joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140096290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov edi, r8d
mov rbx, rdx
mov rbp, rcx
xor r14d, r14d
nop word [rax + rax]
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
mov rax, qword [rbx + 0x18]
mov word [rsp + 0x32], r14w
test rax, rax
je 0x1400962dd
mov eax, dword [rax]
mov dword [rsp + 0x24], eax
jmp 0x1400962e2
mov dword [rsp + 0x24], r14d
mov eax, dword [rbx + 0x10]
shr eax, 0xa
test al, 1
je 0x14009630d
mov rax, qword [rbx + 0x88]
test rax, rax
je 0x14009630d
mov rax, qword [rax + 0x3a8]
test rax, rax
je 0x14009630d
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x28], eax
jmp 0x140096312
mov dword [rsp + 0x28], r14d
mov eax, dword [rbx + 0xbc]
mov dword [rsp + 0x2c], eax
cmp qword [rbx + 0x20], r14
je 0x14009632c
movzx eax, byte [rbx + 0x60]
mov byte [rsp + 0x30], al
jmp 0x140096331
mov byte [rsp + 0x30], 0xff
cvttss2si ecx, dword [rbx + 0x48]
mov eax, dword [rbx + 8]
mov r8d, dword [rbp + 0x24]
and eax, 0xc1fc20
mov dword [rsp + 0x34], eax
mov byte [rsp + 0x31], dil
cvttss2si eax, dword [rbx + 0x4c]
mov word [rsp + 0x38], cx
cvttss2si ecx, dword [rbx + 0x50]
mov word [rsp + 0x3a], ax
cvttss2si eax, dword [rbx + 0x54]
mov word [rsp + 0x3c], cx
cvttss2si ecx, dword [rbx + 0x58]
mov word [rsp + 0x3e], ax
cvttss2si eax, dword [rbx + 0x5c]
mov word [rsp + 0x40], cx
mov ecx, dword [rbp + 0x20]
mov word [rsp + 0x42], ax
cmp ecx, r8d
jne 0x1400963b3
inc ecx
test r8d, r8d
je 0x14009639e
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1400963a3
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
lea rcx, [rbp + 0x20]
call fcn.140097b00
movsxd rax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rax + rax*8]
mov eax, dword [rsp + 0x40]
movups xmmword [rcx + rdx*4], xmm0
movups xmmword [rcx + rdx*4 + 0x10], xmm1
mov dword [rcx + rdx*4 + 0x20], eax
inc dword [rbp + 0x20]
mov rdx, qword [rbx + 0x20]
inc edi
test rdx, rdx
je 0x1400963f3
mov r8d, edi
mov rcx, rbp
call fcn.140096290
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1400962c0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400c4bf0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov r11, qword [0x14027bf58]
movaps xmmword [rsp + 0x30], xmm6
mov rdi, r11
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
test rbx, rbx
je 0x1400c4c27
mov eax, dword [r11 + 0x3f70]
mov dword [rbx + 0x6c], eax
cmp qword [r11 + 0x4a38], rbx
je 0x1400c4c72
test rbx, rbx
je 0x1400c4c60
mov eax, dword [rbx + 0x28]
mov dword [r11 + 0x4a30], eax
mov rax, qword [r11 + 0x3880]
mov qword [r11 + 0x4a38], rbx
test rax, rax
je 0x1400c4c72
mov rcx, rbx
call rax
mov r11, qword [0x14027bf58]
jmp 0x1400c4c72
mov dword [r11 + 0x4a30], 0x3f800000
mov qword [r11 + 0x4a38], rbx
movss xmm1, dword [rdi + 0x39a0]
lea r8, [0x140218869]
subss xmm1, dword [rdi + 0x3918]
movss xmm0, dword [rdi + 0x399c]
lea rsi, [0x140219780]
movss dword [rdi + 0x4980], xmm0
xorps xmm6, xmm6
mov r10d, 0xffffffff
mov r9b, 0x23
mov edx, r10d
maxss xmm1, xmm6
movss dword [rdi + 0x4984], xmm1
movss xmm5, dword [r11 + 0x3918]
addss xmm5, xmm5
addss xmm5, dword [r11 + 0x3d50]
cmp r9b, 0x23
jne 0x1400c4ce4
cmp byte [r8], r9b
jne 0x1400c4ce4
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [rsi + rcx*4]
test r9b, r9b
jne 0x1400c4cd1
not edx
lea rcx, [r11 + 0x3ff8]
call fcn.140070610
mov rcx, rax
test rbx, rbx
jne 0x1400c4d20
mov rax, qword [r11 + 0x4a28]
mov rbx, qword [rax]
xor esi, esi
test rcx, rcx
je 0x1400c4d34
cmp word [rcx + 0xf8], si
jne 0x1400c4dd2
movss xmm1, dword [rbx + 0x130]
movaps xmm3, xmm6
movss xmm0, dword [rbx + 0x10]
movaps xmm4, xmm1
addss xmm4, dword [rbx + 8]
movss xmm2, dword [rbx + 0x134]
subss xmm0, xmm1
addss xmm2, dword [rbx + 0xc]
addss xmm0, dword [rbx + 0x138]
or dword [r11 + 0x48f8], 3
movss dword [r11 + 0x490c], xmm4
movss dword [r11 + 0x4910], xmm2
movss dword [r11 + 0x4920], xmm5
maxss xmm3, xmm0
mov qword [r11 + 0x4914], rsi
mov dword [r11 + 0x48fc], 1
mov byte [r11 + 0x4934], 1
mov dword [r11 + 0x4900], 1
addss xmm3, xmm4
subss xmm3, xmm4
movss dword [r11 + 0x491c], xmm3
addss xmm5, dword [rbx + 0x134]
movss dword [rbx + 0x134], xmm5
mov eax, dword [rbx]
movaps xmm1, xmm6
or dword [r11 + 0x48f8], 0x100
mov ecx, 3
mov dword [r11 + 0x495c], eax
call fcn.140070d40
mov rbx, qword [0x14027bf58]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 5
movss xmm1, dword [rbx + 0x38f0]
lea rcx, [rbx + 0x4998]
movss xmm0, dword [rbx + 0x38f4]
movss dword [rsp + 0x24], xmm1
movss dword [rsp + 0x28], xmm0
call fcn.140097920
xor edx, edx
mov qword [rbx + 0x38f0], rsi
mov r8d, 0x20050f
lea rcx, str.MainMenuBar
call fcn.14007c130
mov ecx, 2
movzx ebx, al
call fcn.140070e50
mov qword [rdi + 0x4980], rsi
test bl, bl
je 0x1400c4e69
call fcn.1400c46e0
jmp 0x1400c4e6e
call fcn.14007eed0
mov rsi, qword [rsp + 0x58]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ee2e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x140277430]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea r15, [r8 - 1]
mov rbx, rcx
mov rbp, r15
mov r14, r9
sar rbp, 1
mov rdi, r8
mov r11, rdx
mov rsi, rdx
mov rcx, rdx
cmp rdx, rbp
jge 0x1400ee369
nop dword [rax]
lea r10, [rcx + rcx]
mov rax, r10
lea rcx, [rsp + 0x90]
add rax, rax
mov r8, qword [rbx + rax*8 + 0x18]
mov rdx, qword [rbx + rax*8 + 0x28]
call fcn.1400e0120
movzx edx, al
lea rcx, [r10 + 1]
add r11, r11
xor rdx, 1
add rcx, rdx
mov rax, rcx
add rax, rax
movups xmm0, xmmword [rbx + rax*8]
movups xmmword [rbx + r11*8], xmm0
mov r11, rcx
cmp rcx, rbp
jl 0x1400ee320
mov r10, rcx
cmp rcx, rbp
jne 0x1400ee389
test dil, 1
jne 0x1400ee389
add rdi, rdi
mov r10, r15
add rcx, rcx
movups xmm0, xmmword [rbx + rdi*8 - 0x10]
movups xmmword [rbx + rcx*8], xmm0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
cmp rsi, r10
jge 0x1400ee3d8
nop dword [rax + rax]
mov r8, qword [r14 + 8]
lea r11, [r10 - 1]
sar r11, 1
lea rcx, [rsp + 0x20]
mov rdi, r11
add rdi, rdi
mov rdx, qword [rbx + rdi*8 + 8]
call fcn.1400e0120
test al, al
je 0x1400ee3d8
movups xmm0, xmmword [rbx + rdi*8]
add r10, r10
movups xmmword [rbx + r10*8], xmm0
mov r10, r11
cmp rsi, r11
jl 0x1400ee3a0
movups xmm0, xmmword [r14]
add r10, r10
movups xmmword [rbx + r10*8], xmm0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401e8350
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400faac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140277430]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r12d, r8d
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov rbx, qword [rcx + 0x30]
mov rsi, qword [rcx + 0x38]
cmp rbx, rsi
je 0x1400fab48
mov rbp, qword [rdx + 0x18]
mov r14, qword [rdx + 0x10]
nop dword [rax + rax]
mov rdx, rdi
cmp rbp, 0x10
jb 0x1400fab1c
mov rdx, qword [rdi]
mov r8, qword [rbx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400fab2d
mov rcx, qword [rbx]
cmp r8, r14
jne 0x1400fab3f
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400fabe1
add rbx, 0x28
cmp rbx, rsi
jne 0x1400fab10
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.1400046f0
mov r8, rax
mov ebx, 0xffffffff
mov r10, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400fab6a
mov r10, qword [rax]
mov r9, qword [rax + 0x10]
xor edx, edx
test r9, r9
je 0x1400fab9c
mov r11, qword [r15]
nop dword [rax + rax]
movzx ecx, byte [r10 + rdx]
mov eax, ebx
xor rcx, rax
movzx eax, cl
shr ebx, 8
xor ebx, dword [r11 + rax*4]
inc rdx
cmp rdx, r9
jb 0x1400fab80
not ebx
mov rcx, r8
call fcn.140002c40
lea rcx, [r15 + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
cmp rax, rdx
je 0x1400fabc3
cmp dword [rax], ebx
je 0x1400fabe7
add rax, 8
cmp rax, rdx
jne 0x1400fabb6
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], r12d
cmp rdx, qword [rcx + 0x10]
je 0x1400fabed
mov rax, qword [rsp + 0x20]
mov qword [rdx], rax
add qword [rcx + 8], 8
jmp 0x1400fabf8
mov dword [rbx + 0x20], r12d
jmp 0x1400fabf8
mov dword [rax + 4], r12d
jmp 0x1400fabf8
lea r8, [rsp + 0x20]
call fcn.1400fbf30
nop
mov rcx, rdi
call fcn.140002c40
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401e8350
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401011f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14010121a
mov rdx, qword [r15]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x140101253
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x140101240
mov r9, rdi
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.140101990
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14010127a
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1401013df
movabs rax, 0x222222222222222
cmp qword [0x14027cfc0], rax
jne 0x14010129b
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14027cfb8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, 0x78
call fcn.1401e8380
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x40], rbx
mov rdx, r15
mov rcx, rbx
call fcn.1400046f0
nop
lea rcx, [rbx + 0x20]
mov qword [rsp + 0x48], rcx
add rcx, 8
call fcn.1401001f0
nop
mov r8, qword [0x14027cfc0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140101304
cvtsi2ss xmm0, rcx
jmp 0x140101319
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14027cfe8]
xorps xmm1, xmm1
test rcx, rcx
js 0x14010132f
cvtsi2ss xmm1, rcx
jmp 0x140101344
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14027cfb0]
seta al
test al, al
je 0x14010137b
call fcn.140101660
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.140101990
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14027cfc0]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14027cfc0], r8
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
mov rax, qword [0x14027cfc8]
and rdi, qword [0x14027cfe0]
add rdi, rdi
mov r8, qword [rax + rdi*8]
cmp r8, qword [0x14027cfb8]
jne 0x1401013c0
mov qword [rax + rdi*8], rsi
jmp 0x1401013d2
cmp r8, rcx
jne 0x1401013cb
mov qword [rax + rdi*8], rsi
jmp 0x1401013d7
cmp qword [rax + rdi*8 + 8], rdx
jne 0x1401013d7
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140101400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14010142a
mov rdx, qword [r15]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x140101463
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x140101450
mov r9, rdi
mov r8, r15
lea rdx, [rsp + 0x20]
call fcn.140101990
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14010148a
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1401015ed
movabs rax, 0x222222222222222
cmp qword [0x14027cfc0], rax
jne 0x1401014ab
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14027cfb8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, 0x78
call fcn.1401e8380
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x40], rbx
mov rdx, r15
mov rcx, rbx
call fcn.1400046f0
nop
lea rcx, [rbx + 0x20]
lea rdx, [r15 + 0x20]
call fcn.140101100
nop
mov r9, qword [0x14027cfc0]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14010150f
cvtsi2ss xmm0, rcx
jmp 0x140101524
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14027cfe8]
xorps xmm1, xmm1
test rcx, rcx
js 0x14010153a
cvtsi2ss xmm1, rcx
jmp 0x14010154f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14027cfb0]
seta al
test al, al
je 0x140101586
call fcn.140101660
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.140101990
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x14027cfc0]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x14027cfc0], r9
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [0x14027cfc8]
mov rax, qword [0x14027cfe0]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x14027cfb8]
jne 0x1401015ce
mov qword [rcx + rax*8], rsi
jmp 0x1401015e0
cmp r9, rdx
jne 0x1401015d9
mov qword [rcx + rax*8], rsi
jmp 0x1401015e5
cmp qword [rcx + rax*8 + 8], r8
jne 0x1401015e5
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x140109b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x140109b34
cmp ecx, r10d
jge 0x140109b22
mov rcx, rbx
call fcn.140109300
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x140109b6e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x140109b50
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x140109b96
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x140109bc5
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x140109baf
xor dl, dl
jmp 0x140109bb8
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140109ba6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140109b72
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x140109c2f
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x140109c49
mov rcx, rbx
call fcn.140109450
test eax, eax
je 0x140109c22
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1401166b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1401166d7
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor r15d, r15d
mov ecx, r15d
test r8, r8
je 0x140116713
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x140116700
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.140116e40
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140116739
mov qword [rsi], rax
mov byte [rsi + 8], r15b
jmp 0x140116891
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [0x14027d000], rax
jne 0x14011675a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14027cff8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
mov ecx, 0x58
call fcn.1401e8380
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.1400046f0
mov qword [rdi + 0x30], r15
mov qword [rdi + 0x38], r15
mov qword [rdi + 0x40], r15
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x50], r15
mov r8, qword [0x14027d000]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1401167b7
cvtsi2ss xmm0, rcx
jmp 0x1401167cc
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14027d028]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401167e2
cvtsi2ss xmm1, rcx
jmp 0x1401167f7
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14027cff0]
seta al
test al, al
je 0x14011682e
call fcn.140116b10
mov r9, rbx
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140116e40
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r8, qword [0x14027d000]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x14027d000], r8
mov qword [rdi], rcx
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rcx + 8], rdi
mov rax, qword [0x14027d008]
and rbx, qword [0x14027d020]
add rbx, rbx
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x14027cff8]
jne 0x140116873
mov qword [rax + rbx*8], rdi
jmp 0x140116885
cmp r8, rcx
jne 0x14011687e
mov qword [rax + rbx*8], rdi
jmp 0x14011688a
cmp qword [rax + rbx*8 + 8], rdx
jne 0x14011688a
mov qword [rax + rbx*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401168b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1401168d7
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor r15d, r15d
mov ecx, r15d
test r8, r8
je 0x140116913
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x140116900
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.140116e40
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140116939
mov qword [rsi], rax
mov byte [rsi + 8], r15b
jmp 0x140116ab9
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [0x14027d000], rax
jne 0x14011695a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14027cff8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r15
mov ecx, 0x58
call fcn.1401e8380
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.1400046f0
mov ecx, dword [r14 + 0x20]
mov dword [rdi + 0x30], ecx
mov ecx, dword [r14 + 0x24]
mov dword [rdi + 0x34], ecx
mov ecx, dword [r14 + 0x28]
mov dword [rdi + 0x38], ecx
mov rdx, qword [r14 + 0x40]
mov qword [r14 + 0x40], r15
mov rcx, qword [r14 + 0x38]
mov qword [r14 + 0x38], r15
mov rax, qword [r14 + 0x30]
mov qword [r14 + 0x30], r15
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x48], rcx
mov qword [rdi + 0x50], rdx
mov r9, qword [0x14027d000]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1401169dc
cvtsi2ss xmm0, rcx
jmp 0x1401169f1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14027d028]
xorps xmm1, xmm1
test rcx, rcx
js 0x140116a07
cvtsi2ss xmm1, rcx
jmp 0x140116a1c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14027cff0]
seta al
test al, al
je 0x140116a53
call fcn.140116b10
mov r9, rbx
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140116e40
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x14027d000]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x14027d000], r9
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [0x14027d008]
mov rax, qword [0x14027d020]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x14027cff8]
jne 0x140116a9b
mov qword [rcx + rax*8], rdi
jmp 0x140116aad
cmp r9, rdx
jne 0x140116aa6
mov qword [rcx + rax*8], rdi
jmp 0x140116ab2
cmp qword [rcx + rax*8 + 8], r8
jne 0x140116ab2
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140118f50
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
test rcx, rcx
je 0x140119092
push rbx
sub rsp, 0xf0
mov rax, qword [0x140277430]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, rdx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140118f80
test rax, rax
je 0x14011907a
xorps xmm0, xmm0
xor edx, edx
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0xd0], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0xb0], xmm0
mov word [rsp + 0xb0], dx
movups xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], edx
mov rdx, rcx
movups xmmword [rsp + 0xa0], xmm0
xor ecx, ecx
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0xac], 1
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xc0], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14011907a
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.USER32.dll_WaitForInputIdle]
nop dword [rax]
mov rdx, rbx
lea rcx, [0x140118ea0]
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x140119040
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401e8350
add rsp, 0xf0
pop rbx
ret