joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180065dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rdx, str.Input
mov dword [rsp + 0x38], 8
call fcn.180074050
mov byte [0x180214b00], 0
call fcn.180074020
test eax, eax
jne 0x180065e23
nop
mov rax, qword gs:[0x20]
mov rcx, qword [rax]
mov byte [rcx + 0x20], 0
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
call fcn.180074020
test eax, eax
je 0x180065e00
call fcn.180073ff0
mov byte [0x180214b00], 1
mov rbx, rax
test rax, rax
je 0x180065e95
mov r8, 0xffffffffffffffff
mov rcx, r8
inc rcx
cmp byte [rax + rcx], 0
jne 0x180065e41
test rcx, rcx
je 0x180065e95
mov rax, r8
inc rax
cmp byte [rbx + rax], 0
jne 0x180065e52
test rax, rax
je 0x180065e95
xor ecx, ecx
inc r8
cmp byte [rbx + r8], cl
jne 0x180065e62
test r8, r8
je 0x180065ee0
lea r9, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
nop word [rax + rax]
movzx edx, byte [rcx + rbx]
xor eax, eax
cmp dl, byte [rax + r9]
je 0x180065ed8
inc rax
cmp rax, 0x3e
jb 0x180065e86
lea rcx, [rbp - 0x20]
mov word [rbp - 0x13], 0x21
mov dword [rbp - 0x20], 0x61766e49
mov dword [rbp - 0x1c], 0x2064696c
mov dword [rbp - 0x18], 0x75706e49
mov byte [rbp - 0x14], 0x74
mov byte [rbp - 0x11], 0
call fcn.180005650
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18016cc50
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
inc rcx
cmp rcx, r8
jb 0x180065e80
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov rdx, rbx
call fcn.1800746f0
mov byte [0x180214b00], 1
jmp 0x180065ec1

Function at 0x180065f20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.1800370d0
mov rbx, rax
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp fcn.1800746f0

Function at 0x1800662d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800744e0
mov ecx, eax
call fcn.180033020
call fcn.180035790
mov ecx, eax
call fcn.1800744e0
mov ecx, eax
call fcn.180074490
call fcn.180035790
mov ecx, eax
call fcn.1800744e0
mov ecx, eax
mov edx, 0x17
mov r8d, 0x28
add rsp, 0x28
jmp fcn.180032fa0

Function at 0x180066340
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
xor edx, edx
add rsp, 0x28
jmp 0x180074540
mov rax, qword [0x1802145b0]
xor r8d, r8d
mov dword [0x1802145a8], r8d
mov dword [0x1802145b8], r8d
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x2497c4717c8b881e
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r8d
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x180066380
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, 1
add rsp, 0x28
jmp 0x180074540

Function at 0x1800663c0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
vmovss xmm1, dword [0x1801e4758]
mov ecx, eax
add rsp, 0x28
jmp fcn.180031d20

Function at 0x180066410
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
vxorps xmm1, xmm1, xmm1
add rsp, 0x28
jmp fcn.180031d20

Function at 0x1800665f0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.1800326a0
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
add rsp, 0x28
jmp fcn.1800326d0

Function at 0x1800666f0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180073f00
mov ebx, eax
call fcn.180035790
mov r8d, 0xffffffff
mov edx, ebx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp fcn.180035520

Function at 0x180066740
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
add rsp, 0x28
jmp 0x180073f30
xor eax, eax
movabs rdx, 0x7f93691ab4b92272
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180066c80
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
mov edx, 0xa2719263
mov r9d, 1
mov r8d, 0x270f
add rsp, 0x28
jmp fcn.1800356c0

Function at 0x180066cd0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
mov edx, 0xa2719263
add rsp, 0x28
jmp fcn.180034cb0

Function at 0x180066d80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rbx, [0x180211ee0]
lea rsi, [0x180212084]
nop dword [rax]
mov edi, dword [rbx]
call fcn.180035790
mov ecx, eax
mov edx, edi
call fcn.180034cb0
add rbx, 4
cmp rbx, rsi
jne 0x180066da0
call fcn.180035790
mov ecx, eax
mov edx, 0xa2719263
mov r9d, 1
mov r8d, 0x270f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800356c0
Function at 0x180066e90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor edi, edi
mov ebx, 1
nop dword [rax]
mov word [rbp - 0x14], 0x54
mov dword [rbp - 0x19], 0x554f435f
mov byte [rbp - 0x15], 0x4e
mov byte [rbp - 0x12], 0
mov edx, ebx
lea rcx, [rbp + 0x2f]
call fcn.180006f90
nop
mov dword [rbp - 5], 0x5f5255
mov dword [rbp - 0x11], 0x435f504d
mov dword [rbp - 0xd], 0x5f524148
mov dword [rbp - 9], 0x4f4d5241
mov byte [rbp - 1], 0
mov r8, rax
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0xf]
call fcn.1800093e0
nop
lea rcx, [rbp - 0x19]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rcx + r8], 0
jne 0x180066f20
lea rdx, [rbp - 0x19]
mov rcx, rax
call fcn.1800085c0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x11], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp + 0xf]
vzeroupper
call fcn.180006590
nop
lea rcx, [rbp + 0x2f]
call fcn.180006590
mov edx, 0x7fffffff
lea rcx, [rbp - 0x11]
call fcn.180037770
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0xf
jbe 0x180066faa
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180066fa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180066fd6
call fcn.18016cc9c
inc ebx
cmp ebx, 5
jle 0x180066ec0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x180067840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x180237e88]
dec eax
movsxd rcx, eax
lea rbx, [0x1801d7130]
mov ebx, dword [rbx + rcx*4]
mov word [rsp + 0x29], 0x4d
mov dword [rsp + 0x20], 0x52414843
mov dword [rsp + 0x24], 0x5f50585f
mov byte [rsp + 0x28], 0x46
mov byte [rsp + 0x2b], 0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x40], xmm1
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800678b0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.180006350
nop
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.180037770
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x180067917
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180067912
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180067912
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18016cc9c
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x60
pop rbx
ret
Function at 0x180067b30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x10], rax
vmovdqu xmm0, xmmword [0x1801e50a0]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x18], 0x4b434c
vmovdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x5f454c43
mov dword [rbp - 0x1c], 0x4e555f31
mov byte [rbp - 0x14], 0
call fcn.180035590
mov ecx, eax
mov edx, 0xffffffff
call fcn.180074de0
vmovdqu xmm0, xmmword [0x1801e5090]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x18], 0x4b434c
vmovdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x5f454c43
mov dword [rbp - 0x1c], 0x4e555f32
mov byte [rbp - 0x14], 0
call fcn.180035590
mov ecx, eax
mov edx, 0xffffffff
call fcn.180074de0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x50
pop rbp
ret

Function at 0x180067e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x10], rax
vmovdqu xmm0, xmmword [0x1801e4c60]
lea rcx, [rbp - 0x30]
mov word [rbp - 0x1b], 0x54
vmovdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x4f505344
mov byte [rbp - 0x1c], 0x52
mov byte [rbp - 0x19], 0
call fcn.180035590
mov ecx, eax
xor edx, edx
call fcn.180074de0
vmovdqu xmm0, xmmword [0x1801e55a0]
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x1a], 0x53454c
vmovdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x48455650
mov word [rbp - 0x1c], 0x4349
mov byte [rbp - 0x16], 0
call fcn.180035590
mov ecx, eax
xor edx, edx
call fcn.180074de0
vmovdqu xmm0, xmmword [0x1801e5240]
lea rcx, [rbp - 0x30]
mov word [rbp - 0x1b], 0x45
vmovdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x41535345
mov byte [rbp - 0x1c], 0x47
mov byte [rbp - 0x19], 0
call fcn.180035590
mov ecx, eax
xor edx, edx
call fcn.180074de0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x50
pop rbp
ret
Function at 0x180068650
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xb0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, dword [0x1801e46f8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm6, dword [rax + 8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xd44295dd
vmovss xmm1, dword [rax]
call fcn.1800752f0
mov edi, eax
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, dword [0x1801e46f8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm6, dword [rax + 8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xd44295dd
vmovss xmm1, dword [rax]
call fcn.1800752f0
vmovss xmm3, dword [0x1801e478c]
mov ebx, eax
xor eax, eax
mov dword [rsp + 0x28], eax
mov ecx, ebx
vxorps xmm1, xmm1, xmm1
mov dword [rsp + 0x20], eax
call fcn.180034b80
mov ecx, ebx
call fcn.180033100
mov ecx, edi
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
jmp fcn.180033100

Function at 0x1800689b0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovss xmm7, dword [rax + 0x10]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm6, dword [rax + 8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
mov byte [rsp + 0x28], 1
mov ecx, 0x55446010
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
vmovss xmm1, dword [rax]
mov byte [rsp + 0x20], 0
call fcn.1800372b0
mov ecx, eax
mov ebx, eax
call fcn.1800749f0
mov ecx, ebx
call fcn.180035410
mov edx, eax
mov ecx, ebx
call fcn.180035450
mov edx, 0xc8
mov ecx, ebx
vmovaps xmm6, xmmword [rsp + 0xa0]
vmovaps xmm7, xmmword [rsp + 0x90]
add rsp, 0xb0
pop rbx
jmp 0x1800353c0

Function at 0x180068ac0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xb0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovss xmm7, dword [rax + 0x10]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm6, dword [rax + 8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
mov byte [rsp + 0x28], 0
mov ecx, 0x55fe9b46
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
vmovss xmm1, dword [rax]
mov byte [rsp + 0x20], 1
call fcn.1800372b0
mov ecx, eax
mov ebx, eax
call fcn.1800749f0
mov ecx, ebx
call fcn.180035410
mov edx, eax
mov ecx, ebx
call fcn.180035450
mov edx, 0xc8
mov ecx, ebx
vmovaps xmm6, xmmword [rsp + 0xa0]
vmovaps xmm7, xmmword [rsp + 0x90]
add rsp, 0xb0
pop rbx
jmp 0x1800353c0
Function at 0x1800691b0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035740
mov ecx, eax
mov edx, 0xa2719263
mov r9d, 1
mov r8d, 0x270f
add rsp, 0x28
jmp fcn.1800356c0

Function at 0x180069200
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035740
mov ecx, eax
mov edx, 0xa2719263
add rsp, 0x28
jmp fcn.180034cb0

Function at 0x180069280
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rbx, [0x180211ee0]
lea rsi, [0x180212084]
nop dword [rax]
mov edi, dword [rbx]
call fcn.180035740
mov ecx, eax
mov edx, edi
call fcn.180034cb0
add rbx, 4
cmp rbx, rsi
jne 0x1800692a0
call fcn.180035740
mov ecx, eax
mov edx, 0xa2719263
mov r9d, 1
mov r8d, 0x270f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800356c0

Function at 0x180069700
Capabilities:
Hash data using fnv

Disassembly:
mov dword [0x1802116fc], 0x1e
mov dword [0x1802116f8], 0xf
mov dword [0x1802116f4], 0x46
jmp fcn.180033d20

Function at 0x180069840
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.1800354a0
mov ecx, eax
add rsp, 0x28
jmp fcn.180035270

Function at 0x180069880
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
add rsp, 0x28
jmp 0x180074d90
xor eax, eax
movabs rdx, 0xf7ec25a3ebeec726
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800698c0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
xor edx, edx
add rsp, 0x28
jmp fcn.180035450

Function at 0x180069900
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
xor edx, edx
add rsp, 0x28
jmp 0x1800353c0

Function at 0x180069940
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
mov edx, 0xc8
add rsp, 0x28
jmp 0x1800353c0

Function at 0x180069980
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180035790
mov ecx, eax
call fcn.180035410
mov ebx, eax
call fcn.180035790
mov edx, ebx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp fcn.180035450

Function at 0x180069b30
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
add rsp, 0x28
jmp 0x180074cd0
xor eax, eax
movabs rdx, 0x9c720776daa43e7e
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180069b70
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
call fcn.1800352a0
call fcn.180035790
mov ecx, eax
add rsp, 0x28
jmp 0x180074d00
xor eax, eax
movabs rdx, 0x6585d955a68452a5
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x180069bb0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180035790
mov ecx, eax
add rsp, 0x28
jmp 0x180073580
xor eax, eax
movabs rdx, 0xa986918b102b448
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x18006a510
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [0x180237fa8]
lea rcx, [rsp + 0x20]
call fcn.180007910
movzx edx, byte [0x180237f98]
movzx ecx, byte [rax]
mov byte [0x180237f98], cl
mov byte [rax], dl
lea rcx, [rax + 8]
mov rdx, qword [0x180237fa0]
mov r8, qword [rcx]
mov qword [0x180237fa0], r8
mov qword [rcx], rdx
movzx edx, byte [rax]
call fcn.180007eb0
nop
call fcn.18002f170
mov word [rsp + 0x39], 0x2e
vmovdqu xmm0, xmmword [0x1801e6030]
vmovdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x74657320
mov dword [rsp + 0x34], 0x676e6974
mov byte [rsp + 0x38], 0x73
mov byte [rsp + 0x3b], 0
lea rcx, [rsp + 0x20]
call fcn.180005650
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x58
ret
Function at 0x18006a8a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
xor ebx, ebx
mov dword [rbp + 0x39], 0x736465
vmovdqu xmm0, xmmword [0x1801e5bc0]
vmovdqu xmmword [rbp + 0x27], xmm0
mov word [rbp + 0x37], 0x5065
mov byte [rbp + 0x3d], bl
lea rdx, [rbp + 0x27]
call fcn.180021410
lea rdi, [rax + 8]
cmp byte [rax], 4
cmovne rdi, rbx
mov dword [rbp + 0x1b], 0x656c69
mov dword [rbp + 0x17], 0x74736f48
mov byte [rbp + 0x1f], bl
mov ecx, 0x158
call fcn.18016cca4
mov qword [rbp - 0x79], rax
mov qword [rbp + 0xf], rbx
lea rcx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rbp - 0x69], rcx
lea rcx, [0x18001e550]
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], 2
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov rcx, rax
call fcn.180069f50
nop
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x180059207
mov ecx, ebx
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x18005921b
lea r8, [rbp - 0x79]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x18005922b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov word [rbp + 0x24], 0x64
mov dword [rbp + 0x17], 0x75706f50
mov dword [rbp + 0x1b], 0x6574616c
mov dword [rbp + 0x1f], 0x726f5720
mov byte [rbp + 0x23], 0x6c
mov byte [rbp + 0x26], 0
mov ecx, pe_nt_image_headers64
call fcn.18016cca4
mov qword [rbp - 0x71], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_e30b2cf626c9ef542d68a425550ace02___void___.0
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x31], rcx
lea r9, [rbp - 0x69]
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov rcx, rax
call fcn.1800378e0
nop
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x1800592a8
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x1800592bc
lea r8, [rbp - 0x79]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rbx, qword [rbp - 0x79]
test rbx, rbx
je 0x1800592cf
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdx, qword [rdx]
jmp 0x180059110
Function at 0x18006df40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x100
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rsi, rdx
xor ebx, ebx
mov word [rbp + 0x1c], 0x66
mov dword [rbp + 0x17], 0x4f2f6e4f
mov byte [rbp + 0x1b], 0x66
mov byte [rbp + 0x1e], bl
mov ecx, pe_nt_image_headers64
call fcn.18016cca4
mov qword [rbp - 0x79], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_9899336635c881ba1cc11d1214eb5db2___void___.0
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x31], rcx
lea r9, [rbp - 0x69]
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov rcx, rax
call fcn.1800378e0
nop
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x18005202d
mov ecx, ebx
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x180052041
lea r8, [rbp - 0x79]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x180052051
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov word [rbp + 0x38], 0x73
vmovdqu xmm0, xmmword [0x1801e58e0]
vmovdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x37], 0x6e
mov byte [rbp + 0x3a], 0
lea rdx, [rbp + 0x27]
call fcn.180021410
lea rdi, [rax + 8]
cmp byte [rax], 4
cmovne rdi, rbx
mov word [rbp + 0x20], 0x64
mov dword [rbp + 0x17], 0x6574754d
mov dword [rbp + 0x1b], 0x756f5320
mov byte [rbp + 0x1f], 0x6e
mov byte [rbp + 0x22], 0
mov ecx, 0x158
call fcn.18016cca4
mov qword [rbp - 0x71], rax
mov qword [rbp + 0xf], rbx
lea rcx, vtable.std::_Func_impl_no_alloc_void____cdecl___void___void___.0
mov qword [rbp - 0x69], rcx
lea rcx, [0x18001c910]
mov qword [rbp - 0x61], rcx
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x31], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x38], rcx
lea rcx, [rbp - 0x69]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x17]
mov rcx, rax
call fcn.180069f50
nop
mov qword [rbp - 0x71], rbx
mov qword [rbp - 0x79], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x180052123
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x180052137
lea r8, [rbp - 0x79]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rbx, qword [rbp - 0x79]
test rbx, rbx
je 0x18005214a
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdx, qword [rdx]
jmp 0x180051f90
Function at 0x18006e230
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, dword [rcx + 8]
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov edx, ebx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp 0x180074740
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x9088eb5a43ffb0a1
inc dword [0x1802145a8]
jmp fcn.180017460