joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b18fa
Capabilities:
Delete registry key

Disassembly:
lea rdx, [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
and qword [rsp + 0x38], 0
lea r9, [rbp + 0x720]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x28], 0
xor edx, edx
mov rcx, qword [rbp + 0x728]
and qword [rsp + 0x20], 0
mov dword [rbp + 0x720], 0x3e8
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
adc eax, 0x2478b4
mov rcx, qword [rbp + 0x728]
test eax, eax
je 0x140001040
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
lea rdx, str.SOFTWAREdialerconfig
mov r8d, 0xf013f
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
add rsp, 0x810
pop rbp
ret
call fcn.14004d06e
lea rdi, [rdi + 0x70b5ba99]
pushfq
or r9d, 0x66a4cc2d
jo 0x140001083
shl r9, 0x73
push r8
je fcn.1400b1f71
jae 0x14007b591
xchg qword [rsp + 0x18], rdi
mov r9, qword [rsp + 0x10]
call fcn.140021415
invalid
movabs r15, 0xff0ab5bc782ea11f
je 0x14006c38c
push r9
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov r9, r15
mov r9w, 0x321e
lea r15, [r9*8 - 0x1c65bfcd]
shl r9d, 0xb2
lea rcx, [rcx + 0x79210c29]
setns r9b
xor r9d, 0x118cee12
neg r14d
or r15d, 0x36307e9c
neg r9
xchg qword [rsp + 0x40], rcx
mov r14, qword [rsp + 0x28]
movsx r9, r15b
lea r15, [r9*4 - 0x7fdec96b]
jae fcn.1400a998c
not r9b
jns 0x1400a56fc
sub r9d, 0xc23741b2
and r15b, r9b
call fcn.140011584
cmp byte [edi + 0x4a3e1fe9], ah
mov esp, 0x7e3cf3dc
mov esp, 0x9f1bd191
jo 0x1400b198d
call [rbp - 0x1b952141]
lodsb al, byte [rsi]
popfq
mov edi, 0xace46ade
mov ebx, 0xc984a2dc
test eax, 0x8f185f4f
adc eax, 0x61d0ee9f
imul ebx, dword es:[rcx - 0xf], 0x82a4133f
lea r12, [r15 - 0x6afcea6f]
imul ebx, dword [rcx], 0x8fc23f30
invalid

Function at 0x1400ba235
Capabilities:
Encode data using xor

Disassembly:
cmp edx, 0x7aa8eeb3
lea rcx, [r10*8 + 0x249cc19a]
setge byte [rsp + r10 + 0x58f04917]
mov rcx, qword [rsp + 0x38]
shl r10w, 0x25
sub r10, r10
or word [rsp + r10 + 0x18], 0xfc16
mov r10, qword [rsp + r10 + 0x28]
call fcn.14005367e
call fcn.1400a7eb4
mov ch, ch
push rbp
mov ebx, 0x17bd8d3
sub eax, dword [rsi - 0x3a]
xor al, 0x58
jae 0x1400ba1f9
ret 0x8110

Function at 0x1400c4eaa
Capabilities:
Execute shellcode via indirect call
Resolve function by parsing pe exports

Disassembly:
push r14
pushfq
movabs r14, 0xae8faf8d99021307
and r14w, 0x4312
xchg qword [rsp + 0x20], rax
push rbx
mov rbx, r14
or r14, 0x78998717
add r14b, bl
cmp r14b, bl
mov ebx, 0x683d6e99
not r14
mov qword [rsp + 0x20], rax
setae r14b
or rbx, rbx
and bl, 0xaf
neg r14w
neg ebx
and ebx, 0xf3242b2c
add qword [rsp + 0x18], 0xfffffffffffecb6a
or rbx, 0xffffffffff9d5f04
push r8
movabs rax, 0x59153797a13206bd
shr rbx, 0xa6
je fcn.14005241d
cmp r14d, 0x20bd0713
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
call fcn.14006ace4
Function at 0x1400cfe98
Capabilities:
Get token privileges

Disassembly:
mov sil, 0x38
mov rsi, qword [rsp + rsi*4 - 0x1e580d0]
mov rsi, qword [rsi]
mov qword [rsp + 0x10], 0xffffffffab113628

Function at 0x1400d1c8e
Capabilities:
Delete registry key

Disassembly:
or di, 0xef36
mov rbp, qword [rsp + r9 - 0x67ffffd8]
mov rbp, qword [rbp + r11*2 + 0x77505ab8]
cmp di, 0xe532
mov qword [rsp + r9 - 0x67ffffd8], r11
jl 0x1400a56fc
sub byte [rsp + r9 - 0x67ffffd8], 0x9d
add word [rsp + r9 - 0x67ffffd8], di
xor r11d, edi
push r9
lea rbp, [rbp - 0x59c42ad9]
add qword [rsp + r9 - 0x67fffff8], 0xffffffffbffede39
mov r9, qword [rsp + r9 - 0x67ffffd0]
or r9b, dil
xor qword [rsp + r9*2 + 0x77505a32], rdi
xchg qword [rsp + r11 - 0x43fd2d23], rbp
mov r11, qword [rsp + r9 + 0x3ba82d21]
xor qword [rsp + 0x30], rdi
je 0x14002f7ec
call fcn.14000b0e6
pop rbp
call fcn.14002f234
movabs r10, 0x722da9345aa88b8d
jns 0x14006970e
sub sil, 0x36
mov r10, qword [rsp]
xor dword [rsp + 8], 0xf20dad96
mov ah, 0x4c
or bl, byte [rbp - 0x74b75594]
mov ah, 0xe
test dword [rsi + 0x36], ecx
invalid
or r11b, 0xa4
jl 0x140021170
xchg qword [rsp + r9*4 - 0x3729051c], rbx
mov r9, qword [rsp + r9*4 - 0x3729054c]
cmp byte [rsp + 0x70], 0x93
jbe 0x1400c1478
scasd eax, dword [rdi]
clc
pop rdi
jno 0x1400d1c5f
invalid

Function at 0x1400d2a62
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Parse pe header
Resolve function by parsing pe exports
Resume thread
Terminate process

Disassembly:
mov qword [rsp + rcx - 0x58b0], 0x45bc1383
jge 0x1400b1f63

Function at 0x1400d4e6a
Capabilities:
Get token privileges

Disassembly:
not r12w
mov rsi, qword [rsp + 8]
mov rsi, qword [rsi]
or r12d, 0xcd15e829
call fcn.1400a09e0

Function at 0x1400d7741
Capabilities:
Create thread

Disassembly:
and edi, dword [rsp + 0x1c]
test r9, rdi
mov qword [rsp + 0x40], rax
push r14
jo 0x14000266c
push r12
add qword [rsp + 0x40], 0xfffffffffffc9377
bswap edi
call fcn.1400b8575

Function at 0x1400dcc36
Capabilities:
Encode data using xor

Disassembly:
shl dil, 0x47
neg r15d
not dil
call fcn.140076791

Function at 0x1400ddcb0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
pushfq
add qword [rsp + 8], 0xe5bb
mov qword [rsp + 0x20], rbx
call fcn.1400b1fb5

Function at 0x14023b6dd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
stc
sub edi, edi
movzx ebx, r8b
mov r9d, ecx
movzx r8w, r12b
mov r11, rcx
mov r8, rdi
nop
movsx r10d, di
xchg r10b, r9b
mov r10b, r11b
movzx r9d, byte [r11]
cmova r10d, r8d
mov r10w, bx
movsxd r10, r11d
movzx r10d, byte [rdx]
inc r11
jmp 0x14023b722
inc rdx
test bl, bl
je 0x14023b74c
mov ecx, r8d
cdqe
mov eax, 0xde14738b
rol eax, cl
clc
add al, r8b
cmp r10b, 0xac
xor r9b, al
jmp 0x14023b749
inc r8
test r9b, r9b
jmp 0x14023b754
je 0x14023b763
cmp r9b, r10b
je 0x14023b707
cmp r9b, r10b
jae 0x14023b784
or eax, 0xffffffff
movzx di, dil
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
jmp 0x14023b783
ret
mov rbx, qword [rsp + 8]
seta dil
mov eax, edi
not rdi
mov rdi, qword [rsp + 0x10]
ret
Function at 0x12ee64c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x12ee656
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x12ee67f
pop rbp
sub rbp, 0x33
sub rbp, 0xeee64c
sub rsp, 0x20
jmp 0x12ee69e
mov rax, 0xeee64c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x69c73092
xor byte [rax], dl
inc rax
dec rcx
jne 0x12ee6bd
jmp 0x12ee6d4
mov ecx, 0x197b1bda
ficomp dword [rbx]
jnp 0x12ee6f1
sbb ebp, dword [rsi - 0x256d6d6e]
adc edx, dword [rbx - 0x66]
xchg ebx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbx + 0x5255da7b]
invalid
mov edx, 0xda929292
jo 0x12ee6d3
xchg ebx, eax
push rbx
sbb dword [rbx], edx
sahf
xchg edx, eax
xchg edx, eax
xchg edx, eax
ficom dword [rbx - 0x253d3d86]
sub cl, byte [rsi]
invalid

Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
xor r9, r9
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
mov rdx, qword [rdx + 0x20]
push r9
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x1401e9910
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1401e976f
xor ecx, ecx
call qword [0x140213478]
test rax, rax
je 0x1401e976f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401e976f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401e976f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401e976f
cmp dword [rcx + 0x84], 0xe
jbe 0x1401e976f
cmp dword [rcx + 0xf8], 0
je 0x1401e976f
mov ecx, ebx
call fcn.1401e982c
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1401e95fc
nop
cmp dword [rbp + 0x20], 0
je 0x1401e97bd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1401e97c8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1401e9700

Function at 0x180001000
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180005010]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp edx, 1
jne 0x1800010c3
call fcn.180001800
mov rcx, rax
test rax, rax
jne 0x180001042
mov qword [0x180005718], rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180001ec0
add rsp, 0x38
ret
movsxd rax, dword [rax + 3]
add rcx, 7
add rcx, rax
mov qword [0x180005718], rcx
jne 0x18000106a
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180001ec0
add rsp, 0x38
ret
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rbx
lea rcx, [0x180001aa0]
mov qword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x1800010be
mov edx, 0xfffffffc
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
lea r8, [0x1800014c0]
mov edx, 0xfffffffc
mov rcx, rbx
mov qword [0x180005708], rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180001ec0
add rsp, 0x38
ret
Function at 0x18009a06c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x60
and dword [rax - 0x48], 0
mov rdi, rcx
mov r8d, dword [0x1801ea6d0]
mov sil, dl
movaps xmmword [rax - 0x18], xmm6
movss xmm6, dword [0x18008b8bc]
mov dword [rax - 0x40], 0xff
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801eb1c0], eax
jg 0x18009a23d
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x18009a0e3
mov rax, qword [0x1801eb1b0]
mov rdx, qword [0x1801eb198]
and rax, rcx
mov r9, qword [0x1801eb188]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x18009a134
mov r8, qword [rdx + rax*8]
jmp 0x18009a12c
cmp rcx, r8
je 0x18009a134
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18009a123
jmp 0x18009a136
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x18009a1b7
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call fcn.18009a9d0
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x18009a160
and rbx, qword [0x1801eb1b0]
mov rdx, qword [0x1801eb198]
add rbx, rbx
mov rax, qword [0x1801eb188]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x18009a1ae
mov r8, qword [rdx + rbx*8]
jmp 0x18009a1a6
cmp rcx, r8
je 0x18009a1ae
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18009a19d
jmp 0x18009a1b0
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801eae88]
lea r8, [rax + 0x18]
mov edx, dword [r8]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x18008b9a8]
test sil, sil
je 0x18009a1ec
cmp edx, 0xff
jge 0x18009a202
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x18009a1fb
test edx, edx
jle 0x18009a202
movd xmm0, edx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si edx, xmm0
mov dword [r8], edx
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
lea rcx, [rsp + 0x20]
mov rsi, qword [r11 + 0x20]
lea rax, [rsp + 0x28]
mov rdi, qword [r11 + 0x28]
test edx, edx
cmovns rcx, r8
cmp edx, 0xff
cmovle rax, rcx
mov eax, dword [rax]
mov dword [r8], eax
mov rsp, r11
pop r14
ret
lea rcx, [0x1801eb1c0]
call fcn.1801246cc
cmp dword [0x1801eb1c0], 0xffffffff
jne 0x18009a0ca
mov ecx, 0x20
call fcn.1801245e8
xorps xmm0, xmm0
lea rcx, [0x1801eb198]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801eb198], 0
mov qword [0x1801eb188], rax
movdqa xmmword [0x1801eb1a0], xmm0
mov qword [0x1801eb1b0], 7
mov qword [0x1801eb1b8], 8
mov dword [0x1801eb180], 0x3f800000
call fcn.18009a64c
lea rcx, [0x180190740]
call fcn.180124aac
lea rcx, [0x1801eb1c0]
call fcn.180124660
jmp 0x18009a0ca
Function at 0x18009a374
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
movss dword [rax + 0x20], xmm3
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x70
and dword [rax - 0x68], 0
mov rdi, rcx
mov r8d, dword [0x1801ea6d0]
mov sil, dl
movaps xmmword [rax - 0x28], xmm6
movss xmm6, dword [0x18008b8bc]
movaps xmmword [rax - 0x38], xmm7
movaps xmm7, xmm3
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801eb1c4], eax
jg 0x18009a541
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x90]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x18009a3e9
mov rax, qword [0x1801eb170]
mov rdx, qword [0x1801eb158]
and rax, rcx
mov r9, qword [0x1801eb148]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x18009a43d
mov r8, qword [rdx + rax*8]
jmp 0x18009a435
cmp rcx, r8
je 0x18009a43d
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18009a42c
jmp 0x18009a43f
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x18009a4c3
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
call fcn.18009a78c
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x90]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x18009a469
and rbx, qword [0x1801eb170]
mov rdx, qword [0x1801eb158]
add rbx, rbx
mov rax, qword [0x1801eb148]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x18009a4ba
mov r8, qword [rdx + rbx*8]
jmp 0x18009a4b2
cmp rcx, r8
je 0x18009a4ba
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18009a4a9
jmp 0x18009a4bc
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801eae88]
lea rdx, [rax + 0x18]
movss xmm0, dword [rdx]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x18008b7f0]
test sil, sil
je 0x18009a4ef
comiss xmm0, xmm7
jae 0x18009a500
addss xmm0, xmm6
jmp 0x18009a4fc
comiss xmm0, dword [0x18008b79c]
jbe 0x18009a500
subss xmm0, xmm6
movss dword [rdx], xmm0
comiss xmm0, dword [0x18008b79c]
mov rbx, qword [rsp + 0x98]
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0xa8]
movaps xmm6, xmmword [rsp + 0x60]
cmovae rcx, rdx
comiss xmm7, xmm0
movaps xmm7, xmmword [rsp + 0x50]
cmovae rax, rcx
movss xmm0, dword [rax]
movss dword [rdx], xmm0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1801eb1c4]
call fcn.1801246cc
cmp dword [0x1801eb1c4], 0xffffffff
jne 0x18009a3d0
mov ecx, 0x20
call fcn.1801245e8
xorps xmm0, xmm0
lea rcx, [0x1801eb158]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801eb158], 0
mov qword [0x1801eb148], rax
movdqa xmmword [0x1801eb160], xmm0
mov qword [0x1801eb170], 7
mov qword [0x1801eb178], 8
mov dword [0x1801eb140], 0x3f800000
call fcn.18009a64c
lea rcx, [0x18019074c]
call fcn.180124aac
lea rcx, [0x1801eb1c4]
call fcn.180124660
jmp 0x18009a3d0
Function at 0x18009a78c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x18009a7bb
mov rax, qword [0x1801eb170]
mov rcx, qword [0x1801eb158]
and rax, r15
mov r14, qword [0x1801eb148]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x18009a826
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801eb150], rax
jne 0x18009a865
lea rcx, [0x180089560]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x18009a838
cmp rbx, rdx
je 0x18009a85b
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x18009a82f
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x18009a805
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18009a9ac
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x18009a84a
mov ecx, 0x20
call fcn.1801245e8
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x1801eb150]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x18009a896
cvtsi2ss xmm1, rcx
jmp 0x18009a8ab
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801eb178]
xorps xmm0, xmm0
test rcx, rcx
js 0x18009a8c1
cvtsi2ss xmm0, rcx
jmp 0x18009a8d6
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801eb140]
comiss xmm0, xmm1
jae 0x18009a944
call fcn.18009ac14
mov rcx, qword [0x1801eb170]
mov rdx, qword [0x1801eb158]
and rcx, r15
mov rbx, qword [0x1801eb148]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x18009a930
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x18009a927
mov rbx, rax
cmp rax, r8
je 0x18009a987
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18009a91b
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x1801eb150]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801eb150], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1801eb170]
mov rcx, qword [0x1801eb158]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801eb148]
jne 0x18009a98e
mov qword [rcx + rax*8], rdi
jmp 0x18009a9a0
mov qword [rsp + 0x20], rax
jmp 0x18009a935
cmp r8, rbp
jne 0x18009a999
mov qword [rcx + rax*8], rdi
jmp 0x18009a9a5
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18009a9a5
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x18009a9d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x18009a9ff
mov rax, qword [0x1801eb1b0]
mov rcx, qword [0x1801eb198]
and rax, r15
mov r14, qword [0x1801eb188]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x18009aa6a
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801eb190], rax
jne 0x18009aaa9
lea rcx, [0x180089560]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x18009aa7c
cmp rbx, rdx
je 0x18009aa9f
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x18009aa73
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x18009aa49
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18009abf0
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x18009aa8e
mov ecx, 0x20
call fcn.1801245e8
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x1801eb190]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x18009aada
cvtsi2ss xmm1, rcx
jmp 0x18009aaef
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801eb1b8]
xorps xmm0, xmm0
test rcx, rcx
js 0x18009ab05
cvtsi2ss xmm0, rcx
jmp 0x18009ab1a
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801eb180]
comiss xmm0, xmm1
jae 0x18009ab88
call fcn.18009ae64
mov rcx, qword [0x1801eb1b0]
mov rdx, qword [0x1801eb198]
and rcx, r15
mov rbx, qword [0x1801eb188]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x18009ab74
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x18009ab6b
mov rbx, rax
cmp rax, r8
je 0x18009abcb
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18009ab5f
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x1801eb190]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801eb190], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1801eb1b0]
mov rcx, qword [0x1801eb198]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801eb188]
jne 0x18009abd2
mov qword [rcx + rax*8], rdi
jmp 0x18009abe4
mov qword [rsp + 0x20], rax
jmp 0x18009ab79
cmp r8, rbp
jne 0x18009abdd
mov qword [rcx + rax*8], rdi
jmp 0x18009abe9
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18009abe9
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret