joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15030bc44
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov dword [rbp - 9], edx
mov rdx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, 0x39
jb 0x15030be48
cmp qword [rcx + 0x18], 0x10
jb 0x15030bc8c
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x39
lea r9, [0x15017e468]
lea rcx, [rbp + 0x27]
call fcn.1502d6494
nop
and qword [rbp - 0x19], 0
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rdx, qword [rbp + 0x27]
lea r8, [rbp - 0x19]
mov rbx, 0xffffffff80000001
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x15030bce5
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 0x19], 0
lea rdx, [rbp + 0x27]
cmp qword [rbp + 0x3f], 0x10
cmovae rdx, qword [rbp + 0x27]
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x15030bd1e
xor bl, bl
jmp 0x15030bdec
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp - 1], rax
lea rdx, [rbp + 7]
lea rcx, [rbp - 1]
call fcn.1503d43d4
and dword [rbp - 0x11], 0
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [rbp - 0x11]
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
setne bl
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x15030bddb
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x15030bdd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x15030be4e
call fcn.15040acc0
movdqa xmm0, xmmword [0x150270450]
movdqu xmmword [rbp + 0x17], xmm0
mov byte [rbp + 7], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x15030be23
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x15030be1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x15030be42
call fcn.15040acc0
mov al, bl
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.15040aca0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rbp
ret
call fcn.150419d24
int3
call fcn.1502a7488
nop
call fcn.150419d24
nop
Function at 0x15030faf0
Capabilities:
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rbp + 0x4f], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rbp + 7], rax
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 7]
call fcn.1503d43d4
nop
mov r9d, 0x4a
lea r8, [0x15017eaa0]
xor edx, edx
mov rcx, rax
call fcn.1502a907c
xorps xmm0, xmm0
movups xmmword [rbp + 0xf], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f], xmm1
and qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rax], 0
mov rdx, qword [rbp + 0x47]
cmp rdx, 0x10
jb 0x15030fba6
inc rdx
mov rcx, qword [rbp + 0x2f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x15030fba1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x15030fc97
call fcn.15040acc0
and qword [rbp - 9], 0
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
lea r8, [rbp - 9]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x15030fbd8
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rbp - 9], 0
lea rdx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rdx, qword [rbp + 0xf]
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x15030fc45
mov dword [rbp - 1], 1
lea r9d, [rax + 4]
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x15017eb20]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp + 0x27]
cmp rdx, 0x10
jb 0x15030fc7c
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x15030fc77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x15030fc91
call fcn.15040acc0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x90
pop rbp
ret
call fcn.150419d24
int3
call fcn.150419d24
int3
Function at 0x150311008
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword gs:[0x58]
or rsi, 0xffffffffffffffff
mov ecx, 0x40
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x15007e598], eax
jg 0x150311189
cmp qword [0x150028e28], 0
je 0x150311076
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
lea rax, [0x150028e18]
cmovae rax, qword [0x150028e18]
jmp 0x150311164
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x15017ebd0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdi, [0x150028e18]
test eax, eax
jne 0x150311151
mov ebx, 0x104
lea rcx, [rsp + 0x40]
mov r8d, ebx
xor edx, edx
call fcn.15040dca0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x15017ebf8]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
inc rsi
cmp byte [rax + rsi], 0
jne 0x150311100
mov rax, qword [reloc.OLEAUT32.dll_SafeArrayDestroy]
cmp rsi, rax
ja 0x150311141
cmp rax, 0x10
mov qword [0x150028e28], rsi
mov rbx, rdi
lea rdx, [rsp + 0x40]
cmovae rbx, qword [0x150028e18]
mov r8, rsi
mov rcx, rbx
call fcn.15040d600
mov byte [rbx + rsi], 0
jmp 0x150311151
lea r9, [rsp + 0x40]
mov rdx, rsi
mov rcx, rdi
call fcn.1502bbc90
cmp qword [reloc.OLEAUT32.dll_SafeArrayDestroy], 0x10
cmovae rdi, qword [0x150028e18]
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.15040aca0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
lea rcx, [0x15007e598]
call fcn.15040b028
cmp dword [0x15007e598], esi
jne 0x150311050
lea rcx, [0x150449548]
call fcn.15040af2c
lea rcx, [0x15007e598]
call fcn.15040afbc
jmp 0x150311050
Function at 0x150314a2c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
inc dword [0x150027068]
mov r9d, 0x138
mov edx, dword [0x150027070]
xorps xmm0, xmm0
cmp edx, r9d
jne 0x150314a9a
lea r8, [0x150027080]
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8]
lea r8, [r8 + 8]
mov al, dl
and al, 1
neg al
movabs rax, 0xb5026f5aa96619e9
sbb rcx, rcx
shr rdx, 1
and rcx, rax
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x150314a53
jmp 0x150314aae
cmp edx, 0x270
jb 0x150314ab4
lea rcx, [0x150027070]
call fcn.15031629c
mov edx, dword [0x150027070]
mov eax, edx
lea rcx, [0x150027078]
inc edx
xorps xmm2, xmm2
mov rcx, qword [rcx + rax*8]
mov rax, rcx
mov dword [0x150027070], edx
shr rax, 0x1d
movabs rdx, 0x38eb3ffff6d3
and rax, qword [0x1500283f8]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x150314b17
cvtsi2sd xmm2, rdx
jmp 0x150314b2c
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
mov rbx, qword [0x150027060]
subsd xmm2, xmm0
addsd xmm2, xmm0
movsd xmm0, qword [0x150028408]
subsd xmm0, qword [0x150028400]
mulsd xmm2, qword [0x1502702c0]
mulsd xmm2, xmm0
xorps xmm0, xmm0
cvtsi2sd xmm0, rbx
addsd xmm2, qword [0x150028400]
mulsd xmm0, qword [0x150270400]
mulsd xmm2, xmm0
cvttsd2si rax, xmm2
sub rbx, rax
cmp qword [0x150027058], rbx
cmovl rbx, qword [0x150027058]
mov qword [0x150027060], rbx
call fcn.15040934c
imul rcx, rbx, 0x2710
add rcx, rax
mov qword [0x150048d20], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x15031629c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r10, [rcx + 0x9c8]
mov r9, rcx
mov rax, qword [r10]
mov r11d, 0x9c
mov rbx, 0xffffffff80000000
movabs rdi, 0xb5026f5aa96619e9
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, qword [r8]
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1503162ca
lea r10, [r9 + 0xea8]
mov r11d, 0x9b
mov rax, qword [r10]
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, qword [r8]
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 - 0xea0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x150316316
mov rdx, qword [r9 + 8]
xor rdx, qword [r9 + 0x1380]
and rdx, rbx
mov rbx, qword [rsp + 8]
xor rdx, qword [r9 + 8]
mov al, dl
and al, 1
neg al
sbb rcx, rcx
and dword [r9], 0
and rcx, rdi
shr rdx, 1
xor rcx, qword [r9 + 0x4e0]
mov rdi, qword [rsp + 0x10]
xor rcx, rdx
mov qword [r9 + 0x9c0], rcx
ret
Function at 0x150316394
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x150180008]
mov rbx, rcx
movups xmm0, xmmword [0x15017ffe0]
mov dword [rsp + 0x68], eax
movzx eax, word [0x15018000c]
movups xmm1, xmmword [0x15017fff0]
mov word [rsp + 0x6c], ax
mov eax, gethostbyname
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x150180000]
movsd qword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
jmp 0x15031640b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x150316412
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x15031647b
inc ax
mov word [rsp + 0x6a], ax
jmp 0x15031642d
cmp eax, 0xe7
jne 0x15031647b
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x15031647b
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and dword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x1503163f2
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x150316465

Function at 0x150316480
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r8
test r8, r8
jne 0x150316494
lea eax, [r8 + 1]
jmp 0x1503164d5
test rcx, rcx
je 0x1503164d3
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x1503164d3
test rdx, rdx
je 0x1503164d3
and dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, 1
cmp eax, ecx
jne 0x1503164cd
cmp dword [rsp + 0x50], ebx
je 0x1503164cf
xor cl, cl
mov al, cl
jmp 0x1503164d5
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x1503164dc
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
je 0x15031656f
test rcx, rcx
je 0x15031656f
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x15031656f
