joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071a74
Capabilities:
Check if file exists
Create process memory minidump

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov ebp, edx
mov r14, r8
mov dl, 1
mov rdi, rcx
call fcn.140071c94
mov ebx, eax
test eax, eax
jns 0x140071b13
cmp dword [0x140142444], 2
jb 0x140071abf
mov r8d, eax
lea rdx, str.Failed_to_acquire_debug_privilege:_0x_x
mov ecx, 2
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071af6
test byte [rcx + 0x1c], 0x10
je 0x140071af6
cmp byte [rcx + 0x19], 2
jb 0x140071af6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401056a8]
mov edx, 0x16
mov r9d, ebx
call fcn.140007608
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
mov dword [rdi + 0x30], 0xea60
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov r8d, ebp
xor edx, edx
mov ecx, 0x1fffff
mov qword [rdi + 0x80], rax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140071bbb
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
cmp dword [0x140142444], 2
jb 0x140071b78
mov r8d, ebx
lea rdx, str.Failed_to_open_target_process:_0x_x
lea ecx, [rsi + 2]
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071baf
test byte [rcx + 0x1c], 0x10
je 0x140071baf
cmp byte [rcx + 0x19], 2
jb 0x140071baf
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401056a8]
mov edx, 0x17
mov r9d, ebx
call fcn.140007608
xor edx, edx
call fcn.140071c94
jmp 0x140071af6
lea rax, [0x140070790]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov r9d, 0x51b25
lea rax, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rax
mov edx, ebp
and qword [rsp + 0x28], 0
mov rcx, rsi
and qword [rsp + 0x20], 0
call qword [sym.imp.api_ms_win_core_debug_minidump_l1_1_0.dll_MiniDumpWriteDump]
test eax, eax
jne 0x140071c58
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
cmp dword [0x140142444], 2
mov ebx, eax
jb 0x140071c1f
mov r8d, eax
lea rdx, str.Failed_to_capture_dump:_0x_x
mov ecx, 2
call fcn.14003929c
mov rcx, qword [section..data]
lea rax, section..data
cmp rcx, rax
je 0x140071c5a
test byte [rcx + 0x1c], 0x10
je 0x140071c5a
cmp byte [rcx + 0x19], 2
jb 0x140071c5a
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401056a8]
mov edx, 0x18
mov r9d, ebx
call fcn.140007608
jmp 0x140071c5a
xor ebx, ebx
xor edx, edx
call fcn.140071c94
mov rcx, rsi
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x140071af6
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.14002953c
int3
Function at 0x140092210
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rsi, qword [rsp + 0x2a0]
mov rcx, rdx
mov r12, r9
mov rdi, r8
mov r14, rdx
call fcn.14003bb18
xor ebx, ebx
test al, al
jne 0x1400923f1
mov rcx, r12
call fcn.14003bb18
test al, al
jne 0x1400923f1
cmp qword [r14 + 0x18], 8
jb 0x140092273
mov rcx, qword [r14]
jmp 0x140092276
mov rcx, r14
lea rdx, str.SYSTEM
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete r15b
cmp qword [rdi + 0x18], 8
jb 0x140092295
mov rcx, qword [rdi]
jmp 0x140092298
mov rcx, rdi
lea rdx, str.queue
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete bpl
cmp qword [rdi + 0x18], 8
jb 0x1400922b5
mov rdi, qword [rdi]
lea rdx, str.archive
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
sete al
test bpl, bpl
jne 0x1400922d7
test al, al
je 0x1400923f1
test r15b, r15b
lea rax, str._ProgramData_microsoftwindowswer_
lea rdx, str._SystemDrive_users_
cmovne rdx, rax
or rdi, 0xffffffffffffffff
cmp word [rdx], bx
jne 0x1400922fa
mov r8, rbx
jmp 0x140092307
mov r8, rdi
inc r8
cmp word [rdx + r8*2], bx
jne 0x1400922fd
mov rcx, rsi
call fcn.140007004
test r15b, r15b
jne 0x14009233a
mov r9, rdi
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call fcn.140008480
mov r8d, 0x25
lea rdx, str._appdatalocalmicrosoftwindowswer_
mov rcx, rsi
call fcn.140008328
test bpl, bpl
lea rax, str.ReportQueue_
lea rdx, str.ReportArchive_
cmovne rdx, rax
cmp word [rdx], bx
jne 0x140092359
mov r8, rbx
jmp 0x140092366
mov r8, rdi
inc r8
cmp word [rdx + r8*2], bx
jne 0x14009235c
mov rcx, rsi
call fcn.140008328
mov r9, rdi
xor r8d, r8d
mov rdx, r12
mov rcx, rsi
call fcn.140008480
cmp qword [rsi + 0x18], 8
jb 0x14009238b
mov rcx, qword [rsi]
jmp 0x14009238e
mov rcx, rsi
mov r8d, 0x104
lea rdx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400923cf
cmp word [rsp + 0x20], bx
je 0x1400923bb
lea rax, [rsp + 0x20]
inc rdi
cmp word [rax + rdi*2], bx
jne 0x1400923af
mov rbx, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140007004
xor eax, eax
jmp 0x1400923f6
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x1400923f6
mov eax, 0x8000ffff
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400c20a0
add rsp, 0x240
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009399c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov rbx, rcx
mov edi, 0x108
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x50]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x40], edi
mov qword [rbp - 0x78], 7
xor edi, edi
mov qword [rbp - 0x80], rdi
mov word [rsp + 0x70], di
lea r8d, [rdi + 0x3e]
lea rdx, str.SystemCurrentControlSetServicesTcpipParametersInterfaces_
lea rcx, [rsp + 0x70]
call fcn.140007004
nop
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x50], dil
cmp byte [rbx], dil
jne 0x140093a30
mov r8d, edi
jmp 0x140093a3d
or r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], dil
jne 0x140093a34
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140004bc4
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x60]
add r8, rcx
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae rdx, qword [rsp + 0x50]
mov qword [rbp - 0x58], 7
mov qword [rbp - 0x60], rdi
mov word [rbp - 0x70], di
lea rcx, [rbp - 0x70]
call fcn.140022c6c
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.140008480
nop
cmp qword [rbp - 0x58], 8
jb 0x140093ab6
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, 2
lea r8, str.NameServer
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x140093b0e
mov bl, 1
jmp 0x140093b15
cmp di, word [rbp - 0x50]
sete bl
cmp qword [rsp + 0x68], 0x10
jb 0x140093b28
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x50], dil
cmp qword [rbp - 0x78], 8
jb 0x140093b4d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov al, bl
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400c20a0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140094b0c
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r13d, r13d
mov r12, rcx
or rcx, 0xffffffffffffffff
mov rbp, r8
mov rdi, rcx
mov r15, rdx
mov ebx, r13d
inc rdi
cmp word [r8 + rdi*2], r13w
jne 0x140094b3e
lea r14, [rdi + 2]
mov eax, 2
mul r14
lea rdx, [0x1400f80f4]
cmovo rax, rcx
mov rcx, rax
call fcn.1400c24ac
mov rsi, rax
test rax, rax
je 0x140094bc9
xor ecx, ecx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
lea rdx, [rdi + 1]
mov r9, rdi
mov r8, rbp
mov rcx, rsi
mov rbx, rsi
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
lea ecx, [r14 + r14]
mov word [rsi + rdi*2 + 2], r13w
mov dword [rsp + 0x28], ecx
mov r9d, 7
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rsi
mov r8, r15
mov rdx, r12
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x140094be7
mov rcx, qword [rsp + 0x58]
lea r8, str.onecoreuap_adminwebbwindowsrest_networkingmanager.cpp
mov edi, 0x8007000e
mov edx, 0x206
mov r9d, edi
call fcn.140003684
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140094c18
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x10], 7
xor r14d, r14d
mov qword [rbp - 0x18], r14
mov word [rbp - 0x28], r14w
mov rcx, qword [rdx]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsIsStringEmpty]
test eax, eax
jne 0x140094ced
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
or rbx, 0xffffffffffffffff
cmp word [rax], r14w
jne 0x140094c84
mov r8d, r14d
jmp 0x140094c91
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140094c87
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140007004
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsIsStringEmpty]
test eax, eax
jne 0x140094ced
lea r8d, [rax + 1]
lea rdx, [0x1400fe704]
lea rcx, [rbp - 0x28]
call fcn.140008328
xor edx, edx
mov rcx, qword [rdi]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
cmp word [rax], r14w
jne 0x140094cd4
mov rbx, r14
jmp 0x140094cde
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140094cd4
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x28]
call fcn.140008328
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov eax, dword [rbp - 0x18]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
lea r8, str.NameServer
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_1.dll_RegSetKeyValueW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140094d57
mov rcx, qword [rbp + 0x28]
mov r9d, ebx
lea r8, str.onecoreuap_adminwebbwindowsrest_networkingmanager.cpp
mov edx, 0x228
call fcn.140003684
jmp 0x140094d64
xor edx, edx
xor ecx, ecx
call qword [sym.imp.DNSAPI.dll_DnsNotifyResolver]
mov ebx, r14d
cmp qword [rbp - 0x10], 8
jb 0x140094d75
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400c20a0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400964a8
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov edi, ecx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x30]
lea edx, [rbx + 0x28]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_OpenProcessToken]
test eax, eax
je 0x14009654f
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeShutdownPrivilege
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14009654f
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_AdjustTokenPrivileges]
test eax, eax
je 0x14009654f
mov dword [rsp + 0x28], 0x80010001
lea r9d, [rbx + 1]
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_shutdown_l1_1_0.dll_InitiateSystemShutdownExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140096564
call qword [sym.imp.api_ms_win_downlevel_kernel32_l1_1_0.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c20a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14009e28c
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x80
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1401411c8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
xor ebx, ebx
mov qword [r11 - 0x58], rbx
lea r9, [r11 - 0x58]
xor r8d, r8d
mov edx, 0x8000
lea rcx, [0x1400f8140]
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetKnownFolderPath]
mov edi, eax
test eax, eax
jns 0x14009e310
mov rcx, qword [rsp + 0x88]
mov r9d, eax
lea r8, str.onecoreuap_adminwebbwindowsrestcrashdumpcollector.cpp
lea edx, [rbx + 0x62]
call fcn.140003684
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009e309
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov eax, edi
jmp 0x14009e3c8
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rbx
mov word [rsp + 0x58], bx
mov rdx, qword [rsp + 0x30]
cmp word [rdx], bx
jne 0x14009e332
mov r8, rbx
jmp 0x14009e340
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], bx
jne 0x14009e336
lea rcx, [rsp + 0x58]
call fcn.140007004
nop
mov r8d, ntohs
lea rdx, [0x14010ad40]
lea rcx, [rsp + 0x58]
call fcn.140008328
mov rax, qword [rsi]
mov rdi, qword [rax]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140064e54
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.140010228
nop
cmp qword [rsp + 0x70], 8
jb 0x14009e3a0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14009e3b0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
xor eax, eax
jmp 0x14009e3c8
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400c20a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14009ff30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov r15, rdx
mov r9, qword [rdx + 0x10]
mov r14, rcx
jb 0x14009ff5e
mov rcx, qword [rdx]
jmp 0x14009ff61
mov rcx, r15
xor ebp, ebp
movabs rdx, 0xcbf29ce484222325
mov r8d, ebp
add r9, r9
je 0x14009ff93
movzx eax, byte [r8 + rcx]
movabs r10, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r10
cmp r8, r9
jb 0x14009ff75
mov rcx, qword [r14 + 0x28]
mov rsi, rdx
shr rsi, 0x20
xor rsi, rdx
and rsi, rcx
cmp qword [r14 + 0x30], rsi
ja 0x14009ffb7
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rsi, rax
mov rbx, qword [r14 + 0x10]
add rsi, rsi
mov rbx, qword [rbx + rsi*8]
mov rax, qword [r14 + 0x10]
mov rcx, qword [r14]
cmp qword [rax + rsi*8], rcx
jne 0x14009ffd4
mov rax, rcx
jmp 0x14009ffdc
mov rax, qword [rax + rsi*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400a0035
lea rcx, [rbx + 0x10]
mov rdx, r15
call fcn.14000ec80
test al, al
jne 0x14009fff6
mov rbx, qword [rbx]
jmp 0x14009ffc2
mov rdi, rbx
mov rax, qword [r14 + 0x10]
mov rcx, qword [r14]
cmp qword [rax + rsi*8], rcx
jne 0x1400a000b
mov rax, rcx
jmp 0x1400a0013
mov rax, qword [rax + rsi*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400a0030
lea rdx, [rbx + 0x10]
mov rcx, r15
call fcn.14000ec80
test al, al
je 0x1400a002d
mov rbx, qword [rbx]
jmp 0x14009fff9
mov rcx, qword [r14]
cmp rdi, rbx
jne 0x1400a003b
mov rdi, rcx
mov rbx, rcx
mov rax, rdi
cmp rdi, rbx
je 0x1400a0051
mov rax, qword [rax]
inc rbp
cmp rax, rbx
jne 0x1400a0043
mov rcx, qword [r14]
cmp rdi, qword [rcx]
jne 0x1400a0085
cmp rbx, rcx
jne 0x1400a0085
mov rcx, r14
call fcn.1400122e8
mov edx, 8
mov rcx, r14
call fcn.1400a00ac
jmp 0x1400a008a
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rdi, qword [rdi]
mov rcx, r14
call fcn.1400a01e4
cmp rdi, rbx
jne 0x1400a0072
mov rbx, qword [rsp + 0x48]
mov rax, rbp
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400a01e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rbx, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rdx, qword [r9 + 0x10]
jb 0x1400a0206
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rdx, rdx
je 0x1400a0235
movzx eax, byte [r9 + rcx]
movabs rdi, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdi
cmp rcx, rdx
jb 0x1400a0217
mov rcx, qword [r10 + 0x28]
mov rdx, r11
shr rdx, 0x20
xor rdx, r11
and rdx, rcx
cmp qword [r10 + 0x30], rdx
ja 0x1400a0259
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [r10 + 0x10]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400a0288
cmp qword [rcx + rdx*8], r8
jne 0x1400a027d
mov rax, qword [r10]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x10]
mov rax, qword [r10]
jmp 0x1400a0281
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400a0295
cmp qword [rcx + rdx*8], r8
jne 0x1400a0295
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rdx, [rsp + 0x30]
mov rcx, r10
call fcn.140036d30
mov rcx, qword [rax]
mov rax, rbx
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a05d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rdi, r8
mov r15, rdx
mov r14, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400a060f
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r9, r9
je 0x1400a063e
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1400a0620
mov rax, rcx
shr rax, 0x20
xor rcx, rax
mov rdx, qword [r14 + 0x28]
mov rsi, rdx
and rsi, rcx
cmp qword [r14 + 0x30], rsi
ja 0x1400a0665
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rsi, rax
mov rbx, qword [r14]
add rsi, rsi
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax + rsi*8]
cmp rbx, rcx
je 0x1400a06ca
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x1400a06ca
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rcx, rdi
call fcn.14000ec80
test al, al
jne 0x1400a06a5
mov rax, qword [r14 + 0x10]
cmp rbx, qword [rax + rsi*8]
jne 0x1400a0685
jmp 0x1400a06ca
mov rdx, rdi
lea rcx, [rbx + 0x10]
call fcn.14000ec80
test al, al
jne 0x1400a06ba
mov rbx, qword [rbx]
jmp 0x1400a06ca
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1400a07af
mov rax, qword [r14]
mov r13, qword [rax]
mov r9, rdi
mov r8, qword [r13 + 8]
mov rdx, r13
call fcn.140036db8
mov rdx, rax
mov rax, qword [r14 + 8]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x1400a07c7
inc rax
mov qword [r14 + 8], rax
mov qword [r13 + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rcx, qword [r14]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400a0752
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
cmp qword [rdx + rsi*8], rcx
jne 0x1400a076b
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x10]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x1400a079b
cmp qword [rdx + rsi*8], rbx
jne 0x1400a0777
mov qword [rdx + rsi*8], rdi
jmp 0x1400a079b
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x1400a079b
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400a07dc
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1400c1c68
int3
Function at 0x1400a08c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rdi, r8
mov r15, rdx
mov r14, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400a08ff
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r9, r9
je 0x1400a092e
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1400a0910
mov rax, rcx
shr rax, 0x20
xor rcx, rax
mov rdx, qword [r14 + 0x28]
mov rsi, rdx
and rsi, rcx
cmp qword [r14 + 0x30], rsi
ja 0x1400a0955
shr rdx, 1
or rax, 0xffffffffffffffff
sub rax, rdx
add rsi, rax
mov rbx, qword [r14]
add rsi, rsi
mov rax, qword [r14 + 0x10]
mov rcx, qword [rax + rsi*8]
cmp rbx, rcx
je 0x1400a09ba
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x1400a09ba
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rcx, rdi
call fcn.14000ec80
test al, al
jne 0x1400a0995
mov rax, qword [r14 + 0x10]
cmp rbx, qword [rax + rsi*8]
jne 0x1400a0975
jmp 0x1400a09ba
mov rdx, rdi
lea rcx, [rbx + 0x10]
call fcn.14000ec80
test al, al
jne 0x1400a09aa
mov rbx, qword [rbx]
jmp 0x1400a09ba
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1400a0a9f
mov rax, qword [r14]
mov r13, qword [rax]
mov r9, rdi
mov r8, qword [r13 + 8]
mov rdx, r13
call fcn.140019880
mov rdx, rax
mov rax, qword [r14 + 8]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x1400a0ab7
inc rax
mov qword [r14 + 8], rax
mov qword [r13 + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rcx, qword [r14]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400a0a42
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
cmp qword [rdx + rsi*8], rcx
jne 0x1400a0a5b
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x10]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x1400a0a8b
cmp qword [rdx + rsi*8], rbx
jne 0x1400a0a67
mov qword [rdx + rsi*8], rdi
jmp 0x1400a0a8b
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x1400a0a8b
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400a07dc
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1400c1c68
int3