joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c32f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
cmp ecx, 9
je 0x1401c34ff
cmp ecx, 0xd
je 0x1401c34f8
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b740]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b370]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x70632e66
mov dword [rbp + 0xa4], 0x32333a70
mov word [rbp + 0xa8], 0x33
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str._anonymous_namespace::qt_format
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1401c3452
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401c34ad
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c34a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c34a7
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401c34ad
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401c34a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401c34a7
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
xor eax, eax
jmp 0x1401c3504
mov eax, 6
jmp 0x1401c3504
mov eax, 0xd
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1401c3670
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
mov rdx, qword [0x1403ee4f0]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r11, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [0x1403ee4c8]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [0x1403ee4d8]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x1401c370c
mov ecx, dword [r11]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1401c370e
nop dword [rax]
cmp rax, rdx
je 0x1401c370c
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1401c36f0
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
xor eax, eax
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
Function at 0x1401c3720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x1401c39a6
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov r15, r8
mov rsi, rdx
xor r13d, r13d
movabs rdi, 0x492492492492492
movabs r12, 0x100000001b3
lea rbp, [0x1403ecd28]
movss xmm6, dword [0x14033a4ac]
movabs rax, 0xcbf29ce484222325
mov r8, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1401c3791
mov rdx, qword [rsi]
mov rbx, rax
mov rcx, r13
test r8, r8
je 0x1401c37b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r12
inc rcx
cmp rcx, r8
jb 0x1401c37a0
mov r9, rbx
mov r8, rsi
lea rdx, [rsp + 0x30]
call fcn.1401c4c10
cmp qword [rsp + 0x38], 0
jne 0x1401c3977
cmp qword [0x1403ecd30], rdi
je 0x1401c39a7
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], r13
mov ecx, 0x38
call fcn.14029d728
mov r14, rax
mov qword [rsp + 0x28], rax
mov rdx, rsi
lea rcx, [rax + 0x10]
call fcn.14008a370
mov eax, dword [rsi + 0x20]
mov dword [r14 + 0x30], eax
mov r8, qword [0x1403ecd30]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1401c3825
cvtsi2ss xmm0, rcx
jmp 0x1401c383a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [0x1403ecd58]
xorps xmm2, xmm2
test rdi, rdi
js 0x1401c3850
cvtsi2ss xmm2, rdi
jmp 0x1401c3868
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x1403ecd20]
comiss xmm1, xmm3
seta al
test al, al
je 0x1401c3905
divss xmm0, xmm3
call fcn.14029ee95
xor ecx, ecx
comiss xmm0, xmm6
jb 0x1401c38ab
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x1401c38ab
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x1401c38dd
cmp rdi, 0x200
jae 0x1401c38da
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x1401c38dd
mov rdi, rcx
mov rdx, rdi
call fcn.1401c4490
mov r9, rbx
lea r8, [r14 + 0x10]
lea rdx, [rsp + 0x40]
call fcn.1401c4c10
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
mov r8, qword [0x1403ecd30]
mov qword [rsp + 0x28], r13
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rcx + 8]
inc r8
mov qword [0x1403ecd30], r8
mov qword [r14], rcx
mov qword [r14 + 8], rdx
mov qword [rdx], r14
mov qword [rcx + 8], r14
mov rax, qword [0x1403ecd38]
and rbx, qword [0x1403ecd50]
add rbx, rbx
mov r8, qword [rax + rbx*8]
cmp r8, qword [0x1403ecd28]
jne 0x1401c394f
mov qword [rax + rbx*8], r14
jmp 0x1401c3961
cmp r8, rcx
jne 0x1401c395a
mov qword [rax + rbx*8], r14
jmp 0x1401c3966
cmp qword [rax + rbx*8 + 8], rdx
jne 0x1401c3966
mov qword [rax + rbx*8 + 8], r14
movabs rdi, 0x492492492492492
lea rbp, [0x1403ecd28]
add rsi, 0x28
cmp rsi, r15
jne 0x1401c3776
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call qword [0x1402c3898]
int3
Function at 0x1401c4350
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [rdx + 1]
movabs rcx, 0x100000001b3
movzx r8d, byte [rdx]
mov r9, rdx
movabs r11, 0xcbf29ce484222325
movabs r10, 0x9ffaac085635bc91
xor r8, r11
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
imul r8, rcx
movzx ecx, byte [rdx + 4]
xor rcx, r11
mov rax, r8
shl rax, 6
mov rdx, r8
imul rcx, r10
shr rdx, 2
add rcx, 0xffffffff9e3779b9
add rcx, rax
add rdx, rcx
movzx ecx, byte [r9 + 5]
xor rdx, r8
xor rcx, r11
imul rcx, r10
mov rax, rdx
shl rax, 6
add rcx, rax
mov rax, rdx
shr rax, 2
add rax, 0xffffffff9e3779b9
add rax, rcx
xor rax, rdx
ret
Function at 0x1401c46f0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1401c4721
lea rcx, str.invalid_hash_bucket_count
call qword [0x1402c3898]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1403ecce8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1403eccf8]
lea rdx, [rdi + rdi]
call fcn.14004bef0
mov rax, qword [0x1403ecce8]
lea r9, [rdi - 1]
mov qword [0x1403ecd10], r9
mov qword [0x1403ecd18], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401c4894
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1403eccf8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1401c47e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401c4855
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1401c481d
mov r10, qword [rdx]
cmp r10, rax
je 0x1401c4817
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401c4855
cmp r9, rdx
je 0x1401c4831
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1401c4869
cmp r9, rdx
jne 0x1401c4822
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1401c488f
mov r9, qword [0x1403ecd10]
jmp 0x1401c4791
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401c4855
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401c48a0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1401c48d1
lea rcx, str.invalid_hash_bucket_count
call qword [0x1402c3898]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1403ee4c8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1403ee4d8]
lea rdx, [rdi + rdi]
call fcn.14004bef0
mov rax, qword [0x1403ee4c8]
lea r9, [rdi - 1]
mov qword [0x1403ee4f0], r9
mov qword [0x1403ee4f8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401c4a44
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1403ee4d8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1401c4990
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401c4a05
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1401c49cd
mov r10, qword [rdx]
cmp r10, rax
je 0x1401c49c7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401c4a05
cmp r9, rdx
je 0x1401c49e1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1401c4a19
cmp r9, rdx
jne 0x1401c49d2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1401c4a3f
mov r9, qword [0x1403ee4f0]
jmp 0x1401c4941
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401c4a05
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401cb0d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x1401cb108
lea rcx, str.invalid_hash_bucket_count
call qword [0x1402c3898]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14004bef0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1401cb246
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1401cb1c0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401cb235
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1401cb1fd
mov r10, qword [rdx]
cmp r10, rax
je 0x1401cb1f7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401cb235
cmp r9, rdx
je 0x1401cb211
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1401cb25b
cmp r9, rdx
jne 0x1401cb202
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1401cb170
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401cb235
Function at 0x1401cd540
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x1401cd589
lock inc dword [rax + 8]
mov rax, qword [rdx]
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
add rcx, 0x10
mov rdx, r8
call qword [0x1402c5880]
nop
cmp qword [rbx], 0
jne 0x1401cd78a
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b740]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b3a0]
movdqa xmmword [rbp + 0x90], xmm1
mov dword [rbp + 0xa0], 0x70617257
mov dword [rbp + 0xa4], 0x2e726570
mov dword [rbp + 0xa8], 0x3a707063
mov word [rbp + 0xac], 0x3034
mov byte [rbp + 0xae], 0
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CDxOImageWrapper::AttachedMetadata::AttachedMetadata
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1401cd6e5
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401cd740
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cd73a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cd73a
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401cd740
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401cd73a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401cd73a
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rcx, qword [rsp + 0x30]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rsp + rdx + 0x2c], r8d
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
nop
mov rax, rsi
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14029d460
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1c0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d37d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
call qword [0x1402c51b0]
nop
lea rax, vtable.CBaseTask.0
mov qword [rsi], rax
lea rcx, [rsi + 0x10]
mov rdx, rbx
call qword [0x1402c5880]
nop
lea rbx, [rsi + 0x28]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call qword [0x1402c32a8]
nop
lea rax, vtable.CDxOCancelable.0
mov qword [rbx], rax
mov byte [rbx + 8], 0
lea rcx, [rbx + 0x10]
mov edx, 1
call qword [0x1402c4af8]
nop
cmp qword [rsi + 0x20], 0
jne 0x1401d3a44
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b740]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b440]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x14033b5d0]
movdqa xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x656e6967
mov dword [rbp + 0xb4], 0x6b736154
mov dword [rbp + 0xb8], 0x353a682e
mov word [rbp + 0xbc], 0x38
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CBaseTask::CBaseTask
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1401d399f
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401d39fa
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d39f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401d39f4
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401d39fa
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d39f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401d39f4
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rcx, qword [rsp + 0x30]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x88]
mov dword [rsp + rdx + 0x2c], r8d
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
nop
mov rax, rsi
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14029d460
mov rbx, qword [rsp + 0x200]
add rsp, 0x1d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d3b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xd0]
sub rsp, 0x1d0
mov rax, qword [0x1403d8618]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp rdx, qword [rcx + 0x18]
je 0x1401d3d13
movdqa xmm0, xmmword [0x14033b050]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [0x14033b110]
movdqa xmmword [rbp + 0x50], xmm1
movdqa xmm0, xmmword [0x14033b890]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [0x14033b570]
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmm0, xmmword [0x14033b740]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [0x14033b440]
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmm0, xmmword [0x14033bab0]
movdqa xmmword [rbp + 0xa0], xmm0
mov dword [rbp + 0xb0], 0x72656469
mov dword [rbp + 0xb4], 0x3a682e73
mov word [rbp + 0xb8], 0x3732
mov byte [rbp + 0xba], 0
lea rcx, [rsp + 0x30]
call fcn.140014cf0
nop
lea rdx, str.CAgentProvider::releaseAgent
lea rcx, [rsp + 0x30]
call fcn.1400143a0
mov rcx, rax
lea rdx, [0x1402f1b70]
call fcn.1400143a0
mov rcx, rax
lea rdx, [rbp + 0x40]
call fcn.1400143a0
call qword [0x1402c9bb8]
test rax, rax
je 0x1401d3c71
call qword [0x1402c9bb8]
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 8]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae r8, qword [rbp + 0x20]
mov dl, 0x45
mov rcx, rdi
call rbx
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401d3ccc
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d3cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401d3cc6
call qword [0x1402c9f00]
int3
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140014280
nop
lea rdx, [rbp + 0x20]
mov cl, 0x45
call qword [0x1402c9bb0]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1401d3ccc
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401d3cc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401d3cc6
call qword [0x1402c9f00]
int3
call fcn.14029da84
nop
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x30], rax
mov rax, qword [rsp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x2c], edx
lea rcx, [rsp + 0x38]
call fcn.140014c30
lea rcx, [rsp + 0x40]
call qword [0x1402c38f8]
lea rcx, [rbp - 0x48]
call qword [0x1402c3910]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14029d460
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret