joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014c860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14014c8db
mov rax, qword [rdi + 0x38]
mov rdx, qword [rdi + 8]
shr rax, 3
cmp rax, rcx
jbe 0x14014c896
mov r8, rdx
mov rcx, rdi
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp fcn.1400299f0
lea rcx, [rdi + 8]
mov qword [rsp + 0x38], rbx
call fcn.140024f20
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rcx, qword [rdi + 8]
mov qword [rcx + 8], rcx
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140026f00
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14014c9f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea edx, [rsi + 0x40]
mov rcx, r15
call fcn.140037df0
mov edi, 2
mov dword [rsp + 0x20], edi
movzx ebp, byte [r12]
mov r14d, 1
not ebp
nop dword [rax + rax]
movzx ebx, bpl
xor bl, byte [r14 + r12]
lea r14, [r14 + 1]
mov rdx, rsi
mov rcx, r15
call fcn.140039f30
or byte [rax], bl
movzx eax, bl
xor eax, ebp
imul ebp, eax, 0x1000193
inc rsi
cmp rsi, 0x40
jb 0x14014ca40
and edi, 0xfffffffd
mov dword [rsp + 0x20], edi
or edi, 1
mov dword [rsp + 0x20], edi
mov rax, r15
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x14014caa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r12, rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
xor r8d, r8d
lea edx, [rsi + 0x20]
mov rcx, r15
call fcn.140037df0
mov edi, 2
mov dword [rsp + 0x20], edi
movzx ebp, byte [r12]
mov r14d, 1
not ebp
nop dword [rax + rax]
movzx ebx, bpl
xor bl, byte [r14 + r12]
lea r14, [r14 + 1]
mov rdx, rsi
mov rcx, r15
call fcn.140039f30
or byte [rax], bl
movzx eax, bl
xor eax, ebp
imul ebp, eax, 0x1000193
inc rsi
cmp rsi, 0x20
jb 0x14014caf0
and edi, 0xfffffffd
mov dword [rsp + 0x20], edi
or edi, 1
mov dword [rsp + 0x20], edi
mov rax, r15
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140150220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1404f4fb8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14015024d
xor eax, eax
jmp 0x1401503b6
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x140150276
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x140150276
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1401503b6
cmp qword [rcx + 0x80], 0
jne 0x14015028a
mov eax, 0xffffffff
jmp 0x1401503b6
mov rcx, qword [rcx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [rcx], rax
jne 0x1401502b9
mov rdx, qword [rbx + 0x88]
mov r8, qword [rbx + 0x90]
mov qword [rcx], rdx
sub r8d, edx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
mov rax, qword [rbx + 0x50]
mov dword [rax], r8d
cmp qword [rbx + 0x68], 0
jne 0x1401502e2
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1401503b6
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140150359
sub eax, 1
je 0x140150359
cmp eax, 2
jne 0x140150280
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1401503b6
mov qword [rsp + 0xa0], rsi
lea rax, [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
sub rsi, rax
je 0x140150396
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
je 0x140150396
mov eax, 0xffffffff
jmp 0x1401503ae
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140233ef0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1401510b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1401510e1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1401510ff
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
cmp qword [rax], 0
je 0x140151119
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14015111b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140151168
mov rdx, qword [rsi + 0x38]
cmp rax, rbp
mov qword [rsp + 0x38], rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
mov rdi, rbx
mov rdx, qword [rdx]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
mov rbx, rbp
sub rbx, rdi
mov ecx, dword [rax]
sub ecx, edi
mov dword [rax], ecx
mov rax, qword [rsi + 0x38]
movsxd rcx, edi
mov rdi, qword [rsp + 0x38]
add rcx, qword [rax]
mov qword [rax], rcx
cmp qword [rsi + 0x80], 0
je 0x1401511fe
mov rcx, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [rcx], rax
jne 0x1401511a5
mov rdx, qword [rsi + 0x88]
mov r8, qword [rsi + 0x90]
mov qword [rcx], rdx
sub r8d, edx
mov rax, qword [rsi + 0x38]
mov qword [rax], rdx
mov rax, qword [rsi + 0x50]
mov dword [rax], r8d
cmp rbx, 0xfff
jbe 0x1401511de
nop
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1401511fe
cmp rbx, rax
ja 0x1401511b0
test rbx, rbx
je 0x1401511fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140151220
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140151257
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
cmp qword [rax], 0
je 0x140151276
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140151278
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1401512e1
test ecx, ecx
jle 0x1401512b7
mov rcx, qword [rdi + 0x40]
cmp rbx, rbp
cmovl rbp, rbx
mov r8, rbp
mov rcx, qword [rcx]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r14, rbp
sub rbx, rbp
mov ecx, dword [rax]
sub ecx, ebp
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
movsxd rcx, ebp
add rcx, qword [rax]
mov qword [rax], rcx
test rbx, rbx
jle 0x1401512e1
cmp qword [rdi + 0x80], 0
je 0x1401512e1
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14015ef00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
xor ebx, ebx
nop word [rax + rax]
mov r9, qword [r11]
cmp dword [r9], 0x270
jne 0x14015ef72
lea r8, [r9 + 8]
mov r10d, 0x270
nop word [rax + rax]
mov edx, dword [r8 - 4]
mov eax, dword [r8]
lea r8, [r8 + 4]
btr eax, 0x1f
and edx, 0x80000000
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14015ef30
jmp 0x14015f05a
cmp dword [r9], 0x4e0
jb 0x14015f05a
lea r8, [r9 + 0x9c4]
mov r10d, 0xe3
nop dword [rax]
mov edx, dword [r8 + 4]
mov eax, dword [r8]
lea r8, [r8 + 4]
and eax, 0x80000000
btr edx, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 - 0x9c4], ecx
sub r10, 1
jne 0x14015ef90
lea rax, [r9 + 0xd50]
mov r10d, 0x18c
nop dword [rax]
mov r8d, dword [rax + 4]
mov ecx, dword [rax]
lea rax, [rax + 4]
and ecx, 0x80000000
btr r8d, 0x1f
or r8d, ecx
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax - 0xd50]
xor edx, r8d
mov dword [rax - 0x9c4], edx
sub r10, 1
jne 0x14015efe0
mov edx, dword [r9 + 0x1380]
mov eax, dword [r9 + 4]
and edx, 0x80000000
btr eax, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov dword [r9], ebx
mov eax, dword [r9]
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
mov eax, dword [r9 + 0x1384]
inc dword [r9]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, 0xffffffff
ja 0x14015ef10
mov rbx, qword [rsp + 8]
ret
Function at 0x1401818e0
Capabilities:
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x140181ad7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
lea r12, [rcx + 8]
movabs r9, 0x7ffffffffffffff
xor r13d, r13d
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx r15d, byte [rbx + 0x10]
xor r15, rax
imul r15, rcx
movzx eax, byte [rbx + 0x11]
xor r15, rax
imul r15, rcx
movzx eax, byte [rbx + 0x12]
xor r15, rax
imul r15, rcx
movzx eax, byte [rbx + 0x13]
xor r15, rax
imul r15, rcx
mov r8, qword [rsi + 0x30]
and r8, r15
lea rcx, [r8 + r8]
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rbp, qword [r12]
cmp rdx, rbp
je 0x1401819a6
add r8, r8
mov rcx, qword [rax + r8*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x140181aac
cmp rdx, rcx
je 0x1401819a3
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140181990
jmp 0x140181aac
mov rbp, rdx
cmp qword [rsi + 0x10], r9
je 0x140181adf
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x38], r13
mov ecx, 0x20
call fcn.140233ad4
mov r14, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401819ed
cvtsi2ss xmm0, rcx
jmp 0x140181a02
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140181a15
cvtsi2ss xmm1, rcx
jmp 0x140181a2a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x140181a8b
mov rcx, rsi
call fcn.140184e70
mov r8, qword [rsi + 0x30]
and r8, r15
lea rcx, [r8 + r8]
mov rax, qword [rsi + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rax, qword [r12]
cmp rdx, rax
je 0x140181a81
add r8, r8
mov rax, qword [rsi + 0x18]
mov rcx, qword [rax + r8*8]
mov eax, dword [r14 + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x140181a7e
nop dword [rax]
cmp rdx, rcx
je 0x140181ad8
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140181a70
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x38], r13
mov r9, r14
mov r8, rbp
mov rdx, r15
mov rcx, rsi
call fcn.14013d1f0
nop
movabs r9, 0x7ffffffffffffff
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14018191f
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x20], rdx
jmp 0x140181a86
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140182100
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov rdi, rdx
mov rbx, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov r8, qword [rbx + 0x30]
and r8, rsi
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rbp, qword [rbx + 8]
cmp rdx, rbp
je 0x1401821d0
add r8, r8
mov rcx, qword [rax + r8*8]
mov eax, dword [r15]
cmp eax, dword [rdx + 0x10]
je 0x1401821a4
cmp rdx, rcx
je 0x1401821cd
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140182196
mov qword [rdi], rdx
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov rbp, rdx
movabs rax, 0x7ffffffffffffff
cmp qword [rbx + 0x10], rax
je 0x1401822eb
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x38], r12
lea ecx, [r12 + 0x20]
call fcn.140233ad4
mov r14, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [r15]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rbx + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140182228
cvtsi2ss xmm0, rcx
jmp 0x14018223d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbx + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140182250
cvtsi2ss xmm1, rcx
jmp 0x140182265
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbx]
jbe 0x1401822c2
mov rcx, rbx
call fcn.140184e70
mov r8, qword [rbx + 0x30]
and r8, rsi
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rax, qword [rbx + 8]
cmp rdx, rax
je 0x1401822b8
add r8, r8
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + r8*8]
mov eax, dword [r14 + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x1401822b5
cmp rdx, rcx
je 0x1401822e4
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1401822a7
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x38], r12
mov r9, r14
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.14013d1f0
mov qword [rdi], rax
mov byte [rdi + 8], 1
jmp 0x1401821ab
mov qword [rsp + 0x20], rdx
jmp 0x1401822bd
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140184970
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140184b32
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.1400289f0
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140184af0
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x140184a68
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x140184ae4
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x140184aa5
mov r8, qword [rax]
cmp r8, rcx
je 0x140184a9f
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x140184ae4
cmp qword [r11], rax
je 0x140184ac0
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x140184b0c
cmp r8, rax
jne 0x140184ab1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140184a10
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x140184ae4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140184b40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140184d02
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.1400289f0
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140184cc0
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x140184c38
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x140184cb4
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x140184c75
mov r8, qword [rax]
cmp r8, rcx
je 0x140184c6f
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x140184cb4
cmp qword [r11], rax
je 0x140184c90
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x140184cdc
cmp r8, rax
jne 0x140184c81
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140184be0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x140184cb4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14018ccc0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1404f4fb8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov qword [rsp + 0x60], rdx
xor ebx, ebx
mov dword [rsp + 0x44], ebx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x105
mov ecx, edx
lea rax, [rsp + 0x90]
mov r10d, ebx
cmp word [rax], bx
je 0x14018cd3c
add rax, 2
sub rcx, 1
jne 0x14018cd22
mov r10d, 0x80070057
mov rax, rbx
jmp 0x14018cd52
test rcx, rcx
jne 0x14018cd4c
mov r10d, 0x80070057
mov rax, rbx
jmp 0x14018cd52
mov rax, rdx
sub rax, rcx
test r10d, r10d
js 0x14018cdc5
sub rdx, rax
lea rcx, [rsp + 0x90]
lea rcx, [rcx + rax*2]
mov r10d, ebx
je 0x14018cdb8
lea r8, [rax + 0x7ffffef9]
add r8, rdx
add rax, rax
lea r9, str.OriginWeb_Cache
sub r9, rax
lea rax, [rsp + 0x90]
sub r9, rax
nop dword [rax]
test r8, r8
je 0x14018cdb3
cmp word [r9 + rcx], bx
je 0x14018cdb3
movzx eax, word [r9 + rcx]
mov word [rcx], ax
add rcx, 2
dec r8
sub rdx, 1
jne 0x14018cd90
jmp 0x14018cdb8
test rdx, rdx
jne 0x14018cdc2
sub rcx, 2
mov r10d, 0x8007007a
mov word [rcx], bx
mov dword [rsp + 0x40], r10d
test r10d, r10d
je 0x14018ceac
lea r8, [rsp + 0x40]
lea rdx, str.The_call_to_the_function_StringCbCatW_failed__result:__ld
lea rcx, [rsp + 0x68]
call fcn.140013960
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14018cdf6
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14018ce02
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, str.eax::services::NetworkAccessManagerFactory::cacheDirectory
mov qword [rsp + 0x20], rax
mov r9d, 0xc2
lea r8, [0x1403680c8]
lea rdx, str.concatResult____HRESULT_0L_
xor ecx, ecx
call fcn.1401dac00
movzx edi, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 0x10
jb 0x14018ce90
inc rdx
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x1000
jb 0x14018ce8b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14018cef2
mov rcx, r8
call fcn.140233b10
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
test dil, dil
je 0x14018ceac
int3
mov r8d, 0xffffffff
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
or ebx, 1
mov dword [rsp + 0x44], ebx
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140233ef0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3