joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003681c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov r11, qword [r8]
or r9, 0xffffffffffffffff
xor r12d, r12d
mov r14, r8
mov ebp, edx
mov rsi, rcx
mov r10d, 0x12b9b0a5
inc r9
cmp word [r11 + r9*2], r12w
jne 0x18003684c
mov r8, r12
add r9, r9
je 0x18003687f
movzx edx, byte [r8 + r11]
mov ecx, r10d
imul eax, r10d, 0x820
inc r8
shr ecx, 2
add edx, eax
add edx, ecx
xor r10d, edx
cmp r8, r9
jb 0x18003685e
btr r10d, 0x1f
xor edx, edx
mov eax, r10d
div ebp
or edi, 0xffffffff
mov eax, edx
mov ebx, edx
lea rcx, [rax + rax*2]
mov eax, dword [rsi + rcx*8]
cmp eax, 2
jne 0x1800368a7
cmp edi, 0xffffffff
jne 0x1800368d5
mov edi, edx
jmp 0x1800368d5
test eax, eax
je 0x1800368de
cmp eax, 1
jne 0x1800368d5
mov r8, qword [r14]
or r9d, 0xffffffff
mov rcx, qword [rsi + rcx*8 + 8]
or edx, r9d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
nop dword [rax + rax]
cmp eax, 2
je 0x1800368e4
lea eax, [rbx + 1]
xor edx, edx
div ebp
jmp 0x18003688e
cmp edi, 0xffffffff
cmovne ebx, edi
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
lea rcx, [rax + rax*2]
lea rax, [rsi + rcx*8]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x18003d63c
Capabilities:
Identify system language via api

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
call fcn.18003d894
mov qword [rsi], rbx
mov rcx, rbx
mov rax, qword [rbx]
mov rax, qword [rax + 8]
call qword [case.0x18004bf34.0]
mov edx, 0x32
lea edi, [rdx - 0x2e]
mov ecx, edi
call qword [0x18006a1e8]
nop dword [rax + rax]
mov r14d, 0x8007000e
mov qword [rsi + 0x20], rax
mov rcx, rax
lea rbp, str.pcshell_shell_appresolverlib_appresolvercachebuilder.cpp
neg rcx
sbb ebx, ebx
not ebx
and ebx, r14d
test rax, rax
jne 0x18003d6c1
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov r8, rbp
mov edx, 0xde
call fcn.18000a128
test ebx, ebx
js 0x18003d868
mov edx, 0x12c
mov ecx, edi
call qword [0x18006a1e8]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsi + 0x10], rax
neg rcx
sbb ebx, ebx
not ebx
and ebx, r14d
test rax, rax
jne 0x18003d707
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov r8, rbp
mov edx, 0xe1
call fcn.18000a128
test ebx, ebx
js 0x18003d868
mov edx, 7
mov ecx, edi
call qword [0x18006a1e8]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsi + 8], rax
neg rcx
sbb ebx, ebx
not ebx
and ebx, r14d
test rax, rax
jne 0x18003d74d
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov r8, rbp
mov edx, 0xe5
call fcn.18000a128
test ebx, ebx
js 0x18003d868
mov edx, 7
mov ecx, edi
call qword [0x18006a1e8]
nop dword [rax + rax]
mov rcx, rax
mov qword [rsi + 0x18], rax
neg rcx
sbb ebx, ebx
not ebx
and ebx, r14d
test rax, rax
jne 0x18003d793
mov rcx, qword [rsp + 0x38]
mov r9d, ebx
mov r8, rbp
mov edx, SHPinDllOfCLSID
call fcn.18000a128
test ebx, ebx
js 0x18003d868
lea rdi, [rsi + 0x40]
cmp qword [rdi], 0
jne 0x18003d864
call qword [sym.imp.api_ms_win_core_localization_obsolete_l1_2_0.dll_GetUserDefaultUILanguage]
nop dword [rax + rax]
mov r14d, 0x411
cmp ax, r14w
je 0x18003d7d7
call qword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetUserDefaultLCID]
nop dword [rax + rax]
cmp ax, r14w
jne 0x18003d864
xor edx, edx
mov qword [rsp + 0x20], rdi
lea r9, [0x1800722e8]
lea rcx, [0x1800722f8]
lea r8d, [rdx + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x18003d817
mov rcx, qword [rsp + 0x38]
mov r9d, eax
mov r8, rbp
mov edx, 0xf2
call fcn.18000a128
test ebx, ebx
js 0x18003d868
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
mov ebx, eax
cmp eax, 0x80070002
jne 0x18003d84b
mov rcx, qword [rdi]
xor ebx, ebx
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
and qword [rdi], rbx
jmp 0x18003d870
test eax, eax
jns 0x18003d870
mov rcx, qword [rsp + 0x38]
mov r9d, eax
mov r8, rbp
mov edx, 0x100
call fcn.18000a128
test ebx, ebx
jns 0x18003d870
mov rcx, rsi
call fcn.18003d894
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1800430d4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rdi, rcx
mov sil, r8b
mov rcx, rdx
xor bl, bl
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x20]
lea r9, [0x1800430a0]
mov rdx, rax
mov dword [rsp + 0x28], 1
and qword [rsp + 0x20], 0
xor r8d, r8d
mov r14, rax
call qword [0x18006a200]
nop dword [rax + rax]
cmp eax, 0xffffffff
jne 0x180043168
test sil, sil
jne 0x18004316f
mov rcx, qword [rdi + 0x28]
lea r9, [0x1800430a0]
mov dword [rsp + 0x28], 1
xor r8d, r8d
and qword [rsp + 0x20], 0
mov rdx, r14
call qword [0x18006a200]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x18004316f
mov bl, 1
jmp 0x180043299
xor ecx, ecx
xchg qword [rdi + 0x30], rcx
mov qword [rbp + 0x20], rcx
test rcx, rcx
jne 0x1800431b2
movups xmm0, xmmword [0x18006d948]
lea r8, [rbp + 0x20]
lea rdx, [0x1800726d8]
lea rcx, [rbp - 0x10]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.SHLWAPI.dll_AssocCreate]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x180043299
mov rax, qword [rcx]
xor r9d, r9d
and qword [rsp + 0x20], 0
mov r8, r14
mov rax, qword [rax + 0x18]
lea r14d, [r9 + 2]
mov edx, r14d
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18004327a
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x38]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
mov r8d, r14d
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [case.0x18004bf34.0]
test eax, eax
js 0x18004327a
and qword [rsp + 0x28], 0
lea rdx, str.NoStartPage
mov rcx, qword [rbp + 0x38]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.SHCORE.dll_SHQueryValueExW]
nop dword [rax + rax]
test eax, eax
sete bl
test eax, eax
je 0x18004326a
test sil, sil
jne 0x180043268
and qword [rsp + 0x28], 0
lea rdx, str.IsHostApp
mov rcx, qword [rbp + 0x38]
xor r9d, r9d
and qword [rsp + 0x20], 0
xor r8d, r8d
call qword [sym.imp.SHCORE.dll_SHQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x180043268
mov bl, 1
jmp 0x18004326a
xor bl, bl
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x20]
xor eax, eax
lock cmpxchg qword [rdi + 0x30], rcx
je 0x180043299
mov rcx, qword [rbp + 0x20]
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [case.0x18004bf34.0]
mov rsi, qword [rsp + 0x70]
mov al, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1800432b8
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
lea rax, [r11 + 0x20]
mov rbp, r8
mov qword [r11 - 0x20], rax
xor r9d, r9d
mov qword [r11 - 0x28], r15
xor r8d, r8d
mov dword [r11 + 0x20], r15d
mov rdi, rdx
mov r14, rcx
mov ebx, r15d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x18004341b
mov eax, dword [rsp + 0x68]
lea ecx, [r15 + 0x40]
add eax, 2
mov edx, eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov rsi, rax
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007000e
test rsi, rsi
je 0x18004341b
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8, rdi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, r14
call qword [sym.imp.SHCORE.dll_SHGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x18004340c
mov rdi, rsi
mov rcx, rsi
jmp 0x1800433c1
mov word [r14], r15w
cmp word [rdi], r15w
je 0x1800433ba
test ebx, ebx
js 0x1800433ba
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrDupW]
nop dword [rax + rax]
test rax, rax
je 0x1800433b5
mov rdx, rax
mov rcx, rbp
call fcn.180043440
mov ebx, eax
jmp 0x1800433ba
mov ebx, 0x8007000e
lea rdi, [r14 + 2]
mov rcx, rdi
mov edx, 0x3b
call qword [sym.imp.SHLWAPI.dll_StrChrW]
nop dword [rax + rax]
mov r14, rax
test rax, rax
jne 0x180043384
cmp word [rdi], r15w
je 0x18004340c
test ebx, ebx
js 0x18004340c
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrDupW]
nop dword [rax + rax]
test rax, rax
je 0x180043407
mov rdx, rax
mov rcx, rbp
call fcn.180043440
mov ebx, eax
jmp 0x18004340c
mov ebx, 0x8007000e
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180043498
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, 4
call qword [0x18006a1a0]
nop dword [rax + rax]
mov rcx, rax
mov qword [r14 + 0x10], rax
neg rcx
sbb ebx, ebx
xor edi, edi
not ebx
and ebx, 0x8007000e
test rax, rax
je 0x180043566
lea rsi, [0x18006ab90]
cmp edi, 2
jae 0x180043566
and qword [rsp + 0x30], 0
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
mov rcx, qword [rsi]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x4000
call qword [sym.imp.Windows.Storage.dll_SHGetKnownFolderPath]
nop dword [rax + rax]
test eax, eax
js 0x18004354b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrDupW]
nop dword [rax + rax]
test rax, rax
je 0x180043546
mov rdx, rax
lea rcx, [r14 + 0x10]
call fcn.180043440
mov ebx, eax
jmp 0x18004354b
mov ebx, 0x8007000e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
inc edi
add rsi, 8
test ebx, ebx
jns 0x1800434e7
mov rsi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180048dfc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x180083330]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, rdx
mov r15, rcx
xor ebx, ebx
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
mov edx, dword [rsp + 0x20]
mov rdi, rax
mov eax, 0x17c
cmp edx, eax
ja 0x180048f14
cmovb eax, edx
lea r12, [rsp + 0x30]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r14d, eax
mov ebp, ebx
lea r12, [r12 + rax*2]
cmp rcx, r12
cmova r14d, ebx
test r14, r14
je 0x180048eac
lea rsi, [rsp + 0x30]
sub rsi, rdi
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_towupper]
nop dword [rax + rax]
inc rbp
mov word [rsi + rdi], ax
lea rdi, [rdi + 2]
cmp rbp, r14
jb 0x180048e89
mov eax, dword [rsp + 0x20]
mov edx, eax
movabs rcx, 0xcbf29ce484222325
mov word [r12], bx
add rdx, rdx
je 0x180048ee0
movzx eax, byte [rsp + rbx + 0x30]
movabs r8, 0x100000001b3
xor rcx, rax
inc rbx
imul rcx, r8
cmp rbx, rdx
jb 0x180048ec2
mov rax, qword [r15 + 0x30]
and rax, rcx
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.180062960
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x368]
lea r8, str.internal_shellcommonshellincDataStoreCacheItemIdentifier.h
mov edx, reloc.SHLWAPI.dll_SHPinDllOfCLSID
call fcn.1800101bc
int3
Function at 0x180052c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov r13, rcx
movabs r14, 0xcbf29ce484222325
mov rcx, r14
xor edx, edx
movabs r9, 0x100000001b3
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x180052c9f
xor edx, edx
movzx eax, byte [r8 + rdx + 8]
xor r14, rax
imul r14, r9
inc rdx
cmp rdx, 8
jb 0x180052cb6
xor r14, rcx
and r14, qword [r13 + 0x30]
mov r12, r14
add r12, r12
mov rcx, qword [r13 + 0x18]
mov rbx, qword [r13 + 8]
cmp rbx, qword [rcx + r12*8]
je 0x180052d1c
mov rbx, qword [rcx + r12*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rcx + r12*8]
je 0x180052d1c
mov rbx, qword [rbx + 8]
mov rax, qword [r8]
cmp rax, qword [rbx + 0x10]
jne 0x180052cef
mov rax, qword [r8 + 8]
cmp rax, qword [rbx + 0x18]
jne 0x180052cef
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x180052e27
lea rax, [r13 + 8]
mov rdi, qword [rax]
mov rdi, qword [rdi]
movabs rcx, 0x7ffffffffffffff
cmp qword [rax + 8], rcx
jne 0x180052d4a
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
mov rsi, qword [rdi + 8]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.180063f20
mov rcx, qword [rsp + 0x70]
movups xmm0, xmmword [rcx]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rax], rdi
mov qword [rax + 8], rsi
inc qword [r13 + 0x10]
mov qword [rdi + 8], rax
mov qword [rsi], rax
mov rcx, qword [r13 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180052dc7
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r13 + 8]
mov rdx, qword [r13 + 0x18]
add r14, r14
cmp qword [rdx + r12*8], rcx
jne 0x180052de3
mov qword [rdx + r14*8], rdi
mov rax, qword [r13 + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x180052e13
cmp qword [rdx + r12*8], rbx
jne 0x180052def
mov qword [rdx + r14*8], rdi
jmp 0x180052e13
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x180052e13
mov rdx, qword [r13 + 0x18]
mov rax, qword [rdx + r12*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12*8 + 8], rcx
mov rcx, r13
call fcn.1800534e4
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800535cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
mov rdi, rdx
mov r11d, ecx
mov rbx, r9
movabs rdx, 0x100000001b3
movzx eax, byte [r11 + r8 + 0x10]
inc r11
xor rbx, rax
imul rbx, rdx
cmp r11, 8
jb 0x1800535f8
movzx eax, byte [r8 + rcx + 0x18]
inc rcx
xor r9, rax
imul r9, rdx
cmp rcx, 8
jb 0x18005360e
mov rcx, qword [r10 + 0x18]
xor r9, rbx
and r9, qword [r10 + 0x30]
add r9, r9
cmp qword [rcx + r9*8 + 8], r8
jne 0x18005365c
cmp qword [rcx + r9*8], r8
jne 0x180053651
mov rax, qword [r10 + 8]
mov qword [rcx + r9*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x180053655
mov rax, qword [r8 + 8]
mov qword [rcx + r9*8 + 8], rax
jmp 0x180053669
cmp qword [rcx + r9*8], r8
jne 0x180053669
mov rax, qword [r8]
mov qword [rcx + r9*8], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.180062da4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800537a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov rdx, r9
xor ecx, ecx
movabs r8, 0x100000001b3
movzx eax, byte [rcx + r11]
xor rdx, rax
imul rdx, r8
inc rcx
cmp rcx, 8
jb 0x1800537de
xor ecx, ecx
movzx eax, byte [r11 + rcx + 8]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, 8
jb 0x1800537f5
xor r9, rdx
and r9, qword [r10 + 0x30]
mov r8, r9
add r8, r8
mov rcx, qword [r10 + 0x18]
mov rdi, qword [r10 + 8]
cmp rdi, qword [rcx + r8*8]
je 0x180053880
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x180053880
mov rdi, qword [rdi + 8]
mov rax, qword [r11]
cmp rax, qword [rdi + 0x10]
jne 0x18005382e
mov rax, qword [r11 + 8]
cmp rax, qword [rdi + 0x18]
jne 0x18005382e
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x20
mov rcx, rbx
call fcn.180062da4
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180053917
mov rax, qword [rbx]
cmp rdi, rax
je 0x1800538b5
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8]
add r9, r9
cmp rax, qword [r10 + 8]
jne 0x1800538d5
mov qword [rdx + r9*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r9*8 + 8], rbx
jmp 0x180053904
cmp rax, rdi
jne 0x1800538e0
mov qword [rdx + r9*8], rbx
jmp 0x180053904
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r9*8 + 8], rcx
cmp rcx, rbx
je 0x180053904
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.1800534e4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180056b2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov r13, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x180056b5e
mov r15, qword [r13 + 0x30]
and r15, rcx
mov r12, r15
add r12, r12
mov rcx, qword [r13 + 0x18]
mov rdi, qword [r13 + 8]
cmp qword [rcx + r12*8], rdi
jne 0x180056b9d
mov rbx, rdi
jmp 0x180056ba5
mov rbx, qword [rcx + r12*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rcx + r12*8]
je 0x180056bc8
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x180056ba5
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x180056cd2
lea rax, [r13 + 8]
mov rdi, qword [rdi]
movabs rcx, 0xaaaaaaaaaaaaaaa
cmp qword [rax + 8], rcx
jne 0x180056bf3
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
mov rsi, qword [rdi + 8]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x30], 0
mov ecx, reloc.SHLWAPI.dll_Ordinal_24
call fcn.180063f20
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx]
mov qword [rax + 0x10], rcx
mov qword [rax], rdi
mov qword [rax + 8], rsi
inc qword [r13 + 0x10]
mov qword [rdi + 8], rax
mov qword [rsi], rax
mov rcx, qword [r13 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180056c72
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r13 + 8]
mov rdx, qword [r13 + 0x18]
add r15, r15
cmp qword [rdx + r12*8], rcx
jne 0x180056c8e
mov qword [rdx + r15*8], rdi
mov rax, qword [r13 + 0x18]
mov qword [rax + r15*8 + 8], rdi
jmp 0x180056cbe
cmp qword [rdx + r12*8], rbx
jne 0x180056c9a
mov qword [rdx + r15*8], rdi
jmp 0x180056cbe
mov rax, qword [rdx + r15*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r15*8 + 8], rcx
cmp rcx, rdi
je 0x180056cbe
mov rdx, qword [r13 + 0x18]
mov rax, qword [rdx + r12*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12*8 + 8], rcx
mov rcx, r13
call fcn.180056cf4
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180056ddc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r8 + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x180056df9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x180056e51
cmp qword [rcx + rdx*8], r8
jne 0x180056e46
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x180056e4a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x180056e5e
cmp qword [rcx + rdx*8], r8
jne 0x180056e5e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov edx, reloc.SHLWAPI.dll_Ordinal_24
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.180062da4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180056f9c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r11]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x180056fcc
mov r8, qword [r9 + 0x30]
and r8, rcx
mov r10, r8
add r10, r10
mov rcx, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [rcx + r10*8]
je 0x180057056
mov rdi, qword [rcx + r10*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r10*8]
je 0x180057056
mov rdi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
cmp qword [r11], rax
jne 0x18005700e
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, reloc.SHLWAPI.dll_Ordinal_24
mov rcx, rbx
call fcn.180062da4
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1800570ed
mov rax, qword [rbx]
cmp rdi, rax
je 0x18005708b
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x1800570ab
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1800570da
cmp rax, rdi
jne 0x1800570b6
mov qword [rdx + r8*8], rbx
jmp 0x1800570da
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1800570da
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.180056cf4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret