joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x1400197c9
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov r15, r8
mov rsi, rdx
xor r13d, r13d
movabs rdi, 0x333333333333333
movabs r12, 0x100000001b3
lea rbp, [0x1401952a8]
movss xmm6, dword [0x14016aed0]
movabs rax, 0xcbf29ce484222325
mov r8, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400195a6
mov rdx, qword [rsi]
mov rbx, rax
add r8, r8
mov rcx, r13
je 0x1400195c4
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r12
inc rcx
cmp rcx, r8
jb 0x1400195b1
mov r9, rbx
mov r8, rsi
lea rdx, [rsp + 0x30]
call fcn.14001bdf0
cmp qword [rsp + 0x38], 0
jne 0x14001979a
cmp qword [0x1401952b0], rdi
je 0x1400197ca
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r13
mov ecx, 0x50
call fcn.14012f210
mov r14, rax
mov qword [rsp + 0x28], rax
lea rbp, [rax + 0x10]
mov qword [rsp + 0x90], rbp
mov rdx, rsi
mov rcx, rbp
call fcn.1400066a0
nop
lea rcx, [rbp + 0x20]
lea rdx, [rsi + 0x20]
call fcn.1400066a0
nop
mov r8, qword [0x1401952b0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140019649
cvtsi2ss xmm0, rcx
jmp 0x14001965e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [0x1401952d8]
xorps xmm2, xmm2
test rdi, rdi
js 0x140019674
cvtsi2ss xmm2, rdi
jmp 0x14001968c
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x1401952a0]
comiss xmm1, xmm3
seta al
test al, al
je 0x140019728
divss xmm0, xmm3
call fcn.140130786
xor ecx, ecx
comiss xmm0, xmm6
jb 0x1400196cf
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x1400196cf
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x140019701
cmp rdi, 0x200
jae 0x1400196fe
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x140019701
mov rdi, rcx
mov rdx, rdi
call fcn.14001b470
mov r9, rbx
mov r8, rbp
lea rdx, [rsp + 0x40]
call fcn.14001bdf0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
mov r8, qword [0x1401952b0]
mov qword [rsp + 0x28], r13
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x1401952b0], r8
mov qword [r14], rcx
mov qword [r14 + 8], rdx
mov qword [rdx], r14
mov qword [rcx + 8], r14
mov rax, qword [0x1401952b8]
and rbx, qword [0x1401952d0]
add rbx, rbx
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x1401952a8]
jne 0x140019772
mov qword [rax + rbx*8], r14
jmp 0x140019784
cmp r8, rcx
jne 0x14001977d
mov qword [rax + rbx*8], r14
jmp 0x140019789
cmp qword [rax + rbx*8 + 8], rdx
jne 0x140019789
mov qword [rax + rbx*8 + 8], r14
movabs rdi, 0x333333333333333
lea rbp, [0x1401952a8]
add rsi, 0x40
cmp rsi, r15
jne 0x14001958b
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call qword [0x140137588]
int3
Function at 0x140024050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rbx, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140024081
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x1400240b3
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x1400240a0
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.140028a20
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400240da
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x140024298
movabs rax, 0x555555555555555
cmp qword [0x140195310], rax
jne 0x1400240fb
lea rcx, str.unordered_map_set_too_long
call qword [0x140137588]
int3
lea rax, [0x140195308]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, 0x30
call fcn.14012f210
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.140006810
nop
mov r9, qword [0x140195310]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140024149
cvtsi2ss xmm0, rcx
jmp 0x14002415e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [0x140195338]
xorps xmm2, xmm2
test rbx, rbx
js 0x140024174
cvtsi2ss xmm2, rbx
jmp 0x14002418c
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x140195300]
comiss xmm1, xmm3
seta al
test al, al
je 0x140024231
divss xmm0, xmm3
call fcn.140130786
xor ecx, ecx
movss xmm1, dword [0x14016aed0]
comiss xmm0, xmm1
jb 0x1400241d7
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400241d7
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140024209
cmp rbx, 0x200
jae 0x140024206
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140024209
mov rbx, rcx
mov rdx, rbx
call fcn.140026150
mov r9, rdi
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x30]
call fcn.140028a20
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x140195310]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x140195310], r9
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rax, qword [0x140195330]
and rax, rdi
add rax, rax
mov rcx, qword [0x140195318]
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x140195308]
jne 0x140024279
mov qword [rcx + rax*8], rsi
jmp 0x14002428b
cmp r9, rdx
jne 0x140024284
mov qword [rcx + rax*8], rsi
jmp 0x140024290
cmp qword [rcx + rax*8 + 8], r8
jne 0x140024290
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140034050
Capabilities:
Check if file exists

Disassembly:
sub rsp, 0x458
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0x440], rax
cmp byte [0x140195169], 0
je 0x14003408c
mov al, 1
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14012f1f0
add rsp, 0x458
ret
mov qword [rsp + 0x460], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x468], rsi
xor edx, edx
mov qword [rsp + 0x450], rdi
mov r8d, 0x208
mov rdi, qword [0x1401949a8]
xor ebx, ebx
call fcn.140130762
xor edx, edx
lea rcx, [rsp + 0x230]
mov r8d, 0x208
call fcn.140130762
lea rcx, [rdi + 8]
call qword [0x140137528]
test eax, eax
je 0x1400340eb
mov ecx, eax
call qword [0x140137518]
int3
cmp byte [rdi], bl
jne 0x1400341d6
mov r8d, 0x104
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140034112
lea ebx, [rax + 1]
jmp 0x1400341d6
cdqe
lea rdx, [rsp + 0x20]
mov r8d, 0x5c
lea rcx, [rsp + 0x20]
lea rdx, [rdx + rax*2]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
test rax, rax
jne 0x14003413b
lea ebx, [rax + 2]
jmp 0x1400341d6
lea rcx, [rsp + 0x20]
sub rax, rcx
lea rdx, [rsp + 0x20]
sar rax, 1
lea rcx, [rsp + 0x230]
lea r8d, [rax + 1]
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea rdx, str.qimei.dll
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x230]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140034189
lea ebx, [rax + 3]
jmp 0x1400341d6
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rdi + 0x58], rax
test rax, rax
jne 0x1400341a5
lea ebx, [rax + 4]
jmp 0x1400341d6
lea rdx, [0x140164724]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1400341bf
lea ebx, [rax + 5]
jmp 0x1400341d6
lea rcx, str.0WIN0GIA035UNMF7
call rax
test eax, eax
jne 0x1400341d1
mov byte [rdi], 1
jmp 0x1400341d6
mov ebx, 6
lea rcx, [rdi + 8]
call qword [0x140137548]
mov rsi, qword [rsp + 0x468]
test ebx, ebx
mov rbx, qword [rsp + 0x460]
mov rdi, qword [rsp + 0x450]
sete al
mov byte [0x140195169], al
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14012f1f0
add rsp, 0x458
ret
Function at 0x140049db0
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
lea rdx, [0x1401949b0]
lea rcx, [rsp + 0x30]
call qword [0x140137a00]
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x140194970]
call qword [0x140137b48]
nop
lea rdx, str..LCK
mov rcx, rax
call qword [0x1401379e8]
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [0x140137a60]
nop
lea rcx, [rsp + 0x28]
call qword [0x140137908]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [0x140137a78]
mov edx, 0x1388
lea rcx, [rsp + 0x20]
call qword [0x140137a70]
test al, al
jne 0x140049e5c
lea rcx, [rsp + 0x20]
call qword [0x140137a80]
mov edx, 0x1388
lea rcx, [rsp + 0x20]
call qword [0x140137a70]
test al, al
je 0x140049f53
mov ecx, dword [0x1401951f8]
inc ecx
mov dword [0x1401951f8], ecx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
cmp ecx, eax
jne 0x140049e95
lea rcx, [0x140194970]
call qword [0x140137b60]
cmp rax, 0xa00000
jbe 0x140049e95
call fcn.140049810
lea rcx, [0x140194970]
call qword [0x140137b60]
mov rdx, rax
lea rcx, [0x140194970]
call qword [0x140137b20]
lea rdx, [0x140194970]
lea rcx, [0x140194960]
call qword [0x140137a48]
mov rdx, rbx
lea rcx, [0x140194960]
call qword [0x140137a58]
mov rcx, rax
call qword [0x140137a30]
lea rcx, [0x140194960]
call qword [0x140137a50]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [0x1401379f8]
cmp qword [rax + 0x18], 8
jb 0x140049f04
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140049f53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f4d
call qword [0x140138140]
int3
call fcn.14012f24c
nop
lea rcx, [rsp + 0x20]
call qword [0x140137a68]
nop
lea rcx, [rsp + 0x30]
call qword [0x140137a08]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012f1f0
add rsp, 0x60
pop rbx
ret
add rcx, 0x20
jmp 0x140049db0
Function at 0x140049f90
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
lea rdx, [0x1401949b0]
lea rcx, [rsp + 0x30]
call qword [0x140137a00]
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x140194970]
call qword [0x140137b48]
nop
lea rdx, str..LCK
mov rcx, rax
call qword [0x1401379e8]
mov rdx, rax
lea rcx, [rsp + 0x20]
call qword [0x140137a60]
nop
lea rcx, [rsp + 0x28]
call qword [0x140137908]
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [0x140137a78]
mov edx, 0x1388
lea rcx, [rsp + 0x20]
call qword [0x140137a70]
test al, al
jne 0x140049e5c
lea rcx, [rsp + 0x20]
call qword [0x140137a80]
mov edx, 0x1388
lea rcx, [rsp + 0x20]
call qword [0x140137a70]
test al, al
je 0x140049f53
mov ecx, dword [0x1401951f8]
inc ecx
mov dword [0x1401951f8], ecx
mov eax, 0x51eb851f
mul ecx
shr edx, 5
imul eax, edx, 0x64
cmp ecx, eax
jne 0x140049e95
lea rcx, [0x140194970]
call qword [0x140137b60]
cmp rax, 0xa00000
jbe 0x140049e95
call fcn.140049810
lea rcx, [0x140194970]
call qword [0x140137b60]
mov rdx, rax
lea rcx, [0x140194970]
call qword [0x140137b20]
lea rdx, [0x140194970]
lea rcx, [0x140194960]
call qword [0x140137a48]
mov rdx, rbx
lea rcx, [0x140194960]
call qword [0x140137a58]
mov rcx, rax
call qword [0x140137a30]
lea rcx, [0x140194960]
call qword [0x140137a50]
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [0x1401379f8]
cmp qword [rax + 0x18], 8
jb 0x140049f04
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140049f53
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049f4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049f4d
call qword [0x140138140]
int3
call fcn.14012f24c
nop
lea rcx, [rsp + 0x20]
call qword [0x140137a68]
nop
lea rcx, [rsp + 0x30]
call qword [0x140137a08]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14012f1f0
add rsp, 0x60
pop rbx
ret
add rcx, 0x20
jmp 0x140049db0

Function at 0x1400512a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1400512d4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1400512c0
ret
Function at 0x140052880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400528a5
cvtsi2ss xmm0, rdx
jmp 0x1400528ba
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.140130786
movss xmm1, dword [0x14016aed0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400528e8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400528e8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14005291a
cmp rbx, 0x200
jae 0x140052917
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14005291a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14001b740
Function at 0x14005a2c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x70], rdx
mov ecx, 0x20
call fcn.14012f210
mov rdi, rax
mov r12d, 0x13
mov qword [rsp + 0xd0], r12
mov r13d, 0x1f
mov qword [rsp + 0xd8], r13
movups xmm0, xmmword [str.com.tencent.androws]
movups xmmword [rax], xmm0
movzx eax, word [0x140163318]
mov word [rdi + 0x10], ax
movzx eax, byte [0x14016331a]
mov byte [rdi + 0x12], al
mov byte [rdi + 0x13], 0
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x40], 1
mov rcx, r15
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
movabs r8, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
xor rdx, rax
imul rdx, r8
inc rcx
cmp rcx, 0x13
jb 0x14005a380
mov rcx, qword [r15 + 0x38]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x20]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r15 + 0x10]
je 0x14005a410
mov r14, qword [rax + rcx*8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14005a3c3
mov rdx, qword [rdx]
cmp r12, rax
jne 0x14005a3d7
mov r8, r12
mov rcx, rdi
call fcn.140130750
test eax, eax
je 0x14005a3e2
cmp rbx, r14
je 0x14005a410
mov rbx, qword [rbx + 8]
jmp 0x14005a3b1
test rbx, rbx
je 0x14005a410
cmp rbx, qword [r15 + 0x10]
je 0x14005a410
lea rdx, [rbx + 0x118]
mov byte [rsp + 0x68], 0
cmp byte [rdx + 0x20], 0
je 0x14005a40e
lea rcx, [rsp + 0x48]
call fcn.140006810
mov byte [rsp + 0x68], 1
jmp 0x14005a415
mov byte [rsp + 0x68], 0
mov rcx, r15
call sub.KERNEL32.dll_ReleaseSRWLockShared
nop
lea rdx, [r13 + 1]
mov rcx, rdi
call fcn.14012f24c
cmp byte [rsp + 0x68], 0
jne 0x14005a43d
mov byte [rsi + 0x14], 0
mov rax, rsi
jmp 0x14005a4fa
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xb8], 0
cmp byte [rsp + 0x68], 0
je 0x14005a527
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.140023ad0
nop
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rsp + 0xc0], xmm0
mov dword [rsp + 0xd0], ecx
lea rdx, [rsp + 0xc0]
mov rcx, rax
call fcn.140059e20
nop
movzx edx, byte [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.1400177c0
nop
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsi], xmm0
mov eax, dword [rsp + 0xd0]
mov dword [rsi + 0x10], eax
mov byte [rsi + 0x14], 1
cmp byte [rsp + 0x68], 0
je 0x14005a4d8
lea rcx, [rsp + 0x48]
call fcn.140006c50
mov rax, rsi
jmp 0x14005a4fa
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.14012f1f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140002a50
nop
int3
Function at 0x14005aa00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ecx, 0x20
call fcn.14012f210
mov rdi, rax
mov qword [rsp + 0x60], 0x11
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [0x14015e6d8]
movups xmmword [rax], xmm0
movzx ecx, byte [0x14015e6e8]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
mov qword [rsp + 0x50], rax
movabs rcx, 0xcbf29ce484222325
xor ebp, ebp
mov edx, ebp
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rdi]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, 0x11
jb 0x14005aa80
and rcx, qword [0x140195250]
add rcx, rcx
mov rax, qword [0x140195238]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [0x140195228]
je 0x14005ac8b
mov rsi, qword [rax + rcx*8]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14005aad2
mov rdx, qword [rdx]
cmp rax, 0x11
jne 0x14005aae7
mov r8, rax
mov rcx, rdi
call fcn.140130750
test eax, eax
je 0x14005aaf6
cmp rbx, rsi
je 0x14005ac8b
mov rbx, qword [rbx + 8]
jmp 0x14005aac0
test rbx, rbx
je 0x14005ac8b
mov rbx, qword [rbx + 0x30]
lea rax, str.PreDownloadSwitch
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x11
call fcn.140037320
lea rdx, [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.140038c60
nop
mov r8d, 0x15
lea rdx, str.SettingsAndrowsStore
mov rcx, rax
call fcn.140006590
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 7
mov word [rax], bp
mov rdx, qword [rsp + 0x88]
cmp rdx, 8
jb 0x14005aba9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005aba4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005aba4
call qword [0x140138140]
int3
call fcn.14012f24c
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov r9, rbx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000001
call fcn.140068280
mov rbx, rax
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14005ac40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ac3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ac3b
call qword [0x140138140]
int3
call fcn.14012f24c
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], bp
mov edx, 0x20
mov rcx, rdi
call fcn.14012f24c
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14012f1f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call qword [0x140137578]
int3
Function at 0x14005ad60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14005add5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14005add5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14005adc5
nop
cmp rbx, rcx
jae 0x14005add5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14005adb0
cmp rbx, rcx
jae 0x14005add5
cmp word [rbx], 0
je 0x14005add5
mov rax, rbx
jmp 0x14005add7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140065080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x14018d030]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, rcx
mov qword [rbp - 0x71], rcx
lea rcx, [rbp - 0x39]
call fcn.1400507f0
nop
mov qword [rbp - 0x61], 0
mov qword [rbp - 0x51], 0
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
mov ecx, 0x20
call fcn.14012f210
mov rsi, rax
mov qword [rbp - 0x51], 0x19
mov qword [rbp - 0x49], 0x1f
movups xmm0, xmmword [str.inner_app_notification_id]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140164258]
movsd qword [rax + 0x10], xmm1
movzx eax, byte [0x140164260]
mov byte [rsi + 0x18], al
mov byte [rsi + 0x19], 0
mov qword [rbp - 0x61], rsi
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs r8, 0x100000001b3
mov rdi, qword [rbp - 0x51]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rsi]
xor rcx, rax
imul rcx, r8
inc rdx
cmp rdx, rdi
jb 0x140065140
and rcx, qword [rbp + 0x17]
add rcx, rcx
mov rax, qword [rbp - 1]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [rbp - 0x11]
je 0x1400651ce
mov r14, qword [rax + rcx*8]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140065182
mov rdx, qword [rdx]
cmp rdi, rax
jne 0x140065196
mov r8, rdi
mov rcx, rsi
call fcn.140130750
test eax, eax
je 0x1400651a1
cmp rbx, r14
je 0x1400651ce
mov rbx, qword [rbx + 8]
jmp 0x140065170
test rbx, rbx
je 0x1400651ce
lea r8, [rbp - 0x61]
lea rdx, [rbp - 0x71]
lea rcx, [rbp - 0x19]
call fcn.1400520b0
mov rdx, qword [rax]
add rdx, 0x30
lea rcx, [rsp + 0x20]
call fcn.140006810
mov byte [rbp - 0x79], 1
jmp 0x1400651d2
mov byte [rbp - 0x79], 0
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140064e70
nop
cmp byte [rbp - 0x79], 0
je 0x1400651f1
lea rcx, [rsp + 0x20]
call fcn.140006c50
nop
mov rdx, qword [rbp - 0x49]
cmp rdx, 0x10
jb 0x14006522f
inc rdx
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006522a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006522a
call qword [0x140138140]
int3
call fcn.14012f24c
mov qword [rbp - 0x51], 0
mov qword [rbp - 0x49], 0xf
mov byte [rbp - 0x61], 0
lea rcx, [rbp - 0x19]
call fcn.1400149f0
lea rcx, [rbp - 0x39]
call fcn.140006c50
mov rax, r15
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14012f1f0
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret