joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041ba0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x13e0
call fcn.140121930
sub rsp, rax
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x20], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], socket
mov byte [rsp + 0x28], r13b
lea r8d, [r13 + 0x3e]
lea rdx, [0x140171990]
lea rcx, [rsp + 0x28]
call fcn.140009980
nop
call fcn.140120304
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea edx, [r13 + 1]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x140041c20
mov dword [rsp + 0x50], 0x270
mov edi, dword [rsp + 0x38]
dec edi
mov qword [rsi], r13
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], recv
mov byte [rsi], 0
mov dword [rsp + 0x20], 1
cmp qword [rsp + 0x40], 0x10
setae r15b
mov r14d, 0xa
mov r12, qword [rsp + 0x28]
movzx ebx, byte [rsp + 0x1428]
cmp edi, 0xffffffff
jne 0x140041c97
lea rcx, [rsp + 0x50]
call fcn.140103c50
mov edx, eax
jmp 0x140041cdb
lea ebp, [rdi + 1]
nop word [rax + rax]
mov ecx, r13d
mov eax, r13d
test edi, edi
je 0x140041cbb
lea rcx, [rsp + 0x50]
call fcn.140103c50
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div ebp
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div ebp
cmp eax, r8d
jb 0x140041cd5
cmp r9d, edi
jne 0x140041ca0
xor edx, edx
mov eax, ecx
div ebp
lea rcx, [rsp + 0x28]
test r15b, r15b
cmovne rcx, r12
movsxd rax, edx
movzx r9d, byte [rax + rcx]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x18]
cmp rcx, rdx
jae 0x140041d1b
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp rdx, 0x10
jb 0x140041d10
mov rax, qword [rsi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140041d2c
movzx r8d, bl
mov edx, 1
mov rcx, rsi
call fcn.1400f4e30
sub r14, 1
jne 0x140041c84
lea rcx, [rsp + 0x28]
call fcn.140009900
mov rax, rsi
mov rbx, qword [rsp + 0x1430]
add rsp, 0x13e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140041d60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rbx, rcx
mov dword [rsp + 0x38], 0
call fcn.14011fe20
mov r8, rax
movabs rax, 0xd6bf94d5e57a42bd
imul r8
add rdx, r8
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rbp + 0x78], rdx
lea rcx, [rbp + 0x78]
call fcn.140134a50
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x60], eax
lea rcx, [rsp + 0x70]
call fcn.1400ecce0
nop
lea rdx, [0x140170a54]
lea rcx, [rsp + 0x70]
call fcn.140018620
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rax, [0x140171a40]
mov qword [rsp + 0x28], rax
nop
inc rax
cmp byte [rax], 0
jne 0x140041e00
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.1400ee500
mov dword [rsp + 0x20], 0xd1ddcfce
mov dword [rsp + 0x24], 0xdea7a7ab
mov dword [rsp + 0x28], 0xd9c2aadd
mov byte [rsp + 0x2c], 0xfa
xor eax, eax
nop dword [rax + rax]
lea ecx, [rax - 0x12]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xd
jb 0x140041e40
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.140018620
nop
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov dword [rsp + 0x38], 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov rcx, qword [rbp - 0x18]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140041eb7
mov rax, qword [rbp - 0x48]
mov r8, qword [rax]
test r8, r8
je 0x140041eb7
mov rax, qword [rbp - 0x68]
mov rdx, qword [rax]
cmp r8, qword [rbp - 0x20]
cmovb r8, qword [rbp - 0x20]
sub r8, rdx
jmp 0x140041ee8
test cl, 4
jne 0x140041ede
mov rax, qword [rbp - 0x50]
mov rcx, qword [rax]
test rcx, rcx
je 0x140041ede
mov rax, qword [rbp - 0x70]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x38]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140041ee8
mov r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x140041ef6
mov rcx, rbx
call fcn.140009980
nop
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [0x140174d40]
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call fcn.1400ec9d0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [0x1401607b8]
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x6c], edx
lea rax, [0x140160698]
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.1401200f4
nop
mov rax, rbx
mov rbx, qword [rsp + 0x180]
add rsp, 0x160
pop rbp
ret
Function at 0x140044170
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x40
mov ebx, ecx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r10
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
imul r9, r10
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [0x14019f630]
imul r9, r10
shr rax, 0x18
xor r9, rax
imul r9, r10
and rcx, r9
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x140044236
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400441fe
cmp rax, rcx
je 0x140044236
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400441f0
test rax, rax
je 0x140044236
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
je 0x140044236
mov rcx, qword [rax]
shr rcx, 0x20
cmp ecx, ebx
je 0x14004423e
add rax, 0x20
cmp rax, rdx
jne 0x140044222
xor al, al
add rsp, 0x40
pop rbx
ret
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x140044250
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
push rdi
sub rsp, 0x40
mov rbx, rcx
movzx r10d, r8b
movabs rax, 0xcbf29ce484222325
mov rdi, rdx
xor r10, rax
movabs rdx, 0x100000001b3
imul r10, rdx
mov eax, r8d
shr eax, 8
movzx r9d, al
mov eax, r8d
xor r10, r9
shr eax, 0x10
imul r10, rdx
movzx ecx, al
xor r10, rcx
mov eax, r8d
mov rcx, qword [0x14019f630]
imul r10, rdx
shr rax, 0x18
xor r10, rax
imul r10, rdx
and rcx, r10
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x140044332
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400442ef
nop
cmp rax, rcx
je 0x140044332
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400442e0
test rax, rax
je 0x140044332
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
je 0x140044332
movups xmm1, xmmword [rax + 0x10]
movups xmm0, xmmword [rax]
psrldq xmm1, 8
movq rcx, xmm1
cmp rcx, rdi
je 0x140044355
add rax, 0x20
cmp rax, rdx
jne 0x140044313
movups xmm0, xmmword [0x14019efe0]
movups xmm1, xmmword [0x14019eff0]
movups xmmword [rbx], xmm0
mov rax, rbx
movups xmmword [rbx + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
movups xmm1, xmmword [rax + 0x10]
jmp 0x140044340
Function at 0x140044360
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x40
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r10
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
imul r9, r10
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [0x14019f630]
imul r9, r10
shr rax, 0x18
xor r9, rax
imul r9, r10
and rcx, r9
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x14004443c
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400443ef
cmp rax, rcx
je 0x14004443c
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400443e1
test rax, rax
je 0x14004443c
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
je 0x14004443c
nop dword [rax]
nop word [rax + rax]
movups xmm1, xmmword [rax + 0x10]
psrldq xmm1, 8
movq rcx, xmm1
cmp rcx, rbx
je 0x140044444
add rax, 0x20
cmp rax, rdx
jne 0x140044420
xor al, al
add rsp, 0x40
pop rbx
ret
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x140044450
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x40
mov rbx, rcx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r10
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
imul r9, r10
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [0x14019f630]
imul r9, r10
shr rax, 0x18
xor r9, rax
imul r9, r10
and rcx, r9
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x140044527
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400444df
cmp rax, rcx
je 0x140044527
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400444d1
test rax, rax
je 0x140044527
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
je 0x140044527
movups xmm1, xmmword [rax + 0x10]
movups xmm0, xmmword [rax]
psrldq xmm1, 8
movq rcx, xmm1
movups xmmword [rsp + 0x20], xmm0
cmp rcx, rbx
je 0x14004452f
add rax, 0x20
cmp rax, rdx
jne 0x140044503
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov eax, dword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140044540
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x40
mov ebx, ecx
movzx r9d, dl
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r10
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
imul r9, r10
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [0x14019f630]
imul r9, r10
shr rax, 0x18
xor r9, rax
imul r9, r10
and rcx, r9
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x1400445ff
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400445ce
cmp rax, rcx
je 0x1400445ff
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400445c0
test rax, rax
je 0x1400445ff
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rax, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x20]
cmp rax, rdx
je 0x1400445ff
cmp dword [rax], ebx
je 0x140044607
add rax, 0x20
cmp rax, rdx
jne 0x1400445f2
xor al, al
add rsp, 0x40
pop rbx
ret
mov al, 1
add rsp, 0x40
pop rbx
ret

Function at 0x140044610
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov r9d, edx
mov rbx, rcx
movzx r8d, dl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r10, 0x100000001b3
imul r8, r10
mov eax, edx
shr eax, 8
movzx edx, al
xor r8, rdx
imul r8, r10
mov eax, r9d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r10
mov eax, r9d
shr rax, 0x18
xor r8, rax
imul r8, r10
mov rcx, qword [0x14019f630]
and rcx, r8
shl rcx, 4
add rcx, qword [0x14019f618]
mov rax, qword [rcx + 8]
cmp rax, qword [0x14019f608]
je 0x14004470c
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1400446af
nop dword [rax + rax]
cmp rax, rcx
je 0x14004470c
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1400446a0
test rax, rax
je 0x14004470c
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x20]
call fcn.1400f29c0
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov r10, qword [rcx + 0x20]
cmp rdx, r10
je 0x14004470c
mov r9, qword [rbx]
mov rcx, qword [rbx + 8]
nop word [rax + rax]
movups xmm0, xmmword [rdx]
movups xmmword [rsp + 0x20], xmm0
mov rax, r9
cmp r9, rcx
je 0x140044703
mov r8d, dword [rsp + 0x20]
cmp r8d, dword [rax]
je 0x14004475a
add rax, 4
cmp rax, rcx
jne 0x1400446f5
add rdx, 0x20
cmp rdx, r10
jne 0x1400446e0
mov rcx, qword [rbx]
test rcx, rcx
je 0x140044752
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140044740
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400447a8
mov rcx, r8
call fcn.140120ef8
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
xor al, al
add rsp, 0x40
pop rbx
ret
test r9, r9
je 0x1400447a0
mov rdx, qword [rbx + 0x10]
sub rdx, r9
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x14004478b
add rdx, 0x27
mov rcx, qword [r9 - 8]
sub r9, rcx
lea rax, [r9 - 8]
cmp rax, 0x1f
ja 0x1400447a8
mov r9, rcx
mov rcx, r9
call fcn.140120ef8
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov al, 1
add rsp, 0x40
pop rbx
ret
call fcn.140127e7c
int3
Function at 0x1400448a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx], 0
je 0x1400449db
movzx r9d, byte [rcx + 2]
cmp r9b, 4
ja 0x1400449db
movzx edx, byte [rcx + 1]
cmp dl, 4
ja 0x1400449db
movzx eax, byte [rcx + 8]
movss xmm1, dword [rcx + 4]
movss dword [rsp + 0x10], xmm1
movss xmm0, dword [rcx + rax*4 + 0xc]
movss dword [rsp + 8], xmm0
test dl, dl
je 0x1400449a2
xor ecx, ecx
mov r8d, ecx
cmp dl, 0x10
jb 0x140044988
movdqa xmm2, xmmword [0x14017da00]
mov eax, 0xfffffff0
mov r10d, edx
and r10, rax
mov eax, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rsp + rax - 8]
add r8d, 0x10
add rcx, 0x10
movdqu xmm1, xmmword [rsp + rax]
lea rax, [rax + 0x40]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x48], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x38]
movdqu xmm1, xmmword [rsp + rax - 0x30]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x38], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x28]
movdqu xmm1, xmmword [rsp + rax - 0x20]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x28], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x18]
movdqu xmm1, xmmword [rsp + rax - 0x10]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x18], xmm1
cmp rcx, r10
jl 0x140044910
movsxd rcx, r8d
cmp rcx, rdx
jge 0x1400449a2
mov eax, dword [rsp + rcx*4 + 0x10]
not eax
xor dword [rsp + rcx*4 + 8], eax
inc rcx
cmp rcx, rdx
jl 0x140044990
test r9b, r9b
je 0x1400449d4
mov ecx, 4
sub rcx, r9
cmp rcx, 4
jae 0x1400449d4
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x10]
not al
xor byte [rsp + rcx + 8], al
inc rcx
cmp rcx, 4
jb 0x1400449c0
movss xmm0, dword [rsp + 8]
ret
xorps xmm0, xmm0
ret

Function at 0x1400449e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx], 0
mov rdx, rcx
je 0x140044b19
movzx r9d, byte [rcx + 2]
cmp r9b, 4
ja 0x140044b19
movzx r8d, byte [rcx + 1]
cmp r8b, 4
ja 0x140044b19
movzx eax, byte [rcx + 8]
mov ecx, dword [rcx + rax*4 + 0xc]
mov eax, dword [rdx + 4]
mov dword [rsp + 0x10], eax
mov dword [rsp + 8], ecx
test r8b, r8b
je 0x140044ae2
xor ecx, ecx
mov edx, ecx
cmp r8b, 0x10
jb 0x140044ac7
movdqa xmm2, xmmword [0x14017da00]
mov eax, 0xfffffff0
mov r10d, r8d
and r10, rax
mov eax, reloc.WS2_32.dll_recv
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax - 8]
add edx, 0x10
add rcx, 0x10
movdqu xmm1, xmmword [rsp + rax]
lea rax, [rax + 0x40]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x48], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x38]
movdqu xmm1, xmmword [rsp + rax - 0x30]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x38], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x28]
movdqu xmm1, xmmword [rsp + rax - 0x20]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x28], xmm1
movdqu xmm0, xmmword [rsp + rax - 0x18]
movdqu xmm1, xmmword [rsp + rax - 0x10]
pandn xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rsp + rax - 0x18], xmm1
cmp rcx, r10
jl 0x140044a50
movsxd rcx, edx
cmp rcx, r8
jge 0x140044ae2
nop
mov eax, dword [rsp + rcx*4 + 0x10]
not eax
xor dword [rsp + rcx*4 + 8], eax
inc rcx
cmp rcx, r8
jl 0x140044ad0
test r9b, r9b
invalid
Function at 0x140044ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x70
add rcx, 0x6c
call fcn.1400ee7e0
mov edx, eax
test eax, eax
je 0x140044fcd
lea rcx, [rdx - 0x10001]
cmp rcx, 0x7ffdfffd
ja 0x140044fcd
test eax, eax
je 0x140044fcd
cmp dword [0x14019f0f8], 0
je 0x140044fcd
xor ebx, ebx
lea r9d, [rbx + 0x20]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14019e1e0]
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
cmp byte [0x14019e189], bl
je 0x140044f0b
call fcn.14011f0f0
jmp 0x140044f11
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x140044fcd
mov qword [rsp + 0x30], rbx
movdqa xmm0, xmmword [0x14017ba80]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140044f40
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140009980
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r9, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rbx, rax
imul rbx, r10
test r8b, r8b
jne 0x140044f90
lea rcx, [rsp + 0x30]
call fcn.140009900
mov rax, rbx
add rsp, 0x70
pop rbx
ret
xor eax, eax
add rsp, 0x70
pop rbx
ret

Function at 0x140044fe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x70
add rcx, 0x90
call fcn.1400ee7e0
mov edx, eax
test eax, eax
je 0x14004510d
lea rcx, [rdx - 0x10001]
cmp rcx, 0x7ffdfffd
ja 0x14004510d
test eax, eax
je 0x14004510d
cmp dword [0x14019f0f8], 0
je 0x14004510d
xor ebx, ebx
lea r9d, [rbx + 0x20]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14019e1e0]
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
cmp byte [0x14019e189], bl
je 0x14004504e
call fcn.14011f0f0
jmp 0x140045054
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
setns al
test al, al
je 0x14004510d
mov qword [rsp + 0x30], rbx
movdqa xmm0, xmmword [0x14017ba80]
movdqu xmmword [rsp + 0x40], xmm0
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140045080
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140009980
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
lea r9, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae r9, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx rax, cl
xor rbx, rax
imul rbx, r10
test r8b, r8b
jne 0x1400450d0
lea rcx, [rsp + 0x30]
call fcn.140009900
mov rax, rbx
add rsp, 0x70
pop rbx
ret
xor eax, eax
add rsp, 0x70
pop rbx
ret
Function at 0x140046710
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
mov r10, rcx
movabs rbx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
nop dword [rax]
movzx r9d, byte [rdx]
lea rdx, [rdx + 1]
lea eax, [r9 + 0x20]
movzx ecx, al
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
movsx rax, cl
xor rbx, rax
imul rbx, r11
test r9b, r9b
jne 0x140046730
lea rdx, [rsp + 0x20]
mov rcx, r10
call fcn.140045f90
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, r8
cmp r8, rcx
je 0x1400467a3
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x58], xmm0
cmp qword [rsp + 0x58], rbx
je 0x140046804
add rax, 0x28
cmp rax, rcx
jne 0x140046780
test r8, r8
je 0x1400467fc
mov rcx, qword [rsp + 0x30]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x1400467f4
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046868
mov rcx, r8
call fcn.140120ef8
xor eax, eax
add rsp, 0x60
pop rbx
ret
test r8, r8
je 0x14004685d
mov rcx, qword [rsp + 0x30]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x140046855
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140046868
mov rcx, r8
call fcn.140120ef8
mov rax, qword [rsp + 0x38]
add rsp, 0x60
pop rbx
ret
call fcn.140127e7c
int3

Function at 0x140046b10
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rcx]
mov r9d, edx
mov r10, rcx
test r8b, r8b
jne 0x140046b22
mov eax, edx
ret
lea edx, [r8 - 0x41]
lea eax, [r8 + 0x20]
cmp dl, 0x19
movzx ecx, al
cmova ecx, r8d
movsx eax, cl
lea rcx, [r10 + 1]
xor eax, r9d
imul edx, eax, 0x1000193
jmp fcn.140046b10
Function at 0x1400470e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x60
add rcx, qword [0x14019a8f0]
mov r10, rdx
movabs rbx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [r10]
lea r10, [r10 + 1]
lea eax, [r9 + 0x20]
movzx edx, al
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
movsx rax, dl
xor rbx, rax
imul rbx, r11
test r9b, r9b
jne 0x140047110
lea rdx, [rsp + 0x20]
call fcn.140045f90
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, r8
cmp r8, rcx
je 0x14004717b
nop word [rax + rax]
movsd xmm0, qword [rax + 0x20]
movsd qword [rsp + 0x58], xmm0
cmp qword [rsp + 0x58], rbx
je 0x1400471dc
add rax, 0x28
cmp rax, rcx
jne 0x140047160
test r8, r8
je 0x1400471d4
mov rcx, qword [rsp + 0x30]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x1400471cc
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004723d
mov rcx, r8
call fcn.140120ef8
xor al, al
add rsp, 0x60
pop rbx
ret
test r8, r8
je 0x140047235
mov rcx, qword [rsp + 0x30]
movabs rax, 0x6666666666666667
sub rcx, r8
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
lea rdx, [rdx + rdx*4]
shl rdx, 3
cmp rdx, 0x1000
jb 0x14004722d
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004723d
mov rcx, r8
call fcn.140120ef8
mov al, 1
add rsp, 0x60
pop rbx
ret
call fcn.140127e7c
int3

Function at 0x140047500
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140049270
movabs rcx, 0xa412c7e8f666085e
cmp rax, rcx
ja 0x1400475a8
je 0x140047592
movabs rcx, 0x210dd34f579c65b4
cmp rax, rcx
je 0x14004757c
movabs rcx, 0x44083dda17b81bc9
cmp rax, rcx
je 0x140047566
movabs rcx, 0x7a0d6e61789bf54e
cmp rax, rcx
jne 0x1400475c6
movabs rcx, 0xff4ea39fefc154c3
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360
movabs rcx, 0x84acaa2fdb19027f
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360
movabs rcx, 0xc56a89d1dd805215
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360
movabs rcx, 0x329894daafedb293
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360
movabs rcx, 0xc364ebc6728aa2ff
cmp rax, rcx
je 0x1400475e4
movabs rcx, 0xde93687bb9d63c52
cmp rax, rcx
je 0x1400475ce
xor al, al
add rsp, 0x20
pop rbx
ret
movabs rcx, 0x9aa623cc62465af
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360
movabs rcx, 0x90920f34a2cdafc2
mov edx, ebx
add rsp, 0x20
pop rbx
jmp fcn.140044360