joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400936d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rdi, r8
lea r8, [r11 + 8]
mov rsi, rdx
cmp r8, r11
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rbx, r11
sbb r10, r10
not r10
and r10d, 8
cmp r11, r8
ja 0x140093735
movzx ecx, byte [rbx]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rbx
mov rcx, rbx
sub rcx, r11
imul rax, rdx
cmp rcx, r10
jne 0x140093713
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14009376d
cmp qword [rcx + rdx*8], rdi
jne 0x140093762
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140093766
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14009377a
cmp qword [rcx + rdx*8], rdi
jne 0x14009377a
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [r11 + 8]
dec qword [r9 + 0x10]
call fcn.140065dc4
mov edx, 0x138
mov rcx, rdi
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140095284
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x18], 8
mov r8, rcx
mov r9, qword [rcx + 0x10]
jb 0x140095295
mov r8, qword [rcx]
add r9, r9
xor ecx, ecx
movabs rax, 0xcbf29ce484222325
mov r10, r8
lea rdx, [r9 + r8]
cmp r8, rdx
cmova r9, rcx
test r9, r9
je 0x1400952da
movzx ecx, byte [r10]
movabs rdx, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r8
imul rax, rdx
cmp rcx, r9
jne 0x1400952b7
ret
Function at 0x140095654
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, r8
mov r11, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rdx
mov rcx, r8
call fcn.140095284
mov r10, rax
mov qword [rsp + 0x28], rax
movabs rax, 0xcbf29ce484222325
lea rdx, [rsp + 0x28]
mov r8d, 8
movzx ecx, byte [rdx]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc rdx
sub r8, 1
jne 0x1400956b1
mov r8, qword [rbx + 0x30]
and r8, rax
add r8, r8
mov r9, qword [rbx + 0x18]
mov rax, qword [r9 + r8*8]
mov rdx, qword [rbx + 8]
cmp qword [r9 + r8*8], rdx
jne 0x1400956ef
mov rcx, rdx
jmp 0x1400956f7
mov rcx, qword [r9 + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140095711
cmp qword [rax + 0x10], r10
je 0x140095707
mov rax, qword [rax]
jmp 0x1400956e4
mov qword [rsp + 0x20], rax
mov rcx, rax
jmp 0x14009571c
mov rax, rdx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
cmp rcx, rdx
je 0x1400957b2
mov rdx, qword [rax + 0x18]
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140095736
mov rcx, qword [rdi]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140095743
mov r8, qword [rdx]
mov rdx, qword [rdx + 0x10]
cmp rdx, qword [rdi + 0x10]
jne 0x1400957df
test rdx, rdx
je 0x14009578b
movzx r9d, word [r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x1400957df
sub r8, rcx
cmp r9w, r10w
ja 0x1400957df
cmp rdx, 1
je 0x14009578b
dec rdx
add rcx, 2
movzx r9d, word [rcx + r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x1400957df
jmp 0x14009576b
and qword [r11], 0
and qword [r11 + 8], 0
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x1400957a1
lock inc dword [rcx + 8]
mov rcx, qword [rax + 0x18]
mov qword [r11], rcx
mov rcx, qword [rax + 0x20]
mov qword [r11 + 8], rcx
jmp 0x1400957bb
and qword [r11], 0
and qword [r11 + 8], 0
mov rax, r11
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.1400958bc
lea rcx, [rax + 8]
call fcn.14006c7bc
mov rbx, rax
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14008cc40
mov rdi, rax
mov rcx, rbx
call fcn.140095070
mov r8, rax
lea rdx, str.hash_collision_in_GenericEtwPropertyDictionary
lea rcx, [rsp + 0x70]
call fcn.1400959c0
nop
lea r8, [0x1403d2a6c]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140095a6c
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140095acc
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400967ec
lea rdx, [0x140513998]
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x140095c60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
mov r10, r8
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x140095cca
movzx ecx, byte [r10]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r10
mov rcx, r10
sub rcx, r8
cmp rcx, rdx
jne 0x140095ca7
mov rdi, qword [rsi + 0x30]
and rdi, rax
add rdi, rdi
mov rdx, qword [rsi + 0x18]
mov r9, qword [rsi + 8]
cmp qword [rdx + rdi*8], r9
jne 0x140095ce7
mov rax, r9
jmp 0x140095cef
mov rax, qword [rdx + rdi*8 + 8]
mov rax, qword [rax]
mov r15, rax
cmp r15, qword [rdx + rdi*8]
je 0x140095d18
mov rax, qword [rax + 8]
mov r15, rax
mov rcx, qword [rax + 0x10]
cmp qword [r8], rcx
jne 0x140095cf2
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140095e0c
mov rbx, qword [r9]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.140096500
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jae 0x140095d5b
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov qword [rsi + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rcx, qword [rsi + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp r15, rax
je 0x140095daf
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r15
mov rcx, qword [r15 + 8]
mov qword [rcx], rbx
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov qword [r15 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x18]
cmp qword [rdx + rdi*8], rcx
jne 0x140095dc8
mov qword [rdx + rdi*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + rdi*8 + 8], rbx
jmp 0x140095df8
cmp qword [rdx + rdi*8], r15
jne 0x140095dd4
mov qword [rdx + rdi*8], rbx
jmp 0x140095df8
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rdi*8 + 8], rcx
cmp rcx, rbx
je 0x140095df8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rdi*8 + 8], rcx
mov rcx, rsi
call fcn.140095fdc
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400960f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rsi, rdx
lea r9, [r11 + 8]
mov r10, rcx
cmp r9, r11
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb rbx, rbx
not rbx
and ebx, 8
cmp r11, r9
ja 0x14009614d
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x14009612b
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140096185
cmp qword [rcx + rdx*8], r8
jne 0x14009617a
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14009617e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140096192
cmp qword [rcx + rdx*8], r8
jne 0x140096192
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rsi
call fcn.140096458
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400961b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs rax, 0xcbf29ce484222325
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x140096225
movzx ecx, byte [r8]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r8
mov rcx, r8
sub rcx, r11
cmp rcx, rdx
jne 0x140096202
mov r8, qword [r10 + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [r10 + 0x18]
mov rdi, qword [r10 + 8]
cmp qword [rcx + r8*8], rdi
je 0x140096245
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x14009627e
mov rdi, qword [rdi + 8]
mov r9, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r11], rax
jne 0x140096248
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [r10 + 8]
call fcn.140096458
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140096312
mov rax, qword [rbx]
cmp r9, rax
je 0x1400962b3
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10 + 8]
jne 0x1400962d0
mov qword [rdx + r8*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400962ff
cmp rax, r9
jne 0x1400962db
mov qword [rdx + r8*8], rbx
jmp 0x1400962ff
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400962ff
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.140095fdc
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140097a90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea r9, [r8 + 4]
mov rbx, rcx
cmp r9, r8
movabs rax, 0xcbf29ce484222325
mov r11, r8
sbb r10, r10
not r10
and r10d, 4
cmp r8, r9
ja 0x140097ade
movzx ecx, byte [r11]
movabs r9, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r8
imul rax, r9
cmp rcx, r10
jne 0x140097abb
mov r9, qword [rbx + 0x30]
mov r11, qword [rbx + 0x18]
and r9, rax
add r9, r9
mov r10, qword [r11 + r9*8]
mov rcx, r10
cmp r10, qword [rbx + 8]
jne 0x140097aff
mov rax, qword [rbx + 8]
jmp 0x140097b07
mov rax, qword [r11 + r9*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x140097b19
mov eax, dword [r8]
cmp dword [rcx + 0x10], eax
je 0x140097b1d
mov rcx, qword [rcx]
jmp 0x140097af3
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
Function at 0x140098268
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
mov rdx, r8
lea r9, [r8 + 4]
cmp r9, r8
sbb r8, r8
not r8
and r8d, 4
cmp rdx, r9
ja 0x1400982d7
movzx ecx, byte [rdx]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc rdx
mov rcx, rdx
sub rcx, r10
cmp rcx, r8
jne 0x1400982b5
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
cmp qword [rcx + r8*8], rdi
je 0x1400982f7
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x14009834e
mov rdi, qword [rdi + 8]
mov r9, rdi
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x1400982fa
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140064054
mov edx, 0x30
mov rcx, rbx
call fcn.140356b5c
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140098473
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp r9, rax
je 0x14009838b
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400983a8
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400983d7
cmp rax, r9
jne 0x1400983b3
mov qword [rdx + r8*8], rbx
jmp 0x1400983d7
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400983d7
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1404202fc]
test rax, rax
jns 0x1400983f8
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140098409
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140098468
cmp rdx, 0x200
jae 0x140098421
shl rdx, 3
jmp 0x140098433
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140098433
add rdx, rdx
mov rcx, rsi
call fcn.14005e790
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140098468
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140098268
cmp rdi, r15
jne 0x140098448
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140098510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rdi, r8
lea r8, [r11 + 4]
mov rsi, rdx
cmp r8, r11
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rbx, r11
sbb r10, r10
not r10
and r10d, 4
cmp r11, r8
ja 0x140098571
movzx ecx, byte [rbx]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rbx
mov rcx, rbx
sub rcx, r11
imul rax, rdx
cmp rcx, r10
jne 0x14009854f
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400985a9
cmp qword [rcx + rdx*8], rdi
jne 0x14009859e
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400985a2
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400985b6
cmp qword [rcx + rdx*8], rdi
jne 0x1400985b6
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [r11 + 8]
dec qword [r9 + 0x10]
call fcn.140064054
mov edx, 0x30
mov rcx, rdi
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14009e1d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x14009e1ff
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x14009e246
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x14009e223
and r8, qword [0x140549510]
mov r15, qword [0x1405494f8]
mov r11, qword [0x1405494e8]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x14009e26e
mov rcx, r11
jmp 0x14009e276
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009e33c
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x14009e290
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x14009e2a0
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x14009e2e0
mov rbp, rsi
test rsi, rsi
je 0x14009e2e8
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x14009e2e0
sub rbx, r9
cmp cx, di
ja 0x14009e2e0
cmp rbp, 1
je 0x14009e2e8
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x14009e2c3
mov rax, qword [rax]
jmp 0x14009e263
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14009e2f5
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009e2ff
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x14009e33c
test r10, r10
je 0x14009e33f
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x14009e33c
sub rdx, rcx
cmp r8w, r9w
ja 0x14009e33c
cmp r10, 1
je 0x14009e33f
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x14009e31e
mov rax, r11
cmp rax, r11
jne 0x14009e348
xor al, al
jmp 0x14009e351
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400a2428
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400a2457
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400a249e
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400a247b
and r8, qword [0x140549550]
mov r15, qword [0x140549538]
mov r11, qword [0x140549528]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400a24c6
mov rcx, r11
jmp 0x1400a24ce
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a2594
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400a24e8
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400a24f8
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400a2538
mov rbp, rsi
test rsi, rsi
je 0x1400a2540
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400a2538
sub rbx, r9
cmp cx, di
ja 0x1400a2538
cmp rbp, 1
je 0x1400a2540
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400a251b
mov rax, qword [rax]
jmp 0x1400a24bb
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400a254d
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a2557
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400a2594
test r10, r10
je 0x1400a2597
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400a2594
sub rdx, rcx
cmp r8w, r9w
ja 0x1400a2594
cmp r10, 1
je 0x1400a2597
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400a2576
mov rax, r11
cmp rax, r11
jne 0x1400a25a0
xor al, al
jmp 0x1400a25a9
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400a25cc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400a25fb
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400a2642
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400a261f
and r8, qword [0x1405495d0]
mov r15, qword [0x1405495b8]
mov r11, qword [0x1405495a8]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400a266a
mov rcx, r11
jmp 0x1400a2672
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a2738
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400a268c
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400a269c
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400a26dc
mov rbp, rsi
test rsi, rsi
je 0x1400a26e4
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400a26dc
sub rbx, r9
cmp cx, di
ja 0x1400a26dc
cmp rbp, 1
je 0x1400a26e4
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400a26bf
mov rax, qword [rax]
jmp 0x1400a265f
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400a26f1
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a26fb
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400a2738
test r10, r10
je 0x1400a273b
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400a2738
sub rdx, rcx
cmp r8w, r9w
ja 0x1400a2738
cmp r10, 1
je 0x1400a273b
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400a271a
mov rax, r11
cmp rax, r11
jne 0x1400a2744
xor al, al
jmp 0x1400a274d
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400a2770
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400a279f
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400a27e6
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400a27c3
and r8, qword [0x140549590]
mov r15, qword [0x140549578]
mov r11, qword [0x140549568]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400a280e
mov rcx, r11
jmp 0x1400a2816
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a28dc
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400a2830
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400a2840
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400a2880
mov rbp, rsi
test rsi, rsi
je 0x1400a2888
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400a2880
sub rbx, r9
cmp cx, di
ja 0x1400a2880
cmp rbp, 1
je 0x1400a2888
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400a2863
mov rax, qword [rax]
jmp 0x1400a2803
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400a2895
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a289f
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400a28dc
test r10, r10
je 0x1400a28df
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400a28dc
sub rdx, rcx
cmp r8w, r9w
ja 0x1400a28dc
cmp r10, 1
je 0x1400a28df
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400a28be
mov rax, r11
cmp rax, r11
jne 0x1400a28e8
xor al, al
jmp 0x1400a28f1
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret