joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a38b4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
mov ebp, reloc.OLEAUT32.dll_SafeArrayUnlock
lea rcx, [rsp + 0x20]
lea ebx, [rbp - 0x14]
mov r8b, bl
call fcn.14006d604
cmp qword [rsp + 0x38], 8
lea r8, [rsp + 0x20]
mov r11, qword [rsp + 0x30]
movabs rdx, 0xcbf29ce484222325
cmovae r8, qword [rsp + 0x20]
xor edi, edi
mov rcx, r8
lea r9, [r11 + r11]
lea rax, [r8 + r9]
cmp r8, rax
cmova r9, rdi
test r9, r9
je 0x1400a394c
movzx eax, byte [rcx]
movabs r10, 0x100000001b3
xor rdx, rax
add rcx, rbx
mov rax, rcx
sub rax, r8
imul rdx, r10
cmp rax, r9
jne 0x1400a392a
and rdx, qword [0x140549610]
mov r12, qword [0x1405495f8]
add rdx, rdx
mov r10, qword [0x1405495e8]
mov rax, qword [r12 + rdx*8]
cmp qword [r12 + rdx*8], r10
jne 0x1400a3973
mov rcx, r10
jmp 0x1400a397b
mov rcx, qword [r12 + rdx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a3a50
cmp qword [rsp + 0x38], 8
lea r8, [rax + 0x10]
mov r15, qword [r8 + 0x18]
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov r9, r8
cmp r15, 8
jb 0x1400a39a9
mov r9, qword [r8]
mov rsi, qword [r8 + 0x10]
cmp rsi, r11
jne 0x1400a39ec
mov r14, rsi
test rsi, rsi
je 0x1400a39f6
movzx r8d, word [r9]
movzx edi, word [rcx]
cmp r8w, di
jb 0x1400a39ea
sub r9, rcx
cmp r8w, di
ja 0x1400a39ea
cmp r14, rbx
je 0x1400a39f4
add rcx, 2
sub r14, rbx
movzx r8d, word [rcx + r9]
movzx edi, word [rcx]
cmp r8w, di
jae 0x1400a39ce
xor edi, edi
mov rax, qword [rax]
jmp 0x1400a3968
xor edi, edi
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x1400a3a03
mov rcx, qword [rcx]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
cmp r11, rsi
jne 0x1400a3a50
test r11, r11
je 0x1400a3a53
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400a3a50
sub rdx, rcx
cmp r8w, r9w
ja 0x1400a3a50
cmp r11, rbx
je 0x1400a3a53
add rcx, 2
sub r11, rbx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400a3a33
mov rax, r10
cmp rax, r10
jne 0x1400a3a5d
mov bl, dil
jmp 0x1400a3a60
mov ebp, dword [rax + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140055f70
mov eax, reloc.OLEAUT32.dll_SafeArrayUnlock
test bl, bl
cmove ebp, eax
mov eax, ebp
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ab284
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400ab2b3
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400ab2fa
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400ab2d7
and r8, qword [0x140549650]
mov r15, qword [0x140549638]
mov r11, qword [0x140549628]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400ab322
mov rcx, r11
jmp 0x1400ab32a
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400ab3f0
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400ab344
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400ab354
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400ab394
mov rbp, rsi
test rsi, rsi
je 0x1400ab39c
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400ab394
sub rbx, r9
cmp cx, di
ja 0x1400ab394
cmp rbp, 1
je 0x1400ab39c
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400ab377
mov rax, qword [rax]
jmp 0x1400ab317
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400ab3a9
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400ab3b3
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400ab3f0
test r10, r10
je 0x1400ab3f3
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400ab3f0
sub rdx, rcx
cmp r8w, r9w
ja 0x1400ab3f0
cmp r10, 1
je 0x1400ab3f3
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400ab3d2
mov rax, r11
cmp rax, r11
jne 0x1400ab3fc
xor al, al
jmp 0x1400ab405
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400acdbc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400acdeb
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400ace32
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400ace0f
and r8, qword [0x1405496c0]
mov r15, qword [0x1405496a8]
mov r11, qword [0x140549698]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400ace5a
mov rcx, r11
jmp 0x1400ace62
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400acf28
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400ace7c
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400ace8c
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400acecc
mov rbp, rsi
test rsi, rsi
je 0x1400aced4
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400acecc
sub rbx, r9
cmp cx, di
ja 0x1400acecc
cmp rbp, 1
je 0x1400aced4
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400aceaf
mov rax, qword [rax]
jmp 0x1400ace4f
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400acee1
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400aceeb
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400acf28
test r10, r10
je 0x1400acf2b
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400acf28
sub rdx, rcx
cmp r8w, r9w
ja 0x1400acf28
cmp r10, 1
je 0x1400acf2b
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400acf0a
mov rax, r11
cmp rax, r11
jne 0x1400acf34
xor al, al
jmp 0x1400acf3d
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400af45c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400af48b
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400af4d2
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400af4af
and r8, qword [0x140549740]
mov r15, qword [0x140549728]
mov r11, qword [0x140549718]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400af4fa
mov rcx, r11
jmp 0x1400af502
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400af5c8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400af51c
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400af52c
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400af56c
mov rbp, rsi
test rsi, rsi
je 0x1400af574
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400af56c
sub rbx, r9
cmp cx, di
ja 0x1400af56c
cmp rbp, 1
je 0x1400af574
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400af54f
mov rax, qword [rax]
jmp 0x1400af4ef
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400af581
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400af58b
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400af5c8
test r10, r10
je 0x1400af5cb
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400af5c8
sub rdx, rcx
cmp r8w, r9w
ja 0x1400af5c8
cmp r10, 1
je 0x1400af5cb
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400af5aa
mov rax, r11
cmp rax, r11
jne 0x1400af5d4
xor al, al
jmp 0x1400af5dd
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b04f8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400b0527
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400b056e
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400b054b
and r8, qword [0x1405497c0]
mov r15, qword [0x1405497a8]
mov r11, qword [0x140549798]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400b0596
mov rcx, r11
jmp 0x1400b059e
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b0664
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400b05b8
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400b05c8
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400b0608
mov rbp, rsi
test rsi, rsi
je 0x1400b0610
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400b0608
sub rbx, r9
cmp cx, di
ja 0x1400b0608
cmp rbp, 1
je 0x1400b0610
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400b05eb
mov rax, qword [rax]
jmp 0x1400b058b
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400b061d
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400b0627
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400b0664
test r10, r10
je 0x1400b0667
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400b0664
sub rdx, rcx
cmp r8w, r9w
ja 0x1400b0664
cmp r10, 1
je 0x1400b0667
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400b0646
mov rax, r11
cmp rax, r11
jne 0x1400b0670
xor al, al
jmp 0x1400b0679
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b069c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400b06cb
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400b0712
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400b06ef
and r8, qword [0x140549780]
mov r15, qword [0x140549768]
mov r11, qword [0x140549758]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400b073a
mov rcx, r11
jmp 0x1400b0742
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b0808
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400b075c
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400b076c
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400b07ac
mov rbp, rsi
test rsi, rsi
je 0x1400b07b4
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400b07ac
sub rbx, r9
cmp cx, di
ja 0x1400b07ac
cmp rbp, 1
je 0x1400b07b4
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400b078f
mov rax, qword [rax]
jmp 0x1400b072f
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400b07c1
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400b07cb
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400b0808
test r10, r10
je 0x1400b080b
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400b0808
sub rdx, rcx
cmp r8w, r9w
ja 0x1400b0808
cmp r10, 1
je 0x1400b080b
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400b07ea
mov rax, r11
cmp rax, r11
jne 0x1400b0814
xor al, al
jmp 0x1400b081d
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1400b8408
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov r12, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [r8 + 0x18], 0x10
jb 0x1400b8446
mov rdx, qword [r8]
movabs rax, 0xcbf29ce484222325
mov r9, rdx
lea rcx, [rdx + r12]
mov r8, r12
xor r10d, r10d
cmp rdx, rcx
cmova r8, r10
test r8, r8
je 0x1400b848c
movzx ecx, byte [r9]
xor rax, rcx
movabs r10, 0x100000001b3
imul rax, r10
inc r9
mov rcx, r9
sub rcx, rdx
cmp rcx, r8
jne 0x1400b8469
mov rsi, qword [r14 + 0x30]
and rsi, rax
add rsi, rsi
mov r13, qword [r14 + 0x18]
mov rdi, qword [r14 + 8]
cmp rdi, qword [r13 + rsi*8]
je 0x1400b84f8
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r13 + rsi*8]
je 0x1400b84f8
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400b84c7
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400b84d4
mov rcx, qword [rbx]
cmp r12, qword [rdi + 0x20]
jne 0x1400b84ad
mov r8, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
xor r10d, r10d
test eax, eax
jne 0x1400b84ad
mov qword [r15], rdi
mov byte [r15 + 8], r10b
mov rax, r15
jmp 0x1400b85f0
mov rax, qword [r14 + 8]
mov r13, qword [rax]
mov r12, qword [r13 + 8]
mov r9, rbx
mov r8, r12
mov rdx, r13
call fcn.1400b89e4
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jae 0x1400b853f
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [r13 + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400b8593
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x1400b85ac
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400b85dc
cmp qword [rdx + rsi*8], rdi
jne 0x1400b85b8
mov qword [rdx + rsi*8], rbx
jmp 0x1400b85dc
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400b85dc
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400b8610
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b86c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 0x10
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x1400b86f5
mov r10, qword [r9]
xor ebx, ebx
lea rcx, [r10 + r11]
cmp r10, rcx
movabs rax, 0xcbf29ce484222325
mov rdx, r10
cmova r11, rbx
test r11, r11
je 0x1400b8736
movzx ecx, byte [rdx]
movabs rbx, 0x100000001b3
xor rax, rcx
inc rdx
mov rcx, rdx
sub rcx, r10
imul rax, rbx
cmp rcx, r11
jne 0x1400b8714
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400b876e
cmp qword [rcx + rdx*8], rdi
jne 0x1400b8763
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400b8767
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400b877b
cmp qword [rcx + rdx*8], rdi
jne 0x1400b877b
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14007269c
mov edx, 0x30
mov rcx, rdi
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b87c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1400b8807
mov rdx, qword [r8]
movabs rax, 0xcbf29ce484222325
mov r9, rdx
lea rcx, [rdx + r10]
mov r8, r10
xor r11d, r11d
cmp rdx, rcx
cmova r8, r11
test r8, r8
je 0x1400b884d
movzx ecx, byte [r9]
xor rax, rcx
movabs r11, 0x100000001b3
imul rax, r11
inc r9
mov rcx, r9
sub rcx, rdx
cmp rcx, r8
jne 0x1400b882a
mov rsi, qword [r14 + 0x30]
and rsi, rax
add rsi, rsi
mov r13, qword [r14 + 0x18]
mov rdi, qword [r14 + 8]
cmp rdi, qword [r13 + rsi*8]
je 0x1400b88f1
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r13 + rsi*8]
je 0x1400b88f1
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400b888c
mov rdx, qword [rdi + 0x10]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x1400b889b
mov rcx, qword [r12]
cmp r10, qword [rdi + 0x20]
jne 0x1400b8872
mov r8, r10
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
mov r10, qword [r12 + 0x10]
jne 0x1400b8872
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14007269c
mov edx, 0x30
mov rcx, rbx
call fcn.140356b5c
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1400b8986
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400b8926
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x1400b8943
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400b8972
cmp rax, rdi
jne 0x1400b894e
mov qword [rdx + rsi*8], rbx
jmp 0x1400b8972
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400b8972
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400b8610
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400bb484
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r10, qword [rdx + 0x10]
mov rcx, rdx
jb 0x1400bb4b3
mov rcx, qword [rdx]
xor r13d, r13d
lea r9, [r10 + r10]
lea rax, [r9 + rcx]
movabs r8, 0xcbf29ce484222325
cmp rcx, rax
mov r11, rcx
cmova r9, r13
test r9, r9
je 0x1400bb4fa
movzx eax, byte [r11]
movabs rbx, 0x100000001b3
xor r8, rax
inc r11
mov rax, r11
sub rax, rcx
imul r8, rbx
cmp rax, r9
jne 0x1400bb4d7
and r8, qword [0x140549840]
mov r15, qword [0x140549828]
mov r11, qword [0x140549818]
shl r8, 4
mov rax, qword [r8 + r15]
cmp qword [r8 + r15], r11
jne 0x1400bb522
mov rcx, r11
jmp 0x1400bb52a
mov rcx, qword [r8 + r15 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400bb5f0
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r9, rdx
jb 0x1400bb544
mov r9, qword [rdx]
mov r14, qword [rcx + 0x18]
mov rbx, rcx
cmp r14, 8
jb 0x1400bb554
mov rbx, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x1400bb594
mov rbp, rsi
test rsi, rsi
je 0x1400bb59c
movzx ecx, word [rbx]
movzx edi, word [r9]
cmp cx, di
jb 0x1400bb594
sub rbx, r9
cmp cx, di
ja 0x1400bb594
cmp rbp, 1
je 0x1400bb59c
add r9, 2
dec rbp
movzx ecx, word [r9 + rbx]
movzx edi, word [r9]
cmp cx, di
jae 0x1400bb577
mov rax, qword [rax]
jmp 0x1400bb517
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400bb5a9
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400bb5b3
mov rdx, qword [rdx]
cmp r10, rsi
jne 0x1400bb5f0
test r10, r10
je 0x1400bb5f3
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400bb5f0
sub rdx, rcx
cmp r8w, r9w
ja 0x1400bb5f0
cmp r10, 1
je 0x1400bb5f3
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400bb5d2
mov rax, r11
cmp rax, r11
jne 0x1400bb5fc
xor al, al
jmp 0x1400bb605
mov cl, byte [rax + 0x30]
mov al, 1
mov byte [r12], cl
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret