + 0x28], 0x7fffffff
sete cl
cmp eax, 0x4563
setb al
and al, cl
mov byte [0x14019db5c], al
lea rcx, [0x14019db60]
call fcn.14016a37c
jmp 0x1400381cf

Function at 0x1400382e0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14016a260
mov eax, esi
add rsp, 0x60
pop rsi
ret
Function at 0x140038d70
Capabilities:
Timestomp file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
mov eax, r9d
mov rsi, rcx
mov ebx, dword [rsp + 0x110]
mov rcx, qword [0x14019ac40]
xor rcx, rsp
mov qword [rsp + 0xc8], rcx
mov r9d, 4
test bl, 2
jne 0x140038db2
movsxd rcx, r8d
lea rdi, [0x14016f954]
mov r9d, dword [rdi + rcx*4]
mov ecx, eax
shl ecx, 0x1f
and eax, 2
shl eax, 0x1d
or eax, ecx
mov ecx, ebx
and ecx, 4
shl ecx, 0xe
or ecx, eax
mov eax, ebx
and eax, 0x10
shl eax, 4
or eax, ecx
mov ecx, ebx
and ecx, 8
shr ecx, 3
mov byte [rsp + 0x30], cl
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0xb0]
lea r8, [rsp + 0xc0]
call fcn.140038f90
cmp dword [rsp + 0xb0], 0
je 0x140038e68
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0xa8]
lea rdx, [rsp + 0x90]
call fcn.140029810
or byte [rsi + 8], 1
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], 0
mov qword [rsi], rax
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
add rsp, 0xd0
pop rbx
pop rdi
pop rsi
ret
test bl, 0x10
je 0x140038eba
lea rdi, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov rdi, qword [rsp + 0xc0]
test eax, eax
je 0x140038f40
lea r8, [rsp + 0x88]
mov rcx, rdi
xor edx, edx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
je 0x140038f40
test bl, 4
jne 0x140038ec9
mov rdi, qword [rsp + 0xc0]
jmp 0x140038f34
mov rdi, qword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
mov rdx, rdi
mov r8b, 1
call fcn.140039240
movups xmm0, xmmword [rsp + 0x78]
movaps xmmword [rsp + 0xb0], xmm0
cmp dword [rsp + 0xb0], 0
je 0x140038f34
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
call fcn.140029810
or byte [rsi + 8], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], 0
jmp 0x140038e47
and byte [rsi + 8], 0xfe
mov qword [rsi], rdi
jmp 0x140038e4a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rsp + 0x60]
mov rcx, rdi
mov edx, ebx
call fcn.14002e8d0
lea rcx, [rsp + 0x70]
mov rdx, rdi
call fcn.140029810
or byte [rsi + 8], 1
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x70], 0
jmp 0x140038e47
Function at 0x140039770
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rcx, qword [r8 + 8]
mov eax, 0xffffffff
cmp rcx, rax
mov eax, 0xffffffff
cmovb eax, ecx
mov dword [rsp + 0x4c], 0
mov rdx, qword [r8]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x4c]
mov rcx, rsi
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400397e6
and byte [rdi + 8], 0xfe
mov eax, dword [rsp + 0x4c]
mov qword [rdi], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14016a260
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x1400397c4
cmp eax, 0x26
je 0x1400397c4
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov edx, eax
call fcn.14002e8d0
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.140029810
or byte [rdi + 8], 1
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], 0
jmp 0x1400397cc

Function at 0x140039980
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x100
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0xf8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x140039ac5
mov rsi, rcx
mov rdx, qword [rcx]
cmp byte [rdx], 0x7e
jne 0x140039ac5
mov rdi, 0xffffffffffffffff
add rax, 0xffffffffffffffff
je 0x1400399ed
xor ecx, ecx
nop word [rax + rax]
movzx ebx, byte [rdx + rcx + 1]
cmp bl, 0x5c
je 0x1400399ea
cmp bl, 0x2f
je 0x1400399ea
add rcx, 1
cmp rax, rcx
jne 0x1400399d0
jmp 0x1400399ed
mov rdi, rcx
cmp rax, rdi
cmovb rdi, rax
test rdi, rdi
jne 0x140039ac5
lea rbx, [rsp + 0x60]
mov qword [rsp + 0x48], rbx
movaps xmm0, xmmword [0x14016ddb0]
movups xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [0x140192ae8]
movaps xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0xe0]
lea r9, [rsp + 0x40]
mov edx, 0x8000
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140039ab5
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov edx, 0xfde9
mov r8, rdi
mov r9, rax
call fcn.140039f50
mov edi, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
test edi, edi
jne 0x140039ab5
mov rax, qword [rsp + 0x48]
mov al, byte [rax]
mov rcx, qword [rsi]
mov byte [rcx], al
mov r8, qword [rsp + 0x48]
mov r9, qword [rsp + 0x50]
add r9, r8
add r8, 1
mov rdx, qword [rsi]
add rdx, 1
mov rcx, rsi
call fcn.14003a2b0
mov rcx, qword [rsp + 0x48]
cmp rcx, rbx
je 0x140039ac5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0xf8]
xor rcx, rsp
call fcn.14016a260
nop
add rsp, 0x100
pop rbx
pop rdi
pop rsi
ret
Function at 0x140050850
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, dword [rcx + 8]
lea r8, [rax + 0x3f]
shr r8, 6
je 0x1400509a5
mov r9, qword [rdx]
mov rsi, qword [rcx]
cmp eax, 0xc1
jb 0x140050881
lea rax, [r9 + r8*8]
cmp rsi, rax
jae 0x1400508f4
lea rax, [rsi + r8*8]
cmp r9, rax
jae 0x1400508f4
xor eax, eax
mov r10, rax
not r10
add r10, r8
mov rdx, r8
and rdx, 3
je 0x1400508b2
nop word cs:[rax + rax]
nop
mov rcx, qword [r9 + rax*8]
xor qword [rsi + rax*8], rcx
add rax, 1
add rdx, 0xffffffffffffffff
jne 0x1400508a0
cmp r10, 3
jb 0x1400509a5
nop dword [rax]
mov rcx, qword [r9 + rax*8]
xor qword [rsi + rax*8], rcx
mov rcx, qword [r9 + rax*8 + 8]
xor qword [rsi + rax*8 + 8], rcx
mov rcx, qword [r9 + rax*8 + 0x10]
xor qword [rsi + rax*8 + 0x10], rcx
mov rcx, qword [r9 + rax*8 + 0x18]
xor qword [rsi + rax*8 + 0x18], rcx
add rax, 4
cmp r8, rax
jne 0x1400508c0
jmp 0x1400509a5
mov eax, r8d
and eax, 0xfffffffc
lea rdx, [rax - 4]
mov r10, rdx
shr r10, 2
add r10, 1
test rdx, rdx
je 0x1400509a7
mov r11, r10
and r11, 0xfffffffffffffffe
neg r11
xor edx, edx
nop
movups xmm0, xmmword [r9 + rdx*8]
movups xmm1, xmmword [r9 + rdx*8 + 0x10]
movups xmm2, xmmword [rsi + rdx*8]
xorps xmm2, xmm0
movups xmm0, xmmword [rsi + rdx*8 + 0x10]
xorps xmm0, xmm1
movups xmm1, xmmword [rsi + rdx*8 + 0x20]
movups xmm3, xmmword [rsi + rdx*8 + 0x30]
movups xmmword [rsi + rdx*8], xmm2
movups xmmword [rsi + rdx*8 + 0x10], xmm0
movups xmm0, xmmword [r9 + rdx*8 + 0x20]
xorps xmm0, xmm1
movups xmm1, xmmword [r9 + rdx*8 + 0x30]
xorps xmm1, xmm3
movups xmmword [rsi + rdx*8 + 0x20], xmm0
movups xmmword [rsi + rdx*8 + 0x30], xmm1
add rdx, 8
add r11, 2
jne 0x140050920
test r10b, 1
je 0x14005099c
movups xmm0, xmmword [r9 + rdx*8]
movups xmm1, xmmword [r9 + rdx*8 + 0x10]
movups xmm2, xmmword [rsi + rdx*8]
xorps xmm2, xmm0
movups xmm0, xmmword [rsi + rdx*8 + 0x10]
xorps xmm0, xmm1
movups xmmword [rsi + rdx*8], xmm2
movups xmmword [rsi + rdx*8 + 0x10], xmm0
cmp r8, rax
jne 0x140050883
pop rsi
ret
xor edx, edx
test r10b, 1
jne 0x140050979
jmp 0x14005099c
Function at 0x1400534b0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rcx
mov ecx, dword [rcx + 8]
cmp rcx, 0x40
ja 0x1400534cf
mov rax, qword [r8]
not rax
neg cl
shl rax, cl
shr rax, cl
jmp 0x1400535d0
mov r10, rcx
add r10, 0x3f
shr r10, 6
mov r11, qword [r8]
cmp ecx, 0xc1
jae 0x1400534ec
xor ecx, ecx
jmp 0x1400535a8
mov ecx, r10d
and ecx, 0xfffffffc
lea rax, [rcx - 4]
mov r9, rax
shr r9, 2
add r9, 1
test rax, rax
je 0x140053578
mov rax, r9
and rax, 0xfffffffffffffffe
neg rax
xor edx, edx
pcmpeqd xmm0, xmm0
nop word cs:[rax + rax]
movdqu xmm1, xmmword [r11 + rdx*8]
movdqu xmm2, xmmword [r11 + rdx*8 + 0x10]
movdqu xmm3, xmmword [r11 + rdx*8 + 0x20]
movdqu xmm4, xmmword [r11 + rdx*8 + 0x30]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r11 + rdx*8], xmm1
movdqu xmmword [r11 + rdx*8 + 0x10], xmm2
pxor xmm3, xmm0
pxor xmm4, xmm0
movdqu xmmword [r11 + rdx*8 + 0x20], xmm3
movdqu xmmword [r11 + rdx*8 + 0x30], xmm4
add rdx, 8
add rax, 2
jne 0x140053520
test r9b, 1
jne 0x140053580
jmp 0x1400535b0
xor edx, edx
test r9b, 1
je 0x1400535b0
movdqu xmm0, xmmword [r11 + rdx*8]
movdqu xmm1, xmmword [r11 + rdx*8 + 0x10]
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [r11 + rdx*8], xmm0
movdqu xmmword [r11 + rdx*8 + 0x10], xmm1
jmp 0x1400535b0
not qword [r11 + rcx*8]
add rcx, 1
cmp r10, rcx
jne 0x1400535a8
mov edx, dword [r8 + 8]
mov ecx, edx
neg cl
mov rax, 0xffffffffffffffff
shr rax, cl
cmp rdx, 0x40
ja 0x140053609
and rax, qword [r8]
mov qword [r8], rax
add qword [r8], 1
mov ecx, dword [r8 + 8]
cmp rcx, 0x40
jbe 0x1400535fa
lea rax, [rcx + 0x3f]
shr rax, 6
mov edx, 0xffffffff
add eax, edx
shl rax, 3
add rax, qword [r8]
mov r8, rax
neg cl
mov rax, qword [r8]
shl rax, cl
shr rax, cl
mov qword [r8], rax
ret
mov r9, qword [r8]
add rdx, 0x3f
shr rdx, 6
mov ecx, 0xffffffff
add edx, ecx
and qword [r9 + rdx*8], rax
mov eax, dword [r8 + 8]
cmp rax, 0x41
jb 0x1400535d3
mov rcx, qword [r8]
add qword [rcx], 1
jne 0x1400535d7
add rax, 0x3f
shr rax, 6
mov edx, 1
nop
cmp rax, rdx
je 0x1400535d7
add qword [rcx + rdx*8], 1
lea rdx, [rdx + 1]
je 0x140053640
jmp 0x1400535d7
Function at 0x1400692c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x190
movaps xmmword [rsp + 0x180], xmm7
movaps xmmword [rsp + 0x170], xmm6
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14019ac40]
xor rax, rsp
mov qword [rsp + 0x168], rax
call fcn.140067a20
mov dword [rsi + 0x118], 0
cmp bl, 4
je 0x140069513
cmp bl, 3
jne 0x14006951d
mov byte [rsi + 0x22], 1
mov byte [rsi + 0x62], 1
mov dword [rsi + 0x90], 8
mov dword [rsi + 0x180], 4
movaps xmm0, xmmword [0x14018c240]
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x28], 0x72646e61
mov dword [rsp + 0x2b], 0x64696f72
mov byte [rsp + 0x2f], 0
movaps xmm0, xmmword [0x14018c2b0]
movups xmmword [rsp + 0x58], xmm0
movabs rax, 0x7864696f72646e61
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x50], 0
movaps xmm0, xmmword [0x14018c2d0]
movups xmmword [rsp + 0x78], xmm0
mov dword [rsp + 0x68], 0x6d6f63
movaps xmm1, xmmword [0x14018c2a0]
movups xmmword [rsp + 0x98], xmm1
mov dword [rsp + 0x88], 0x766c6164
mov word [rsp + 0x8c], 0x6b69
mov byte [rsp + 0x8e], 0
movaps xmm7, xmmword [0x14018c2e0]
movups xmmword [rsp + 0xb8], xmm7
mov dword [rsp + 0xa8], 0x696e756a
mov word [rsp + 0xac], 0x74
movups xmmword [rsp + 0xd8], xmm0
mov byte [rsp + 0xca], 0x67
mov word [rsp + 0xc8], 0x726f
mov byte [rsp + 0xcb], 0
lea rcx, [rsp + 0xe8]
movaps xmm6, xmmword [0x14016c7a0]
movups xmmword [rsp + 0xf8], xmm6
mov byte [rsp + 0xe8], 0
lea r9, str.com.google.android.apps.chrome
mov edx, 0x1e
call fcn.1400058f0
movaps xmm0, xmmword [0x14018c250]
movups xmmword [rsp + 0x118], xmm0
movabs rax, 0x6f7268632e67726f
mov qword [rsp + 0x108], rax
mov dword [rsp + 0x110], 0x6d75696d
mov byte [rsp + 0x114], 0
movaps xmm0, xmmword [0x14018c2c0]
movups xmmword [rsp + 0x138], xmm0
mov dword [rsp + 0x128], 0x6176616a
mov byte [rsp + 0x12c], 0
movups xmmword [rsp + 0x158], xmm7
mov dword [rsp + 0x148], 0x6176616a
mov word [rsp + 0x14c], 0x78
lea r8, [rsp + 0x168]
lea rcx, [rsi + 0x188]
lea rdx, [rsp + 0x28]
call fcn.140076e60
mov edi, 0x120
jmp 0x1400694d9
call fcn.14016a23c
movups xmmword [rsp + rdi + 0x38], xmm6
mov byte [rsp + rdi + 0x28], 0
add rdi, 0xffffffffffffffe0
cmp rdi, 0xffffffffffffffe0
je 0x140069544
mov rax, qword [rsp + rdi + 0x40]
cmp rax, 0x10
jb 0x1400694c5
mov rcx, qword [rsp + rdi + 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400694c0
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140069579
add rax, 0x28
mov rdx, rax
mov rcx, rbx
jmp 0x1400694c0
mov byte [rsi + 0x22], 0
mov byte [rsi + 0x24], 0
jmp 0x14006954b
mov byte [rsi + 0x1d], 0
mov word [rsi + 0x21], 3
mov byte [rsi + 0x24], 0
mov byte [rsi + 0x4a], 0
mov byte [rsi + 0x96], 0
cmp bl, 5
jne 0x14006954b
mov dword [rsi + 0x64], 0x50
jmp 0x14006954b
mov byte [rsi + 0x239], 1
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.14016a260
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x170]
movaps xmm7, xmmword [rsp + 0x180]
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400b7b80
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400b7d6e
mov r15, rcx
add rdx, 0xffffffffffffffff
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea r14, [r15 + 0x18]
mov r12, qword [r15 + 8]
lea rdx, [rsi + rsi]
mov rcx, r14
mov r8, r12
call fcn.1400b7540
lea rdi, [rsi - 1]
mov qword [r15 + 0x30], rdi
mov qword [r15 + 0x38], rsi
mov rax, qword [r15 + 8]
mov rdx, qword [rax]
cmp rdx, r12
je 0x1400b7d60
movabs r9, 0x100000001b3
movabs r8, 0xcbf29ce484222325
jmp 0x1400b7c28
mov qword [rdi + r10*8], rdx
mov qword [rdi + rax*8], rdx
cmp r11, r12
je 0x1400b7d60
mov rdi, qword [r15 + 0x30]
mov rdx, r11
mov r11, qword [rdx]
movzx eax, byte [rdx + 0x10]
xor rax, r8
imul rax, r9
movzx ecx, byte [rdx + 0x11]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + 0x12]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + 0x13]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + 0x14]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + 0x15]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + 0x16]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + 0x17]
xor rcx, rax
imul rcx, r9
and rcx, rdi
mov rdi, qword [r14]
lea r10, [rcx + rcx]
lea rax, [rcx + rcx]
add rax, 1
shl rcx, 4
mov rbx, qword [rdi + rcx]
cmp rbx, r12
je 0x1400b7c10
mov rsi, qword [rdi + rax*8]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rsi + 0x10]
je 0x1400b7d00
nop word cs:[rax + rax]
nop
cmp rbx, rsi
je 0x1400b7d32
mov rsi, qword [rsi + 8]
cmp rcx, qword [rsi + 0x10]
jne 0x1400b7cc0
mov rax, qword [rsi]
mov rcx, qword [rdx + 8]
mov qword [rcx], r11
mov rbx, qword [r11 + 8]
mov qword [rbx], rax
mov rdi, qword [rax + 8]
mov qword [rdi], rdx
mov qword [rax + 8], rbx
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rdi
cmp r11, r12
jne 0x1400b7c21
jmp 0x1400b7d60
mov rcx, qword [rsi]
cmp rcx, rdx
je 0x1400b7c14
mov r10, qword [rdx + 8]
mov qword [r10], r11
mov rsi, qword [r11 + 8]
mov qword [rsi], rcx
mov rbx, qword [rcx + 8]
mov qword [rbx], rdx
mov qword [rcx + 8], rsi
mov qword [r11 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400b7c14
mov rax, qword [rdx + 8]
mov qword [rax], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rbx
mov rsi, qword [rbx + 8]
mov qword [rsi], rdx
mov qword [rbx + 8], rcx
mov qword [r11 + 8], rax
mov qword [rdx + 8], rsi
mov qword [rdi + r10*8], rdx
cmp r11, r12
jne 0x1400b7c21
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400b7d80
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbp, rdx
cmp rdx, r8
je 0x1400b7e96
mov rsi, r8
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
mov rax, qword [r14 + 8]
mov qword [rsp + 0x28], rax
mov rdx, qword [r14 + 0x18]
movzx eax, byte [rbp + 0x10]
xor rax, rcx
imul rax, rbx
movzx ecx, byte [rbp + 0x11]
xor rcx, rax
imul rcx, rbx
movzx eax, byte [rbp + 0x12]
xor rax, rcx
imul rax, rbx
movzx ecx, byte [rbp + 0x13]
xor rcx, rax
imul rcx, rbx
movzx eax, byte [rbp + 0x14]
xor rax, rcx
imul rax, rbx
movzx ecx, byte [rbp + 0x15]
xor rcx, rax
imul rcx, rbx
movzx eax, byte [rbp + 0x16]
xor rax, rcx
imul rax, rbx
movzx ecx, byte [rbp + 0x17]
xor rcx, rax
imul rcx, rbx
and rcx, qword [r14 + 0x30]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x38], rax
lea rax, [rcx + rcx]
lea rbx, [rcx + rcx]
add rbx, 1
mov qword [rsp + 0x40], rbx
shl rcx, 4
mov r12, qword [rdx + rcx]
cmp r12, rbp
setne r13b
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], rax
mov r15, qword [rdx + rax*8 + 8]
mov rbx, rbp
nop word [rax + rax]
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
mov rcx, rdi
call fcn.14016a23c
add qword [r14 + 0x10], 0xffffffffffffffff
cmp rdi, r15
je 0x1400b7e9e
cmp rbx, rsi
setne al
or al, r13b
je 0x1400b7fa1
cmp rbx, rsi
jne 0x1400b7e60
jmp 0x1400b7fba
mov rsi, rbp
jmp 0x1400b7fc6
mov rax, qword [rsp + 0x38]
cmp r12, rbp
jne 0x1400b7ebe
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov qword [rax + rdx*8], rcx
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rdx*8], rax
cmp rbx, rsi
je 0x1400b7fba
movzx eax, byte [rbx + 0x10]
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rdx, 0x100000001b3
imul rax, rdx
movzx ecx, byte [rbx + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x12]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x13]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x14]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x15]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x16]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x17]
xor rcx, rax
imul rcx, rdx
and rcx, qword [r14 + 0x30]
lea r12, [rcx + rcx]
lea r15, [rcx + rcx]
add r15, 1
mov rax, qword [rsp + 0x20]
mov rbp, qword [rax + r12*8 + 8]
nop dword [rax + rax]
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
mov rcx, rdi
call fcn.14016a23c
add qword [r14 + 0x10], 0xffffffffffffffff
cmp rdi, rbp
je 0x1400b7f84
cmp rbx, rsi
jne 0x1400b7f60
jmp 0x1400b7fb1
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rax + r12*8], rcx
mov qword [rax + r15*8], rcx
cmp rbx, rsi
jne 0x1400b7ed5
jmp 0x1400b7fba
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov qword [rax + rcx*8], rsi
jmp 0x1400b7fba
mov rax, qword [rsp + 0x20]
mov qword [rax + r12*8], rsi
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret