joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800dfee0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x1800dff67
mov rbx, r15
mov rbp, r15
jmp 0x1800dffaa
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800dff81
cmp rbx, rcx
je 0x1800dffa4
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800dff73
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rsi + 0x10], rax
jne 0x1800dffc8
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18012c300
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xor eax, eax
mov qword [rdi + 0x14], rax
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1800e0009
cvtsi2ss xmm0, rcx
jmp 0x1800e001e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800e0031
cvtsi2ss xmm1, rcx
jmp 0x1800e0046
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x1800e00b1
mov rcx, rsi
call fcn.1800e0120
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x1800e0083
mov qword [rsp + 0x28], 0
jmp 0x1800e00a4
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800e00a1
nop
mov rbx, rax
cmp rax, rdx
je 0x1800e00e5
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800e0090
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x1800e00f5
mov qword [rcx + rax*8], rdi
jmp 0x1800e0107
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x1800e00a9
cmp r8, rbp
jne 0x1800e0100
mov qword [rcx + rax*8], rdi
jmp 0x1800e010c
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1800e010c
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x1800dff89
Function at 0x1800e7e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1800e7e74
cmp ecx, r10d
jge 0x1800e7e62
mov rcx, rbx
call fcn.1800e7620
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1800e7eae
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1800e7e90
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1800e7edd
mov edx, dword [0x180357864]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1800e7f0f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x1800e7ef9
xor dl, dl
jmp 0x1800e7f02
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800e7ef0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1800e7eb2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1800e7f84
mov edx, dword [0x180357864]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1800e7f9e
mov rcx, rbx
call fcn.1800e7770
test eax, eax
je 0x1800e7f77
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1800f3370
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword gs:[0x58]
lea rsi, [0x18035b640]
mov ecx, dword [0x180357864]
mov ebx, 1
mov ebp, 8
movaps xmmword [rsp + 0x20], xmm6
mov rdi, qword [rax + rcx*8]
mov eax, dword [rdi + rbp]
cmp dword [0x18035b630], eax
jle 0x1800f342a
lea rcx, [0x18035b630]
call fcn.18012c8d8
cmp dword [0x18035b630], 0xffffffff
jne 0x1800f342a
mov r8d, 0x1571
mov dword [0x18035c9c4], 0xffffffff
mov dword [0x18035b644], r8d
mov edx, ebx
nop word [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, edx
mov dword [rsi + rdx*4 + 4], r8d
inc rdx
cmp rdx, 0x270
jb 0x1800f33f0
lea rcx, [0x18035b630]
mov dword [0x18035b640], 0x270
call fcn.18012c86c
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
mov rcx, rdx
sar rcx, 0xb
mov rax, rcx
shr rax, 0x3f
add rcx, rax
mov dword [0x18035b644], ecx
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, ebx
mov dword [rsi + rbx*4 + 4], ecx
inc rbx
cmp rbx, 0x270
jb 0x1800f3460
mov eax, dword [rdi + rbp]
xorps xmm6, xmm6
cmp dword [0x18035b634], eax
mov dword [0x18035b640], 0x270
jle 0x1800f34d0
lea rcx, [0x18035b634]
call fcn.18012c8d8
cmp dword [0x18035b634], 0xffffffff
jne 0x1800f34d0
lea rcx, [0x18035b634]
mov dword [0x18035b628], 0
mov dword [0x18035b62c], 0x3f800000
call fcn.18012c86c
nop dword [rax]
call fcn.1800f7cd0
movss xmm1, dword [0x18035b62c]
xorps xmm2, xmm2
subss xmm1, dword [0x18035b628]
mov rcx, qword [0x18035ac58]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movss xmm0, dword [rcx + 0x81c]
mov eax, eax
cvtsi2ss xmm2, rax
xor eax, eax
subss xmm2, xmm6
addss xmm2, xmm6
movaps xmm6, xmmword [rsp + 0x20]
mulss xmm2, dword [0x18032a638]
mulss xmm1, xmm2
addss xmm1, dword [0x18035b628]
comiss xmm0, xmm1
setb al
add rsp, 0x30
pop rdi
ret
Function at 0x1800f3a50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
movaps xmmword [rsp + 0x30], xmm6
mov rcx, qword [rax + 0x10]
add rcx, 8
call fcn.180074420
mov ecx, 1
mov rbp, rax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
movzx edi, ax
setne sil
test ax, ax
je 0x1800f3afd
mov rdx, qword [0x18035b138]
lea rcx, [rbx + 0x60]
mov r8, qword [rdx + 0x48]
lea rdx, [rsp + 0x20]
movsd xmm6, qword [r8 + 0x20]
mov r8, qword [0x18035ac58]
cvtpd2ps xmm6, xmm6
add r8, 0x828
divss xmm6, dword [0x18032a844]
call fcn.1800f7600
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mulss xmm6, dword [rax + 0x10]
xorps xmm0, xmm0
addss xmm6, dword [rbx + 0x110]
comiss xmm0, xmm6
ja 0x1800f3b61
movss xmm0, dword [0x18032a704]
minss xmm0, xmm6
jmp 0x1800f3b61
mov rax, qword [0x18035b138]
lea rdx, [rsp + 0x20]
mov r8, qword [0x18035ac58]
add r8, 0x828
mov rcx, qword [rax + 0x48]
movsd xmm6, qword [rcx + 0x20]
lea rcx, [rbx + 0x60]
cvtpd2ps xmm6, xmm6
divss xmm6, dword [0x18032a844]
call fcn.1800f7600
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
movss xmm1, dword [rbx + 0x110]
xorps xmm0, xmm0
mulss xmm6, dword [rax + 0x14]
subss xmm1, xmm6
comiss xmm0, xmm1
ja 0x1800f3b61
movss xmm0, dword [0x18032a704]
minss xmm0, xmm1
movaps xmm6, xmmword [rsp + 0x30]
movss dword [rbx + 0x110], xmm0
cmp sil, byte [rbx + 0x108]
je 0x1800f3bdb
test di, di
je 0x1800f3bd4
mov rax, qword [0x18035ac58]
cmp byte [rax + 0x818], 0
je 0x1800f3bc3
cmp dword [rax + 0x828], 2
jne 0x1800f3bc3
cmp dword [rax + 0x824], 1
jne 0x1800f3bc3
call fcn.1800f3370
mov rcx, qword [0x18035ac58]
mov dword [rcx + 0x820], eax
mov rcx, qword [0x18035ac58]
add rcx, 0x820
call fcn.18007c5c0
mov rax, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
add rcx, 8
call fcn.180074420
mov byte [rbx + 0x108], sil
mov edi, dword [rbp + 0x44]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
cmp edi, dword [rbx + 0x10c]
je 0x1800f3c47
mov rax, qword [0x18035ac58]
cmp byte [rax + 0x818], 0
je 0x1800f3c37
cmp dword [rax + 0x828], 2
jne 0x1800f3c37
cmp dword [rax + 0x824], 0
jne 0x1800f3c37
call fcn.1800f3370
mov rcx, qword [0x18035ac58]
mov dword [rcx + 0x820], eax
mov rcx, qword [0x18035ac58]
add rcx, 0x820
call fcn.18007c5c0
mov dword [rbx + 0x110], 0
mov dword [rbx + 0x10c], edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1800f7600
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, qword [rbp + 0x30]
and rcx, rsi
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x1800f7687
mov rbx, r12
mov r15, r12
jmp 0x1800f76ca
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800f76a1
cmp rbx, rcx
je 0x1800f76c4
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800f7693
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rbp + 0x10], rax
jne 0x1800f76e8
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18012c300
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xor r13d, r13d
mov qword [rdi + 0x18], r13
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1800f772a
cvtsi2ss xmm0, rcx
jmp 0x1800f773f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800f7752
cvtsi2ss xmm1, rcx
jmp 0x1800f7767
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
seta al
test al, al
je 0x1800f77c7
mov rcx, rbp
call fcn.1800e0120
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
je 0x1800f77ba
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800f77b7
mov rbx, rax
cmp rax, rdx
je 0x1800f77f8
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800f77a6
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x1800f77ff
mov qword [rax + rsi*8], rdi
jmp 0x1800f7811
mov qword [rsp + 0x20], rax
jmp 0x1800f77bf
cmp rdx, r15
jne 0x1800f780a
mov qword [rax + rsi*8], rdi
jmp 0x1800f7816
cmp qword [rax + rsi*8 + 8], rcx
jne 0x1800f7816
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x1800f76a9
Function at 0x1800f7cd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, dword [0x18035b640]
lea r11, [0x18035b640]
mov r9d, 0x270
cmp r8d, r9d
jne 0x1800f7d35
lea r8, [0x18035b648]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1800f7cf0
mov r8d, dword [0x18035b640]
jmp 0x1800f7e0f
cmp r8d, 0x4e0
jb 0x1800f7e0f
xor r8d, r8d
mov r9d, 0x38c
mov r10d, r8d
nop
mov eax, dword [r10 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r10 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + r11 + 0xff8]
xor ecx, edx
mov dword [r10 + r11 + 4], ecx
add r10, 4
cmp r10, r9
jb 0x1800f7d50
mov eax, dword [r9 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r9 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + r11 - 0x388]
xor ecx, edx
mov dword [r9 + r11 + 4], ecx
add r9, 4
cmp r9, 0x9bc
jb 0x1800f7d90
mov edx, dword [0x18035b644]
xor edx, dword [0x18035c9c0]
btr edx, 0x1f
mov dword [0x18035b640], r8d
xor edx, dword [0x18035c9c0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [0x18035bc74]
mov dword [0x18035c000], ecx
mov eax, r8d
inc r8d
mov ecx, dword [r11 + rax*4 + 4]
mov eax, ecx
shr eax, 0xb
and eax, dword [0x18035c9c4]
xor ecx, eax
mov dword [0x18035b640], r8d
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x1800f9880
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x180350010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
mov r15, rdx
mov r14, rcx
cmp r8, 0xe
jae 0x1800f98af
xor eax, eax
jmp 0x1800f9a40
xor ecx, ecx
mov qword [rsp + 0x68], rbx
lea rdx, [r8 + 0xe]
mov qword [rsp + 0x38], rbp
mov r8d, 0x3000
mov qword [rsp + 0x30], rdi
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbp, rax
test rax, rax
je 0x1800f98f8
mov r8, rsi
mov rcx, rax
test r14, r14
je 0x1800f98f1
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1800f990a
xor edx, edx
call fcn.18012d546
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_shutdown
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov dword [rsi + rbp], 0x25ff
lea rdi, [rsi + r14]
mov word [rsi + rbp + 4], 0
mov rbx, rdi
mov byte [rsi + rbp + 6], dil
mov r11, rdi
shr r11, 0x10
mov r10, rdi
shr r10, 0x18
mov r9, rdi
shr r9, 0x20
mov rdx, rdi
shr rdx, 0x28
mov rcx, rdi
shr rcx, 0x30
mov rax, rdi
shr rax, 0x38
mov r8d, 0x40
shr rbx, 8
mov byte [rsi + rbp + 7], bl
mov byte [rsi + rbp + 8], r11b
mov byte [rsi + rbp + 9], r10b
mov byte [rsi + rbp + 0xa], r9b
lea r9, [rsp + 0x20]
mov byte [rsi + rbp + 0xb], dl
mov rdx, rsi
mov byte [rsi + rbp + 0xc], cl
mov rcx, r14
mov byte [rsi + rbp + 0xd], al
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [r14], 0x25ff
mov r11, r15
mov word [r14 + 4], 0
mov r10, r15
mov byte [r14 + 6], r15b
mov r9, r15
shr r9, 0x18
mov r8, r15
shr r11, 8
mov rdx, r15
mov byte [r14 + 7], r11b
mov rcx, r15
shr r10, 0x10
mov rax, r15
mov byte [r14 + 8], r10b
mov byte [r14 + 9], r9b
mov r9d, select
shr r8, 0x20
mov byte [r14 + 0xa], r8b
shr rdx, 0x28
mov byte [r14 + 0xb], dl
shr rcx, 0x30
mov byte [r14 + 0xc], cl
shr rax, 0x38
mov byte [r14 + 0xd], al
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
cmp rsi, r9
jbe 0x1800f9a22
lea rax, [r14 + 0xe]
nop dword [rax + rax]
inc r9d
mov byte [rax], 0x90
movsxd r8, r9d
lea rax, [rax + 1]
cmp r8, rsi
jb 0x1800f9a10
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, rbp
mov rbp, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18012c2e0
add rsp, 0x40
pop r15
pop r14
pop rsi
ret

Function at 0x1800f9a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180350010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, r8
lea r9, [rsp + 0x20]
mov rbx, rdx
mov r8d, 0x40
mov rdx, rsi
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, rsi
mov rdx, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18012c2e0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800fa2d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
mov r10, qword [rdx + 0x10]
mov rsi, rcx
mov r8, rdx
jb 0x1800fa2f1
mov r8, qword [rdx]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800fa324
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r8]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r10
jb 0x1800fa310
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180098e30
mov rcx, qword [rax + 8]
test rcx, rcx
cmove rcx, qword [rsi + 8]
cmp rcx, qword [rsi + 8]
je 0x1800fa390
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800ff370
mov rcx, qword [rax]
mov rax, qword [rcx + 0x38]
sub rax, qword [rcx + 0x30]
sar rax, 3
cmp rax, 1
jb 0x1800fa390
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800ff370
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov rax, qword [rax]
mov rsi, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1800fa3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
mov r10, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1800fa3c3
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800fa3f3
movabs r8, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r8
inc rcx
cmp rcx, r10
jb 0x1800fa3e0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.180098e30
mov rcx, qword [rax + 8]
test rcx, rcx
cmove rcx, qword [rsi + 8]
cmp rcx, qword [rsi + 8]
jne 0x1800fa48c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800ff370
mov rcx, qword [rax]
add rcx, 0x30
lea rdx, [rsp + 0x30]
call fcn.1800fe520
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1800fa48c
mov rdx, qword [rsp + 0x40]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800fa487
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800fa487
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18012c40c
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1800ff370
mov rdx, qword [rax]
mov rax, qword [rdx + 0x38]
sub rax, qword [rdx + 0x30]
sar rax, 3
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
cmp rax, 1
jae 0x1800fa4f7
call fcn.1800ff370
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1800fa4e2
mov qword [rdx], rbp
add qword [rcx + 8], 8
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x80]
call fcn.1800898d0
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.1800ff370
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rax], rbp
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x180100420
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x180350010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov ecx, 8
call fcn.18012c300
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180100ac0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x180100499
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18012c2e0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180100b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rdi, r8
mov r8, qword [rdx + 0x10]
mov rsi, rdx
mov rbx, rcx
jb 0x180100b3b
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180100b73
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x180100b60
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x80]
call fcn.180098e30
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x180100b97
mov rcx, qword [rbx + 0x88]
cmp rcx, qword [rbx + 0x88]
je 0x180100bf1
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x80]
call fcn.1800fedd0
mov rcx, qword [rax]
mov rcx, qword [rcx + 0x30]
test rcx, rcx
je 0x180100bf1
cmp qword [rdi + 0x18], 0x10
mov rax, qword [rdi + 0x10]
jb 0x180100bce
mov rdi, qword [rdi]
cmp qword [rcx + 0x18], 0x10
mov r8, qword [rcx + 0x10]
jb 0x180100bdc
mov rcx, qword [rcx]
cmp r8, rax
jne 0x180100bf1
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180100bf1
mov al, 1
jmp 0x180100bf3
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180107350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180350010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov rdi, r8
cmp qword [r8 + 0x18], 0x10
jb 0x180107382
mov rdi, qword [r8]
mov rbp, qword [r8 + 0x10]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x38]
call fcn.180086870
nop
lea rcx, [rsp + 0x38]
mov rax, qword [rsp + 0x38]
mov r9, qword [rsp + 0x50]
cmp r9, 0x10
cmovae rcx, rax
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1801073e8
mov rax, rbx
nop
xor edx, edx
div rbp
movzx eax, byte [rdx + rdi]
xor byte [rcx], al
inc ebx
lea rcx, [rcx + 1]
movsxd rax, ebx
cmp rax, r8
jb 0x1801073c0
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x38]
lea rdx, [rsp + 0x38]
cmp r9, 0x10
cmovae rdx, rax
mov rcx, rsi
call fcn.1801070f0
nop
lea rcx, [rsp + 0x38]
call fcn.180071b60
nop
mov rax, rsi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18012c2e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret