joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180034fd0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x26695ec767728d84
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035020
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xdf993ee5e90aba25
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035070
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xb128377056a54e2a
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035100
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xad9e8f87ff7c16f
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035150
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xe0a7d1e497ffcd6f
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800351a0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802145b0]
xor r8d, r8d
mov dword [0x1802145a8], r8d
mov dword [0x1802145b8], r8d
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x39ff19c64ef7da5b
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r8d
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035210
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x1454f2448de30163
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035240
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xaa5f02db48d704b9
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x180035270
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xb302540597885499
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800352a0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x8fe22675a5a45817
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035370
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x43c851690662113d
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
vmovss dword [rax + rcx*8], xmm1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035450
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x6b76dc1f3ae6e6a3
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800354d0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x239528eacdc3e7de
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035520
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xf75b0d629e1c063d
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r8d
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035650
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802145b0]
xor r8d, r8d
mov dword [0x1802145a8], r8d
mov dword [0x1802145b8], r8d
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xb3b1cb349ff9c75d
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r8d
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x1800356c0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xb282dc6ebd803c75
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], r9d
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035800
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x299eeb23175895fc
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], 1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035990
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802145b0]
xor edx, edx
mov dword [0x1802145a8], edx
mov dword [0x1802145b8], edx
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
vmovss dword [rax + rcx*8], xmm1
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
vmovss dword [rax + rcx*8], xmm2
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
vmovss dword [rax + rcx*8], xmm3
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
mov ecx, dword [rsp + 0x40]
inc eax
mov dword [0x1802145a8], eax
mov edx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rdx*8], ecx
movabs rdx, 0x6843da7060a026b
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035a80
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xae3cbe5bf394c9c9
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov qword [rax], rcx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180035ab0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1802145b0]
xor edx, edx
mov dword [0x1802145a8], edx
mov dword [0x1802145b8], edx
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xad738c3085fe7e11
inc dword [0x1802145a8]
jmp fcn.180017460
Function at 0x1800374f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, rcx
mov qword [rsp + 0x30], rcx
xor r12d, r12d
lea r10, str.MPPLY_LAST_MP_CHAR
mov r9d, r12d
mov r8b, 0x4d
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
lea r10, [r10 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx r8d, byte [r10]
test r8b, r8b
jne 0x180037540
lea ecx, [r9 + r9*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
lea rdx, [rsp + 0x30]
call fcn.180074e60
mov edx, dword [rsp + 0x30]
lea rcx, [rsp + 0x60]
call fcn.180006f90
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 2
jb 0x18003763c
lea rax, [r8 + 2]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1800375d0
mov rdi, qword [rbx]
lea rax, [0x1801df15a]
mov r15d, 2
lea rsi, [0x1801df158]
cmp rax, rdi
jbe 0x180037604
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x180037604
cmp rdi, rsi
ja 0x1800375fc
mov rbp, r12
jmp 0x180037607
mov rbp, rdi
sub rbp, rsi
jmp 0x180037607
mov rbp, r15
lea rcx, [rdi + 2]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rbp]
sub r15, rbp
lea rdx, [rsi + 2]
add rdx, rbp
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
jmp 0x180037667
mov r15d, 2
mov qword [rsp + 0x28], r15
lea rsi, [0x1801df158]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
mov rcx, rbx
call fcn.180013250
mov rbx, rax
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x50], xmm1
vmovups ymm0, ymmword [rbx]
vmovups ymmword [rsp + 0x40], ymm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov r8d, 1
lea rdx, [0x1801df154]
lea rcx, [rsp + 0x40]
vzeroupper
call fcn.1800085c0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [r14], xmm0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
vmovups ymm0, ymmword [rax]
vmovups ymmword [r14], ymm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x18003771d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180037715
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180037715
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.18016cc9c
vmovdqu xmm0, xmmword [0x1801e4850]
vmovdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0x60]
vzeroupper
call fcn.180006590
mov rax, r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180037770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov ebp, edx
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x48]
call fcn.1800374f0
nop
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0xf
jbe 0x1800377b9
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.1800085c0
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x28], ymm0
vmovups ymmword [rsp + 0x68], ymm0
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x48]
vzeroupper
call fcn.180006590
lea r9, [rsp + 0x68]
vmovups ymm0, ymmword [rsp + 0x28]
vmovq rdi, xmm0
vextractf128 xmm0, ymm0, 1
vpextrq rsi, xmm0, 1
cmp rsi, 0xf
cmova r9, rdi
movzx r8d, byte [r9]
test r8b, r8b
je 0x180037854
nop dword [rax]
movzx edx, r8b
lea r9, [r9 + 1]
sub r8b, 0x41
lea eax, [rdx + 0x20]
movzx ecx, al
cmp r8b, 0x19
cmova ecx, edx
movsx eax, cl
add eax, ebx
imul ebx, eax, 0x401
mov eax, ebx
shr eax, 6
xor ebx, eax
movzx r8d, byte [r9]
test r8b, r8b
jne 0x180037820
lea ecx, [rbx + rbx*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul ecx, ecx, 0x8001
mov edx, ebp
vzeroupper
call fcn.180074de0
nop
cmp rsi, 0xf
jbe 0x1800378a9
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1800378a1
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800378a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.18016cc9c
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180037ec0
Capabilities:
Access peb ldr_data
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.1800355d0
call fcn.180035740
vmovss xmm3, dword [0x1801e472c]
mov edx, eax
lea rcx, [rsp + 0x40]
vxorps xmm2, xmm2, xmm2
call fcn.180074940
call fcn.180035740
vmovss xmm3, dword [0x1801e4814]
mov edx, eax
lea rcx, [rsp + 0x58]
vxorps xmm2, xmm2, xmm2
call fcn.180074940
call fcn.180035740
vmovss xmm2, dword [0x1801e4814]
mov edx, eax
lea rcx, [rsp + 0x70]
vxorps xmm3, xmm3, xmm3
call fcn.180074940
call fcn.180035740
vmovss xmm2, dword [0x1801e472c]
mov edx, eax
lea rcx, [rsp + 0x88]
vxorps xmm3, xmm3, xmm3
call fcn.180074940
vmovss xmm3, dword [rsp + 0x50]
vmovss xmm2, dword [rsp + 0x48]
vmovss xmm1, dword [rsp + 0x40]
mov ecx, 0x5c14edfa
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x20], 0
call fcn.1800372b0
vmovss xmm3, dword [rsp + 0x68]
vmovss xmm2, dword [rsp + 0x60]
vmovss xmm1, dword [rsp + 0x58]
mov ecx, 0x2970a494
mov byte [rsp + 0x28], 0
mov edi, eax
mov byte [rsp + 0x20], 0
call fcn.1800372b0
vmovss xmm3, dword [rsp + 0x80]
vmovss xmm2, dword [rsp + 0x78]
vmovss xmm1, dword [rsp + 0x70]
mov ecx, 0x6e0fb794
mov byte [rsp + 0x28], 0
mov esi, eax
mov byte [rsp + 0x20], 0
call fcn.1800372b0
vmovss xmm3, dword [rsp + 0x98]
vmovss xmm2, dword [rsp + 0x90]
vmovss xmm1, dword [rsp + 0x88]
mov ecx, 0x81441b71
mov byte [rsp + 0x28], 0
mov ebp, eax
mov byte [rsp + 0x20], 0
call fcn.1800372b0
mov rcx, qword gs:[0x20]
mov r14d, eax
mov rbx, qword [rcx]
lea rcx, [rsp + 0xc0]
call fcn.180027590
mov rdx, qword [rax]
add rdx, 0x1e8480
cmp byte [rbx + 0x20], 0
jne 0x18003803a
mov byte [rbx + 0x20], 1
mov qword [rbx + 0x18], rdx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
call fcn.180035740
mov edx, eax
mov ecx, edi
call fcn.1800748a0
call fcn.180035740
mov edx, eax
mov ecx, esi
call fcn.1800748a0
call fcn.180035740
mov edx, eax
mov ecx, ebp
call fcn.1800748a0
call fcn.180035740
mov edx, eax
mov ecx, r14d
call fcn.1800748a0
mov rax, qword gs:[0x20]
lea rcx, [rsp + 0xc0]
mov rbx, qword [rax]
call fcn.180027590
mov rax, qword [rax]
add rax, 0x1e8480
cmp byte [rbx + 0x20], 0
jne 0x1800380ad
mov byte [rbx + 0x20], 1
mov qword [rbx + 0x18], rax
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
lea rdx, str.WORLD_HUMAN_PROSTITUTE_HIGH_CLASS
mov ecx, edi
call fcn.180074810
lea rdx, str.WORLD_HUMAN_PROSTITUTE_HIGH_CLASS
mov ecx, esi
call fcn.180074810
lea rdx, str.WORLD_HUMAN_PROSTITUTE_HIGH_CLASS
mov ecx, ebp
call fcn.180074810
lea rdx, str.WORLD_HUMAN_PROSTITUTE_HIGH_CLASS
mov ecx, r14d
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
jmp fcn.180074810
jmp 0x180037ec0
Function at 0x180038110
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0xd0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
vmovaps xmmword [rax - 0x38], xmm8
vmovaps xmmword [rax - 0x48], xmm9
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovss xmm8, dword [0x1801e46f8]
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, xmm8
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm9, dword [0x1801e4720]
vmovss xmm0, dword [rax + 8]
vsubss xmm6, xmm0, xmm9
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xfdbc763
vaddss xmm1, xmm9, dword [rax]
call fcn.1800752f0
mov ebp, eax
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, xmm8
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm0, dword [rax + 8]
vsubss xmm6, xmm0, xmm9
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xfdbc763
vmovss xmm0, dword [rax]
vsubss xmm1, xmm0, xmm9
call fcn.1800752f0
mov esi, eax
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, xmm8
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vaddss xmm6, xmm9, dword [rax + 8]
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xfdbc763
vmovss xmm0, dword [rax]
vsubss xmm1, xmm0, xmm9
call fcn.1800752f0
mov edi, eax
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.1800355d0
vmovss xmm0, dword [rax + 0x10]
vsubss xmm7, xmm0, xmm8
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1800355d0
vmovss xmm0, dword [rax + 8]
vsubss xmm6, xmm0, xmm9
call fcn.180035740
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.1800355d0
vmovaps xmm3, xmm7
vmovaps xmm2, xmm6
mov ecx, 0xfdbc763
vmovss xmm0, dword [rax]
vsubss xmm1, xmm0, xmm9
call fcn.1800752f0
vmovss xmm3, dword [0x1801e478c]
vxorps xmm1, xmm1, xmm1
mov ecx, ebp
mov dword [rsp + 0x28], 1
mov ebx, eax
mov dword [rsp + 0x20], 0
call fcn.180034b80
vmovss xmm3, dword [0x1801e478c]
vxorps xmm1, xmm1, xmm1
mov ecx, esi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call fcn.180034b80
mov ecx, ebp
call fcn.180033100
mov ecx, esi
call fcn.180033100
mov ecx, edi
call fcn.180033100
mov ecx, ebx
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop rdi
jmp fcn.180033100
jmp 0x180038110
Function at 0x1800398d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov word [rbp - 0x1c], 0x48
mov dword [rbp - 0x29], 0x5f305053
mov dword [rbp - 0x25], 0x41544f54
mov dword [rbp - 0x21], 0x41435f4c
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x1a], 0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x19], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x29]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180039940
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.180006350
nop
mov word [rbp - 0x1c], 0x48
mov dword [rbp - 0x29], 0x5f315053
mov dword [rbp - 0x25], 0x41544f54
mov dword [rbp - 0x21], 0x41435f4c
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x1a], 0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 7], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x29]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x180039994
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 7]
call fcn.180006350
nop
mov word [rbp - 0x1c], 0x48
mov dword [rbp - 0x29], 0x5f325053
mov dword [rbp - 0x25], 0x41544f54
mov dword [rbp - 0x21], 0x41435f4c
mov byte [rbp - 0x1d], 0x53
mov byte [rbp - 0x1a], 0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x27], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x29]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800399e5
mov r8, rbx
lea rdx, [rbp - 0x29]
lea rcx, [rbp + 0x27]
call fcn.180006350
nop
lea rax, [rbp - 0x19]
mov qword [rbp - 0x29], rax
lea rax, [rbp + 0x47]
mov qword [rbp - 0x21], rax
vmovups xmm0, xmmword [rbp - 0x29]
vmovdqa xmmword [rbp - 0x29], xmm0
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.18005ac10
nop
lea r9, [fcn.1800065f0]
mov edx, 0x20
mov r8d, 3
lea rcx, [rbp - 0x19]
call fcn.18016d050
mov rdi, qword [rbp - 0x41]
mov rbx, qword [rbp - 0x49]
cmp rbx, rdi
je 0x180039a66
nop
mov edx, 0x7fffffff
mov rcx, rbx
call fcn.180037770
add rbx, 0x20
cmp rbx, rdi
jne 0x180039a50
lea rcx, [rbp - 0x49]
call fcn.180074650
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
jmp 0x1800398d0
Function at 0x180039a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x3c], 0x454d49
vmovdqu xmm0, xmmword [0x1801e4ed0]
vmovdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x545f4c4c
mov byte [rbp - 0x38], 0
lea rcx, [rbp - 0x50]
call fcn.180035590
mov ecx, eax
xor edx, edx
call fcn.180074de0
mov word [rbp - 0x3b], 0x48
vmovdqu xmm0, xmmword [0x1801e50d0]
vmovdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x565f474e
mov byte [rbp - 0x3c], 0x45
mov byte [rbp - 0x39], 0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x30], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180039b20
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call fcn.180006350
nop
mov edx, 0xc350
lea rcx, [rbp - 0x30]
call fcn.180037770
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x180039b85
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039b80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180039b80
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18016cc9c
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x70
pop rbp
ret
jmp 0x180039a90