joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000db00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098db8], r9d
jle 0x18000db8b
lea rcx, [0x180098db8]
call fcn.180063c38
cmp dword [0x180098db8], 0xffffffff
jne 0x18000db8b
mov edx, 2
lea rsi, [0x180098c40]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066410]
call fcn.180063b78
lea rcx, [0x180098db8]
call fcn.180063bcc
jmp 0x18000db92
lea rsi, [0x180098c40]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000dbb0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098c8c], 0x7fffffff
jne 0x18000dbd2
mov dword [0x180098c8c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dbe3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000dc13
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000dc00
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000dc3e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000dc6f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dc4b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000dcbb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000dcc4
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000dce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180098c34], r8d
jle 0x18000dd62
lea rcx, [0x180098c34]
call fcn.180063c38
cmp dword [0x180098c34], 0xffffffff
jne 0x18000dd62
mov edx, 2
lea rsi, [0x180098ec0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066400]
call fcn.180063b78
lea rcx, [0x180098c34]
call fcn.180063bcc
jmp 0x18000dd69
lea rsi, [0x180098ec0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000dd87
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098f0c], 0x7fffffff
jne 0x18000dda9
mov dword [0x180098f0c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000ddba
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000ddf3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000dde0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000de1e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000de4f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000de2b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000de97
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000dea0
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000deb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180098f10], edx
jle 0x18000df33
lea rcx, [0x180098f10]
call fcn.180063c38
cmp dword [0x180098f10], 0xffffffff
jne 0x18000df33
mov edx, 2
lea rsi, [0x180098f20]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663f0]
call fcn.180063b78
lea rcx, [0x180098f10]
call fcn.180063bcc
jmp 0x18000df3a
lea rsi, [0x180098f20]
mov qword [rsp + 0x60], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000df58
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098f6c], 0x7fffffff
jne 0x18000df7a
mov dword [0x180098f6c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000df8b
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000dfc3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000dfb0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000dfee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e01f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000dffb
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e073
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
lea rdx, [0x180097190]
lea rcx, [0x180008f40]
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000e07c
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18000e090
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180098cf8], r8d
jle 0x18000e112
lea rcx, [0x180098cf8]
call fcn.180063c38
cmp dword [0x180098cf8], 0xffffffff
jne 0x18000e112
mov edx, 2
lea rsi, [0x180098dc0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663e0]
call fcn.180063b78
lea rcx, [0x180098cf8]
call fcn.180063bcc
jmp 0x18000e119
lea rsi, [0x180098dc0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000e137
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098e0c], 0x7fffffff
jne 0x18000e159
mov dword [0x180098e0c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e16a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000e1a3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000e190
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000e1ce
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e1ff
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e1db
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e245
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000e24e
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000e260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098ce0], r9d
jle 0x18000e2eb
lea rcx, [0x180098ce0]
call fcn.180063c38
cmp dword [0x180098ce0], 0xffffffff
jne 0x18000e2eb
mov edx, 2
lea rsi, [0x180098d00]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663d0]
call fcn.180063b78
lea rcx, [0x180098ce0]
call fcn.180063bcc
jmp 0x18000e2f2
lea rsi, [0x180098d00]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000e310
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098d4c], 0x7fffffff
jne 0x18000e332
mov dword [0x180098d4c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e343
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000e373
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000e360
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000e39e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e3cf
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e3ab
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e41b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000e424
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000e440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098d54], r9d
jle 0x18000e4cb
lea rcx, [0x180098d54]
call fcn.180063c38
cmp dword [0x180098d54], 0xffffffff
jne 0x18000e4cb
mov edx, 2
lea rsi, [0x180098c90]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663c0]
call fcn.180063b78
lea rcx, [0x180098d54]
call fcn.180063bcc
jmp 0x18000e4d2
lea rsi, [0x180098c90]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000e4f0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098cdc], 0x7fffffff
jne 0x18000e512
mov dword [0x180098cdc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e523
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000e553
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000e540
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000e57e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e5af
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e58b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e5fb
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000e604
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000e620
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180098ce8], r8d
jle 0x18000e6a2
lea rcx, [0x180098ce8]
call fcn.180063c38
cmp dword [0x180098ce8], 0xffffffff
jne 0x18000e6a2
mov edx, 2
lea rsi, [0x180098e20]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663b0]
call fcn.180063b78
lea rcx, [0x180098ce8]
call fcn.180063bcc
jmp 0x18000e6a9
lea rsi, [0x180098e20]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000e6c7
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098e6c], 0x7fffffff
jne 0x18000e6e9
mov dword [0x180098e6c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e6fa
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000e733
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000e720
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000e75e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e78f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e76b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e7d5
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000e7de
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000e7f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098c30], r9d
jle 0x18000e87b
lea rcx, [0x180098c30]
call fcn.180063c38
cmp dword [0x180098c30], 0xffffffff
jne 0x18000e87b
mov edx, 2
lea rsi, [0x180098fc0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x1800663a0]
call fcn.180063b78
lea rcx, [0x180098c30]
call fcn.180063bcc
jmp 0x18000e882
lea rsi, [0x180098fc0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000e8a0
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x18009900c], 0x7fffffff
jne 0x18000e8c2
mov dword [0x18009900c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e8d3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000e903
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000e8f0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000e92e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000e95f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000e93b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000e9a9
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov eax, ebx
jmp 0x18000e9b2
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000e9d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14d, r8d
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098cfc], r9d
jle 0x18000ea5b
lea rcx, [0x180098cfc]
call fcn.180063c38
cmp dword [0x180098cfc], 0xffffffff
jne 0x18000ea5b
mov edx, 2
lea rsi, [0x180098e70]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066390]
call fcn.180063b78
lea rcx, [0x180098cfc]
call fcn.180063bcc
jmp 0x18000ea62
lea rsi, [0x180098e70]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000ea80
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098ebc], 0x7fffffff
jne 0x18000eaa2
mov dword [0x180098ebc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000eab3
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000eae3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000ead0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000eb0e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000eb3f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000eb1b
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000eb8b
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov edx, r14d
mov rcx, r15
call r8
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000eb94
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18000ebb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
mov r9d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r9*8]
mov r9d, dword [rcx + rax]
cmp dword [0x180098d50], r9d
jle 0x18000ec3b
lea rcx, [0x180098d50]
call fcn.180063c38
cmp dword [0x180098d50], 0xffffffff
jne 0x18000ec3b
mov edx, 2
lea rsi, [0x180098be0]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066380]
call fcn.180063b78
lea rcx, [0x180098d50]
call fcn.180063bcc
jmp 0x18000ec42
lea rsi, [0x180098be0]
mov qword [rsp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000ec60
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098c2c], 0x7fffffff
jne 0x18000ec82
mov dword [0x180098c2c], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000ec93
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000ecc3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000ecb0
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000ecee
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000ed1f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000ecfb
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000ed66
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov r8, qword [rax + 0x30]
mov rdx, r14
mov rcx, r15
call r8
nop
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
jmp 0x18000ed6f
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret