joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001f90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [rdx], 2
movdqa xmmword [rcx], xmm0
ret

Function at 0x1400480d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor r12d, r12d
xor r13d, r13d
xor edi, edi
cmp r8, 0x201
jae 0x140048170
jmp 0x14004815f
jae 0x14004822e
cmp r8, 0x201
jae 0x140048170
lea rbx, [rbp - 0x58]
mov r14d, 0x200
mov rsi, r8
jmp 0x1400481c7
sub r8, rdi
sub r13, rdi
cmp r13, r8
jae 0x14004819f
lea rcx, [rbp + 0x3c8]
mov rdx, rdi
call fcn.14006f540
mov r12, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp r12, rax
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rbp + 0x3d8], rdi
mov r13, r12
mov rbx, qword [rbp + 0x3e8]
mov r14, rdi
mov rsi, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r15d, eax
test eax, eax
jne 0x1400481ef
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140048296
mov r8d, r15d
cmp rsi, r8
jne 0x140048150
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400482b9
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x14004815f
jmp 0x140048170
cmp r14, r8
jb 0x1400482d3
lea rcx, [rbp + 0x3a8]
mov rdx, rbx
call fcn.14004b520
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r12, r12
je 0x14004827f
add r12, r12
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, r12
call fcn.140042ea0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test r12, r12
jne 0x140048267
jmp 0x14004827f
lea rcx, [0x140071af3]
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400701a0
jmp 0x1400482e8
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140070530
ud2
Function at 0x14004be20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x38]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14004be53
test ecx, ecx
jne 0x14004bea2
movzx r15d, byte [rdi + 0x3a]
cmp al, 0xff
je 0x14004be60
test ecx, ecx
jne 0x14004bea2
mov rcx, rdi
call fcn.14004bd00
movzx r10d, al
test bl, bl
jne 0x14004bea9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14004be96.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14004c01c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14004be96.2
xor r10d, r10d
test bl, bl
je 0x14004be70
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14004bffe
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14004bedb
xor edi, edi
jmp 0x14004bf58
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14004bf20
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14004bf3b
inc rsi
dec rax
cmp rsi, 1
jne 0x14004bf00
jmp 0x14004bf58
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14004bf3b
cmp ebx, 0x5c
je 0x14004bf3b
inc rsi
dec rax
cmp rsi, 1
jne 0x14004bf20
jmp 0x14004bf58
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14004c00c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14004bf82
mov al, 9
cmp rdx, 2
je 0x14004bf86
cmp rdx, 1
jne 0x14004bf96
cmp byte [r9], 0x2e
jne 0x14004bf96
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14004bf96
mov al, 0xa
jmp 0x14004bf96
cmp byte [r9], 0x2e
jne 0x14004bf96
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14004be96.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14004be96.2
mov esi, 2
jmp case.0x14004be96.2
lea r8, str.library_std_srcpath.rs
call fcn.140070520
ud2
lea r8, str.library_std_srcpath.rs
call fcn.140070520
ud2
Function at 0x14005f710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
test r8, r8
je 0x14005f78a
mov r11, rdx
mov rdx, qword [rsp + 0x70]
mov ebp, ecx
shr ebp, 8
lea r8, [r11 + r8*2]
xor eax, eax
mov rbx, r11
movzx edi, byte [r11 + 1]
add r11, 2
lea r10, [rax + rdi]
cmp byte [rbx], bpl
jne 0x14005f780
cmp r10, rax
jb 0x14005f81d
cmp r10, rdx
ja 0x14005f831
add rax, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14005f782
lea rsi, [rbx + 1]
cmp byte [rax + rbx], cl
mov rbx, rsi
jne 0x14005f760
jmp 0x14005f7f2
ja 0x14005f78a
mov rax, r10
cmp r11, r8
jne 0x14005f730
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14005f7f6
mov rsi, qword [rsp + 0x78]
add rdx, rsi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea rbx, [rsi + 1]
movzx edi, byte [rsi]
test dil, dil
js 0x14005f7d0
mov rsi, rbx
sub ecx, edi
jns 0x14005f7e9
jmp 0x14005f7f8
cmp rbx, rdx
je 0x14005f803
movzx ebp, byte [rsi + 1]
add rsi, 2
and edi, 0x7f
shl edi, 8
or edi, ebp
sub ecx, edi
js 0x14005f7f8
xor al, 1
cmp rsi, rdx
jne 0x14005f7b0
jmp 0x14005f7f8
xor eax, eax
jmp 0x14005f7f8
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.0V_a_
mov edx, 0x2b
call fcn.1400701a0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, rax
mov rdx, r10
call fcn.140070540
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140070530
ud2

Function at 0x140061424
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006146e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006146e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006146e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006146e
cmp dword [rcx + 0x84], 0xe
jbe 0x14006146e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140061470
xor al, al
add rsp, 0x28
ret

Function at 0x1400657b4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400655a4
Function at 0x140068820
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140068850
xor eax, eax
jmp 0x140068913
mov rbp, rbx
cmp word [rax], si
je 0x140068875
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14006885c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140068858
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140068770
movsxd r14, eax
test eax, eax
jne 0x1400688b3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140068849
mov rcx, r14
call fcn.1400696d4
mov rdi, rax
test rax, rax
jne 0x1400688cc
xor ecx, ecx
call fcn.140066e00
jmp 0x1400688a8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140068770
test eax, eax
jne 0x1400688fd
mov rcx, rdi
call fcn.140066e00
jmp 0x140068907
xor ecx, ecx
call fcn.140066e00
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14006bddc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140067874
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14006be66
cmp byte [rbp - 0x21], r15b
je 0x14006be61
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14006be9c
call fcn.140069ef4
test eax, eax
jne 0x14006be88
cmp byte [rbp - 0x21], r15b
je 0x14006be80
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14006be9c
cmp byte [rbp - 0x21], r15b
je 0x14006be99
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140066e50
test eax, eax
jne 0x14006bf3c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140067874
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14006bedb
cmp byte [rbp - 0x21], r15b
je 0x14006bf10
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14006bf10
call fcn.140069ef4
test eax, eax
jne 0x14006befc
cmp byte [rbp - 0x21], r15b
je 0x14006bef5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14006bf10
cmp byte [rbp - 0x21], r15b
je 0x14006bf0d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140066e50
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14006bf3c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14006bf3f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14006bf4d
mov rcx, rdi
call fcn.140066e00
cmp byte [rbp + 0x3f], r15b
je 0x14006bf5c
mov rcx, qword [rbp + 0x27]
call fcn.140066e00
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000df20
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140017ee0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140002b88
xor ebx, ebx
cmp qword [0x140018d48], rbx
mov rdi, rax
jne 0x14000e033
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000e10a
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000e10a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140018d48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140018d50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140018d58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140018d68], rax
test rax, rax
je 0x14000e02a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140018d60], rax
jmp 0x14000e03a
mov rax, qword [0x140018d60]
jmp 0x14000e041
mov rax, qword [0x140018d60]
mov r11, qword [0x140018d68]
cmp rax, rdi
je 0x14000e0a8
cmp r11, rdi
je 0x14000e0a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140018d68]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000e0a8
test rax, rax
je 0x14000e0a8
call rsi
test rax, rax
je 0x14000e0a2
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14000e0a2
test byte [rsp + 0x40], 1
jne 0x14000e0a8
bts ebp, 0x15
jmp 0x14000e0e8
mov rcx, qword [0x140018d50]
cmp rcx, rdi
je 0x14000e0e8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000e0e8
call rax
mov rbx, rax
test rax, rax
je 0x14000e0e8
mov rcx, qword [0x140018d58]
cmp rcx, rdi
je 0x14000e0e8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000e0e8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140018d48]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000e10a
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14000e10c
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400067a0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e5fb
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140017ee0]
jne 0x1400067ba
rol rcx, 0x10
test cx, 0xffff
jne 0x1400067b6
repz ret
ror rcx, 0x10
jmp 0x14000e554
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140018e10]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140018f08]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14000e5d9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140018e10]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14000e5fb
mov rax, qword [rsp + 0x88]
mov qword [0x140018f08], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140018ea8], rax
mov rax, qword [0x140018f08]
mov qword [0x140018d80], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140018e90], rax
mov dword [0x140018d70], 0xc0000409
mov dword [0x140018d74], 1
mov rax, qword [0x140017ee0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140017ee8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140018e08], eax
mov ecx, 1
call fcn.14000677c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140014980]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140018e08], 0
jne 0x14000e682
mov ecx, 1
call fcn.14000677c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000c43c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140014c60], rbx
je 0x14000c4a3
cmp rax, rbx
jne 0x14000c496
mov ebx, 1
mov esi, ebx
jmp 0x14000c4a8
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000c47b
mov ebx, 1
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c4c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14000c52c
mov eax, dword [0x140014c68]
test eax, eax
jne 0x14000c521
mov dword [0x140014c68], ebx
lea r15, [0x14000eba0]
lea rdi, [0x14000eb88]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000c513
test eax, eax
jne 0x14000c517
cmp qword [rdi], r14
je 0x14000c508
mov rax, qword [rdi]
mov rcx, qword [0x14000eb40]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000c4ea
test eax, eax
je 0x14000c527
mov eax, 0xff
jmp 0x14000c682
mov dword [0x1400143e4], ebx
mov edi, 0x1f
mov eax, dword [0x140014c68]
cmp eax, ebx
jne 0x14000c553
lea rdx, [0x14000eb80]
lea rcx, [0x14000eb48]
call sub.msvcrt.dll__initterm
mov dword [0x140014c68], 2
test esi, esi
jne 0x14000c561
mov rax, r14
xchg qword [0x140014c60], rax
cmp qword [0x140014c80], r14
je 0x14000c594
lea rcx, [0x140014c80]
call fcn.14000ca70
test eax, eax
je 0x14000c594
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140014c80]
mov r9, qword [0x14000eb40]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000c5ad
mov eax, 0xff
jmp 0x14000c682
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000c633
test ax, ax
je 0x14000c5c8
test edx, edx
jne 0x14000c633
sub ax, bx
cmp ax, di
ja 0x14000c5de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000c5c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001878
mov dword [0x1400143e0], eax
cmp dword [0x140014400], r14d
jne 0x14000c61c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400143e4], r14d
jne 0x14000c631
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400143e0]
jmp 0x14000c682
cmp ax, 0x22
jne 0x14000c647
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000c5b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14018e000
add rsp, 0x28
jmp 0x14000c43c
Function at 0x180002b58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r10, rdx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r8 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x180002b68
mov rdx, qword [0x1801ab890]
mov r9, qword [0x1801ab878]
and rdx, rcx
mov rcx, qword [0x1801ab868]
add rdx, rdx
mov rax, qword [r9 + rdx*8 + 8]
cmp rax, rcx
je 0x180002bc5
mov r9, qword [r9 + rdx*8]
mov edx, dword [r8]
jmp 0x180002bbe
cmp rax, r9
je 0x180002bc5
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180002bb5
jmp 0x180002bc7
xor eax, eax
test rax, rax
cmovne rcx, rax
mov rax, r10
mov qword [r10], rcx
ret

Function at 0x180004d7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r10, rdx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r8 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x180004d8c
mov rdx, qword [0x1801acd90]
mov r9, qword [0x1801acd78]
and rdx, rcx
mov rcx, qword [0x1801acd68]
add rdx, rdx
mov rax, qword [r9 + rdx*8 + 8]
cmp rax, rcx
je 0x180004de9
mov r9, qword [r9 + rdx*8]
mov edx, dword [r8]
jmp 0x180004de2
cmp rax, r9
je 0x180004de9
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180004dd9
jmp 0x180004deb
xor eax, eax
test rax, rax
cmovne rcx, rax
mov rax, r10
mov qword [r10], rcx
ret
Function at 0x180004dfc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 4
jb 0x180004e24
mov rax, qword [0x1801acd90]
mov rcx, qword [0x1801acd78]
and rax, r15
mov rbp, qword [0x1801acd68]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, rbp
jne 0x180004eb4
mov rbx, rbp
mov rsi, rbp
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [0x1801acd70], rax
je 0x18000501e
mov ecx, 0x18
call fcn.180032440
mov rcx, qword [r12]
mov rdi, rax
xorps xmm0, xmm0
mov qword [rax + 0x10], rcx
mov r8, qword [0x1801acd70]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x180004ef3
cvtsi2ss xmm0, rcx
jmp 0x180004f08
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x180004ec6
cmp rbx, rdx
je 0x180004ee9
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x180004ebd
mov rbp, qword [rbx]
mov rax, rbx
mov rsi, rbp
mov rbx, rbp
test rax, rax
je 0x180004e6e
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x180005004
mov rbp, rbx
xor eax, eax
mov rsi, rbx
jmp 0x180004ed7
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1801acd98]
xorps xmm1, xmm1
test rcx, rcx
js 0x180004f1e
cvtsi2ss xmm1, rcx
jmp 0x180004f33
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1801acd60]
jbe 0x180004f9b
call fcn.1800050a4
mov rcx, qword [0x1801acd90]
mov rdx, qword [0x1801acd78]
and rcx, r15
mov rbx, qword [0x1801acd68]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x180004f87
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x180004f7f
mov rbx, rax
cmp rax, r8
je 0x180004fde
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180004f73
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rsi, rbx
mov r8, qword [0x1801acd70]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801acd70], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1801acd90]
mov rcx, qword [0x1801acd78]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801acd68]
jne 0x180004fe5
mov qword [rcx + rax*8], rdi
jmp 0x180004ff7
mov qword [rsp + 0x20], rax
jmp 0x180004f8c
cmp r8, rsi
jne 0x180004ff0
mov qword [rcx + rax*8], rdi
jmp 0x180004ffc
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180004ffc
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x60]
mov rax, r14
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180032348
int3