joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401bf780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbp, r8
mov r15, rdx
mov r9, rcx
cmp rdx, r8
je 0x1401bf927
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r12, qword [rcx + 0x18]
lea rcx, [rdx + 0x10]
cmp qword [rcx + 0x18], 8
mov r14, qword [rdx + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x80], rax
jb 0x1401bf7d0
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
add r10, r10
je 0x1401bf800
movzx eax, byte [r8 + rcx]
inc r8
xor rdx, rax
imul rdx, r11
cmp r8, r10
jb 0x1401bf7ec
mov r13, qword [r9 + 0x30]
and r13, rdx
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x78], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.14019e8f0
mov edx, 0x40
mov rcx, rbx
call fcn.140016264
mov r8, qword [rsp + 0x70]
dec qword [r8 + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1401bf86b
cmp rsi, rbp
jne 0x1401bf820
cmp qword [rsp + 0x78], r15
jne 0x1401bf920
mov qword [r12 + r13*8], rsi
jmp 0x1401bf920
cmp qword [rsp + 0x78], r15
jne 0x1401bf883
mov rdx, qword [rsp + 0x80]
mov qword [r12 + r13*8], rdx
mov rax, rdx
jmp 0x1401bf886
mov rax, r14
mov qword [r12 + r13*8 + 8], rax
cmp rsi, rbp
je 0x1401bf920
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 8
mov r10, qword [rcx + 0x10]
jb 0x1401bf8a6
mov rcx, qword [rcx]
xor r9d, r9d
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x1401bf8db
movabs r8, 0x100000001b3
movzx eax, byte [r9 + rcx]
inc r9
xor rdx, rax
imul rdx, r8
cmp r9, r10
jb 0x1401bf8c2
mov r8, qword [rsp + 0x70]
mov r15, qword [r8 + 0x30]
and r15, rdx
add r15, r15
mov r13, qword [r12 + r15*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.14019e8f0
mov edx, 0x40
mov rcx, rbx
call fcn.140016264
mov r8, qword [rsp + 0x70]
dec qword [r8 + 0x10]
cmp rbx, r13
je 0x1401bf93b
cmp rsi, rbp
jne 0x1401bf8ea
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [rsp + 0x80]
mov qword [r12 + r15*8], rax
mov qword [r12 + r15*8 + 8], rax
jmp 0x1401bf88b
Function at 0x1401c30e0
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x1401c326c
cmp ecx, 0x7c
je 0x1401c326c
cmp ecx, 0x29
jne 0x1401c3123
cmp dword [rbx + 0x1c], 0
jne 0x1401c326c
test dword [rbx + 0x80], 0x10000000
je 0x1401c3298
cmp ecx, 0x2e
jne 0x1401c3143
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1401c33b0
mov rcx, rbx
call fcn.1401c30a4
jmp 0x1401c325a
cmp ecx, 0x5c
jne 0x1401c31a7
mov rcx, rbx
call fcn.1401c30a4
test byte [rbx + 0x80], 0x80
je 0x1401c319a
cmp word [rbx + 0x78], 0x62
jne 0x1401c317b
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1401c33b0
mov rcx, rbx
call fcn.1401c30a4
jmp 0x1401c3262
cmp word [rbx + 0x78], 0x42
jne 0x1401c319a
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1401c33b0
mov rax, qword [rbx + 0x48]
xor dword [rax + 0xc], 1
jmp 0x1401c316e
mov rcx, rbx
call fcn.1401c84f4
jmp 0x1401c325a
cmp ecx, 0x5b
jne 0x1401c31cb
mov rcx, rbx
call fcn.1401c30a4
mov rcx, rbx
call fcn.1401c83a4
cmp dword [rbx + 0x7c], 0x5d
jne 0x1401c3282
jmp 0x1401c3136
cmp ecx, 0x28
jne 0x1401c31ef
mov rcx, rbx
call fcn.1401c30a4
mov rcx, rbx
call fcn.1401c8634
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x1401c328d
jmp 0x1401c324d
cmp ecx, 0x5e
jne 0x1401c31fc
lea edx, [rcx - 0x5c]
jmp 0x1401c3165
cmp ecx, 0x24
jne 0x1401c3209
lea edx, [rcx - 0x21]
jmp 0x1401c3165
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1401c3277
cmp ecx, 0x3f
je 0x1401c3277
cmp ecx, 0x7b
je 0x1401c3277
cmp ecx, 0x7d
jne 0x1401c322c
test dword [rbx + 0x80], 0x10000000
je 0x1401c32a3
cmp ecx, 0x5d
jne 0x1401c323d
test dword [rbx + 0x80], 0x10000000
je 0x1401c32ae
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1401c8868
mov dil, 1
mov rcx, rbx
call fcn.1401c30a4
test dil, dil
je 0x1401c3262
mov rcx, rbx
call fcn.1401c872c
mov ecx, dword [rbx + 0x7c]
mov al, 1
jmp 0x1401c30f2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
call fcn.1401bfcc8
int3
mov edx, 4
call fcn.1401bfcc8
int3
mov edx, 5
call fcn.1401bfcc8
int3
mov edx, 5
call fcn.1401bfcc8
int3
mov edx, 6
call fcn.1401bfcc8
int3
mov edx, 4
call fcn.1401bfcc8
int3
Function at 0x1401e34e4
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x14029f3b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
lea rax, [rdx + 0x10]
xor esi, esi
cmp rdx, rax
jne 0x1401e3536
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
jmp 0x1401e35cd
mov dword [rbp - 0x19], esi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea edx, [r9 + 0x10]
mov r8d, 0x40000001
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x1401e3616
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], si
mov edx, dword [rbp - 0x19]
lea rax, [rbp + 0x27]
mov qword [rbp - 0x11], rax
lea rcx, [rbp + 0x27]
call fcn.14002a1e8
lea r9, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r9, qword [rbp + 0x27]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov edx, 0x10
mov r8d, 0x40000001
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebx, eax
lea rcx, [rbp - 0x11]
call fcn.1400670b8
test ebx, ebx
je 0x1401e35f5
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140220ed0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.crypt_binary_to_string
lea rcx, [rbp + 0xf]
call fcn.140021538
lea rdx, [0x140294698]
lea rcx, [rbp + 0xf]
call fcn.1402230c0
nop
lea rdx, str.crypt_binary_to_string
lea rcx, [rbp - 9]
call fcn.140021538
lea rdx, [0x140294698]
lea rcx, [rbp - 9]
call fcn.1402230c0
int3
Function at 0x1401e3638
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov rax, qword [0x14029f3b8]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x11], rcx
lea rax, [rdx + 8]
xor esi, esi
cmp rdx, rax
jne 0x1401e368a
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
jmp 0x1401e3721
mov dword [rbp - 0x19], esi
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea edx, [r9 + 8]
mov r8d, 0x40000001
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
je 0x1401e376a
mov qword [rbp + 0x37], rsi
mov qword [rbp + 0x3f], 7
mov word [rbp + 0x27], si
mov edx, dword [rbp - 0x19]
lea rax, [rbp + 0x27]
mov qword [rbp - 0x11], rax
lea rcx, [rbp + 0x27]
call fcn.14002a1e8
lea r9, [rbp + 0x27]
cmp qword [rbp + 0x3f], 8
cmovae r9, qword [rbp + 0x27]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov edx, 8
mov r8d, 0x40000001
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
mov ebx, eax
lea rcx, [rbp - 0x11]
call fcn.1400670b8
test ebx, ebx
je 0x1401e3749
movups xmm0, xmmword [rbp + 0x27]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp + 0x37]
movups xmmword [rdi + 0x10], xmm1
mov rax, rdi
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140220ed0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
lea rdx, str.crypt_binary_to_string
lea rcx, [rbp + 0xf]
call fcn.140021538
lea rdx, [0x140294698]
lea rcx, [rbp + 0xf]
call fcn.1402230c0
nop
lea rdx, str.crypt_binary_to_string
lea rcx, [rbp - 9]
call fcn.140021538
lea rdx, [0x140294698]
lea rcx, [rbp - 9]
call fcn.1402230c0
int3
Function at 0x1401ecf14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov r8, qword [r8]
xor r14d, r14d
mov rsi, rdx
mov dword [rbp - 0x29], r14d
mov rdi, rcx
mov r10, r8
cmp qword [r8 + 0x18], 8
mov rdx, qword [r8 + 0x10]
jb 0x1401ecf54
mov r10, qword [r8]
movabs r9, 0xcbf29ce484222325
mov rcx, r14
add rdx, rdx
je 0x1401ecf84
movzx eax, byte [rcx + r10]
movabs r11, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r11
cmp rcx, rdx
jb 0x1401ecf66
lea rdx, [rbp - 0x21]
mov rcx, rsi
call fcn.1401c0d28
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1401ecfc5
cmp rbx, qword [rsi + 8]
je 0x1401ecfc5
lea rdx, [rbx + 0x30]
lea rcx, [rbp + 0x1f]
call fcn.140011d38
movsd xmm0, qword [rbx + 0x50]
lea rax, [rbp + 0x1f]
movsd qword [rbp + 0x3f], xmm0
mov ebx, 0x34
mov byte [rbp + 0x47], 1
jmp 0x1401ecfd2
mov byte [rbp + 0x17], r14b
lea rax, [rbp - 0x11]
mov ebx, 0x18
mov byte [rdi + 0x28], r14b
cmp byte [rax + 0x28], r14b
je 0x1401ed006
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
movups xmmword [rdi], xmm0
mov qword [rax + 0x18], 7
movups xmmword [rdi + 0x10], xmm1
mov word [rax], r14w
mov rax, qword [rax + 0x20]
mov qword [rdi + 0x20], rax
mov byte [rdi + 0x28], 1
test bl, 8
je 0x1401ed041
and ebx, 0xfffffff7
cmp byte [rbp + 0x17], r14b
je 0x1401ed041
mov rdx, qword [rbp + 7]
cmp rdx, 8
jb 0x1401ed02f
mov rcx, qword [rbp - 0x11]
lea rdx, [rdx*2 + 2]
call fcn.140016264
movdqa xmm0, xmmword [0x14025c2d0]
movdqu xmmword [rbp - 1], xmm0
mov word [rbp - 0x11], r14w
test bl, 4
je 0x1401ed067
cmp byte [rbp + 0x47], r14b
je 0x1401ed067
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x1401ed067
mov rcx, qword [rbp + 0x1f]
lea rdx, [rdx*2 + 2]
call fcn.140016264
lea r11, [rsp + 0xa0]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401ee208
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x14029f3b8]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
mov rax, rdx
cmp qword [rdx + 0x18], 8
mov rbx, rcx
mov qword [rsp + 0x30], rsi
jb 0x1401ee247
mov rax, qword [rdx]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov r14d, 0x1c
mov rcx, rax
mov edx, r14d
xor r9d, r9d
mov r8d, 0x6000
call qword [sym.imp.DNSAPI.dll_DnsQuery_W]
cmp eax, 0x25e5
jne 0x1401ee29b
movups xmm0, xmmword [rsp + 0x38]
mov byte [rsp + 0x58], sil
movups xmm1, xmmword [rsp + 0x48]
mov ecx, dword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x20], ecx
mov byte [rbx + 0x30], sil
jmp 0x1401ee30e
test eax, eax
je 0x1401ee2be
movups xmm0, xmmword [rsp + 0x38]
mov byte [rsp + 0x58], sil
movups xmm1, xmmword [rsp + 0x48]
mov eax, dword [rsp + 0x58]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x20], eax
jmp 0x1401ee295
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x68], sil
jmp 0x1401ee2de
cmp word [rdi + 0x10], r14w
je 0x1401ee335
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rdi
test rdi, rdi
jne 0x1401ee2cf
movups xmm0, xmmword [rsp + 0x38]
mov byte [rsp + 0x58], sil
movups xmm1, xmmword [rsp + 0x48]
mov eax, dword [rsp + 0x58]
movups xmmword [rbx], xmm0
mov byte [rbx + 0x30], sil
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x20], eax
lea rcx, [rsp + 0x60]
call fcn.1401ee8e4
mov rax, rbx
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140220ed0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor edx, edx
lea rcx, [rbp - 0x1e]
lea r8d, [rdx + 0x7e]
call fcn.140222f30
cmp dword [rdi + 0x28], 0xffff0000
jne 0x1401ee368
cmp dword [rdi + 0x24], esi
jne 0x1401ee368
cmp dword [rdi + 0x20], esi
jne 0x1401ee368
mov eax, 2
mov word [rbp - 0x20], ax
mov eax, dword [rdi + 0x2c]
mov dword [rbp - 0x1c], eax
jmp 0x1401ee38e
mov eax, 0x17
lea rcx, [rbp - 0x18]
add rdi, 0x20
mov word [rbp - 0x20], ax
sub rcx, rdi
lea edx, [rax - 0x13]
mov eax, dword [rdi]
mov dword [rcx + rdi], eax
lea rdi, [rdi + 4]
sub rdx, 1
jne 0x1401ee37f
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x38]
call fcn.1400e6874
lea rdx, [rbp - 0x58]
mov rcx, rbx
movups xmm1, xmmword [rax]
movups xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax + 0x10]
mov byte [rbp - 0x60], sil
movups xmmword [rbp - 0x58], xmm1
mov byte [rbp - 0x28], sil
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x48], xmm0
call fcn.1401ee9ec
movsx rax, byte [rbp - 0x60]
add rax, 1
je 0x1401ee304
cmp rax, 1
je 0x1401ee304
lea rcx, [rbp - 0x70]
call fcn.140029ef4
lea rcx, [rbp - 0x80]
call fcn.14002a14c
jmp 0x1401ee304
Function at 0x140200bfc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
lea r12, [rcx + 8]
mov qword [rax - 0x28], r12
and qword [rax - 0x20], 0
mov ecx, 0x70
call fcn.140221508
mov rdi, rax
mov qword [rsp + 0x38], rax
lea r14, [rax + 0x10]
mov rdx, qword [rbx]
mov rcx, r14
call fcn.1400213b8
and qword [r14 + 0x58], 0
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140200ca2
cmp rcx, r15
jne 0x140200c99
mov rax, qword [rcx]
lea rdx, [r14 + 0x20]
mov rax, qword [rax + 8]
call qword [case.0x14003d846.0]
mov qword [r14 + 0x58], rax
mov rcx, qword [r15 + 0x38]
test rcx, rcx
je 0x140200ca2
mov rax, qword [rcx]
cmp rcx, r15
setne dl
mov rax, qword [rax + 0x20]
call qword [case.0x14003d846.0]
jmp 0x140200c9d
mov qword [r14 + 0x58], rcx
and qword [r15 + 0x38], 0
mov r8, qword [r14 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x140200cb3
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
add r8, r8
je 0x140200ce1
movzx eax, byte [rcx + rdx]
xor rbx, rax
movabs r9, 0x100000001b3
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x140200cc4
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140063a4c
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140200d28
mov qword [rsi], rax
mov byte [rsi + 8], 0
test rdi, rdi
je 0x140200e21
mov rcx, r14
call fcn.1401b3770
mov edx, 0x70
mov rcx, rdi
call fcn.140016264
jmp 0x140200e21
mov rdx, qword [rbp + 0x10]
movabs rax, 0x249249249249249
cmp rdx, rax
je 0x140200e43
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140200d52
cvtsi2ss xmm0, rcx
jmp 0x140200d67
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140200d7a
cvtsi2ss xmm1, rcx
jmp 0x140200d8f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x140200dc6
mov rcx, rbp
call fcn.1401aeb74
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140063a4c
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rbp + 0x10]
mov r8, qword [rsp + 0x20]
mov r9, qword [r8 + 8]
lea rax, [rdx + 1]
mov qword [rbp + 0x10], rax
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [r9], rdi
mov qword [r8 + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [r12]
jne 0x140200e03
mov qword [rcx + rax*8], rdi
jmp 0x140200e15
cmp rdx, r8
jne 0x140200e0e
mov qword [rcx + rax*8], rdi
jmp 0x140200e1a
cmp qword [rcx + rax*8 + 8], r9
jne 0x140200e1a
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14006dcb4
int3
Function at 0x140212658
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14029f3b8]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r14, r9
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x58], r9
mov rdx, r8
lea rcx, [rbp - 0x30]
call fcn.140212870
nop
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae r8, qword [rbp - 0x30]
movabs rcx, 0xcbf29ce484222325
mov rax, qword [rbp - 0x20]
lea r9, [rax + rax]
xor edx, edx
test r9, r9
je 0x1402126de
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1402126c0
mov rax, qword [rdi + 0x30]
and rax, rcx
add rax, rax
mov rcx, qword [rdi + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rdi + 8]
je 0x1402127c2
mov r11, qword [rcx + rax*8]
jmp 0x14021270e
cmp rbx, r11
je 0x1402127c2
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.14002c208
test al, al
je 0x140212701
test rbx, rbx
je 0x1402127c2
cmp rbx, qword [rdi + 8]
je 0x1402127c2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
mov rax, qword [r14]
and qword [r14], 0
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x10]
lea rax, [0x1402b07b0]
cmp byte [rbp + 0x10], 0
cmove rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140011d38
mov rax, qword [rbp + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x38], rax
and qword [rbp + 0x18], 0
and qword [rbp + 0x20], 0
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x30]
call fcn.140213288
mov byte [rsi + 0x30], 0
lea rcx, [rbp - 0x30]
call fcn.140213024
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x140212852
mov rax, qword [rcx]
mov rax, qword [rax + 0xc0]
jmp 0x140212847
mov byte [rsp + 0x20], 0
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
lea rax, [0x140213fc0]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x30], 0x22
lea rax, [0x140298038]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x30]
mov dl, 1
lea rcx, [rbp - 0x68]
call fcn.140022534
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x68]
call fcn.140022738
mov rdx, rax
mov rcx, rsi
call fcn.14002225c
nop
lea rcx, [rbp - 0x30]
call fcn.140213024
nop
mov rcx, qword [r14]
test rcx, rcx
je 0x140212852
mov rdx, qword [rcx]
mov rax, qword [rdx + 0xc0]
mov edx, 1
call qword [case.0x14003d846.0]
mov rax, rsi
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.140220ed0
add rsp, 0x140
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140218124
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov rbx, qword [rcx]
mov r9, qword [rcx + 0x18]
cmp rbx, 0x20
jb 0x1402181f2
mov rdx, qword [rcx + 8]
movabs rsi, 0x9e3779b185ebca87
mov r8, qword [rcx + 0x10]
mov r11, r9
mov r10, qword [rcx + 0x20]
movabs rdi, 0xc2b2ae3d27d4eb4f
rol r11, 0xc
mov rax, rdx
rol rax, 1
add r11, rax
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r9, rdi
imul r8, rdi
imul r10, rdi
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
movabs rax, 0x7a1435883d4d519d
rol r9, 0x1f
imul rdx, rsi
imul r9, rsi
xor r11, rdx
rol r8, 0x1f
imul r11, rsi
imul r8, rsi
sub r11, rax
rol r10, 0x1f
imul r10, rsi
xor r11, r8
imul r11, rsi
sub r11, rax
xor r11, r9
movabs r9, 0x85ebca77c2b2ae63
imul r11, rsi
sub r11, rax
xor r11, r10
imul r11, rsi
add r9, r11
jmp 0x1402181ff
movabs rdx, 0x27d4eb2f165667c5
add r9, rdx
add r9, rbx
lea rdx, [rcx + 0x28]
mov rcx, r9
mov r8, rbx
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp fcn.140217e8c
Function at 0x140017260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140017406
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x140132c48]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033a60
xorps xmm15, xmm15
mov r14, qword [0x1402e1550]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x1400172cb
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x1400172e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x140017305
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x140017319
cmp rbx, 0x1000
jae 0x1400172d5
nop dword [rax]
jmp 0x140017389
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x14001732d
xor edx, edx
jmp 0x140017380
mov rcx, qword [0x140132c48]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.140033a60
xorps xmm15, xmm15
mov r14, qword [0x1402e1550]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x14001730f
jmp 0x1400172f4
call fcn.140066000
xorps xmm15, xmm15
mov r14, qword [0x1402e1550]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.140038140
lea rax, [0x140174b6d]
mov ebx, 0x18
call fcn.140038a40
mov rax, qword [rsp + 0x38]
call fcn.140038740
lea rax, [0x140174c5d]
mov ebx, 0x19
call fcn.140038a40
mov rax, qword [rsp + 0x30]
nop
call fcn.140038740
call fcn.1400383a0
call fcn.1400381c0
lea rax, [0x140177cb1]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.140036800
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140062440
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.140017260