joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800090d0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
xorps xmm0, xmm0
mov dword [rbp + 7], 0xed98fc8e
movups xmmword [rbp + 0x15], xmm0
mov dword [rbp + 0xb], 0x89ee8689
movabs r9, 0x2bde344e40445033
mov dword [rbp + 0xf], 0xe3f7affd
mov word [rbp + 0x13], 0x25f5
mov qword [rbp + 0x67], 0
mov rax, qword [rbp + 0x67]
nop word [rax + rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
add rcx, r9
movzx edx, byte [rbp + rax + 7]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x67]
add r8, rcx
add r8, rdx
sub r8b, 0x65
mov byte [rbp + rax + 7], r8b
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x1e
jb 0x180009120
lea rcx, [rbp + 7]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1800092a1
xor eax, eax
mov dword [rbp + 0x27], 0x49444847
mov qword [rbp + 0x3a], rax
movabs r9, 0x5106d428b74061e6
mov dword [rbp + 0x42], eax
mov word [rbp + 0x46], ax
mov byte [rbp + 0x48], al
mov dword [rbp + 0x2b], 0x912d4459
mov dword [rbp + 0x2f], 0x5f5b5678
mov dword [rbp + 0x33], 0x5b8c4f5d
mov word [rbp + 0x37], 0x4140
mov byte [rbp + 0x39], 0xb2
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
nop dword [rax]
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
add rcx, r9
movzx edx, byte [rbp + rax + 0x27]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x67]
add r8, rcx
add r8, rdx
sub r8b, 0x4a
mov byte [rbp + rax + 0x27], r8b
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x22
jb 0x1800091c0
lea rcx, [rbp + 0x27]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1800092a1
xor eax, eax
mov dword [rbp - 0x19], 0xf5aa8298
mov byte [rbp + 5], al
xorps xmm0, xmm0
movups xmmword [rbp - 0xb], xmm0
mov dword [rbp - 0x15], 0xa9f49c9d
movabs r9, 0x3d11c2b64f6649b0
mov dword [rbp - 0x11], 0x878e4789
mov word [rbp - 0xd], 0x6d80
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
nop
mov rcx, qword [rbp + 0x67]
mov rax, qword [rbp + 0x67]
add rcx, r9
movzx edx, byte [rbp + rax - 0x19]
mov rax, rcx
and rax, rdx
imul r8, rax, 0xfffffffffffffffe
mov rax, qword [rbp + 0x67]
add r8, rcx
add r8, rdx
add r8b, 0x30
mov byte [rbp + rax - 0x19], r8b
mov rax, qword [rbp + 0x67]
inc rax
mov qword [rbp + 0x67], rax
mov rax, qword [rbp + 0x67]
cmp rax, 0x1f
jb 0x180009250
lea rcx, [rbp - 0x19]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
jne 0x1800092aa
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
add rsp, 0x90
pop rbp
ret
Function at 0x180010df0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800ee0f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180010ec3
cmp byte [rcx + 0x71], 0
je 0x180010ec3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180010ebf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180010e84
sub eax, 1
je 0x180010e88
cmp eax, 2
jne 0x180010ebf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b2e20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180010eb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x180010ebf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180010e6c
xor al, al
jmp 0x180010e6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b2e20
add rsp, 0x60
pop rbx
ret

Function at 0x180014500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ee0f8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1800b2e74
mov rdx, qword [rbx]
mov qword [rax], rdx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800150a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x180014579
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b2e20
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180014590
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800ee0f8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x10
call fcn.1800b2e74
mov r8, qword [rbx]
mov qword [rax], r8
mov qword [rax + 8], rdi
mov qword [rsp + 0x30], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180015130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x18001461a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b2e20
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800306c0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rdi, rcx
lea r10, [rsp + 0x20]
mov ecx, 0x10
xor r9b, r9b
nop dword [rax]
nop word [rax + rax]
movzx edx, r9b
lea r10, [r10 + 4]
movzx eax, r9b
add r9b, 4
movzx r8d, byte [rax + rdi + 1]
movzx eax, byte [rdx + rdi]
shl eax, 8
or r8d, eax
movzx eax, byte [rdx + rdi + 2]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + rdi + 3]
shl r8d, 8
or r8d, eax
mov dword [r10 - 4], r8d
sub rcx, 1
jne 0x180030700
mov esi, dword [rsp + 0x20]
lea rbx, [rsp + 0x20]
mov r11b, 0x10
nop
mov r10d, dword [rbx + 4]
lea rbx, [rbx + 4]
movzx eax, r11b
mov r8d, r10d
rol r8d, 0xe
inc r11b
mov edx, dword [rsp + rax*4 + 0x18]
mov ecx, edx
rol ecx, 0xf
mov eax, r10d
ror eax, 7
xor r8d, eax
mov eax, r10d
shr eax, 3
xor r8d, eax
mov eax, edx
rol eax, 0xd
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add r8d, ecx
add r8d, dword [rbx + 0x20]
add r8d, esi
mov esi, r10d
mov dword [rbx + 0x3c], r8d
cmp r11b, 0x40
jb 0x180030750
movups xmm0, xmmword [rdi + 0x50]
lea rax, [rdi + 0x50]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rbp + 0x68], rax
movups xmmword [rsp], xmm0
mov r12d, dword [rsp + 8]
lea edi, [rsi + 0x40]
mov r13d, dword [rsp + 4]
mov r11d, dword [rsp]
movups xmmword [rsp + 0x10], xmm1
mov r14d, dword [rsp + 0x18]
mov r15d, dword [rsp + 0x14]
mov ebx, dword [rsp + 0x10]
mov eax, dword [rsp + 0x1c]
nop dword [rax]
nop word [rax + rax]
mov ecx, ebx
lea rsi, [rsi + 4]
rol ecx, 7
mov r10d, ebx
ror r10d, 0xb
mov edx, ebx
xor r10d, ecx
not edx
and edx, r14d
mov ecx, ebx
ror ecx, 6
mov r8d, r12d
xor r10d, ecx
mov r9d, r13d
mov ecx, r15d
and r9d, r8d
and ecx, ebx
xor edx, ecx
lea rcx, [0x1800d7350]
add r10d, edx
mov edx, r11d
add r10d, dword [rsi + rcx - 4]
mov ecx, r11d
add r10d, dword [rsp + rsi + 0x1c]
rol ecx, 0xa
add r10d, eax
ror edx, 0xd
mov eax, r14d
xor edx, ecx
mov r14d, r15d
mov ecx, r11d
mov r15d, ebx
mov ebx, dword [rsp + 0xc]
ror ecx, 2
add ebx, r10d
xor edx, ecx
mov dword [rsp + 0xc], r12d
mov r12d, r13d
mov r13d, r11d
mov ecx, r12d
or ecx, r8d
and r11d, ecx
lea ecx, [r10 + rdx]
or r11d, r9d
add r11d, ecx
sub rdi, 1
jne 0x1800307f0
lea r8, [rsp]
mov dword [rsp + 0x1c], eax
sub r8, qword [rbp + 0x60]
lea edx, [rdi + 8]
mov rax, qword [rbp + 0x68]
mov dword [rsp], r11d
mov dword [rsp + 0x10], ebx
mov dword [rsp + 0x18], r14d
mov dword [rsp + 0x14], r15d
mov dword [rsp + 8], r12d
mov dword [rsp + 4], r13d
nop word [rax + rax]
mov ecx, dword [r8 + rax - 0x50]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1800308c0
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180036c10
Capabilities:
Hash data using murmur3

Disassembly:
and r8d, 0xf
mov r9, rdx
cmp r8, 4
jb 0x180036bae
mov r10d, r8d
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
nop dword [rax + rax]
mov eax, dword [r9]
add r9, 4
imul edx, eax, 0x3d4d51c3
sub ecx, edx
rol ecx, 0x11
imul ecx, ecx, 0x27d4eb2f
sub r10, 1
jne 0x180036b90
test r8, r8
je 0x180036bdf
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
imul edx, eax, 0x165667b1
add ecx, edx
rol ecx, 0xb
imul ecx, ecx, 0x9e3779b1
sub r8, 1
jne 0x180036bc0
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul ecx, eax, 0x85ebca77
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
sub rsp, 0x28
mov r11, rdx
mov rdx, rcx
cmp r11, 0x10
jb 0x180036cc7
mov qword [rsp + 0x20], rbx
mov eax, 0x61c88679
lea rbx, [rcx - 0xf]
mov r8d, 0x24234452
add rbx, r11
mov r9d, 0x85ebcaa1
mov r10d, 0x2a
nop word [rax + rax]
imul ecx, dword [rdx], 0x7a143589
sub r8d, ecx
imul ecx, dword [rdx + 4], 0x7a143589
rol r8d, 0xd
imul r8d, r8d, 0x9e3779b1
sub r9d, ecx
imul ecx, dword [rdx + 8], 0x7a143589
rol r9d, 0xd
imul r9d, r9d, 0x9e3779b1
sub r10d, ecx
imul ecx, dword [rdx + 0xc], 0x7a143589
rol r10d, 0xd
add rdx, 0x10
imul r10d, r10d, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp rdx, rbx
jb 0x180036c50
mov rbx, qword [rsp + 0x20]
rol eax, 0x12
rol r10d, 0xc
add eax, r10d
rol r9d, 7
add eax, r9d
rol r8d, 1
add eax, r8d
jmp 0x180036ccc
mov eax, 0x165667db
mov r8, r11
lea ecx, [rax + r11]
and r8d, 0xf
add rsp, 0x28
jmp 0x180036b70

Function at 0x180037110
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
mov r9, qword [rcx + 0x18]
cmp rbx, 0x20
jb 0x1800371ed
mov rdx, qword [rcx + 8]
mov r11, r9
mov r8, qword [rcx + 0x10]
mov rax, rdx
mov r10, qword [rcx + 0x20]
rol r11, 0xc
rol rax, 1
add r11, rax
mov qword [rsp + 0x30], rsi
movabs rsi, 0x9e3779b185ebca87
mov qword [rsp + 0x38], rdi
movabs rdi, 0xc2b2ae3d27d4eb4f
mov rax, r8
rol rax, 7
add r11, rax
mov rax, r10
imul rdx, rdi
imul r9, rdi
imul r8, rdi
imul r10, rdi
mov rdi, qword [rsp + 0x38]
rol rax, 0x12
add r11, rax
rol rdx, 0x1f
imul rdx, rsi
movabs rax, 0x7a1435883d4d519d
rol r9, 0x1f
xor r11, rdx
rol r8, 0x1f
imul r11, rsi
imul r9, rsi
imul r8, rsi
sub r11, rax
rol r10, 0x1f
imul r10, rsi
xor r11, r8
imul r11, rsi
sub r11, rax
xor r11, r9
movabs r9, 0x85ebca77c2b2ae63
imul r11, rsi
sub r11, rax
xor r11, r10
imul r11, rsi
mov rsi, qword [rsp + 0x30]
add r9, r11
jmp 0x1800371fa
movabs rdx, 0x27d4eb2f165667c5
add r9, rdx
add r9, rbx
lea rdx, [rcx + 0x28]
mov rcx, r9
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.180036ce0
Function at 0x1800a28e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1800a2992
mov r10d, dword [rdx]
mov r11d, dword [rbx + 0x18]
mov edx, r10d
mov r8d, r10d
shr edx, 0x18
mov ecx, r10d
shr r8d, 0x10
shr ecx, 8
cmp r10d, r11d
je 0x1800a2992
mov r9, qword [rbx + 8]
mov rbx, qword [rbx]
dec r9
movzx ecx, cl
mov qword [rsp + 0x10], rdi
movabs rdi, 0xcbf29ce484222325
movzx eax, r10b
xor rax, rdi
movabs rdi, 0x100000001b3
imul rax, rdi
xor rax, rcx
movzx ecx, r8b
imul rax, rdi
xor rax, rcx
mov ecx, edx
imul rax, rdi
xor rax, rcx
imul rax, rdi
mov rdi, qword [rsp + 0x10]
and rax, r9
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
cmp edx, r10d
je 0x1800a2996
cmp edx, r11d
je 0x1800a2992
inc rax
add rax, rcx
inc rcx
and rax, r9
cmp rcx, r9
jbe 0x1800a2970
xor eax, eax
pop rbx
ret
mov rax, r8
pop rbx
ret

Function at 0x1800a2bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov rdi, rcx
je 0x1800a2cd7
mov r12d, dword [rdx + 0x80]
lea rax, [rcx + 0x18]
mov ecx, dword [rax + 0x80]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x60], ecx
cmp r12d, ecx
jne 0x1800a2c2f
lea r8, [r12*4]
mov rdx, rax
mov rcx, r13
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2cd7
mov r15, qword [rdi + 8]
xor ebp, ebp
dec r15
mov eax, 0x811c9dc5
mov ecx, ebp
test r12, r12
je 0x1800a2c63
nop dword [rax]
nop dword [rax + rax]
xor eax, dword [r13 + rcx*4]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, r12
jb 0x1800a2c50
mov ebx, eax
mov rax, qword [rdi]
and rbx, r15
mov qword [rsp + 0x78], rax
imul rsi, rbx, 0x88
add rsi, rax
mov r14d, dword [rsi + 0x80]
mov edi, r14d
shl rdi, 2
cmp r14d, r12d
jne 0x1800a2c9f
mov r8, rdi
mov rdx, r13
mov rcx, rsi
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2cd2
cmp r14d, dword [rsp + 0x60]
jne 0x1800a2cba
mov rdx, qword [rsp + 0x70]
mov r8, rdi
mov rcx, rsi
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a2cd7
inc rbx
add rbx, rbp
inc rbp
and rbx, r15
cmp rbp, r15
ja 0x1800a2cd7
mov rax, qword [rsp + 0x78]
jmp 0x1800a2c70
mov rax, rsi
jmp 0x1800a2cd9
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800a2ea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov r9, qword [rcx]
mov r8, rax
test rax, rax
je 0x1800a2ecc
nop
movzx edx, byte [r9 + r8 - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub r8, 1
jne 0x1800a2eb0
ret
Function at 0x1800a2ed0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 8]
mov rsi, rcx
movzx eax, byte [rdx]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
dec r10
mov rbx, qword [rsi]
movzx ecx, byte [r11 + 2]
movzx r8d, byte [r11 + 1]
mov edi, dword [rsi + 0x18]
imul rax, rdx
xor rax, r8
imul rax, rdx
xor rax, rcx
movzx ecx, byte [r11 + 3]
imul rax, rdx
xor rax, rcx
imul rax, rdx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
mov r9d, dword [r11]
cmp edx, edi
je 0x1800a2f76
cmp edx, r9d
je 0x1800a2f7d
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1800a2f40
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [r8], r9d
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 8]
mov rax, r8
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1800a3170
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [rcx + 8]
xor ebp, ebp
mov r13d, dword [rdx + 0x80]
dec r12
mov r14, rdx
mov eax, 0x811c9dc5
mov r8d, ebp
test r13, r13
je 0x1800a31c2
nop dword [rax]
xor eax, dword [rdx + r8*4]
inc r8
imul eax, eax, 0x1000193
cmp r8, r13
jb 0x1800a31b0
mov edi, eax
mov rax, qword [rcx]
and rdi, r12
add rcx, 0x18
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rcx
nop dword [rax + rax]
imul rbx, rdi, 0x88
add rbx, rax
mov r15d, dword [rbx + 0x80]
mov esi, r15d
shl rsi, 2
cmp r15d, dword [rcx + 0x80]
jne 0x1800a3213
mov rdx, rcx
mov r8, rsi
mov rcx, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a3247
cmp r15d, r13d
jne 0x1800a322a
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800a32a3
inc rdi
add rdi, rbp
inc rbp
and rdi, r12
cmp rbp, r12
ja 0x1800a32a8
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
jmp 0x1800a31e0
movups xmm0, xmmword [r14]
mov rax, qword [rsp + 0x60]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r14 + 0x60]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r14 + 0x70]
movups xmmword [rbx + 0x70], xmm1
mov ecx, dword [r14 + 0x80]
mov dword [rbx + 0x80], ecx
inc qword [rax + 0x10]
mov rax, rbx
jmp 0x1800a32aa
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800a3490
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x58], rbx
mov rbx, rcx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x40], rsi
mov rsi, qword [rcx + 8]
mov qword [rsp + 0x38], rdi
mov edi, dword [rcx + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
lea r15, [rcx + 0x18]
mov r14, r15
test rsi, rsi
jne 0x1800a34de
mov esi, 0x10
lea ecx, [rsi + 0x70]
call fcn.1800b2e74
mov r11, rax
xor ecx, ecx
mov ebp, esi
jmp 0x1800a3510
xor r11d, r11d
xor ebp, ebp
add rsi, rsi
je 0x1800a3527
lea rcx, [rsi*8]
call fcn.1800b2e74
xor ecx, ecx
mov r11, rax
mov rbp, rsi
test rsi, rsi
je 0x1800a3527
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14]
mov dword [r11 + rcx*8], eax
xor eax, eax
mov word [r11 + rcx*8 + 4], ax
inc rcx
cmp rcx, rsi
jb 0x1800a3510
xor esi, esi
cmp qword [rbx + 8], rsi
jbe 0x1800a35f1
mov qword [rsp + 0x30], r12
movabs r14, 0x100000001b3
movabs r12, 0xcbf29ce484222325
nop dword [rax]
mov rax, qword [rbx]
mov r9d, dword [rax + rsi*8]
mov edx, r9d
mov r8d, r9d
mov ecx, r9d
shr edx, 0x18
shr r8d, 0x10
shr ecx, 8
cmp r9d, dword [r15]
je 0x1800a35df
movzx ecx, cl
lea r10, [rbp - 1]
movzx eax, r9b
xor rax, r12
imul rax, r14
xor rax, rcx
movzx ecx, r8b
imul rax, r14
xor rax, rcx
mov ecx, edx
imul rax, r14
xor rax, rcx
imul rax, r14
and rax, r10
xor ecx, ecx
mov r8d, dword [r11 + rax*8]
lea rdx, [r11 + rax*8]
cmp r8d, edi
je 0x1800a35c8
cmp r8d, r9d
je 0x1800a35cb
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1800a35a1
xor edx, edx
jmp 0x1800a35cb
mov dword [rdx], r9d
mov rax, qword [rbx]
lea rcx, [rax + rsi*8]
mov eax, dword [rax + rsi*8]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
inc rsi
cmp rsi, qword [rbx + 8]
jb 0x1800a3550
mov r12, qword [rsp + 0x30]
mov rcx, qword [rbx]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 8], rbp
mov rbp, qword [rsp + 0x60]
mov qword [rbx], r11
mov rbx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800a3627
add rsp, 0x48
jmp fcn.1800b2eb0
add rsp, 0x48
ret
Function at 0x1800b0a00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1800ee0f8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x1800efca0]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800b0a48
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x1800b0a3c
mov rax, qword [rax + 0x10]
jmp 0x1800b0a42
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800b0a30
cmp byte [rcx + 0x19], 0
jne 0x1800b0b24
cmp dword [rcx + 0x20], 4
jg 0x1800b0b24
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1800b0a71
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800b0aa3
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x1800b0a90
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800b0450
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800b0ade
cmp rcx, qword [rbx + 8]
je 0x1800b0ade
cmp qword [rbx + 0x10], 1
jne 0x1800b0ae2
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800b2e20
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x1800b0ac8
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.1800b0b50
nop
mov r8, rax
lea rdx, [0x1800ce170]
lea rcx, [rsp + 0x58]
call fcn.180011910
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1800b09a0
lea rdx, [0x1800ea688]
lea rcx, [rsp + 0x20]
call sub.vcruntime140.dll__CxxThrowException
nop
lea rcx, [0x1800ce1e0]
call sub.msvcp140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3

Function at 0x1800b6390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
mov r9d, 0x811c9dc5
test rdx, rdx
je 0x1800b63b7
nop dword [rax]
movzx r8d, byte [rax + rcx]
inc rax
xor r8d, r9d
imul r9d, r8d, 0x1000193
cmp rax, rdx
jb 0x1800b63a0
mov eax, r9d
ret
Function at 0x1800b6560
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov r12, rcx
lea rax, [0x1800d5433]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov qword [rcx], 0
mov qword [rcx + 8], 0
mov qword [rcx + 0x10], 0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rcx + 0x18], xmm0
mov ecx, 0x800
call fcn.1800b2e74
mov rdx, rax
mov qword [r12], rax
mov qword [r12 + 8], 0x80
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rax], xmm0
lea r8, [rax + 0x10]
mov r9d, 0x3f
mov rcx, qword [rdx]
mov qword [r8], rcx
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [r8 + 0x10], rax
lea r8, [r8 + 0x20]
mov rax, qword [rdx + 0x18]
mov qword [r8 - 8], rax
lea rdx, [rdx + 0x20]
sub r9, 1
jne 0x1800b65e0
mov rax, qword [rdx]
mov qword [r8], rax
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
mov qword [r12 + 0x30], rbx
mov eax, 0x121
mov dword [rsp + 0x78], eax
lea rcx, [0x1800ee160]
mov qword [rsp + 0x80], rcx
nop word [rax + rax]
mov r15, qword [rcx]
mov qword [rsp + 0x20], r15
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [r15 + rdi], 0
jne 0x1800b6650
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x2c], eax
mov r13, qword [r12 + 8]
mov rcx, qword [r12 + 0x10]
lea rax, [r13*2]
add rax, r13
shr rax, 2
cmp rcx, rax
jb 0x1800b673a
test rcx, rcx
je 0x1800b6732
cmp edi, dword [r12 + 0x20]
jne 0x1800b66ac
mov r8d, edi
mov rdx, qword [r12 + 0x18]
mov rcx, r15
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b6732
dec r13
mov edx, 0x811c9dc5
mov r8d, edi
xor ecx, ecx
test edi, edi
je 0x1800b66d5
nop dword [rax]
movzx eax, byte [rcx + r15]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r8
jb 0x1800b66c0
mov esi, edx
and rsi, r13
xor ebp, ebp
nop dword [rax]
mov rbx, rsi
shl rbx, 4
add rbx, qword [r12]
mov r14d, dword [rbx + 8]
cmp r14d, edi
jne 0x1800b6706
mov r8d, r14d
mov rdx, r15
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b673a
cmp r14d, dword [r12 + 0x20]
jne 0x1800b6721
mov r8, r14
mov rdx, qword [r12 + 0x18]
mov rcx, qword [rbx]
call sub.vcruntime140.dll_memcmp
test eax, eax
je 0x1800b6732
inc rsi
add rsi, rbp
and rsi, r13
inc rbp
cmp rbp, r13
jbe 0x1800b66e0
mov rcx, r12
call fcn.1800b8ad0
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.1800b7290
mov eax, dword [rsp + 0x78]
inc eax
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x80]
add rcx, 8
mov qword [rsp + 0x80], rcx
cmp eax, 0x137
jl 0x1800b6640
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret