joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021870
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r9d, edx
movzx edx, dl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
mov eax, r9d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr rax, 0x18
xor rdx, rax
imul rdx, r10
mov rcx, qword [r8 + 0x30]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + 8]
je 0x1400218eb
mov rcx, qword [rcx]
nop
cmp r9d, dword [rax + 0x10]
je 0x1400218ed
cmp rax, rcx
jne 0x14002192d
xor eax, eax
test rax, rax
je 0x1400218ff
mov qword [rsp + 0x40], rax
cmp rax, qword [r8 + 8]
jne 0x140021924
jmp 0x140021908
mov rax, qword [r8 + 8]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x38]
mov rcx, r8
call fcn.140027b30
jmp 0x140021928
add rax, 0x14
add rsp, 0x28
ret
mov rax, qword [rax + 8]
jmp 0x1400218e0

Function at 0x140021940
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r9d, edx
movzx edx, dl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
mov eax, r9d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr rax, 0x18
xor rdx, rax
imul rdx, r10
mov rcx, qword [r8 + 0x30]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + 8]
je 0x1400219bb
mov rcx, qword [rcx]
nop
cmp r9d, dword [rax + 0x10]
je 0x1400219bd
cmp rax, rcx
jne 0x140021a1e
xor eax, eax
mov rdx, qword [r8 + 8]
test rax, rax
je 0x1400219d4
cmp rax, rdx
je 0x1400219d4
mov rax, qword [rax + 0x18]
add rsp, 0x28
ret
mov rcx, qword [r8 + 0x30]
movabs rax, 0xad2aca7747985764
and rcx, rax
add rcx, rcx
mov r8, qword [r8 + 0x18]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x140021a24
mov rcx, qword [r8 + rcx*8]
nop word [rax + rax]
cmp dword [rax + 0x10], 1
jne 0x140021a0c
mov rax, qword [rax + 0x18]
jmp 0x140021a19
cmp rax, rcx
je 0x140021a24
mov rax, qword [rax + 8]
jmp 0x140021a00
add rsp, 0x28
ret
mov rax, qword [rax + 8]
jmp 0x1400219b0
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x140021a40
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r9d, edx
movzx edx, dl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
mov eax, r9d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r9d
shr rax, 0x18
xor rdx, rax
imul rdx, r10
mov rcx, qword [r8 + 0x30]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + 8]
je 0x140021abb
mov rcx, qword [rcx]
nop
cmp r9d, dword [rax + 0x10]
je 0x140021abd
cmp rax, rcx
jne 0x140021b1e
xor eax, eax
mov rdx, qword [r8 + 8]
test rax, rax
je 0x140021ad4
cmp rax, rdx
je 0x140021ad4
movzx eax, byte [rax + 0x14]
add rsp, 0x28
ret
mov rcx, qword [r8 + 0x30]
movabs rax, 0xad2aca7747985764
and rcx, rax
add rcx, rcx
mov r8, qword [r8 + 0x18]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x140021b24
mov rcx, qword [r8 + rcx*8]
nop word [rax + rax]
cmp dword [rax + 0x10], 1
jne 0x140021b0c
movzx eax, byte [rax + 0x14]
jmp 0x140021b19
cmp rax, rcx
je 0x140021b24
mov rax, qword [rax + 8]
jmp 0x140021b00
add rsp, 0x28
ret
mov rax, qword [rax + 8]
jmp 0x140021ab0
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x140026e80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140026f53
cmp byte [rcx + 0x71], 0
je 0x140026f53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140026f4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140026f14
sub eax, 1
je 0x140026f18
cmp eax, 2
jne 0x140026f4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140073840
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140026f46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140026f4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140026efc
xor al, al
jmp 0x140026efc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140073840
add rsp, 0x60
pop rbx
ret
Function at 0x1400271f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400273af
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14000e340
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140027374
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
mov r10d, dword [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r10d
mov rcx, qword [rcx]
shr edx, 8
movzx r9d, dl
movzx edx, r10b
xor rdx, rbp
imul rdx, rdi
xor r9, rdx
mov edx, r10d
imul r9, rdi
shr edx, 0x10
movzx r8d, dl
mov edx, r10d
xor r9, r8
shr rdx, 0x18
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400272f2
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140027363
mov rdx, qword [r11 + 8]
cmp r10d, dword [rdx + 0x10]
jne 0x14002732b
mov r10, qword [rdx]
cmp r10, rax
je 0x140027325
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140027363
cmp r8, rdx
je 0x14002733f
mov rdx, qword [rdx + 8]
cmp r10d, dword [rdx + 0x10]
je 0x140027389
cmp r8, rdx
jne 0x140027330
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140027290
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140027363
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400273e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140027405
cvtsi2ss xmm0, rdx
jmp 0x14002741a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14007ea8c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140027448
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140027448
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14002747a
cmp rbx, 0x200
jae 0x140027477
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14002747a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140026f70
Function at 0x140027a80
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, dword [rdx]
mov r9, rcx
movabs r11, 0x100000001b3
movzx r8d, r10b
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, r10d
imul r8, r11
shr eax, 8
movzx edx, al
mov eax, r10d
xor r8, rdx
shr eax, 0x10
imul r8, r11
movzx ecx, al
mov eax, r10d
xor r8, rcx
shr rax, 0x18
mov rcx, qword [r9 + 0x30]
imul r8, r11
xor r8, rax
imul r8, r11
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r9 + 8]
je 0x140027b18
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x140027b0f
nop dword [rax]
cmp rax, rcx
je 0x140027b18
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140027b00
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3

Function at 0x140027b30
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, dword [rdx]
mov r9, rcx
movabs r11, 0x100000001b3
movzx r8d, r10b
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, r10d
imul r8, r11
shr eax, 8
movzx edx, al
mov eax, r10d
xor r8, rdx
shr eax, 0x10
imul r8, r11
movzx ecx, al
mov eax, r10d
xor r8, rcx
shr rax, 0x18
mov rcx, qword [r9 + 0x30]
imul r8, r11
xor r8, rax
imul r8, r11
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r9 + 8]
je 0x140027bc8
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x140027bbf
nop dword [rax]
cmp rax, rcx
je 0x140027bc8
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140027bb0
add rax, 0x14
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x14002a9e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
jne 0x14002aa14
xor al, al
jmp 0x14002abeb
cmp qword [rcx + 0x18], 0xf
jbe 0x14002aa1e
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002aa3c
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14002aa3c
shr eax, 4
and al, 1
je 0x14002aa3c
mov al, 1
jmp 0x14002abeb
mov esi, 0xffffffff
cmp qword [rbx + 0x18], 0xf
jbe 0x14002aa4b
mov rbx, qword [rbx]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], sendto
mov byte [rbp - 0x30], al
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x38]
mov rdx, qword [0x140097418]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
je 0x14002aba4
movzx ebx, byte [rbp - 0x40]
movzx edi, byte [rbp - 0x40]
nop
mov r14, 0xffffffffffffffff
nop word [rax + rax]
inc r14
cmp byte [rcx + r14], 0
jne 0x14002aaa0
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x14002aaea
lea rax, [r14 + rdx]
mov qword [rbp - 0x20], rax
lea rsi, [rbp - 0x30]
cmp r8, 0xf
cmova rsi, qword [rbp - 0x30]
add rsi, rdx
mov r8, r14
mov rdx, rcx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + r14], 0
jmp 0x14002ab02
mov qword [rsp + 0x20], r14
mov r9, rcx
movzx r8d, bl
mov rdx, r14
lea rcx, [rbp - 0x30]
call fcn.1400069f0
mov r9, qword [0x140097418]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [r9 + rsi], 0
jne 0x14002ab10
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x14002ab5a
lea rax, [rsi + rcx]
mov qword [rbp - 0x20], rax
lea r14, [rbp - 0x30]
cmp rdx, 0xf
cmova r14, qword [rbp - 0x30]
add r14, rcx
mov r8, rsi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rsi], 0
jmp 0x14002ab6f
mov qword [rsp + 0x20], rsi
movzx r8d, dil
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.1400069f0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov esi, eax
lea r8, [rbp - 0x38]
mov rdx, qword [0x140097418]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
jne 0x14002aa90
cmp esi, 0xffffffff
setne bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14002abe8
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002abe3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002abe3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734ec
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140073840
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14002b880
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rax, r8
mov rdi, rcx
test r8, r8
jne 0x14002b8d6
mov rcx, qword [rcx + 0x80]
lea r9, str.toFile
mov edx, ebx
lea r8, [rcx + 0xa0]
call fcn.140020ab0
test al, al
je 0x14002b996
mov rcx, qword [rdi + 0x80]
mov edx, ebx
call fcn.14002b660
test rax, rax
je 0x14002b996
lea rcx, [rax + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3b]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x270]
and rcx, rdx
mov rdx, qword [rdi + 0x248]
shl rcx, 4
add rcx, qword [rdi + 0x258]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x14002b960
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x14002b962
nop
cmp rax, rcx
je 0x14002b960
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x14002b950
jmp 0x14002b962
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x14002b975
mov dword [rax + 0x14], 0
mov r8, qword [0x14009a7f8]
test r8, r8
je 0x14002b996
mov rcx, qword [rdi + 0x80]
add r8, 0xe8
mov edx, ebx
call fcn.1400339f0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002b9b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, rdx
mov rdi, rcx
call qword [rax + 0x58]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
mov r8, qword [rbx + 0x10]
mov rsi, rax
jbe 0x14002b9df
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x14002ba13
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14002ba00
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14001dac0
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14002ba30
mov rbx, qword [rsi + 8]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x58]
cmp rbx, qword [rax + 8]
jne 0x14002ba51
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14002c170
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
lea rdi, [0x14009a8a0]
mov rsi, r8
mov rbx, rcx
xor ebp, ebp
mov rdx, rdi
mov rcx, rax
lea r8d, [rbp + 0x32]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rbp
test rdi, rdi
je 0x14002c1de
cmp byte [rdi], bpl
je 0x14002c1de
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
nop dword [rax + rax]
inc r8
cmp byte [rdi + r8], bpl
jne 0x14002c1d0
mov rdx, rdi
jmp 0x14002c1ff
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
inc r8
cmp byte [rsi + r8], bpl
jne 0x14002c1f3
mov rdx, rsi
mov rcx, rbx
call fcn.140006860
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x14002c220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
mov r14, rcx
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x40], xmm1
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x14002c260
lea rcx, [rsp + 0x30]
call fcn.140006860
mov rsi, qword [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
cmp rsi, 0xf
mov r8, qword [rsp + 0x40]
movabs r9, 0xcbf29ce484222325
cmova rdx, rdi
xor ecx, ecx
test r8, r8
je 0x14002c2c3
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14002c2b0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [r14 + 0x18]
call fcn.14001dac0
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14002c2e3
mov rbx, qword [r14 + 0x20]
cmp rsi, 0xf
jbe 0x14002c31d
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002c315
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002c315
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400734ec
cmp rbx, qword [r14 + 0x20]
je 0x14002c333
cmp qword [rbx + 0x48], 0xf
lea rax, [rbx + 0x30]
jbe 0x14002c33a
mov rax, qword [rax]
jmp 0x14002c33a
lea rax, [0x14007f226]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073840
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14002c630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rbp, rcx
call fcn.14002c7b0
mov rdx, qword [rsi]
mov rax, qword [rdx + 0x58]
mov edx, dword [rdx]
mov rcx, qword [rax + 0x80]
call fcn.14002b6f0
mov r10, rax
mov r8, qword [rax + 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002c67f
mov rdx, qword [rax]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x14002c6b3
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r8
jb 0x14002c6a0
mov r8, r10
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x60]
call fcn.14001dac0
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x14002c6d1
mov rbx, qword [rbp + 0x68]
mov rbx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14002c7a3
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14002c793
mov qword [rbp + 0xf0], rsi
mov r8, qword [rsi]
mov rax, qword [r8 + 0x58]
mov rcx, qword [rax + 0x290]
mov rax, qword [rcx]
cmp dword [rsi + 8], 2
sete r9b
lea rdx, [rsp + 0x38]
call qword [rax + ioctlsocket]
nop
mov rdx, rax
mov rcx, rbp
call fcn.14002b130
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14002c76e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002c768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002c768
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400734ec
nop
mov rcx, rbx
call fcn.140072c8b
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140073840
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14002c7b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rdx
mov r15, rcx
lea rbx, [rcx + 0xa0]
mov qword [rsp + 0x28], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14002ca12
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14002ca02
mov rdx, qword [rdi]
mov rax, qword [rdx + 0x58]
mov edx, dword [rdx]
mov rcx, qword [rax + 0x80]
call fcn.14002b6f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140018b00
nop
lea r13, [r15 + 0x60]
lea r8, [rsp + 0x40]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x14002c884
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x14002c870
mov rcx, qword [r15 + 0x90]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x78]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r15 + 0x68]
cmp rdi, r12
je 0x14002c8ef
mov r15, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14002c8c2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x14002c8e0
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002c8eb
cmp rdi, r15
je 0x14002c8ef
mov rdi, qword [rdi + 8]
jmp 0x14002c8b0
xor esi, esi
jmp 0x14002c8f3
xor esi, esi
mov edi, esi
mov rax, r12
test rdi, rdi
cmovne rax, rdi
cmp rax, r12
jne 0x14002c994
mov ecx, 0x50
call fcn.1400734b0
mov rdi, rax
test rax, rax
je 0x14002c948
mov dword [rax], esi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
xorps xmm0, xmm0
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x38], xmm0
mov qword [rax + 0x48], 0
mov edx, 0x102
mov rcx, rax
call sub.MSVCP140.dll__Mtx_init_in_situ
jmp 0x14002c94b
mov rdi, rsi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140018b00
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x80], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.14001f1d0
nop
lea rcx, [rsp + 0x60]
call fcn.1400241a0
nop
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
cmp r14, 0xf
jbe 0x14002c9cf
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x14002c9c6
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002c9c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1400734ec
nop
mov rcx, rbx
call fcn.140072c8b
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140073840
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3