joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057e80
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
lea rax, [rsp + 0x60]
mov rdx, qword [rcx]
lea r8, [rsp + 0x50]
mov rcx, qword [0x1402f8258]
add rdx, 0x18
mov r9d, 8
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea rcx, [0x1402f5f40]
call fcn.1400e01e0
test eax, eax
jne 0x140057fcc
cmp dword [0x1402f5f8c], 0x7fffffff
je 0x140057fb7
mov rax, qword [rsp + 0x50]
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
movzx r8d, al
xor r8, rcx
movzx ecx, byte [rsp + 0x51]
imul r8, rdx
xor r8, rcx
movzx ecx, byte [rsp + 0x52]
imul r8, rdx
xor r8, rcx
movzx ecx, byte [rsp + 0x53]
imul r8, rdx
xor r8, rcx
imul r8, rdx
mov rdx, qword [0x1402f6090]
and rdx, r8
shl rdx, 4
add rdx, qword [0x1402f6078]
mov rcx, qword [rdx + 8]
cmp rcx, qword [0x1402f6068]
je 0x140057f60
mov rdx, qword [rdx]
cmp eax, dword [rcx + 0x10]
je 0x140057f62
nop dword [rax]
cmp rcx, rdx
je 0x140057f60
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140057f50
jmp 0x140057f62
xor ecx, ecx
test rcx, rcx
je 0x140057f87
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.140065ed0
mov rcx, rbx
mov rdx, qword [rax]
add rdx, 0x18
call fcn.140064ed0
jmp 0x140057fa2
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea rcx, [0x1402f5f40]
call fcn.1400e01e8
mov rax, rbx
add rsp, 0x40
pop rbx
ret
mov ecx, 6
mov dword [0x1402f5f8c], 0x7ffffffe
call fcn.1400dfb90
int3
mov ecx, 5
call fcn.1400dfb90
int3
Function at 0x1400581b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rbx, rdx
lea r8, [rsp + 0x90]
mov rdi, rcx
xor edx, edx
lea rcx, [0x1402f8390]
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x1400582ed
mov qword [rsp + 0x80], rsi
xor esi, esi
cmp dword [rsp + 0x90], esi
je 0x14005829b
vmovdqu xmm0, xmmword [0x140144480]
mov eax, dword [0x14013e998]
mov ecx, 0x20
vmovdqu xmmword [rsp + 0x40], xmm0
vmovsd xmm0, qword [str.RootComponent]
mov dword [rsp + 0x38], eax
movzx eax, byte [0x14013e99c]
vmovsd qword [rsp + 0x30], xmm0
mov word [rsp + 0x3e], si
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], sil
mov qword [rsp + 0x58], rsi
call fcn.140066350
vmovups xmm1, xmmword [str._Script_Engine.Actor]
vmovdqu xmm0, xmmword [0x1401444f0]
vmovdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
vmovups xmmword [rax], xmm1
mov edx, dword [0x14013e988]
mov dword [rax + 0x10], edx
lea rdx, [rsp + 0x30]
mov byte [rax + 0x14], sil
call fcn.140057de0
xor r8d, r8d
mov qword [0x1402f84b0], rax
xor edx, edx
lea rcx, [0x1402f8390]
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x1400582e7
mov rcx, qword [0x1402f8258]
lea rax, [rsp + 0x98]
mov edx, dword [0x1402f84b0]
mov r9d, 8
add rdx, qword [rdi]
mov r8, rbx
mov qword [rbx], rsi
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rsp + 0x80]
mov rax, rbx
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
call fcn.1400e01cc
int3
call fcn.1400f053c
int3
Function at 0x140059250
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
lea r8, [rsp + 0x90]
lea rcx, [0x1402f84c8]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x14005939a
cmp dword [rsp + 0x90], 0
je 0x140059351
vmovdqu xmm1, xmmword [0x140144470]
mov eax, dword [0x14013ebe0]
mov ecx, 0x20
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x30], xmm0
vmovsd xmm0, qword [str.CurrentState]
vmovsd qword [rsp + 0x30], xmm0
vmovdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x38], eax
mov byte [rsp + 0x3c], 0
mov qword [rsp + 0x58], 0
call fcn.140066350
vmovups xmm1, xmmword [str._Script_OPP.RBExplosiveWireTrap]
vmovdqu xmm0, xmmword [0x140144590]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
vmovdqu xmmword [rsp + 0x60], xmm0
vmovups xmmword [rax], xmm1
vmovsd xmm0, qword [0x14013ebf8]
vmovsd qword [rax + 0x10], xmm0
mov edx, dword [0x14013ec00]
mov r8, rax
mov dword [rax + 0x18], edx
lea rdx, [rsp + 0x30]
movzx eax, word [0x14013ec04]
mov word [r8 + 0x1c], ax
movzx eax, byte [0x14013ec06]
mov byte [r8 + 0x1e], al
mov byte [r8 + 0x1f], 0
call fcn.140057de0
xor r8d, r8d
mov qword [0x1402f8398], rax
xor edx, edx
lea rcx, [0x1402f84c8]
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140059394
mov rcx, qword [0x1402f8258]
lea rax, [rsp + 0x98]
mov edx, dword [0x1402f8398]
lea r8, [rsp + 0x88]
add rdx, qword [rbx]
mov r9d, 1
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movzx eax, byte [rsp + 0x88]
add rsp, 0x70
pop rbx
ret
call fcn.1400e01cc
int3
call fcn.1400f053c
int3
Function at 0x140064960
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r8, rdx
mov r10, qword [rdx + 0x10]
jbe 0x140064975
mov r8, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1400649a4
movabs r11, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x140064990
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140065df0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400649c4
add rax, 0x30
add rsp, 0x38
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1400dfd94
int3

Function at 0x1400649e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rdi, rdx
mov r8, qword [rdx + 0x10]
jbe 0x1400649fb
mov rdx, qword [rdx]
xor ecx, ecx
movabs rbx, 0xcbf29ce484222325
test r8, r8
je 0x140064a33
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor rbx, rax
imul rbx, r9
cmp rcx, r8
jb 0x140064a20
mov r9, rbx
lea rdx, [rsp + 0x20]
mov r8, rdi
call fcn.140065df0
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x140064b39
movabs rax, 0x249249249249249
cmp qword [0x1402f6130], rax
je 0x140064b48
mov qword [rsp + 0x40], rbp
mov ecx, 0x70
mov qword [rsp + 0x48], rsi
call fcn.1400deef0
mov rdx, rdi
mov rbp, rax
lea rcx, [rax + 0x10]
call fcn.140064ed0
lea rcx, [rbp + 0x30]
call fcn.140064800
mov rcx, qword [0x1402f6130]
add rcx, 1
vxorps xmm0, xmm0, xmm0
js 0x140064aac
vcvtsi2ss xmm0, xmm0, rcx
jmp 0x140064ac1
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
mov rcx, qword [0x1402f6158]
vxorps xmm1, xmm1, xmm1
test rcx, rcx
js 0x140064ad8
vcvtsi2ss xmm1, xmm1, rcx
jmp 0x140064aed
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm1, xmm1, rax
vaddss xmm1, xmm1, xmm1
vdivss xmm1, xmm0, xmm1
vmovss xmm0, dword [0x1402f6120]
vcomiss xmm0, xmm1
jae 0x140064b1f
call fcn.140066460
mov r9, rbx
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x20]
call fcn.140065df0
vmovups xmm0, xmmword [rax]
vmovups xmmword [rsp + 0x20], xmm0
mov r8, qword [rsp + 0x20]
mov r9, rbp
mov rdx, rbx
call fcn.140066510
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rax, 0x30
add rsp, 0x30
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400dfd70
int3

Function at 0x1400653f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r8, rdx
mov r10, qword [rdx + 0x10]
jbe 0x140065405
mov r8, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x140065434
movabs r11, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x140065420
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140065df0
cmp qword [rax + 8], 0
setne al
add rsp, 0x38
ret
Function at 0x140065450
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
cmp qword [rdx + 0x18], 0xf
mov r10, rdx
mov r11, qword [rdx + 0x10]
jbe 0x140065465
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1400654a9
mov qword [rsp + 0x30], rbx
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r10 + r8]
inc r8
xor r9, rax
imul r9, rbx
cmp r8, r11
jb 0x140065490
mov rbx, qword [rsp + 0x30]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140066d50
cmp qword [rax + 8], 0
setne al
add rsp, 0x38
ret

Function at 0x1400654d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
mov r9, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [0x1402f6090]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x1402f6078]
mov rax, qword [rdx + 8]
cmp rax, qword [0x1402f6068]
je 0x140065555
mov ecx, dword [r9]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x140065557
cmp rax, rdx
je 0x140065555
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140065540
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret
Function at 0x140065ed0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x30
movzx esi, byte [r8]
movabs rcx, 0x100000001b3
mov rbp, qword [0x1402f6068]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r14, r8
mov rdx, qword [0x1402f6090]
imul rsi, rcx
xor rsi, rax
movzx eax, byte [r8 + 2]
imul rsi, rcx
xor rsi, rax
movzx eax, byte [r8 + 3]
imul rsi, rcx
xor rsi, rax
imul rsi, rcx
mov rcx, qword [0x1402f6078]
and rdx, rsi
add rdx, rdx
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, rbp
je 0x140065f91
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x140065f6e
nop
cmp rax, rdx
je 0x140065f8e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140065f60
mov byte [rbx + 8], 0
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop r14
ret
mov rbp, rax
movabs rax, 0x492492492492492
cmp qword [0x1402f6070], rax
je 0x1400660c2
mov ecx, 0x38
mov qword [rsp + 0x40], rdi
call fcn.1400deef0
mov ecx, dword [r14]
mov rdi, rax
xor r14d, r14d
vpxor xmm0, xmm0, xmm0
mov dword [rax + 0x10], ecx
vmovups xmmword [rax + 0x18], xmm0
mov qword [rax + 0x28], r14
mov qword [rax + 0x30], 0xf
mov byte [rax + 0x18], r14b
mov rcx, qword [0x1402f6070]
add rcx, 1
vxorps xmm0, xmm0, xmm0
js 0x140065ff4
vcvtsi2ss xmm0, xmm0, rcx
jmp 0x140066009
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
mov rcx, qword [0x1402f6098]
vxorps xmm1, xmm1, xmm1
test rcx, rcx
js 0x140066020
vcvtsi2ss xmm1, xmm1, rcx
jmp 0x140066035
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm1, xmm1, rax
vaddss xmm1, xmm1, xmm1
vdivss xmm1, xmm0, xmm1
vmovss xmm0, dword [0x1402f6060]
vcomiss xmm0, xmm1
jae 0x14006609f
call fcn.140066570
mov rax, qword [0x1402f6090]
mov r8, qword [0x1402f6078]
and rax, rsi
mov rdx, qword [0x1402f6068]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x140066078
mov qword [rsp + 0x20], rdx
jmp 0x14006609a
mov rdx, qword [r8 + rax*8]
mov eax, dword [rdi + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x140066092
cmp rcx, rdx
je 0x1400660bb
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140066084
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x20]
mov r9, rdi
mov r8, rbp
mov rdx, rsi
call fcn.140066620
mov rdi, qword [rsp + 0x40]
mov byte [rbx + 8], 1
jmp 0x140065f72
mov qword [rsp + 0x20], rcx
jmp 0x14006609a
lea rcx, str.unordered_map_set_too_long
call fcn.1400dfd70
int3
Function at 0x140066570
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [0x1402f6070]
add rcx, 1
mov rdx, qword [0x1402f6098]
vxorps xmm0, xmm0, xmm0
js 0x14006658f
vcvtsi2ss xmm0, xmm0, rcx
jmp 0x1400665a4
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
vdivss xmm0, xmm0, dword [0x1402f6060]
vxorps xmm1, xmm1, xmm1
vroundss xmm1, xmm1, xmm0, 2
vmovss xmm0, dword [0x140144330]
xor ecx, ecx
vcomiss xmm1, xmm0
jb 0x1400665dd
vsubss xmm1, xmm1, xmm0
vcomiss xmm1, xmm0
jae 0x1400665dd
movabs rax, 0x8000000000000000
mov rcx, rax
vcvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x14006660f
cmp rdx, 0x200
jae 0x14006660c
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x14006660f
mov rdx, rcx
jmp 0x140066b90
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov r8d, 1
bsr rcx, rax
shlx rax, r8, rcx
cmp rdx, rax
ja 0x140066d42
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1402f6068]
or rax, r8
bsr rcx, rax
mov qword [rsp + 0x20], rdi
inc ecx
shlx rdi, r8, rcx
mov r8, rbx
lea rcx, [0x1402f6078]
lea rdx, [rdi + rdi]
call fcn.140065270
mov rax, qword [0x1402f6068]
lea r9, [rdi - 1]
mov qword [0x1402f6090], r9
mov qword [0x1402f6098], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140066d33
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop dword [rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1402f6078]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140066c7f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140066cf4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140066cbc
mov r10, qword [rdx]
cmp r10, rax
je 0x140066cb6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140066cf4
cmp r9, rdx
je 0x140066cd0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140066d08
cmp r9, rdx
jne 0x140066cc1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140066d2e
mov r9, qword [0x1402f6090]
jmp 0x140066c30
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140066cf4
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400dfd70
int3
Function at 0x140066b90
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [0x1402f6070]
add rcx, 1
mov rdx, qword [0x1402f6098]
vxorps xmm0, xmm0, xmm0
js 0x14006658f
vcvtsi2ss xmm0, xmm0, rcx
jmp 0x1400665a4
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
vdivss xmm0, xmm0, dword [0x1402f6060]
vxorps xmm1, xmm1, xmm1
vroundss xmm1, xmm1, xmm0, 2
vmovss xmm0, dword [0x140144330]
xor ecx, ecx
vcomiss xmm1, xmm0
jb 0x1400665dd
vsubss xmm1, xmm1, xmm0
vcomiss xmm1, xmm0
jae 0x1400665dd
movabs rax, 0x8000000000000000
mov rcx, rax
vcvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x14006660f
cmp rdx, 0x200
jae 0x14006660c
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x14006660f
mov rdx, rcx
jmp 0x140066b90
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov r8d, 1
bsr rcx, rax
shlx rax, r8, rcx
cmp rdx, rax
ja 0x140066d42
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1402f6068]
or rax, r8
bsr rcx, rax
mov qword [rsp + 0x20], rdi
inc ecx
shlx rdi, r8, rcx
mov r8, rbx
lea rcx, [0x1402f6078]
lea rdx, [rdi + rdi]
call fcn.140065270
mov rax, qword [0x1402f6068]
lea r9, [rdi - 1]
mov qword [0x1402f6090], r9
mov qword [0x1402f6098], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140066d33
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop dword [rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1402f6078]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140066c7f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140066cf4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140066cbc
mov r10, qword [rdx]
cmp r10, rax
je 0x140066cb6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140066cf4
cmp r9, rdx
je 0x140066cd0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140066d08
cmp r9, rdx
jne 0x140066cc1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140066d2e
mov r9, qword [0x1402f6090]
jmp 0x140066c30
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140066cf4
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400dfd70
int3
Function at 0x14006a140
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
mov rsi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14006a174
xor eax, eax
jmp 0x14006a201
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
call fcn.14010d2d0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14006a1f6
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.1400f09f8
test eax, eax
jne 0x14006a1b7
mov ebx, dword [rsp + 0x28]
jmp 0x14006a1f6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x14006a1f6
nop dword [rax]
lea rdx, [rsp + 0x4c]
mov rcx, rsi
call fcn.1400f09f8
test eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rdi
cmove ebx, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14006a1d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14006f560
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov dword [rsp + 0x28], edx
lea rcx, [0x14006f5b0]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
test eax, eax
jne 0x14006f59c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
jne 0x14006f59c
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x14006f59e
xor eax, eax
add rsp, 0x38
ret
Function at 0x1400729c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140072a21
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400729e0
mov ecx, dword [r9]
jmp 0x140072b0b
cmp ecx, 0x4e0
jb 0x140072b0b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140072a40
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140072a90
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400d5570
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
movzx ebp, byte [r8]
movabs rcx, 0x100000001b3
mov r14, qword [0x1402f6068]
movabs rax, 0xcbf29ce484222325
xor rbp, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov rsi, r8
mov rdx, qword [0x1402f6090]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [r8 + 2]
imul rbp, rcx
xor rbp, rax
movzx eax, byte [r8 + 3]
imul rbp, rcx
xor rbp, rax
imul rbp, rcx
mov rcx, qword [0x1402f6078]
and rdx, rbp
add rdx, rdx
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, r14
je 0x1400d5620
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x1400d5605
cmp rax, rdx
je 0x1400d561d
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1400d55f7
mov byte [rbx + 8], 0
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
mov r14, rax
movabs rax, 0x492492492492492
cmp qword [0x1402f6070], rax
je 0x1400d5776
mov qword [rsp + 0x50], rdi
mov ecx, 0x38
mov qword [rsp + 0x58], r15
call fcn.1400deef0
mov ecx, dword [rsi]
xor r15d, r15d
vpxor xmm0, xmm0, xmm0
mov rdi, rax
mov dword [rax + 0x10], ecx
vmovups xmmword [rax + 0x18], xmm0
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], r15
vmovups ymm0, ymmword [rsi + 8]
vmovups ymmword [rax + 0x18], ymm0
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], 0xf
mov byte [rsi + 8], r15b
mov rcx, qword [0x1402f6070]
add rcx, 1
vxorps xmm0, xmm0, xmm0
js 0x1400d5699
vcvtsi2ss xmm0, xmm0, rcx
jmp 0x1400d56ae
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm0, xmm0, rax
vaddss xmm0, xmm0, xmm0
mov rcx, qword [0x1402f6098]
vxorps xmm1, xmm1, xmm1
test rcx, rcx
js 0x1400d56c5
vcvtsi2ss xmm1, xmm1, rcx
jmp 0x1400d56da
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
vcvtsi2ss xmm1, xmm1, rax
vaddss xmm1, xmm1, xmm1
vdivss xmm1, xmm0, xmm1
vmovss xmm0, dword [0x1402f6060]
vcomiss xmm0, xmm1
jae 0x1400d574b
vzeroupper
call fcn.140066570
mov rax, qword [0x1402f6090]
mov r8, qword [0x1402f6078]
and rax, rbp
mov rdx, qword [0x1402f6068]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x1400d5720
mov qword [rsp + 0x20], rdx
jmp 0x1400d5746
mov rdx, qword [r8 + rax*8]
mov eax, dword [rdi + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x1400d573e
nop dword [rax]
cmp rcx, rdx
je 0x1400d576f
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x1400d5730
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0x20]
mov r9, rdi
mov r8, r14
mov rdx, rbp
vzeroupper
call fcn.140066620
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov byte [rbx + 8], 1
jmp 0x1400d5609
mov qword [rsp + 0x20], rcx
jmp 0x1400d5746
lea rcx, str.unordered_map_set_too_long
call fcn.1400dfd70
int3