joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008f29c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x14008efb5
call fcn.14007b664
mov dword [rax], 0x16
call fcn.14007b4f8
jmp 0x14008f111
mov eax, dword [rcx + 0x14]
shr eax, 0xd
mov ebp, 1
test bpl, al
je 0x14008f111
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test bpl, al
jne 0x14008f111
mov eax, dword [rcx + 0x14]
shr eax, 1
test bpl, al
je 0x14008efec
lock or dword [rcx + 0x14], 0x10
jmp 0x14008f111
lock or dword [rcx + 0x14], ebp
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x14008efff
call fcn.1400930a0
mov r14d, dword [rbx + 0x10]
cmp r14d, ebp
jne 0x14008f010
mov rax, qword [rbx]
mov r15b, byte [rax]
jmp 0x14008f013
xor r15b, r15b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.14008e260
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.14008ea18
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x14008f0ff
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x14008f0a6
mov rcx, rbx
call fcn.14008e260
cmp eax, 0xffffffff
je 0x14008f091
mov rcx, rbx
call fcn.14008e260
cmp eax, 0xfffffffe
je 0x14008f091
mov rcx, rbx
call fcn.14008e260
movsxd rdi, eax
lea rsi, [0x1400d7c80]
mov rcx, rbx
sar rdi, 6
call fcn.14008e260
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x14008f098
lea rdx, [0x1400d0900]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x14008f0a6
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14008f0cc
mov eax, dword [rbx + 0x14]
shr eax, 6
test bpl, al
je 0x14008f0cc
mov eax, dword [rbx + 0x14]
shr eax, 8
test bpl, al
jne 0x14008f0cc
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp r14d, ebp
jne 0x14008f0e7
movzx ecx, byte [rdx]
shl cx, 8
movzx eax, r15b
or cx, ax
dec dword [rbx + 0x10]
jmp 0x14008f0f3
movzx ecx, word [rdx]
mov ebp, 2
add dword [rbx + 0x10], 0xfffffffe
lea rax, [rdx + rbp]
mov qword [rbx], rax
movzx eax, cx
jmp 0x14008f116
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
jmp 0x14008ef80
Function at 0x140095fe4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140096014
xor eax, eax
jmp 0x1400960d7
mov rbp, rbx
cmp word [rax], si
je 0x140096039
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140096020
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14009601c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140094808
movsxd r14, eax
test eax, eax
jne 0x140096077
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14009600d
mov rcx, r14
call fcn.14008f834
mov rdi, rax
test rax, rax
jne 0x140096090
xor ecx, ecx
call fcn.14008e224
jmp 0x14009606c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140094808
test eax, eax
jne 0x1400960c1
mov rcx, rdi
call fcn.14008e224
jmp 0x1400960cb
xor ecx, ecx
call fcn.14008e224
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14009c9b8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14008f51c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14008f51c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14009cb08
cmp rax, 0xffffffffffffffff
je 0x14009cb08
xor edi, edi
test rbp, rbp
jle 0x14009cab3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14009131c
mov rbx, rax
test rax, rax
jne 0x14009ca40
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14009caa9
mov edx, 0x8000
mov ecx, r14d
call fcn.14008b49c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140092998
cmp eax, 0xffffffff
je 0x14009ca89
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14009ca50
mov edx, r15d
mov ecx, r14d
call fcn.14008b49c
jmp 0x14009caa9
cmp byte [rsi + 0x38], dil
je 0x14009caa0
cmp dword [rsi + 0x34], 5
jne 0x14009caa0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14009caa9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14008e224
jmp 0x14009cb1c
jns 0x14009cb1c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14008f51c
cmp rax, 0xffffffffffffffff
jne 0x14009cad4
cmp byte [rsi + 0x30], dil
je 0x14009cb1c
mov edi, dword [rsi + 0x2c]
jmp 0x14009cb1c
mov ecx, r14d
call fcn.1400967c0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14009cb1c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14009cb1c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14009cb15
mov eax, dword [rsi + 0x2c]
jmp 0x14009cb1a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14008f51c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14009e480
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14009e4a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14009e4a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1800022e0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002312
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002312
nop word cs:[rax + rax]
jmp 0x180002310
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a94]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a98], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x1800023e8
mov rsi, r10
test r8b, r8b
je 0x180002400
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002380
test r9b, r9b
je 0x180002410
sub rsi, rcx
je 0x1800023e4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x1800023e0
test ebp, ebp
jne 0x1800023e0
add rbx, 1
cmp rsi, rbx
jne 0x1800023a0
jmp 0x1800023e4
test ebp, ebp
jne 0x18000236c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002400
jmp 0x180002410
Function at 0x1423d774c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1423d7756
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1423d777f
pop rbp
sub rbp, 0x33
sub rbp, 0x23d774c
sub rsp, 0x20
jmp 0x1423d779e
mov rax, 0x23d774c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffffa5276319
xor byte [rax], dl
inc rax
dec rcx
jne 0x1423d77bd
jmp 0x1423d77d4
push rcx
nop
invalid
Function at 0x180002ba0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a8c], 0xa
jl 0x180002bd2
mov eax, dword [0x180020a90]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002bd2
nop word cs:[rax + rax]
jmp 0x180002bd0
mov rax, qword gs:[0x60]
mov rbx, qword [rax + 0x18]
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
mov edx, dword [0x180020a94]
lea edi, [rdx - 1]
imul edi, edx
test dil, 1
sete dl
cmp dword [0x180020a98], 0xa
setl r9b
mov r14, qword [rbx + 0x10]
lea r10, [rbx + 0x10]
cmp r14, r10
je 0x180002cc8
or r8b, al
or r9b, dl
lea r11, [rcx - 1]
xor eax, eax
mov rsi, r11
test r8b, r8b
je 0x180002cb0
nop
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002c40
test r9b, r9b
je 0x180002cc0
sub rsi, rcx
je 0x180002cc2
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop word [rax + rax]
movzx edx, word [r15 + rbx*2]
movsx r13d, byte [rcx + rbx]
lea r12d, [rdx - 0x41]
lea ebp, [rdx + 0x20]
cmp r12w, 0x1a
cmovae ebp, edx
lea r12d, [r13 - 0x41]
lea edi, [r13 + 0x20]
cmp r12b, 0x1a
cmovae edi, r13d
cmp ebp, edi
jne 0x180002c9d
test dx, dx
je 0x180002cc2
add rbx, 1
cmp rsi, rbx
jne 0x180002c60
jmp 0x180002cc2
mov r14, qword [r14]
cmp r14, r10
jne 0x180002c37
jmp 0x180002cca
jmp 0x180002cb0
jmp 0x180002cc0
mov rax, qword [r14 + 0x30]
jmp 0x180002cca
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400032c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
movsxd rdx, dword [rdx]
mov rcx, qword [rdi + 0x18]
mov rcx, qword [rcx + 0x40]
call fcn.14003df90
mov rdx, rax
mov rcx, qword [rdi + 0x10]
test byte [rax + 8], 0xf
jne 0x1400032f0
mov byte [rcx + 8], 0
jmp 0x1400032fd
mov rax, qword [rax]
mov qword [rcx], rax
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
add qword [rdi + 0x10], 0x10
mov edx, 0xffffffff
mov rcx, rdi
call fcn.140011e40
mov rbx, rax
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.140011870
nop
movzx r8d, bl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rcx, rbx
shr rcx, 8
movzx edx, cl
xor r8, rdx
imul r8, r9
mov rax, rbx
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x28
movzx eax, al
xor rax, r8
imul rax, r9
mov rcx, rbx
shr rcx, 0x30
movzx edx, cl
xor rax, rdx
imul rax, r9
shr rbx, 0x38
xor rax, rbx
imul rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140006c70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r9
mov r15, r8
mov r14, rdx
mov rbp, rcx
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x20], xmm0
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov r8, qword [r8 + 8]
test r8, r8
je 0x140006cd3
movabs r9, 0x100000001b3
mov rcx, qword [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rdx
cmp rdx, r8
jb 0x140006cc0
mov r9, rbx
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140007680
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140006d0e
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rax + 0x30], xmm1
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x140006eb1
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
jne 0x140006d2c
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r13, [rbp + 8]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], 0
mov ecx, gethostname
call fcn.1401053c8
mov rsi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r15]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rax + 0x30], xmm1
mov rcx, qword [rbp + 0x10]
movss xmm3, dword [rbp]
add rcx, 1
xorps xmm0, xmm0
js 0x140006d82
cvtsi2ss xmm0, rcx
jmp 0x140006d97
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [rbp + 0x38]
xorps xmm2, xmm2
test rdi, rdi
js 0x140006daa
cvtsi2ss xmm2, rdi
jmp 0x140006dc2
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
jbe 0x140006e59
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x14012f408]
comiss xmm0, xmm1
jb 0x140006e00
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140006e00
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x140006e32
cmp rdi, 0x200
jae 0x140006e2f
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x140006e32
mov rdi, rcx
mov rdx, rdi
mov rcx, rbp
call fcn.140007440
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140007680
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r13]
jne 0x140006e92
mov qword [rcx + rax*8], rsi
jmp 0x140006ea4
cmp r9, rdx
jne 0x140006e9d
mov qword [rcx + rax*8], rsi
jmp 0x140006ea9
cmp qword [rcx + rax*8 + 8], r8
jne 0x140006ea9
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
sub rsp, 0x78
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x40], rcx
mov rbp, rcx
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x14000747a
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rbp + 8]
or rax, rbx
bsr rcx, rax
mov qword [rsp + 0x70], rdi
mov r8, rsi
inc ecx
mov qword [rsp + 0x58], r14
shl rbx, cl
lea r14, [rbp + 0x18]
mov rcx, r14
mov qword [rsp + 0x20], r14
lea rdx, [rbx + rbx]
call fcn.1400059d0
lea rax, [rbx - 1]
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x30], rax
mov rbx, qword [rbp + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rsi
je 0x140007640
mov qword [rsp + 0x68], r12
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x60], r13
movabs r10, 0x100000001b3
mov qword [rsp + 0x50], r15
nop word [rax + rax]
movups xmm0, xmmword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
xor ecx, ecx
mov rdi, qword [rdi]
mov rdx, rax
movaps xmmword [rsp + 0x30], xmm0
test r8, r8
je 0x140007534
mov r9, qword [rsp + 0x30]
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r8
jb 0x140007520
mov r12, qword [rbp + 0x30]
and r12, rdx
shl r12, 4
add r12, qword [r14]
mov r15, qword [r12]
cmp r15, rsi
jne 0x140007559
mov qword [r12], rbx
mov qword [r12 + 8], rbx
jmp 0x140007616
mov r14, qword [r12 + 8]
cmp r8, qword [r14 + 0x18]
jne 0x1400075a6
mov rdx, qword [r14 + 0x10]
movq rcx, xmm0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400075a6
mov r8, qword [r14]
cmp r8, rbx
je 0x14000759f
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + 8], rbx
jmp 0x140007607
cmp r15, r14
je 0x1400075e2
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x30], xmm0
mov rbp, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
nop
mov r14, qword [r14 + 8]
cmp rbp, qword [r14 + 0x18]
jne 0x1400075dd
mov rdx, qword [r14 + 0x10]
mov r8, rbp
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007659
cmp r15, r14
jne 0x1400075c0
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r14
mov rax, qword [r14 + 8]
mov qword [rax], rbx
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12], rbx
mov r14, qword [rsp + 0x20]
movabs r10, 0x100000001b3
mov rbp, qword [rsp + 0x40]
mov rbx, rdi
movabs rax, 0xcbf29ce484222325
cmp rdi, rsi
jne 0x140007500
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x58]
add rsp, 0x78
pop rbp
pop rbx
ret
mov r8, qword [r14]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x140007607
Function at 0x140007750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
movups xmm0, xmmword [r8 + 0x10]
mov r11, qword [r8 + 0x18]
mov rdi, rdx
xor edx, edx
mov r10, rcx
movaps xmmword [rsp + 0x20], xmm0
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1400077a3
mov rcx, qword [rsp + 0x20]
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
inc rdx
xor r9, rax
imul r9, rbx
cmp rdx, r11
jb 0x140007790
mov rdx, qword [r10 + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x1400077d7
cmp rax, r8
jne 0x1400077cd
mov rax, qword [r10 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1400077e2
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x1400077e2
cmp rax, r8
jne 0x1400077e2
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, gethostname
dec qword [r10 + 0x10]
mov rcx, qword [r8 + 8]
mov qword [rcx], rbx
mov rcx, qword [r8 + 8]
mov qword [rbx + 8], rcx
mov rcx, r8
call fcn.1401052a0
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140010ec0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140010ef1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x70], rsi
mov rsi, qword [0x1401d02f8]
or rax, rbx
bsr rcx, rax
mov r8, rsi
mov qword [rsp + 0x78], rdi
inc ecx
shl rbx, cl
lea rcx, [0x1401d0308]
lea rdx, [rbx + rbx]
call fcn.1400059d0
lea r10, [rbx - 1]
mov qword [0x1401d0328], rbx
mov rbx, qword [0x1401d02f8]
mov qword [0x1401d0320], r10
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rsi
je 0x1400110e5
mov qword [rsp + 0x60], rbp
movabs r11, 0x100000001b3
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
movups xmm0, xmmword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
xor edx, edx
mov rdi, qword [rdi]
movabs rax, 0xcbf29ce484222325
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rax
test r8, r8
je 0x140010fb4
mov r9, qword [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, r11
cmp rdx, r8
jb 0x140010fa0
mov r12, qword [0x1401d0308]
and rcx, r10
shl rcx, 4
add r12, rcx
mov r15, qword [r12]
cmp r15, rsi
jne 0x140010fdc
mov qword [r12], rbx
mov qword [r12 + 8], rbx
jmp 0x140011092
mov r14, qword [r12 + 8]
cmp r8, qword [r14 + 0x18]
jne 0x140011029
mov rdx, qword [r14 + 0x10]
movq rcx, xmm0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011029
mov r8, qword [r14]
cmp r8, rbx
je 0x140011022
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + 8], rbx
jmp 0x140011088
cmp r15, r14
je 0x140011063
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x20], xmm0
mov rbp, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov r14, qword [r14 + 8]
cmp rbp, qword [r14 + 0x18]
jne 0x14001105e
mov rdx, qword [r14 + 0x10]
mov r8, rbp
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400110a6
cmp r15, r14
jne 0x140011041
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r14
mov rax, qword [r14 + 8]
mov qword [rax], rbx
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12], rbx
movabs r11, 0x100000001b3
mov rbx, rdi
cmp rdi, rsi
je 0x1400110cc
mov r10, qword [0x1401d0320]
jmp 0x140010f70
mov r8, qword [r14]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x140011088
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbx
ret
Function at 0x14002ddd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor esi, esi
lea r11, [0x14011b340]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x14002de3f
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x14002de30
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x14002de56
mov r12d, ebp
jmp 0x14002de60
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x14002dfb9
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14002dfb9
movsd xmm2, qword [0x14012f2d8]
lea r13, [0x14011b340]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x14002debb
test edi, edi
jne 0x14002df10
mov edi, ebp
inc rdx
jmp 0x14002dea0
test byte [r8 + r13 + 1], 0x10
je 0x14002df10
test r10d, r10d
jne 0x14002ded3
cmp r8b, 0x30
jne 0x14002ded3
inc r14d
jmp 0x14002df04
inc r10d
cmp r10d, 0x1e
jg 0x14002df01
test byte [rcx + r13 + 1], 2
je 0x14002dee9
add ecx, 0xffffffd0
jmp 0x14002deef
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x14002df04
inc r9d
test edi, edi
je 0x14002df0b
dec r9d
inc rdx
jmp 0x14002dea0
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x14002dfb9
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14002df9f
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x14002df47
lea rdx, [r11 + 2]
jmp 0x14002df51
cmp al, 0x2b
jne 0x14002df4f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x14011b340]
test byte [r8 + r11 + 1], 2
je 0x14002dfb9
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x14002df70
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x14002dfab
xorps xmm1, xmmword [0x14012fc50]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14002dfbc
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret