joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140065270
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x14006528b
cmp byte [rcx + 0x2f40], 0
je 0x1400652a4
mov r8d, 0xef6
lea rdx, str.D:himainmenuImGuiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call fcn.1400d0570
xor eax, eax
lea r8, [0x14010a0c9]
mov dword [rsp + 0x2c], eax
lea r11, [0x140108c30]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x1400652e8
cmp byte [r8], r9b
jne 0x1400652e8
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x1400652d5
mov ecx, dword [rbx + 0x2f5c]
lea rax, [0x140070b90]
mov edi, dword [rbx + 0x2f58]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x140070ab0]
mov qword [rsp + 0x38], rax
lea rax, [0x140070c10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x1400653f8
inc edi
test ecx, ecx
je 0x140065354
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140065359
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1400653f8
mov rax, qword [0x1402b1958]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x14006537d
inc dword [rax + 0x3bc]
mov rdx, qword [0x1402b1968]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [0x1402ac850]
mov rdx, qword [rbx + 0x2f60]
mov rsi, rax
test rdx, rdx
je 0x1400653e6
movsxd rcx, dword [rbx + 0x2f58]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call fcn.1400bd5b0
mov rcx, qword [rbx + 0x2f60]
test rcx, rcx
je 0x1400653d9
mov rax, qword [0x1402b1958]
test rax, rax
je 0x1400653d9
dec dword [rax + 0x3bc]
mov rdx, qword [0x1402b1968]
call qword [fcn.14005ad10]
mov qword [rbx + 0x2f60], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2f5c], edi
movsxd rax, dword [rbx + 0x2f58]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f60]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f58]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140074c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140074da1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140074c80
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.1400794e0
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.140072050
mov dword [rbx + 0x80], 0
jmp 0x140074d8d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.140079a60
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140083b20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402acd18]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.140063be0
mov rdi, rax
mov rcx, qword [rax + 0xa0]
cmp dword [rcx + 0x40], 0
jle 0x140083b5c
cmp qword [rcx + 0x18], 0
jne 0x140083b75
cmp qword [rcx + 0x20], 0
jne 0x140083b75
mov r8d, 0xd7
lea rdx, str.D:himainmenuImGuiimgui_impl_win32.cpp
lea rcx, str.io.Fonts__IsBuilt_____Font_atlas_not_built__It_is_generally_built_by_the_renderer_back_end._Missing_call_to_renderer__NewFrame___function__e.g._ImGui_ImplOpenGL3_NewFrame__._
call fcn.1400d0570
mov rcx, qword [0x1402b19d0]
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
sub eax, dword [rsp + 0x28]
movd xmm1, eax
mov eax, dword [rsp + 0x34]
sub eax, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x1402b19d8]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1402b19e0]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x1402b19d8], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.140063be0
cmp byte [rax + 0x39b], 0
lea rbx, [rax + 0x128]
je 0x140083c81
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x38]
cvttss2si eax, dword [rax + 0x12c]
mov dword [rsp + 0x38], ecx
mov rcx, qword [0x1402b19d0]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x140083cf2
mov rdx, qword [0x1402b19d0]
cmp rax, rdx
je 0x140083cb2
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x140083cf2
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140083cf2
mov rcx, qword [0x1402b19d0]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140083cf2
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc0], 0
je 0x140083d02
mov eax, 0xffffffff
jmp 0x140083d07
call fcn.140063c20
cmp dword [reloc.OLEAUT32.dll_VariantCopy], eax
je 0x140083d1a
mov dword [reloc.OLEAUT32.dll_VariantCopy], eax
call fcn.140084030
call fcn.140083d50
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400a02c0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400903d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, r8
je 0x1400905e0
cmp qword [rdx + 0x28], 0x10
lea r8, [rdx + 0x10]
mov rax, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rdi
lea rdi, [rcx + 8]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x80], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x88], r10
jb 0x14009043f
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x140090474
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140090460
mov r15, qword [r14 + 0x30]
mov rcx, rdi
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r10
mov r13, qword [r15]
mov r12, qword [r15 + 8]
call fcn.14008d200
dec qword [rdi + 8]
cmp rsi, r12
je 0x1400904c4
mov r14, rbx
cmp rbx, rbp
je 0x1400904de
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rbx]
call fcn.14008d200
dec qword [rdi + 8]
cmp r14, r12
jne 0x1400904a0
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
cmp r13, rsi
mov r13, qword [rsp + 0x78]
jne 0x1400904f7
mov qword [r15], r12
mov rax, r12
jmp 0x1400904fa
cmp r13, rsi
jne 0x1400904e6
mov qword [r15], rbx
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov qword [rbx + 8], rax
jmp 0x1400905c7
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400905bf
nop word [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jb 0x140090525
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x140090559
movabs r13, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r13
cmp rdx, r9
jb 0x140090540
mov r13, qword [rsp + 0x78]
mov r15, qword [r14 + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
mov rcx, rdi
add r15, qword [rsp + 0x88]
mov r14, qword [r15 + 8]
call fcn.14008d200
dec qword [rdi + 8]
cmp rsi, r14
je 0x1400905a6
mov rsi, rbx
cmp rbx, rbp
je 0x1400905bc
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rbx]
call fcn.14008d200
dec qword [rdi + 8]
cmp rsi, r14
jne 0x140090587
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
je 0x1400905bf
mov r14, qword [rsp + 0x70]
jmp 0x140090510
mov qword [r15], rbx
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov r15, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
Function at 0x140092510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov r15, rdx
mov r13, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14009253e
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x140092573
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x140092560
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000c740
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14009259c
mov qword [r15], rax
mov byte [r15 + 8], r12b
jmp 0x140092741
movabs rax, 0x492492492492492
cmp qword [r13 + 0x10], rax
je 0x14009275c
lea rbp, [r13 + 8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
mov ecx, 0x38
call fcn.1400a02e0
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.140009b10
mov dword [rsi + 0x30], r12d
mov rcx, qword [r13 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400925f4
cvtsi2ss xmm0, rcx
jmp 0x140092609
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r13 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14009261c
cvtsi2ss xmm1, rcx
jmp 0x140092631
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r13]
seta al
test al, al
je 0x1400926e9
mov rcx, r13
call fcn.140093120
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov rdx, qword [r13 + 0x18]
mov rbx, qword [rdx + rax*8 + 8]
mov rcx, qword [rbp]
cmp rbx, rcx
jne 0x140092675
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r12
jmp 0x1400926de
mov r12, qword [rdx + rax*8]
mov rbp, qword [rsi + 0x20]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140092692
mov rdx, qword [rdx]
lea rcx, [rsi + 0x10]
cmp qword [rsi + 0x28], 0x10
jb 0x1400926a1
mov rcx, qword [rsi + 0x10]
cmp rbp, rax
jne 0x1400926b2
mov r8, rbp
call fcn.1400bd4b0
test eax, eax
je 0x1400926bd
cmp rbx, r12
je 0x1400926cc
mov rbx, qword [rbx + 8]
jmp 0x140092680
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
jmp 0x1400926da
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rbp, [r13 + 8]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [r13 + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [rbp]
jne 0x140092722
mov qword [rcx + rax*8], rsi
jmp 0x140092734
cmp r9, rdx
jne 0x14009272d
mov qword [rcx + rax*8], rsi
jmp 0x140092739
cmp qword [rcx + rax*8 + 8], r8
jne 0x140092739
mov qword [rcx + rax*8 + 8], rsi
mov qword [r15], rsi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14009e87c
int3
Function at 0x140092770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov r14, rdx
mov r13, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14009279e
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x1400927d3
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x1400927c0
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000c740
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400927fc
mov qword [r14], rcx
mov byte [r14 + 8], r12b
jmp 0x1400929a1
movabs rax, 0x492492492492492
cmp qword [r13 + 0x10], rax
je 0x1400929bc
lea rbp, [r13 + 8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
mov ecx, 0x38
call fcn.1400a02e0
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.140009b10
mov qword [rsi + 0x30], r12
mov rcx, qword [r13 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140092854
cvtsi2ss xmm0, rcx
jmp 0x140092869
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r13 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14009287c
cvtsi2ss xmm1, rcx
jmp 0x140092891
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r13]
seta al
test al, al
je 0x140092949
mov rcx, r13
call fcn.1400931d0
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov rdx, qword [r13 + 0x18]
mov rbx, qword [rdx + rax*8 + 8]
mov rcx, qword [rbp]
cmp rbx, rcx
jne 0x1400928d5
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r12
jmp 0x14009293e
mov r12, qword [rdx + rax*8]
mov rbp, qword [rsi + 0x20]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400928f2
mov rdx, qword [rdx]
lea rcx, [rsi + 0x10]
cmp qword [rsi + 0x28], 0x10
jb 0x140092901
mov rcx, qword [rsi + 0x10]
cmp rbp, rax
jne 0x140092912
mov r8, rbp
call fcn.1400bd4b0
test eax, eax
je 0x14009291d
cmp rbx, r12
je 0x14009292c
mov rbx, qword [rbx + 8]
jmp 0x1400928e0
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
jmp 0x14009293a
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rbp, [r13 + 8]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [r13 + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [rbp]
jne 0x140092982
mov qword [rcx + rax*8], rsi
jmp 0x140092994
cmp r9, rdx
jne 0x14009298d
mov qword [rcx + rax*8], rsi
jmp 0x140092999
cmp qword [rcx + rax*8 + 8], r8
jne 0x140092999
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14009e87c
int3
Function at 0x140093120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140093145
cvtsi2ss xmm0, rdx
jmp 0x14009315a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400da414
movss xmm1, dword [0x14012a5e4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140093188
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140093188
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400931ba
cmp rbx, 0x200
jae 0x1400931b7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400931ba
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14008f950

Function at 0x1400931d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400931f5
cvtsi2ss xmm0, rdx
jmp 0x14009320a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1400da414
movss xmm1, dword [0x14012a5e4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140093238
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140093238
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14009326a
cmp rbx, 0x200
jae 0x140093267
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14009326a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14008fce0
Function at 0x1400940b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14009416d
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1400940ea
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp fcn.1400903d0
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x50], rsi
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rsi, qword [rcx]
test rsi, rsi
je 0x140094136
mov qword [rsp + 0x48], rbx
nop dword [rax + rax]
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.140093c80
mov edx, 0x98
mov rcx, rsi
call fcn.1400a031c
mov rsi, rbx
test rbx, rbx
jne 0x140094110
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.14000b180
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140094180
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x1402acd18]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r13, rcx
call fcn.1400940b0
mov rax, qword gs:[0x60]
test rax, rax
je 0x140094392
mov r12, qword [rax + 0x18]
add r12, 0x20
mov r14, qword [r12]
test r14, r14
je 0x140094392
cmp r14, r12
je 0x140094388
xor ebx, ebx
nop dword [rax]
lea r15, [r14 - 0x10]
test r15, r15
je 0x14009437c
mov rdx, qword [r15 + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140094220
lea rcx, [rsp + 0x20]
call fcn.14004a6e0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xf]
call fcn.1400943d0
nop
mov rdx, qword [rbp - 0x71]
cmp rdx, 8
jb 0x140094286
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140094281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400943c7
call fcn.1400a031c
mov qword [rbp - 0x79], rbx
mov qword [rbp - 0x71], 7
mov word [rsp + 0x20], bx
lea rdi, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
setae cl
mov rbx, qword [rbp + 0xf]
cmovae rdi, rbx
lea rdx, [rbp + 0xf]
mov rsi, qword [rbp + 0x1f]
test cl, cl
je 0x1400942bc
add rsi, rbx
jmp 0x1400942c3
add rsi, rdx
lea rbx, [rbp + 0xf]
cmp rbx, rsi
je 0x1400942e3
sub rdi, rbx
nop dword [rax + rax]
movsx ecx, byte [rbx]
call fcn.1400d9f04
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x1400942d0
mov rbx, qword [r15 + 0x30]
lea rcx, [rbp - 0x69]
call fcn.1400929d0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov qword [rbp - 9], rbx
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov qword [rbp - 0x11], rax
lea r8, [rbp + 0xf]
lea rdx, [rbp - 1]
mov rcx, r13
call fcn.140093920
mov rcx, qword [rax]
add rcx, 0x30
lea rdx, [rbp - 0x69]
call fcn.140092fd0
nop
lea rcx, [rbp - 0x29]
call fcn.14008ff60
lea rcx, [rbp - 0x69]
call fcn.14008ee70
nop
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x14009437a
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140094375
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400943c1
call fcn.1400a031c
xor ebx, ebx
mov r14, qword [r14]
cmp r14, r12
jne 0x1400941f0
cmp qword [r13 + 0x10], 0
setne al
jmp 0x140094394
xor al, al
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400a02c0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400d0a24
nop
call fcn.1400d0a24
nop
int3
Function at 0x14009a3c0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1402acd18]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14009a47d
mov qword [rsp + 0x170], rbx
lea rcx, [rsp + 0x4c]
mov r8, rsi
sub r8, rcx
nop dword [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x14009a433
inc rcx
test eax, eax
jne 0x14009a420
test edx, edx
jne 0x14009a464
mov r8d, dword [rsp + 0x28]
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14009a464
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14009a410
mov rbx, qword [rsp + 0x170]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a02c0
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret