joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015069
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rbx, rdx
mov rsi, rcx
call fcn.140001066
mov r14, rax
mov rcx, rbx
call fcn.140014482
lea rdi, [rsp + 0x20]
mov rcx, rdi
call fcn.140014482
mov rcx, rsi
mov rdx, rdi
call fcn.140015003
cmp byte [r14], 0
je 0x140014e35
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
cmp qword [rsi], 0
jle 0x140014e8d
mov rcx, qword [rsi + 8]
xor edx, edx
call fcn.140014707
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
mov rcx, rbx
call fcn.140013d36
cmp byte [r14], 0
jne 0x140014e2b
mov rcx, qword [rsi + 8]
add rcx, 8
mov rdx, qword [rsp + 0x20]
mov r8, qword [rsp + 0x28]
call fcn.1400110ca
cmp byte [r14], 0
jne 0x140014e2b
mov rcx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140015069
mov rax, qword [rsp + 0x20]
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
jmp 0x140014e2b
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r12, rcx
call fcn.140001066
mov r13, rax
lea rcx, [rsp + 0x30]
call fcn.140014482
cmp byte [r13], 0
jne 0x1400150c1
mov r14, qword [r12]
mov rcx, qword [r12 + 8]
xor edx, edx
call fcn.140014707
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
call fcn.140013d36
cmp byte [r13], 0
je 0x1400150d2
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
lea rdi, [rbx + rbx]
inc rdi
cmp rdi, r14
jge 0x140015182
lea rsi, [rbx + rbx]
add rsi, 2
mov rbp, qword [r12 + 8]
mov rcx, rbp
mov rdx, rdi
call fcn.140014707
mov r15, rax
cmp rsi, r14
jge 0x140015150
mov rcx, rbp
mov rdx, rsi
call fcn.140014707
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.140014714
cmp byte [r13], 0
jne 0x1400150c1
test al, al
jne 0x14001513d
mov rdi, rsi
mov rbp, qword [r12 + 8]
mov rcx, rbp
mov rdx, rdi
call fcn.140014707
mov r15, rax
shl rbx, 4
lea rcx, [rbx + rbp]
add rcx, 8
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
call fcn.140013d36
cmp byte [r13], 0
mov rbx, rdi
je 0x1400150d4
jmp 0x1400150c1
mov rax, qword [r12 + 8]
mov rcx, rbx
shl rcx, 4
add rcx, rax
add rcx, 8
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
call fcn.1400110ca
cmp byte [r13], 0
jne 0x1400150c1
mov rcx, r12
mov rdx, rbx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp 0x140014576

Function at 0x1400170ee
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.14000cc65
test al, al
je 0x140017125
mov rcx, rsi
call fcn.14000ccb6
cmp byte [r14], 0
je 0x14001712f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a
Function at 0x140017145
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
mov rsi, qword [rdi]
test rbx, rbx
je 0x14001716c
mov rcx, rbx
call fcn.140010d4f
mov qword [rdi], rbx
mov rcx, rsi
call fcn.14000cc65
test al, al
je 0x140017189
mov rcx, rsi
call fcn.14000ccb6
cmp byte [r14], 0
je 0x140017193
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a

Function at 0x140017424
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call fcn.1400031b4
test al, al
je 0x140017443
mov edx, 8
xor ecx, ecx
add rsp, 0x28
jmp fcn.140001c2a
nop
add rsp, 0x28
ret

Function at 0x1400175ac
Capabilities:
Terminate process

Disassembly:
test rcx, rcx
jne fcn.1400011e0
ret
Function at 0x140018357
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x140018393
cmp byte [rsi], 0
jne 0x1400184e2
jmp 0x140018529
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x1400184c8
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14001845f
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x140018422
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x1400184c8
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x1400184c8
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14001841d
test rbx, rbx
jne 0x1400183ce
test rbx, rbx
je 0x14001845f
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.140018357]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x1400184c5
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x140018474
xor r12d, r12d
jmp 0x1400184c8
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140092b10]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x1400184e2
mov byte [rsi], r12b
test r12b, r12b
je 0x140018529
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x140018508
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x140018538
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x140018587
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rcx
call fcn.140001066
mov ecx, 0x40
call fcn.14000ed36
mov rdi, rax
lea rax, [0x14009d5b0]
mov qword [rdi], rax
lea rbx, [0x14009d0e0]
mov qword [rdi + 0x10], rbx
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.14000ed6d
movaps xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi + 0x18], xmm0
mov qword [rsp + 0x20], 0x35
lea r8, [0x14009d100]
lea r9, str.LEc41v3cy
mov rcx, rdi
mov rdx, rbx
call fcn.14000ed74
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001860e
test byte [rcx + 7], 0x40
jne 0x14001860e
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.1400011e0
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret

Function at 0x140019599
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x1400195b5
test byte [rcx + 7], 0x40
jne 0x1400195b5
call fcn.1400011e0
mov rcx, qword [rsi + 0x10]
call fcn.1400031b4
test al, al
je 0x1400195d5
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.140001c2a
nop
add rsp, 0x20
pop rsi
ret
Function at 0x140019fac
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x30]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x140019fe8
cmp byte [rsi], 0
jne 0x14001a137
jmp 0x14001a17e
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14001a11d
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14001a0b4
lea rbp, [rdi + 0x30]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14001a077
mov rcx, qword [rdi + 0x38]
call qword [rdi + 0x30]
cmp byte [rsi], 0
jne 0x14001a11d
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14001a11d
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14001a072
test rbx, rbx
jne 0x14001a023
test rbx, rbx
je 0x14001a0b4
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.140019fac]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14001a11a
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14001a0c9
xor r12d, r12d
jmp 0x14001a11d
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140092b50]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14001a137
mov byte [rsi], r12b
test r12b, r12b
je 0x14001a17e
mov byte [rsi], 0
mov rax, qword [rdi + 0x28]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14001a15d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x28]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14001a18d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14001a454
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.140001066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x38]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.14001854b
test al, al
je 0x14001a490
cmp byte [rsi], 0
jne 0x14001a5df
jmp 0x14001a626
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x40]
call qword [rdi + 0x38]
mov r12b, 1
cmp byte [rsi], 0
jne 0x14001a5c5
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x14001a55c
lea rbp, [rdi + 0x38]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.14001296a
test al, al
je 0x14001a51f
mov rcx, qword [rdi + 0x40]
call qword [rdi + 0x38]
cmp byte [rsi], 0
jne 0x14001a5c5
mov rcx, r14
mov rdx, rax
call fcn.1400106b1
cmp byte [rsi], 0
jne 0x14001a5c5
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.14001854b
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x14001a51a
test rbx, rbx
jne 0x14001a4cb
test rbx, rbx
je 0x14001a55c
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.1400018bc
lea rax, [fcn.14001a454]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.140013427
jmp 0x14001a5c2
mov rax, qword [rdi + 0x30]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14001a571
xor r12d, r12d
jmp 0x14001a5c5
mov ecx, 0x40
call fcn.14000ed36
lea rcx, [0x1400a8228]
mov qword [rax], rcx
lea rdx, [0x1400a8260]
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x140092b50]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov qword [rsp + 0x20], 0x2a
lea r8, [0x1400a8280]
lea r9, str.mVedrBkx34YrVf
mov rcx, rax
call fcn.14000ed74
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.1400106dc
cmp byte [rsi], 0
jne 0x14001a5df
mov byte [rsi], r12b
test r12b, r12b
je 0x14001a626
mov byte [rsi], 0
mov rax, qword [rdi + 0x30]
mov cl, byte [rax + 0x20]
call fcn.14001296a
test al, al
je 0x14001a605
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140018558
call fcn.1400130f9
mov rbx, rax
mov rcx, qword [rdi + 0x30]
mov rdx, rax
call fcn.140011d4b
mov rcx, rbx
call fcn.14000ebe5
cmp byte [rsi], 0
je 0x14001a635
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140013124
Function at 0x14001ad99
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
lea rax, [r8*4]
movabs rdi, 0x5555555555555556
imul rdi
mov rax, rdx
shr rax, 0x3f
add rdx, rax
add rdx, 6
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
call fcn.14001250f
mov rax, rbp
imul rdi
mov rax, rdx
shr rax, 0x3f
add rax, rdx
lea rcx, [rax + rax*2]
mov qword [rsp + 0x30], rbp
sub rbp, rcx
mov rax, rcx
mov qword [rsp + 0x28], rcx
test rcx, rcx
mov qword [rsp + 0x38], rbp
je 0x14001aecc
sub qword [rsp + 0x30], rbp
xor edi, edi
xor ebp, ebp
mov qword [rsp + 0x40], rbx
movzx r13d, byte [rbx + rbp]
mov r14d, r13d
shl r14d, 0x10
movzx r12d, byte [rbx + rbp + 1]
shl r12d, 8
or r14d, r12d
movzx r15d, byte [rbx + rbp + 2]
or r12d, r15d
add rbp, 3
mov rcx, rsi
call fcn.140010326
shr r13, 2
lea rbx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [r13 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rcx, rsi
call fcn.140010326
shr r14d, 0xc
and r14d, 0x3f
mov al, byte [r14 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 9], al
mov rcx, rsi
call fcn.140010326
shr r12d, 6
and r12d, 0x3f
mov al, byte [r12 + rbx]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 0xa], al
mov rcx, rsi
call fcn.140010326
and r15d, 0x3f
mov al, byte [r15 + rbx]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 0xb], al
add rdi, 4
cmp qword [rsp + 0x30], rbp
jne 0x14001ae20
jmp 0x14001aece
xor edi, edi
mov rax, qword [rsp + 0x38]
cmp rax, 2
je 0x14001af3b
cmp rax, 1
jne 0x14001afd3
mov rax, qword [rsp + 0x28]
movzx ebx, byte [rbx + rax]
mov ebp, ebx
shl ebp, 4
mov rcx, rsi
call fcn.140010326
shr rbx, 2
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rbx + r14]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rbx, rdi
or rbx, 1
mov rcx, rsi
call fcn.140010326
and ebp, 0x30
mov al, byte [rbp + r14]
mov rcx, qword [rsi + 8]
mov byte [rcx + rbx + 8], al
mov rcx, rsi
call fcn.140010326
mov al, 0x3d
jmp 0x14001afa8
mov rcx, qword [rsp + 0x28]
movzx ebp, byte [rbx + rcx]
mov eax, ebp
shl eax, 0x10
movzx r14d, byte [rbx + rcx + 1]
mov ebx, r14d
shl ebx, 8
or ebx, eax
mov rcx, rsi
call fcn.140010326
shr rbp, 2
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rbp + r15]
mov rcx, qword [rsi + 8]
mov byte [rcx + rdi + 8], al
mov rbp, rdi
or rbp, 1
mov rcx, rsi
call fcn.140010326
shr ebx, 0xc
and ebx, 0x3f
mov al, byte [rbx + r15]
mov rcx, qword [rsi + 8]
mov byte [rcx + rbp + 8], al
mov rcx, rsi
call fcn.140010326
and r14d, 0xf
mov al, byte [r15 + r14*4]
mov rcx, rdi
or rcx, 2
mov rdx, qword [rsi + 8]
mov byte [rdx + rcx + 8], al
mov rbx, rdi
or rbx, 3
mov rcx, rsi
call fcn.140010326
mov rax, qword [rsi + 8]
mov byte [rax + rbx + 8], 0x3d
add rdi, 4
mov rcx, rsi
mov rdx, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14001250f
Function at 0x14001afee
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
mov rax, qword [rcx]
test rax, rax
jle 0x14001b039
mov ebx, 0x10
xor edi, edi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx + rbx]
test rcx, rcx
je 0x14001b02d
test qword [rcx], r14
jne 0x14001b02d
call fcn.1400011e0
mov rax, qword [rsi]
inc rdi
add rbx, 0x10
cmp rdi, rax
jl 0x14001b013
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001b05a
test qword [rcx], r14
jne 0x14001b05a
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001b6a3
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14001b6c8
test byte [rcx + 7], 0x40
jne 0x14001b6c8
call fcn.1400011e0
mov rcx, qword [rsi + 0x20]
call fcn.140004303
test al, al
je 0x14001b6e3
mov rcx, qword [rsi + 0x20]
call fcn.140004340
cmp byte [rdi], 0
je 0x14001b6ea
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x20]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x14001babc
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001bad8
test byte [rcx + 7], 0x40
jne 0x14001bad8
call fcn.1400011e0
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x14001bb55
mov rax, qword [rcx]
mov edx, 0xffffffff
xor rdx, rax
lea rdx, [rdx + rdx*2]
lea rsi, [rax + rax]
add rdx, rax
inc rdx
xor rdx, rsi
mov r8d, edx
movabs rsi, 0x186d3dd989c577ed
xor rsi, r8
and edx, 0x93
xor edx, 0xfe
imul edx, edx
imul r8d, edx, 0xc24b
mov edx, eax
or edx, 0x84
movzx edx, dl
imul edx, edx
imul r10d, edx, 0x8cb1
movabs r9, 0x2792c22689c577ec
lea rdx, [r9 + 1]
cmp r8d, r10d
cmove rdx, r9
add rdx, rsi
test rax, rdx
je 0x14001bb5b
add rsp, 0x20
pop rsi
ret
add rsp, 0x20
pop rsi
jmp fcn.1400011e0

Function at 0x14001beb3
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs r14, 0x4000000000000000
cmp qword [rcx], 0
jle 0x14001bf0f
xor ebx, ebx
xor edi, edi
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x18]
test rcx, rcx
je 0x14001beef
test qword [rcx], r14
jne 0x14001beef
call fcn.1400011e0
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx + 0x28]
test rcx, rcx
je 0x14001bf03
test qword [rcx], r14
jne 0x14001bf03
call fcn.1400011e0
inc rdi
add rbx, 0x28
cmp rdi, qword [rsi]
jl 0x14001bed3
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001bf30
test qword [rcx], r14
jne 0x14001bf30
mov edx, 8
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400011a3
nop
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001c029
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140001066
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
add rsp, 0x20
pop rsi
jmp 0x14001c093
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rbx, rcx
call fcn.140001066
lea r13, [r12 + 3]
test r12, r12
cmovns r13, r12
mov r14, rax
and r13, 0xfffffffffffffffc
xor r15d, r15d
xor edi, edi
cmp r12, 4
jl 0x14001c10e
cmp byte [r14], 0
jne 0x14001c182
xor esi, esi
imul ecx, dword [rbx + rsi], 0xcc9e2d51
mov edx, 0xf
call fcn.14001c195
add rsi, 4
imul ecx, eax, 0x1b873593
xor ecx, edi
mov edx, 0xd
call fcn.14001c195
lea edi, [rax + rax*4]
add edi, 0xe6546b64
cmp rsi, r13
jl 0x14001c0d7
jmp 0x14001c110
xor esi, esi
mov rax, r12
sub rax, r13
test rax, rax
jle 0x14001c13f
inc rax
add rbx, rsi
xor ecx, ecx
mov edx, ecx
shl edx, 8
movzx ecx, byte [rbx + rax - 2]
or ecx, edx
dec rax
cmp rax, 1
jg 0x14001c123
imul r15d, ecx, 0xcc9e2d51
cmp byte [r14], 0
je 0x14001c149
xor edi, edi
jmp 0x14001c182
mov edx, 0xf
mov ecx, r15d
call fcn.14001c195
imul eax, eax, 0x1b873593
xor edi, r12d
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x14001c093
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.140001066
mov rdx, qword [rsi]
mov rax, qword [rsi + 8]
lea rcx, [rax + 8]
test rax, rax
cmove rcx, rax
add rsp, 0x20
pop rsi
jmp 0x14001c093
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r12, rdx
mov rbx, rcx
call fcn.140001066
lea r13, [r12 + 3]
test r12, r12
cmovns r13, r12
mov r14, rax
and r13, 0xfffffffffffffffc
xor r15d, r15d
xor edi, edi
cmp r12, 4
jl 0x14001c10e
cmp byte [r14], 0
jne 0x14001c182
xor esi, esi
imul ecx, dword [rbx + rsi], 0xcc9e2d51
mov edx, 0xf
call fcn.14001c195
add rsi, 4
imul ecx, eax, 0x1b873593
xor ecx, edi
mov edx, 0xd
call fcn.14001c195
lea edi, [rax + rax*4]
add edi, 0xe6546b64
cmp rsi, r13
jl 0x14001c0d7
jmp 0x14001c110
xor esi, esi
mov rax, r12
sub rax, r13
test rax, rax
jle 0x14001c13f
inc rax
add rbx, rsi
xor ecx, ecx
mov edx, ecx
shl edx, 8
movzx ecx, byte [rbx + rax - 2]
or ecx, edx
dec rax
cmp rax, 1
jg 0x14001c123
imul r15d, ecx, 0xcc9e2d51
cmp byte [r14], 0
je 0x14001c149
xor edi, edi
jmp 0x14001c182
mov edx, 0xf
mov ecx, r15d
call fcn.14001c195
imul eax, eax, 0x1b873593
xor edi, r12d
xor edi, eax
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae35
mov edi, eax
shr edi, 0x10
xor edi, eax
mov rax, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001c7c2
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
call fcn.1400031b4
test al, al
je 0x14001c7f3
mov rcx, qword [rsi + 0x10]
call fcn.14000a957
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x20
pop rsi
jmp fcn.140001c2a
nop
add rsp, 0x20
pop rsi
ret

Function at 0x14001c8b4
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
cmp qword [rcx], 0
jle 0x14001c907
mov edi, 0x18
xor ebx, ebx
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.1400031b4
test al, al
je 0x14001c8fb
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
call fcn.14000a957
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rdi]
mov edx, 8
call fcn.140001c2a
inc rbx
add rdi, 0x18
cmp rbx, qword [rsi]
jl 0x14001c8cb
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14001c927
test byte [rcx + 7], 0x40
jne 0x14001c927
mov edx, 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400011a3
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x14001d3dd
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call fcn.140001066
mov rdi, rax
mov rcx, qword [rsi + 0x10]
lea rdx, [0x1400a4b48]
call fcn.14000ddcb
test al, al
je 0x14001d410
mov rcx, qword [rsi + 0x10]
call fcn.14000a731
cmp byte [rdi], 0
je 0x14001d417
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, qword [rsi + 0x10]
mov edx, 8
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140001c2a

Function at 0x14001d42b
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
mov rsi, qword [rdi + 0x10]
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x10], rax
lea rdx, [0x1400a4b48]
mov rcx, rsi
call fcn.14000ddcb
test al, al
je 0x14001d475
mov rcx, rsi
call fcn.14000a731
cmp byte [r14], 0
je 0x14001d47f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a

Function at 0x14001d4f0
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rdx
mov rdi, rcx
call fcn.140001066
mov r14, rax
mov rsi, qword [rdi]
mov qword [rdi], rbx
mov rcx, rsi
call fcn.14000a984
test al, al
je 0x14001d527
mov rcx, rsi
call fcn.14000a731
cmp byte [r14], 0
je 0x14001d531
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov edx, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.140001c2a