joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018e180
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x240
mov rax, qword [0x1401b05d8]
xor rax, rsp
mov qword [rsp + 0x230], rax
lea rdx, [0x140016370]
mov rbp, rcx
call fcn.140196edc
xor edi, edi
test rax, rax
je 0x14018e266
mov ebx, edi
call fcn.14017d244
mov r14d, dword [rax]
call fcn.14017d244
mov r8d, 0x104
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov dword [rax], edi
call fcn.140196e28
mov rsi, rax
test rax, rax
je 0x14018e1f7
call fcn.14017d244
mov dword [rax], r14d
jmp 0x14018e221
call fcn.14017d244
cmp dword [rax], 0x22
jne 0x14018e25e
call fcn.14017d244
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.140196e28
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x14018e25e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x14018e225
cmp rax, 3
je 0x14018e240
mov rcx, rsi
call fcn.14018e0dc
test al, al
je 0x14018e251
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x14018e251
mov dil, 1
mov rcx, rbx
call fcn.14017dbf0
mov al, dil
jmp 0x14018e268
mov rcx, rbx
call fcn.14017dbf0
xor al, al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1401768f0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140190930
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1401b22a0]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x14019098e
cmp word [rdx], r12w
jne 0x14019098e
or byte [rax + r8*8 + 0x38], cl
jmp 0x140190994
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x140190aef
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140190aca
lea r9, [rcx + 2]
cmp ax, r13w
je 0x1401909cd
mov rcx, r9
jmp 0x1401909f0
cmp r9, rdx
jae 0x140190a07
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x1401909b1
jmp 0x140190aef
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140190ac4
cmp dword [rsp + 0x80], edi
je 0x140190ac4
mov rdx, r14
lea r11, [0x1401b22a0]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x140190a9d
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x140190a70
mov word [rbx], r12w
jmp 0x140190aeb
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x140190a79
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140190aeb
cmp word [rsp + 0x70], r12w
jne 0x140190aaa
cmp rbx, rsi
je 0x140190a6a
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.140195e1c
cmp word [rsp + 0x70], r12w
je 0x140190aef
mov word [rbx], r13w
jmp 0x140190aeb
lea r11, [0x1401b22a0]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140190ae7
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x140190aef
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140195800
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140195832
call fcn.14017d244
mov dword [rax], socket
call fcn.14017d0d8
jmp 0x140195951
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140195951
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140195951
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140195861
lock or dword [rcx + 0x14], 0x10
jmp 0x140195951
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140195875
call fcn.14019d170
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14019439c
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.140190ddc
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x14019593f
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x14019590a
mov rcx, rsi
call fcn.14019439c
cmp eax, edi
je 0x1401958f5
mov rcx, rsi
call fcn.14019439c
cmp eax, 0xfffffffe
je 0x1401958f5
mov rcx, rsi
call fcn.14019439c
movsxd rbx, eax
lea r14, [0x1401b22a0]
mov rcx, rsi
sar rbx, 6
call fcn.14019439c
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x1401958fc
lea rdx, [0x1401b09d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14019590a
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x14019592e
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x14019592e
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x14019592e
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140195954
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x1401960d0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401960ad
call fcn.14017d244
mov dword [rax], socket
call fcn.14017d0d8
or eax, 0xffffffff
jmp 0x1401960ca
sub dword [rcx + 0x10], 1
jns 0x1401960bc
add rsp, 0x28
jmp fcn.140195800
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x14019608c
Function at 0x14019696c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140195e1c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140195e1c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140196abc
cmp rax, 0xffffffffffffffff
je 0x140196abc
xor edi, edi
test rbp, rbp
jle 0x140196a67
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140194eb0
mov rbx, rax
test rax, rax
jne 0x1401969f4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140196a5d
mov edx, 0x8000
mov ecx, r14d
call fcn.140190534
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140191d20
cmp eax, 0xffffffff
je 0x140196a3d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140196a04
mov edx, r15d
mov ecx, r14d
call fcn.140190534
jmp 0x140196a5d
cmp byte [rsi + 0x38], dil
je 0x140196a54
cmp dword [rsi + 0x34], 5
jne 0x140196a54
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
cmp byte [rsi + 0x30], dil
je 0x140196a5d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140192f58
jmp 0x140196ad0
jns 0x140196ad0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140195e1c
cmp rax, 0xffffffffffffffff
jne 0x140196a88
cmp byte [rsi + 0x30], dil
je 0x140196ad0
mov edi, dword [rsi + 0x2c]
jmp 0x140196ad0
mov ecx, r14d
call fcn.14019685c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140196ad0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, recv
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], recv
jmp 0x140196ad0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140196ac9
mov eax, dword [rsi + 0x2c]
jmp 0x140196ace
mov eax, socket
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140195e1c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14019a28c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14019a2bc
xor eax, eax
jmp 0x14019a37f
mov rbp, rbx
cmp word [rax], si
je 0x14019a2e1
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14019a2c8
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14019a2c4
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401972f4
movsxd r14, eax
test eax, eax
jne 0x14019a31f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14019a2b5
mov rcx, r14
call fcn.140192f94
mov rdi, rax
test rax, rax
jne 0x14019a338
xor ecx, ecx
call fcn.140192f58
jmp 0x14019a314
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401972f4
test eax, eax
jne 0x14019a369
mov rcx, rdi
call fcn.140192f58
jmp 0x14019a373
xor ecx, ecx
call fcn.140192f58
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x14019a39c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14019a423
mov rsi, rbx
cmp word [rax], bp
je 0x14019a3e2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14019a3cc
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14019a3c8
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140192f94
mov rdi, rax
test rax, rax
je 0x14019a410
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140177990
mov rbp, rdi
xor ecx, ecx
call fcn.140192f58
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14019b804
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14019b824
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14017d1b8
or eax, 0xffffffff
jmp 0x14019b826
xor eax, eax
add rsp, 0x28
ret

Function at 0x14019e884
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14017da48
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14019e90e
cmp byte [rbp - 0x21], r15b
je 0x14019e909
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14019e944
call fcn.140195198
test eax, eax
jne 0x14019e930
cmp byte [rbp - 0x21], r15b
je 0x14019e928
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14019e944
cmp byte [rbp - 0x21], r15b
je 0x14019e941
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14018ccb0
test eax, eax
jne 0x14019e9e4
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14017da48
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14019e983
cmp byte [rbp - 0x21], r15b
je 0x14019e9b8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14019e9b8
call fcn.140195198
test eax, eax
jne 0x14019e9a4
cmp byte [rbp - 0x21], r15b
je 0x14019e99d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14019e9b8
cmp byte [rbp - 0x21], r15b
je 0x14019e9b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14018ccb0
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14019e9e4
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14019e9e7
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14019e9f5
mov rcx, rdi
call fcn.140192f58
cmp byte [rbp + 0x3f], r15b
je 0x14019ea04
mov rcx, qword [rbp + 0x27]
call fcn.140192f58
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140024c80
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140024d4c
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140024d4c
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140024d65
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140024d3c
cmp byte [rax], 0x5c
jne 0x140024d36
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140024d36
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140024d22
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140024d33
test r8b, 0x10
jne 0x140024d36
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140024d36
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.1400282a0
test edi, edi
jne 0x140024ca0
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.140025e30
int3

Function at 0x140028ff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140029024
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140029010
ret
Function at 0x14002edb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002ef8f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14002ea80
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002ef54
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002eecc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002ef43
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14002ef09
mov r10, qword [rdx]
cmp r10, rax
je 0x14002ef03
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002ef43
cmp r9, rdx
je 0x14002ef1f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14002ef69
cmp r9, rdx
jne 0x14002ef10
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14002ee50
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002ef43
lea rcx, str.invalid_hash_bucket_count
call fcn.14009bd00
int3

Function at 0x14002f250
Capabilities:
Hash data using fnv

Disassembly:
test r8, r8
jne 0x14002f259
mov rax, rcx
ret
movsx rax, byte [rdx]
movabs r9, 0x100000001b3
imul rcx, r9
dec r8
xor rcx, rax
inc rdx
jmp fcn.14002f250
Function at 0x1400322f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140129778]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rdi, rdx
test eax, eax
movd edx, xmm3
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x140032350
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x140032353
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x140032384
lea edx, [rax - 0x27]
jmp 0x14003238d
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x1400323ab
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x1400324f7
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14003239b
mov qword [rsp + 0x70], rbx
cmp r10d, r11d
jge 0x1400323ed
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x140032474
mov byte [rdi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyzfalse
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, SafeArrayUnaccessData
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x140032474
mov edx, 0x100000
test ecx, ecx
je 0x14003245e
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x140032436
jmp 0x140032474
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call fcn.1400a0a00
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x140032490
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x1400324d5
mov dword [r14 + 8], 0x84
jmp 0x1400324ef
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.1400a0360
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x70]
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009e4e0
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140032520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140129778]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rsi, rdx
test eax, eax
movq rdx, xmm3
mov r9, rdx
mov r11d, SafeArrayDestroy
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x140032593
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x140032599
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x1400325d3
lea edx, [rax - 0x27]
jmp 0x1400325ec
cmp edi, 0x64
jae 0x1400325df
mov edx, 5
jmp 0x1400325ec
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x14003272b
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14003272b
cmp r10d, r11d
jge 0x140032641
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x1400326d2
mov byte [rsi], 0x2e
lea r11, str.0123456789abcdefghijklmnopqrstuvwxyzfalse
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x1400326d2
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x1400326bc
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x140032690
jmp 0x1400326d2
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call fcn.1400a0a00
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x1400326f0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x140032735
mov dword [r14 + 8], 0x84
jmp 0x14003274f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.1400a0360
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009e4e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret