joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400866fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 8
jb 0x140086721
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140086779
cmp qword [rcx + rdx*8], rdi
jne 0x14008676e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140086772
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140086786
cmp qword [rcx + rdx*8], rdi
jne 0x140086786
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.14005b734
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140086b18
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x18], 8
mov r9, qword [rcx + 0x10]
jb 0x140086b26
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
add r9, r9
je 0x140086b56
movzx eax, byte [r8 + rcx]
movabs r10, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r10
cmp r8, r9
jb 0x140086b38
mov rax, rdx
ret
Function at 0x140086ea8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r8
mov r11, rdx
mov rdi, rcx
mov rcx, r8
call fcn.140086b18
mov r10, rax
mov qword [rsp + 0x28], rax
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x28]
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
inc r8
cmp r8, 8
jb 0x140086ef8
mov rcx, qword [rdi + 0x30]
and rcx, rdx
mov r8, qword [rdi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [r8 + rax*8]
lea r9, [rcx + rcx]
mov rdx, qword [rdi + 8]
cmp qword [r8 + r9*8], rdx
jne 0x140086f40
mov rcx, rdx
jmp 0x140086f48
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140086f62
cmp qword [rax + 0x10], r10
je 0x140086f58
mov rax, qword [rax]
jmp 0x140086f35
mov qword [rsp + 0x20], rax
mov rcx, rax
jmp 0x140086f6d
mov rax, rdx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
cmp rcx, rdx
je 0x140086ff9
mov rdx, qword [rax + 0x18]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140086f87
mov rcx, qword [rbx]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x140086f94
mov r9, qword [rdx]
mov r8, qword [rdx + 0x10]
cmp r8, qword [rbx + 0x10]
jne 0x140087026
test r8, r8
je 0x140086fc3
sub r9, rcx
movzx edx, word [rcx + r9]
movzx r10d, word [rcx]
cmp dx, r10w
jne 0x140086ff0
add rcx, 2
sub r8, 1
jne 0x140086faa
xor ecx, ecx
test ecx, ecx
jne 0x140087026
and qword [r11], 0
and qword [r11 + 8], 0
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140086fdf
lock inc dword [rcx + 8]
mov rcx, qword [rax + 0x18]
mov qword [r11], rcx
mov rcx, qword [rax + 0x20]
mov qword [r11 + 8], rcx
jmp 0x140087002
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140086fc5
and qword [r11], 0
and qword [r11 + 8], 0
mov rax, r11
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
ret
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140087b3c
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.1400870f4
lea rcx, [rax + 8]
call fcn.140061754
mov rcx, rax
call fcn.14008691c
mov r8, rax
lea rdx, str.hash_collision_in_GenericEtwPropertyDictionary
lea rcx, [rsp + 0x70]
call fcn.140087128
nop
lea r8, [0x14034ada0]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400871d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.14008722c
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140087ae8
lea rdx, [0x14047c090]
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x1400873b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, rdx
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x1400873e7
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rcx, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp qword [rax + rsi*8], rcx
jne 0x140087423
mov rbx, rcx
jmp 0x14008742b
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + rsi*8]
je 0x140087456
mov rdx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140087446
cmp rbx, qword [rax + rsi*8]
jne 0x140087434
jmp 0x140087456
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140087544
mov rdi, qword [rcx]
mov r12, qword [rdi + 8]
mov r9, r8
mov r8, r12
mov rdx, rdi
call fcn.140087808
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jae 0x140087493
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400874e7
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x140087500
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x140087530
cmp qword [rdx + rsi*8], rbx
jne 0x14008750c
mov qword [rdx + rsi*8], rdi
jmp 0x140087530
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x140087530
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400789e8
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140088a7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r10d, r8d
mov dword [rbp - 0x29], r8d
mov rbx, rdx
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
mov r9, rcx
movzx eax, byte [rbp + r8 - 0x29]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x140088ab4
mov rcx, qword [r9 + 0x48]
and rcx, rdx
mov rdx, qword [r9 + 0x30]
mov rax, rcx
add rax, rax
lea r8, [rcx + rcx]
mov rdi, qword [rdx + r8*8]
mov rax, qword [rdx + rax*8]
cmp rdi, qword [r9 + 0x20]
jne 0x140088afd
mov rcx, qword [r9 + 0x20]
jmp 0x140088b05
mov rcx, qword [rdx + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140088b15
cmp dword [rax + 0x10], r10d
je 0x140088b19
mov rax, qword [rax]
jmp 0x140088af1
mov rax, qword [r9 + 0x20]
cmp rax, qword [r9 + 0x20]
je 0x140088b5c
mov rdx, qword [rax + 0x20]
mov rcx, qword [rax + 0x18]
jmp 0x140088b42
mov rax, qword [rcx]
cmp rax, qword [rbx]
jne 0x140088b3b
mov rax, qword [rcx + 8]
cmp rax, qword [rbx + 8]
je 0x140088b47
add rcx, 0x200
cmp rcx, rdx
jne 0x140088b29
cmp rcx, rdx
je 0x140088b5c
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
ja 0x140088b8b
jmp 0x140088bd3
lea rdx, [rbp - 0x29]
lea rcx, [r9 + 0x18]
call fcn.1400890b0
mov rdx, rbx
mov rcx, rax
call fcn.1400891cc
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
and dword [rbp + 0x23], 0
lea rax, str.Config_contains_the_same_ruleId
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x40
mov qword [rbp + 0x27], rbx
mov dword [rbp + 0x2f], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403d7294]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
lea rdx, str.adding_a_rule_with_an_existing_rule_id
lea rcx, [rbp - 0x21]
call fcn.140067138
lea rdx, [0x14047c000]
lea rcx, [rbp - 0x21]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x1400890b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1400890d2
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r9, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r9*8], rdx
jne 0x140089119
mov rcx, rdx
jmp 0x140089121
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140089138
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x140089133
mov rax, qword [rax]
jmp 0x14008910e
mov rcx, rax
jmp 0x14008913e
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1400891b7
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.140089968
mov rdx, rax
movabs rcx, 0x555555555555554
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14008918c
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14008972c
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008972c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 4
jb 0x140089763
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x1400897f7
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x1400897f7
mov ecx, dword [r11]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x1400897bc
cmp rdi, qword [rax + r8*8]
jne 0x1400897ab
jmp 0x1400897f7
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14005973c
mov rcx, rbx
call fcn.1402e0278
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x140089925
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140089831
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14008984e
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14008987d
cmp rax, rdi
jne 0x140089859
mov qword [rdx + r8*8], rbx
jmp 0x14008987d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14008987d
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14038ac0c]
test rax, rax
jns 0x14008989e
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400898af
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14008991a
cmp rdx, 0x200
jae 0x1400898c7
shl rdx, 3
jmp 0x1400898d9
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400898d9
add rdx, rdx
mov rcx, rsi
call fcn.1400591e0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140089915
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14008972c
cmp rdi, qword [rsp + 0x20]
jne 0x1400898f3
mov r10, qword [rsp + 0x78]
mov qword [r10], rbx
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400899a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x1400899c9
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140089a21
cmp qword [rcx + rdx*8], rdi
jne 0x140089a16
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140089a1a
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140089a2e
cmp qword [rcx + rdx*8], rdi
jne 0x140089a2e
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.14005973c
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008f1a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008f1cd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008f201
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008f1e3
and rcx, qword [0x1404a41f0]
mov r14, qword [0x1404a41d8]
mov rax, rcx
mov r10, qword [0x1404a41c8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008f22f
mov rcx, r10
jmp 0x14008f237
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008f2e4
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008f251
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008f261
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008f293
mov rdi, rsi
test rsi, rsi
je 0x14008f28d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008f298
add r8, 2
sub rdi, 1
jne 0x14008f275
xor ecx, ecx
test ecx, ecx
je 0x14008f2a1
mov rax, qword [rax]
jmp 0x14008f224
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008f28f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008f2ae
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008f2b8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008f2e4
test r11, r11
je 0x14008f2de
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008f2f0
add rcx, 2
sub r11, 1
jne 0x14008f2c5
xor ecx, ecx
test ecx, ecx
je 0x14008f2e7
mov rax, r10
cmp rax, r10
jne 0x14008f2f9
xor al, al
jmp 0x14008f302
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008f2e0
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400931d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400931fd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140093231
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140093213
and rcx, qword [0x1404a4230]
mov r14, qword [0x1404a4218]
mov rax, rcx
mov r10, qword [0x1404a4208]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009325f
mov rcx, r10
jmp 0x140093267
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140093314
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140093281
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140093291
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400932c3
mov rdi, rsi
test rsi, rsi
je 0x1400932bd
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400932c8
add r8, 2
sub rdi, 1
jne 0x1400932a5
xor ecx, ecx
test ecx, ecx
je 0x1400932d1
mov rax, qword [rax]
jmp 0x140093254
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400932bf
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400932de
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400932e8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140093314
test r11, r11
je 0x14009330e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140093320
add rcx, 2
sub r11, 1
jne 0x1400932f5
xor ecx, ecx
test ecx, ecx
je 0x140093317
mov rax, r10
cmp rax, r10
jne 0x140093329
xor al, al
jmp 0x140093332
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140093310
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140093350
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009337d
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400933b1
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140093393
and rcx, qword [0x1404a42b0]
mov r14, qword [0x1404a4298]
mov rax, rcx
mov r10, qword [0x1404a4288]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400933df
mov rcx, r10
jmp 0x1400933e7
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140093494
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140093401
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140093411
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x140093443
mov rdi, rsi
test rsi, rsi
je 0x14009343d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x140093448
add r8, 2
sub rdi, 1
jne 0x140093425
xor ecx, ecx
test ecx, ecx
je 0x140093451
mov rax, qword [rax]
jmp 0x1400933d4
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009343f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009345e
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x140093468
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140093494
test r11, r11
je 0x14009348e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400934a0
add rcx, 2
sub r11, 1
jne 0x140093475
xor ecx, ecx
test ecx, ecx
je 0x140093497
mov rax, r10
cmp rax, r10
jne 0x1400934a9
xor al, al
jmp 0x1400934b2
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140093490
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400934d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400934fd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x140093531
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x140093513
and rcx, qword [0x1404a4270]
mov r14, qword [0x1404a4258]
mov rax, rcx
mov r10, qword [0x1404a4248]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009355f
mov rcx, r10
jmp 0x140093567
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140093614
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x140093581
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x140093591
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400935c3
mov rdi, rsi
test rsi, rsi
je 0x1400935bd
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400935c8
add r8, 2
sub rdi, 1
jne 0x1400935a5
xor ecx, ecx
test ecx, ecx
je 0x1400935d1
mov rax, qword [rax]
jmp 0x140093554
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400935bf
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400935de
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400935e8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x140093614
test r11, r11
je 0x14009360e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x140093620
add rcx, 2
sub r11, 1
jne 0x1400935f5
xor ecx, ecx
test ecx, ecx
je 0x140093617
mov rax, r10
cmp rax, r10
jne 0x140093629
xor al, al
jmp 0x140093632
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140093610
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret