joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140074fb0
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rbp, r8
mov qword [rsp + 0x30], rbx
mov rcx, r9
mov qword [rsp + 0x40], rsi
mov r11, r9
mov qword [rsp + 0x18], rdi
mov rbx, r9
mov rdi, r9
mov qword [rsp + 8], r14
mov r14, qword [0x140517738]
mov r8, r9
mov rsi, r9
shr rdi, 0x18
mov rax, r9
shr rcx, 0x38
shr r11, 0x30
shr rbx, 0x28
shr r8, 0x20
shr rsi, 0x10
shr rax, 8
mov r10d, edx
test r14, r14
je 0x140075119
movzx eax, al
mov qword [rsp + 0x10], r12
movabs r12, 0x100000001b3
mov qword [rsp], r15
movabs r15, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, r15
imul rdx, r12
xor rdx, rax
movzx eax, sil
imul rdx, r12
xor rdx, rax
movzx eax, dil
imul rdx, r12
xor rdx, rax
movzx eax, r8b
mov r8, qword [r14 + 8]
imul rdx, r12
xor rdx, rax
movzx eax, bl
imul rdx, r12
xor rdx, rax
movzx eax, r11b
imul rdx, r12
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, r12
xor rdx, rcx
movzx ecx, r10b
xor rcx, r15
mov r15, qword [rsp]
imul rcx, r12
imul rdx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3a]
imul rcx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3b]
imul rcx, r12
xor rcx, rax
imul rcx, r12
mov r12, qword [rsp + 0x10]
xor rcx, rdx
mov rdx, qword [r14 + 0x18]
and rcx, qword [r14 + 0x30]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r11, qword [rdx + rcx*8]
lea rdx, [rdx + rcx*8]
cmp r11, r8
jne 0x1400750ed
mov rcx, r8
jmp 0x1400750f4
mov rcx, qword [rdx + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140075119
cmp qword [rax + 0x10], r9
jne 0x140075105
cmp dword [rax + 0x18], r10d
je 0x14007510a
mov rax, qword [rax]
jmp 0x1400750e3
cmovne rax, r8
cmp rax, r8
je 0x140075119
add rax, 0x20
jmp 0x14007511b
xor eax, eax
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x14007513a
add rsp, 0x20
pop rbp
ret
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
mov al, 1
movups xmmword [rbp + 0x10], xmm1
add rsp, 0x20
pop rbp
ret
Function at 0x14007e250
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rdx + 8]
xor r8d, r8d
mov r11, rcx
mov r9, r10
movzx eax, byte [r10]
test al, al
je 0x14007e297
nop dword [rax]
nop dword [rax + rax]
movsx rax, al
lea r8, [r8 + r8*4]
add r8, rax
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x14007e280
mov rbx, qword [rdx]
mov rdx, qword [r11 + 0x18]
imul rcx, rbx, 0x1000193
xor rcx, r8
and rcx, qword [r11 + 0x30]
mov r11, qword [r11 + 8]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov rdi, qword [rdx + rcx*8]
lea rsi, [rdx + rcx*8]
cmp rdi, r11
jne 0x14007e2cf
mov rcx, r11
jmp 0x14007e2d6
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14007e33c
cmp qword [rax + 0x10], rbx
jne 0x14007e30a
mov rcx, qword [rax + 0x18]
mov r9, r10
sub r9, rcx
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x14007e305
inc rcx
test edx, edx
jne 0x14007e2f0
test r8d, r8d
je 0x14007e30f
mov rax, qword [rax]
jmp 0x14007e2c5
mov r8, qword [rax + 0x18]
sub r8, r10
nop word [rax + rax]
movzx edx, byte [r10]
movzx ecx, byte [r10 + r8]
sub edx, ecx
jne 0x14007e334
inc r10
test ecx, ecx
jne 0x14007e320
test edx, edx
cmovne rax, r11
jmp 0x14007e33f
mov rax, r11
cmp rax, r11
jne 0x14007e356
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rax, qword [rax + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14007f3b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rdx
mov r9, rcx
movsxd rdx, dword [r8 + 8]
mov r10, qword [r8]
imul r8, rdx, 0x1000193
imul rax, r10, 0x100011b
xor r8, rax
and r8, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r11, r8
shl r11, 4
add r11, qword [rcx + 0x18]
mov rax, qword [r11]
cmp rbx, rax
je 0x14007f459
mov rbx, qword [r11 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rax
je 0x14007f459
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x14007f410
cmp edx, dword [rbx + 0x18]
jne 0x14007f410
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x28
mov rcx, rdi
call fcn.140233b10
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14007f4ef
mov rax, qword [rdi]
cmp rbx, rax
je 0x14007f48e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r8, 4
mov rdx, qword [r9 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r9 + 8]
jne 0x14007f4b0
mov qword [rdx], rdi
mov rax, qword [r9 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x14007f4dc
cmp rax, rbx
jne 0x14007f4ba
mov qword [rdx], rdi
jmp 0x14007f4dc
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14007f4dc
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r9
call fcn.1400a9240
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007f500
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x14007f557
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x14007f540
mov r15, qword [r8]
imul r10, r15, 0x1000193
xor r10, r9
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r10, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r10]
cmp rbx, rax
je 0x14007f5ee
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14007f5ee
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x14007f585
mov rcx, qword [r14 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x14007f5b5
inc rcx
test edx, edx
jne 0x14007f5a0
test r8d, r8d
jne 0x14007f585
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea edx, [r8 + 0x28]
mov rcx, rdi
call fcn.140233b10
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14007f680
mov rax, qword [rdi]
cmp rbx, rax
je 0x14007f623
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x14007f641
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x14007f66d
cmp rax, rbx
jne 0x14007f64b
mov qword [rdx], rdi
jmp 0x14007f66d
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14007f66d
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1400a92e0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007f690
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x14007f6e7
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x14007f6d0
mov r15, qword [r8]
imul r10, r15, 0x1000193
xor r10, r9
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r10, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r10]
cmp rbx, rax
je 0x14007f77e
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14007f77e
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x14007f715
mov rcx, qword [r14 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x14007f745
inc rcx
test edx, edx
jne 0x14007f730
test r8d, r8d
jne 0x14007f715
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea edx, [r8 + 0x30]
mov rcx, rdi
call fcn.140233b10
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14007f810
mov rax, qword [rdi]
cmp rbx, rax
je 0x14007f7b3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x14007f7d1
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x14007f7fd
cmp rax, rbx
jne 0x14007f7db
mov qword [rdx], rdi
jmp 0x14007f7fd
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14007f7fd
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1400a9380
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007f820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r12, r8
mov r15, rcx
mov r13, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x14007f861
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x14007f894
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r13
jb 0x14007f880
mov r14, qword [r15 + 0x30]
and r14, rdx
mov rbx, qword [r15 + 8]
add r14, r14
mov rax, qword [r15 + 0x18]
mov rsi, qword [rax + r14*8]
cmp rbx, rsi
je 0x14007f929
mov rbx, qword [rax + r14*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x14007f929
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x14007f8cf
mov rdx, qword [rbx + 0x10]
mov rcx, r12
cmp r9, 0x10
jb 0x14007f8dc
mov rcx, qword [r12]
cmp r13, qword [rbx + 0x20]
jne 0x14007f8b7
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov r9, qword [r12 + 0x18]
jne 0x14007f8b7
lea rcx, [r15 + 8]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rcx + 8]
mov rdx, rdi
call fcn.1400a9bd0
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov byte [rax + 8], 0
jmp 0x14007fa2c
mov rax, qword [rdi]
cmp rbx, rax
je 0x14007f95e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [r15 + 8]
jne 0x14007f97b
mov qword [rdx + r14*8], rdi
mov rax, qword [r15 + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x14007f9aa
cmp rax, rbx
jne 0x14007f986
mov qword [rdx + r14*8], rdi
jmp 0x14007f9aa
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x14007f9aa
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14036d7c4]
test rax, rax
jns 0x14007f9cb
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14007f9dc
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [r15]
jbe 0x14007fa1c
cmp rdx, 0x200
jae 0x14007f9f9
lea rdx, [rdx*8]
jmp 0x14007fa0b
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14007fa0b
add rdx, rdx
mov rcx, r15
call fcn.140058d90
mov rcx, r15
call fcn.1400a9fc0
nop
mov r9, qword [rsp + 0x78]
mov qword [r9], rdi
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14007fd60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r11, qword [r10 + 0x30]
and r11, r9
mov rbx, qword [r10 + 8]
mov rdx, r11
add rdx, rdx
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x14007fe6b
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x14007fe6b
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x14007fe24
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.140233b10
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14007ff01
mov rax, qword [rdi]
cmp rbx, rax
je 0x14007fea0
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r11, 4
mov rdx, qword [r10 + 0x18]
add rdx, r11
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x14007fec2
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r11 + rax + 8], rdi
jmp 0x14007feee
cmp rax, rbx
jne 0x14007fecc
mov qword [rdx], rdi
jmp 0x14007feee
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14007feee
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r11 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r11 + 8], rcx
mov rcx, r10
call fcn.1400a9420
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14007ff20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rsi
mov rsi, rdx
mov r14, rcx
movsxd rdx, dword [r8 + 8]
mov r9, qword [r8]
imul r15, rdx, 0x1000193
imul rax, r9, 0x100011b
xor r15, rax
and r15, qword [rcx + 0x30]
mov rdi, qword [rcx + 8]
mov rbx, r15
shl rbx, 4
add rbx, qword [rcx + 0x18]
mov rax, qword [rbx]
cmp rax, rdi
jne 0x14007ff83
mov rbx, rdi
jmp 0x14007ff90
mov rbx, qword [rbx + 8]
mov rbx, qword [rbx]
nop word [rax + rax]
cmp rbx, rax
je 0x14007ffb3
mov rbx, qword [rbx + 8]
cmp r9, qword [rbx + 0x10]
jne 0x14007ff90
cmp edx, dword [rbx + 0x18]
jne 0x14007ff90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14008009e
mov rdi, qword [rdi]
mov r13, qword [rdi + 8]
mov r9, r8
mov r8, r13
mov rdx, rdi
add rcx, 8
call fcn.14007e640
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jb 0x1400800b6
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14008003e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
shl r15, 4
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, rcx
jne 0x14008005f
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x14008008b
cmp rax, rbx
jne 0x140080069
mov qword [rdx], rdi
jmp 0x14008008b
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14008008b
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
call fcn.1400a9240
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14036d7b0]
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400800d0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rsi
mov r11, r8
mov rsi, rdx
mov r14, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x140080127
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x140080110
mov r10, qword [r8]
imul r15, r10, 0x1000193
xor r15, r9
and r15, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r15, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r15]
cmp rbx, rax
je 0x140080199
mov rbx, qword [rcx + r15 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140080199
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x140080155
mov rcx, qword [r11 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140080185
inc rcx
test edx, edx
jne 0x140080170
test r8d, r8d
jne 0x140080155
mov qword [rsi], rbx
mov byte [rsi + 8], r8b
mov rax, rsi
jmp 0x140080284
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r13, qword [rdi + 8]
mov r9, r11
mov r8, r13
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.14007e640
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jb 0x14008029c
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140080228
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, rcx
jne 0x140080245
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x140080271
cmp rax, rbx
jne 0x14008024f
mov qword [rdx], rdi
jmp 0x140080271
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140080271
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
call fcn.1400a92e0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14036d7b0]
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400802b0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rsi
mov r11, r8
mov rsi, rdx
mov r14, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x140080307
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400802f0
mov r10, qword [r8]
imul r15, r10, 0x1000193
xor r15, r9
and r15, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r15, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r15]
cmp rbx, rax
je 0x140080379
mov rbx, qword [rcx + r15 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140080379
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x140080335
mov rcx, qword [r11 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x140080365
inc rcx
test edx, edx
jne 0x140080350
test r8d, r8d
jne 0x140080335
mov qword [rsi], rbx
mov byte [rsi + 8], r8b
mov rax, rsi
jmp 0x140080464
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r13, qword [rdi + 8]
mov r9, r11
mov r8, r13
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.14007e6c0
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x14008047c
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140080408
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, rcx
jne 0x140080425
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x140080451
cmp rax, rbx
jne 0x14008042f
mov qword [rdx], rdi
jmp 0x140080451
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140080451
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, r14
call fcn.1400a9380
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14036d7b0]
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3