joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400100b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400100e7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140010108
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001010a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140010163
test ecx, ecx
jle 0x140010143
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140010163
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140010163
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140027b40
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movzx ecx, word [rbx]
mov esi, 1
mov rdi, rax
mov word [rsp + 0x20], si
xor eax, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x28], esi
mov word [rsp + 0x2c], ax
mov dword [rsp + 0x30], eax
test cx, cx
je 0x140027bb8
nop word [rax + rax]
mov word [rsp + 0x2e], cx
lea r9, [rsp + 0x50]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
movzx ecx, word [rbx + 2]
lea rbx, [rbx + 2]
test cx, cx
jne 0x140027b90
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400303c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x38
mov r9, qword [rcx + 8]
xorps xmm0, xmm0
mov r8, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x10]
movdqu xmmword [rsp + 0x20], xmm0
mov rax, qword [r9 + 8]
test rax, rax
je 0x1400303e6
lock inc dword [rax + 8]
mov rax, qword [r9]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rax, qword [r9 + 8]
mov qword [rsp + 0x28], rax
call fcn.140043020
test al, al
je 0x14003040e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x38
ret
Function at 0x140054580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
xor edx, edx
mov r8d, 0x400
movzx ebp, r9b
mov r14, rcx
call sub.VCRUNTIME140.dll_memset
lea r15d, [rbx - 1]
xor r12d, r12d
mov ecx, r15d
mov r13d, 1
mov edi, r13d
movzx r11d, r12w
shl rdi, cl
mov ecx, 0x20
sub ecx, ebx
mov ebx, 0xffffffff
shr ebx, cl
mov ecx, 0x80
nop dword [rax]
nop word [rax + rax]
mov edx, r12d
movzx r9d, r11w
movzx eax, r13w
nop dword [rax + rax]
movzx r10d, cx
or r10w, ax
movzx r8d, r10w
and r8w, r9w
cmp r8w, cx
je 0x14005461c
cmp r8w, ax
jne 0x140054620
xor r9w, r10w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140054600
mov r8d, 8
test r13b, r9b
mov eax, r12d
mov ecx, r12d
cmovne eax, edi
xor edx, eax
test edx, edi
cmovne ecx, esi
shr r9w, 1
lea eax, [rdx + rdx]
mov edx, ecx
xor edx, eax
sub r8d, r13d
jne 0x140054631
and edx, ebx
test bpl, bpl
je 0x1400546cd
mov ecx, r15d
mov eax, r13d
shl eax, cl
mov r8d, r13d
cmp eax, r13d
jbe 0x140054691
nop dword [rax + rax]
mov r9d, eax
or r9d, r8d
mov ecx, r9d
and ecx, edx
cmp ecx, eax
je 0x140054684
cmp ecx, r8d
jne 0x140054687
xor edx, r9d
shr eax, 1
add r8d, r8d
cmp eax, r8d
ja 0x140054670
movzx r10d, r11w
movzx eax, r13w
mov ecx, 0x80
nop
movzx r9d, cx
or r9w, ax
movzx r8d, r9w
and r8w, r10w
cmp r8w, cx
je 0x1400546bc
cmp r8w, ax
jne 0x1400546c0
xor r10w, r9w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x1400546a0
jmp 0x1400546d1
movzx r10d, r11w
movzx eax, r10w
inc r11w
mov dword [r14 + rax*4], edx
mov eax, 0x100
lea ecx, [rax - 0x80]
cmp r11w, ax
jb 0x1400545f0
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c8990
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x1400c8a4e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1400c8a50
cmp rax, rdx
je 0x1400c8a4e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400c8a31
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
Function at 0x1400ce9f0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x50
mov rdi, qword [rcx + 0x40]
mov rbp, rcx
test rdi, rdi
je 0x1400cebe6
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
lea rsi, [rdi - 1]
mov qword [rcx + 0x40], rsi
nop
xor ebx, ebx
xor eax, eax
test rsi, rsi
je 0x1400cea62
lea rcx, [0x14023e010]
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400cebde
lea rdx, [rsp + 0x78]
lea ecx, [rbx + 8]
call fcn.14014dfa0
mov rbx, qword [rsp + 0x78]
lea rcx, [0x14023e010]
call sub.MSVCP140.dll__Mtx_unlock
mov rax, 0xffffffffffffffff
xor edx, edx
div rdi
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rbx
div rdi
cmp rax, rcx
jb 0x1400cea7f
cmp r8, rsi
jne 0x1400cea20
xor edx, edx
mov qword [rsp + 0x40], r15
mov rax, rbx
lea r8, [rbp + 0x40]
div rdi
mov rcx, rbp
mov rbx, rdx
mov qword [rsp + 0x70], rdx
lea rdx, [rsp + 0x78]
call fcn.1400c8990
mov rsi, qword [rbp + 8]
mov rcx, rbx
mov rax, qword [rsp + 0x78]
mov r8, rbx
mov r9, rbx
shr rcx, 0x10
mov r10, rbx
shr r8, 0x18
mov r11, rbx
shr r9, 0x20
shr r10, 0x28
mov rdi, rbx
shr r11, 0x30
cmp rax, rsi
je 0x1400ceadf
mov r14, qword [rax + 0x18]
jmp 0x1400ceae3
mov r14, qword [rbp + 0x40]
movabs r15, 0xcbf29ce484222325
movzx edx, bl
xor rdx, r15
shr rdi, 0x38
movabs r15, 0x100000001b3
mov rax, rbx
imul rdx, r15
shr rax, 8
movzx eax, al
xor rdx, rax
movzx eax, cl
mov rcx, qword [rbp + 0x30]
imul rdx, r15
xor rdx, rax
movzx eax, r8b
imul rdx, r15
xor rdx, rax
movzx eax, r9b
imul rdx, r15
xor rdx, rax
movzx eax, r10b
imul rdx, r15
xor rdx, rax
movzx eax, r11b
imul rdx, r15
xor rdx, rax
imul rdx, r15
xor rdx, rdi
imul rdx, r15
mov r15, qword [rsp + 0x40]
and rcx, rdx
shl rcx, 4
add rcx, qword [rbp + 0x18]
mov rax, qword [rcx + 8]
cmp rax, rsi
je 0x1400cebaa
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1400ceb8f
nop dword [rax]
cmp rax, rcx
je 0x1400cebaa
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400ceb80
test rax, rax
cmove rax, rsi
cmp rax, rsi
je 0x1400cebaa
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x70], rcx
mov qword [rax + 0x18], r14
jmp 0x1400cebc3
lea r8, [rsp + 0x70]
mov rcx, rbp
lea rdx, [rsp + 0x20]
call fcn.1400c4ce0
mov rcx, qword [rax]
mov qword [rcx + 0x18], r14
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop rdi
pop rbp
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
lea rdx, str.shuffle_sequence_ended
lea rcx, [rsp + 0x20]
call fcn.1400101d0
lea rdx, [0x140227e18]
lea rcx, [rsp + 0x20]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400cec10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1400cee26
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x1400cecd4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400cec90
mov ecx, dword [r10]
jmp 0x1400cedb7
cmp ecx, 0x4e0
jb 0x1400cedb7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400cecf0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400ced40
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x1400cec70
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x1400cec60
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400cee4a
cmp r8, r14
jne 0x1400cec40
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400d06f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
movzx eax, byte [rdx]
cmp byte [rcx + 0x10], al
jne 0x1400d0764
cmp qword [r8 + 0x18], 0x10
mov r11, qword [rcx + 8]
mov rcx, r8
mov r10, qword [r8 + 0x10]
jb 0x1400d0711
mov rcx, qword [r8]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1400d0749
mov qword [rsp + 0x30], rbx
movabs rbx, 0x100000001b3
movzx eax, byte [rdx + rcx]
inc rdx
xor r9, rax
imul r9, rbx
cmp rdx, r10
jb 0x1400d0731
mov rbx, qword [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, r11
call fcn.140052e40
cmp qword [rax + 8], 0
jne 0x1400d0764
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x1400d13a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400d1583
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400bab80
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400d1548
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400d14bc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400d1537
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1400d14f9
mov r10, qword [rax]
cmp r10, rcx
je 0x1400d14f3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400d1537
mov r8, rax
cmp r10, rax
je 0x1400d1513
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x1400d155d
cmp r10, rax
jne 0x1400d1501
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400d1440
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400d1537
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400d2360
Capabilities:
Hash data using fnv

Disassembly:
mov rdx, qword [rcx + 0x10]
mov r9, rcx
add rdx, 1
mov r8, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1400d237b
cvtsi2ss xmm0, rdx
jmp 0x1400d2390
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
xor ecx, ecx
xorps xmm1, xmm1
roundss xmm1, xmm0, 2
movss xmm0, dword [0x1401dd484]
comiss xmm1, xmm0
jb 0x1400d23c2
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x1400d23c2
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp r8, rcx
jae 0x1400d23f4
cmp r8, 0x200
jae 0x1400d23f1
lea r8, [r8*8]
cmp r8, rcx
jae 0x1400d23f4
mov r8, rcx
mov rdx, r8
mov rcx, r9
jmp fcn.1400d13a0
Function at 0x1400e2a80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
sub rsp, 0x1a0
mov rbx, rdx
mov rdi, rcx
add rcx, 0xffffffffffffffe0
call fcn.1400ec050
lea rcx, [rdi - 0x20]
call fcn.1400ec0f0
lea rbp, [rdi + 0x1f8]
lea rax, [rbp + 0x60]
mov ecx, 0x78
test rbp, rbp
cmove rax, rcx
cmp qword [rax], rbx
jbe 0x1400e2c09
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x1c9]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1ca]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1cb]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1cc]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1cd]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1ce]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x1cf]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x2a8]
and rcx, rdx
shl rcx, 4
add rcx, qword [rdi + 0x290]
mov rax, qword [rcx + 8]
mov rdx, qword [rdi + 0x280]
cmp rax, rdx
je 0x1400e2ba2
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1400e2b90
cmp rax, rcx
je 0x1400e2ba2
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400e2b81
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400e2ba2
movzx eax, byte [rax + 0x18]
jmp 0x1400e2bf6
mov rax, qword [rdi + 0x250]
mov r8, qword [rax + rbx*8]
lea rdx, [r8 - 0xc8]
xor eax, eax
test r8, r8
cmove rdx, rax
lea rcx, [rdi - 0x20]
call fcn.1400e25e0
mov byte [rsp + 0x1c0], al
lea r9, [rsp + 0x1c0]
lea r8, [rsp + 0x1c8]
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x278]
call fcn.1400c7f40
movzx eax, byte [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1a0
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rdi + 0x20]
lea r9, [0x1402307c0]
mov r8d, 1
lea rdx, [rsp + 0x68]
call fcn.140173ea0
nop
lea rdx, str.Failed_to_check_transaction:_invalid_index
mov rcx, rax
call fcn.140052400
mov rcx, rax
lea rdx, [rsp + 0x1c8]
call fcn.1400524b0
mov rcx, rax
lea rdx, str.._Number_of_transactions:
call fcn.140052400
mov rbx, rax
mov rcx, rbp
call fcn.1400eb7d0
mov qword [rsp + 0x1c8], rax
lea rdx, [rsp + 0x1c8]
mov rcx, rbx
call fcn.1400524b0
nop
lea rcx, [rsp + 0x68]
call fcn.1400bab50
mov edx, socket
lea rcx, [rsp + 0x30]
call fcn.1400bcf40
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140025280
lea rdx, [0x140227e50]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14010eb00
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x30]
mov qword [rsp + 0xc0], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14010ecac
cmp dword [rsi + 0x2c], eax
je 0x14010eb71
mov dword [rsp + 0x30], 2
lea rax, [0x14022fcf0]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14010ec96
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + 0x10]
jmp 0x14010ec7a
mov dword [rsi + 0x2c], 1
mov rcx, rsi
call fcn.14010f220
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
xor r14d, r14d
mov qword [rsp + 0x80], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x14010ebb8
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
mov ecx, 0x48
call fcn.14018967c
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x14010ec05
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0xd8], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010ec03
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x14010ec08
mov rdi, r14
mov qword [rsp + 0xd0], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x1400fe2c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14010ec9c
cmp dword [rsi + 0xd0], 0
jne 0x14010ec8f
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010ec7a
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp sub.MSVCP140.dll__Mtx_unlock
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x14014c080
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
pslldq xmm2, 4
pxor xmm1, xmm0
movdqa xmm4, xmm2
pxor xmm4, xmm1
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x14014e3b0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, 0xc8
jmp fcn.14014e0b0