joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e850
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x140063028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0
call fcn.14001e820
test eax, eax
jne 0x14001e8b4
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.140004c20
lea rcx, [rsp + 0x30]
call fcn.140004c60
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x30]
call fcn.140009ed0
jmp 0x14001e8c6
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14001e8fa
mov r8d, 0x17
lea rdx, str...CommonLibStdHelp.cpp
lea rcx, [0x14004fef0]
call fcn.14001e440
mov rdx, qword [rsp + 0xe0]
lea rcx, str.Cant_find_the_FilePath:_s_n
call fcn.14001e260
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14002f130
add rsp, 0xd8
ret

Function at 0x14001ee90
Capabilities:
Set file attributes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x140063028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
call fcn.14001e820
test eax, eax
jne 0x14001ef01
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x30]
call fcn.140004c20
lea rcx, [rsp + 0x30]
call fcn.140004c60
mov edx, dword [rsp + 0xe8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [rsp + 0xc0], eax
lea rcx, [rsp + 0x30]
call fcn.140009ed0
mov eax, dword [rsp + 0xc0]
jmp 0x14001ef16
mov edx, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14002f130
add rsp, 0xd8
ret

Function at 0x14001ef40
Capabilities:
Copy file

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x170
mov qword [rsp + 0x158], 0xfffffffffffffffe
mov rax, qword [0x140063028]
xor rax, rsp
mov qword [rsp + 0x160], rax
call fcn.14001e820
test eax, eax
jne 0x14001effc
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0xc0]
call fcn.140004c20
nop
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x30]
call fcn.140004c20
lea rcx, [rsp + 0x30]
call fcn.140004c60
mov rbx, rax
lea rcx, [rsp + 0xc0]
call fcn.140004c60
mov r8d, dword [rsp + 0x190]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [rsp + 0x150], eax
lea rcx, [rsp + 0x30]
call fcn.140009ed0
nop
lea rcx, [rsp + 0xc0]
call fcn.140009ed0
mov eax, dword [rsp + 0x150]
jmp 0x14001f01a
mov r8d, dword [rsp + 0x190]
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0x180]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14002f130
add rsp, 0x170
pop rbx
ret
Function at 0x14001f310
Capabilities:
Get geographical location

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
mov rax, qword [0x140063028]
xor rax, rbp
mov qword [rbp + 0x150], rax
call fcn.14001e820
test eax, eax
jne 0x14001f43b
movzx eax, byte [0x14004fe9c]
mov byte [rbp + 0x30], al
lea rdi, [rbp + 0x31]
xor eax, eax
mov ecx, 0x103
rep stosb byte [rdi], al
mov r9d, dword [rbp + 0x198]
lea r8, [rbp + 0x30]
mov edx, dword [rbp + 0x188]
mov ecx, dword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [rbp + 0x14], eax
call fcn.140004730
mov dword [rbp + 0x10], eax
lea rax, [rbp + 0x30]
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x18], 0
jne 0x14001f3a9
mov qword [rbp + 0x140], 0
jmp 0x14001f423
mov rcx, qword [rbp + 0x18]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14001f3cf
mov qword [rbp + 0x148], 0
jmp 0x14001f415
movsxd rcx, dword [rbp]
shl rcx, 1
mov rax, rcx
add rax, 0xf
cmp rax, rcx
ja 0x14001f3ec
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140045720
sub rsp, rax
lea rcx, [rsp + 0x20]
mov r9d, dword [rbp + 0x10]
mov r8d, dword [rbp]
mov rdx, qword [rbp + 0x18]
call fcn.140004740
mov qword [rbp + 0x148], rax
mov rax, qword [rbp + 0x148]
mov qword [rbp + 0x140], rax
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x190]
call fcn.14001fd00
mov eax, dword [rbp + 0x14]
jmp 0x14001f45b
mov r9d, dword [rbp + 0x198]
mov r8, qword [rbp + 0x190]
mov edx, dword [rbp + 0x188]
mov ecx, dword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rcx, qword [rbp + 0x150]
xor rcx, rbp
call fcn.14002f130
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x14001f610
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x140063028]
xor rax, rsp
mov qword [rsp + 0xc8], rax
call fcn.14001e820
test eax, eax
jne 0x14001f690
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x30]
call fcn.140004c20
lea rcx, [rsp + 0x30]
call fcn.140004c60
mov r8, qword [rsp + 0xf0]
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExA]
mov dword [rsp + 0xc0], eax
lea rcx, [rsp + 0x30]
call fcn.140009ed0
mov eax, dword [rsp + 0xc0]
jmp 0x14001f6ae
mov r8, qword [rsp + 0xf0]
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.14002f130
add rsp, 0xd8
ret
Function at 0x140026db4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x40]
mov rbx, r8
call fcn.140024f24
mov rsi, rax
test rax, rax
je 0x140026e30
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
test rbx, rbx
je 0x140026e2b
cmp dword [rbx], 0x40
jb 0x140026e2b
mov rcx, qword [rbp + 0x40]
or dword [rbx + 4], 1
or qword [rbx + 0x30], 0xffffffffffffffff
mov qword [rbx + 8], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x87
mov rcx, rsi
mov qword [rbx + 0x10], rsi
call qword [sym.imp.USER32.dll_SendMessageW]
bt rax, 0xd
jb 0x140026e2b
or dword [rbx + 4], 0x80000002
mov rax, rdi
jmp 0x140026e34
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003196c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14003bb9c
nop
cmp dword [0x140068f08], 1
je 0x140031918
mov dword [0x140068f04], 1
mov byte [0x140068f00], r12b
test ebx, ebx
jne 0x140031904
mov rcx, qword [0x14006b110]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400318f1
mov rcx, qword [0x14006b108]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x140031890
call fcn.140033ed4
cmp qword [rdi], rax
jne 0x140031890
jmp 0x140031876
cmp rdi, rsi
jb 0x1400318f1
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140033ed4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x14006b110]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x14006b108]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x1400318cf
cmp r13, rax
je 0x1400318ef
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x140031876
lea rdx, [0x14004aa90]
lea rcx, [0x14004aa78]
call fcn.1400316c0
lea rdx, [0x14004aaa0]
lea rcx, [0x14004aa98]
call fcn.1400316c0
nop
test r12d, r12d
je 0x140031927
mov ecx, 8
call fcn.14003ba9c
test r12d, r12d
jne 0x140031952
mov dword [0x140068f08], 1
lea ecx, [r12 + 8]
call fcn.14003ba9c
mov ecx, r15d
call fcn.140031654
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x1400317e0

Function at 0x140031978
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x1400317e0
Function at 0x1400323d4
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400323ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400323ee
xor eax, eax
test eax, eax
je 0x1400323fe
mov ecx, eax
call fcn.140032c9c
or eax, 0xffffffff
jmp 0x140032400
xor eax, eax
add rsp, 0x28
ret

Function at 0x140032408
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140032420
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140032422
xor eax, eax
test eax, eax
je 0x140032432
mov ecx, eax
call fcn.140032c9c
or eax, 0xffffffff
jmp 0x140032434
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003243c
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x140032452
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140032454
xor eax, eax
test eax, eax
je 0x140032464
mov ecx, eax
call fcn.140032c9c
or eax, 0xffffffff
jmp 0x140032466
xor eax, eax
add rsp, 0x28
ret

Function at 0x14003246c
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x140032482
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140032484
xor eax, eax
test eax, eax
je 0x140032494
mov ecx, eax
call fcn.140032c9c
or eax, 0xffffffff
jmp 0x140032496
xor eax, eax
add rsp, 0x28
ret
Function at 0x14003ceac
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140033ed4
xor ebx, ebx
mov rdi, rax
cmp qword [0x140069d90], rbx
jne 0x14003cfb2
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14003d087
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14003d087
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140069d90], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, [0x140053ff0]
mov rcx, rsi
mov qword [0x140069d98], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140069da0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140069db0], rax
test rax, rax
je 0x14003cfa9
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140069da8], rax
jmp 0x14003cfb9
mov rax, qword [0x140069da8]
jmp 0x14003cfc0
mov rax, qword [0x140069da8]
mov r11, qword [0x140069db0]
cmp rax, rdi
je 0x14003d028
cmp r11, rdi
je 0x14003d028
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140069db0]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14003d028
test rax, rax
je 0x14003d028
call rsi
test rax, rax
je 0x14003d022
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14003d022
test byte [rsp + 0x38], 1
jne 0x14003d028
bts ebp, 0x15
jmp 0x14003d066
mov rcx, qword [0x140069d98]
cmp rcx, rdi
je 0x14003d066
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003d066
call rax
mov rbx, rax
test rax, rax
je 0x14003d066
mov rcx, qword [0x140069da0]
cmp rcx, rdi
je 0x14003d066
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003d066
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140069d90]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14003d087
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14003d089
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140003310
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000332f
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14001dbf8

Function at 0x140008510
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp qword [0x14009f0f0], 0
mov rbx, rcx
mov rdi, rdx
je 0x140008590
lea rsi, [rsp + 0x20]
mov rdx, rcx
mov rcx, rsi
call fcn.140008390
mov rbx, qword [rsp + 0x28]
mov rcx, rsi
call qword [0x14009f0f0]
test rbx, rbx
je 0x140008550
test byte [rbx + 7], 0x40
je 0x140008570
lea rcx, [0x14001e1e0]
call fcn.140018400
cmp byte [rax], 0
jne 0x1400085c0
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, [0x14001e200]
call fcn.140018400
mov rdx, rbx
mov rcx, rax
call fcn.140005400
jmp 0x140008550
mov ecx, 2
call qword [fcn.14001d620]
mov rcx, rbx
mov r8, rdi
mov edx, 1
mov rsi, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.14001dbf8
mov byte [rax], 0
lea rcx, [0x14001e0e0]
call fcn.140018400
mov rbx, qword [rax]
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400085e0
add qword [rdx - 0x10], 0x10
mov qword [rax], rdx
mov rax, qword [rbx - 0x10]
lea rdx, [rbx - 0x10]
cmp rax, 0xf
jbe 0x140008610
mov r8, qword [rbx]
sub rax, 0x10
xor ecx, ecx
mov qword [rbx - 0x10], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.140007620
mov r8, qword [rbx]
mov ecx, 1
call fcn.140007620
mov rcx, rbx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
jmp fcn.1400076b0

Function at 0x140009650
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r13, [0x14009f0c0]
mov rsi, rdx
mov rbx, rcx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
jle 0x1400096df
mov rdi, qword [fcn.14001d620]
xor r14d, r14d
lea r12, [rsp + 0x20]
lea rbp, [0x14001e1e0]
jmp 0x1400096a5
add r14, 1
add rbx, 0x10
cmp rsi, r14
je 0x1400096e6
mov ecx, 1
call rdi
movdqu xmm0, xmmword [rbx]
xor r8d, r8d
mov rdx, r12
mov rcx, rax
movups xmmword [rsp + 0x20], xmm0
call fcn.140009560
mov rcx, rbp
call fcn.140018400
cmp byte [rax], 0
je 0x140009698
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [fcn.14001d620]
mov ecx, 1
call rdi
mov r8d, 1
mov edx, 1
lea rcx, [0x1400212a1]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rdi
mov rcx, rax
call fcn.14001dbf8
mov rcx, r13
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b7e0
Capabilities:
Hash data using sha256

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movdqu xmm0, xmmword [0x1400216c0]
xor eax, eax
lea rsi, [rsp + 0x20]
mov rbp, rcx
mov ecx, 0xd
mov rbx, rdx
mov rdi, rsi
mov qword [rsp + 0xf0], r8
rep stosq qword [rdi], rax
movups xmmword [rsp + 0x28], xmm0
mov rcx, qword [0x14009a4f0]
movdqu xmm0, xmmword [0x1400216d0]
movups xmmword [rsp + 0x38], xmm0
call fcn.140018400
cmp byte [rax], 0
mov r14, rax
jne 0x14000b96a
xor eax, eax
xor r13d, r13d
lea r12, [rsp + 0x48]
mov edi, 0x40
lea r15, [rsp + 0x28]
mov edx, eax
test rbx, rbx
jg 0x14000b8c7
jmp 0x14000b946
test cl, 4
jne 0x14000b980
test ecx, ecx
je 0x14000b884
movzx edx, byte [r9]
mov byte [rax], dl
test cl, 2
jne 0x14000b9a0
add r13, rcx
sub rbx, rcx
mov eax, ecx
add eax, dword [rsp + 0x20]
mov dword [rsp + 0x20], eax
jae 0x14000b89b
add dword [rsp + 0x24], 1
test al, 0x3f
jne 0x14000b8ba
mov r8d, 0x40
mov rdx, r12
mov rcx, r15
call fcn.14000b9c0
cmp byte [r14], 0
jne 0x14000b96a
test rbx, rbx
jle 0x14000b940
mov edx, dword [rsp + 0x20]
and edx, 0x3f
mov rax, rdi
lea r9, [rbp + r13]
mov ecx, edx
sub rax, rcx
cmp rax, rbx
cmovg rax, rbx
add edx, 0x28
mov rcx, rax
lea rax, [rsi + rdx]
cmp ecx, 8
jb 0x14000b868
mov rdx, qword [r9]
mov qword [rax], rdx
mov edx, ecx
mov r8, qword [r9 + rdx - 8]
mov qword [rax + rdx - 8], r8
lea r8, [rax + 8]
and r8, 0xfffffffffffffff8
sub rax, r8
mov rdx, rax
sub r9, rax
add edx, ecx
and edx, 0xfffffff8
cmp edx, 8
jb 0x14000b884
and edx, 0xfffffff8
xor eax, eax
mov r10d, eax
add eax, 8
mov r11, qword [r9 + r10]
mov qword [r8 + r10], r11
cmp eax, edx
jb 0x14000b927
jmp 0x14000b884
cmp byte [r14], 0
jne 0x14000b96a
mov rdx, qword [rsp + 0xf0]
mov rcx, rsi
call fcn.14000d750
cmp byte [r14], 0
jne 0x14000b96a
mov edx, 0x68
mov rcx, rsi
call fcn.14000b780
nop
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [r9]
mov dword [rax], edx
mov edx, ecx
mov r8d, dword [r9 + rdx - 4]
mov dword [rax + rdx - 4], r8d
jmp 0x14000b884
mov edx, ecx
movzx r8d, word [r9 + rdx - 2]
mov word [rax + rdx - 2], r8w
jmp 0x14000b884
Function at 0x14000fcc0
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rbx, rcx
mov rcx, qword [0x14009a4f0]
mov rbp, rdx
sar rax, 0x3f
mov rsi, rdx
shr rax, 0x3e
lea rdi, [rdx + rax]
and edi, 3
sub rdi, rax
call fcn.140018400
sub rbp, rdi
movzx r8d, byte [rax]
cmp rsi, 3
jle 0x14000fdec
test r8b, r8b
jne 0x14000fdd8
xor edx, edx
xor ecx, ecx
mov eax, dword [rbx + rdx]
add rdx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
lea ecx, [rax + rax*4 - 0x19ab949c]
cmp rbp, rdx
jg 0x14000fd10
mov rdi, rsi
and edi, 3
je 0x14000fde8
lea rax, [rbp - 1]
shr rax, 2
test rbp, rbp
lea rdx, [rax*4 + 4]
mov eax, 4
cmovle rdx, rax
lea r9, [rdi - 1]
lea rax, [rbx + r9]
movzx eax, byte [rax + rdx]
test r9, r9
je 0x14000fd91
sub rdi, 2
shl eax, 8
lea r9, [rbx + rdi]
movzx r9d, byte [r9 + rdx]
or eax, r9d
test rdi, rdi
je 0x14000fd91
movzx edx, byte [rbx + rdx]
shl eax, 8
or eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
jne 0x14000fdd8
imul eax, eax, 0x1b873593
xor ecx, esi
xor eax, ecx
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
jmp 0x14000fd9f
test rdi, rdi
jle 0x14000fdfa
xor edx, edx
xor ecx, ecx
jmp 0x14000fd5f
xor ecx, ecx
xor eax, eax
jmp 0x14000fd9a
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
lea rax, [rcx + 8]
test rcx, rcx
cmovne rcx, rax
jmp 0x14000fcc0
Function at 0x14000fe00
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rbx, rcx
mov rcx, qword [0x14009a4f0]
mov rbp, rdx
sar rax, 0x3f
mov rsi, rdx
shr rax, 0x3e
lea rdi, [rdx + rax]
and edi, 3
sub rdi, rax
call fcn.140018400
sub rbp, rdi
movzx r8d, byte [rax]
cmp rsi, 3
jle 0x14000fdec
test r8b, r8b
jne 0x14000fdd8
xor edx, edx
xor ecx, ecx
mov eax, dword [rbx + rdx]
add rdx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
lea ecx, [rax + rax*4 - 0x19ab949c]
cmp rbp, rdx
jg 0x14000fd10
mov rdi, rsi
and edi, 3
je 0x14000fde8
lea rax, [rbp - 1]
shr rax, 2
test rbp, rbp
lea rdx, [rax*4 + 4]
mov eax, 4
cmovle rdx, rax
lea r9, [rdi - 1]
lea rax, [rbx + r9]
movzx eax, byte [rax + rdx]
test r9, r9
je 0x14000fd91
sub rdi, 2
shl eax, 8
lea r9, [rbx + rdi]
movzx r9d, byte [r9 + rdx]
or eax, r9d
test rdi, rdi
je 0x14000fd91
movzx edx, byte [rbx + rdx]
shl eax, 8
or eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
test r8b, r8b
jne 0x14000fdd8
imul eax, eax, 0x1b873593
xor ecx, esi
xor eax, ecx
mov edx, eax
shr edx, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
jmp 0x14000fd9f
test rdi, rdi
jle 0x14000fdfa
xor edx, edx
xor ecx, ecx
jmp 0x14000fd5f
xor ecx, ecx
xor eax, eax
jmp 0x14000fd9a
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
lea rax, [rcx + 8]
test rcx, rcx
cmovne rcx, rax
jmp 0x14000fcc0
Function at 0x1400111c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movups xmmword [rsp], xmm6
movups xmmword [rsp + 0x10], xmm7
movups xmmword [rsp + 0x20], xmm8
movdqu xmm6, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm5, xmmword [rcx + 0x30]
movd xmm0, r8d
lea rax, [rdx - 0x40]
pxor xmm0, xmm6
cmp rax, 0x3f
jle 0x140011400
lea r8, [rdx - 0x80]
movdqu xmm4, xmmword [0x140021b70]
lea rax, [rcx + 0x40]
mov rdx, r8
and rdx, 0xffffffffffffffc0
lea rdx, [rcx + rdx + 0x80]
nop dword [rax]
movdqu xmm7, xmm3
movdqu xmm6, xmm2
movdqu xmm1, xmm5
add rax, 0x40
movdqu xmm8, xmm0
pclmulqdq xmm7, xmm4, 0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm8, xmm4, 0
pclmulqdq xmm5, xmm4, 0x11
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm3, xmm4, 0x11
pclmulqdq xmm2, xmm4, 0x11
pxor xmm0, xmm8
pxor xmm3, xmm7
pxor xmm2, xmm6
movdqu xmm8, xmmword [rax - 0x40]
pxor xmm1, xmm5
movdqu xmm7, xmmword [rax - 0x30]
movdqu xmm6, xmmword [rax - 0x20]
movdqu xmm5, xmmword [rax - 0x10]
pxor xmm0, xmm8
pxor xmm3, xmm7
pxor xmm2, xmm6
pxor xmm5, xmm1
cmp rax, rdx
jne 0x140011220
mov rax, r8
shr rax, 6
lea rdx, [rax + 2]
shl rax, 6
mov r9, rax
mov rax, r8
shl rdx, 6
sub rax, r9
movdqu xmm1, xmmword [0x140021b60]
movdqu xmm4, xmm0
pclmulqdq xmm4, xmm1, 0
pclmulqdq xmm0, xmm1, 0x11
pxor xmm0, xmm4
pxor xmm3, xmm0
movdqu xmm0, xmm3
pclmulqdq xmm3, xmm1, 0x11
pclmulqdq xmm0, xmm1, 0
pxor xmm3, xmm0
pxor xmm2, xmm3
movdqu xmm3, xmm2
pclmulqdq xmm2, xmm1, 0x11
pclmulqdq xmm3, xmm1, 0
movdqu xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm5
cmp rax, 0xf
jle 0x140011381
movdqu xmm2, xmm0
movdqu xmm7, xmmword [rcx + rdx]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm7
cmp rax, 0x1f
jle 0x140011381
movdqu xmm2, xmm0
movdqu xmm7, xmmword [rcx + rdx + 0x10]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm7
cmp rax, 0x2f
jle 0x140011381
movdqu xmm2, xmm0
movdqu xmm3, xmmword [rcx + rdx + 0x20]
pclmulqdq xmm0, xmm1, 0x11
pclmulqdq xmm2, xmm1, 0
pxor xmm0, xmm2
pxor xmm0, xmm3
movdqu xmm2, xmm0
psrldq xmm0, 8
movups xmm6, xmmword [rsp]
movdqu xmm3, xmmword [0x140021ba0]
pclmulqdq xmm2, xmm1, 0x10
movups xmm7, xmmword [rsp + 0x10]
movups xmm8, xmmword [rsp + 0x20]
pxor xmm2, xmm0
movdqu xmm1, xmm2
movdqu xmm0, xmm2
movdqu xmm2, xmmword [0x140021b80]
psrldq xmm0, 4
pand xmm1, xmm2
pclmulqdq xmm1, xmmword [0x140021b90], 0
pxor xmm1, xmm0
movdqu xmm0, xmm1
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0x10
pand xmm0, xmm2
pclmulqdq xmm0, xmm3, 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
add rsp, 0x38
ret
mov edx, 0x40
jmp 0x1400112c2