joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140102bb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x140102bec
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x140102c1b
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x140102bfd
mov r14, qword [rsi + 0x30]
and r14, rdx
add r14, r14
mov rax, qword [rsi + 0x18]
lea rcx, [rsi + 8]
mov qword [rsp + 0x90], rcx
mov rdi, qword [rcx]
cmp rdi, qword [rax + r14*8]
je 0x140102caf
mov rdi, qword [rax + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r14*8]
je 0x140102caf
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140102c62
mov rdx, qword [rdx]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140102c71
mov rcx, qword [r12]
cmp r13, rax
mov rax, qword [rsi + 0x18]
jne 0x140102c46
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov rax, qword [rsi + 0x18]
jne 0x140102c46
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
call fcn.140102e00
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140102dd4
mov qword [rsp + 0x90], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x140102cec
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [rsi + 8]
jne 0x140102d09
mov qword [rdx + r14*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r14*8 + 8], rbx
jmp 0x140102d38
cmp rax, rdi
jne 0x140102d14
mov qword [rdx + r14*8], rbx
jmp 0x140102d38
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rbx
je 0x140102d38
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14017f2b0]
test rax, rax
jns 0x140102d59
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140102d6a
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140102dc9
cmp rdx, 0x200
jae 0x140102d82
shl rdx, 3
jmp 0x140102d94
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140102d94
add rdx, rdx
mov rcx, rsi
call fcn.1400186e0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140102dc9
mov r14, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.140102bb0
cmp rdi, r14
jne 0x140102da9
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140102f14
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140102f36
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x140102f66
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x140102f48
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140102f9e
cmp qword [rcx + rdx*8], r8
jne 0x140102f93
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x140102f97
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140102fab
cmp qword [rcx + rdx*8], r8
jne 0x140102fab
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.140102e00
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140106bc0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140106bf1
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140106c64
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140106c08
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140106c0a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140106c5e
test ecx, ecx
jle 0x140106c39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140106c5e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140106c5e
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140106c80
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rdi, r8
mov r14, rdx
mov rbx, rcx
je 0x140106cb4
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140106d5f
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140106ccb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140106ccd
xor ecx, ecx
movsxd rsi, ecx
test rdi, rdi
jle 0x140106d59
test ecx, ecx
jle 0x140106d00
cmp rdi, rsi
mov rcx, r14
cmovl rsi, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov edx, esi
mov rcx, rbx
add r14, rsi
sub rdi, rsi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
test rdi, rdi
jle 0x140106d59
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140106d59
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140106d45
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140107190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1401071c9
xor eax, eax
jmp 0x1401072dc
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1401071f2
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, qword [rax]
cmp qword [rax], r8
jae 0x1401071f2
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1401072dc
cmp qword [rcx + 0x80], 0
je 0x1401072da
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14010722d
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140107251
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x1401072da
lea rax, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x3f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x1401072da
cmp eax, 1
jle 0x14010729f
cmp eax, 3
jne 0x1401072da
movsx ecx, byte [rbp - 0x40]
jmp 0x14010723a
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1401072ca
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1401072da
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x1401072dc
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140118d00
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401074b8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14010756d
cmp byte [rcx + 0x71], 0
je 0x14010756d
mov rax, qword [rcx]
or edx, 0xffffffff
mov rax, qword [rax + 0x18]
call qword [case.0x140007d11.0]
cmp eax, 0xffffffff
je 0x14010752e
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140107532
sub eax, 1
je 0x140107536
sub eax, 2
je 0x14010756d
xor al, al
jmp 0x14010756f
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140107564
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14010752e
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14010756f
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140118d00
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14010c33c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
mov rbp, rsp
sub rsp, 0x60
and qword [rbp - 0x18], 0
lea rax, [rbp - 0x18]
mov rbx, rcx
mov qword [rsp + 0x20], rax
lea rsi, fcn.140009090
mov dword [rbp - 0x20], 1
mov rcx, 0xffffffff80000001
mov qword [rbp - 0x28], rsi
mov r9d, 0x20019
mov byte [rbp - 0x10], 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14010c3d5
and dword [rbp + 0x20], eax
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], eax
xor r8d, r8d
mov rdx, qword [str.SendTelemetry]
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x28], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14010c3d5
mov eax, dword [rbp + 0x20]
mov dword [rbx], eax
mov byte [rbx + 4], 1
jmp 0x14010c3dc
and dword [rbx], 0
mov byte [rbx + 4], 0
cmp byte [rbp - 0x10], 0
mov qword [rbp - 0x28], rsi
je 0x14010c3f5
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x14010c3f5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x78]
mov rax, rbx
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rbp
ret
Function at 0x14010cfd0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov r15, rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x14010d006
mov r9, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r10, [r11 + r11]
xor ecx, ecx
test r10, r10
je 0x14010d039
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r10
jb 0x14010d01b
mov rsi, qword [r15 + 0x30]
and rsi, rdx
mov rdi, rsi
add rdi, rdi
mov rax, qword [r15 + 0x18]
mov rbx, qword [r15 + 8]
mov r12, qword [rax + rdi*8]
cmp r12, rbx
jne 0x14010d05c
mov rdi, rbx
jmp 0x14010d064
mov rdi, qword [rax + rdi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x14010d0d9
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14010d07f
mov rax, qword [rax]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x14010d08c
mov r9, qword [r8]
cmp r11, rcx
jne 0x14010d064
mov r10, r11
test r11, r11
je 0x14010d0c9
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x14010d064
sub r9, rax
cmp cx, dx
ja 0x14010d064
cmp r10, 1
je 0x14010d0c9
dec r10
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14010d0ab
jmp 0x14010d064
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14010d1ca
mov rbx, qword [rbx]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.14010d598
mov rdx, rax
mov rax, qword [r15 + 0x10]
movabs rcx, 0x492492492492491
sub rcx, rax
cmp rcx, 1
jae 0x14010d116
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rax, qword [r15 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14010d16a
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r15 + 8]
add rsi, rsi
mov rdx, qword [r15 + 0x18]
cmp qword [rdx + rsi*8], rax
jne 0x14010d186
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x14010d1b6
cmp qword [rdx + rsi*8], rdi
jne 0x14010d192
mov qword [rdx + rsi*8], rbx
jmp 0x14010d1b6
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x14010d1b6
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.14010d1e0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14010d290
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14010d2bd
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14010d2ec
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14010d2ce
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14010d324
cmp qword [rcx + rdx*8], rdi
jne 0x14010d319
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14010d31d
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14010d331
cmp qword [rcx + rdx*8], rdi
jne 0x14010d331
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14010caa0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14010d374
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14010d3b1
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x14010d3e4
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x14010d3c6
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
mov r12, qword [rcx + rax*8]
cmp rdi, r12
je 0x14010d4b1
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x14010d4b1
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14010d42d
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x14010d43a
mov r11, qword [r10]
cmp r15, rcx
jne 0x14010d40e
mov r14, r15
test r15, r15
je 0x14010d477
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x14010d40e
sub r11, rax
cmp cx, dx
ja 0x14010d40e
cmp r14, 1
je 0x14010d477
dec r14
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14010d459
jmp 0x14010d40e
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14010caa0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14010d547
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14010d4e6
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14010d506
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14010d535
cmp rax, rdi
jne 0x14010d511
mov qword [rdx + r8*8], rbx
jmp 0x14010d535
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14010d535
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14010d1e0
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140112e28
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r10, rdx
mov r14, rcx
mov rsi, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x140112e5f
mov r9, qword [rdx]
movabs r8, 0xcbf29ce484222325
lea rdx, [rsi + rsi]
xor ecx, ecx
test rdx, rdx
je 0x140112e92
movzx eax, byte [rcx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rcx
cmp rcx, rdx
jb 0x140112e74
mov rbp, qword [r14 + 0x30]
and rbp, r8
add rbp, rbp
mov r12, qword [r14 + 0x18]
mov rbx, qword [r12 + rbp*8]
mov rdx, qword [r14 + 8]
mov r15, rbx
cmp qword [r12 + rbp*8], rdx
jne 0x140112eb6
mov rax, rdx
jmp 0x140112ebe
mov rax, qword [r12 + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140112faf
lea rax, [rbx + 0x10]
mov rcx, r10
cmp qword [r10 + 0x18], 8
jb 0x140112ed8
mov rcx, qword [r10]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140112ee6
mov rax, qword [rax]
cmp r8, rsi
jne 0x140112f23
test r8, r8
je 0x140112f28
movzx r9d, word [rax]
movzx r11d, word [rcx]
cmp r9w, r11w
jb 0x140112f23
sub rax, rcx
cmp r9w, r11w
ja 0x140112f23
cmp r8, 1
je 0x140112f28
dec r8
add rcx, 2
movzx r9d, word [rax + rcx]
movzx r11d, word [rcx]
cmp r9w, r11w
jae 0x140112f05
mov rbx, qword [rbx]
jmp 0x140112ea8
mov rdi, rbx
cmp qword [r12 + rbp*8], rdx
jne 0x140112f36
mov rax, rdx
jmp 0x140112f3e
mov rax, qword [r12 + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140112faa
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140112f55
mov rax, qword [rax]
mov r9, r10
cmp qword [r10 + 0x18], 8
jb 0x140112f62
mov r9, qword [r10]
cmp rsi, rcx
jne 0x140112faa
mov r11, rsi
test rsi, rsi
je 0x14011301d
movzx ecx, word [r9]
movzx r8d, word [rax]
cmp cx, r8w
jb 0x140112faa
sub r9, rax
cmp cx, r8w
ja 0x140112faa
cmp r11, 1
je 0x14011301d
dec r11
add rax, 2
movzx ecx, word [r9 + rax]
movzx r8d, word [rax]
cmp cx, r8w
jae 0x140112f84
cmp r15, rbx
jne 0x140112fb5
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor ebp, ebp
cmp rdi, rbx
je 0x140112fcd
inc rbp
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x140112fbf
mov rsi, qword [rdx]
cmp rdi, rsi
jne 0x140113038
cmp rbx, rdx
jne 0x140113038
mov qword [rdx], rdx
mov rax, qword [r14 + 8]
mov qword [rax + 8], rax
and qword [r14 + 0x10], 0
cmp rsi, qword [r14 + 8]
je 0x14011300e
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.14001ce94
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, rbx
cmp rbx, qword [r14 + 8]
jne 0x140112ff0
mov edx, 8
mov rcx, r14
call fcn.1400186e0
jmp 0x14011303d
mov rbx, qword [rbx]
jmp 0x140112f2b
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140113258
cmp rdi, rbx
jne 0x140113025
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140113258
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140113285
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x1401132b4
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140113296
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1401132ec
cmp qword [rcx + rdx*8], rdi
jne 0x1401132e1
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1401132e5
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401132f9
cmp qword [rcx + rdx*8], rdi
jne 0x1401132f9
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14001ce94
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret