joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035150
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r14, rcx
xor ebx, ebx
mov ecx, dword [0x1401d5478]
cmp byte [0x1401d547c], bl
je 0x140035184
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14003518a
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035251
mov ecx, dword [0x1401d5468]
cmp byte [0x1401d546c], bl
je 0x1400351a9
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x1400351af
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400351be
mov ebx, 1
jmp 0x140035251
lea rax, [0x1401d5478]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ebx
mov esi, 1
mov ecx, dword [0x1401d5478]
mov edx, esi
cmp byte [0x1401d547c], bl
je 0x1400351eb
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x1400351f1
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400351fa
lea ecx, [rax + 7]
int 0x29
lock xadd dword [rsp + 0x30], esi
mov rdx, qword [r14]
mov rcx, qword [rdx]
add rcx, 8
mov rdx, qword [rdx + 8]
call fcn.14002f2b0
mov sil, al
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14003524e
or eax, 0xffffffff
lock xadd dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x28]
xor edx, edx
cmp byte [rcx + 4], bl
mov ecx, dword [rcx]
je 0x14003523d
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x140035243
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x140035216
lea ecx, [rax + 7]
int 0x29
jmp 0x140035216
mov bl, sil
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop r14
ret
Function at 0x140038e00
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor r14d, r14d
mov dword [rax + 0x18], r14d
lea r8, [rax + 0x18]
lea rdx, [0x1401dc3a0]
lea ecx, [r14 + 3]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov esi, eax
test eax, eax
jne 0x140038e46
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x140038efc
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140038f0a
mov r8, rsi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x20], rdi
mov r9d, esi
xor r8d, r8d
lea rdx, [0x1401dc3a0]
lea ecx, [r8 + 3]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
mov rcx, rdi
test eax, eax
jne 0x140038e94
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x140038ef5
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x78], r14d
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x140135248]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x140038ec8
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x140038ef2
cmp dword [rsp + 0x78], 0x34
jne 0x140038ebf
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + 0xa]
mov dword [rbx], eax
movzx eax, word [rcx + 8]
mov dword [rbx + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rbx + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rbx + 0xc], eax
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, rbx
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400ecb00
nop
jmp 0x140038f14
nop
nop
nop
nop

Function at 0x140039c44
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x140039c92
mov edx, 0x323658
jmp 0x140039cc2
cmp dword [rsp + 0x24], 6
jae 0x140039cb6
mov rax, qword [0x1401d3d78]
lea rcx, [0x1401d3d78]
mov edx, 0x323659
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
cmp dword [rsp + 0x30], 2
je 0x140039cda
mov edx, 0x32365a
mov rax, qword [0x1401d3d78]
lea rcx, [0x1401d3d78]
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
mov eax, dword [rsp + 0x24]
movzx ecx, word [rsp + 0x134]
movzx edx, word [rsp + 0x138]
mov dword [rbx], eax
mov eax, dword [rsp + 0x28]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 8], eax
mov eax, pe_nt_image_headers64
test ax, dx
mov dword [rbx + 0xc], ecx
mov cl, byte [rsp + 0x13a]
mov rax, rbx
mov byte [rbx + 0x10], cl
setne cl
shr dx, 8
and dl, 1
mov byte [rbx + 0x11], cl
mov byte [rbx + 0x12], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140118d00
add rsp, 0x150
pop rbx
ret
Function at 0x14003a79c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov rdi, rcx
cmp byte [0x1401d54fc], bl
mov ecx, dword [0x1401d54f8]
je 0x14003a7c1
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14003a7c7
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003a825
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x14003a825
mov rdx, qword [rax]
mov r8, qword [rax + 0x18]
mov rax, rbx
test rdx, rdx
je 0x14003a7ef
mov rdx, qword [rdx]
test rdx, rdx
je 0x14003a7ef
mov rax, qword [rdx]
lea rdx, [rcx - 1]
add rdx, r8
test rax, rax
je 0x14003a80e
mov rax, qword [rax]
test rax, rax
je 0x14003a80e
mov rax, qword [rax]
test rax, rax
je 0x14003a80e
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x10]
mov rax, qword [rbx + 8]
dec rcx
and rcx, rdx
mov rcx, qword [rax + rcx*8]
movups xmm0, xmmword [rcx]
jmp 0x14003a836
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rax, rdi
movdqu xmmword [rdi], xmm0
add rsp, 0x30
pop rdi
ret

Function at 0x14003a848
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ecx, dword [0x1401d54f8]
xor edi, edi
cmp byte [0x1401d54fc], dil
je 0x14003a870
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x14003a876
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x14003a914
mov rax, qword [rax + 0x50]
cmp rax, 8
jb 0x14003a8ba
mov rcx, qword [rbx + 0x38]
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x14003a8b4
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a8fe
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x48], rdi
lea rcx, [rbx + 0x28]
mov esi, 7
mov qword [rbx + 0x50], rsi
mov word [rbx + 0x38], di
call fcn.140019440
mov rcx, rbx
call fcn.14002aa9c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [0x1401d54f8]
xor edx, edx
cmp byte [0x1401d54fc], dil
je 0x14003a905
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
jmp 0x14003a90b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x14003a914
mov rcx, rsi
int 0x29
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14003bbb0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
xor r10d, r10d
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov r11d, r10d
test rcx, rcx
je 0x14003bd58
test r8, r8
je 0x14003bd58
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x14003bd58
test edx, edx
je 0x14003bd3c
mov ecx, r10d
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rdi]
dec ebx
mov byte [rsp + rcx + 0x18], al
inc rdi
inc rcx
inc r11d
cmp rcx, 3
jne 0x14003bc8b
cmp r9d, 4
jb 0x14003bc93
movzx edx, byte [rsp + 0x1a]
mov r11d, r10d
movzx eax, byte [rsp + 0x18]
movzx ecx, byte [rsp + 0x19]
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov cl, byte [rsp + 0x19]
mov byte [r8 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
shl cl, 2
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov rcx, r10
mov byte [r8 + 2], al
mov al, byte [r13 + rdx*2]
mov byte [r8 + 3], al
add r8, 4
add r9d, 0xfffffffc
test ebx, ebx
jne 0x14003bc03
test r11d, r11d
jle 0x14003bd3a
cmp r9d, 4
jb 0x14003bd37
movzx edi, byte [rsp + 0x19]
cmp r11d, 1
movzx ebx, byte [rsp + 0x1a]
mov dl, 0x3d
movzx eax, byte [rsp + 0x18]
cmovle edi, r10d
cmp r11d, 2
movzx ecx, dil
cmovle ebx, r10d
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov byte [r8 + 1], al
cmp r11d, 1
jle 0x14003bd11
mov al, dil
movzx ecx, bl
shl al, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
jmp 0x14003bd13
mov al, dl
mov byte [r8 + 2], al
cmp r11d, 2
jle 0x14003bd28
movzx eax, bl
and eax, 0x3f
mov dl, byte [r13 + rax*2]
mov byte [r8 + 3], dl
mov r11d, r10d
add r8, 4
add r9d, 0xfffffffc
test r11d, r11d
jne 0x14003bd47
cmp r9d, 1
jb 0x14003bd47
mov byte [r8], r10b
jmp 0x14003bd4d
mov r10d, 0x800700ea
sub r8d, esi
mov eax, r10d
mov dword [r14], r8d
jmp 0x14003bd5d
mov eax, 0x80070057
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r13
ret
Function at 0x14004a7e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r15, rdx
mov r14, qword [r8 + 0x10]
mov rdx, r8
mov rdi, r8
mov rbp, rcx
jb 0x14004a81e
mov rdx, qword [r8]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x14004a84c
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r8, rax
inc rcx
imul r8, r9
cmp rcx, r14
jb 0x14004a82f
mov rax, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and r12, r8
add r12, r12
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x14004a872
mov rax, rbp
jmp 0x14004a87a
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14004a8ef
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x14004a890
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r13, qword [rsi + 0x10]
jb 0x14004a8a1
mov rcx, qword [rsi]
cmp r13, r14
jne 0x14004a8b2
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a8bc
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x14004a867
cmp qword [rsi + 0x18], 0x10
jb 0x14004a8c6
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
jb 0x14004a8d0
mov rdi, qword [rdi]
cmp r14, r13
jne 0x14004a8e7
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a8ea
mov rbx, rbp
mov qword [r15], rbx
jmp 0x14004a8f2
mov qword [r15], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14004ada4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r15, rdx
mov rsi, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14004ade0
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x14004ae0f
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x14004adf1
mov r14, qword [rsi + 0x30]
and r14, rdx
add r14, r14
mov rax, qword [rsi + 0x18]
lea rcx, [rsi + 8]
mov qword [rsp + 0x90], rcx
mov rdi, qword [rcx]
cmp rdi, qword [rax + r14*8]
je 0x14004aea3
mov rdi, qword [rax + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r14*8]
je 0x14004aea3
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14004ae56
mov rdx, qword [rdx]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14004ae65
mov rcx, qword [r12]
cmp r13, rax
mov rax, qword [rsi + 0x18]
jne 0x14004ae3a
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov rax, qword [rsi + 0x18]
jne 0x14004ae3a
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x90]
call fcn.14004b1f8
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14004afc8
mov qword [rsp + 0x90], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14004aee0
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [rsi + 8]
jne 0x14004aefd
mov qword [rdx + r14*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r14*8 + 8], rbx
jmp 0x14004af2c
cmp rax, rdi
jne 0x14004af08
mov qword [rdx + r14*8], rbx
jmp 0x14004af2c
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rbx
je 0x14004af2c
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14017f2b0]
test rax, rax
jns 0x14004af4d
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14004af5e
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14004afbd
cmp rdx, 0x200
jae 0x14004af76
shl rdx, 3
jmp 0x14004af88
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14004af88
add rdx, rdx
mov rcx, rsi
call fcn.1400186e0
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14004afbd
mov r14, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14004ada4
cmp rdi, r14
jne 0x14004af9d
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004b374
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x14004b396
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x14004b3c6
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x14004b3a8
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14004b3fe
cmp qword [rcx + rdx*8], r8
jne 0x14004b3f3
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x14004b3f7
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14004b40b
cmp qword [rcx + rdx*8], r8
jne 0x14004b40b
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.14004b1f8
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140052ee4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
mov rbp, qword [rdx + 0x10]
mov r15, rcx
mov r8, rdx
jb 0x140052f17
mov r8, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rbp, rbp
je 0x140052f46
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r9
cmp rcx, rbp
jb 0x140052f28
mov r12, qword [r15 + 0x30]
mov rax, qword [r15 + 0x18]
and r12, rdx
mov rsi, qword [r15 + 8]
add r12, r12
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rsi
jne 0x140052f67
mov rax, rsi
jmp 0x140052f6f
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140052fe3
cmp qword [rdi + 0x18], 0x10
lea r14, [rbx + 0x10]
mov rdx, rdi
jb 0x140052f85
mov rdx, qword [rdi]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
mov r13, qword [r14 + 0x10]
jb 0x140052f96
mov rcx, qword [r14]
cmp r13, rbp
jne 0x140052fa7
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140052fb0
mov rbx, qword [rbx]
mov rax, qword [r15 + 0x18]
jmp 0x140052f5c
cmp qword [r14 + 0x18], 0x10
jb 0x140052fba
mov r14, qword [r14]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x140052fc7
mov rcx, qword [rdi]
cmp rbp, r13
jne 0x140052fdb
mov r8, rbp
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140052fde
mov rbx, rsi
mov rax, rbx
jmp 0x140052fe9
mov rbx, rsi
mov rax, rsi
cmp rax, rsi
jne 0x140053062
mov rbx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.140053380
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140053037
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14004ada4
mov rbx, qword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x40]
lea rax, [rbx + 0x30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400620b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
movzx eax, word [rcx]
xor r9d, r9d
mov edx, 0x1505
test ax, ax
je 0x1400620d8
mov r8d, r9d
imul edx, edx, 0x21
inc r8
movzx eax, ax
xor edx, eax
movzx eax, word [rcx + r8*2]
test ax, ax
jne 0x1400620c3
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
add eax, 0x3039
inc ecx
shr eax, 0x10
and ecx, 0xffff0000
or eax, ecx
ret
Function at 0x14006e274
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r10, qword [r8 + 0x10]
mov rbx, rcx
mov r11, r8
jb 0x14006e2a4
mov r11, qword [r8]
lea rdx, [r10 + r10]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x14006e2d7
movzx eax, byte [rcx + r11]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x14006e2b9
mov r14, qword [rbx + 0x30]
mov r12, qword [rbx + 0x18]
and r14, r9
mov r11, qword [rbx + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], r11
jne 0x14006e2f8
mov rcx, r11
jmp 0x14006e300
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14006e3cd
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x14006e31a
mov rdx, qword [r8]
mov r15, qword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
cmp r15, 8
jb 0x14006e32b
mov rcx, qword [rcx]
cmp rsi, r10
jne 0x14006e369
mov rbp, rsi
test rsi, rsi
je 0x14006e371
movzx r9d, word [rcx]
movzx ebx, word [rdx]
cmp r9w, bx
jb 0x14006e369
sub rcx, rdx
cmp r9w, bx
ja 0x14006e369
cmp rbp, 1
je 0x14006e371
add rdx, 2
dec rbp
movzx r9d, word [rcx + rdx]
movzx ebx, word [rdx]
cmp r9w, bx
jae 0x14006e34c
mov rax, qword [rax]
jmp 0x14006e2ed
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x14006e37e
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x14006e388
mov r8, qword [r8]
cmp r10, rsi
jne 0x14006e3c5
test r10, r10
je 0x14006e3c8
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x14006e3c5
sub r8, rcx
cmp dx, r9w
ja 0x14006e3c5
cmp r10, 1
je 0x14006e3c8
add rcx, 2
dec r10
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x14006e3a7
mov rax, r11
mov qword [rdi], rax
jmp 0x14006e3d0
mov qword [rdi], r11
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x14006e3f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r10, rdx
mov rbp, rcx
mov r14, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x14006e42b
mov r9, qword [rdx]
movabs r8, 0xcbf29ce484222325
lea rdx, [r14 + r14]
xor esi, esi
mov ecx, esi
test rdx, rdx
je 0x14006e460
movzx eax, byte [rcx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rcx
cmp rcx, rdx
jb 0x14006e442
mov r15, qword [rbp + 0x30]
and r15, r8
add r15, r15
mov r13, qword [rbp + 0x18]
mov rbx, qword [r13 + r15*8]
mov rdx, qword [rbp + 8]
mov r12, rbx
cmp qword [r13 + r15*8], rdx
jne 0x14006e486
mov rax, rdx
jmp 0x14006e48e
mov rax, qword [r13 + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14006e57b
lea rax, [rbx + 0x10]
mov rcx, r10
cmp qword [r10 + 0x18], 8
jb 0x14006e4a8
mov rcx, qword [r10]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14006e4b6
mov rax, qword [rax]
cmp r8, r14
jne 0x14006e4f3
test r8, r8
je 0x14006e4fb
movzx r9d, word [rax]
movzx r11d, word [rcx]
cmp r9w, r11w
jb 0x14006e4f3
sub rax, rcx
cmp r9w, r11w
ja 0x14006e4f3
cmp r8, 1
je 0x14006e4fb
dec r8
add rcx, 2
movzx r9d, word [rax + rcx]
movzx r11d, word [rcx]
cmp r9w, r11w
jae 0x14006e4d5
mov rbx, qword [rbx]
jmp 0x14006e477
mov rdi, rbx
cmp qword [r13 + r15*8], rdx
jne 0x14006e50a
mov rax, rdx
jmp 0x14006e512
mov rax, qword [r13 + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14006e576
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14006e529
mov rax, qword [rax]
mov r9, r10
cmp qword [r10 + 0x18], 8
jb 0x14006e536
mov r9, qword [r10]
cmp r14, rcx
jne 0x14006e576
mov r11, r14
test r14, r14
je 0x14006e5b9
movzx ecx, word [r9]
movzx r8d, word [rax]
cmp cx, r8w
jb 0x14006e576
sub r9, rax
cmp cx, r8w
ja 0x14006e576
cmp r11, 1
je 0x14006e5b9
dec r11
add rax, 2
movzx ecx, word [r9 + rax]
movzx r8d, word [rax]
cmp cx, r8w
jae 0x14006e554
cmp r12, rbx
jne 0x14006e581
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
cmp rdi, rbx
je 0x14006e597
inc rsi
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x14006e589
cmp rdi, qword [rdx]
jne 0x14006e5d4
cmp rbx, rdx
jne 0x14006e5d4
lea rcx, [rbp + 8]
call fcn.14006e814
mov edx, 8
mov rcx, rbp
call fcn.1400186e0
jmp 0x14006e5d9
mov rbx, qword [rbx]
jmp 0x14006e4fe
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.14006e8c0
cmp rdi, rbx
jne 0x14006e5c1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006e8c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x14006e8e2
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x14006e911
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x14006e8f3
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14006e949
cmp qword [rcx + rdx*8], r8
jne 0x14006e93e
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14006e942
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14006e956
cmp qword [rcx + rdx*8], r8
jne 0x14006e956
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.14006e970
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret