joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406b64b0
Capabilities:
Encode data using xor

Disassembly:
mov r10, r8
not r8b
pushfq
xor r10, r8
jbe 0x1406b64b6
mov r10, qword [rsp + 0x10]
neg r8
movzx r8, r8w
call fcn.1408569c7

Function at 0x1406cfd55
Capabilities:
Encode data using xor

Disassembly:
or r11b, sil
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x1415003e
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140c39290
push 0xfffffffff7aa8855
pop rcx
xor byte [rdi + 0x55], dh
adc byte [rsi], bl
ror byte [rbp - 0x2d], cl
sub bh, byte [rdi + riz*2]
mov dword [rdx - 0x403466f9], ebp
sub al, 5
and edx, dword [rax + 0x3e385570]
loope 0x1406cfd52
stosb byte [rdi], al
cmpsd dword [rsi], dword [rdi]
and dword [rdx - 0x42], eax
sub al, 0x9b
add eax, 0x26556c02
jo 0x1406cfe16
pop rbx
shl dword [rsi - 0x2ca350b0], cl
push rbx
xchg ebp, eax
invalid
movabs eax, dword [0x8a33873fd434db71]
sbb al, 0xd2
mov bh, bl
std
invalid

Function at 0x14070ba98
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffbf6eb9e3
push rdi
call fcn.14036603a

Function at 0x14071a7d0
Capabilities:
Encode data using xor

Disassembly:
mov rbp, qword [rsp + 0x10]
call fcn.14090249c
cdq
invalid

Function at 0x14073843d
Capabilities:
Encode data using xor

Disassembly:
call fcn.1405a658e
push r9
pushfq
movabs r9, 0x6da206916783415f
xor r9w, 0x4daa
or r9, r9
cmp r9w, 0x4005
movsx r9w, r9w
push r11
mov qword [rsp + 0x18], 0x2c0b641
movabs r9, 0x51d059237c973d60
mov r11, r9
jno 0x14070e3af
int1
sal dword [0xf99f8058], 0x36
mov ebp, 0xf275875c
and cl, byte [rcx]
push rsp
invalid
sub r9d, 0x24303bb1
sub r11b, r11b
sub r11d, 0x60b70b1d
mov r11, qword [rsp]
lea r9, [r9 + r9*2 + 0x50a13aca]
xor r9, 0x19ad63ef
movsx r9d, r9b
setl r9b
not r9b
mov r9, qword [rsp + 0x10]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
call fcn.140c5d55e
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.140b37d8f
push r15
movabs r15, 0x5192017a33a01383
and r14, r14
add qword [rsp + 0x28], 0xffffffffbf3753e4
sub r14b, 0xe5
mov r15, qword [rsp]
not r14w
or r14w, 0x3936
and r14b, 0x4c
and r14, r14
xor r14d, 0x6e4536ad
movabs r14, 0x3aa04ec975b344f3
add r14, 0x4c410503
lea r14, [r14*8 + 0x78456a67]
bswap r14
mov r14, qword [rsp + 0x10]
jb 0x14073843f
jne 0x1405a184f
invalid

Function at 0x1407b5613
Capabilities:
Encode data using xor

Disassembly:
pushfq
movabs r13, 0x2861703f2e966a27
xor r13d, 0x1a5361a3
xor r13d, r13d
neg r13b
neg r13w
mov r13, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x477a6331
add qword [rsp + 0x10], 0x25185f
call fcn.1405e3246

Function at 0x140803a7f
Capabilities:
Encode data using xor

Disassembly:
neg dword [rsp + 0x18]
not r14b
jno 0x1406c4d81

Function at 0x14082792d
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebx
mov eax, 0x6c8b48ff
mov rbp, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x20]
push qword [rsp + 0x30]
popfq
lea rsp, [rsp + 0x38]
call fcn.140b37d8f
add dword [rax + 0x5a], edx
je 0x140827929
invalid
Function at 0x1409cc947
Capabilities:
Encode data using xor

Disassembly:
test word [rsp + 8], 0x6c9e
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.140c39290
movabs byte [0x6842010f0987bdaf], al
sub eax, 0xd8467ff8
ror byte [rdx + 0x1a], cl
mov al, 0x87
nop
push 0x5887b2b2
sbb dh, byte [rax - 0x4d976f79]
mov dl, 0x87
pop rax
lodsd eax, dword [rsi]
fdiv qword [rdx - 0x16143269]
call 0x189019298
push 0xffffffffb642f500
push rdi
push 0x284f174c
cmp al, 0x95
test al, 0xad
out 0x43, eax
cmp byte [0xd85247bc], bl
fadd dword gs:[rax]
mov cl, 0x27
or edi, dword [rdx - 0x7b87b89b]
xor ch, cl
js 0x1409cc96d
invalid

Function at 0x1409df61a
Capabilities:
Authenticate hmac

Disassembly:
mov r10, qword [rsp + 0x18]
or r14b, 0x46
or r14, r14
xor r14b, r14b
or r14d, 0xe020a35
jo 0x140c8bf0a
sub r14b, 0x39
js 0x140a13ca4
push rbp
cmp dx, 0x16b0
mov r10, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x37d7c3da
mov rbp, rdx
cmovg ebp, edx
call fcn.140a4ca3b
call [rbx + rdi + 0x49]
imul rbp, qword [r15 + 0x3e], 9
or r10, qword [rdx - 0x40]
cmpsb byte [rsi], byte [rdi]
sub esp, edi
sub al, 0xc4
invalid
jne 0x1401db9e0
call fcn.140bee542
mov rsi, qword [rsp + 0x28]
call fcn.1409051b6
ja 0x140714db2
sub r14w, 0x4252
mov r14, qword [rsp + 8]
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x20]
call fcn.140b2f108
movabs r14, 0x5cdc64b8199e1528
test r15, r15
mov r15, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0xffffffffa30d6ba4
movzx r14w, r10b
call 0x1409df61a
out dx, eax
stosb byte [rdi], al
jge 0x140c8bfac
call fcn.140543cac
push rdx
pushfq
call fcn.14058a66c
push r9
call fcn.14097ed79
leave
call fcn.140a77b4a
imul rax, qword [r15 + 0x41], 0x55
call fcn.1409a0527
and eax, ebp
sbb dh, byte [rax]
test eax, 0x5241d0ff
pushfq
movabs r10, 0x5d482ace70dc543e
xor r10w, r10w
push rdx
movabs rdx, 0x63461aac3a870f03
test rdx, 0x3c1823e4
jae 0x1406ca291
push rsi
movabs eax, dword [0xf03b318657b62126]
mov byte [rcx], cl
pop rdx
fnstenv [0x117c94aa2]
and bh, byte [rbp - 0x5e]
ret 0x5029
fild dword [rdi + rbx*4]
in al, 0x5f
bswap edx
Function at 0x140a71432
Capabilities:
Encode data using xor

Disassembly:
test bl, 0x65
call fcn.14032ea60
out 2, al
outsd dx, dword [rsi]
stosd dword [rdi], eax
xor ch, byte [rcx - 0x48]
push rbp
mov edx, 0x8eddda59
push 0x5628b6c0
out dx, eax
jne 0x140a7143e
invalid

Function at 0x140aa6796
Capabilities:
Encode data using xor

Disassembly:
movabs r14, 0x5dc65b1071c127ec
xor r14d, 0x621a6f1e
push r12
movabs r12, 0x70b1724a3923339c
mov r14, qword [rsp + 0x10]
or r12w, r12w
jl fcn.140aa6796
pop r12
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140c0e18c

Function at 0x140abd067
Capabilities:
Encode data using xor

Disassembly:
or esi, 0xb572bb9
not si
mov rsi, qword [rsp + 0x10]
mov qword [rsp + 0x10], 0x49b0ba4
add qword [rsp], 0x47d2b6
push rdx
movabs rdx, 0x3d5419d75a8c05e1
neg dl
lea rdx, [rdx + rdx + 0x4257326e]
mov rdx, qword [rsp]
or ebx, dword [rbx + 0x44814804]
and al, 0
mov dh, 0xd2
add byte [r10 + 0x48], r10b
mov edx, 0x5a8c05e1
xlatb
sbb dword [rbp + rdi - 0xa], edx
fimul dword [rax - 0x73]
xchg esp, eax
adc ch, byte [rsi + 0x32]
push rdi
mov rdx, qword [rsp]
call fcn.1403d7345
xor al, 0x91
mov word [0x1b27eef02], ds
loop 0x140abd07b
pop rdi
popfq
invalid

Function at 0x140c59945
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec edx
jmp 0x140b70ff0
jmp r10
rol edx, 1
cmc
test rbp, r8
add edx, 0x4ccf5c9e
test r10w, r11w
cmp bl, 0x1c
neg edx
test sil, 0x84
bswap edx
push rdi
cmc
xor dword [rsp], edx
clc
rcr dil, cl
rcr dil, 0x72
pop rdi
cmp ax, di
stc
movsxd rdx, edx
test ah, 0xf5
cmc
add r10, rdx
jmp 0x140b599a9
push rdx
movsxd rsi, r10d
push r9
mov dl, r14b
movzx dx, r15b
cmovae si, si
push rax
push rbx
cqo
push rbp
cwde
movsx dx, r14b
push r15
bswap ax
lahf
movzx esi, bp
push r12
mov si, ax
movzx rdx, cx
push r11
lahf
mov r9b, dl
push rcx
movsx r10, bp
push r8
lahf
rdtsc
movabs rsi, 0
cbw
movzx r8d, bx
not dh
push rsi
mov r9, qword [rsp + 0x90]
cdq
rdtsc
cqo
dec r9d
btc ax, r13w
cwde
xor rax, rbp
not r9d
movsx edi, sp
bswap ax
sub r9d, 0x11220d8f
btc r10w, 0xe2
bts rax, r9
xor r8d, eax
neg r9d
not r9d
inc r9d
cmp al, r12b
bts r8w, r8w
rcl dl, cl
bswap r9d
not r9d
bts ax, si
movzx di, dil
cmc
add r9, rsi
add r8b, al
btc di, ax
or dil, sil
movabs rax, 0x100000000
add r9, rax
mov r8, rsp
xchg esi, edi
add dh, 0xeb
sub rsp, 0x180
rcl r10d, 0x44
and rsp, 0xfffffffffffffff0
sbb r10b, 0xee
mov rdi, r9
cqo
movabs rsi, 0
shl edx, 0x26
sub rdi, rsi
btr r10w, bx
sal dl, cl
sar dx, 0x6b
lea r10, [0x140c4fe5e]
mov edx, dword [r9]
cmp cl, r13b
add r9, 4
test r15d, r10d
cmc
xor edx, edi
sub edx, 0x594656d
rol edx, 2
dec edx
stc
ror edx, 2
jmp 0x140b3e801
push r10
movzx r10, bp
push rsi
movzx r10w, r14b
xchg sil, sil
push rdi
bswap di
pushfq
movsxd rsi, ebp
sets sil
dec r10w
push r13
mov r10w, 0x5269
movsx di, cl
push r14
movsx r10, r10w
jmp 0x140c4fd5b
Function at 0x1800018d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x180001a63
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x180001a63
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x180001969
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x180001a87
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000197f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x18000197f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x180001992
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x1800019dd
mov r9d, eax
cmp eax, 0x800
jae 0x1800019ac
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1800019dd
cmp eax, 0x10000
jae 0x1800019c6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x1800019dd
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x180001a63
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x180001a01
cmp r10d, 3
jae 0x180001a0d
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x180001a3e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x180001a20
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x18000191e
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x180001a72

Function at 0x180005400
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x180005439
xor eax, eax
lea r8, [0x18000b760]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180006120
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x180006226
mov rax, qword [rsi + 0x38]
shr rax, 3
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rdi
cmp rax, rcx
jbe 0x1800062c7
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x20], r14
mov r14, qword [rsi + 8]
mov rbp, qword [r14]
cmp rbp, r14
je 0x180006212
movzx ecx, byte [rbp + 0x10]
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rsi + 0x18]
xor rcx, rax
movzx eax, byte [rbp + 0x11]
movabs r8, 0x100000001b3
imul rcx, r8
mov qword [r11 - 0x10], r12
mov rbx, rbp
mov r12, qword [rbp + 8]
xor rcx, rax
imul rcx, r8
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x28], r15
mov r15, qword [rsi + 0x30]
and r15, rcx
mov qword [rsp + 0x20], rdx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov r13, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.180063790
dec qword [rsi + 0x10]
cmp rdi, r13
je 0x18000622c
cmp rbx, r14
jne 0x1800061d0
cmp qword [rsp + 0x28], rbp
jne 0x1800061fb
mov qword [r15], rbx
mov r13, qword [rsp + 0x40]
mov r15, qword [rsp + 0x30]
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
cmp qword [rsp + 0x28], rbp
jne 0x18000623b
mov qword [r15], r14
mov rax, r14
jmp 0x18000623e
mov rax, r12
mov qword [r15 + 8], rax
cmp rbx, r14
je 0x1800061fb
mov r13, qword [rsp + 0x20]
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rdx, 0x100000001b3
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, r13
mov rbp, qword [r15 + 8]
nop word [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.180063790
dec qword [rsi + 0x10]
cmp rdi, rbp
je 0x1800062b6
cmp rbx, r14
jne 0x180006290
jmp 0x1800061f8
mov qword [r15], r14
mov qword [r15 + 8], r14
cmp rbx, r14
jne 0x180006250
jmp 0x1800061fb
mov rcx, qword [rsi + 8]
xor edi, edi
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800062f5
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.180063790
mov rcx, rbx
test rbx, rbx
jne 0x1800062e0
mov rax, qword [rsi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
mov qword [rsi + 0x10], rdi
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180006b30
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x1800064d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x180006505
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.180002f60
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x180006635
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx r11d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r11, rbp
mov rcx, qword [rcx]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x1800065a7
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180006624
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x1800065e6
mov r10, qword [rdx]
cmp r10, rax
je 0x1800065e0
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180006624
cmp r8, rdx
je 0x180006600
nop dword [rax + rax]
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x180006646
cmp r8, rdx
jne 0x1800065f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x180006570
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006624
Function at 0x180006bc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
mov rcx, qword [rbp + 0x30]
and rcx, rsi
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x180006c2f
mov rbx, r12
mov r15, r12
jmp 0x180006c78
mov rcx, qword [rax + rcx*8]
movzx eax, word [r8]
cmp ax, word [rbx + 0x10]
je 0x180006c4f
nop dword [rax]
cmp rbx, rcx
je 0x180006c72
mov rbx, qword [rbx + 8]
cmp ax, word [rbx + 0x10]
jne 0x180006c40
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
jne 0x180006c96
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.180063798
mov rdi, rax
mov qword [rsp + 0x28], rax
movzx eax, word [r13]
mov word [rdi + 0x10], ax
mov rdx, qword [rbp + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x180006cd3
cvtsi2ss xmm0, rdx
jmp 0x180006ceb
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x180006cfe
cvtsi2ss xmm1, rcx
jmp 0x180006d13
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x180006d92
mov rcx, rbp
call fcn.180006670
mov rdx, rax
mov rcx, rbp
call fcn.1800064d0
mov rdx, rsi
and rdx, qword [rbp + 0x30]
add rdx, rdx
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
jne 0x180006d5c
mov qword [rsp + 0x28], 0
jmp 0x180006d85
mov rdx, qword [rcx + rdx*8]
movzx ecx, word [rdi + 0x10]
cmp cx, word [rax + 0x10]
je 0x180006d82
nop word [rax + rax]
mov rbx, rax
cmp rax, rdx
je 0x180006dc3
mov rax, qword [rax + 8]
cmp cx, word [rax + 0x10]
jne 0x180006d70
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x180006dd3
mov qword [rax + rsi*8], rdi
jmp 0x180006de5
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x180006d8a
cmp rdx, r15
jne 0x180006dde
mov qword [rax + rsi*8], rdi
jmp 0x180006dea
cmp qword [rax + rsi*8 + 8], rcx
jne 0x180006dea
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x180006c57
Function at 0x18000d770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
mov r8d, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov r8d, dword [rcx + rax]
cmp dword [0x180098e14], r8d
jle 0x18000d7f2
lea rcx, [0x180098e14]
call fcn.180063c38
cmp dword [0x180098e14], 0xffffffff
jne 0x18000d7f2
mov edx, 2
lea rsi, [0x180098f70]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066430]
call fcn.180063b78
lea rcx, [0x180098e14]
call fcn.180063bcc
jmp 0x18000d7f9
lea rsi, [0x180098f70]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d817
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098fbc], 0x7fffffff
jne 0x18000d839
mov dword [0x180098fbc], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d84a
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000d883
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000d870
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000d8ae
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000d8df
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000d8bb
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000d927
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000d930
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18000d940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov edx, dword [0x1800988f4]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + rdx*8]
mov edx, dword [rcx + rax]
cmp dword [0x180098e10], edx
jle 0x18000d9be
lea rcx, [0x180098e10]
call fcn.180063c38
cmp dword [0x180098e10], 0xffffffff
jne 0x18000d9be
mov edx, 2
lea rsi, [0x180098d60]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x180066420]
call fcn.180063b78
lea rcx, [0x180098e10]
call fcn.180063bcc
jmp 0x18000d9c5
lea rsi, [0x180098d60]
mov qword [rsp + 0x58], rsi
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x18000d9e3
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
cmp dword [0x180098dac], 0x7fffffff
jne 0x18000da05
mov dword [0x180098dac], 0x7ffffffe
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000da16
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18000da44
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18000da31
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180010ee0
cmp qword [rax + 8], 0
je 0x18000da6f
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18000daa0
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18000da7c
mov rdx, qword [rdi]
mov rcx, qword [0x180098cf0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x18000dae2
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.18000f4f0
mov rax, qword [rax]
call qword [rax + 0x30]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rax, rbx
jmp 0x18000daeb
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret