joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fa0c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xb0]
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x50], rcx
xor edi, edi
mov ebp, 1
cmp eax, 2
je 0x14002fa71
xor eax, eax
lock cmpxchg dword [rbx + 0xb0], ebp
je 0x14002fa56
cmp eax, 2
je 0x14002fa71
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rdi
call fcn.1400375e8
jmp 0x14002fa34
lea rcx, [rsp + 0x50]
call fcn.14002faf4
neg al
mov eax, ebp
sbb ecx, ecx
and ecx, 2
lock cmpxchg dword [rbx + 0xb0], ecx
mov dword [rsp + 0x48], esi
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [rsp + rdi + 0x48]
movabs rdx, 0x100000001b3
xor rcx, rax
add rdi, rbp
imul rcx, rdx
cmp rdi, 4
jb 0x14002fa7f
mov r8, qword [rbx + 0xa0]
mov r9, qword [rbx + 0x88]
and r8, rcx
mov rdx, qword [rbx + 0x78]
add r8, r8
mov rax, qword [r9 + r8*8]
cmp qword [r9 + r8*8], rdx
jne 0x14002fac5
mov rcx, rdx
jmp 0x14002facd
mov rcx, qword [r9 + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14002fadc
cmp dword [rax + 0x10], esi
je 0x14002fadf
mov rax, qword [rax]
jmp 0x14002faba
mov rax, rdx
mov rbx, qword [rsp + 0x58]
cmp rax, rdx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032114
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r10, qword [r8 + 0x10]
mov rbx, rcx
mov r11, r8
jb 0x140032144
mov r11, qword [r8]
lea rdx, [r10 + r10]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x140032177
movzx eax, byte [rcx + r11]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x140032159
mov r14, qword [rbx + 0x30]
mov r12, qword [rbx + 0x18]
and r14, r9
mov r11, qword [rbx + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], r11
jne 0x140032198
mov rcx, r11
jmp 0x1400321a0
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14003226d
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1400321ba
mov rdx, qword [r8]
mov r15, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
cmp r15, 8
jb 0x1400321cb
mov rcx, qword [rcx]
cmp rsi, r10
jne 0x140032209
mov rbp, rsi
test rsi, rsi
je 0x140032211
movzx r9d, word [rcx]
movzx ebx, word [rdx]
cmp r9w, bx
jb 0x140032209
sub rcx, rdx
cmp r9w, bx
ja 0x140032209
cmp rbp, 1
je 0x140032211
add rdx, 2
dec rbp
movzx r9d, word [rdx + rcx]
movzx ebx, word [rdx]
cmp r9w, bx
jae 0x1400321ec
mov rax, qword [rax]
jmp 0x14003218d
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x14003221e
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x140032228
mov r8, qword [r8]
cmp r10, rsi
jne 0x140032265
test r10, r10
je 0x140032268
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x140032265
sub r8, rcx
cmp dx, r9w
ja 0x140032265
cmp r10, 1
je 0x140032268
add rcx, 2
dec r10
movzx edx, word [r8 + rcx]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x140032247
mov rax, r11
mov qword [rdi], rax
jmp 0x140032270
mov qword [rdi], r11
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x140034a68
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 4
jb 0x140034a9f
mov rdi, qword [r14 + 0x30]
and rdi, rcx
mov rax, rdi
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [r14 + 8]
mov rdx, qword [rcx + rax*8]
cmp rdx, rbx
jne 0x140034ae1
mov rax, rbx
jmp 0x140034ae9
mov rax, qword [rcx + rax*8 + 8]
mov rax, qword [rax]
mov r15, rax
cmp r15, rdx
je 0x140034b0f
mov rax, qword [rax + 8]
mov r15, rax
mov ecx, dword [rax + 0x10]
cmp dword [r8], ecx
jne 0x140034aec
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140034bff
mov rbx, qword [rbx]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.140037404
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x140034b4c
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, qword [rbx]
cmp r15, rdx
je 0x140034ba0
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r15
mov rax, qword [r15 + 8]
mov qword [rax], rbx
mov rcx, qword [r15 + 8]
mov rax, qword [rdx + 8]
mov qword [r15 + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r14 + 8]
add rdi, rdi
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rdi*8], rax
jne 0x140034bbc
mov qword [rdx + rdi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rdi*8 + 8], rbx
jmp 0x140034bec
cmp qword [rdx + rdi*8], r15
jne 0x140034bc8
mov qword [rdx + rdi*8], rbx
jmp 0x140034bec
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rdi*8 + 8], rcx
cmp rcx, rbx
je 0x140034bec
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rdi*8 + 8], rcx
mov rcx, r14
call fcn.140034e50
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140034f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x140034f1d
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140034f75
cmp qword [rcx + rdx*8], r8
jne 0x140034f6a
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140034f6e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140034f82
cmp qword [rcx + rdx*8], r8
jne 0x140034f82
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400357b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rdi, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400357ec
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rbx, qword [r9 + 8]
mov r11, qword [rcx + rax*8]
cmp r11, rbx
je 0x140035831
mov rbx, qword [rcx + rax*8 + 8]
mov rbx, qword [rbx]
mov rdx, rbx
cmp rdx, r11
je 0x140035879
mov rbx, qword [rbx + 8]
mov rdx, rbx
mov eax, dword [rbx + 0x10]
cmp dword [r10], eax
jne 0x140035834
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140035910
mov r10, qword [rdi]
cmp rdx, r10
je 0x1400358ae
mov rax, qword [rdi + 8]
mov qword [rax], r10
mov rax, qword [r10 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rcx, qword [rdx + 8]
mov rax, qword [r10 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rdi + 8]
mov qword [r10 + 8], rax
mov qword [rdi + 8], rcx
add r8, r8
mov r10, qword [r9 + 0x18]
mov rax, qword [r10 + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1400358ce
mov qword [r10 + r8*8], rdi
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x1400358fd
cmp rax, rdx
jne 0x1400358d9
mov qword [r10 + r8*8], rdi
jmp 0x1400358fd
mov rax, qword [r10 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r10 + r8*8 + 8], rcx
cmp rcx, rdi
je 0x1400358fd
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140034e50
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
nop
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140035ae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140035b02
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140035b31
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140035b13
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140035b69
cmp qword [rcx + rdx*8], r8
jne 0x140035b5e
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140035b62
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140035b76
cmp qword [rcx + rdx*8], r8
jne 0x140035b76
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rdx, r8
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
call fcn.14003379c
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140035bf4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140035c16
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140035c45
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140035c27
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140035c7d
cmp qword [rcx + rdx*8], r8
jne 0x140035c72
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140035c76
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140035c8a
cmp qword [rcx + rdx*8], r8
jne 0x140035c8a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140035920
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400367f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov r15, rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x14003682a
mov r9, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r10, [r11 + r11]
xor ecx, ecx
test r10, r10
je 0x14003685d
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r10
jb 0x14003683f
mov rsi, qword [r15 + 0x30]
and rsi, rdx
mov rdi, rsi
add rdi, rdi
mov rax, qword [r15 + 0x18]
mov rbx, qword [r15 + 8]
mov r12, qword [rax + rdi*8]
cmp r12, rbx
jne 0x140036880
mov rdi, rbx
jmp 0x140036888
mov rdi, qword [rax + rdi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x1400368fd
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400368a3
mov rax, qword [rax]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x1400368b0
mov r9, qword [r8]
cmp r11, rcx
jne 0x140036888
mov r10, r11
test r11, r11
je 0x1400368ed
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140036888
sub r9, rax
cmp cx, dx
ja 0x140036888
cmp r10, 1
je 0x1400368ed
dec r10
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400368cf
jmp 0x140036888
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400369ee
mov rbx, qword [rbx]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.14000fc94
mov rdx, rax
mov rax, qword [r15 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jae 0x14003693a
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rax, qword [r15 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14003698e
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r15 + 8]
add rsi, rsi
mov rdx, qword [r15 + 0x18]
cmp qword [rdx + rsi*8], rax
jne 0x1400369aa
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400369da
cmp qword [rdx + rsi*8], rdi
jne 0x1400369b6
mov qword [rdx + rsi*8], rbx
jmp 0x1400369da
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400369da
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.140036a00
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140036ab0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140036ad2
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
add rbx, rbx
je 0x140036b02
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x140036ae4
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140036b3a
cmp qword [rcx + rdx*8], r8
jne 0x140036b2f
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x140036b33
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140036b47
cmp qword [rcx + rdx*8], r8
jne 0x140036b47
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
lea rdx, [rsp + 0x30]
call fcn.140036bd4
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rax]
mov rax, rdi
mov qword [rdi], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x1400370f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140037121
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x140037150
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x140037132
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140037188
cmp qword [rcx + rdx*8], rdi
jne 0x14003717d
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140037181
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140037195
cmp qword [rcx + rdx*8], rdi
jne 0x140037195
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140034264
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140037220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140037242
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140037271
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140037253
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400372a9
cmp qword [rcx + rdx*8], r8
jne 0x14003729e
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1400372a2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400372b6
cmp qword [rcx + rdx*8], r8
jne 0x1400372b6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140036bd4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140037320
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14003734d
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14003737c
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14003735e
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400373b4
cmp qword [rcx + rdx*8], rdi
jne 0x1400373a9
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400373ad
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400373c1
cmp qword [rcx + rdx*8], rdi
jne 0x1400373c1
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140018e70
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140037420
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14003745c
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x14003748f
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x140037471
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
mov r13, qword [rcx + rax*8]
cmp rdi, r13
je 0x140037542
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r13
je 0x140037542
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400374d8
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x1400374e5
mov r11, qword [r10]
cmp r15, rcx
jne 0x1400374b9
mov r14, r15
test r15, r15
je 0x140037522
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400374b9
sub r11, rax
cmp cx, dx
ja 0x1400374b9
cmp r14, 1
je 0x140037522
dec r14
add rax, 2
movzx ecx, word [rax + r11]
movzx edx, word [rax]
cmp cx, dx
jae 0x140037504
jmp 0x1400374b9
mov r8, rbx
lea rdx, [rsp + 0x70]
lea rcx, [r9 + 8]
call fcn.140036bd4
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400375d8
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x140037577
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140037597
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400375c6
cmp rax, rdi
jne 0x1400375a2
mov qword [rdx + r8*8], rbx
jmp 0x1400375c6
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400375c6
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140036a00
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004401c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov r9, rdx
mov rbp, rcx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + r9]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r8
cmp r8, 4
jb 0x14004404b
mov r8, qword [rbp + 0x30]
and r8, rcx
add r8, r8
mov r11, qword [rbp + 0x18]
mov rbx, qword [r11 + r8*8]
mov rdx, qword [rbp + 8]
mov r10, rbx
cmp qword [r11 + r8*8], rdx
jne 0x14004408e
mov rax, rdx
jmp 0x140044096
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400440d2
mov ecx, dword [r9]
cmp dword [rbx + 0x10], ecx
je 0x1400440a8
mov rbx, qword [rbx]
jmp 0x140044080
mov rdi, rbx
cmp qword [r11 + r8*8], rdx
jne 0x1400440b6
mov rax, rdx
jmp 0x1400440be
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400440cd
cmp ecx, dword [rbx + 0x10]
jne 0x1400440cd
mov rbx, qword [rbx]
jmp 0x1400440ab
cmp r10, rbx
jne 0x1400440d8
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor r14d, r14d
cmp rdi, rbx
je 0x1400440f1
inc r14
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x1400440e3
mov rsi, qword [rdx]
cmp rdi, rsi
jne 0x140044166
cmp rbx, rdx
jne 0x140044166
mov qword [rdx], rdx
mov rax, qword [rbp + 8]
mov qword [rax + 8], rax
and qword [rbp + 0x10], 0
cmp rsi, qword [rbp + 8]
je 0x140044144
mov rbx, qword [rsi]
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x140044132
and qword [rsi + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140089b1f.8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, rbx
cmp rbx, qword [rbp + 8]
jne 0x140044114
mov edx, 8
mov rcx, rbp
call fcn.140032944
jmp 0x14004416b
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.140044590
cmp rdi, rbx
jne 0x140044153
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret