joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140168b30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov rdi, rdx
mov rbx, rcx
movzx ebp, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rbp, rax
movabs rcx, 0x100000001b3
imul rbp, rcx
movzx eax, byte [r8 + 1]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 2]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 3]
xor rbp, rax
imul rbp, rcx
mov r8, qword [rbx + 0x30]
and r8, rbp
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov r14, qword [rbx + 8]
cmp rdx, r14
je 0x140168c00
add r8, r8
mov rcx, qword [rax + r8*8]
mov eax, dword [r15]
cmp eax, dword [rdx + 0x10]
je 0x140168bd4
cmp rdx, rcx
je 0x140168bfd
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140168bc6
mov qword [rdi], rdx
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov r14, rdx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbx + 0x10], rax
je 0x140168d1c
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x38], r12
lea ecx, [r12 + 0x18]
call fcn.1401f0dd4
mov rsi, rax
mov qword [rsp + 0x38], rax
mov ecx, dword [r15]
mov dword [rax + 0x10], ecx
mov dword [rax + 0x14], r12d
mov rcx, qword [rbx + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140168c5a
cvtsi2ss xmm0, rcx
jmp 0x140168c6f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbx + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140168c82
cvtsi2ss xmm1, rcx
jmp 0x140168c97
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbx]
jbe 0x140168cf3
mov rcx, rbx
call fcn.140178290
mov r8, qword [rbx + 0x30]
and r8, rbp
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rax, qword [rbx + 8]
cmp rdx, rax
je 0x140168ce9
add r8, r8
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + r8*8]
mov eax, dword [rsi + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x140168ce6
cmp rdx, rcx
je 0x140168d15
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x140168cd8
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0x20]
mov qword [rsp + 0x38], r12
mov r9, rsi
mov r8, r14
mov rdx, rbp
mov rcx, rbx
call fcn.1400d6fc0
mov qword [rdi], rax
mov byte [rdi + 8], 1
jmp 0x140168bdb
mov qword [rsp + 0x20], rdx
jmp 0x140168cee
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14017b160
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x59], esi
mov dword [rbp - 0x55], 0xffffffff
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x14017b1a6
mov r8, qword [rdx]
mov rax, qword [rdx + 0x10]
mov qword [rbp - 9], r8
mov qword [rbp - 1], rax
mov qword [rbp - 0x49], sendto
lea rax, [rbp - 9]
mov qword [rbp - 0x41], rax
lea rax, str.SELECT_Number_FROM_MSFT_Disk_WHERE_UniqueId__
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], gethostname
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
movaps xmm1, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm1
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call fcn.14016d1d0
mov ebx, 1
mov dword [rbp - 0x59], ebx
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
jb 0x14017b2fb
mov rcx, qword [rbp - 0x29]
test rcx, rcx
jne 0x14017b2fb
mov qword [rbp - 0x49], rsi
and ebx, 0xfffffffe
mov dword [rbp - 0x59], ebx
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x14017b266
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
cmp rdx, 0x1000
jb 0x14017b261
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017b310
mov rcx, r8
call fcn.140096c70
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], si
mov qword [rbp + 0x3f], rsi
lea rax, [0x140343050]
mov qword [rbp + 7], rax
lea rax, [rbp - 0x55]
mov qword [rbp + 0xf], rax
lea rax, [rbp + 7]
mov qword [rbp + 0x3f], rax
mov rcx, qword [rdi]
add rcx, 0x10
lea r8, [rbp + 7]
lea rdx, [rbp - 0x49]
call fcn.140179060
nop
mov rcx, qword [rbp + 0x3f]
test rcx, rcx
je 0x14017b2c7
mov rax, qword [rcx]
lea rdx, [rbp + 7]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x3f], rsi
mov ebx, dword [rbp - 0x55]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, ebx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401f11e0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop
mov qword [rbp - 0x49], rax
test rax, rax
je 0x14017b317
jmp 0x14017b220
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x8007000e
call fcn.14010cf30
int3
Function at 0x14017b330
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x79], esi
mov qword [rbp - 0x49], rsi
call fcn.14017b160
nop
mov dword [rbp + 0x27], eax
mov qword [rbp - 0x69], 2
lea rax, [rbp + 0x27]
mov qword [rbp - 0x61], rax
lea rax, str.SELECT_DriveLetter_FROM_MSFT_Partition_WHERE_DiskNumber__
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x51], 0x3e
movaps xmm0, xmmword [rbp - 0x69]
movdqa xmmword [rbp - 0x69], xmm0
movaps xmm1, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm1
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x41]
call fcn.14016d1d0
mov ebx, 1
mov dword [rbp - 0x79], ebx
lea rcx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
jb 0x14017b4b8
mov rcx, qword [rbp - 0x41]
test rcx, rcx
jne 0x14017b4b8
mov qword [rbp - 0x69], rsi
and ebx, 0xfffffffe
mov dword [rbp - 0x79], ebx
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x14017b41b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
cmp rdx, 0x1000
jb 0x14017b416
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017b4cd
mov rcx, r8
call fcn.140096c70
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], si
mov qword [rbp - 0x59], rdi
lea rax, [rbp - 0x49]
mov qword [rbp - 0x51], rax
mov qword [rbp + 0x1f], rsi
lea rax, [0x140343018]
mov qword [rbp - 0x19], rax
movups xmm0, xmmword [rbp - 0x59]
movups xmmword [rbp - 0x11], xmm0
lea rax, [rbp - 0x19]
mov qword [rbp + 0x1f], rax
mov rcx, qword [rdi]
add rcx, 0x10
lea r8, [rbp - 0x19]
lea rdx, [rbp - 0x69]
call fcn.140179060
nop
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14017b488
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x1f], rsi
mov rbx, qword [rbp - 0x49]
mov rcx, qword [rbp - 0x69]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, rbx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401f11e0
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop
mov qword [rbp - 0x69], rax
test rax, rax
je 0x14017b4d4
jmp 0x14017b3d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x8007000e
call fcn.14010cf30
int3
Function at 0x14017da60
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdi, rcx
xor esi, esi
mov dword [rbp - 0x69], esi
mov qword [rbp - 0x49], rsi
mov word [rbp + 0x37], dx
mov qword [rbp - 0x59], 9
lea rax, [rbp + 0x37]
mov qword [rbp - 0x51], rax
lea rax, str.SELECT_SizeRemaining_FROM_MSFT_Volume_WHERE_DriveLetter__
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], 0x3e
movaps xmm0, xmmword [rbp - 0x59]
movdqa xmmword [rbp - 0x59], xmm0
movaps xmm1, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm1
lea r8, [rbp - 0x59]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x29]
call fcn.14016d1d0
mov ebx, 1
mov dword [rbp - 0x69], ebx
lea rcx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
jb 0x14017dbe5
mov rcx, qword [rbp - 0x29]
test rcx, rcx
jne 0x14017dbe5
mov qword [rbp - 0x59], rsi
and ebx, 0xfffffffe
mov dword [rbp - 0x69], ebx
mov rdx, qword [rbp - 0x11]
cmp rdx, 8
jb 0x14017db4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x29]
cmp rdx, 0x1000
jb 0x14017db49
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14017dbfa
mov rcx, r8
call fcn.140096c70
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], 7
mov word [rbp - 0x29], si
mov qword [rbp + 0x2f], rsi
lea rax, vtable.std::_Func_impl_no_alloc_class__private:_unsigned_long_long_unsigned___int64____cdecl_eax::services::systemInfo::SystemInfoProvider::getVolumeRemainingSpace_wchar_t____ptr64::_2::_lambda_1___bool__class_ATL::CComPtr_struct_IWbemClassObject_____ptr64_.0
mov qword [rbp - 9], rax
lea rax, [rbp - 0x49]
mov qword [rbp - 1], rax
lea rax, [rbp - 9]
mov qword [rbp + 0x2f], rax
mov rcx, qword [rdi]
add rcx, 0x10
lea r8, [rbp - 9]
lea rdx, [rbp - 0x59]
call fcn.140179060
nop
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x14017dbaf
mov rax, qword [rcx]
lea rdx, [rbp - 9]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x2f], rsi
mov rbx, qword [rbp - 0x49]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rax, rbx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401f11e0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
nop
mov qword [rbp - 0x59], rax
test rax, rax
je 0x14017dc01
jmp 0x14017db08
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x8007000e
call fcn.14010cf30
int3
Function at 0x140185610
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x30
mov rbx, rdx
mov r10, rcx
xor r11d, r11d
mov dword [rsp + 0x20], r11d
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [rsp + 0x51]
xor r9, rax
imul r9, rcx
movzx eax, byte [rsp + 0x52]
xor r9, rax
imul r9, rcx
movzx eax, byte [rsp + 0x53]
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x58]
and rcx, r9
lea rax, [rcx + rcx]
mov rdx, qword [r10 + 0x40]
mov rdx, qword [rdx + rax*8 + 8]
cmp rdx, qword [r10 + 0x30]
je 0x1401856b1
add rcx, rcx
mov rax, qword [r10 + 0x40]
mov rcx, qword [rax + rcx*8]
cmp r8d, dword [rdx + 0x10]
je 0x1401856b4
nop dword [rax + rax]
cmp rdx, rcx
je 0x1401856b1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
jne 0x1401856a0
jmp 0x1401856b4
mov rdx, r11
test rdx, rdx
jne 0x1401856bd
mov rdx, qword [r10 + 0x30]
cmp rdx, qword [r10 + 0x30]
je 0x1401856d1
add rdx, 0x18
mov rcx, rbx
call fcn.14003ae50
jmp 0x1401856e6
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r11
mov qword [rbx + 0x18], sendto
mov byte [rbx], r11b
mov dword [rsp + 0x20], 1
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x14018a390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
movss xmm2, dword [0x14029999c]
mov r11d, 0x138
mov r8, rcx
xorps xmm1, xmm1
cmp dword [rcx], r11d
jne 0x14018a405
lea r9, [rcx + 0x10]
movabs r10, 0xb5026f5aa96619e9
nop word [rax + rax]
mov eax, dword [r9]
mov rdx, qword [r9 - 8]
lea r9, [r9 + 8]
btr eax, 0x1f
and rdx, 0xffffffff80000000
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 + 0x4d0]
xor rcx, rdx
mov qword [r9 + 0x9b0], rcx
sub r11, 1
jne 0x14018a3c0
jmp 0x14018a4fc
cmp dword [rcx], 0x270
jb 0x14018a4fc
lea r9, [rcx + 0x9c8]
mov r11d, 0x9c
movabs r10, 0xb5026f5aa96619e9
nop dword [rax + rax]
mov edx, dword [r9 + 8]
mov rax, qword [r9]
lea r9, [r9 + 8]
and rax, 0xffffffff80000000
btr edx, 0x1f
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x14018a430
lea r9, [r8 + 0xea8]
mov r11d, 0x9b
nop dword [rax]
mov edx, dword [r9 + 8]
mov rax, qword [r9]
lea r9, [r9 + 8]
and rax, 0xffffffff80000000
btr edx, 0x1f
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x14018a480
mov eax, dword [r8 + 8]
mov rdx, qword [r8 + 0x1380]
btr eax, 0x1f
and rdx, 0xffffffff80000000
or rdx, rax
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r10
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
mov qword [r8 + 0x9c0], rcx
mov dword [r8], r11d
mov eax, dword [r8]
movabs rdx, 0x38eb3ffff6d3
xorps xmm0, xmm0
mov rcx, qword [r8 + rax*8 + 8]
inc dword [r8]
mov rax, rcx
shr rax, 0x1d
and rax, qword [r8 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x14018a555
cvtsi2ss xmm0, rdx
jmp 0x14018a56a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
subss xmm0, xmm1
mulss xmm0, xmm2
mulss xmm2, dword [0x140330ee4]
addss xmm1, xmm0
divss xmm1, xmm2
movaps xmm0, xmm1
ret
Function at 0x14018a590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1400
call fcn.1401f1180
sub rsp, rax
movaps xmmword [rsp + 0x13f0], xmm6
movaps xmmword [rsp + 0x13e0], xmm7
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov rsi, rdx
mov rdi, rcx
call fcn.14003d1c0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x38], sendto
mov edx, 0x20
lea rcx, [rsp + 0x20]
call fcn.14002d7f0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], SafeArrayPutElement
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.telemetry.disableCulling]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1403441a0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14003a990
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14018a68f
inc rdx
mov rcx, qword [rsp + 0x20]
cmp rdx, 0x1000
jb 0x14018a68a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14018a76a
mov rcx, r8
call fcn.140096c70
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], sendto
mov byte [rsp + 0x20], 0
test bl, bl
jne 0x14018a766
cmp byte [rsi + 0x5d], bl
jne 0x14018a766
xorps xmm7, xmm7
comiss xmm7, dword [rdi + 0x40]
jae 0x14018a766
movss xmm0, dword [rdi + 0x40]
movss xmm6, dword [0x14029999c]
comiss xmm0, xmm6
jae 0x14018a771
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13c8], rax
mov qword [rsp + 0x48], rdx
mov ecx, 1
movabs r8, 0x5851f42d4c957f2d
nop word [rax + rax]
mov rax, rdx
shr rax, 0x3e
xor rdx, rax
imul rdx, r8
add rdx, rcx
mov qword [rsp + rcx*8 + 0x48], rdx
inc rcx
cmp rcx, 0x138
jb 0x14018a710
mov dword [rsp + 0x40], 0x138
lea rcx, [rsp + 0x40]
call fcn.14018a390
addss xmm0, xmm7
comiss xmm0, dword [rdi + 0x40]
jb 0x14018a771
subss xmm6, dword [rdi + 0x40]
movss xmm0, dword [rdi + 0x40]
divss xmm0, xmm6
addss xmm0, dword [rsi + 0x54]
movss dword [rsi + 0x54], xmm0
xor al, al
jmp 0x14018a773
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov al, 1
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1401f11e0
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14018f410
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x30], esi
movsd xmm0, qword [0x140330eb8]
divsd xmm0, xmm1
mulsd xmm0, qword [0x14033a708]
cvttsd2si eax, xmm0
cdqe
cmp dword [rcx + 0xd8], esi
jne 0x14018f4eb
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea ecx, [rsi + 0x10]
call fcn.1401f0dd4
test rax, rax
je 0x14018f46f
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
jmp 0x14018f472
mov rax, rsi
mov qword [rsp + 0x70], rax
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14018dc50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14018f4fe
mov qword [rsp + 0x70], rsi
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
cmp dword [rdi + 0xd8], 0
je 0x14018f4c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmmword [rdi + 0xd0], xmm1
cmp dword [rsp + 0x48], 0
je 0x14018f4eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov dword [rsp + 0x48], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140197720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.14003ae50
mov ebp, 1
mov dword [rsp + 0x20], ebp
lea rsi, [rsp + 0x28]
mov rcx, qword [rsp + 0x28]
mov r9, qword [rsp + 0x40]
cmp r9, 0x10
cmovae rsi, rcx
lea rbx, [rsp + 0x28]
cmovae rbx, rcx
mov r8, qword [rsp + 0x38]
add rbx, r8
lea rdi, [rsp + 0x28]
cmp r9, 0x10
cmovae rdi, rcx
cmp rdi, rbx
je 0x1401977c3
sub rsi, rdi
nop dword [rax + rax]
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbx
jne 0x1401977a0
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x28]
cmp r9, 0x10
cmovae rdx, rcx
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x140197803
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x1401977f0
and ebp, 0xfffffffe
mov dword [rsp + 0x20], ebp
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140197843
inc rdx
mov rcx, qword [rsp + 0x28]
cmp rdx, 0x1000
jb 0x14019783e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14019787f
mov rcx, r8
call fcn.140096c70
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], sendto
mov byte [rsp + 0x28], 0
mov rax, rbx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401f11e0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140197fd0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
mov dword [rsp + 0x20], 0
test r8b, 1
lea rcx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__
lea rax, [0x1403453d0]
cmovne rax, rcx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
mov rcx, qword [rdx + 8]
add rcx, 2
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
mov r8b, 0x3d
mov rcx, rdi
call fcn.1400e02a0
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor edx, edx
xor r8d, r8d
mov rsi, qword [rbx + 8]
add rsi, qword [rbx]
mov r10, qword [rbx]
cmp r10, rsi
je 0x1401980fd
mov r11, qword [rsp + 0x28]
nop word [rax + rax]
movzx eax, byte [r10]
or r8d, eax
inc r9
movzx ecx, r9b
add cl, cl
mov eax, r8d
shr rax, cl
and eax, 0x3f
movzx ecx, byte [rax + r11]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14019809b
mov rax, qword [rdi]
mov byte [rax + rdx], cl
inc rdx
cmp r9, 3
jne 0x1401980c8
mov eax, r8d
and eax, 0x3f
movzx ecx, byte [rax + r11]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1401980bf
mov rax, qword [rdi]
mov byte [rax + rdx], cl
inc rdx
xor r9d, r9d
shl r8d, 8
inc r10
cmp r10, rsi
jne 0x140198070
test r9, r9
je 0x1401980fd
lea ecx, [r9 + 1]
add cl, cl
mov eax, r8d
shr rax, cl
and eax, 0x3f
movzx ecx, byte [rax + r11]
mov rax, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1401980fa
mov rax, qword [rdi]
mov byte [rax + rdx], cl
test bpl, 2
je 0x140198140
cmp qword [rdi + 0x10], 0
jbe 0x140198140
nop word [rax + rax]
mov rcx, rdi
call fcn.1400f5e80
cmp byte [rax], 0x3d
jne 0x140198140
mov rax, qword [rdi + 0x10]
dec rax
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140198131
mov rcx, qword [rdi]
mov qword [rdi + 0x10], rax
mov byte [rcx + rax], 0
cmp qword [rdi + 0x10], 0
ja 0x140198110
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x14019d7e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rbx, rcx
mov r11, qword [rdx + 0x10]
mov r10, rdx
jb 0x14019d7fa
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x14019d834
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x14019d820
mov r8, rdx
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.14003f1c0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14019d851
mov rcx, qword [rbx + 8]
cmp rcx, qword [rbx + 8]
setne al
add rsp, 0x30
pop rbx
ret