joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112fd
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e40
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e53
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014e7d
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014e91
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ea3
xor al, al
jmp 0x140014ec1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014ebf
xor al, al
jmp 0x140014ec1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012d00
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011438
movzx eax, al
test eax, eax
jne 0x140012d20
mov ecx, 7
call fcn.1400113a7
nop
mov byte [rsp + 0x20], 0
call fcn.1400113bb
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x140012d44
mov ecx, 7
call fcn.1400113a7
nop
jmp 0x140012d9c
cmp dword [0x14001e868], 0
jne 0x140012d97
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.140011203
test eax, eax
je 0x140012d78
mov eax, 0xff
jmp 0x140012ea1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.1400113b1
mov dword [0x14001e868], 2
jmp 0x140012d9c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011393
call fcn.140011325
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012df9
mov rcx, qword [rsp + 0x30]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140012df9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011357
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012e2d
mov rcx, qword [rsp + 0x38]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140012e2d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113f2
nop
call fcn.140012f50
mov dword [rsp + 0x28], eax
call fcn.1400112fd
movzx eax, al
test eax, eax
jne 0x140012e4c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012e5b
call fcn.1400113fc
nop
xor edx, edx
mov cl, 1
call fcn.14001119a
mov eax, dword [rsp + 0x28]
jmp 0x140012ea1
add rsp, 0x68
ret
Function at 0x140011082
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
jmp 0x140012230
push rbp
push rdi
sub rsp, 0x288
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x66
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x248], rax
lea rcx, [0x1400250f7]
call fcn.14001141f
nop
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x28], rax
lea rax, str.MyAutoRestartApp
mov qword [rbp + 0x48], rax
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
nop
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140012320
lea rcx, [rbp + 0x70]
call fcn.1400111db
inc rax
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, str.Program_added_to_autostart_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140012344
lea rdx, str.Failed_to_open_registry_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011091
lea rdx, [0x14001103c]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bc40]
call fcn.1400113ac
mov rcx, qword [rbp + 0x248]
xor rcx, rbp
call fcn.140011221
lea rsp, [rbp + 0x258]
pop rdi
pop rbp
ret

Function at 0x140011267
Capabilities:
Terminate process

Disassembly:
jmp 0x140013bc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011302
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f10
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014f30
xor al, al
jmp 0x140014fb1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014f43
xor al, al
jmp 0x140014fb1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014f6d
xor al, al
jmp 0x140014fb1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014f81
xor al, al
jmp 0x140014fb1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014f93
xor al, al
jmp 0x140014fb1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014faf
xor al, al
jmp 0x140014fb1
mov al, 1
add rsp, 0x38
ret
Function at 0x140012de0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011447
movzx eax, al
test eax, eax
jne 0x140012e00
mov ecx, 7
call fcn.1400113b6
nop
mov byte [rsp + 0x20], 0
call fcn.1400113ca
mov byte [rsp + 0x21], al
cmp dword [0x14001f868], 1
jne 0x140012e24
mov ecx, 7
call fcn.1400113b6
nop
jmp 0x140012e7c
cmp dword [0x14001f868], 0
jne 0x140012e77
mov dword [0x14001f868], 1
lea rdx, [0x14001b660]
lea rcx, [0x14001b330]
call fcn.140011208
test eax, eax
je 0x140012e58
mov eax, 0xff
jmp 0x140012f81
lea rdx, [0x14001b220]
lea rcx, [section..rdata]
call fcn.1400113c0
mov dword [0x14001f868], 2
jmp 0x140012e7c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113a2
call fcn.14001132a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012ed9
mov rcx, qword [rsp + 0x30]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140012ed9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.14001135c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012f0d
mov rcx, qword [rsp + 0x38]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140012f0d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011406
nop
call fcn.140013030
mov dword [rsp + 0x28], eax
call fcn.140011302
movzx eax, al
test eax, eax
jne 0x140012f2c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012f3b
call fcn.140011410
nop
xor edx, edx
mov cl, 1
call fcn.14001119a
mov eax, dword [rsp + 0x28]
jmp 0x140012f81
add rsp, 0x68
ret
Function at 0x1800975f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x60
and dword [rax - 0x48], 0
mov rdi, rcx
mov r8d, dword [0x180353bc0]
mov sil, dl
movaps xmmword [rax - 0x18], xmm6
movss xmm6, dword [0x18009193c]
mov dword [rax - 0x40], 0xff
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x18038a200], eax
jg 0x1800977c1
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x180097667
mov rax, qword [0x18038a1f0]
mov rdx, qword [0x18038a1d8]
and rax, rcx
mov r9, qword [0x18038a1c8]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x1800976b8
mov r8, qword [rdx + rax*8]
jmp 0x1800976b0
cmp rcx, r8
je 0x1800976b8
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800976a7
jmp 0x1800976ba
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x18009773b
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call fcn.180097f4c
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x1800976e4
and rbx, qword [0x18038a1f0]
mov rdx, qword [0x18038a1d8]
add rbx, rbx
mov rax, qword [0x18038a1c8]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x180097732
mov r8, qword [rdx + rbx*8]
jmp 0x18009772a
cmp rcx, r8
je 0x180097732
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180097721
jmp 0x180097734
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x180354418]
lea r8, [rax + 0x18]
mov edx, dword [r8]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x180091a34]
test sil, sil
je 0x180097770
cmp edx, 0xff
jge 0x180097786
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x18009777f
test edx, edx
jle 0x180097786
movd xmm0, edx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si edx, xmm0
mov dword [r8], edx
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
lea rcx, [rsp + 0x20]
mov rsi, qword [r11 + 0x20]
lea rax, [rsp + 0x28]
mov rdi, qword [r11 + 0x28]
test edx, edx
cmovns rcx, r8
cmp edx, 0xff
cmovle rax, rcx
mov eax, dword [rax]
mov dword [r8], eax
mov rsp, r11
pop r14
ret
lea rcx, [0x18038a200]
call fcn.180104c30
cmp dword [0x18038a200], 0xffffffff
jne 0x18009764e
mov ecx, 0x20
call fcn.180104b4c
xorps xmm0, xmm0
lea rcx, [0x18038a1d8]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x18038a1d8], 0
mov qword [0x18038a1c8], rax
movdqa xmmword [0x18038a1e0], xmm0
mov qword [0x18038a1f0], 7
mov qword [0x18038a1f8], 8
mov dword [0x18038a1c0], 0x3f800000
call fcn.180097bc8
lea rcx, [0x180170cfc]
call fcn.180105000
lea rcx, [0x18038a200]
call fcn.180104bc4
jmp 0x18009764e
Function at 0x1800978f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
and dword [rax - 0x38], 0
mov rdi, rcx
mov r8d, dword [0x180353bc0]
mov sil, dl
mov dword [rax - 0x30], 0x3f800000
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x18038a204], eax
jg 0x180097abd
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x60]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x180097962
mov rax, qword [0x18038a1b0]
mov rdx, qword [0x18038a198]
and rax, rcx
mov r9, qword [0x18038a188]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x1800979b3
mov r8, qword [rdx + rax*8]
jmp 0x1800979ab
cmp rcx, r8
je 0x1800979b3
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800979a2
jmp 0x1800979b5
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x180097a36
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call fcn.180097d08
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x60]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x1800979df
and rbx, qword [0x18038a1b0]
mov rdx, qword [0x18038a198]
add rbx, rbx
mov rax, qword [0x18038a188]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x180097a2d
mov r8, qword [rdx + rbx*8]
jmp 0x180097a25
cmp rcx, r8
je 0x180097a2d
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180097a1c
jmp 0x180097a2f
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x180354418]
lea rdx, [rax + 0x18]
movss xmm1, dword [0x18009193c]
movss xmm0, dword [rdx]
subss xmm1, dword [rcx + 0x18]
mulss xmm1, dword [rsp + 0x80]
test sil, sil
je 0x180097a6f
comiss xmm0, dword [0x18009193c]
jae 0x180097a80
addss xmm0, xmm1
jmp 0x180097a7c
comiss xmm0, dword [0x18009180c]
jbe 0x180097a80
subss xmm0, xmm1
movss dword [rdx], xmm0
comiss xmm0, dword [0x18009180c]
mov rbx, qword [rsp + 0x68]
lea rcx, [rsp + 0x20]
mov rbp, qword [rsp + 0x70]
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
cmovae rcx, rdx
comiss xmm0, dword [0x18009193c]
cmovbe rax, rcx
movss xmm0, dword [rax]
movss dword [rdx], xmm0
add rsp, 0x50
pop rdi
ret
lea rcx, [0x18038a204]
call fcn.180104c30
cmp dword [0x18038a204], 0xffffffff
jne 0x180097949
mov ecx, 0x20
call fcn.180104b4c
xorps xmm0, xmm0
lea rcx, [0x18038a198]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x18038a198], 0
mov qword [0x18038a188], rax
movdqa xmmword [0x18038a1a0], xmm0
mov qword [0x18038a1b0], 7
mov qword [0x18038a1b8], 8
mov dword [0x18038a180], 0x3f800000
call fcn.180097bc8
lea rcx, [0x180170d08]
call fcn.180105000
lea rcx, [0x18038a204]
call fcn.180104bc4
jmp 0x180097949
Function at 0x180097d08
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x180097d37
mov rax, qword [0x18038a1b0]
mov rcx, qword [0x18038a198]
and rax, r15
mov r14, qword [0x18038a188]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x180097da2
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x18038a190], rax
jne 0x180097de1
lea rcx, [0x18008a470]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x180097db4
cmp rbx, rdx
je 0x180097dd7
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180097dab
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x180097d81
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x180097f28
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x180097dc6
mov ecx, 0x20
call fcn.180104b4c
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x18038a190]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x180097e12
cvtsi2ss xmm1, rcx
jmp 0x180097e27
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x18038a1b8]
xorps xmm0, xmm0
test rcx, rcx
js 0x180097e3d
cvtsi2ss xmm0, rcx
jmp 0x180097e52
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x18038a180]
comiss xmm0, xmm1
jae 0x180097ec0
call fcn.180098190
mov rcx, qword [0x18038a1b0]
mov rdx, qword [0x18038a198]
and rcx, r15
mov rbx, qword [0x18038a188]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x180097eac
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x180097ea3
mov rbx, rax
cmp rax, r8
je 0x180097f03
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180097e97
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x18038a190]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x18038a190], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x18038a1b0]
mov rcx, qword [0x18038a198]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x18038a188]
jne 0x180097f0a
mov qword [rcx + rax*8], rdi
jmp 0x180097f1c
mov qword [rsp + 0x20], rax
jmp 0x180097eb1
cmp r8, rbp
jne 0x180097f15
mov qword [rcx + rax*8], rdi
jmp 0x180097f21
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180097f21
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180097f4c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x180097f7b
mov rax, qword [0x18038a1f0]
mov rcx, qword [0x18038a1d8]
and rax, r15
mov r14, qword [0x18038a1c8]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x180097fe6
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x18038a1d0], rax
jne 0x180098025
lea rcx, [0x18008a470]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x180097ff8
cmp rbx, rdx
je 0x18009801b
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180097fef
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x180097fc5
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18009816c
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x18009800a
mov ecx, 0x20
call fcn.180104b4c
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x18038a1d0]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x180098056
cvtsi2ss xmm1, rcx
jmp 0x18009806b
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x18038a1f8]
xorps xmm0, xmm0
test rcx, rcx
js 0x180098081
cvtsi2ss xmm0, rcx
jmp 0x180098096
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x18038a1c0]
comiss xmm0, xmm1
jae 0x180098104
call fcn.1800983e0
mov rcx, qword [0x18038a1f0]
mov rdx, qword [0x18038a1d8]
and rcx, r15
mov rbx, qword [0x18038a1c8]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x1800980f0
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1800980e7
mov rbx, rax
cmp rax, r8
je 0x180098147
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800980db
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x18038a1d0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x18038a1d0], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x18038a1f0]
mov rcx, qword [0x18038a1d8]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x18038a1c8]
jne 0x18009814e
mov qword [rcx + rax*8], rdi
jmp 0x180098160
mov qword [rsp + 0x20], rax
jmp 0x1800980f5
cmp r8, rbp
jne 0x180098159
mov qword [rcx + rax*8], rdi
jmp 0x180098165
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180098165
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180098190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x18038a190]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x1800981ba
cvtsi2ss xmm1, rcx
jmp 0x1800981cf
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x18038a180]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x180098202
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x180098202
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x180091b34]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180098227
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180098227
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x18038a1b8]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18009825c
cmp rdx, 0x200
jae 0x180098259
shl rdx, 3
cmp rdx, rcx
jae 0x18009825c
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x180098283
lea rcx, [0x18008a490]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x18038a188]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18038a198]
lea rdx, [rdi + rdi]
call fcn.180097bc8
mov rax, qword [0x18038a188]
lea r9, [rdi - 1]
mov qword [0x18038a1b0], r9
mov qword [0x18038a1b8], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x1800983cf
mov rdx, qword [rdx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [rax + r8 + 0x10]
movabs r10, 0x100000001b3
xor r11, rcx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x1800982e8
mov rdi, qword [0x18038a198]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180098326
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180098395
mov rcx, qword [rdi + r11*8 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rcx + 0x10]
jne 0x18009836a
mov r8, qword [rcx]
cmp r8, rax
je 0x18009831f
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rcx, qword [r8 + 8]
mov qword [rcx], rax
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], rcx
jmp 0x18009831f
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
je 0x1800983a9
cmp qword [rdi + r11*8], rcx
jne 0x180098360
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rax
mov qword [rcx + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], r8
mov qword [rdi + r11*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x1800983cf
mov r9, qword [0x18038a1b0]
jmp 0x1800982d8
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x180098395
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret