joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006d820
Capabilities:
Reference sql statements

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x140125310]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r15, rdx
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov edi, r14d
mov dword [rsp + 0x44], r14d
lea ebx, [r14 + 9]
lea r13, str.PredMetID
cmp edi, 2
jge 0x14006da26
lea rdx, [0x1401274f8]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__5]
nop
lea rcx, [rsi + 0xa38]
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], rcx
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
mov r12d, 0x17
test edi, edi
cmove r12d, ebx
mov dword [rsp + 0x20], r12d
mov r9, r13
mov r8, r15
lea rdx, str.DELETE_FROM__s_WHERE__s___d
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
nop
cmp dword [rsp + 0x300], 0
je 0x14006d8f6
mov rcx, qword [rsi + 0xcb0]
mov rax, qword [rcx]
mov r8d, 0x10
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x28]
mov r8d, 5
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi + 0x10a8]
call qword [sym.imp.BQRCommon.dll_public:_class_ATL::CStringT_wchar_t__class_StrTraitMFC_DLL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_CRbdLicense::GetFilePWD_long_int____ptr64]
mov qword [rsp + 0x68], rax
lea rcx, [rsi + 0x828]
call qword [sym.imp.mfc140u.dll_CMFCRibbonUndoButton::GetIconSize]
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_Ordinal_285]
or r14d, 1
mov dword [rsp + 0x40], r14d
mov r9, qword [0x140127508]
mov eax, dword [r9 - 0x10]
mov rdx, qword [rsi + 0x828]
mov dword [rsp + 0x20], eax
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCTasksPane::CollapseAllGroups]
mov dword [rsp + 0x38], r12d
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r15
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x60]
mov r8, r15
lea rdx, str.INSERT_INTO__s_SELECT__FROM___s_s_._s_WHERE__s___d
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
and r14d, 0xfffffffe
mov dword [rsp + 0x40], r14d
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsi + 0xcb0]
mov rax, qword [rcx]
mov r8d, 0x10
mov rdx, qword [rsp + 0x48]
call qword [rax + 0x28]
nop
jmp 0x14006d9e7
mov ebx, 9
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
cmp dword [rcx - 0x10], 0
je 0x14006da10
xor edx, edx
call fcn.14006b920
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::DrawButton]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
inc edi
mov dword [rsp + 0x44], edi
jmp 0x14006d874
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400c5eb0
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c6908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c6952
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c6952
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c6952
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c6952
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c6952
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c6954
xor al, al
add rsp, 0x28
ret
Function at 0x140020bd0
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rax, rdx
mov rdi, rcx
lea rdx, [rbp - 4]
mov rcx, rax
call sub.shell32.dll_CommandLineToArgvW
test rax, rax
je 0x140020cc3
mov rsi, rax
mov qword [rbp - 0x28], rdi
movsxd rax, dword [rbp - 4]
mov qword [rbp - 0x20], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea r13, [rsi + rax*8]
lea rbx, [rbp - 0x40]
lea r14, [rbp - 0x58]
lea r15, [rbp - 0x20]
mov rdi, rsi
jmp 0x140020c61
add rdi, 8
mov rax, qword [rbp - 0x20]
lea rcx, [rdx + rdx*2]
mov rdx, qword [rbp - 0x30]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rbp - 0x40]
movups xmmword [rax + rcx*8], xmm0
inc qword [rbp - 0x10]
cmp rdi, r13
je 0x140020ca6
mov r12, qword [rdi]
mov rcx, r12
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rax, [r12 + rax*2]
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rax
mov word [rbp - 0x48], 0
mov rcx, rbx
mov rdx, r14
call fcn.14002b6b0
mov rdx, qword [rbp - 0x10]
cmp rdx, qword [rbp - 0x18]
jne 0x140020c40
mov rcx, r15
call fcn.14002b110
mov rdx, qword [rbp - 0x10]
jmp 0x140020c40
mov rcx, rsi
call sub.kernel32.dll_LocalFree
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x28]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rcx], xmm0
jmp 0x140020cd1
mov qword [rdi], 8
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140028370
Capabilities:
Reference wmi statements

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rbp - 0x20], 0
cmp qword [rdx + 0x10], 0
je 0x14002846b
mov qword [rbp - 0x10], rdx
lea rcx, [0x1402133aa]
call sub.oleaut32.dll_SysAllocString
mov rdi, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.oleaut32.dll_SysAllocString
mov rbx, rax
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 0xa0]
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], 0
mov rdx, rdi
mov r8, rbx
mov r9d, 0x30
call rax
mov r14d, eax
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
mov rcx, rbx
call sub.oleaut32.dll_SysFreeString
test r14d, r14d
mov rdx, qword [rbp - 0x10]
js 0x14002846b
mov rax, qword [rbp - 0x20]
mov qword [rbp - 0x18], rax
cmp qword [rdx + 0x20], 0
je 0x14002842f
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14002842f
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 0x20], 1
mov rax, qword [rbp - 0x18]
mov qword [rcx + 0x28], rax
mov rax, qword [rcx + 0x30]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rcx + 0x20]
mov qword [rsi + 0x20], rax
mov rax, qword [rcx + 0x28]
mov qword [rsi + 0x28], rax
jmp 0x14002847a
mov qword [rsi], 2
mov rcx, rdx
call fcn.140027000
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400292c0
Capabilities:
Get local ipv4 addresses

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov rsi, rcx
mov dword [rbp + 0x14], 0x3c00
mov dword [rbp + 0x10], 0
xor edi, edi
lea rbx, [rbp + 0x14]
cmp edi, 3
jae 0x1400293c0
nop dword [rax]
mov ecx, dword [rbp + 0x14]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov qword [rbp + 8], rax
je 0x140029361
mov r14, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rbp + 0x10], eax
cmp eax, 0x6f
jne 0x140029345
inc edi
mov rcx, qword [rbp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
cmp edi, 3
jb 0x140029300
jmp 0x1400293c0
test eax, eax
mov rcx, qword [rbp + 8]
jne 0x1400293bb
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rcx
mov qword [rsi], 0
jmp 0x14002941a
movzx eax, byte [0x140321f01]
mov ecx, 0x32
mov edx, 1
call fcn.14001f750
test rax, rax
je 0x14002942b
movups xmm0, xmmword [0x140213560]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x140213550]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movups xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsi], rax
mov qword [rsi + 8], 0x32
mov qword [rsi + 0x10], 0x32
jmp 0x14002941a
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rax, [rbp + 0x10]
mov qword [rbp - 8], rax
lea rax, [0x1401fefe0]
mov qword [rbp], rax
lea rax, str.r5__
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x30], 0
lea rax, [rbp - 8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x20]
lea rdx, [rbp - 0x50]
call fcn.1401f0e30
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov ecx, 1
mov edx, 0x32
call fcn.14020ea60
ud2
Function at 0x14002a8f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14002a932
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14002a93a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14002a94b
jmp 0x14002a962
xor r10d, r10d
jmp 0x14002a9ed
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14002a962
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14002a979
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14002a999
add r11, r8
jmp 0x14002aaca
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14002aa62
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14002aa10
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14002aa80
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14002aa92
jmp 0x14002aaac
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14002aaac
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14002aac6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x14002ad60
Capabilities:
Get disk information

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x2c], eax
test eax, eax
je 0x14002ad9d
movabs rax, 0x2000000000
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002d970
jmp 0x14002adab
mov qword [rsi], 8
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x40
pop rsi
ret
Function at 0x140036790
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, qword [rcx + 0x10]
test rsi, rsi
je 0x1400367b8
mov rax, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rbp
ret
lea rdx, str.RAYON_NUM_THREADSRAYON_RS_NUM_CPUSThreadPoolBuildErrorkind
lea rcx, [rbp - 0x38]
mov r8d, 0x11
call fcn.1401d22e0
movzx eax, byte [rbp - 0x20]
cmp eax, 2
je 0x14003683f
cmp eax, 3
jne 0x140036827
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x14003683f
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x10], rdx
call fcn.1401fe0e0
movzx ebx, byte [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x14003681e
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.14001f760
test bl, bl
jne 0x14003683f
jmp 0x1400368a9
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x14003683f
mov rcx, qword [rbp - 0x38]
mov r8d, 1
call fcn.14001f760
lea rdx, [0x140214341]
lea rcx, [rbp - 0x38]
mov r8d, 0x11
call fcn.1401d22e0
movzx eax, byte [rbp - 0x20]
cmp eax, 2
je 0x1400368cc
cmp eax, 3
jne 0x1400368b4
mov rdx, qword [rbp - 0x38]
test rdx, rdx
je 0x1400368cc
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x18], rax
mov r8, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x10], rdx
call fcn.1401fe0e0
movzx ebx, byte [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1400368a5
mov r8d, 1
mov rcx, qword [rbp - 0x10]
call fcn.14001f760
test bl, bl
jne 0x1400368cc
test rsi, rsi
jne 0x1400367ad
jmp 0x1400368cc
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x1400368cc
mov rcx, qword [rbp - 0x38]
mov r8d, 1
call fcn.14001f760
nop
add rsp, 0x60
pop rbx
pop rsi
pop rbp
jmp fcn.1401a4d20
Function at 0x14003aea0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, rdx
mov rsi, rcx
movups xmm0, xmmword [rdx + 0x20]
movups xmm1, xmmword [rdx + 0x30]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
mov rax, qword [rdx + 0x10]
movzx r14d, byte [rdx + 0x18]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rax
mov byte [rbp - 0x20], r14b
movzx eax, byte [0x140321f01]
mov ecx, 0x5f0
mov edx, 8
call fcn.14001f750
test rax, rax
mov qword [rbp - 8], rbx
je 0x14003b116
mov rdi, rax
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x60]
mov qword [rbp - 0x10], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
nop word cs:[rax + rax]
mov eax, 1
lock xadd qword [0x140321f28], rax
mov r13, rax
xor r13, rcx
lea r15, [rdx + r13]
mov rbx, r13
rol rbx, 0x10
xor rbx, r15
lea r12, [rbx + r8]
rol rbx, 0x15
add r13, r9
mov r15, r13
xor r15, r10
rol r13, 0x20
xor rax, r12
add rax, r15
rol r15, 0xd
xor r12, r11
xor r15, rax
rol rax, 0x20
xor r12, rbx
add r13, r12
rol r12, 0x10
xor r12, r13
add rax, r12
rol r12, 0x15
add r13, r15
rol r15, 0x11
xor r12, rax
xor r15, r13
rol r13, 0x20
xor rax, r11
add rax, r15
rol r15, 0xd
xor r15, rax
rol rax, 0x20
xor r13, 0xff
add r13, r12
rol r12, 0x10
xor r12, r13
add rax, r12
rol r12, 0x15
add r13, r15
rol r15, 0x11
xor r15, r13
rol r13, 0x20
xor r12, rax
add rax, r15
rol r15, 0xd
xor r15, rax
rol rax, 0x20
add r13, r12
rol r12, 0x10
xor r12, r13
add rax, r12
rol r12, 0x15
add r13, r15
rol r15, 0x11
xor r15, r13
rol r13, 0x20
xor r12, rax
add rax, r15
rol r15, 0xd
add r13, r12
rol r12, 0x10
xor r12, r13
rol r12, 0x15
xor r15, rax
add r13, r15
rol r15, 0x11
mov rax, r13
rol rax, 0x20
xor rax, r15
xor rax, r12
xor rax, r13
je 0x14003af70
mov rdx, qword [rbp - 8]
mov rcx, qword [rdx + 0x40]
movaps xmm0, xmmword [rbp - 0x50]
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov r8, qword [rbp - 0x18]
mov qword [rsi + 0x138], r8
mov byte [rsi + 0x140], r14b
mov qword [rsi], 0
mov qword [rsi + 8], rdi
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov r8, qword [rbp - 0x10]
mov qword [rsi + 0x100], r8
mov qword [rsi + 0x108], rax
mov qword [rsi + 0x110], rcx
mov rcx, qword [rdx + 0x48]
test rcx, rcx
je 0x14003b102
mov rdx, qword [rdx + 0x50]
test rdx, rdx
je 0x14003b102
mov r8d, 1
call fcn.14001f760
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.14020ea60
ud2
Function at 0x14004c560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x9a8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x910], xmm7
movaps xmmword [rbp + 0x900], xmm6
mov qword [rbp + 0x8f8], 0xfffffffffffffffe
mov rdi, r8
mov r13, rdx
mov r15, rcx
mov rcx, qword [rdx + 0x130]
test rcx, rcx
mov qword [rbp + 0x760], r15
je 0x14004c5c0
mov rdx, rdi
call fcn.140181bb0
test al, al
je 0x14004e7e2
lea rax, [r13 + 0x118]
mov qword [rbp + 0x3c0], rax
lea rax, [r13 + 0x20]
mov qword [rbp + 0x6d0], rax
lea rax, [r13 + 0x88]
mov qword [rbp + 0x6e8], rax
lea rax, [r13 + 0xe0]
mov qword [rbp + 0x6f0], rax
lea rax, [r13 + 0xe3]
mov qword [rbp + 0x538], rax
lea r12, [rbp + 0x78a]
xorps xmm6, xmm6
movaps xmm7, xmmword [0x140211640]
lea rax, [r13 + 0x28]
mov qword [rbp + 0x888], rax
lea rax, [r13 + 0x50]
mov qword [rbp + 0x3c8], rax
lea rax, [r13 + 0x68]
mov qword [rbp + 0x3d0], rax
lea rax, [r13 + 0x98]
mov qword [rbp + 0x778], rax
lea rax, [r13 + 0xc8]
mov qword [rbp + 0x758], rax
lea rax, [r13 + 0xf8]
mov qword [rbp + 0x3d8], rax
lea r14, [rbp + 0x5a0]
lea rax, fcn.140011570
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x8a0], r13
mov qword [rbp + 0x520], rdi
mov word [rbp + 0x7e8], 1
mov qword [rbp + 0x7d8], 1
lea rax, fcn.140011570
mov qword [rbp + 0x7e0], rax
mov dword [rbp + 0x780], 2
movzx eax, byte [0x140321f01]
mov ecx, 0x70
mov edx, 8
call fcn.14001f750
test rax, rax
je 0x14004f15f
mov rsi, rax
movups xmm0, xmmword [rbp + 0x7e0]
movups xmmword [rax + 0x60], xmm0
movups xmm0, xmmword [rbp + 0x7d0]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [rbp + 0x7c0]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rbp + 0x780]
movups xmm1, xmmword [rbp + 0x790]
movups xmm2, xmmword [rbp + 0x7a0]
movups xmm3, xmmword [rbp + 0x7b0]
movups xmmword [rax + 0x30], xmm3
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rbp + 0x240], rax
lea rdx, [r13 + 0x98]
lea rcx, [rbp + 0x780]
call fcn.1401f1540
movups xmm6, xmmword [r13 + 0xb4]
movups xmm0, xmmword [r13 + 0xc8]
movzx eax, byte [r13 + 0xd8]
mov byte [rbp + 0x3f0], al
jmp 0x14004ed53
mov ecx, 8
mov edx, 0x70
call fcn.14020ea60
jmp 0x14004f1ba
Function at 0x140059de0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x140059e76
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdetfatal_runtime_error:_thread_local_panicked_on_drop_n]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x1402135c0]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14002a8f0
test rdi, rdi
je 0x140059f05
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x140059f1e
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x14005a016
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x14005a098
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14005a023
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140059ee0
cmp r9, 8
jae 0x14005a02c
jmp 0x14005a098
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14002a8f0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14005a098
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x14005a098
mov r8, rcx
cmp r9, 8
jb 0x14005a098
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14005a030
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret