joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e12a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x50
mov r10, r8
mov rdi, rdx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov qword [rdx], rbx
mov qword [rdx + 8], rbx
mov qword [rdx + 0x10], rbx
mov r8, qword [r8 + 0x10]
mov rdx, r10
cmp qword [r10 + 0x18], 0x10
jb 0x1400e12e4
mov rdx, qword [r10]
movabs r9, 0xcbf29ce484222325
mov rcx, rbx
test r8, r8
je 0x1400e1313
movabs r11, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r8
jb 0x1400e1300
mov r8, r10
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 8]
call fcn.1400e1d20
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400e1331
mov rcx, qword [rbp + 0x10]
cmp rcx, qword [rbp + 0x10]
je 0x1400e1411
add rcx, 0x30
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x20], 3
lea rdx, [rsp + 0x38]
call fcn.1400dede0
lea rax, [rsp + 0x38]
cmp rdi, rax
je 0x1400e13cf
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400e13a9
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1400e1399
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400e13c8
mov rcx, r8
call fcn.14029da84
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rbx
mov rax, qword [rsp + 0x38]
mov qword [rdi], rax
mov rax, qword [rsp + 0x40]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0x48]
mov qword [rdi + 0x10], rax
mov rdx, rbx
jmp 0x1400e13d9
call qword [0x1402c9f00]
int3
mov rdx, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x1400e1411
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400e1409
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e1409
call qword [0x1402c9f00]
int3
mov rcx, rbx
call fcn.14029da84
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e1b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, r9
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x28], rdx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r15
mov qword [rdx + 0x18], 0xf
mov byte [rdx], r15b
xor dil, dil
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1400e1b7b
mov rdx, qword [r8]
movabs r9, 0xcbf29ce484222325
mov rcx, r15
test r10, r10
je 0x1400e1bb3
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x1400e1ba0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.1400e1d20
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400e1bce
mov rcx, qword [rbp + 0x10]
cmp rcx, qword [rbp + 0x10]
je 0x1400e1cee
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov eax, 0xf
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x20], 3
xor dil, dil
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x40], dil
mov rdx, qword [rcx + 0x30]
test rdx, rdx
je 0x1400e1c45
cmp dword [rdx], 7
jne 0x1400e1c45
mov rdx, qword [rdx + 8]
test rdx, rdx
je 0x1400e1c45
cmp qword [rdx + 0x18], 0x10
jb 0x1400e1c29
mov r8, qword [rdx]
add r8, qword [rdx + 0x10]
mov rdx, qword [rdx]
jmp 0x1400e1c30
mov r8, qword [rdx + 0x10]
add r8, rdx
sub r8, rdx
lea rcx, [rsp + 0x40]
call fcn.140014110
mov dil, 1
mov rax, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
cmp rbx, rcx
je 0x1400e1cab
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400e1c85
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400e1c80
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400e1ce2
mov rcx, r8
call fcn.14029da84
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x10], xmm1
mov eax, 0xf
mov byte [rsp + 0x40], 0
cmp rax, 0x10
jb 0x1400e1cee
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e1ce9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e1ce9
call qword [0x1402c9f00]
nop
call qword [0x1402c9f00]
nop
call fcn.14029da84
test r14, r14
je 0x1400e1cf6
mov byte [r14], dil
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14029d460
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400eb050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rdx
mov rdi, rcx
xor ecx, ecx
test rdx, rdx
je 0x1400eb0da
mov rax, qword [rdx]
lea rdx, [rdi + 0x10]
test rdi, rdi
cmove rdx, rcx
mov rcx, rbx
call qword [rax + 0x20]
mov qword [rsp + 0x20], rbx
lea r8, [rsp + 0x20]
mov rdx, qword [rdi + 0x30]
lea rcx, [rdi + 0x20]
call fcn.140086c80
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x1400eb0c7
mov eax, dword [rax]
cmp eax, 1
jle 0x1400eb2a1
xor r8d, r8d
xor edx, edx
lea rcx, [rdi + 0x20]
call fcn.140038db0
jmp 0x1400eb2a1
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b9f0]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b6c0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b6f0]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x632e7473
mov dword [rbp + 0xa4], 0x353a7070
mov word [rbp + 0xa8], 0x33
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CCorrectionModuleHost::addCorrectionModule
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1400eb1ff
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400eb25a
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb254
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400eb25a
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb254
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb254
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401579f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rdx
mov rsi, rcx
xor edi, edi
lea rdx, [0x1403ec410]
mov rcx, rbx
call fcn.140016c60
test al, al
je 0x140157a3b
mov dword [rsi + 0x28], edi
jmp 0x140157c5f
lea rdx, [0x1403ec428]
mov rcx, rbx
call fcn.140016c60
test al, al
je 0x140157a5a
mov dword [rsi + 0x28], 1
jmp 0x140157c5f
lea rdx, [0x1403ec440]
mov rcx, rbx
call fcn.140016c60
test al, al
je 0x140157a79
mov dword [rsi + 0x28], 2
jmp 0x140157c5f
lea rdx, [0x1403ebc38]
mov rcx, rbx
call fcn.140016c60
test al, al
jne 0x140157c5f
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b7a0]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b0e0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b270]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x6e6f6974
mov dword [rbp + 0xa4], 0x7070632e
mov dword [rbp + 0xa8], 0x3531313a
mov byte [rbp + 0xac], dil
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CDistortionCorrection::touchAdditionalControl
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x140157bbd
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140157c18
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140157c12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140157c12
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140157c18
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140157c12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140157c12
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
lea rcx, [rsi - 0x10]
call fcn.140157ec0
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401868d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rcx
cmp byte [rcx + 0x30], 0
jne 0x140186ade
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b3b0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b290]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x65695673
mov dword [rbp + 0xa4], 0x70632e77
mov dword [rbp + 0xa8], 0x33333a70
mov word [rbp + 0xac], 0x36
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CBaseGraphicsView::onProcessingFinished
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x140186a3c
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140186a97
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140186a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140186a91
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140186a97
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140186a91
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140186a91
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
lea rcx, [rsi + 0xf0]
call qword [0x1402c5148]
lea rcx, [rsi + 0xf0]
call qword [0x1402c49b8]
mov byte [rsi + 0x119], 0
mov qword [rsp + 0x20], rsi
mov qword [rbp + 0x20], 0
lea rax, [rsp + 0x20]
mov qword [rbp + 0x28], rax
lea r9, [rbp + 0x20]
xor r8d, r8d
lea rdx, [0x14030edd0]
mov rcx, rsi
call qword [0x1402c3bd8]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140187bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rcx
cmp byte [rcx + 0x30], 1
je 0x140187dfe
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b3b0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b290]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x65695673
mov dword [rbp + 0xa4], 0x70632e77
mov dword [rbp + 0xa8], 0x37363a70
mov word [rbp + 0xac], 0x38
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CBaseGraphicsView::onStopImageProcessingTimer
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x140187d5c
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140187db7
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140187db1
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140187db7
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140187db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140187db1
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x230]
mov byte [rsi + 0x30], 0
mov byte [rsi + 0x118], 1
mov rcx, rsi
call qword [0x1402c8d18]
mov rcx, rax
call qword [0x1402c8d20]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401b0950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rsp + 0x40], rax
movdqu xmm0, xmmword [rdx]
lea rax, [rsp + 0x38]
mov rbx, rcx
movdqa xmm1, xmmword [0x14033b090]
mov rdi, r8
pxor xmm1, xmm0
mov qword [rsp + 0x20], rcx
movdqu xmmword [rsp + 0x28], xmm1
mov ecx, 0x10
sub rdx, rax
nop word [rax + rax]
lea r9, [rsp + 0x28]
add r9, rcx
inc rcx
movzx r8d, byte [rdx + r9 + 0x10]
xor r8b, 0x55
mov byte [r9], r8b
cmp rcx, 0x13
jb 0x1401b09a0
lea rdx, [rsp + 0x28]
mov byte [rsp + 0x3a], 0
mov rcx, rbx
call qword [0x1402c58d8]
lea rcx, [rbx + 0x18]
mov rdx, rdi
call qword [0x1402c5890]
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14029d460
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1401c2680
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
movzx r8d, byte [rcx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov rbx, rdx
mov rdx, qword [0x1403ecd10]
movabs rax, 0xcbf29ce484222325
xor r8, rax
xor r10d, r10d
movzx eax, byte [r9 + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 3]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [0x1403ecce8]
shl rdx, 4
add rdx, qword [0x1403eccf8]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x1401c2712
mov ecx, dword [r9]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1401c2715
cmp rax, rdx
je 0x1401c2712
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1401c2702
jmp 0x1401c2715
mov rax, r10
test rax, rax
mov rdx, r8
cmovne rdx, rax
cmp rdx, r8
jne 0x1401c274d
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], 0xf
mov dword [rbx], 0x656e6f4e
mov byte [rbx + 4], r10b
add rsp, 0x30
pop rbx
ret
add rdx, 0x18
mov rcx, rbx
call fcn.14008a370
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1401c2770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rbx, rcx
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1401c278a
mov rcx, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1401c27c4
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x1401c27b0
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.1401c4c10
mov rdx, qword [0x1403ecd28]
mov rcx, qword [rax + 8]
test rcx, rcx
cmovne rdx, rcx
cmp rdx, qword [0x1403ecd28]
jne 0x1401c27fb
mov dword [rbx], 1
mov rax, rbx
add rsp, 0x30
pop rbx
ret
mov eax, dword [rdx + 0x30]
mov dword [rbx], eax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401c3090
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor esi, esi
test ecx, ecx
jne 0x1401c30db
call qword [0x1402c5d10]
cmp eax, 0x20
je 0x1401c30ed
mov esi, 9
jmp 0x1401c32c0
cmp ecx, 1
jne 0x1401c30e8
lea esi, [rcx + 8]
jmp 0x1401c32c0
cmp ecx, 2
jne 0x1401c30f7
mov esi, 0xd
jmp 0x1401c32c0
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b740]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b370]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x70632e66
mov dword [rbp + 0xa4], 0x30333a70
mov word [rbp + 0xa8], 0x39
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str._anonymous_namespace::dxo_layoutOf
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1401c321c
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401c3277
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c3271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c3271
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401c3277
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c3271
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c3271
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rcx, qword [rsp + 0x30]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rsp + rdx + 0x2c], r8d
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
mov eax, esi
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret