joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140152ff8
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r15, r8
mov r12d, edx
mov r14, rcx
call fcn.140153238
mov esi, eax
xor ebx, ebx
test eax, eax
js 0x140153201
mov word [rsp + 0x38], bx
mov rax, qword [0x1401fd228]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
call fcn.140156688
mov esi, eax
test eax, eax
js 0x1401531f7
lea esi, [rbx + 1]
mov qword [r15], rbx
and r12d, 2
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x140153085
mov ebx, 0x80004005
jmp 0x1401531e9
mov r8d, dword [rsp + 0x70]
mov dword [rsp + 0x30], r8d
mov r9d, dword [rsp + 0x64]
mov dword [rsp + 0x34], r9d
mov rdx, r14
mov ecx, 0x1505
movzx eax, word [r14]
jmp 0x1401530b3
imul ecx, ecx, 0x21
xor ecx, eax
lea rdx, [rdx + 2]
movzx eax, word [rdx]
test eax, eax
jne 0x1401530a7
mov eax, 0xae4c415d
mul ecx
shr edx, 5
imul eax, edx, 0x2f
sub ecx, eax
mov eax, ecx
mov qword [rsp + 0x48], rax
lea rcx, [0x1401fd0b0]
mov rdi, qword [rcx + rax*8]
test rdi, rdi
je 0x140153144
mov eax, dword [rdi + 0xc8]
and eax, 2
cmp eax, r12d
jne 0x140153144
mov rax, qword [rdi + 0x70]
cmp dword [rax + 0x1a58], r9d
jne 0x140153144
cmp dword [rax + 0x1a5c], r8d
jne 0x140153144
mov rax, qword [rax + 0x1a50]
lea rdx, [0x1401a3214]
test rax, rax
cmovne rdx, rax
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rcx, r14
call fcn.1401511c0
test eax, eax
jne 0x14015313a
mov qword [r15], rdi
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
jmp 0x1401531e9
mov r8d, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
mov rcx, qword [0x1401fccf8]
movsxd r13, dword [rcx + 8]
test r13, r13
jle 0x1401531f7
mov rbp, rbx
mov rax, qword [rcx]
mov rdi, qword [rax + rbp*8]
mov eax, dword [rdi + 0xc8]
test al, 0x10
je 0x1401531b9
and eax, 2
cmp eax, r12d
jne 0x1401531b9
mov rax, qword [rdi + 0x70]
cmp dword [rax + 0x1a58], r9d
jne 0x1401531b9
cmp dword [rax + 0x1a5c], r8d
jne 0x1401531b9
mov rax, qword [rax + 0x1a50]
lea rdx, [0x1401a3214]
test rax, rax
cmovne rdx, rax
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rcx, r14
call fcn.1401511c0
test eax, eax
je 0x1401531cd
mov rcx, qword [0x1401fccf8]
add rbp, rsi
cmp rbp, r13
jge 0x1401531f7
mov r8d, dword [rsp + 0x30]
mov r9d, dword [rsp + 0x34]
jmp 0x14015315b
mov qword [r15], rdi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 8]
mov rax, qword [rsp + 0x48]
lea rcx, [0x1401fd0b0]
mov qword [rcx + rax*8], rdi
lea rcx, [rsp + 0x38]
call fcn.140155b3c
mov eax, ebx
jmp 0x140153203
lea rcx, [rsp + 0x38]
call fcn.140155b3c
mov eax, esi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14005a600
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140155298
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, ecx
mov esi, edx
mov ecx, dword [0x1401f8a48]
cmp ecx, 0xffffffff
jne 0x1401552e5
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
or eax, 0xffffffff
lock cmpxchg dword [0x1401f8a48], ecx
je 0x1401552d1
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [0x1401f8a48]
lea rax, [0x140155394]
mov qword [0x1401f9490], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140155351
test esi, esi
je 0x140155351
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, 0xb0
xor edx, edx
mov rcx, rax
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x140155335
cmp edi, 9
je 0x140155364
cmp edi, 6
je 0x140155364
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0xc0000017
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [0x1401f8a48]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140155354

Function at 0x140155758
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1401f7030]
xor rax, rsp
mov qword [rsp + 0xa0], rax
or rbp, 0xffffffffffffffff
mov rbx, rcx
mov r8, rbp
xor esi, esi
inc r8
cmp word [rcx + r8*2], si
jne 0x14015578d
mov eax, edx
neg eax
sbb rcx, rcx
and rcx, 0xfffffffffffffff8
add rcx, 0x3f
cmp r8, rcx
ja 0x140155850
mov edi, 0x40
test edx, edx
je 0x1401557ea
cmp dword [0x1401fd244], esi
je 0x1401557d3
mov rdx, rbx
lea rcx, [0x1401fc978]
call fcn.140155a4c
test eax, eax
je 0x140155850
lea r8, str.COMPlus_
mov rdx, rdi
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
jmp 0x1401557ef
mov word [rsp + 0x20], si
mov r8, rbx
lea rcx, [rsp + 0x20]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
xor r8d, r8d
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
movsxd rdi, eax
test eax, eax
je 0x140155850
mov eax, 2
mul rdi
lea rdx, [0x1401a6330]
cmovo rax, rbp
mov rcx, rax
call fcn.14005e254
mov rbx, rax
test rax, rax
je 0x14015584b
mov r8d, edi
lea rcx, [rsp + 0x20]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, rbx
jmp 0x140155852
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14005a600
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14015587c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov dword [rsp + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x18], 0
mov r14d, 1
and dword [rbp + 0x48], 0
mov rdi, r8
mov r13, rdx
mov r15, rcx
mov dword [rbp - 0x30], 4
test byte [rbp + 0x50], r14b
je 0x140155919
mov edx, dword [rbp + 0x58]
call fcn.140155758
mov rbx, rax
test rax, rax
je 0x140155919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
lea r8d, [r14 + 0xf]
mov rcx, rbx
lea rdx, [rbp - 0x10]
and dword [rax], 0
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstoul]
mov r12d, eax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x22
je 0x1401558fe
cmp qword [rbp - 0x10], rbx
jne 0x140155901
xor r14d, r14d
mov rcx, rbx
call qword [sym.imp.tbbmalloc.dll_scalable_free]
test r14d, r14d
je 0x140155919
mov qword [rdi], r12
xor eax, eax
jmp 0x140155a2f
test byte [rbp + 0x50], 0xe
je 0x140155a27
mov rcx, r15
call fcn.140155ab0
test eax, eax
je 0x140155a27
or r14, 0xffffffffffffffff
mov r12d, 0x20019
test byte [rbp + 0x50], 2
je 0x1401559ac
lea rax, [rbp - 0x28]
mov qword [rbp - 0x28], r14
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401559ac
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x18]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x28]
movsxd rbx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
jne 0x1401559ac
cmp dword [rbp + 0x48], 4
je 0x140155a1b
test byte [rbp + 0x50], 4
je 0x140155a27
lea rax, [rbp - 0x20]
mov qword [rbp - 0x20], r14
mov r9d, r12d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoft.NETFramework
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140155a27
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x48]
lea rax, [rbp - 0x18]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x20]
movsxd rbx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
jne 0x140155a27
cmp dword [rbp + 0x48], 4
jne 0x140155a27
mov rax, qword [rbp - 0x18]
mov qword [rdi], rax
jmp 0x140155912
mov qword [rdi], r13
mov eax, 0x80004005
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140155a4c
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
movzx r8d, word [rdx]
mov r11, rdx
mov r10d, 0x1505
xor r9d, r9d
jmp 0x140155a86
lea eax, [r8 - 0x61]
mov edx, r8d
and edx, 0xffffffdf
lea r11, [r11 + 2]
cmp eax, 0x19
cmova edx, r8d
movzx r8d, word [r11]
imul eax, r10d, 0x21
mov r10d, edx
xor r10d, eax
test r8d, r8d
jne 0x140155a63
mov rbx, qword [rsp + 8]
movzx r8d, r10b
mov edx, r8d
shr r8, 5
and edx, 0x1f
mov ecx, dword [rcx + r8*4]
bt ecx, edx
setb r9b
mov eax, r9d
ret

Function at 0x140156f50
Capabilities:
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x1401fb520]
mov rbx, rcx
test eax, eax
jne 0x140156f96
lea rcx, [0x1401fd248]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1401fd268]
mov ecx, 2
cmp eax, ecx
cmovb eax, ecx
imul eax, eax, 0x4e20
mov dword [0x1401f94ac], eax
mov dword [0x1401fb520], 1
and qword [rbx + 8], 0
mov rax, rbx
and qword [rbx + 0x10], 0
mov dword [rbx], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14015af68
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
jmp 0x14015af77
imul eax, eax, 0x21
xor eax, edx
inc rcx
movsx edx, byte [rcx]
test edx, edx
jne 0x14015af6f
ret

Function at 0x140180ab8
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x10], edx
push rbp
push rbx
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
xor r13d, r13d
mov r14d, r8d
mov rdi, rcx
mov ebx, r13d
cmp qword [rcx + 0x558], r13
jne 0x140180c3f
mov r12d, dword [rcx + 0x24]
cmp r12d, 0x18
jbe 0x140180cdd
lea rdx, [0x1401a6330]
lea ecx, [r13 + 0x28]
call fcn.14005e240
mov qword [rbp + 0x40], rax
mov rcx, rax
test rax, rax
je 0x140180c2e
mov qword [rax], r13
mov qword [rax + 8], r13
mov dword [rax + 0x10], 0x10
lea eax, [r13 + 0xc]
mov word [rcx + 0x14], ax
mov byte [rcx + 0x16], 1
mov qword [rcx + 0x18], r13
mov qword [rcx + 0x20], r13
mov qword [rdi + 0x558], rcx
test rcx, rcx
je 0x140180c35
cmp dword [rdi + 0x18f0], 1
lea edx, [r13 + 4]
mov eax, r13d
cmove eax, edx
lea rdx, [0x1401b72e0]
mov edx, dword [rax + rdx]
call fcn.140189958
mov ebx, eax
test eax, eax
js 0x140180cdd
lea r14d, [r13 + 1]
mov r15d, 0x1505
lea r13, [rdi + 0x5d0]
mov rax, qword [r13]
lea r8, [rbp + 0x58]
mov edx, r14d
mov rcx, r13
call qword [rax + 0xa8]
mov ebx, eax
test eax, eax
js 0x140180cdd
mov r9, qword [rbp + 0x58]
mov edx, 1
mov r8d, edx
mov rcx, rdi
call fcn.1401869ec
lea rcx, [rdi + 0x1658]
mov edx, eax
lea r8, [rbp + 0x40]
call fcn.14015acb8
mov ebx, eax
test eax, eax
js 0x140180cdd
and dword [rbp + 0x48], 0
lea rcx, [rbp + 0x48]
mov r8d, r15d
movzx eax, byte [rcx]
inc rcx
imul r8d, r8d, 0x21
xor r8d, eax
lea rax, [rbp + 0x4c]
cmp rcx, rax
jb 0x140180be0
mov rcx, qword [rbp + 0x40]
call fcn.14015af68
mov rcx, qword [rdi + 0x558]
lea edx, [r8 + rax]
call fcn.1401801cc
test rax, rax
je 0x140180c35
mov ecx, r14d
inc r14d
bts ecx, 0x18
mov dword [rax], ecx
cmp r14d, r12d
jbe 0x140180b87
jmp 0x140180cdd
mov qword [rdi + 0x558], r13
mov ebx, 0x8007000e
jmp 0x140180cdd
add rcx, 0x5d0
lea r8, [rbp + 0x58]
and r14d, 0xffffff
mov edx, r14d
mov rax, qword [rcx]
call qword [rax + 0xa8]
mov ebx, eax
test eax, eax
js 0x140180cdd
mov r9, qword [rbp + 0x58]
mov edx, 1
mov r8d, edx
mov rcx, rdi
call fcn.1401869ec
lea rcx, [rdi + 0x1658]
mov edx, eax
lea r8, [rbp + 0x40]
call fcn.14015acb8
mov ebx, eax
test eax, eax
js 0x140180cdd
mov dword [rbp + 0x48], r13d
lea rcx, [rbp + 0x48]
mov r15d, 0x1505
movzx eax, byte [rcx]
inc rcx
imul r15d, r15d, 0x21
xor r15d, eax
lea rax, [rbp + 0x4c]
cmp rcx, rax
jb 0x140180c9d
mov rcx, qword [rbp + 0x40]
call fcn.14015af68
mov rcx, qword [rdi + 0x558]
lea edx, [r15 + rax]
call fcn.1401801cc
test rax, rax
je 0x140180c35
bts r14d, 0x18
mov dword [rax], r14d
mov eax, ebx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401813a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x430]
xor eax, eax
mov rsi, qword [rsp + 0x70]
xorps xmm0, xmm0
mov r15d, 1
mov r12b, r9b
mov r13, r8
mov r14d, edx
mov rbp, rcx
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
mov qword [rsi + 0x30], rax
mov dword [rsi + 8], 2
and dword [rsi + 0x20], eax
and dword [rsi + 0x24], eax
lea eax, [r15 + 3]
mov word [rsi + 0x2c], ax
mov dword [rsi + 0x28], 0x10
mov byte [rsi + 0x2e], r15b
mov dword [rsi], 0xc000000
test rdi, rdi
je 0x1401814b3
mov dword [r11 + 0x28], edx
mov ecx, 0x1505
lea rdx, [r11 + 0x28]
movzx eax, byte [rdx]
inc rdx
imul ecx, ecx, 0x21
xor ecx, eax
lea rax, [rsp + 0x74]
cmp rdx, rax
jb 0x14018142a
mov eax, ecx
xor edx, edx
div dword [rdi + 0x20]
mov rax, qword [rdi + 0x18]
movsxd rcx, edx
mov ecx, dword [rax + rcx*4]
mov dword [rsp + 0x70], ecx
jmp 0x14018149c
mov r9d, dword [rbx]
mov r8, r13
and r9d, 0xffffff
mov edx, r14d
mov rcx, rbp
call fcn.140182848
test eax, eax
js 0x140181524
jne 0x14018149c
mov edx, dword [rbx]
mov rcx, rsi
or edx, 0xc000000
xor r15d, r15d
call fcn.140155c5c
test eax, eax
js 0x140181524
test r12b, r12b
jne 0x140181521
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14015a224
mov rbx, rax
test rax, rax
jne 0x140181456
jmp 0x140181521
mov eax, dword [rcx + 0x18]
bt rax, 0xc
jae 0x1401814de
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x50]
call fcn.1401751d0
test eax, eax
js 0x140181524
mov ebx, dword [rsp + 0x70]
test ebx, ebx
je 0x140181521
mov edi, dword [rsp + 0x50]
jmp 0x14018151d
mov edi, dword [rcx + 0x50]
mov ebx, r15d
inc edi
jmp 0x14018151d
mov r9d, ebx
mov r8, r13
mov edx, r14d
mov rcx, rbp
call fcn.140182848
test eax, eax
js 0x140181524
jne 0x14018151b
mov edx, ebx
mov rcx, rsi
or edx, 0xc000000
xor r15d, r15d
call fcn.140155c5c
test eax, eax
js 0x140181524
test r12b, r12b
jne 0x140181521
inc ebx
cmp ebx, edi
jb 0x1401814e8
mov eax, r15d
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140184054
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, qword [rcx + 0x490]
mov r12, r9
mov r13d, r8d
mov r14d, edx
mov rdi, rcx
test rsi, rsi
je 0x140184152
mov dword [rbp + 0x30], edx
lea r10, [rbp + 0x30]
mov eax, 0x1505
movzx ecx, byte [r10]
inc r10
imul eax, eax, 0x21
xor eax, ecx
lea rcx, [rbp + 0x34]
cmp r10, rcx
jb 0x14018409b
xor edx, edx
div dword [rsi + 0x20]
mov rax, qword [rsi + 0x18]
movsxd rcx, edx
lea rdx, [rbp + 0x30]
mov ecx, dword [rax + rcx*4]
mov dword [rbp + 0x30], ecx
mov rcx, rsi
call fcn.14015a224
mov rbx, rax
test rax, rax
je 0x140184124
lea r15, [rdi + 0xdb8]
mov r9, qword [r15]
lea r8, [rbp - 8]
mov edx, dword [rbx]
mov rcx, r15
call qword [r9 + 0xa8]
mov r10d, eax
test eax, eax
js 0x14018412a
mov rdx, qword [rbp - 8]
movzx ecx, word [rdx]
cmp ecx, r13d
jne 0x140184110
mov rcx, rdi
call fcn.140172aac
cmp eax, r14d
je 0x14018414a
lea rdx, [rbp + 0x30]
mov rcx, rsi
call fcn.14015a224
mov rbx, rax
test rax, rax
jne 0x1401840dd
mov r10d, 0x80131130
mov rbx, qword [rsp + 0x68]
mov eax, r10d
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, dword [rbx]
mov dword [r12], eax
jmp 0x14018412a
mov eax, dword [rcx + 0x18]
bt rax, 0x18
jae 0x140184178
lea r9, [rbp + 0x30]
lea r8, [rbp - 0x10]
call fcn.14018e6ac
mov r10d, eax
test eax, eax
js 0x14018412a
mov ebx, dword [rbp + 0x30]
mov esi, dword [rbp - 0x10]
jmp 0x140184185
mov esi, dword [rcx + 0x80]
mov ebx, 1
inc esi
cmp ebx, esi
jae 0x140184124
lea r15, [rdi + 0xdb8]
mov rax, qword [r15]
lea r8, [rbp - 8]
mov edx, ebx
mov rcx, r15
call qword [rax + 0xa8]
mov r10d, eax
test eax, eax
js 0x14018412a
mov rdx, qword [rbp - 8]
movzx eax, word [rdx]
cmp eax, r13d
jne 0x1401841c2
mov rcx, rdi
call fcn.140172aac
cmp eax, r14d
je 0x1401841cd
inc ebx
cmp ebx, esi
jb 0x140184190
jmp 0x140184124
mov dword [r12], ebx
jmp 0x14018412a
Function at 0x140184588
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using djb2

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, qword [rcx + 0x530]
mov r9d, edx
and r9d, 0xffffff
xor r10d, r10d
movabs rax, 0x100000000000
mov rbx, r8
mov r12d, edx
mov rdi, rcx
test qword [rcx + 0x18], rax
je 0x14018462b
mov rcx, qword [rcx + 0x3a0]
lea r8, [rbp + 0x40]
lea edx, [r10 + 0x2c]
movzx eax, word [rcx]
mov word [rbp + 0x40], ax
mov al, byte [rcx + 2]
mov rcx, rdi
mov byte [rbp + 0x42], al
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
call fcn.1401965e4
mov r10d, eax
test eax, eax
js 0x1401847b6
mov edx, dword [rbp + 0x48]
mov ecx, dword [rbp + 0x58]
and dword [rbx + 8], 0
mov dword [rbx + 0x10], ecx
sub ecx, edx
mov dword [rbx + 4], ecx
mov dword [rbx], 0x2c000000
mov dword [rbx + 0x14], edx
mov dword [rbx + 0xc], edx
jmp 0x1401847b6
xor eax, eax
xorps xmm0, xmm0
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
or dword [r8], 0xffffffff
mov dword [r8 + 8], 2
and qword [r8 + 0x18], rax
and dword [r8 + 0x20], eax
and dword [r8 + 0x24], eax
mov eax, 4
mov word [r8 + 0x2c], ax
mov dword [r8 + 0x28], 0x10
mov byte [r8 + 0x2e], 1
test r14, r14
je 0x140184742
mov dword [rbp + 0x48], r12d
lea rdx, [rbp + 0x48]
mov eax, 0x1505
movzx ecx, byte [rdx]
inc rdx
imul eax, eax, 0x21
xor eax, ecx
lea rcx, [rbp + 0x4c]
cmp rdx, rcx
jb 0x140184687
xor edx, edx
div dword [r14 + 0x20]
mov rax, qword [r14 + 0x18]
movsxd rcx, edx
lea rdx, [rbp + 0x48]
mov ecx, dword [rax + rcx*4]
mov dword [rbp + 0x48], ecx
mov rcx, r14
call fcn.14015a224
mov rsi, rax
test rax, rax
je 0x1401847b6
lea r15, [rdi + 0x1498]
mov r9, qword [r15]
lea r8, [rbp - 0x10]
mov edx, dword [rsi]
mov rcx, r15
call qword [r9 + 0xa8]
mov r10d, eax
test eax, eax
js 0x1401847b6
mov rax, qword [rdi + 0x3a0]
movzx ecx, byte [rax + 1]
add rcx, qword [rbp - 0x10]
cmp byte [rax + 2], 2
jne 0x140184705
movzx eax, word [rcx]
jmp 0x140184707
mov eax, dword [rcx]
or eax, 0x2a000000
cmp eax, r12d
jne 0x14018472c
mov edx, dword [rsi]
mov rcx, rbx
or edx, 0x2c000000
call fcn.140155c5c
mov r10d, eax
test eax, eax
js 0x1401847b6
lea rdx, [rbp + 0x48]
mov rcx, r14
call fcn.14015a224
mov rsi, rax
test rax, rax
jne 0x1401846cd
jmp 0x1401847b6
mov esi, 1
cmp dword [rcx + 0xd0], esi
jb 0x1401847b6
lea r14, [rcx + 0x1498]
mov rax, qword [r14]
lea r8, [rbp - 0x10]
mov edx, esi
mov rcx, r14
call qword [rax + 0xa8]
mov r10d, eax
test eax, eax
js 0x1401847b6
mov rax, qword [rdi + 0x3a0]
movzx ecx, byte [rax + 1]
add rcx, qword [rbp - 0x10]
cmp byte [rax + 2], 2
jne 0x140184789
movzx eax, word [rcx]
jmp 0x14018478b
mov eax, dword [rcx]
or eax, 0x2a000000
cmp eax, r12d
jne 0x1401847ac
mov edx, esi
mov rcx, rbx
or edx, 0x2c000000
call fcn.140155c5c
mov r10d, eax
test eax, eax
js 0x1401847b6
inc esi
cmp esi, dword [rdi + 0xd0]
jbe 0x140184756
mov eax, r10d
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401847c8
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, qword [rcx + 0x520]
xor r10d, r10d
movabs rax, 0x40000000000
mov rbx, r8
mov edi, edx
mov rsi, rcx
test qword [rcx + 0x18], rax
je 0x14018489d
mov ecx, edx
and ecx, 0xff000000
xor eax, eax
lea rdx, [0x1401b7320]
cmp dword [rdx + rax*4], ecx
je 0x14018482a
inc rax
cmp rax, 2
jb 0x140184811
xor edi, edi
jmp 0x140184834
and edi, 0xffffff
add edi, edi
or edi, eax
mov rcx, qword [rsi + 0x380]
lea r8, [rbp + 0x30]
mov r9d, edi
mov edx, 0x2a
movzx eax, word [rcx + 6]
mov word [rbp + 0x30], ax
mov al, byte [rcx + 8]
mov rcx, rsi
mov byte [rbp + 0x32], al
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
call fcn.1401965e4
mov r10d, eax
test eax, eax
js 0x140184a00
mov edx, dword [rbp + 0x48]
mov ecx, dword [rbp - 0x10]
and dword [rbx + 8], 0
mov dword [rbx + 0x10], ecx
sub ecx, edx
mov dword [rbx + 4], ecx
mov dword [rbx], 0x2a000000
mov dword [rbx + 0x14], edx
mov dword [rbx + 0xc], edx
jmp 0x140184a00
xor eax, eax
xorps xmm0, xmm0
movups xmmword [r8], xmm0
movups xmmword [r8 + 0x10], xmm0
movups xmmword [r8 + 0x20], xmm0
mov qword [r8 + 0x30], rax
or dword [r8], 0xffffffff
mov dword [r8 + 8], 2
and qword [r8 + 0x18], rax
and dword [r8 + 0x20], eax
and dword [r8 + 0x24], eax
mov eax, 4
mov word [r8 + 0x2c], ax
mov dword [r8 + 0x28], 0x10
mov byte [r8 + 0x2e], 1
test r15, r15
je 0x14018499c
mov dword [rbp + 0x30], edi
lea rdx, [rbp + 0x30]
mov eax, 0x1505
movzx ecx, byte [rdx]
inc rdx
imul eax, eax, 0x21
xor eax, ecx
lea rcx, [rbp + 0x34]
cmp rdx, rcx
jb 0x1401848f8
xor edx, edx
div dword [r15 + 0x20]
mov rax, qword [r15 + 0x18]
movsxd rcx, edx
lea rdx, [rbp + 0x30]
mov ecx, dword [rax + rcx*4]
mov dword [rbp + 0x30], ecx
mov rcx, r15
call fcn.14015a224
mov r14, rax
test rax, rax
je 0x140184a00
lea r12, [rsi + 0x13e8]
mov r9, qword [r12]
lea r8, [rbp - 8]
mov edx, dword [r14]
mov rcx, r12
call qword [r9 + 0xa8]
mov r10d, eax
test eax, eax
js 0x140184a00
mov rdx, qword [rbp - 8]
mov rcx, rsi
call fcn.14015c774
cmp eax, edi
jne 0x140184986
mov edx, dword [r14]
mov rcx, rbx
or edx, 0x2a000000
call fcn.140155c5c
mov r10d, eax
test eax, eax
js 0x140184a00
lea rdx, [rbp + 0x30]
mov rcx, r15
call fcn.14015a224
mov r14, rax
test rax, rax
jne 0x14018493e
jmp 0x140184a00
mov r14d, 1
cmp dword [rcx + 0xc8], r14d
jb 0x140184a00
lea r15, [rcx + 0x13e8]
mov rax, qword [r15]
lea r8, [rbp - 8]
mov edx, r14d
mov rcx, r15
call qword [rax + 0xa8]
mov r10d, eax
test eax, eax
js 0x140184a00
mov rdx, qword [rbp - 8]
mov rcx, rsi
call fcn.14015c774
cmp eax, edi
jne 0x1401849f4
mov edx, r14d
mov rcx, rbx
or edx, 0x2a000000
call fcn.140155c5c
mov r10d, eax
test eax, eax
js 0x140184a00
inc r14d
cmp r14d, dword [rsi + 0xc8]
jbe 0x1401849b2
lea r11, [rsp + 0x40]
mov eax, r10d
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret