joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b746c
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov byte [rcx], 0
mov ecx, 0x202
lea rdx, [rsp + 0xc0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
test eax, eax
je 0x1400b74c7
mov rcx, qword [rsp + 0x278]
lea r8, str.amcorewcd_sourcemachinestatecollectionmachineinfoWinsockApiHelper.h
mov r9d, eax
mov edx, MsiGetActiveDatabase
call fcn.14023b72c
int3
movzx ecx, word [rsp + 0xc0]
cmp cl, 2
jne 0x1400b74fd
shr cx, 8
cmp cl, 2
jne 0x1400b74fd
mov byte [rbx], 1
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140112420
add rsp, 0x270
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
and dword [rsp + 0x30], 0
lea rax, str.Could_not_find_a_usable_version_of_Winsock.dll
mov ecx, 0xc8
mov qword [rsp + 0x40], rax
call fcn.140112a2c
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140119014
lea rdx, [0x1404af150]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3

Function at 0x1400b7550
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rdi, qword [r8 + 0x18]
mov rbx, r8
mov r10, qword [r8 + 0x10]
mov r12, rdx
mov r11, rcx
mov r9, r8
cmp rdi, 8
jb 0x1400b7582
mov r9, qword [r8]
lea r8, [r10 + r10]
mov qword [rsp + 0x20], rsi
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r8, r8
je 0x1400b75ba
movabs rsi, 0x100000001b3
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, rsi
cmp rdx, r8
jb 0x1400b75a6
mov rax, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x30]
mov r15, qword [r11 + 8]
and rdx, rcx
add rdx, rdx
mov rbp, qword [rax + rdx*8]
lea r14, [rax + rdx*8]
mov rcx, rbp
jmp 0x1400b76a3
mov rax, r15
cmp rcx, rax
je 0x1400b767d
lea r11, [rcx + 0x10]
mov rax, rbx
cmp rdi, 8
jb 0x1400b75f8
mov rax, qword [rbx]
mov rsi, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x10]
cmp rsi, 8
jb 0x1400b7609
mov r11, qword [r11]
cmp rdx, r10
jne 0x1400b76a0
test rdx, rdx
je 0x1400b763c
sub r11, rax
nop word [rax + rax]
movzx r8d, word [rax + r11]
cmp r8w, word [rax]
ja 0x1400b76a0
jb 0x1400b76a0
cmp rdx, 1
je 0x1400b763c
dec rdx
add rax, 2
jmp 0x1400b7620
lea rax, [rcx + 0x10]
cmp rsi, 8
jb 0x1400b7649
mov rax, qword [rax]
cmp rdi, 8
jb 0x1400b7652
mov rbx, qword [rbx]
test r10, r10
je 0x1400b767a
sub rbx, rax
nop word [rax + rax]
movzx edx, word [rax + rbx]
cmp dx, word [rax]
ja 0x1400b767d
jb 0x1400b767d
cmp r10, 1
je 0x1400b767a
dec r10
add rax, 2
jmp 0x1400b7660
mov r15, rcx
mov rsi, qword [rsp + 0x20]
mov rax, r12
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov qword [r12], r15
pop r15
pop r14
pop r12
ret
mov rcx, qword [rcx]
cmp rbp, r15
je 0x1400b75dc
mov rax, qword [r14 + 8]
mov rax, qword [rax]
jmp 0x1400b75df
Function at 0x1400b7fe0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov r11, r8
lea rdx, [r8 + 0x10]
mov rdi, rcx
call fcn.140071820
movzx edx, byte [r11 + 0x30]
movabs rcx, 0xcbf29ce484222325
xor rdx, rcx
mov r8, rax
shl r8, 6
movabs rcx, 0x100000001b3
imul rdx, rcx
mov rcx, rax
add rdx, r8
shr rcx, 2
mov r8d, 0x9e3779b9
add r8, rcx
mov rcx, qword [rdi + 0x18]
add r8, rdx
xor r8, rax
and r8, qword [rdi + 0x30]
add r8, r8
cmp qword [rcx + r8*8 + 8], r11
jne 0x1400b8076