and qword [rax - 0x10], 0
xor r9d, r9d
and dword [rax + 0x10], 0
lea rax, [rax + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x15031655d
mov eax, dword [rsp + 0x48]
cmp rax, rdi
jb 0x15031656f
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x58]
and dword [rsp + 0x58], 0
mov r8d, edi
and qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x15031655d
jmp 0x150316571
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], 0
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x15031a12c
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rdi, r8
mov qword [r11 + 8], rsi
mov rbx, rcx
test rdx, rdx
je 0x15031a183
cmp word [rdx], si
je 0x15031a183
mov qword [r11 - 0x18], rsi
lea rax, [r11 + 8]
mov qword [r11 - 0x20], rax
xor r9d, r9d
mov qword [r11 - 0x28], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x15031a1c6
mov rcx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x88]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov rax, qword [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
mov edi, eax
test rcx, rcx
je 0x15031a1c4
cmp rcx, rbx
je 0x15031a1c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x15031b938
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x98
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r10, rcx
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rcx, qword [r10 + 0x460]
and rcx, rax
add rcx, rcx
mov r8, qword [r10 + 0x448]
mov rax, qword [r8 + rcx*8 + 8]
mov r9, qword [r10 + 0x438]
cmp rax, r9
je 0x15031b9ad
mov r8, qword [r8 + rcx*8]
jmp 0x15031b9a6
cmp rax, r8
je 0x15031b9ad
mov rax, qword [rax + 8]
cmp dl, byte [rax + 0x10]
jne 0x15031b99d
jmp 0x15031b9af
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x15031b9d6
mov al, byte [rax + 0x11]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x98
ret
mov r8b, dl
lea rdx, [rsp + 0x48]
mov rcx, r10
call fcn.15031ba30
nop
lea rcx, [0x150181018]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x23
mov r8, rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1502cedc8
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.150332b98
lea rdx, [0x1502a09b0]
lea rcx, [rsp + 0x30]
call fcn.15040e028
int3
Function at 0x15031ba30
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
xor r11d, r11d
movzx eax, r8b
movabs rdx, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x100000001b3
imul rax, rdx
mov rdx, qword [rcx + 0x3a0]
and rdx, rax
add rdx, rdx
mov r10, qword [rcx + 0x388]
mov rax, qword [r10 + rdx*8 + 8]
mov r9, qword [rcx + 0x378]
cmp rax, r9
je 0x15031baae
mov rcx, qword [r10 + rdx*8]
jmp 0x15031baa6
cmp rax, rcx
je 0x15031baae
mov rax, qword [rax + 8]
cmp r8b, byte [rax + 0x10]
jne 0x15031ba9d
jmp 0x15031bab1
mov rax, r11
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x15031baf4
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r11
mov qword [rbx + 0x18], r11
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
mov rcx, rbx
call fcn.1502a75e8
mov rax, rbx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x80
pop rbx
ret
mov byte [rsp + 0x20], r8b
lea rax, [0x150181070]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], gethostbyname
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.15031e9fc
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1502c36c8
lea rdx, [0x1502a0838]
lea rcx, [rsp + 0x40]
call fcn.15040e028
int3

Function at 0x15031bb44
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x88
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x20], dl
movzx eax, dl
movabs r8, 0xcbf29ce484222325
xor rax, r8
movabs r8, 0x100000001b3
imul rax, r8
mov r8, qword [rcx + 0x420]
and r8, rax
add r8, r8
mov r10, qword [rcx + 0x408]
mov rax, qword [r10 + r8*8 + 8]
mov r9, qword [rcx + 0x3f8]
cmp rax, r9
je 0x15031bbb7
mov rcx, qword [r10 + r8*8]
jmp 0x15031bbb0
cmp rax, rcx
je 0x15031bbb7
mov rax, qword [rax + 8]
cmp dl, byte [rax + 0x10]
jne 0x15031bba7
jmp 0x15031bbb9
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x15031bbdd
mov al, byte [rax + 0x11]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x88
ret
lea rax, [0x1501810a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0x29
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.15031e9fc
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.150332b98
lea rdx, [0x1502a09b0]
lea rcx, [rsp + 0x40]
call fcn.15040e028
int3
Function at 0x15031bdc8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov word [rsp + 0x18], r8w
push rbx
sub rsp, 0x40
xor r11d, r11d
mov rbx, rdx
mov r9d, r11d
mov r10, rcx
movabs rdx, 0xcbf29ce484222325
movzx eax, byte [rsp + r9 + 0x60]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r9
imul rdx, rcx
cmp r9, 2
jb 0x15031bde9
mov rcx, qword [r10 + 0x4a0]
mov r9, qword [r10 + 0x488]
and rcx, rdx
mov rdx, qword [r10 + 0x478]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x15031be46
mov r9, qword [r9 + rcx*8]
jmp 0x15031be3d
cmp rax, r9
je 0x15031be46
mov rax, qword [rax + 8]
cmp r8w, word [rax + 0x10]
jne 0x15031be34
jmp 0x15031be49
mov rax, r11
test rax, rax
mov rcx, rbx
cmove rax, rdx
cmp rax, rdx
je 0x15031be75
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r11
mov qword [rbx + 0x18], r11
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
call fcn.1502a75e8
jmp 0x15031be99
lea rax, [0x1501810d8]
mov qword [rsp + 0x38], SafeArrayGetDim
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call fcn.15031ea80
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x15031bfe4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x40
xor r11d, r11d
mov rbx, rdx
mov r9d, r11d
mov r10, rcx
movabs rdx, 0xcbf29ce484222325
movzx eax, byte [rsp + r9 + 0x60]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r9
imul rdx, rcx
cmp r9, 8
jb 0x15031c004
mov rcx, qword [r10 + 0x620]
mov r9, qword [r10 + 0x608]
and rcx, rdx
mov rdx, qword [r10 + 0x5f8]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x15031c060
mov r9, qword [r9 + rcx*8]
jmp 0x15031c058
cmp rax, r9
je 0x15031c060
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x15031c04f
jmp 0x15031c063
mov rax, r11
test rax, rax
mov rcx, rbx
cmove rax, rdx
cmp rax, rdx
je 0x15031c08f
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r11
mov qword [rbx + 0x18], r11
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
call fcn.1502a75e8
jmp 0x15031c0b3
lea rax, [0x150181140]
mov qword [rsp + 0x38], SafeArrayGetDim
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call fcn.15031eb04
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x15031c0bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
mov rbx, rcx
mov rax, rdx
jb 0x15031c0d5
mov rax, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp rdx, 6
jb 0x15031c0ff
mov ecx, dword [rax]
sub ecx, 0x6e75665f
jne 0x15031c0f4
movzx ecx, word [rax + 4]
mov eax, 0x5f63
sub ecx, eax
test ecx, ecx
jne 0x15031c0ff
mov al, 1
jmp 0x15031c1c1
test dword [rbx], 0x200
je 0x15031c184
mov rdx, r8
call fcn.15031bea4
mov r9, rax
mov qword [rsp + 0x58], rax
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [rsp + r8 + 0x58]
movabs rax, 0x100000001b3
xor rdx, rcx
inc r8
imul rdx, rax
cmp r8, 8
jb 0x15031c124
mov rcx, qword [rbx + 0x620]
and rcx, rdx
mov rdx, qword [rbx + 0x608]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rbx + 0x5f8]
je 0x15031c17d
mov r8, qword [rdx + rcx*8]
jmp 0x15031c175
cmp rax, r8
je 0x15031c17d
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x15031c16c
jmp 0x15031c17f
xor eax, eax
test rax, rax
jmp 0x15031c1be
cmp qword [r8 + 0x18], 0x10
jb 0x15031c18e
mov r8, qword [r8]
mov rcx, r8
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdx
call fcn.1502b08e4
mov r9, rax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x4b0]
call fcn.150309958
cmp qword [rax + 8], 0
setne al
add rsp, 0x40
pop rbx
ret

Function at 0x15031c540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov word [rsp + 0x18], r8w
push rbx
sub rsp, 0x40
xor r11d, r11d
mov rbx, rdx
mov r9d, r11d
mov r10, rcx
movabs rdx, 0xcbf29ce484222325
movzx eax, byte [rsp + r9 + 0x60]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r9
imul rdx, rcx
cmp r9, 2
jb 0x15031c561
mov rcx, qword [r10 + 0x520]
mov r9, qword [r10 + 0x508]
and rcx, rdx
mov rdx, qword [r10 + 0x4f8]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, rdx
je 0x15031c5be
mov r9, qword [r9 + rcx*8]
jmp 0x15031c5b5
cmp rax, r9
je 0x15031c5be
mov rax, qword [rax + 8]
cmp r8w, word [rax + 0x10]
jne 0x15031c5ac
jmp 0x15031c5c1
mov rax, r11
test rax, rax
mov rcx, rbx
cmove rax, rdx
cmp rax, rdx
je 0x15031c5ed
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r11
mov qword [rbx + 0x18], r11
mov r8, qword [rax + 0x20]
mov rdx, qword [rax + 0x18]
call fcn.1502a75e8
jmp 0x15031c611
lea rax, [0x150181198]
mov qword [rsp + 0x38], SafeArrayGetDim
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
call fcn.15031ea80
mov rax, rbx
add rsp, 0x40
pop rbx
ret