joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010e10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800ed0f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180010ee3
cmp byte [rcx + 0x71], 0
je 0x180010ee3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180010edf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180010ea4
sub eax, 1
je 0x180010ea8
cmp eax, 2
jne 0x180010edf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b2170
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180010ed6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x180010edf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180010e8c
xor al, al
jmp 0x180010e8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b2170
add rsp, 0x60
pop rbx
ret

Function at 0x180014520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ed0f8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1800b21c4
mov rdx, qword [rbx]
mov qword [rax], rdx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800150c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x180014599
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b2170
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1800145b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ed0f8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x10
call fcn.1800b21c4
mov r8, qword [rbx]
mov qword [rax], r8
mov qword [rax + 8], rdi
mov qword [rsp + 0x30], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180015150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18001463a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b2170
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180035f60
Capabilities:
Hash data using murmur3

Disassembly:
and r8d, 0xf
mov r9, rdx
cmp r8, 4
jb 0x180035efe
mov r10d, r8d
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
nop dword [rax + rax]
mov eax, dword [r9]
add r9, 4
imul edx, eax, 0x3d4d51c3
sub ecx, edx
rol ecx, 0x11
imul ecx, ecx, 0x27d4eb2f
sub r10, 1
jne 0x180035ee0
test r8, r8
je 0x180035f2f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
imul edx, eax, 0x165667b1
add ecx, edx
rol ecx, 0xb
imul ecx, ecx, 0x9e3779b1
sub r8, 1
jne 0x180035f10
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul ecx, eax, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
sub rsp, 0x28
mov r11, rdx
mov rdx, rcx
cmp r11, 0x10
jb 0x180036017
mov qword [rsp + 0x20], rbx
mov eax, 0x61c88679
lea rbx, [rcx - 0xf]
mov r8d, 0x24234452
add rbx, r11
mov r9d, 0x85ebcaa1
mov r10d, 0x2a
nop word [rax + rax]
imul ecx, dword [rdx], 0x7a143589
sub r8d, ecx
imul ecx, dword [rdx + 4], 0x7a143589
rol r8d, 0xd
imul r8d, r8d, 0x9e3779b1
sub r9d, ecx
imul ecx, dword [rdx + 8], 0x7a143589
rol r9d, 0xd
imul r9d, r9d, 0x9e3779b1
sub r10d, ecx
imul ecx, dword [rdx + 0xc], 0x7a143589
rol r10d, 0xd
add rdx, 0x10
imul r10d, r10d, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp rdx, rbx
jb 0x180035fa0
mov rbx, qword [rsp + 0x20]
rol eax, 0x12
rol r10d, 0xc
add eax, r10d
rol r9d, 7
add eax, r9d
rol r8d, 1
add eax, r8d
jmp 0x18003601c
mov eax, 0x165667db
mov r8, r11
lea ecx, [rax + r11]
and r8d, 0xf
add rsp, 0x28
jmp 0x180035ec0

Function at 0x180036460
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov r9, qword [rcx + 0x18]
cmp rbx, 0x20
jb 0x18003653d
mov rdx, qword [rcx + 8]
mov r11, r9
mov r8, qword [rcx + 0x10]
mov rax, rdx
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r9, rdi
imul r8, rdi
imul r10, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r9, 0x1f
xor r11, rdx
rol r8, 0x1f
imul r11, rsi
imul r9, rsi
imul r8, rsi
sub r11, rax
rol r10, 0x1f
imul r10, rsi
xor r11, r8
imul r11, rsi
sub r11, rax
xor r11, r9
movabs r9, 0x85ebca77c2b2ae63
imul r11, rsi
sub r11, rax
xor r11, r10
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r9, r11
jmp 0x18003654a
movabs rdx, 0x27d4eb2f165667c5
add r9, rdx
add r9, rbx
lea rdx, [rcx + 0x28]
mov rcx, r9
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.180036030
Function at 0x1800a1c30
Capabilities:
Hash data using fnv

Disassembly:
push rbx
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1800a1ce2
mov r10d, dword [rdx]
mov r11d, dword [rbx + 0x18]
mov edx, r10d
mov r8d, r10d
shr edx, 0x18
mov ecx, r10d
shr r8d, 0x10
shr ecx, 8
cmp r10d, r11d
je 0x1800a1ce2
mov r9, qword [rbx + 8]
mov rbx, qword [rbx]
dec r9
movzx ecx, cl
mov qword [rsp + 0x10], rdi
movabs rdi, 0xcbf29ce484222325
movzx eax, r10b
xor rax, rdi
movabs rdi, 0x100000001b3
imul rax, rdi
xor rax, rcx
movzx ecx, r8b
imul rax, rdi
xor rax, rcx
mov ecx, edx
imul rax, rdi
xor rax, rcx
imul rax, rdi
mov rdi, qword [rsp + 0x10]
and rax, r9
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
cmp edx, r10d
je 0x1800a1ce6
cmp edx, r11d
je 0x1800a1ce2
inc rax
add rax, rcx
inc rcx
and rax, r9
cmp rcx, r9
jbe 0x1800a1cc0
xor eax, eax
pop rbx
ret
mov rax, r8
pop rbx
ret

Function at 0x1800a1f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov rdi, rcx
je 0x1800a2027
mov r12d, dword [rdx + 0x80]
lea rax, [rcx + 0x18]
mov ecx, dword [rax + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], ecx
cmp r12d, ecx
jne 0x1800a1f7f
lea r8, [r12*4]
mov rdx, rax
mov rcx, r13
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2027
mov r15, qword [rdi + 8]
xor ebp, ebp
dec r15
mov eax, 0x811c9dc5
mov ecx, ebp
test r12, r12
je 0x1800a1fb3
nop dword [rax]
nop dword [rax + rax]
xor eax, dword [r13 + rcx*4]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, r12
jb 0x1800a1fa0
mov ebx, eax
mov rax, qword [rdi]
and rbx, r15
mov qword [rsp + 0x78], rax
imul rsi, rbx, 0x88
add rsi, rax
mov r14d, dword [rsi + 0x80]
mov edi, r14d
shl rdi, 2
cmp r14d, r12d
jne 0x1800a1fef
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2022
cmp r14d, dword [rsp + 0x60]
jne 0x1800a200a
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rsi
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2027
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
ja 0x1800a2027
mov rax, qword [rsp + 0x78]
jmp 0x1800a1fc0
mov rax, rsi
jmp 0x1800a2029
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800a21f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov r9, qword [rcx]
mov r8, rax
test rax, rax
je 0x1800a221c
nop
movzx edx, byte [r9 + r8 - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub r8, 1
jne 0x1800a2200
ret
Function at 0x1800a2220
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 8]
mov rsi, rcx
movzx eax, byte [rdx]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
dec r10
mov rbx, qword [rsi]
movzx ecx, byte [r11 + 2]
movzx r8d, byte [r11 + 1]
mov edi, dword [rsi + 0x18]
imul rax, rdx
xor rax, r8
imul rax, rdx
xor rax, rcx
movzx ecx, byte [r11 + 3]
imul rax, rdx
xor rax, rcx
imul rax, rdx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
mov r9d, dword [r11]
cmp edx, edi
je 0x1800a22c6
cmp edx, r9d
je 0x1800a22cd
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1800a2290
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [r8], r9d
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 8]
mov rax, r8
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800a24c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [rcx + 8]
xor ebp, ebp
mov r13d, dword [rdx + 0x80]
dec r12
mov r14, rdx
mov eax, 0x811c9dc5
mov r8d, ebp
test r13, r13
je 0x1800a2512
nop dword [rax]
xor eax, dword [rdx + r8*4]
inc r8
imul eax, eax, 0x1000193
cmp r8, r13
jb 0x1800a2500
mov edi, eax
mov rax, qword [rcx]
and rdi, r12
add rcx, 0x18
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
imul rbx, rdi, 0x88
add rbx, rax
mov r15d, dword [rbx + 0x80]
mov esi, r15d
shl rsi, 2
cmp r15d, dword [rcx + 0x80]
jne 0x1800a2563
mov rdx, rcx
mov r8, rsi
mov rcx, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2597
cmp r15d, r13d
jne 0x1800a257a
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a25f3
inc rdi
add rdi, rbp
inc rbp
and rdi, r12
cmp rbp, r12
ja 0x1800a25f8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
jmp 0x1800a2530
movups xmm0, xmmword [r14]
mov rax, qword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r14 + 0x60]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r14 + 0x70]
movups xmmword [rbx + 0x70], xmm1
mov ecx, dword [r14 + 0x80]
mov dword [rbx + 0x80], ecx
inc qword [rax + 0x10]
mov rax, rbx
jmp 0x1800a25fa
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a27e0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x40], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x38], rdi
mov edi, dword [rcx + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
lea r15, [rcx + 0x18]
mov r14, r15
test rsi, rsi
jne 0x1800a282e
mov esi, 0x10
lea ecx, [rsi + 0x70]
call fcn.1800b21c4
mov r11, rax
xor ecx, ecx
mov ebp, esi
jmp 0x1800a2860
xor r11d, r11d
xor ebp, ebp
add rsi, rsi
je 0x1800a2877
lea rcx, [rsi*8]
call fcn.1800b21c4
xor ecx, ecx
mov r11, rax
mov rbp, rsi
test rsi, rsi
je 0x1800a2877
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14]
mov dword [r11 + rcx*8], eax
xor eax, eax
mov word [r11 + rcx*8 + 4], ax
inc rcx
cmp rcx, rsi
jb 0x1800a2860
xor esi, esi
cmp qword [rbx + 8], rsi
jbe 0x1800a2941
mov qword [rsp + 0x30], r12
movabs r14, 0x100000001b3
movabs r12, 0xcbf29ce484222325
nop dword [rax]
mov rax, qword [rbx]
mov r9d, dword [rax + rsi*8]
mov edx, r9d
mov r8d, r9d
mov ecx, r9d
shr edx, 0x18
shr r8d, 0x10
shr ecx, 8
cmp r9d, dword [r15]
je 0x1800a292f
movzx ecx, cl
lea r10, [rbp - 1]
movzx eax, r9b
xor rax, r12
imul rax, r14
xor rax, rcx
movzx ecx, r8b
imul rax, r14
xor rax, rcx
mov ecx, edx
imul rax, r14
xor rax, rcx
imul rax, r14
and rax, r10
xor ecx, ecx
mov r8d, dword [r11 + rax*8]
lea rdx, [r11 + rax*8]
cmp r8d, edi
je 0x1800a2918
cmp r8d, r9d
je 0x1800a291b
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1800a28f1
xor edx, edx
jmp 0x1800a291b
mov dword [rdx], r9d
mov rax, qword [rbx]
lea rcx, [rax + rsi*8]
mov eax, dword [rax + rsi*8]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
inc rsi
cmp rsi, qword [rbx + 8]
jb 0x1800a28a0
mov r12, qword [rsp + 0x30]
mov rcx, qword [rbx]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 8], rbp
mov rbp, qword [rsp + 0x60]
mov qword [rbx], r11
mov rbx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800a2977
add rsp, 0x48
jmp fcn.1800b2200
add rsp, 0x48
ret
Function at 0x1800afd50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1800ed0f8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x1800eeca0]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800afd98
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1800afd8c
mov rax, qword [rax + 0x10]
jmp 0x1800afd92
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800afd80
cmp byte [rcx + 0x19], 0
jne 0x1800afe74
cmp dword [rcx + 0x20], 4
jg 0x1800afe74
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1800afdc1
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800afdf3
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x1800afde0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800af7a0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800afe2e
cmp rcx, qword [rbx + 8]
je 0x1800afe2e
cmp qword [rbx + 0x10], 1
jne 0x1800afe32
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800b2170
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x1800afe18
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1800afea0
nop
mov r8, rax
lea rdx, [0x1800cd150]
lea rcx, [rsp + 0x58]
call fcn.180011930
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800afcf0
lea rdx, [0x1800e94a0]
lea rcx, [rsp + 0x20]
call sub.vcruntime140.dll__CxxThrowException
nop
lea rcx, [0x1800cd1c0]
call sub.msvcp140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3

Function at 0x1800b56e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r9d, 0x811c9dc5
test rdx, rdx
je 0x1800b5707
nop dword [rax]
movzx r8d, byte [rax + rcx]
inc rax
xor r8d, r9d
imul r9d, r8d, 0x1000193
cmp rax, rdx
jb 0x1800b56f0
mov eax, r9d
ret
Function at 0x1800b58b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov r12, rcx
lea rax, [0x1800d434b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx + 0x18], xmm0
mov ecx, 0x800
call fcn.1800b21c4
mov rdx, rax
mov qword [r12], rax
mov qword [r12 + 8], 0x80
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
lea r8, [rax + 0x10]
mov r9d, 0x3f
mov rcx, qword [rdx]
mov qword [r8], rcx
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [r8 + 0x10], rax
lea r8, [r8 + 0x20]
mov rax, qword [rdx + 0x18]
mov qword [r8 - 8], rax
lea rdx, [rdx + 0x20]
sub r9, 1
jne 0x1800b5930
mov rax, qword [rdx]
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov qword [r12 + 0x30], rbx
mov eax, 0x121
mov dword [rsp + 0x78], eax
lea rcx, [0x1800ed160]
mov qword [rsp + 0x80], rcx
nop word [rax + rax]
mov r15, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [r15 + rdi], 0
jne 0x1800b59a0
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], eax
mov r13, qword [r12 + 8]
mov rcx, qword [r12 + 0x10]
lea rax, [r13*2]
add rax, r13
shr rax, 2
cmp rcx, rax
jb 0x1800b5a8a
test rcx, rcx
je 0x1800b5a82
cmp edi, dword [r12 + 0x20]
jne 0x1800b59fc
mov r8d, edi
mov rdx, qword [r12 + 0x18]
mov rcx, r15
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5a82
dec r13
mov edx, 0x811c9dc5
mov r8d, edi
xor ecx, ecx
test edi, edi
je 0x1800b5a25
nop dword [rax]
movzx eax, byte [rcx + r15]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r8
jb 0x1800b5a10
mov esi, edx
and rsi, r13
xor ebp, ebp
nop dword [rax]
mov rbx, rsi
shl rbx, 4
add rbx, qword [r12]
mov r14d, dword [rbx + 8]
cmp r14d, edi
jne 0x1800b5a56
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5a8a
cmp r14d, dword [r12 + 0x20]
jne 0x1800b5a71
mov r8, r14
mov rdx, qword [r12 + 0x18]
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5a82
inc rsi
add rsi, rbp
and rsi, r13
inc rbp
cmp rbp, r13
jbe 0x1800b5a30
mov rcx, r12
call fcn.1800b7e20
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1800b65e0
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x80]
add rcx, 8
mov qword [rsp + 0x80], rcx
cmp eax, 0x137
jl 0x1800b5990
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800b5cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov r12, rcx
je 0x1800b5d92
mov r15d, dword [rdx + 8]
cmp r15d, dword [rcx + 0x20]
jne 0x1800b5cff
mov rdx, qword [rcx + 0x18]
mov r8d, r15d
mov rcx, qword [r13]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5d92
mov r14, qword [r12 + 8]
xor esi, esi
dec r14
mov edx, 0x811c9dc5
mov ecx, esi
test r15, r15
je 0x1800b5d35
mov r8, qword [r13]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r15
jb 0x1800b5d20
mov edi, edx
and rdi, r14
nop word [rax + rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, r15d
jne 0x1800b5d66
mov rdx, qword [r13]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5db1
cmp ebp, dword [r12 + 0x20]
jne 0x1800b5d81
mov rdx, qword [r12 + 0x18]
mov r8, rbp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b5d92
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x1800b5d40
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, rbx
jmp 0x1800b5d94

Function at 0x1800b65e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 8]
xor esi, esi
mov r15d, dword [rdx + 8]
dec r14
mov r13, rdx
mov r12, rcx
mov r9d, 0x811c9dc5
mov r8d, esi
test r15, r15
je 0x1800b6637
mov r10, qword [rdx]
movzx eax, byte [r10 + r8]
inc r8
xor eax, r9d
imul r9d, eax, 0x1000193
cmp r8, r15
jb 0x1800b6620
mov edi, r9d
and rdi, r14
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, qword [r12]
mov ebp, dword [rbx + 8]
cmp ebp, dword [r12 + 0x20]
jne 0x1800b6669
mov rdx, qword [r12 + 0x18]
mov r8d, ebp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b66b1
cmp ebp, r15d
jne 0x1800b6681
mov rdx, qword [r13]
mov r8, rbp
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b66be
inc rdi
add rdi, rsi
inc rsi
and rdi, r14
cmp rsi, r14
jbe 0x1800b6640
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movups xmm0, xmmword [r13]
movups xmmword [rbx], xmm0
inc qword [r12 + 0x10]
mov rax, rbx
jmp 0x1800b6694
Function at 0x1800b7e20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
sub rsp, 0x98
movups xmm0, xmmword [rcx + 0x18]
mov qword [rax - 8], rbx
mov rbx, qword [rcx + 8]
mov qword [rax - 0x10], rbp
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x30], r13
mov r13, rcx
mov qword [rax - 0x40], r15
lea r15, [rcx + 0x18]
mov rdi, r15
movups xmmword [rax - 0x60], xmm0
test rbx, rbx
jne 0x1800b7e83
mov ecx, 0x100
mov ebx, 0x10
call fcn.1800b21c4
mov rsi, rax
mov qword [rsp + 0xa0], rax
mov ebp, ebx
mov qword [rsp + 0xa8], rbx
jmp 0x1800b7ec3
xor esi, esi
xor ebp, ebp
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rbp
add rbx, rbx
je 0x1800b7ee1
mov rcx, rbx
shl rcx, 4
call fcn.1800b21c4
mov qword [rsp + 0xa0], rax
mov rsi, rax
mov qword [rsp + 0xa8], rbx
mov rbp, rbx
test rbx, rbx
je 0x1800b7ee1
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 0x10]
movups xmm0, xmmword [rdi]
movups xmmword [rax - 0x10], xmm0
sub rbx, 1
jne 0x1800b7ed0
cmp qword [r13 + 8], 0
mov qword [rsp + 0xb8], 0
jbe 0x1800b803a
xor ecx, ecx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0x60], r14
nop dword [rax]
mov r12, qword [r13]
add r12, rcx
mov r14d, dword [r12 + 8]
cmp r14d, dword [r15 + 8]
jne 0x1800b7f39
mov rdx, qword [r15]
mov r8d, r14d
mov rcx, qword [r12]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b7fef
xor ecx, ecx
lea r15, [rbp - 1]
mov edx, 0x811c9dc5
test r14, r14
je 0x1800b7f65
mov r8, qword [r12]
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r14
jb 0x1800b7f50
mov edi, edx
and rdi, r15
xor ebp, ebp
nop dword [rax]
mov rbx, rdi
shl rbx, 4
add rbx, rsi
mov esi, dword [rbx + 8]
cmp esi, dword [rsp + 0x40]
jne 0x1800b7f97
mov rdx, qword [rsp + 0x38]
mov r8d, esi
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b7fca
cmp esi, r14d
jne 0x1800b7faf
mov rdx, qword [r12]
mov r8, rsi
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b7fd6
inc rdi
add rdi, rbp
inc rbp
and rdi, r15
cmp rbp, r15
ja 0x1800b7fd4
mov rsi, qword [rsp + 0xa0]
jmp 0x1800b7f70
movups xmm0, xmmword [r12]
movups xmmword [rbx], xmm0
jmp 0x1800b7fd6
xor ebx, ebx
mov rax, qword [r13]
lea r15, [r13 + 0x18]
mov rcx, qword [rsp + 0xb0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rbx], xmm0
jmp 0x1800b7ff7
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xb8]
add rcx, 0x10
mov rsi, qword [rsp + 0xa0]
inc rdx
mov rbp, qword [rsp + 0xa8]
mov qword [rsp + 0xb8], rdx
mov qword [rsp + 0xb0], rcx
cmp rdx, qword [r13 + 8]
jb 0x1800b7f10
mov r14, qword [rsp + 0x60]
mov r12, qword [rsp + 0x70]
mov rcx, qword [r13]
mov rax, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov qword [r13], rsi
mov rsi, qword [rsp + 0x80]
mov qword [r13 + 8], rax
mov r13, qword [rsp + 0x68]
test rcx, rcx
je 0x1800b807f
call fcn.1800b2200
add rsp, 0x98
ret