joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10040edc0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rdx
lea rdx, [0x10042616b]
mov rdi, r8
call sub.cygwin1.dll_fopen
mov rbx, rax
test rax, rax
je 0x10040ee15
mov rcx, rsi
mov r9, rax
mov r8, rdi
mov edx, 1
call sub.cygwin1.dll_fwrite
mov rcx, rbx
test byte [rbx + 0x10], 0x40
jne 0x10040ee10
call sub.cygwin1.dll_fclose
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call sub.cygwin1.dll_fclose
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x10040f710
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0xa8
lea rdx, [rsp + 0x20]
call sub.cygwin1.dll_stat
mov edx, eax
xor eax, eax
cmp edx, 0xffffffff
je 0x10040f72f
mov rax, qword [rsp + 0x60]
add rsp, 0xa8
ret

Function at 0x10040fd70
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov edx, 0x2f
mov rsi, rcx
call sub.cygwin1.dll_strchr
mov rbx, rax
test rax, rax
je 0x10040fdf8
lea rdx, [0x100426198]
lea rcx, [rax + 1]
lea r8, [rsp + 0x2c]
call sub.cygwin1.dll_sscanf
mov edx, eax
xor eax, eax
cmp edx, 1
je 0x10040fdc0
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [rsp + 0x2c]
cmp edx, 0x20
ja 0x10040fdae
mov byte [rdi + 4], dl
movzx ebp, byte [rbx]
mov r8, rdi
mov rdx, rsi
mov byte [rbx], 0
mov ecx, 2
call sub.cygwin1.dll_inet_pton
mov byte [rbx], bpl
cmp eax, 1
sete al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov byte [rdi + 4], 0x20
mov r8, rdi
mov rdx, rsi
mov ecx, 2
call sub.cygwin1.dll_inet_pton
cmp eax, 1
sete al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x10040fe20
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, rdx
mov edx, 0x2f
mov rsi, rcx
call sub.cygwin1.dll_strchr
mov rbx, rax
test rax, rax
je 0x10040feb0
lea rdx, [0x100426198]
lea rcx, [rax + 1]
lea r8, [rsp + 0x2c]
call sub.cygwin1.dll_sscanf
mov edx, eax
xor eax, eax
cmp edx, 1
je 0x10040fe70
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, dword [rsp + 0x2c]
cmp edx, 0x80
ja 0x10040fe5e
mov byte [rdi + 0x10], dl
movzx ebp, byte [rbx]
mov r8, rdi
mov rdx, rsi
mov byte [rbx], 0
mov ecx, 0x17
call sub.cygwin1.dll_inet_pton
mov byte [rbx], bpl
cmp eax, 1
sete al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov byte [rdi + 0x10], pe_nt_image_headers64
mov r8, rdi
mov rdx, rsi
mov ecx, 0x17
call sub.cygwin1.dll_inet_pton
cmp eax, 1
sete al
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x100410f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r8, rcx
mov r10d, edx
cmp edx, 0xb
jbe 0x1004111c8
mov r9d, edx
mov ebx, 0x9e3779b9
mov r11d, 0x9e3779b9
mov ecx, 0xfeedbeef
nop dword [rax + rax]
movzx edx, byte [r8 + 5]
movzx eax, byte [r8 + 6]
shl edx, 8
shl eax, 0x10
add edx, eax
movzx eax, byte [r8 + 4]
add edx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
add edx, eax
movzx eax, byte [r8 + 9]
add edx, ebx
movzx ebx, byte [r8 + 0xa]
shl eax, 8
shl ebx, 0x10
add eax, ebx
movzx ebx, byte [r8 + 8]
add eax, ebx
movzx ebx, byte [r8 + 0xb]
shl ebx, 0x18
add eax, ebx
movzx ebx, byte [r8 + 2]
add eax, ecx
movzx ecx, byte [r8 + 1]
shl ebx, 0x10
shl ecx, 8
add ecx, ebx
movzx ebx, byte [r8]
add ecx, ebx
movzx ebx, byte [r8 + 3]
shl ebx, 0x18
add ecx, ebx
sub ecx, edx
sub edx, eax
sub ecx, eax
add ecx, r11d
mov r11d, eax
shr r11d, 0xd
xor ecx, r11d
sub edx, ecx
sub eax, ecx
mov r11d, edx
mov edx, ecx
shl edx, 8
xor edx, r11d
sub eax, edx
mov r11d, eax
mov eax, edx
shr eax, 0xd
xor eax, r11d
sub ecx, edx
sub r9d, 0xc
add r8, 0xc
sub ecx, eax
sub edx, eax
mov r11d, ecx
mov ecx, eax
shr ecx, 0xc
xor ecx, r11d
sub edx, ecx
sub eax, ecx
mov r11d, edx
mov edx, ecx
shl edx, 0x10
xor edx, r11d
sub eax, edx
sub ecx, edx
mov r11d, eax
mov eax, edx
shr eax, 5
xor eax, r11d
mov r11d, eax
sub ecx, eax
sub edx, eax
shr r11d, 3
xor r11d, ecx
mov ebx, r11d
sub edx, r11d
sub eax, r11d
shl ebx, 0xa
xor ebx, edx
mov ecx, ebx
sub eax, ebx
shr ecx, 0xf
xor ecx, eax
cmp r9d, 0xb
ja 0x100410fb8
add ecx, r10d
cmp r9d, 0xb
ja case.0x1004110d4.0
lea rdx, [0x1004265f0]
movsxd rax, dword [rdx + r9*4]
add rax, rdx
jmp rax
movzx eax, byte [r8 + 0xa]
shl eax, 0x18
add ecx, eax
movzx eax, byte [r8 + 9]
shl eax, 0x10
add ecx, eax
movzx eax, byte [r8 + 8]
shl eax, 8
add ecx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r8 + 6]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r8 + 5]
shl eax, 8
add ebx, eax
movzx eax, byte [r8 + 4]
add ebx, eax
movzx eax, byte [r8 + 3]
shl eax, 0x18
add r11d, eax
movzx eax, byte [r8 + 2]
shl eax, 0x10
add r11d, eax
movzx eax, byte [r8 + 1]
shl eax, 8
add r11d, eax
movzx eax, byte [r8]
add r11d, eax
lea eax, [rcx + rbx]
mov edx, ecx
sub ebx, ecx
sub r11d, eax
shr edx, 0xd
xor edx, r11d
mov eax, edx
sub ebx, edx
sub ecx, edx
shl eax, 8
xor eax, ebx
sub ecx, eax
sub edx, eax
mov r8d, ecx
mov ecx, eax
shr ecx, 0xd
xor ecx, r8d
mov r8d, ecx
sub edx, ecx
sub eax, ecx
shr r8d, 0xc
xor r8d, edx
sub eax, r8d
sub ecx, r8d
mov edx, eax
mov eax, r8d
shl eax, 0x10
xor eax, edx
mov edx, eax
sub ecx, eax
sub r8d, eax
shr edx, 5
xor edx, ecx
mov ecx, edx
sub r8d, edx
sub eax, edx
shr ecx, 3
xor r8d, ecx
mov ecx, r8d
sub eax, r8d
sub edx, r8d
shl ecx, 0xa
xor eax, ecx
sub edx, eax
shr eax, 0xf
xor eax, edx
pop rbx
ret
mov r9d, edx
mov ebx, 0x9e3779b9
mov r11d, 0x9e3779b9
mov ecx, 0xfeedbeef
jmp 0x1004110b9
Function at 0x100411660
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.100411620
mov ecx, ebx
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
nop

Function at 0x100412250
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
mov rcx, qword [0x10042dc00]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
cmp byte [rcx + 0x1028], 0
jne 0x100412288
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rbx, [rsp + 0x58]
lea rdx, [0x100429dd0]
add rcx, 0x1028
mov qword [rsp + 0x28], rbx
call sub.cygwin1.dll_fopen
mov rsi, rax
test rax, rax
je 0x1004122fe
mov rcx, rax
call fcn.10040f690
mov r9, rsi
mov r8d, 3
mov edx, 1
lea rcx, [0x100429dde]
call sub.cygwin1.dll_fwrite
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.cygwin1.dll_vfprintf
mov rdx, rsi
mov ecx, 0xa
mov ebx, eax
call sub.cygwin1.dll_fputc
mov rcx, rsi
call sub.cygwin1.dll_fclose
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ebx, 0xffffffff
jmp 0x10041227b

Function at 0x100412310
Capabilities:
Reference http user-agent string

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov edx, 0x4a80
mov ecx, 1
call sub.cygwin1.dll_calloc
mov rbx, rax
test rax, rax
je 0x10041246b
mov byte [rax + 0x25], 1
mov rsi, qword [0x10042dbe0]
lea rdi, [rbx + 0x618]
mov ecx, 0x51
mov dword [rax + 0x13], 0x74736f68
mov rax, qword [0x100429de8]
mov qword [rbx + 0x39b0], 0x288
mov qword [rbx + 0x34], rax
mov rax, qword [0x100429df0]
mov qword [rbx + 0x28], rax
rep movsq qword [rdi], qword [rsi]
lea rcx, [rbx + 0x618]
call fcn.10040e5a0
mov rax, qword [0x10042dbd0]
mov rsi, qword [rax]
mov rcx, rsi
call sub.cygwin1.dll_strlen
mov rdx, rsi
lea rcx, [rbx + 0x64]
mov qword [rbx + 0x39a8], rax
mov r8, rax
call sub.cygwin1.dll_memcpy
mov rax, qword [0x100429e30]
mov byte [rbx + 8], 0xff
mov edx, 0x101
movdqa xmm0, xmmword [0x100429e00]
mov word [rbx + 0x39ec], dx
mov qword [rbx + 0x5c], rax
mov eax, 0x6e6e
mov rdx, qword [0x10042dc00]
mov word [rbx + 0x44], ax
mov rax, qword [0x100429e38]
movups xmmword [rbx + 0x39b8], xmm0
movdqa xmm0, xmmword [0x100429e10]
mov qword [rbx + 0x4a50], rax
mov rax, qword [rdx + 0x1010]
movups xmmword [rbx + 0x39c8], xmm0
movdqa xmm0, xmmword [0x100429e20]
mov byte [rbx + 0x2868], 0x40
mov byte [rbx + 0x51], 0xff
mov byte [rbx + 0xa], 0x6e
mov dword [rbx + 0x39e8], 2
mov dword [rbx + 0x4a58], 3
movups xmmword [rbx + 0x39d8], xmm0
test rax, rax
je 0x100412480
nop dword [rax]
mov rdx, rax
mov rax, qword [rax + 0x4a70]
test rax, rax
jne 0x100412440
mov qword [rbx + 0x4a70], 0
add rdx, 0x4a70
mov qword [rdx], rbx
mov qword [rbx + 0x4a78], rdx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov qword [rdx + 0x1010], rbx
mov rax, rbx
add rdx, 0x1010
mov qword [rbx + 0x4a70], 0
mov qword [rbx + 0x4a78], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x100416950
Capabilities:
Set current directory
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll_fork
cmp eax, 0xffffffff
je 0x1004169d1
test eax, eax
jne 0x1004169c0
call sub.cygwin1.dll_setsid
cmp eax, 0xffffffff
je 0x1004169c7
lea rcx, [0x10042a005]
call sub.cygwin1.dll_chdir
cmp eax, 0xffffffff
je 0x1004169c7
xor ecx, ecx
call sub.cygwin1.dll_close
mov ecx, 1
call sub.cygwin1.dll_close
mov ecx, 2
call sub.cygwin1.dll_close
mov edx, 2
lea rcx, str._dev_null
call sub.cygwin1.dll_open
xor ecx, ecx
call sub.cygwin1.dll_dup
xor ecx, ecx
add rsp, 0x28
jmp sub.cygwin1.dll_dup
xor ecx, ecx
call sub.cygwin1.dll_exit
mov ecx, 2
call sub.cygwin1.dll_exit
lea rcx, str.fork
call fcn.1004121a0
mov ecx, 2
call sub.cygwin1.dll_exit
nop
nop dword [rax + rax]
Function at 0x10041b580
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
movsx r8d, word [rcx + 0x28]
lea eax, [r8 + 1]
mov rbx, rcx
mov ecx, r8d
movsxd r8, r8d
mov byte [rbx + r8 + 0x2a], dl
cmp cx, 0x37
jle 0x10041b5d2
cmp ax, 0x3f
jg 0x10041b5c6
mov r8d, 0x3f
movsx rax, ax
xor edx, edx
sub r8d, ecx
lea rcx, [rbx + rax + 0x2a]
movzx r8d, r8w
call sub.cygwin1.dll_memset
mov rcx, rbx
call fcn.10041b0f0
movzx eax, word [rbx + 0x28]
cmp ax, 0x37
jg 0x10041b5f5
mov r8d, 0x38
xor edx, edx
sub r8d, eax
movsx rax, ax
lea rcx, [rbx + rax + 0x2a]
movzx r8d, r8w
call sub.cygwin1.dll_memset
mov r9d, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x20]
mov eax, r9d
movzx esi, r9b
mov r10d, r9d
mov r11d, r9d
movzx eax, ah
shr r11d, 0x10
mov edx, ecx
mov r8d, ecx
shr r10d, 0x18
mov r9, rax
mov rax, rsi
shr r8d, 0x10
shl rax, 8
movzx r8d, r8b
shr edx, 0x18
or rax, r9
movzx r9d, r11b
movzx edx, dl
shl rax, 8
or rax, r9
movzx r9d, r10b
shl rax, 8
or rax, r9
movzx r9d, cl
movzx ecx, ch
shl rax, 8
or rax, r9
shl rax, 8
or rax, rcx
mov rcx, rbx
shl rax, 8
or rax, r8
shl rax, 8
or rax, rdx
mov qword [rbx + 0x62], rax
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.10041b0f0

Function at 0x10041bb80
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
je 0x10041b6b8
movdqa xmm0, xmmword [0x10042a2b0]
xor eax, eax
mov qword [rcx + 0x20], 0
mov word [rcx + 0x28], ax
xor eax, eax
movups xmmword [rcx], xmm0
movdqa xmm0, xmmword [0x10042a2c0]
mov qword [rcx + 0x6c], 0
movups xmmword [rcx + 0x10], xmm0
ret
mov eax, 1
ret
test rcx, rcx
je 0x10041b938
movdqa xmm0, xmmword [0x10042a2d0]
xor eax, eax
mov qword [rcx + 0x20], 0
mov word [rcx + 0x28], ax
xor eax, eax
movups xmmword [rcx], xmm0
movdqa xmm0, xmmword [0x10042a2e0]
mov qword [rcx + 0x6c], 0
movups xmmword [rcx + 0x10], xmm0
ret
mov eax, 1
ret
test rcx, rcx
je 0x10041bba0
mov dword [rcx], edx
test edx, edx
je 0x10041bbb0
mov eax, 4
cmp edx, 1
jne 0x10041bba5
add rcx, 4
jmp 0x10041b900
mov eax, 1
ret
add rcx, 4
jmp 0x10041b680
Function at 0x180001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get file size
Read file on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, str.README.md
mov edx, 0x10000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800010a7
mov qword [rsp + 0x60], rbx
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x1000
mov edi, eax
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, edi
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
call rbx
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180001100
add rsp, 0x50
pop rsi
ret
Function at 0x140010710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
xor eax, eax
mov qword [rbp - 0x10], rcx
mov rdi, rcx
mov dword [rbp - 0x50], 0x44434241
mov dword [rbp - 0x4c], 0x48474645
mov dword [rbp - 0x48], 0x4c4b4a49
lea edx, [rax + 0x40]
mov dword [rbp - 0x44], 0x504f4e4d
mov dword [rbp - 0x40], 0x54535251
mov dword [rbp - 0x3c], 0x58575655
mov dword [rbp - 0x38], 0x62615a59
mov dword [rbp - 0x34], 0x66656463
mov dword [rbp - 0x30], 0x6a696867
mov dword [rbp - 0x2c], 0x6e6d6c6b
mov dword [rbp - 0x28], 0x7271706f
mov dword [rbp - 0x24], 0x76757473
mov dword [rbp - 0x20], 0x7a797877
mov dword [rbp - 0x1c], 0x33323130
mov dword [rbp - 0x18], 0x37363534
mov dword [rbp - 0x14], 0x2f2b3938
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
call fcn.14000c4c0
mov rbx, qword [rdi]
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov r8d, 0x40
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rbx + 0x40]
mov rax, rdi
lea r11, [rsp + 0x70]
mov qword [rdi + 8], rcx
mov rdi, qword [r11 + 0x20]
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140014400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov dword [rsp + 0x20], esi
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], sil
mov dword [rsp + 0x20], 1
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
cmp qword [rbx + 0x10], 0
je 0x14001446c
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140014465
mov rax, qword [rbx]
mov qword [rbx + 0x10], rsi
mov byte [rax], 0
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
lea rdx, [rcx + rcx*8]
cmp edx, 3
ja 0x140014491
nop dword [rax]
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
lea rdx, [rcx + rcx*8]
cmp edx, 4
jb 0x140014480
shr rdx, 0x20
add edx, 8
lea rcx, [rsp + 0x40]
call fcn.14009db60
mov rdi, rax
cmp rbx, rax
je 0x140014510
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400144e4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400144df
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014590
mov rcx, r8
call fcn.14012e950
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
lea rcx, [rsp + 0x40]
call fcn.14000c460
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14001452b
mov rdx, qword [rbx]
mov r9, r14
mov rcx, rsi
test r8, r8
je 0x140014553
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, rbp
inc rcx
cmp rcx, r8
jb 0x140014540
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.1400243f0
cmp qword [rax + 8], 0
jne 0x140014451
mov r8, rbx
lea rdx, [rsp + 0x30]
call fcn.14001f030
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001f030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14001f054
mov rdx, qword [rdi]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r8, r8
je 0x14001f083
movabs r9, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x14001f070
mov r9, rbx
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.1400243f0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14001f0b6
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
movabs rax, 0x555555555555555
cmp qword [0x1401b68d0], rax
jne 0x14001f0d7
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x1401b68c8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, Ordinal_50
call fcn.14012e6c4
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rcx, [rax + 0x10]
mov rdx, rdi
call fcn.14001c0b0
nop
mov r9, qword [0x1401b68d0]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14001f125
cvtsi2ss xmm0, rcx
jmp 0x14001f13a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [0x1401b68f8]
xorps xmm2, xmm2
test rdi, rdi
js 0x14001f150
cvtsi2ss xmm2, rdi
jmp 0x14001f168
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x1401b68c0]
comiss xmm1, xmm3
seta al
test al, al
je 0x14001f20d
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x140198a60]
comiss xmm0, xmm1
jb 0x14001f1b3
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14001f1b3
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x14001f1e5
cmp rdi, 0x200
jae 0x14001f1e2
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x14001f1e5
mov rdi, rcx
mov rdx, rdi
call fcn.140021b00
lea r8, [rsi + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.1400243f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x1401b68d0]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x1401b68d0], r9
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [0x1401b68d8]
mov rax, qword [0x1401b68f0]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x1401b68c8]
jne 0x14001f255
mov qword [rcx + rax*8], rsi
jmp 0x14001f267
cmp r9, rdx
jne 0x14001f260
mov qword [rcx + rax*8], rsi
jmp 0x14001f26c
cmp qword [rcx + rax*8 + 8], r8
jne 0x14001f26c
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140021de0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140021e15
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14001daf0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x140021f84
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x140021efc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140021f73
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140021f39
mov r10, qword [rdx]
cmp r10, rax
je 0x140021f33
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140021f73
cmp r9, rdx
je 0x140021f4f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140021f95
cmp r9, rdx
jne 0x140021f40
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x140021e80
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140021f73
Function at 0x140028db0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x140028e11
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140028dd0
mov ecx, dword [r9]
jmp 0x140028ef8
cmp ecx, 0x4e0
jb 0x140028ef8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140028e30
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x140028e80
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret