joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003cce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x657361
mov dword [rbp - 0x20], 0x615f6d61
mov dword [rbp - 0x1c], 0x62796d72
mov byte [rbp - 0x14], 0
call fcn.180073670
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x736165
mov dword [rbp - 0x20], 0x74736572
mov dword [rbp - 0x1c], 0x74636972
mov dword [rbp - 0x18], 0x72616465
mov byte [rbp - 0x10], 0
call fcn.180073670
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x18], 0x657361
mov dword [rbp - 0x20], 0x615f6572
mov dword [rbp - 0x1c], 0x62796d72
mov byte [rbp - 0x14], 0
call fcn.180073670
vmovdqu xmm0, xmmword [0x1801e5be0]
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], 0
vmovdqu xmmword [rbp - 0x20], xmm0
call fcn.180073670
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x1a], 0x6e6f73
mov dword [rbp - 0x20], 0x705f6572
mov word [rbp - 0x1c], 0x6972
mov byte [rbp - 0x16], 0
call fcn.180073670
vmovdqu xmm0, xmmword [0x1801e56d0]
lea rcx, [rbp - 0x20]
mov word [rbp - 0x10], 0x6b
vmovdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0xe], 0
call fcn.180073670
lea rcx, [rbp - 0x20]
mov word [rbp - 0x19], 0x73
mov dword [rbp - 0x20], 0x645f6d61
mov word [rbp - 0x1c], 0x6f6f
mov byte [rbp - 0x1a], 0x72
mov byte [rbp - 0x17], 0
call fcn.180073670
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x40
pop rbp
ret
jmp 0x18003cce0
Function at 0x1800459f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 8], rax
mov rsi, rdx
xor ebx, ebx
mov dword [rbp - 0x10], 0x70696c
mov dword [rbp - 0x18], 0x666c6553
mov dword [rbp - 0x14], 0x436f4e5f
mov byte [rbp - 0xc], bl
lea rdx, [rbp - 0x18]
call fcn.180021410
lea rdi, [rax + 8]
cmp byte [rax], 4
cmovne rdi, rbx
mov dword [rbp - 4], 0x70696c
mov dword [rbp - 8], 0x43206f4e
mov byte [rbp], bl
mov ecx, 0x158
call fcn.18016cca4
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x28], rbx
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_27749e726544be110f10657788878fb8___void___.0
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x68], rcx
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], 2
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp - 8]
mov rcx, rax
call fcn.180069f50
nop
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x20], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x180045ada
mov ecx, ebx
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x180045aee
lea r8, [rbp - 0x20]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x180045afe
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov word [rbp - 0x1b], 0x3a
mov dword [rbp - 0x20], 0x65657053
mov byte [rbp - 0x1c], 0x64
mov byte [rbp - 0x19], 0
mov ecx, 0x170
call fcn.18016cca4
mov qword [rbp - 0x18], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_d016ecbfbee5163e379fba17082f5de7___void___.0
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x68], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x40], 0
mov qword [rsp + 0x38], 1
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0xc
mov dword [rsp + 0x20], 1
lea r9, [0x180211708]
xor r8d, r8d
lea rdx, [rbp - 0x20]
mov rcx, rax
call fcn.180069da0
nop
mov qword [rbp - 8], rbx
mov qword [rbp - 0x18], rax
mov rdx, qword [rsi + 0x98]
cmp rdx, qword [rsi + 0xa0]
je 0x180045ba2
mov qword [rdx], rax
add qword [rsi + 0x98], 8
jmp 0x180045bb6
lea r8, [rbp - 0x18]
lea rcx, [rsi + 0x90]
call fcn.18006a210
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x180045bc9
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdx, qword [rdx]
jmp 0x1800459f0
Function at 0x1800536a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x10], rax
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x16], 0x746e65
vmovdqu xmmword [rbp - 0x30], xmm0
mov r14, rcx
mov dword [rbp - 0x20], 0x656c6544
mov dword [rbp - 0x1c], 0x75436574
mov word [rbp - 0x18], 0x7272
mov byte [rbp - 0x12], 0
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
xor r15d, r15d
mov word [rbp - 0x17], 0x65
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], 0x69766e49
cmp byte [rax], 4
lea rcx, [rax + 8]
vmovdqu xmmword [rbp - 0x30], xmm0
cmovne rcx, r15
mov dword [rbp - 0x1c], 0x6269636e
test rcx, rcx
mov byte [rbp - 0x18], 0x6c
mov byte [rbp - 0x15], r15b
setne sil
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x1e], 0x726143
vmovdqu xmmword [rbp - 0x30], xmm0
cmp byte [rax], 4
lea rcx, [rax + 8]
mov word [rbp - 0x20], 0x6e49
cmovne rcx, r15
mov byte [rbp - 0x1a], r15b
test rcx, rcx
setne dil
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x18], 0x646564
vmovdqu xmmword [rbp - 0x30], xmm0
cmp byte [rax], 4
lea rcx, [rax + 8]
mov dword [rbp - 0x20], 0x5578614d
cmovne rcx, r15
mov dword [rbp - 0x1c], 0x61726770
test rcx, rcx
mov byte [rbp - 0x14], r15b
setne bl
call fcn.180021410
mov rcx, qword [r14]
movzx r9d, dil
movzx r8d, bl
mov byte [rsp + 0x20], sil
cmp byte [rax], 4
lea rdx, [rax + 8]
cmovne rdx, r15
test rdx, rdx
setne dl
call fcn.18003c450
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
add rcx, 8
jmp 0x1800536a0
Function at 0x180059e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rdi, rdx
xor ebx, ebx
mov dword [rbp + 0x41], 0x73676e
mov dword [rbp + 0x37], 0x65766153
mov dword [rbp + 0x3b], 0x74655320
mov word [rbp + 0x3f], 0x6974
mov byte [rbp + 0x45], bl
mov ecx, pe_nt_image_headers64
call fcn.18016cca4
mov qword [rbp - 0x19], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_619076286e6affb597fd1429f7d2c50a___void___.0
mov qword [rbp - 9], rcx
lea rcx, [rbp - 9]
mov qword [rbp + 0x2f], rcx
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, [rbp + 0x37]
mov rcx, rax
call fcn.1800378e0
nop
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], rax
mov rdx, qword [rdi + 0x98]
cmp rdx, qword [rdi + 0xa0]
je 0x180059ec9
mov ecx, ebx
mov qword [rdx], rax
add qword [rdi + 0x98], 8
jmp 0x180059edd
lea r8, [rbp - 0x19]
lea rcx, [rdi + 0x90]
call fcn.18006a210
mov rcx, qword [rbp - 0x19]
test rcx, rcx
je 0x180059eed
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
mov word [rbp + 0x47], 0
vmovdqu xmm0, xmmword [0x1801e5f60]
vmovdqu xmmword [rbp + 0x37], xmm0
mov ecx, pe_nt_image_headers64
call fcn.18016cca4
mov qword [rbp - 0x11], rax
lea rcx, vtable.std::_Func_impl_no_alloc_class__lambda_b9619925deede2e48cb3406f5cf05869___void___.0
mov qword [rbp - 9], rcx
lea rcx, [rbp - 9]
mov qword [rbp + 0x2f], rcx
lea r9, [rbp - 9]
xor r8d, r8d
lea rdx, [rbp + 0x37]
mov rcx, rax
call fcn.1800378e0
nop
mov qword [rbp - 0x11], rbx
mov qword [rbp - 0x19], rax
mov rdx, qword [rdi + 0x98]
cmp rdx, qword [rdi + 0xa0]
je 0x180059f5a
mov qword [rdx], rax
add qword [rdi + 0x98], 8
jmp 0x180059f6e
lea r8, [rbp - 0x19]
lea rcx, [rdi + 0x90]
call fcn.18006a210
mov rbx, qword [rbp - 0x19]
test rbx, rbx
je 0x180059f81
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
nop
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.18016cc50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rdx, qword [rdx]
jmp 0x180059e20
Function at 0x1800641c0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073710
xor eax, eax
movabs rdx, 0xe574a662acaefbb1
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x1800641f0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073730
xor eax, eax
movabs rdx, 0xeb6891f03362fb12
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x180064220
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073750
mov rax, qword [0x1802145b0]
xor edx, edx
mov dword [0x1802145a8], edx
mov dword [0x1802145b8], edx
mov dword [rax], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0x95914459a87eba28
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180064250
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800737b0
xor eax, eax
movabs rdx, 0xbd6e84632dd4cb3f
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x180064280
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800737d0
xor eax, eax
movabs rdx, 0x9bae5ad2508df078
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], 1
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x1800642b0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073800
xor eax, eax
movabs rdx, 0x7472bb270d7b4f3e
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x1800642e0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073820
xor eax, eax
movabs rdx, 0x3bc861df703e5097
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x180064550
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 3
jmp 0x180073cf0
xor eax, eax
movabs rdx, 0x740e14fad5842351
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180064580
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 2
jmp 0x180073cf0

Function at 0x1800645b0
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 1
jmp 0x180073cf0

Function at 0x180064610
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 0xffffffff
jmp 0x180073d20
mov rax, qword [0x1802145b0]
xor edx, edx
mov dword [0x1802145a8], edx
mov dword [0x1802145b8], edx
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xd716f30d8c8980e2
inc dword [0x1802145a8]
jmp fcn.180017460

Function at 0x180064640
Capabilities:
Hash data using fnv

Disassembly:
mov ecx, 1
jmp 0x180073d20
Function at 0x1800647c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2d], 0x73
mov dword [rsp + 0x20], 0x61727473
mov dword [rsp + 0x24], 0x63736f74
mov dword [rsp + 0x28], 0x6c756d75
mov byte [rsp + 0x2c], 0x75
mov byte [rsp + 0x2f], 0
call fcn.180073d80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180064ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2b], 0x33
mov dword [rsp + 0x20], 0x69726f68
mov dword [rsp + 0x24], 0x626e6f7a
mov word [rsp + 0x28], 0x6e61
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2d], 0
call fcn.180073d80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180064b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2b], 0x32
mov dword [rsp + 0x20], 0x69726f68
mov dword [rsp + 0x24], 0x626e6f7a
mov word [rsp + 0x28], 0x6e61
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2d], 0
call fcn.180073d80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180064be0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2b], 0x31
mov dword [rsp + 0x20], 0x69726f68
mov dword [rsp + 0x24], 0x626e6f7a
mov word [rsp + 0x28], 0x6e61
mov byte [rsp + 0x2a], 0x64
mov byte [rsp + 0x2d], 0
call fcn.180073d80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180064e20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x2b], 0x73
mov dword [rsp + 0x20], 0x72726963
mov dword [rsp + 0x24], 0x6d75636f
mov word [rsp + 0x28], 0x6c75
mov byte [rsp + 0x2a], 0x75
mov byte [rsp + 0x2d], 0
call fcn.180073d80
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180064f80
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073490
xor eax, eax
movabs rdx, 0x957e790ea1727b64
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x180064fb0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800734b0
xor eax, eax
movabs rdx, 0xf6062e089251c898
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460
Function at 0x1800654b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov word [rsp + 0x29], 0x79
mov dword [rsp + 0x20], 0x72747865
mov dword [rsp + 0x24], 0x6e757361
mov byte [rsp + 0x28], 0x6e
mov byte [rsp + 0x2b], 0
call fcn.180073dd0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180065670
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x1800734d0
xor eax, eax
movabs rdx, 0x8b05f884cf7e8020
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460
Function at 0x1800656d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x726568
mov dword [rsp + 0x20], 0x636d6d66
mov dword [rsp + 0x24], 0x75616c5f
mov word [rsp + 0x28], 0x636e
mov byte [rsp + 0x2e], 0
call fcn.180073670
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x48
ret

Function at 0x180065750
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180073600
xor eax, eax
movabs rdx, 0x50eeaad86232ee55
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
jmp fcn.180017460

Function at 0x180065810
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
vmovss xmm0, dword [0x1801e47f8]
vmovaps xmm1, xmm0
call fcn.1800736a0
vmovss xmm0, dword [0x1801e482c]
vmovaps xmm1, xmm0
add rsp, 0x28
jmp fcn.1800736a0

Function at 0x180065860
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
call fcn.180035790
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1800355d0
vmovss xmm7, dword [rax + 0x10]
call fcn.180035790
mov edx, eax
lea rcx, [rsp + 0x48]
call fcn.1800355d0
vmovss xmm6, dword [rax + 8]
call fcn.180035790
mov edx, eax
lea rcx, [rsp + 0x60]
call fcn.1800355d0
vmovss xmm3, dword [0x1801e4804]
vmovaps xmm2, xmm7
vmovaps xmm1, xmm6
vmovss xmm0, dword [rax]
call fcn.180073e00
mov ebx, eax
call fcn.180035790
mov ecx, eax
mov r8d, 0xffffffff
mov edx, ebx
vmovaps xmm6, xmmword [rsp + 0x90]
vmovaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa0
pop rbx
jmp fcn.180035520
Function at 0x1800659d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x878
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rsp + 0x840], rax
call fcn.1800312e0
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180031330
call fcn.1800312b0
test eax, eax
jne 0x18003cada
vmovdqu xmm0, xmmword [0x1801e6140]
lea rcx, [rsp + 0x30]
mov word [rsp + 0x4b], 0x21
vmovdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6e696f70
mov dword [rsp + 0x44], 0x6f662074
mov word [rsp + 0x48], 0x6e75
mov byte [rsp + 0x4a], 0x64
mov byte [rsp + 0x4d], al
call fcn.180005650
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x878
ret
vmovdqu ymm3, ymmword [0x1801e62c0]
mov qword [rsp + 0x880], rbx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x870], rdi
xor ebx, ebx
vmovaps xmmword [rsp + 0x860], xmm6
vmovaps xmmword [rsp + 0x850], xmm7
mov ecx, ebx
lea eax, [rcx + 8]
vmovd xmm0, ecx
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm3
vcvtdq2ps ymm1, ymm0
vaddps ymm2, ymm1, ymm1
vmovups ymmword [rdx - 0x20], ymm2
vmovd xmm0, eax
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm3
vcvtdq2ps ymm1, ymm0
vaddps ymm2, ymm1, ymm1
vmovups ymmword [rdx], ymm2
lea eax, [rcx + 0x10]
vmovd xmm0, eax
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm3
vcvtdq2ps ymm1, ymm0
vaddps ymm2, ymm1, ymm1
vmovups ymmword [rdx + 0x20], ymm2
lea eax, [rcx + 0x18]
add ecx, 0x20
lea rdx, [rdx + 0x80]
vmovd xmm0, eax
vpbroadcastd ymm0, xmm0
vpaddd ymm0, ymm0, ymm3
vcvtdq2ps ymm1, ymm0
vaddps ymm2, ymm1, ymm1
vmovups ymmword [rdx - 0x40], ymm2
cmp ecx, 0x1e0
jb 0x18003cb10
movsxd rax, ecx
cmp rax, 0x1f4
jae 0x18003cbce
lea rax, [rsp + rax*4 + 0x70]
nop word [rax + rax]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, ecx
vaddss xmm1, xmm0, xmm0
inc ecx
vmovss dword [rax], xmm1
lea rax, [rax + 4]
cmp ecx, 0x1f4
jb 0x18003cbb0
vmovss xmm7, dword [0x1801e46f8]
lea rdi, [rsp + 0x70]
nop dword [rax + rax]
vzeroupper
call fcn.180035790
vmovss xmm6, dword [rdi]
vmovss xmm2, dword [rsp + 0x58]
vmovss xmm1, dword [rsp + 0x50]
vmovaps xmm3, xmm6
mov ecx, eax
call fcn.180031230
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
vmovaps xmm1, xmm7
call fcn.180032f40
mov rax, qword gs:[0x20]
mov rcx, qword [rax]
mov byte [rcx + 0x20], 0
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
vmovss xmm1, dword [rsp + 0x58]
vmovss xmm0, dword [rsp + 0x50]
lea r9, [rsp + 0x60]
vmovaps xmm2, xmm6
call fcn.180031160
test eax, eax
jne 0x18003cc88
inc ebx
add rdi, 4
cmp ebx, 0x1f4
jb 0x18003cbe0
vmovss xmm0, dword [0x1801e47dc]
vmovss dword [rsp + 0x60], xmm0
call fcn.180035790
mov ecx, eax
xor r9d, r9d
mov edx, 0xfbab5776
mov r8d, 1
call fcn.1800356c0
vmovaps xmm6, xmmword [rsp + 0x860]
mov rdi, qword [rsp + 0x870]
mov rbx, qword [rsp + 0x880]
vmovaps xmm7, xmmword [rsp + 0x850]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x878
ret
jmp 0x18003ca50
Function at 0x180065a00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x20], rax
lea rdx, str.Input
mov dword [rsp + 0x38], 0x14
call fcn.180074050
mov byte [0x180214b00], 0
call fcn.180074020
test eax, eax
jne 0x18003c8b3
nop
mov rax, qword gs:[0x20]
mov rcx, qword [rax]
mov byte [rcx + 0x20], 0
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
call fcn.180074020
test eax, eax
je 0x18003c890
call fcn.180073ff0
test rax, rax
je 0x18003ca2f
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
mov byte [0x180214b00], 1
call fcn.180073ff0
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x26], 0x746e65
vmovdqu xmmword [rbp - 0x40], xmm0
mov r14, rax
mov dword [rbp - 0x30], 0x656c6544
mov dword [rbp - 0x2c], 0x75436574
mov word [rbp - 0x28], 0x7272
mov byte [rbp - 0x22], 0
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
xor r15d, r15d
mov word [rbp - 0x27], 0x65
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x30], 0x69766e49
cmp byte [rax], 4
lea rcx, [rax + 8]
vmovdqu xmmword [rbp - 0x40], xmm0
cmovne rcx, r15
mov dword [rbp - 0x2c], 0x6269636e
test rcx, rcx
mov byte [rbp - 0x28], 0x6c
mov byte [rbp - 0x25], r15b
setne sil
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x2e], 0x726143
vmovdqu xmmword [rbp - 0x40], xmm0
cmp byte [rax], 4
lea rcx, [rax + 8]
mov word [rbp - 0x30], 0x6e49
cmovne rcx, r15
mov byte [rbp - 0x2a], r15b
test rcx, rcx
setne dil
call fcn.180021410
vmovdqu xmm0, xmmword [0x1801e5610]
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x28], 0x646564
vmovdqu xmmword [rbp - 0x40], xmm0
cmp byte [rax], 4
lea rcx, [rax + 8]
mov dword [rbp - 0x30], 0x5578614d
cmovne rcx, r15
mov dword [rbp - 0x2c], 0x61726770
test rcx, rcx
mov byte [rbp - 0x24], r15b
setne bl
call fcn.180021410
movzx r9d, dil
mov byte [rsp + 0x20], sil
movzx r8d, bl
cmp byte [rax], 4
lea rcx, [rax + 8]
cmovne rcx, r15
test rcx, rcx
mov rcx, r14
setne dl
call fcn.18003c450
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x80
pop rbp
ret
jmp 0x18003c850

Function at 0x180065a30
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
call fcn.180073fb0
xor ebx, ebx
test eax, eax
sete bl
call fcn.180035790
mov ecx, eax
call fcn.1800350c0
mov ecx, eax
mov edx, ebx
add rsp, 0x20
pop rbx
jmp 0x180073f60
xor eax, eax
mov dword [0x1802145a8], eax
mov dword [0x1802145b8], eax
mov rax, qword [0x1802145b0]
mov dword [rax], ecx
mov eax, dword [0x1802145a8]
inc eax
mov dword [0x1802145a8], eax
mov ecx, eax
mov rax, qword [0x1802145b0]
mov dword [rax + rcx*8], edx
movabs rdx, 0xf4924635a19eb37d
inc dword [0x1802145a8]
jmp fcn.180017460