cmp qword [rcx + r8*8], r11
jne 0x1400b806b
mov rax, qword [rdi + 8]
mov qword [rcx + r8*8], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
jmp 0x1400b806f
mov rax, qword [r11 + 8]
mov qword [rcx + r8*8 + 8], rax
jmp 0x1400b8083
cmp qword [rcx + r8*8], r11
jne 0x1400b8083
mov rax, qword [r11]
mov qword [rcx + r8*8], rax
lea rcx, [rdi + 8]
mov r8, r11
mov rdx, rsi
call fcn.1400b8b50
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b880c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rsi, rcx
lea rbp, [rcx + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdi]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 8
jb 0x1400b884f
mov rdx, qword [rsi + 0x88]
and rdx, rcx
add rdx, rdx
mov r8, qword [rsi + 0x70]
mov rbx, qword [r8 + rdx*8]
mov rcx, qword [rsi + 0x60]
cmp qword [r8 + rdx*8], rcx
jne 0x1400b892b
mov rax, rcx
cmp rbx, rax
je 0x1400b8938
mov rax, qword [rdi]
cmp qword [rbx + 0x10], rax
jne 0x1400b8972
cmp rbx, rcx
je 0x1400b897a
mov rdi, qword [rbx + 0x28]
cmp qword [rsi + 0x40], 0
jne 0x1400b8995
mov rax, qword [rsi + 0x98]
cmp rdi, rax
je 0x1400b88d6
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x1400b8940
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x40]
movups xmm0, xmmword [rbx + 0x18]
mov byte [rsp + 0x30], 1
movups xmmword [r14], xmm0
movsd xmm0, qword [rsp + 0x30]
movsd qword [r14 + 0x10], xmm0
test rbp, rbp
je 0x1400b890c
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rax, qword [r8 + rdx*8 + 8]
mov rax, qword [rax]
jmp 0x1400b8894
mov rbx, rcx
jmp 0x1400b88aa
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x1400b88d6
mov rbx, qword [rbx]
jmp 0x1400b8887
mov rax, qword [rsi + 0x48]
lock inc qword [rax + 0x48]
xorps xmm0, xmm0
movdqu xmmword [r14], xmm0
mov byte [r14 + 0x10], 0
jmp 0x1400b88f8
lea rcx, [rdi + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x1400b88c2

Function at 0x1400b8fd8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movzx eax, word [rdx + 4]
movabs rcx, 0xcbf29ce484222325
movzx r8d, word [rdx + 6]
xor r8, rax
mov eax, dword [rdx]
xor r8, rax
xor r9d, r9d
movzx eax, byte [rdx + r9 + 0x10]
movabs r10, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, r10
cmp r9, 4
jb 0x1400b8ff6
mov rax, r8
mov rdx, r8
shl rax, 6
add rcx, rax
shr rdx, 2
mov eax, 0x9e3779b9
add rax, rdx
add rax, rcx
xor rax, r8
ret
Function at 0x1400bf768
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1404e1800]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rbp - 0x50], rcx
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
je 0x1400bf86e
or dword [rbp - 0x50], 0xffffffff
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0x40000001
mov edx, eax
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
nop dword [rax + rax]
test eax, eax
je 0x1400bf88c
mov edx, dword [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.1400bfd2c
nop
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp - 0x48]
mov r8d, 0x40000001
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
nop dword [rax + rax]
test eax, eax
je 0x1400bf8c9
mov r8d, dword [rbp - 0x50]
movdqa xmm0, xmmword [0x1403aa3d0]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x48]
lea rcx, [rbp - 0x30]
call fcn.14009eb68
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
lea rcx, [rbp - 0x48]
call fcn.14007a750
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140112420
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], SafeArrayLock
mov byte [rcx], 0
lea rdx, [0x1403ab7c0]
call fcn.14009d350
jmp 0x1400bf849
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x1400bf8a4
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 8]
lea rdx, str.ConvertByteArrayToBase64String_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcoreWCDSourceincConverters.h
mov edx, 0x12e
call fcn.140121d1c
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
test eax, eax
jle 0x1400bf8e2
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 8]
lea rdx, str.ConvertByteArrayToBase64String_failed_conversion
mov qword [rsp + 0x20], rdx
mov r9d, eax
lea r8, str.amcoreWCDSourceincConverters.h
mov edx, 0x135
call fcn.140121d1c
int3
Function at 0x1400c71b0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 8
mov rax, qword [r8]
mov r9, rdx
mov r11, rcx
test rax, rax
je 0x1400c72a5
movabs rdx, 0x100000001b3
mov qword [rsp], rbx
mov rbx, qword [rax + 0x40]
movabs rax, 0xcbf29ce484222325
movzx r8d, bl
xor r8, rax
mov rax, rbx
imul r8, rdx
shr rax, 8
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x10
imul r8, rdx
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x18
imul r8, rdx
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x20
imul r8, rdx
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x28
imul r8, rdx
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x30
imul r8, rdx
movzx ecx, al
mov rax, rbx
xor r8, rcx
shr rax, 0x38
imul r8, rdx
xor r8, rax
mov rax, qword [r11 + 0x18]
imul r8, rdx
mov rdx, qword [r11 + 0x30]
and rdx, r8
mov r8, qword [r11 + 8]
add rdx, rdx
mov r10, qword [rax + rdx*8]
lea r11, [rax + rdx*8]
mov rcx, r10
cmp r10, r8
je 0x1400c72bf
mov rax, qword [r11 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1400c72ba
cmp qword [rcx + 0x10], rbx
jne 0x1400c72b5
mov qword [r9], rcx
mov rax, r9
mov rbx, qword [rsp]
add rsp, 8
ret
mov rax, qword [rcx + 8]
mov qword [rdx], rax
mov rax, r9
add rsp, 8
ret
mov rcx, qword [rcx]
jmp 0x1400c727e
mov rcx, r8
jmp 0x1400c7295
mov rax, r8
jmp 0x1400c728a

Function at 0x1400c72d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rsi, qword [r8 + 0x18]
mov rdi, r8
mov r10, qword [r8 + 0x10]
mov r12, rdx
mov rbx, rcx
mov r11, r8
cmp rsi, 8
jb 0x1400c7307
mov r11, qword [r8]
lea r8, [r10 + r10]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1400c7344
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r8
jb 0x1400c7330
mov rax, qword [rbx + 0x18]
mov rdx, qword [rbx + 0x30]
mov r15, qword [rbx + 8]
and rdx, r9
add rdx, rdx
mov rbp, qword [rax + rdx*8]
lea r14, [rax + rdx*8]
mov rcx, rbp
cmp rbp, r15
jne 0x1400c7430
mov rax, r15
cmp rcx, rax
je 0x1400c740d
lea r11, [rcx + 0x10]
mov rax, rdi
cmp rsi, 8
jb 0x1400c7386
mov rax, qword [rdi]
mov rbx, qword [r11 + 0x18]
mov rdx, qword [r11 + 0x10]
cmp rbx, 8
jb 0x1400c7397
mov r11, qword [r11]
cmp rdx, r10
jne 0x1400c743c
test rdx, rdx
je 0x1400c73d0
sub r11, rax
nop dword [rax + rax]
movzx r8d, word [rax + r11]
cmp r8w, word [rax]
ja 0x1400c743c
jb 0x1400c743c
cmp rdx, 1
je 0x1400c73d0
dec rdx
add rax, 2
jmp 0x1400c73b0
lea rax, [rcx + 0x10]
cmp rbx, 8
jb 0x1400c73dd
mov rax, qword [rax]
cmp rsi, 8
jb 0x1400c73e6
mov rdi, qword [rdi]
test r10, r10
je 0x1400c740a
sub rdi, rax
nop
movzx edx, word [rax + rdi]
cmp dx, word [rax]
ja 0x1400c740d
jb 0x1400c740d
cmp r10, 1
je 0x1400c740a
dec r10
add rax, 2
jmp 0x1400c73f0
mov r15, rcx
mov rbx, qword [rsp + 0x20]
mov rax, r12
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov qword [r12], r15
pop r15
pop r14
pop r12
ret
mov rax, qword [r14 + 8]
mov rax, qword [rax]
jmp 0x1400c736d
mov rcx, qword [rcx]
jmp 0x1400c7361
Function at 0x1400cb4e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
lea rbx, [rcx + 0x18]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
mov qword [rsp + 0x40], rbx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + rsi]
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
inc r10
cmp r10, 8
jb 0x1400cb526
mov r8, qword [rdi + 0x88]
and r8, r9
add r8, r8
mov r9, qword [rdi + 0x70]
mov rcx, qword [r9 + r8*8]
mov rdx, qword [rdi + 0x60]
cmp qword [r9 + r8*8], rdx
jne 0x1400cb5bc
mov rax, rdx
cmp rcx, rax
je 0x1400cb5c6
mov rax, qword [rsi]
cmp qword [rcx + 0x10], rax
jne 0x1400cb5cb
cmp rcx, rdx
jne 0x1400cb5d0
mov r9, rbp
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14009c464
nop
test rbx, rbx
je 0x1400cb5a2
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov al, byte [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rax, qword [r9 + r8*8 + 8]
mov rax, qword [rax]
jmp 0x1400cb567
mov rcx, rdx
jmp 0x1400cb575
mov rcx, qword [rcx]
jmp 0x1400cb55e
test rbx, rbx
je 0x1400cb5e4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
xor al, al
jmp 0x1400cb5a6

Function at 0x1400cd29c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [r8]
mov r9, rcx
xor r8d, r8d
test rax, rax
jne 0x1400cd2c0
mov rax, qword [rcx + 8]
mov qword [rdx], rax
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
mov r11, qword [rax + 0x40]
movabs rcx, 0xcbf29ce484222325
mov qword [rsp + 0x18], r11
movzx eax, byte [rsp + r8 + 0x18]
movabs r10, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r10
cmp r8, 8
jb 0x1400cd2d3
mov r10, qword [r9 + 0x30]
mov rbx, qword [r9 + 0x18]
and r10, rcx
mov r8, qword [r9 + 8]
add r10, r10
mov rax, qword [rbx + r10*8]
cmp qword [rbx + r10*8], r8
je 0x1400cd327
mov rcx, qword [rbx + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400cd32c
cmp qword [rax + 0x10], r11
je 0x1400cd2b3
mov rax, qword [rax]
jmp 0x1400cd309
mov rcx, r8
jmp 0x1400cd317
mov qword [rdx], r8
jmp 0x1400cd2b6
Function at 0x1400d3a30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
cmp qword [rdx + 0x18], 8
mov r14, r8
mov r15, qword [rdx + 0x10]
mov r11, rdx
mov r9, rdx
jb 0x1400d3a58
mov r9, qword [rdx]
lea r8, [r15 + r15]
xor edx, edx
movabs rax, 0xcbf29ce484222325
test r8, r8
je 0x1400d3a94
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r8
jb 0x1400d3a80
mov rdx, qword [0x1404e3448]
and rax, qword [0x1404e3460]
mov r8, qword [0x1404e3438]
add rax, rax
mov qword [rsp + 0x10], rbp
mov r9, qword [rdx + rax*8]
lea r10, [rdx + rax*8]
mov rcx, r9
cmp r9, r8
je 0x1400d3b64
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1400d3b3b
cmp qword [r11 + 0x18], 8
lea rdx, [rcx + 0x10]
mov rax, r11
jb 0x1400d3ae2
mov rax, qword [r11]
mov rbp, qword [rdx + 0x18]
mov rbx, qword [rdx + 0x10]
cmp rbp, 8
jb 0x1400d3af3
mov rdx, qword [rdx]
cmp rbx, r15
jne 0x1400d3b8a
test rbx, rbx
jne 0x1400d3b6c
lea rax, [rcx + 0x10]
cmp rbp, 8
jb 0x1400d3b0e
mov rax, qword [rax]
cmp qword [r11 + 0x18], 8
jb 0x1400d3b18
mov r11, qword [r11]
test r15, r15
je 0x1400d3b3f
sub r11, rax
movzx edx, word [rax + r11]
cmp dx, word [rax]
jb 0x1400d3b92
ja 0x1400d3b92
cmp r15, 1
je 0x1400d3b3f
dec r15
add rax, 2
jmp 0x1400d3b20
xor al, al
jmp 0x1400d3b4c
cmp rcx, r8
je 0x1400d3b3b
mov eax, dword [rcx + 0x30]
mov dword [r14], eax
mov al, 1
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
mov rax, r8
jmp 0x1400d3acc
sub rdx, rax
nop
movzx edi, word [rax + rdx]
cmp di, word [rax]
jb 0x1400d3b8a
ja 0x1400d3b8a
cmp rbx, 1
je 0x1400d3b01
dec rbx
add rax, 2
jmp 0x1400d3b70
mov rcx, qword [rcx]
jmp 0x1400d3abc
mov rcx, r8
jmp 0x1400d3b3f
Function at 0x1400d4ac0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
cmp qword [rdx + 0x18], 8
mov r14, r8
mov r15, qword [rdx + 0x10]
mov r11, rdx
mov r9, rdx
jb 0x1400d4ae8
mov r9, qword [rdx]
lea r8, [r15 + r15]
xor edx, edx
movabs rax, 0xcbf29ce484222325
test r8, r8
je 0x1400d4b24
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r8
jb 0x1400d4b10
mov rdx, qword [0x1404e3488]
and rax, qword [0x1404e34a0]
mov r8, qword [0x1404e3478]
add rax, rax
mov qword [rsp + 0x10], rbp
mov r9, qword [rdx + rax*8]
lea r10, [rdx + rax*8]
mov rcx, r9
cmp r9, r8
je 0x1400d4bf4
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1400d4bcb
cmp qword [r11 + 0x18], 8
lea rdx, [rcx + 0x10]
mov rax, r11
jb 0x1400d4b72
mov rax, qword [r11]
mov rbp, qword [rdx + 0x18]
mov rbx, qword [rdx + 0x10]
cmp rbp, 8
jb 0x1400d4b83
mov rdx, qword [rdx]
cmp rbx, r15
jne 0x1400d4c1a
test rbx, rbx
jne 0x1400d4bfc
lea rax, [rcx + 0x10]
cmp rbp, 8
jb 0x1400d4b9e
mov rax, qword [rax]
cmp qword [r11 + 0x18], 8
jb 0x1400d4ba8
mov r11, qword [r11]
test r15, r15
je 0x1400d4bcf
sub r11, rax
movzx edx, word [rax + r11]
cmp dx, word [rax]
jb 0x1400d4c22
ja 0x1400d4c22
cmp r15, 1
je 0x1400d4bcf
dec r15
add rax, 2
jmp 0x1400d4bb0
xor al, al
jmp 0x1400d4bdc
cmp rcx, r8
je 0x1400d4bcb
mov eax, dword [rcx + 0x30]
mov dword [r14], eax
mov al, 1
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
pop r15
ret
mov rax, r8
jmp 0x1400d4b5c
sub rdx, rax
nop
movzx edi, word [rax + rdx]
cmp di, word [rax]
jb 0x1400d4c1a
ja 0x1400d4c1a
cmp rbx, 1
je 0x1400d4b91
dec rbx
add rax, 2
jmp 0x1400d4c00
mov rcx, qword [rcx]
jmp 0x1400d4b4c
mov rcx, r8
jmp 0x1400d4bcf
Function at 0x1400d6ae4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea rbp, [rcx + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + rdi]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x1400d6b26
mov rdx, qword [r14 + 0x88]
and rdx, rcx
add rdx, rdx
mov r8, qword [r14 + 0x70]
mov rbx, qword [r8 + rdx*8]
mov rcx, qword [r14 + 0x60]
cmp qword [r8 + rdx*8], rcx
jne 0x1400d6c04
mov rax, rcx
cmp rbx, rax
je 0x1400d6c11
mov rax, qword [rdi]
cmp qword [rbx + 0x10], rax
jne 0x1400d6c4b
cmp rbx, rcx
je 0x1400d6c53
mov rdi, qword [rbx + 0x28]
cmp qword [r14 + 0x40], 0
jne 0x1400d6c6a
mov rax, qword [r14 + 0x98]
cmp rdi, rax
je 0x1400d6bac
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x1400d6c19
mov rax, qword [r14 + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1400d6bc6
lock inc dword [rdx + 8]
mov rdx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test rbp, rbp
je 0x1400d6be5
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rax, qword [r8 + rdx*8 + 8]
mov rax, qword [rax]
jmp 0x1400d6b6a
mov rbx, rcx
jmp 0x1400d6b80
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x1400d6bac
mov rbx, qword [rbx]
jmp 0x1400d6b5d
mov rax, qword [r14 + 0x48]
lock inc qword [rax + 0x48]
and qword [rsi], 0
and qword [rsi + 8], 0
jmp 0x1400d6bd1
lea rcx, [rdi + 0x18]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x1400d6b98
Function at 0x1400d6d00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea rbp, [rcx + 0x18]
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + rdi]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400d6d42
mov rdx, qword [r14 + 0x88]
and rdx, rcx
add rdx, rdx
mov r8, qword [r14 + 0x70]
mov rbx, qword [r8 + rdx*8]
mov rcx, qword [r14 + 0x60]
cmp qword [r8 + rdx*8], rcx
jne 0x1400d6e22
mov rax, rcx
cmp rbx, rax
je 0x1400d6e92
mov eax, dword [rdi]
cmp dword [rbx + 0x10], eax
jne 0x1400d6e2f
cmp rbx, rcx
je 0x1400d6e37
mov rdi, qword [rbx + 0x28]
cmp qword [r14 + 0x40], 0
jne 0x1400d6e7d
mov rax, qword [r14 + 0x98]
cmp rdi, rax
je 0x1400d6dca
mov rcx, qword [rdi]
cmp rax, rcx
jne 0x1400d6e4b
mov rax, qword [r14 + 0x48]
lock inc qword [rax + 0x40]
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x1400d6de4
lock inc dword [rdx + 8]
mov rdx, qword [rbx + 0x20]
mov rax, qword [rbx + 0x18]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
test rbp, rbp
je 0x1400d6e03
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
mov rax, qword [r8 + rdx*8 + 8]
mov rax, qword [rax]
jmp 0x1400d6d86
mov rbx, qword [rbx]
jmp 0x1400d6d79
mov rax, qword [r14 + 0x48]
lock inc qword [rax + 0x48]
and qword [rsi], 0
and qword [rsi + 8], 0
jmp 0x1400d6def
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
jmp 0x1400d6dca
lea rcx, [rdi + 0x14]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemTimeAsFileTime]
nop dword [rax + rax]
jmp 0x1400d6db2
mov rbx, rcx
jmp 0x1400d6d9a

Function at 0x1400d7090
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
mov r11, r8
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [r8 + 1]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
mov r10, qword [r10 + 8]
and r8, r9
shl r8, 4
mov r9, qword [rcx + r8]
add r8, rcx
mov rax, r9
cmp r9, r10
je 0x1400d711c
mov rcx, qword [r8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400d7121
mov ecx, dword [r11]
cmp dword [rax + 0x10], ecx
jne 0x1400d7117
mov qword [rdx], rax
mov rax, rdx
ret
mov rax, qword [rax]
jmp 0x1400d70f6
mov rcx, r10
jmp 0x1400d7102
mov qword [rdx], r10
jmp 0x1400d7112