joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d4bb0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x10], xmm6
mov qword [rbp + 8], 0xfffffffffffffffe
mov r15, rdx
mov rdi, rcx
add rcx, 0x268
mov qword [rbp - 8], rcx
call fcn.1400ea0f4
test eax, eax
jne 0x1400d4d74
mov r9d, dword [r15]
mov rax, r9
shr rax, 0x10
lea r8, [rbp + 6]
mov word [r8], ax
lea rcx, [rdi + 0x228]
movzx eax, al
movabs rdx, 0xcbf29ce484222325
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
shr r9, 0x18
xor r9, rdx
imul r9, rax
lea rdx, [rbp - 0x58]
call fcn.1400d72ac
mov r14, qword [rbp - 0x50]
test r14, r14
je 0x1400d4d53
cmp r14, qword [rdi + 0x230]
je 0x1400d4d53
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1400d4c85
lea rdi, [r15 + 0x48]
lea r12, [rbp - 0x58]
lea r8, [rbx + 0x10]
mov rcx, rdi
mov rdx, r12
call fcn.14000e2ca
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x1400d4c6e
mov r12, qword [r14 + 0x60]
add r15, 0x88
xorps xmm6, xmm6
lea rdi, [rbp - 0x58]
mov rsi, r12
mov rsi, qword [rsi]
cmp rsi, r12
je 0x1400d4d53
mov qword [rbp - 0x30], 0
lea rax, [rbp - 0x20]
movups xmmword [rax], xmm6
cmp qword [rsi + 0x48], 0x10
jb 0x1400d4cc2
mov rbx, qword [rsi + 0x30]
jmp 0x1400d4cc6
lea rbx, [rsi + 0x30]
mov r14, qword [rsi + 0x40]
cmp r14, 0xf
ja 0x1400d4cdf
movups xmm0, xmmword [rbx]
movaps xmmword [rbp - 0x30], xmm0
mov r13d, send
jmp 0x1400d4d23
mov r13, r14
or r13, 0xf
movabs rax, 0x7fffffffffffffff
cmp r13, rax
cmovae r13, rax
lea rcx, [r13 + 1]
cmp r13, 0xfff
jb 0x1400d4d0b
call fcn.1400014ce
jmp 0x1400d4d10
call fcn.1400e7770
mov qword [rbp - 0x30], rax
lea r8, [r14 + 1]
mov rcx, rax
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r13
mov rcx, rdi
lea rdx, [rbp - 0x30]
call fcn.1400bfd00
lea rdx, [rsi + 0x10]
mov rcx, r15
mov r8, rdi
call fcn.1400d5002
mov rcx, rdi
call fcn.14007bb08
jmp 0x1400d4c9a
mov rcx, qword [rbp - 8]
call fcn.1400ea138
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov ecx, eax
call fcn.1400e8684
int3
Function at 0x1400d6a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rsi + rax]
xor rbx, rdx
imul rbx, rcx
inc rax
cmp rax, 4
jne 0x1400d6a78
lea rdi, [rbp - 0x20]
mov rcx, r15
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call fcn.1400c4748
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400d6ab7
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400d6b8c
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [r15 + 0x10], rax
je 0x1400d6b9c
lea rdx, [r15 + 8]
lea rcx, [rbp - 0x10]
mov r8, rsi
call fcn.1400d6be0
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x38]
inc rcx
js 0x1400d6aef
cvtsi2ss xmm0, rcx
jmp 0x1400d6b04
mov rdx, rcx
shr rdx, 1
and ecx, 1
or rcx, rdx
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
test rax, rax
js 0x1400d6b10
cvtsi2ss xmm1, rax
jmp 0x1400d6b25
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
ucomiss xmm0, dword [r15]
jbe 0x1400d6b56
mov rcx, r15
call fcn.1400c481e
mov r8, qword [rbp - 8]
add r8, 0x10
lea rdx, [rbp - 0x30]
mov rcx, r15
mov r9, rbx
call fcn.1400c4748
movups xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x20], xmm0
mov r9, qword [rbp - 8]
mov qword [rbp - 8], 0
mov r8, qword [rbp - 0x20]
mov rcx, r15
mov rdx, rbx
call fcn.14000984c
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400d6b8c
mov edx, 0x18
call fcn.1400e7768
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400e8940
int3
Function at 0x1400d6cb6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
cmp rdx, r8
je 0x1400d6d98
mov rsi, rcx
mov rax, qword [rcx + 8]
mov qword [rbp - 0x10], rax
mov rbx, qword [rcx + 0x18]
mov rax, qword [r15 + 8]
mov qword [rbp - 0x20], rax
movabs rax, 0xcbf29ce484222325
mov ecx, send
movabs rdi, 0x100000001b3
movzx edx, byte [r15 + rcx]
xor rax, rdx
imul rax, rdi
inc rcx
cmp rcx, 0x14
jne 0x1400d6d07
and rax, qword [rsi + 0x30]
lea rcx, [rax + rax]
mov rdx, rax
shl rdx, 4
lea rdi, [rbx + rdx]
mov qword [rbp - 0x18], rdi
add rax, rax
inc rax
mov qword [rbp - 0x30], rax
mov rax, qword [rbx + rdx]
mov qword [rbp - 0x28], rax
cmp rax, r15
setne byte [rbp - 8]
mov qword [rbp], rbx
mov r14, qword [rbx + rcx*8 + 8]
mov rbx, r15
mov r13, r8
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
mov rcx, rdi
mov r12, rsi
call fcn.1400e7768
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1400d6da0
mov r8, r13
cmp rbx, r13
setne al
or al, byte [rbp - 8]
cmp al, 1
jne 0x1400d6e71
cmp rbx, r8
jne 0x1400d6d58
jmp 0x1400d6e7d
mov r8, r15
jmp 0x1400d6e88
mov rax, qword [rbp - 0x20]
cmp qword [rbp - 0x28], r15
mov r8, r13
jne 0x1400d6db8
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
mov qword [rcx], rax
mov rcx, qword [rbp]
mov rdx, qword [rbp - 0x30]
mov qword [rcx + rdx*8], rax
cmp rbx, r8
je 0x1400d6e7d
movabs rax, 0xcbf29ce484222325
mov ecx, send
movabs rdi, 0x100000001b3
movzx edx, byte [rbx + rcx]
xor rax, rdx
imul rax, rdi
inc rcx
cmp rcx, 0x14
jne 0x1400d6de6
and rax, qword [rsi + 0x30]
lea rcx, [rax + rax]
mov r14, rax
shl r14, 4
mov rdx, qword [rbp]
add r14, rdx
add rax, rax
inc rax
mov qword [rbp - 8], rax
mov r15, qword [rdx + rcx*8 + 8]
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
mov rcx, rdi
call fcn.1400e7768
dec qword [r12 + 0x10]
cmp rdi, r15
je 0x1400d6e43
cmp rbx, r13
jne 0x1400d6e1f
jmp 0x1400d6e77
mov rsi, r12
mov rax, qword [rbp - 0x10]
mov qword [r14], rax
mov rcx, qword [rbp]
mov rdx, qword [rbp - 8]
mov qword [rcx + rdx*8], rax
mov r8, r13
cmp rbx, r13
movabs rax, 0xcbf29ce484222325
jne 0x1400d6dd7
jmp 0x1400d6e7d
mov r14, qword [rbp - 0x18]
jmp 0x1400d6e7a
mov r8, r13
mov qword [r14], r8
mov rax, qword [rbp - 0x20]
mov qword [rax], r8
mov qword [r8 + 8], rax
mov rax, r8
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400d710c
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx ebx, byte [r8 + 1]
xor rbx, rcx
imul rbx, rax
lea rdi, [rbp - 0x30]
mov rcx, r15
mov rdx, rdi
mov r9, rbx
call fcn.1400d72ac
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400d7181
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400d7263
movabs rax, 0x1af286bca1af286
cmp qword [r15 + 0x10], rax
je 0x1400d7273
lea r9, [rbp - 0x40]
mov qword [r9], rsi
lea rdx, [r15 + 8]
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r8, [0x140114e98]
lea rcx, [rbp - 0x18]
call fcn.1400d730a
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x38]
inc rcx
js 0x1400d71cd
cvtsi2ss xmm0, rcx
jmp 0x1400d71e2
mov rdx, rcx
shr rdx, 1
and ecx, 1
or rcx, rdx
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
test rax, rax
js 0x1400d71ee
cvtsi2ss xmm1, rax
jmp 0x1400d7203
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
ucomiss xmm0, dword [r15]
jbe 0x1400d7234
mov rcx, r15
call fcn.1400d7394
mov r8, qword [rbp - 0x10]
add r8, 0x10
lea rdx, [rbp - 0x40]
mov rcx, r15
mov r9, rbx
call fcn.1400d72ac
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x30], xmm0
lea rsi, [rbp - 0x18]
mov r9, qword [rsi + 8]
mov qword [rsi + 8], 0
mov r8, qword [rbp - 0x30]
mov rcx, r15
mov rdx, rbx
call fcn.14000984c
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, rsi
call fcn.1400d7438
mov rax, r14
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400e8940
int3
Function at 0x1400d7556
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400d76d3
mov r14, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea rax, [r14 + 0x18]
mov r15, qword [r14 + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, r15
call fcn.1400092e6
lea rax, [rsi - 1]
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rsi
mov rax, qword [r14 + 8]
mov r11, qword [rax]
cmp r11, r15
je 0x1400d76c6
movabs r8, 0x4bf29ce484222325
movabs r9, 0x100000001b3
mov rdx, r11
movzx eax, byte [r11 + 0x10]
xor rax, r8
imul rax, r9
movzx esi, byte [r11 + 0x11]
xor rsi, rax
imul rsi, r9
and rsi, qword [r14 + 0x30]
mov r11, qword [r11]
mov rcx, qword [r14 + 0x18]
lea r10, [rsi + rsi]
lea rdi, [rsi + rsi]
inc rdi
shl rsi, 4
mov rbx, qword [rcx + rsi]
cmp rbx, r15
je 0x1400d768c
mov rsi, qword [rcx + rdi*8]
movzx eax, word [rdx + 0x10]
cmp ax, word [rsi + 0x10]
jne 0x1400d7657
mov rax, qword [rsi]
cmp rax, rdx
je 0x1400d7690
mov r10, qword [rdx + 8]
mov qword [r10], r11
mov rsi, qword [r11 + 8]
mov qword [rsi], rax
mov rbx, qword [rax + 8]
mov qword [rbx], rdx
mov qword [rax + 8], rsi
mov qword [r11 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400d7690
cmp rbx, rsi
je 0x1400d769f
mov rsi, qword [rsi + 8]
cmp ax, word [rsi + 0x10]
jne 0x1400d7657
mov rax, qword [rsi]
mov rcx, qword [rdx + 8]
mov qword [rcx], r11
mov rbx, qword [r11 + 8]
mov qword [rbx], rax
mov rdi, qword [rax + 8]
mov qword [rdi], rdx
mov qword [rax + 8], rbx
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rdi
jmp 0x1400d7694
mov qword [rcx + r10*8], rdx
mov qword [rcx + rdi*8], rdx
cmp r11, r15
jne 0x1400d75e0
jmp 0x1400d76c6
mov rax, qword [rdx + 8]
mov qword [rax], r11
mov rsi, qword [r11 + 8]
mov qword [rsi], rbx
mov rdi, qword [rbx + 8]
mov qword [rdi], rdx
mov qword [rbx + 8], rsi
mov qword [r11 + 8], rax
mov qword [rdx + 8], rdi
mov qword [rcx + r10*8], rdx
jmp 0x1400d7694
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400e8940
int3
Function at 0x1400d96a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
cmp rdx, r8
je 0x1400d96ce
mov r15, r8
mov rax, qword [rdx + 0x20]
cmp qword [rdx + 0x28], 0x10
jb 0x1400d96d6
mov rbx, qword [rdx + 0x10]
jmp 0x1400d96da
mov r15, rdx
jmp 0x1400d989a
lea rbx, [rdx + 0x10]
movabs r9, 0xcbf29ce484222325
mov qword [rbp - 0x20], rcx
mov r8, qword [rcx + 0x18]
mov rsi, r9
test rax, rax
je 0x1400d9719
movabs r10, 0x100000001b3
xor edi, edi
mov rcx, r9
movzx esi, byte [rbx + rdi]
xor rsi, rcx
imul rsi, r10
inc rdi
mov rcx, rsi
cmp rax, rdi
jne 0x1400d9703
mov rbx, qword [rbp - 0x20]
lea rax, [rbx + 8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbx + 8]
mov qword [rbp - 0x10], rax
mov rax, qword [rdx + 8]
mov qword [rbp - 0x18], rax
and rsi, qword [rbx + 0x30]
lea rax, [rsi + rsi]
mov rcx, rsi
shl rcx, 4
lea rdi, [r8 + rcx]
mov qword [rbp], rdi
lea rdi, [rsi + rsi]
inc rdi
mov qword [rbp - 0x38], rdi
mov rcx, qword [r8 + rcx]
mov qword [rbp - 0x30], rcx
cmp rcx, rdx
setne r13b
mov qword [rbp - 8], r8
mov r12, qword [r8 + rax*8 + 8]
mov rsi, rdx
mov r14, rdx
mov rdi, r14
mov r14, qword [r14]
mov rcx, qword [rbp - 0x28]
mov rdx, rdi
call fcn.14000d640
dec qword [rbx + 0x10]
cmp rdi, r12
je 0x1400d97ab
cmp r14, r15
setne al
or al, r13b
cmp al, 1
jne 0x1400d9888
cmp r14, r15
jne 0x1400d9775
jmp 0x1400d988f
mov rax, qword [rbp - 0x18]
cmp qword [rbp - 0x30], rsi
jne 0x1400d97c0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp]
mov qword [rcx], rax
mov rcx, qword [rbp - 8]
mov rdx, qword [rbp - 0x38]
mov qword [rcx + rdx*8], rax
cmp r14, r15
je 0x1400d988f
movabs r12, 0x100000001b3
cmp qword [r14 + 0x28], 0x10
jb 0x1400d97ec
mov rax, qword [r14 + 0x10]
jmp 0x1400d97f0
lea rax, [r14 + 0x10]
movabs rsi, 0xcbf29ce484222325
mov r8, qword [rbp - 8]
mov rcx, qword [r14 + 0x20]
mov rdx, rsi
test rcx, rcx
je 0x1400d9822
xor edi, edi
movzx edx, byte [rax + rdi]
xor rdx, rsi
imul rdx, r12
inc rdi
mov rsi, rdx
cmp rcx, rdi
jne 0x1400d980c
mov rsi, qword [rbp - 0x20]
and rdx, qword [rsi + 0x30]
lea rax, [rdx + rdx]
mov rbx, rdx
shl rbx, 4
add rbx, r8
lea rcx, [rdx + rdx]
inc rcx
mov qword [rbp], rcx
mov r13, qword [r8 + rax*8 + 8]
mov rdi, r14
mov r14, qword [r14]
mov rcx, qword [rbp - 0x28]
mov rdx, rdi
call fcn.14000d640
dec qword [rsi + 0x10]
cmp rdi, r13
je 0x1400d986a
cmp r14, r15
jne 0x1400d9848
jmp 0x1400d988c
mov rcx, qword [rbp - 0x10]
mov qword [rbx], rcx
mov rax, qword [rbp - 8]
mov rdx, qword [rbp]
mov qword [rax + rdx*8], rcx
cmp r14, r15
jne 0x1400d97df
jmp 0x1400d988f
mov rbx, qword [rbp]
mov qword [rbx], r15
mov rax, qword [rbp - 0x18]
mov qword [rax], r15
mov qword [r15 + 8], rax
mov rax, r15
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400dce10
Capabilities:
Check if file exists

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rdi, r9
mov r15, r8
mov r14d, edx
test r9, r9
je 0x1400dce43
mov byte [rdi], 0
mov qword [r15], 0
mov eax, 0x104
xor edx, edx
movzx ebx, word [rcx + rdx]
test bx, bx
je 0x1400dce74
mov word [rbp + rdx - 0x60], bx
add rdx, 2
dec rax
jne 0x1400dce51
lea rcx, [rdx + rbp]
add rcx, 0xffffffffffffffa0
xor eax, eax
jmp 0x1400dce7c
lea rcx, [rdx + rbp]
add rcx, 0xffffffffffffffa0
xor edx, edx
cmp rax, 1
sbb rdx, rdx
mov word [rcx + rdx*2], 0
lea rax, [rbp - 0x60]
mov ecx, 0x104
cmp word [rax], 0
je 0x1400dcea5
add rax, 2
dec rcx
jne 0x1400dce94
jmp 0x1400dcedd
xor edx, edx
lea rbx, [0x140147db8]
movzx esi, word [rdx + rbx]
test si, si
je 0x1400dcecb
mov word [rax + rdx], si
add rdx, 2
dec rcx
jne 0x1400dceae
add rax, rdx
xor ecx, ecx
jmp 0x1400dcece
add rax, rdx
xor edx, edx
cmp rcx, 1
sbb rdx, rdx
mov word [rax + rdx*2], 0
xor ebx, ebx
lea r8, [rbp - 0x60]
mov ecx, 0x1f0003
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp + 0x1b0], rax
test rax, rax
je 0x1400dcf39
lea rdx, [rbp + 0x1bc]
mov dword [rdx], ebx
mov dword [rbp + 0x1cc], ebx
mov rcx, rax
call fcn.1400dd120
mov ebx, eax
test eax, eax
js 0x1400dcf69
xor eax, eax
test r14b, r14b
je 0x1400dcff9
cmp word [rbp + rax*2 - 0x60], 0
je 0x1400dcf89
inc rax
cmp rax, 0x104
jne 0x1400dcf24
jmp 0x1400dcfb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 2
je 0x1400dd055
mov rcx, qword [rbp + 0x208]
lea r8, [0x14013c0a1]
mov edx, 0xc9
call fcn.1400dd0d8
mov ebx, eax
jmp 0x1400dd055
mov rcx, qword [rbp + 0x208]
lea r8, [0x14013c0a1]
mov edx, 0xcf
mov r9d, ebx
call fcn.1400dc3f4
jmp 0x1400dd055
lea rcx, [rax*2 - 0x60]
add rcx, rbp
mov word [rcx], 0x68
xor edx, edx
cmp rax, 0x103
sete dl
add rdx, rdx
sub rcx, rdx
mov word [rcx + 2], 0
lea r8, [rbp - 0x60]
mov ecx, 0x1f0003
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp + 0x1c0], rax
test rax, rax
je 0x1400dd012
lea rdx, [rbp + 0x1cc]
mov rcx, rax
call fcn.1400dd120
mov ebx, eax
test eax, eax
js 0x1400dd02e
lea rcx, [rbp + 0x1c0]
call fcn.1400dd2fe
movsxd rax, dword [rbp + 0x1cc]
shl rax, 0x1f
movsxd rcx, dword [rbp + 0x1bc]
test rdi, rdi
je 0x1400dd008
mov byte [rdi], 1
or rax, rcx
mov qword [r15], rax
xor ebx, ebx
jmp 0x1400dd055
mov rcx, qword [rbp + 0x208]
lea r8, [0x14013c0a1]
mov edx, 0xd5
call fcn.1400dd0d8
mov ebx, eax
jmp 0x1400dd049
mov rcx, qword [rbp + 0x208]
lea r8, [0x14013c0a1]
mov edx, 0xd7
mov r9d, ebx
call fcn.1400dc3f4
lea rcx, [rbp + 0x1c0]
call fcn.1400dd2fe
lea rcx, [rbp + 0x1b0]
call fcn.1400dd2fe
mov eax, ebx
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400de9ca
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r8, rdx
mov rsi, rcx
movabs rdi, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + rax]
xor rdi, rdx
imul rdi, rcx
inc rax
cmp rax, 8
jne 0x1400de9fa
lea rdx, [rbp - 0x18]
mov rcx, rsi
mov r9, rdi
call fcn.140056274
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400dea53
and rdi, qword [rsi + 0x30]
mov rax, qword [rsi + 0x18]
lea r8, [rdi + rdi]
mov rdx, rdi
shl rdx, 4
mov rdx, qword [rax + rdx]
cmp qword [rax + r8*8 + 8], rcx
je 0x1400dea57
cmp rdx, rcx
jne 0x1400dea74
mov rdx, qword [rcx]
mov qword [rax + r8*8], rdx
jmp 0x1400dea74
xor eax, eax
jmp 0x1400dea95
add rdi, rdi
inc rdi
cmp rdx, rcx
je 0x1400dea68
mov rdx, qword [rcx + 8]
jmp 0x1400dea70
mov rdx, qword [rsi + 8]
mov qword [rax + r8*8], rdx
mov qword [rax + rdi*8], rdx
mov rax, qword [rcx]
dec qword [rsi + 0x10]
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov qword [rax + 8], rdx
mov edx, 0x20
call fcn.1400e7768
mov eax, 1
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400deea8
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x140
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb8], 0xfffffffffffffffe
mov rsi, rcx
lea rax, vtable.folly::AsyncLogWriter.0
mov qword [rcx], rax
add rcx, 8
mov qword [rbp + 0x90], rcx
call fcn.1400df11a
lea rcx, [rsi + 0xc0]
mov qword [rbp + 0x98], rcx
call fcn.1400f0398
lea rcx, [rsi + 0x108]
mov qword [rbp + 0xa0], rcx
call fcn.1400f0398
lea rax, [rsi + 0x150]
mov qword [rbp + 0xa8], rax
mov qword [rsi + 0x150], 0
mov byte [rsi + 0x158], 0
lea r9, [rbp - 0x50]
mov qword [r9], rsi
lea rax, [0x1400e00ca]
mov qword [r9 + 0x30], rax
lea rax, [0x1400baf2e]
mov qword [r9 + 0x38], rax
lea r8, [rbp - 0x10]
mov qword [r8], rsi
lea rcx, [0x1400e00e3]
mov qword [r8 + 0x30], rcx
mov qword [r8 + 0x38], rax
lea rdx, [rbp + 0x30]
mov qword [rdx], rsi
lea rcx, [0x1400e00fc]
mov qword [rdx + 0x30], rcx
mov qword [rdx + 0x38], rax
mov rcx, rsi
call fcn.1400cf72e
lea rdi, [rsi + 0x70]
mov qword [rbp + 0x70], rdi
mov byte [rbp + 0x78], 0
mov rcx, rdi
call fcn.1400ea0f4
test eax, eax
jne 0x1400df007
mov byte [rbp + 0x78], 1
or byte [rsi + 0x38], 1
mov ecx, 8
call fcn.1400e7770
mov qword [rax], rsi
lea rcx, [rbp + 0x88]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400e02e8]
xor ecx, ecx
xor edx, edx
mov qword [rbp + 0xb0], rax
mov r9, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov qword [rbp + 0x80], rax
test rax, rax
je 0x1400df00e
cmp dword [rsi + 0x68], 0
jne 0x1400df022
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rsi + 0x60], xmm0
mov rcx, rdi
call fcn.1400ea138
mov rax, rsi
add rsp, 0x140
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.1400e8684
mov dword [rbp + 0x88], 0
mov ecx, 6
call fcn.1400e86c0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_terminate
int3
Function at 0x1400dfd26
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 0x150]
mov qword [rbp - 0x28], rdi
mov r8b, byte [rcx + 0x158]
mov byte [rbp - 0x20], r8b
mov qword [rcx + 0x150], 0
mov byte [rcx + 0x158], 0
test rdi, rdi
mov rcx, 0xffffffffffffff98
cmove rcx, rdi
mov eax, dword [rdi + rcx + 0x30]
mov edx, eax
and edx, 3
cmp edx, 1
jne 0x1400dfdf6
add rdi, rcx
and eax, 0xffffffe3
mov dword [rdi + 0x30], eax
mov ecx, 8
call fcn.1400e7770
mov qword [rax], rsi
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
lea r8, [0x1400e02e8]
xor ecx, ecx
xor edx, edx
mov qword [rbp - 0x30], rax
mov r9, rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1400dfe12
cmp dword [rdi + 0x60], 0
jne 0x1400dfe0d
add rdi, 0x58
movups xmm0, xmmword [rbp - 0x18]
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x18], 0
mov dword [rbp - 0x10], 0
movups xmmword [rdi], xmm0
cmp dword [rbp - 0x10], 0
jne 0x1400dfe0d
mov r8b, byte [rbp - 0x20]
test r8b, r8b
je 0x1400dfe04
mov rcx, qword [rbp - 0x28]
call fcn.1400ea138
nop
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
call sub.api_ms_win_crt_runtime_l1_1_0.dll_terminate
mov dword [rbp - 0x10], 0
mov ecx, 6
call fcn.1400e86c0
int3

Function at 0x1400e71ac
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov esi, ecx
mov eax, dword [0x1401bab98]
mov ecx, dword [0x14019ea3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400e721a
test rdi, rdi
je 0x1400e720f
mov rax, qword [0x1401bab90]
xor ecx, ecx
mov dl, byte [rbx + rcx]
xor dl, sil
shr esi, 8
movzx edx, dl
xor esi, dword [rax + rdx*4]
inc rcx
cmp rdi, rcx
jne 0x1400e71f8
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401bab98]
call fcn.1400e78b0
cmp dword [0x1401bab98], 0xffffffff
jne 0x1400e71ea
call fcn.1400e7272
mov qword [0x1401bab90], rax
lea rcx, [0x1401bab98]
call fcn.1400e7948
jmp 0x1400e71ea
Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov rdi, rcx
movabs rbp, 0x9e3779b185ebca87
movabs r15, 0x27d4eb2f165667c5
movabs r14, 0xc2b2ae3d27d4eb4f
movabs r12, 0x7a1435883d4d519d
cmp rsi, 0x20
jb 0x14000217b
mov rcx, qword [rcx + 8]
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
mov rax, r8
mov rdx, qword [rdi + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rdx
rol rax, 7
add r10, rax
mov rax, rcx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rcx, r14
imul rdx, r14
imul r8, r14
imul r9, r14
rol rcx, 0x1f
imul rcx, rbp
rol rdx, 0x1f
xor r10, rcx
rol r8, 0x1f
imul r10, rbp
imul rdx, rbp
imul r8, rbp
sub r10, r12
rol r9, 0x1f
xor r10, rdx
imul r10, rbp
imul r9, rbp
sub r10, r12
xor r10, r8
imul r10, rbp
sub r10, r12
xor r10, r9
imul r10, rbp
add rax, r10
add rax, rsi
jmp 0x140002183
lea rax, [rsi + r15]
add rax, qword [rcx + 0x18]
lea rdx, [rdi + 0x30]
cmp rdx, rbx
ja 0x1400021ba
nop dword [rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, r14
add r11, 8
rol rcx, 0x1f
imul rcx, rbp
xor rax, rcx
rol rax, 0x1b
imul rax, rbp
sub rax, r12
cmp rdx, rbx
jbe 0x140002190
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021e5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rbp
xor rax, rcx
rol rax, 0x17
imul rax, r14
add rax, r8
cmp r11, rbx
jae 0x14000220b
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r15
xor rax, rcx
rol rax, 0xb
imul rax, rbp
cmp r11, rbx
jb 0x1400021f0
mov rbx, qword [rsp + 0x20]
mov rcx, rax
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
shr rcx, 0x21
xor rcx, rax
imul rcx, r14
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
pop r12
ret

Function at 0x14000a2e0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
lea edi, [r14 + 0x28]
test al, al
je 0x14000a391
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.14000ffb8
cmp rax, 1
jne 0x14000a3c7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14000a36d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x14000a360
cmp rcx, 1
jb 0x14000a3c7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14000a330
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000bb30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14000fc7c
int3