joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400be490
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400be4bf
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400be506
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400be4e3
and r8, qword [0x140566290]
mov r15, qword [0x140566278]
mov r11, qword [0x140566268]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400be52e
mov rcx, r11
jmp 0x1400be536
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400be5fc
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400be550
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400be560
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400be5a0
mov rbp, rsi
test rsi, rsi
je 0x1400be5a8
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400be5a0
sub rbx, r9
cmp cx, di
ja 0x1400be5a0
cmp rbp, 1
je 0x1400be5a8
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400be583
mov rax, qword [rax]
jmp 0x1400be523
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400be5b5
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400be5bf
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400be5fc
test r10, r10
je 0x1400be5ff
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400be5fc
sub rdx, rcx
cmp r8w, r9w
ja 0x1400be5fc
cmp r10, 1
je 0x1400be5ff
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400be5de
mov rax, r11
cmp rax, r11
jne 0x1400be608
xor al, al
jmp 0x1400be611
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400bebf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rbx, rcx
mov r9, rdx
jb 0x1400bec22
mov r9, qword [rdx]
xor r13d, r13d
lea r8, [r10 + r10]
lea rcx, [r8 + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r11, r9
cmova r8, r13
test r8, r8
je 0x1400bec69
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rdi
cmp rcx, r8
jne 0x1400bec46
mov r14, qword [rbx + 0x30]
mov r15, qword [rbx + 0x18]
and r14, rax
mov r11, qword [rbx + 8]
add r14, r14
mov rax, qword [r15 + r14*8]
cmp qword [r15 + r14*8], r11
jne 0x1400bec8a
mov rcx, r11
jmp 0x1400bec92
mov rcx, qword [r15 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400bed59
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400becac
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400becbc
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, r10
jne 0x1400becfd
mov rsi, rdi
test rdi, rdi
je 0x1400bed05
movzx ecx, word [r9]
movzx ebx, word [r8]
cmp cx, bx
jb 0x1400becfd
sub r9, r8
cmp cx, bx
ja 0x1400becfd
cmp rsi, 1
je 0x1400bed05
add r8, 2
dec rsi
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jae 0x1400bece0
mov rax, qword [rax]
jmp 0x1400bec7f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400bed12
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400bed1c
mov rdx, qword [rdx]
cmp r10, rdi
jne 0x1400bed59
test r10, r10
je 0x1400bed5c
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400bed59
sub rdx, rcx
cmp r8w, r9w
ja 0x1400bed59
cmp r10, 1
je 0x1400bed5c
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400bed3b
mov rax, r11
cmp rax, r11
jne 0x1400bed65
xor al, al
jmp 0x1400bed6e
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400c263c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400c266b
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400c26b2
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400c268f
and r8, qword [0x140549900]
mov r15, qword [0x1405498e8]
mov r11, qword [0x1405498d8]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400c26da
mov rcx, r11
jmp 0x1400c26e2
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400c27a8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400c26fc
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400c270c
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400c274c
mov rbp, rsi
test rsi, rsi
je 0x1400c2754
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400c274c
sub rbx, r9
cmp cx, di
ja 0x1400c274c
cmp rbp, 1
je 0x1400c2754
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400c272f
mov rax, qword [rax]
jmp 0x1400c26cf
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400c2761
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400c276b
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400c27a8
test r10, r10
je 0x1400c27ab
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400c27a8
sub rdx, rcx
cmp r8w, r9w
ja 0x1400c27a8
cmp r10, 1
je 0x1400c27ab
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400c278a
mov rax, r11
cmp rax, r11
jne 0x1400c27b4
xor al, al
jmp 0x1400c27bd
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400cd4a4
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rbp - 0x50], rcx
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
jne 0x1400cd4f2
lea rdx, [0x1403c55d2]
call fcn.140072838
jmp 0x1400cd60d
or dword [rbp - 0x50], 0xffffffff
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0x40000001
mov edx, eax
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
nop dword [rax + rax]
test eax, eax
je 0x1400cd674
mov edx, dword [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140083118
nop
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rbp - 0x40]
mov r9, rbx
mov r8d, 0x40000001
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
nop dword [rax + rax]
test eax, eax
je 0x1400cd62f
mov esi, dword [rbp - 0x50]
movdqa xmm0, xmmword [0x140420320]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x28]
cmp rsi, 0xf
ja 0x1400cd596
mov qword [rbp - 0x18], rsi
mov r8d, esi
mov rdx, rbx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov byte [rbp + rsi - 0x28], 0
jmp 0x1400cd5a1
mov r9, rbx
mov rdx, rsi
call fcn.140072704
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x140420320]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x28]
call fcn.14007269c
nop
test rbx, rbx
je 0x1400cd60d
mov rdx, qword [rbp - 0x30]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400cd605
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cd605
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
nop dword [rax + rax]
int3
mov rcx, rbx
call fcn.140356b5c
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rbp + 0x18]
lea rax, str.ConvertByteArrayToBase64String_failed_conversion
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x134
call fcn.1400545b8
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14004f7b4
mov r9d, eax
mov rcx, qword [rbp + 0x18]
lea rax, str.ConvertByteArrayToBase64String_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x12d
call fcn.1400545b8
int3
Function at 0x1400d5978
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x80
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x1405662cc], eax
jg 0x1400d59e0
lea rcx, [rdi + 0x110]
mov rdx, rbx
call fcn.1400d7278
mov r9d, 2
mov r8, rbx
lea rdx, [0x1405662a8]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400d5a2c
lea rcx, [0x1405662cc]
call fcn.14035c740
cmp dword [0x1405662cc], 0xffffffff
jne 0x1400d59af
lea rdx, str.EventType
lea rcx, [0x1405662a8]
call fcn.140072838
lea rcx, [0x140398210]
call fcn.140356b3c
nop
lea rcx, [0x1405662cc]
call fcn.14035c6d8
jmp 0x1400d59af
Function at 0x1400e137c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x1400e13af
mov r9, qword [rsi]
xor r11d, r11d
lea rcx, [r9 + r10]
cmp r9, rcx
movabs rax, 0xcbf29ce484222325
mov rdx, r9
cmova r10, r11
test r10, r10
je 0x1400e13f1
movzx ecx, byte [rdx]
movabs r11, 0x100000001b3
xor rax, rcx
inc rdx
mov rcx, rdx
sub rcx, r9
imul rax, r11
cmp rcx, r10
jne 0x1400e13cf
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400e1429
cmp qword [rcx + rdx*8], rdi
jne 0x1400e141e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400e1422
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400e1436
cmp qword [rcx + rdx*8], rdi
jne 0x1400e1436
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14007269c
mov rcx, rsi
call fcn.14007269c
mov edx, 0x58
mov rcx, rdi
call fcn.140356b5c
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x140196a34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [rcx]
cmp rcx, qword [rdx]
je 0x140196c58
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [str.p76_]
mov rcx, qword [rsi]
mov ebx, eax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x58]
call qword [str.p76_]
cmp ebx, eax
je 0x140196a89
xor al, al
jmp 0x140196c5d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
call qword [str.p76_]
xor r14d, r14d
test eax, eax
je 0x140196c04
sub eax, 1
je 0x140196bd5
sub eax, 1
je 0x140196b3c
sub eax, 1
je 0x140196b2c
cmp eax, 1
jne 0x140196c58
mov rdx, qword [rdi]
mov rbp, qword [rsi]
mov rbx, qword [rdx + 8]
mov rdi, qword [rbp + 8]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rdx + 0x10]
sub rcx, rdi
sub rax, rbx
xor rcx, rax
test rcx, 0xfffffffffffffff8
jne 0x140196bcd
mov rsi, qword [rdx + 0x10]
mov rbp, qword [rbp + 0x10]
jmp 0x140196b1a
cmp rdi, rbp
je 0x140196b1f
mov rdx, rdi
mov rcx, rbx
call fcn.140196a34
test al, al
je 0x140196bcd
add rbx, 8
add rdi, 8
cmp rbx, rsi
jne 0x140196afa
mov eax, 1
mov r14b, al
jmp 0x140196bcd
mov rdx, qword [rsi]
mov rcx, qword [rdi]
call fcn.140199b7c
jmp 0x140196c5d
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rax, qword [rax + 0xb0]
call qword [str.p76_]
mov rcx, qword [rdi]
mov rbx, rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0xb0]
call qword [str.p76_]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140196b72
mov rcx, qword [rbx]
cmp qword [rax + 0x18], 8
mov r8, rax
jb 0x140196b7f
mov r8, qword [rax]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [rbx + 0x10]
jne 0x140196bcd
mov eax, 1
test rdx, rdx
je 0x140196c5d
movzx r9d, word [r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x140196bcd
sub r8, rcx
cmp r9w, r10w
ja 0x140196bcd
cmp rdx, rax
je 0x140196c5d
add rcx, 2
sub rdx, rax
movzx r9d, word [rcx + r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x140196bac
mov al, r14b
jmp 0x140196c5d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [str.p76_]
mov rcx, qword [rsi]
mov bl, al
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x88]
call qword [str.p76_]
cmp bl, al
sete al
jmp 0x140196c5d
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x70]
call qword [str.p76_]
mov rcx, qword [rsi]
mov rbx, rax
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x70]
call qword [str.p76_]
mov ecx, dword [rbx + 8]
cmp ecx, dword [rax + 8]
jne 0x140196bcd
test ecx, ecx
je 0x140196c49
cmp ecx, 1
je 0x140196c49
movsd xmm0, qword [rbx]
ucomisd xmm0, qword [rax]
jp 0x140196bcd
jne 0x140196bcd
jmp 0x140196b1f
mov rax, qword [rax]
cmp qword [rbx], rax
sete r14b
jmp 0x140196bcd
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1401a7b04
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r10, qword [r8 + 0x10]
mov rbx, rcx
mov r9, r8
jb 0x1401a7b36
mov r9, qword [r8]
xor r13d, r13d
lea rdx, [r10 + r10]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r11, r9
cmova rdx, r13
test rdx, rdx
je 0x1401a7b7d
movzx ecx, byte [r11]
movabs rsi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rsi
cmp rcx, rdx
jne 0x1401a7b5a
mov r14, qword [rbx + 0x30]
mov r12, qword [rbx + 0x18]
and r14, rax
mov r11, qword [rbx + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], r11
jne 0x1401a7b9e
mov rcx, r11
jmp 0x1401a7ba6
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1401a7c73
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1401a7bc0
mov rdx, qword [r8]
mov r15, qword [rcx + 0x18]
mov r9, rcx
cmp r15, 8
jb 0x1401a7bd0
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1401a7c0f
mov rbp, rsi
test rsi, rsi
je 0x1401a7c17
movzx ecx, word [r9]
movzx ebx, word [rdx]
cmp cx, bx
jb 0x1401a7c0f
sub r9, rdx
cmp cx, bx
ja 0x1401a7c0f
cmp rbp, 1
je 0x1401a7c17
add rdx, 2
dec rbp
movzx ecx, word [rdx + r9]
movzx ebx, word [rdx]
cmp cx, bx
jae 0x1401a7bf3
mov rax, qword [rax]
jmp 0x1401a7b93
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x1401a7c24
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x1401a7c2e
mov r8, qword [r8]
cmp r10, rsi
jne 0x1401a7c6b
test r10, r10
je 0x1401a7c6e
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x1401a7c6b
sub r8, rcx
cmp dx, r9w
ja 0x1401a7c6b
cmp r10, 1
je 0x1401a7c6e
add rcx, 2
dec r10
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x1401a7c4d
mov rax, r11
mov qword [rdi], rax
jmp 0x1401a7c76
mov qword [rdi], r11
mov rbx, qword [rsp + 0x28]
mov rax, rdi
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1401a7c9c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r10, rdx
mov r14, rcx
mov r15, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401a7cd3
mov r8, qword [rdx]
movabs rax, 0xcbf29ce484222325
mov r9, r8
lea rdx, [r15 + r15]
lea rcx, [rdx + r8]
xor esi, esi
cmp r8, rcx
cmova rdx, rsi
test rdx, rdx
je 0x1401a7d19
movzx ecx, byte [r9]
xor rax, rcx
movabs r11, 0x100000001b3
imul rax, r11
inc r9
mov rcx, r9
sub rcx, r8
cmp rcx, rdx
jne 0x1401a7cf6
mov rbp, qword [r14 + 0x30]
and rbp, rax
add rbp, rbp
mov r12, qword [r14 + 0x18]
mov rbx, qword [r12 + rbp*8]
mov rdx, qword [r14 + 8]
cmp qword [r12 + rbp*8], rdx
jne 0x1401a7d3a
mov rax, rdx
jmp 0x1401a7d42
mov rax, qword [r12 + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401a7e3b
lea rcx, [rbx + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x1401a7d5c
mov rax, qword [r10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401a7d69
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
cmp r8, r15
jne 0x1401a7daa
test r8, r8
je 0x1401a7daf
movzx ecx, word [r9]
movzx r11d, word [rax]
cmp cx, r11w
jb 0x1401a7daa
sub r9, rax
cmp cx, r11w
ja 0x1401a7daa
cmp r8, 1
je 0x1401a7daf
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx r11d, word [rax]
cmp cx, r11w
jae 0x1401a7d8c
mov rbx, qword [rbx]
jmp 0x1401a7d2f
mov rcx, rbx
mov rdi, rbx
cmp qword [r12 + rbp*8], rdx
jne 0x1401a7dc0
mov rax, rdx
jmp 0x1401a7dc8
mov rax, qword [r12 + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401a7e34
lea rax, [rbx + 0x10]
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x1401a7dde
mov r8, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x1401a7deb
mov r11, qword [r10]
cmp r15, qword [rax + 0x10]
jne 0x1401a7e34
mov rsi, r15
test r15, r15
je 0x1401a7eac
movzx eax, word [r11]
movzx r9d, word [r8]
cmp ax, r9w
jb 0x1401a7e34
sub r11, r8
cmp ax, r9w
ja 0x1401a7e34
cmp rsi, 1
je 0x1401a7eac
dec rsi
add r8, 2
movzx eax, word [r8 + r11]
movzx r9d, word [r8]
cmp ax, r9w
jae 0x1401a7e0e
xor esi, esi
cmp rcx, rbx
jne 0x1401a7e41
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
mov rbp, rsi
cmp rdi, rbx
je 0x1401a7e57
inc rbp
mov rax, qword [rax]
cmp rax, rbx
jne 0x1401a7e4c
mov rsi, qword [rdx]
cmp rdi, rsi
jne 0x1401a7ec7
cmp rbx, rdx
jne 0x1401a7ec7
mov qword [rdx], rdx
mov rax, qword [r14 + 8]
mov qword [rax + 8], rax
and qword [r14 + 0x10], 0
cmp rsi, qword [r14 + 8]
je 0x1401a7e9c
mov rbx, qword [rsi]
lea rcx, [rsi + 0x10]
call fcn.1401a8b18
mov edx, WSAStartup
mov rcx, rsi
call fcn.140356b5c
mov rsi, rbx
cmp rbx, qword [r14 + 8]
jne 0x1401a7e7a
mov edx, 8
mov rcx, r14
call fcn.14005e790
nop
jmp 0x1401a7ecc
mov rbx, qword [rbx]
jmp 0x1401a7db5
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.1401a8224
cmp rdi, rbx
jne 0x1401a7eb4
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401a80f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [r8 + 0x10]
mov r10, rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
movabs rax, 0xcbf29ce484222325
mov rbx, rdx
mov r11d, 8
movzx r9d, byte [rcx]
movabs rdx, 0x100000001b3
xor rax, r9
inc rcx
imul rax, rdx
sub r11, 1
jne 0x1401a811a
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1401a8170
cmp qword [rcx + rdx*8], r8
jne 0x1401a8165
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1401a8169
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401a817d
cmp qword [rcx + rdx*8], r8
jne 0x1401a817d
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
lea rdx, [rsp + 0x30]
call fcn.140077470
mov rcx, qword [rax]
mov rax, rbx
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1401a8224
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov rdx, qword [r9 + 0x10]
jb 0x1401a8251
mov r10, qword [r9]
add rdx, rdx
xor ebx, ebx
movabs rax, 0xcbf29ce484222325
mov r11, r10
lea rcx, [rdx + r10]
cmp r10, rcx
cmova rdx, rbx
test rdx, rdx
je 0x1401a8296
movzx ecx, byte [r11]
movabs rbx, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r10
imul rax, rbx
cmp rcx, rdx
jne 0x1401a8273
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1401a82ce
cmp qword [rcx + rdx*8], rdi
jne 0x1401a82c3
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1401a82c7
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401a82db
cmp qword [rcx + rdx*8], rdi
jne 0x1401a82db
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1401a8b18
mov edx, WSAStartup
mov rcx, rdi
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret