joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180033c10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.180033d70
mov rdi, rax
movabs r8, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rcx, rbx
shr rcx, 8
movzx edx, cl
movzx ecx, bl
xor rcx, rax
mov rax, rbx
shr rax, 0x10
imul rcx, r8
xor rdx, rcx
movzx ecx, al
imul rdx, r8
mov rax, rbx
xor rdx, rcx
shr rax, 0x18
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x20
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x28
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x30
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rdi + 0x480]
imul rdx, r8
xor rdx, rax
imul rdx, r8
and rcx, rdx
mov rdx, qword [rdi + 0x458]
shl rcx, 4
add rcx, qword [rdi + 0x468]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x180033cf6
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x180033cf8
cmp rax, rcx
je 0x180033cf6
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x180033ce5
jmp 0x180033cf8
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x180033d44
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x180033d3b
mov r8, qword [0x18014fe60]
mov rcx, rdi
mov r8, qword [r8 + 0xb0]
call fcn.18008cd80
mov rax, qword [0x18014fe68]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x30]
lea rdx, str.Failed_to_find_handler_for_native_0x_p
jmp 0x180033d4b
lea rdx, str.Failed_to_find_current_hash_for_native_0x_p
mov rcx, qword [0x18014fe40]
mov r8, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18008a8e0
Function at 0x180035db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180136280]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov qword [rsp + 0x68], rdx
xor esi, esi
mov eax, esi
lea r11, [0x180119512]
lea r10, str.MPPLY_LAST_MP_CHAR
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r8d, [r9 - 0x41]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
cmp r8b, 0x19
cmova edx, r9d
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
inc r10
cmp r10, r11
jne 0x180035df0
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul ebx, eax, 0x8001
call fcn.180033d70
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180033d70
mov rdx, rax
mov ecx, dword [rax + 8]
mov rax, qword [rax + 0x10]
mov dword [rax + rcx*8], ebx
inc dword [rdx + 8]
call fcn.180033d70
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
lea r8, [rsp + 0x68]
mov qword [rcx + rdx*8], r8
inc dword [rax + 8]
call fcn.180033d70
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
inc dword [rax + 8]
movabs rcx, 0x767fbc2ac802ef3d
call fcn.180033c10
call fcn.180033d70
mov edx, dword [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.180036f70
nop
mov r9d, 2
lea r8, [0x180119518]
xor edx, edx
lea rcx, [rsp + 0x48]
call fcn.180024700
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x38], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x180119514]
lea rcx, [rsp + 0x28]
call fcn.180031c00
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x28]
call fcn.180032ad0
nop
lea rcx, [rsp + 0x48]
call fcn.180032ad0
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18008f1c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180037150
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rcx]
xor eax, eax
mov r11, qword [rcx + 8]
add r11, r10
cmp r10, r11
je 0x180037195
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, r11
jne 0x180037161
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x180038100
Capabilities:
Download url
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rbx, rdx
mov rdi, rcx
mov r8, rdx
jbe 0x180038122
mov r8, qword [rdx]
cmp qword [rcx + 0x18], 0xf
mov rdx, rdi
jbe 0x18003812f
mov rdx, qword [rcx]
xor esi, esi
xor r9d, r9d
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov rcx, qword [rdi + 0x18]
test eax, eax
jne 0x1800381d1
cmp rcx, 0xf
jbe 0x180038184
lea rdx, [rcx + 1]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x18003817f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003826a
mov rcx, r8
call fcn.18008f558
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1800381cd
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800381c8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003826a
mov rcx, r8
call fcn.18008f558
mov al, 1
jmp 0x18003824b
cmp rcx, 0xf
jbe 0x180038204
lea rdx, [rcx + 1]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1800381ff
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003826a
mov rcx, r8
call fcn.18008f558
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180038249
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180038244
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003826a
mov rcx, r8
call fcn.18008f558
xor al, al
mov byte [rbx], sil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x180038380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180136280]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r9
mov ebx, edx
mov qword [rsp + 0x30], r9
xor r15d, r15d
mov r9d, r15d
lea r11, [0x1801199bf]
lea r10, str.shop_controller
nop word [rax + rax]
movzx r8d, byte [r10]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
inc r10
cmp r10, r11
jne 0x1800383d0
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul r8d, ecx, 0x8001
mov rax, qword gs:[0x58]
mov r14, qword [rax]
mov rax, qword [0x18014fe60]
mov rcx, qword [rax]
mov rdx, qword [rcx]
movzx eax, word [rcx + 8]
lea rcx, [rdx + rax*8]
cmp rdx, rcx
je 0x180038581
mov rax, qword [rdx]
test rax, rax
je 0x180038456
cmp dword [rax + 8], r15d
je 0x180038456
cmp dword [rax + 0xc], r8d
je 0x180038464
add rdx, 8
cmp rdx, rcx
jne 0x180038442
jmp 0x180038581
mov rbp, qword [r14 + 0x848]
mov qword [r14 + 0x848], rax
mov byte [r14 + 0x850], 1
call fcn.180033d70
mov dword [rax + 8], r15d
mov dword [rax + 0x18], r15d
movabs rcx, 0xa65568121df2ea26
call fcn.180033c10
call fcn.180033d70
mov rcx, qword [rax]
cmp dword [rcx], r15d
je 0x1800384c4
call fcn.180033d70
mov dword [rax + 8], r15d
mov dword [rax + 0x18], r15d
movabs rcx, 0xfa336e7f40c0a0d0
call fcn.180033c10
call fcn.180033d70
mov dword [rsp + 0x38], 0xffffffff
mov rax, qword [0x18014fe60]
mov r10, qword [rax + 0x98]
mov dword [rsp + 0x20], 4
mov r9d, ebx
mov r8d, 0xb6fd233f
lea rdx, [rsp + 0x38]
mov rcx, qword [rax + 0xa8]
call r10
test al, al
je 0x18003856d
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x180038534
nop word [rax + rax]
mov rax, qword [0x18014fe60]
mov r8, qword [rax + 0xa0]
mov rdx, rbx
mov rcx, qword [rax + 0xa8]
call r8
add rbx, 0x14
cmp rbx, rdi
jne 0x180038510
mov ebx, dword [rsp + 0x38]
call fcn.180033d70
mov dword [rax + 8], r15d
mov dword [rax + 0x18], r15d
call fcn.180033d70
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], ebx
inc dword [rax + 8]
movabs rcx, 0x39be7cea8d9cc8e6
call fcn.180033c10
call fcn.180033d70
mov qword [r14 + 0x848], rbp
test rbp, rbp
setne al
mov byte [r14 + 0x850], al
mov rcx, rsi
call fcn.18003b450
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18008f1c0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x18003e120
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18003e155
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180034630
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18003e2c4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18003e23c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18003e2b3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18003e279
mov r10, qword [rdx]
cmp r10, rax
je 0x18003e273
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18003e2b3
cmp r9, rdx
je 0x18003e28f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18003e2d5
cmp r9, rdx
jne 0x18003e280
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18003e1c0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18003e2b3
Function at 0x18003edf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x18003ee61
mov rdi, qword [rcx + 0x60]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18003ee61
nop word [rax + rax]
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [0x18014fe68]
mov r8, qword [rax + 0x28]
mov rax, qword [0x18014fe60]
movq rdx, xmm0
mov rcx, qword [rax + 0x38]
call r8
movups xmm0, xmmword [rsp + 0x20]
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rcx], rax
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18003ee20
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x18003efad
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rcx], rax
mov rdx, qword [rsi + 8]
mov r8, rdx
shr r8, 0x38
mov r9, rdx
shr r9, 0x30
mov r10, rdx
shr r10, 0x28
mov r11, rdx
shr r11, 0x20
mov rbx, rdx
shr rbx, 0x18
mov rdi, rdx
shr rdi, 0x10
mov rax, rdx
shr rax, 8
test rdx, rdx
je 0x18003efad
movzx ecx, dl
movabs rbp, 0xcbf29ce484222325
xor rcx, rbp
movabs rbp, 0x100000001b3
imul rcx, rbp
movzx eax, al
xor rcx, rax
imul rcx, rbp
movzx eax, dil
xor rcx, rax
imul rcx, rbp
movzx eax, bl
xor rcx, rax
imul rcx, rbp
movzx eax, r11b
xor rcx, rax
imul rcx, rbp
movzx eax, r10b
xor rcx, rax
imul rcx, rbp
movzx eax, r9b
xor rcx, rax
imul rcx, rbp
xor r8, rcx
imul r8, rbp
and r8, qword [0x18014ff20]
shl r8, 4
add r8, qword [0x18014ff08]
mov rcx, qword [r8 + 8]
mov r9, qword [0x18014fef8]
cmp rcx, r9
je 0x18003ef57
mov rax, qword [r8]
cmp rdx, qword [rcx + 0x10]
je 0x18003ef59
cmp rcx, rax
je 0x18003ef57
mov rcx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x18003ef46
jmp 0x18003ef59
xor ecx, ecx
test rcx, rcx
je 0x18003efad
mov rax, qword [r8]
cmp qword [r8 + 8], rcx
jne 0x18003ef7f
cmp rax, rcx
jne 0x18003ef75
mov qword [r8], r9
mov qword [r8 + 8], r9
jmp 0x18003ef8a
mov r9, qword [rcx + 8]
mov qword [r8 + 8], r9
jmp 0x18003ef8a
cmp rax, rcx
jne 0x18003ef8a
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [0x18014ff00]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.18008f558
lea rcx, [rsi + 0x58]
call fcn.180033e40
lea rcx, [rsi + 0x18]
call fcn.180033e40
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x18003efe4
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18003efd6
call fcn.18008f558
mov edx, 0x20
mov rcx, rbx
call fcn.18008f558
nop
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18003fb70
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18003fba1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18014fef8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18014ff08]
lea rdx, [rdi + rdi]
call fcn.180034630
mov rax, qword [0x18014fef8]
lea r9, [rdi - 1]
mov qword [0x18014ff20], r9
mov qword [0x18014ff28], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18003fd42
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18014ff08]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18003fc8c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18003fd03
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18003fcc9
mov r10, qword [rdx]
cmp r10, rax
je 0x18003fcc3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18003fd03
cmp r9, rdx
je 0x18003fcdf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18003fd17
cmp r9, rdx
jne 0x18003fcd0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18003fd3d
mov r9, qword [0x18014ff20]
jmp 0x18003fc11
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18003fd03
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180040910
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
mov dword [rcx], edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea ecx, [rdi + 0x30]
call fcn.18008f58c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 8], rax
lea rcx, [rsi + 0x18]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rsi + 0x30], 7
mov qword [rsi + 0x38], 8
mov dword [rsi], 0x3f800000
mov r8, qword [rsi + 8]
lea edx, [rdi + 0x10]
call fcn.180034630
nop
lea rbx, [rsi + 0x40]
mov qword [rsp + 0x48], rbx
mov dword [rbx], edi
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
lea ecx, [rdi + 0x20]
call fcn.18008f58c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rdi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
lea edx, [rdi + 0x10]
call fcn.180034630
nop
lea r9, str.main_persistent
mov r8b, 0x6d
nop
movzx edx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, edi
imul edi, eax, 0x401
mov eax, edi
shr eax, 6
xor edi, eax
movzx r8d, byte [r9]
test r8b, r8b
jne 0x1800409e0
lea eax, [rdi + rdi*8]
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul r8d, ecx, 0x8001
mov rcx, rsi
call fcn.180040b90
mov rax, qword [0x18014fe60]
mov rcx, qword [rax + 0x30]
mov rbx, qword [rcx]
mov edi, dword [rcx + 0x18]
shl rdi, 4
add rdi, rbx
cmp rbx, rdi
je 0x180040a69
nop word [rax + rax]
mov rdx, qword [rbx]
test rdx, rdx
je 0x180040a60
mov rcx, rsi
call fcn.180040d80
add rbx, 0x10
cmp rbx, rdi
jne 0x180040a50
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180040b90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180136280]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
mov dword [rsp + 0x68], r8d
mov r9d, r8d
shr r9d, 0x18
mov eax, r8d
shr eax, 0x10
movzx edx, al
mov eax, r8d
shr eax, 8
movzx ecx, al
movzx eax, r8b
lea rbx, [0x180040110]
mov qword [rsp + 0x58], rbx
movabs r11, 0x767fbc2ac802ef3d
mov qword [rsp + 0x60], r11
movabs r10, 0xcbf29ce484222325
xor rax, r10
movabs r10, 0x100000001b3
imul rax, r10
xor rax, rcx
imul rax, r10
xor rax, rdx
imul rax, r10
xor rax, r9
imul rax, r10
mov rcx, qword [rdi + 0x30]
and rcx, rax
shl rcx, 4
add rcx, qword [rdi + 0x18]
mov rax, qword [rcx + 8]
mov rdx, qword [rdi + 8]
cmp rax, rdx
je 0x180040c52
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x180040c54
cmp rax, rcx
je 0x180040c52
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x180040c41
jmp 0x180040c54
xor eax, eax
test rax, rax
je 0x180040c91
cmp rax, rdx
je 0x180040c91
lea rcx, [rax + 0x18]
mov rdx, qword [rax + 0x20]
cmp rdx, qword [rax + 0x28]
je 0x180040c7d
mov qword [rdx], r11
mov qword [rdx + 8], rbx
add qword [rax + 0x20], 0x10
jmp 0x180040d57
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
call fcn.180041fa0
jmp 0x180040d57
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], rbx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov ecx, 0x10
call fcn.18008f58c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x30], rbx
mov r8d, 0x10
lea rdx, [rsp + 0x38]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1800415f0
nop
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x180040d3d
mov rdx, qword [rsp + 0x30]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x180040d38
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180040d38
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18008f558
lea r8, [0x18011fc98]
lea rdx, str._Natives__Hooked:__s
mov rcx, qword [0x18014fe40]
call fcn.18008a860
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18008f1c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x180041df0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180041e25
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180034630
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180041f66
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180041ee0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180041f55
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180041f1d
mov r10, qword [rdx]
cmp r10, rax
je 0x180041f17
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180041f55
cmp r9, rdx
je 0x180041f31
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180041f77
cmp r9, rdx
jne 0x180041f22
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180041e90
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180041f55