joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1502daa58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r13, rcx
cmp rdx, r8
je 0x1502dab0c
mov rax, qword [rcx + 8]
mov rdi, rdx
mov r12, qword [rcx + 0x18]
movabs r15, 0xcbf29ce484222325
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x68], rax
movabs rdx, 0x100000001b3
movzx eax, byte [rcx + rbp + 0x10]
inc rcx
xor r15, rax
imul r15, rdx
cmp rcx, 8
jb 0x1502daaa8
and r15, qword [r13 + 0x30]
add r15, r15
mov rax, qword [r12 + r15*8]
mov qword [rsp + 0x70], rax
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x78], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x20
call fcn.15040acc0
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x78]
je 0x1502dab24
cmp rdi, rsi
jne 0x1502daad7
cmp qword [rsp + 0x70], rbp
jne 0x1502dab05
mov qword [r12 + r15*8], rdi
mov qword [r14], rdi
mov qword [rdi + 8], r14
mov rbx, qword [rsp + 0x60]
mov rax, rsi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rsp + 0x70], rbp
jne 0x1502dab39
mov rbp, qword [rsp + 0x68]
mov qword [r12 + r15*8], rbp
mov rax, rbp
jmp 0x1502dab3c
mov rax, r14
mov qword [r12 + r15*8 + 8], rax
cmp rdi, rsi
je 0x1502dab05
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs rbp, 0x100000001b3
movzx eax, byte [rdi + rdx + 0x10]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x1502dab5c
mov r15, qword [r13 + 0x30]
mov rbp, qword [rsp + 0x68]
and r15, rcx
add r15, r15
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x70], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x20
call fcn.15040acc0
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x70]
je 0x1502dabb3
cmp rdi, rsi
je 0x1502dab01
jmp 0x1502dab8a
mov qword [r12 + r15*8], rbp
mov qword [r12 + r15*8 + 8], rbp
jmp 0x1502dab41
Function at 0x1502dace4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 8
jb 0x1502dad13
mov rax, qword [0x1500795a0]
and rax, r15
add rax, rax
mov rcx, qword [0x150079588]
mov rbx, qword [rcx + rax*8 + 8]
mov r14, qword [0x150079578]
cmp rbx, r14
jne 0x1502dadbf
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x150079580], rax
je 0x1502daf3b
lea rax, [0x150079578]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], 0
mov r8, qword [0x150079580]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1502dae02
cvtsi2ss xmm0, rcx
jmp 0x1502dae17
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x1502dadd1
cmp rbx, rdx
je 0x1502dadf8
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1502dadc8
mov r14, qword [rbx]
mov rbp, r14
mov rax, rbx
mov rbx, r14
test rax, rax
je 0x1502dad5d
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1502daf19
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x1502dade3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1500795a8]
xorps xmm1, xmm1
test rcx, rcx
js 0x1502dae2d
cvtsi2ss xmm1, rcx
jmp 0x1502dae42
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x150079570]
seta al
test al, al
je 0x1502daeb1
call fcn.1502daf64
mov rcx, qword [0x1500795a0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x150079588]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x150079578]
cmp rax, rbx
je 0x1502dae9d
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x1502dae94
mov rbx, rax
cmp rax, r8
je 0x1502daef4
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1502dae88
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r8, qword [0x150079580]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x150079580], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1500795a0]
and rax, r15
add rax, rax
mov rcx, qword [0x150079588]
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x150079578]
jne 0x1502daefb
mov qword [rcx + rax*8], rdi
jmp 0x1502daf0d
mov qword [rsp + 0x20], rax
jmp 0x1502daea2
cmp r8, rbp
jne 0x1502daf06
mov qword [rcx + rax*8], rdi
jmp 0x1502daf12
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1502daf12
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3
Function at 0x1502daf64
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x150079580]
xorps xmm0, xmm0
add rcx, 1
js 0x1502daf85
cvtsi2ss xmm0, rcx
jmp 0x1502daf9a
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x150079570]
call fcn.1504413bc
movss xmm1, dword [0x1502703c8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1502dafcc
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1502dafcc
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1500795a8]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x1502db001
cmp rdx, 0x200
jae 0x1502daffe
shl rdx, 3
cmp rdx, rcx
jae 0x1502db001
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x1502db17a
mov rbx, qword [0x150079578]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x150079588]
lea rdx, [rdi + rdi]
call fcn.1502dabc0
mov rax, qword [0x150079578]
lea r9, [rdi - 1]
mov qword [0x1500795a0], r9
mov qword [0x1500795a8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1502db16f
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 8
jb 0x1502db088
mov rdi, qword [0x150079588]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1502db0c6
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1502db135
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x1502db10a
mov r10, qword [r10]
cmp r10, rax
je 0x1502db0bf
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502db0bf
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x1502db149
cmp qword [rdi + r11*8], r10
jne 0x1502db100
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x1502db16f
mov r9, qword [0x1500795a0]
jmp 0x1502db078
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502db135
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x1502df180
Capabilities:
Get session user name

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x20]
mov rbx, rcx
mov dword [rsp + 0x20], 0x101
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
test eax, eax
jne 0x1502df201
mov eax, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
movsd xmm0, qword [0x15017b6a8]
movsd qword [rbx], xmm0
mov ecx, dword [0x15017b6b0]
mov dword [rbx + 8], ecx
movzx ecx, word [0x15017b6b4]
mov word [rbx + 0xc], cx
mov cl, byte [0x15017b6b6]
mov byte [rbx + 0xe], cl
mov byte [rbx + 0xf], 0
jmp 0x1502df220
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x30]
and qword [rbx + 0x18], 0
mov rcx, rbx
mov r8d, dword [rsp + 0x20]
dec r8d
call fcn.1502a75e8
mov rax, rbx
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.15040aca0
add rsp, 0x150
pop rbx
ret
Function at 0x1502e23c8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov bl, cl
lea rcx, [rsp + 0x50]
call fcn.1502cc98c
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rsp + 0x74]
call fcn.15040dca0
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0x68
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x50]
call fcn.1503d4500
nop
cmp qword [rax + 0x18], 0x10
jb 0x1502e2434
mov rax, qword [rax]
lea rcx, [0x15017bde0]
lea r8, [0x15017bdf0]
test bl, bl
cmovne r8, rcx
mov rdx, rax
lea rcx, [0x15017be00]
call fcn.1503d49a8
mov rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1502e2495
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1502e2490
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1502e257e
call fcn.15040acc0
movdqa xmm0, xmmword [0x150270450]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.1503d4500
cmp qword [rax + 0x18], 0x10
jb 0x1502e24be
mov rax, qword [rax]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1502e2531
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1502e252c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1502e2578
call fcn.15040acc0
mov rcx, qword [rsp + 0x60]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1502e2546
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1502e255b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.15040aca0
mov rbx, qword [rsp + 0x148]
add rsp, 0x130
pop rbp
ret
call fcn.150419d24
int3
call fcn.150419d24
int3
Function at 0x1502e5b70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x1502e5c40
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r15, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r14, rax
imul r14, r8
cmp rdx, 8
jb 0x1502e5bbe
and r14, qword [rcx + 0x30]
add r14, r14
mov rax, qword [r12 + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.1502a94bc
mov edx, 0x58
mov rcx, rbx
call fcn.15040acc0
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1502e5c54
cmp rsi, rbp
jne 0x1502e5bf4
cmp qword [rsp + 0x80], r13
jne 0x1502e5c39
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x1502e5c6c
mov r13, qword [rsp + 0x78]
mov qword [r12 + r14*8], r13
mov rax, r13
jmp 0x1502e5c6f
mov rax, r15
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
je 0x1502e5c39
xor edx, edx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rsi + rdx + 0x10]
inc rdx
xor r14, rax
imul r14, r13
cmp rdx, 8
jb 0x1502e5c8f
and r14, qword [rcx + 0x30]
mov r13, qword [rsp + 0x78]
add r14, r14
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.1502a94bc
mov edx, 0x58
mov rcx, rbx
call fcn.15040acc0
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x1502e5cfa
cmp rsi, rbp
je 0x1502e5c35
jmp 0x1502e5cbd
mov qword [r12 + r14*8], r13
mov qword [r12 + r14*8 + 8], r13
jmp 0x1502e5c74
Function at 0x1502e6040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r15, rdx
mov rdi, r8
mov rdx, rcx
cmp r15, r8
je 0x1502e616f
mov r13, qword [r15 + 8]
lea rax, [rcx + 8]
mov r14, qword [rcx + 0x18]
movabs rsi, 0xcbf29ce484222325
mov r12, qword [rax]
xor ecx, ecx
mov qword [rbp - 0x20], rax
movabs r8, 0x100000001b3
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r15
movzx eax, byte [r15 + rcx + 0x10]
inc rcx
xor rsi, rax
imul rsi, r8
cmp rcx, 4
jb 0x1502e609f
and rsi, qword [rdx + 0x30]
lea rcx, [rbp - 0x20]
add rsi, rsi
mov rbx, qword [r14 + rsi*8]
mov rax, qword [r14 + rsi*8 + 8]
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x48], rax
call fcn.1502e61b4
mov rax, qword [rbp + 0x48]
cmp r15, rax
je 0x1502e6103
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x1502e615a
cmp rcx, rax
lea rcx, [rbp - 0x20]
sete bl
call fcn.1502e61b4
mov rax, qword [rbp + 0x48]
test bl, bl
je 0x1502e60df
mov rbx, qword [rbp + 0x50]
cmp rbx, r15
jne 0x1502e610f
mov qword [r14 + rsi*8], r12
mov r13, r12
mov qword [r14 + rsi*8 + 8], r13
mov rcx, qword [rbp - 0x10]
cmp rcx, rdi
je 0x1502e6164
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs r13, 0x100000001b3
movzx eax, byte [rcx + rdx + 0x10]
inc rdx
xor rsi, rax
imul rsi, r13
cmp rdx, 4
jb 0x1502e6133
mov r13, qword [rbp + 0x40]
and rsi, qword [r13 + 0x30]
add rsi, rsi
mov r15, qword [r14 + rsi*8 + 8]
jmp 0x1502e618f
cmp qword [rbp + 0x50], r15
jne 0x1502e6164
mov qword [r14 + rsi*8], rcx
mov rax, qword [rbp - 0x18]
mov qword [rax], rcx
mov qword [rcx + 8], rax
mov rbx, qword [rsp + 0x98]
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp rcx, rdi
je 0x1502e6160
cmp rcx, r15
lea rcx, [rbp - 0x20]
sete bl
call fcn.1502e61b4
mov rcx, qword [rbp - 0x10]
test bl, bl
je 0x1502e618a
mov qword [r14 + rsi*8], r12
mov qword [r14 + rsi*8 + 8], r12
jmp 0x1502e6118

Function at 0x1502e6280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x1502e6290
mov rcx, qword [r11 + 0x30]
and rcx, r9
mov r9, qword [r11 + 0x18]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, qword [r11 + 8]
je 0x1502e62e1
mov r9, qword [r9 + rcx*8]
mov ecx, dword [r8]
jmp 0x1502e62da
cmp rax, r9
je 0x1502e62e1
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1502e62d1
jmp 0x1502e62e3
xor eax, eax
test rax, rax
cmove rax, qword [r11 + 8]
mov qword [rdx], rax
mov rax, rdx
ret
Function at 0x1502e70d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x150079710]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x150079738]
js 0x1502e70f8
cvtsi2ss xmm0, rcx
jmp 0x1502e710d
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x150079700]
call fcn.1504413bc
movss xmm1, dword [0x1502703c8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1502e713f
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1502e713f
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1502e716d
cmp rbx, 0x200
jae 0x1502e716a
shl rbx, 3
cmp rbx, rcx
jae 0x1502e716d
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x1502e72e6
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [0x150079708]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x150079718]
lea rdx, [rdi + rdi]
call fcn.1502ae44c
mov rax, qword [0x150079708]
lea r9, [rdi - 1]
mov qword [0x150079730], r9
mov qword [0x150079738], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1502e72db
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 8
jb 0x1502e71f4
mov rdi, qword [0x150079718]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1502e7232
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1502e72a1
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x1502e7276
mov r10, qword [r10]
cmp r10, rax
je 0x1502e722b
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502e722b
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x1502e72b5
cmp qword [rdi + r11*8], r10
jne 0x1502e726c
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x1502e72db
mov r9, qword [0x150079730]
jmp 0x1502e71e4
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502e72a1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x1502e7724
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x1502e78a9
mov rbx, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1502ae44c
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1502e786d
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x1502e77b4
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1502e77f3
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1502e7861
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x1502e7836
mov r10, qword [r10]
cmp r10, rax
je 0x1502e77ec
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502e77ec
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x1502e7883
cmp qword [rdi + r11*8], r10
jne 0x1502e782c
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1502e77a4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1502e7861
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x1502eadd4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, r8
mov r15, rdx
mov r13, rcx
cmp rdx, r8
je 0x1502eaeaa
mov rax, qword [rcx + 8]
movabs r8, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
mov rdi, rdx
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x70], rax
mov rdx, r8
movabs r9, 0x100000001b3
movzx eax, byte [r15 + rcx + 0x14]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, 4
jb 0x1502eae27
mov rsi, r8
xor ecx, ecx
movzx eax, byte [r15 + rcx + 0x18]
inc rcx
xor rsi, rax
imul rsi, r9
cmp rcx, 2
jb 0x1502eae42
xor rsi, rdx
and rsi, qword [r13 + 0x30]
add rsi, rsi
mov rax, qword [r12 + rsi*8]
mov qword [rsp + 0x68], rax
mov rax, qword [r12 + rsi*8 + 8]
mov qword [rsp + 0x78], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x28
call fcn.15040acc0
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x78]
je 0x1502eaec2
cmp rdi, rbp
jne 0x1502eae75
cmp qword [rsp + 0x68], r15
jne 0x1502eaea3
mov qword [r12 + rsi*8], rdi
mov qword [r14], rdi
mov qword [rdi + 8], r14
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x70]
jne 0x1502eaed7
mov qword [r12 + rsi*8], r15
mov rax, r15
jmp 0x1502eaeda
mov rax, r14
mov qword [r12 + rsi*8 + 8], rax
cmp rdi, rbp
je 0x1502eaea3
movabs r8, 0xcbf29ce484222325
xor ecx, ecx
mov rdx, r8
movabs r9, 0x100000001b3
movzx eax, byte [rcx + rdi + 0x14]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, 4
jb 0x1502eaefd
mov rsi, r8
xor ecx, ecx
movzx eax, byte [rcx + rdi + 0x18]
inc rcx
xor rsi, rax
imul rsi, r9
cmp rcx, 2
jb 0x1502eaf17
xor rsi, rdx
and rsi, qword [r13 + 0x30]
add rsi, rsi
mov rax, qword [r12 + rsi*8 + 8]
mov qword [rsp + 0x68], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x28
call fcn.15040acc0
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x68]
je 0x1502eaf69
cmp rdi, rbp
je 0x1502eae9f
jmp 0x1502eaf40
mov qword [r12 + rsi*8], r15
mov qword [r12 + rsi*8 + 8], r15
jmp 0x1502eaedf
Function at 0x1502eaf78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
mov rdi, rdx
mov r11d, ecx
mov rbx, r9
movabs rdx, 0x100000001b3
movzx eax, byte [r8 + r11 + 0x14]
inc r11
xor rbx, rax
imul rbx, rdx
cmp r11, 4
jb 0x1502eafa4
movzx eax, byte [r8 + rcx + 0x18]
inc rcx
xor r9, rax
imul r9, rdx
cmp rcx, 2
jb 0x1502eafba
mov rcx, qword [r10 + 0x18]
xor r9, rbx
and r9, qword [r10 + 0x30]
add r9, r9
cmp qword [rcx + r9*8 + 8], r8
jne 0x1502eb000
cmp qword [rcx + r9*8], r8
jne 0x1502eaff5
mov rax, qword [r10 + 8]
mov qword [rcx + r9*8], rax
jmp 0x1502eaff9
mov rax, qword [r8 + 8]
mov qword [rcx + r9*8 + 8], rax
jmp 0x1502eb00d
cmp qword [rcx + r9*8], r8
jne 0x1502eb00d
mov rax, qword [r8]
mov qword [rcx + r9*8], rax
mov rbx, qword [r8]
mov edx, 0x28
dec qword [r10 + 0x10]
mov rcx, r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov rax, qword [r8 + 8]
mov qword [rbx + 8], rax
call fcn.15040acc0
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret