joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004d2b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rdi, r9
mov r11, r8
mov r14, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r8, qword [r10 + 0x30]
and r8, r9
shl r8, 4
mov rbx, qword [r10 + 0x18]
mov rax, qword [rbx + r8]
cmp rax, qword [r10 + 8]
jne 0x18004d36e
mov rbx, qword [r10 + 8]
jmp 0x18004d376
mov rbx, qword [rbx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x18004d3ef
mov rcx, qword [r11]
nop
mov rbx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x18004d391
cmp rbx, rax
jne 0x18004d380
jmp 0x18004d3ef
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov rsi, qword [rdi + 0x18]
test rsi, rsi
je 0x18004d3d7
mov rcx, qword [rsi]
test rcx, rcx
je 0x18004d3ca
call qword [0x18019da90]
xor eax, eax
mov qword [rsi], rax
mov qword [rsi + 8], rax
mov edx, 0x10
mov rcx, rsi
call fcn.18017ab18
mov rcx, rdi
call fcn.18017ab90
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x18004d487
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x18004d429
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x18004d447
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x18004d473
cmp rax, rbx
jne 0x18004d451
mov qword [rdx], rdi
jmp 0x18004d473
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x18004d473
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.180061180
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180077bc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, r8
movzx eax, byte [r8 + 1]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rdx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [rcx + 0x18]
imul r9, rdx
xor r9, rax
imul r9, rdx
mov rdx, qword [rcx + 0x30]
mov rcx, qword [rcx + 8]
and rdx, r9
mov rax, rdx
add rax, rax
add rdx, rdx
mov rax, qword [r8 + rax*8]
mov r9, qword [r8 + rdx*8]
lea r10, [r8 + rdx*8]
cmp r9, rcx
jne 0x180077c6c
mov rdx, rcx
jmp 0x180077c73
mov rdx, qword [r10 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x180077cc6
mov rdx, qword [rbx]
cmp qword [rax + 0x10], rdx
je 0x180077c86
mov rax, qword [rax]
jmp 0x180077c62
mov rbx, qword [rbx]
mov rdx, rax
nop dword [rax]
cmp r9, rcx
jne 0x180077c9a
mov r8, rcx
jmp 0x180077ca1
mov r8, qword [r10 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x180077cb1
cmp rbx, qword [rax + 0x10]
jne 0x180077cb1
mov rax, qword [rax]
jmp 0x180077c90
cmp rdx, rax
je 0x180077cc6
mov qword [r11 + 8], rax
mov rax, r11
mov qword [r11], rdx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, r11
mov qword [r11], rcx
mov qword [r11 + 8], rcx
ret

Function at 0x180077ce0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x180077da1
cmp qword [rcx], r8
jne 0x180077d97
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x180077dac
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x180077dac
cmp qword [rcx], r8
jne 0x180077db1
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.180079190
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x180082f30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r11, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x30]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r9, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
cmp r9, r8
jne 0x180082fdf
mov rcx, r8
jmp 0x180082fe6
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180083010
mov rcx, qword [r11]
cmp qword [rax + 0x10], rcx
je 0x180082ff9
mov rax, qword [rax]
jmp 0x180082fd5
mov rcx, qword [rax + 0x10]
cmp qword [r11], rcx
cmovne rax, r8
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rbx], r8
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1800ed9e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r8, qword [r10 + 0x30]
and r8, r9
shl r8, 4
mov rbx, qword [r10 + 0x18]
mov rax, qword [rbx + r8]
cmp rax, qword [r10 + 8]
jne 0x1800eda70
mov rbx, qword [r10 + 8]
jmp 0x1800eda78
mov rbx, qword [rbx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1800edac0
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1800eda90
cmp rbx, rax
jne 0x1800eda80
jmp 0x1800edac0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov rcx, rdi
call fcn.18017ab90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1800edb57
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1800edafa
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x1800edb18
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x1800edb44
cmp rax, rbx
jne 0x1800edb22
mov qword [rdx], rdi
jmp 0x1800edb44
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1800edb44
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.1800f1150
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f06d0
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [rcx]
mov edi, r8d
mov ebx, edx
mov r14, rcx
call qword [rax + 0x78]
mov rcx, rax
mov r9, qword [rax]
call qword [r9 + 0x68]
movzx ecx, byte [rsp + 0x89]
movabs rdx, 0x100000001b3
mov rbp, rax
movzx r9d, bl
movabs rax, 0xcbf29ce484222325
xor r9, rax
movzx eax, byte [rsp + 0x8b]
imul r9, rdx
mov r8, qword [rbp + 0x18]
xor r9, rcx
movzx ecx, byte [rsp + 0x8a]
imul r9, rdx
xor r9, rcx
mov rcx, qword [rbp + 8]
imul r9, rdx
xor r9, rax
imul r9, rdx
mov rdx, qword [rbp + 0x30]
and rdx, r9
mov rax, rdx
add rax, rax
add rdx, rdx
mov rax, qword [r8 + rax*8]
mov r9, qword [r8 + rdx*8]
lea r10, [r8 + rdx*8]
nop dword [rax]
cmp r9, rcx
jne 0x1800f0782
mov qword [rsp + 0x98], rcx
mov rdx, rcx
jmp 0x1800f0791
mov rdx, qword [r10 + 8]
mov rdx, qword [rdx]
mov qword [rsp + 0x98], rdx
cmp rax, rdx
je 0x1800f07a7
cmp ebx, dword [rax + 0x10]
je 0x1800f07a0
mov rax, qword [rax]
jmp 0x1800f0770
mov qword [rsp + 0x28], rax
jmp 0x1800f07aa
mov rax, rcx
mov qword [rsp + 0x30], rcx
cmp rax, rcx
jne 0x1800f0842
test edi, edi
je 0x1800f085e
mov dword [rsp + 0x80], ebx
lea r9, [rsp + 0x80]
mov rbx, qword [rcx]
lea rcx, [rbp + 8]
mov rdx, rbx
mov dword [rsp + 0x84], edi
mov r8, qword [rbx + 8]
call fcn.1800ed800
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1800f0811
lea rcx, str.list_T__too_long
call qword [0x18019d4b8]
int3
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
lea rdx, [rsp + 0x40]
mov r9, qword [rbp + 8]
mov r9, qword [r9]
mov qword [rsp + 0x38], r9
lea r8, [r9 + 0x10]
call fcn.1800ed9e0
jmp 0x1800f084a
cmp dword [rax + 0x14], edi
je 0x1800f085e
mov dword [rax + 0x14], edi
mov eax, 1
xchg byte [r14 + 0x99], al
mov byte [r14 + 0x90], 1
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800f1ba0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r9, r8
mov r10, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rdx
xor r8, rax
movzx eax, byte [r9 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x13]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r9
jne 0x1800f1c39
cmp qword [rcx], r9
jne 0x1800f1c2f
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1800f1c44
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x1800f1c44
cmp qword [rcx], r9
jne 0x1800f1c49
mov rax, qword [r9]
mov qword [rcx], rax
mov r9, qword [rsp + 0x40]
mov rax, qword [r9 + 8]
mov rcx, r9
mov rbx, qword [r9]
mov qword [rax], rbx
mov rdx, qword [r9]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.18017ab90
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18011ea50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rsi, rcx
call fcn.18011f490
lea rbp, [rsi + 0x100]
mov dword [rsp + 0x30], 0
mov rax, qword [rbp]
lea rdx, [rsp + 0xc0]
xor r12d, r12d
mov qword [rbp + 8], rax
mov r8, qword [rbp]
lea rax, [rsp + 0x30]
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r12
lea r9d, [r12 + 6]
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x44], 1
mov byte [rsp + 0x58], 1
mov dword [rsp + 0x70], r12d
call fcn.18011ed00
mov rax, qword [rsi + 0x78]
mov rbx, qword [rbp]
mov rax, qword [rax + 0x30]
mov qword [rbx + 8], rax
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 8]
mov dword [rbx + 0x18], eax
call fcn.18013da90
movss xmm1, dword [rbx]
movss xmm6, dword [0x1801b8d10]
movaps xmm0, xmm1
xorps xmm0, xmm6
mov rcx, qword [rax + 0x10]
addss xmm1, xmm0
movss dword [rbx + 0x2c], xmm0
mov qword [rbx + 0x20], rcx
mov byte [rbx + 0x28], r12b
mov qword [rbx + 0x30], r12
movss dword [rbx + 0x38], xmm1
mov qword [rbx + 0x3c], r12
mov rax, qword [rsi + 0x78]
mov rbx, qword [rbp]
mov rax, qword [rax + 0x38]
mov qword [rbx + 0x50], rax
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rbx + 0x50]
mov dword [rbx + 0x60], eax
call fcn.18013da90
movss xmm1, dword [rbx + 0x48]
lea r15, [rsi + 0xf2]
movaps xmm0, xmm1
mov edi, 0x90
xorps xmm0, xmm6
mov r14d, 0x40
mov rcx, qword [rax + 0x10]
addss xmm1, xmm0
movss dword [rbx + 0x74], xmm0
mov qword [rbx + 0x68], rcx
mov byte [rbx + 0x70], r12b
mov qword [rbx + 0x78], r12
movss dword [rbx + 0x80], xmm1
mov qword [rbx + 0x84], r12
mov rax, qword [rsi + 0x78]
mov rbx, qword [rbp]
mov rax, qword [r14 + rax]
mov qword [rdi + rbx + 8], rax
mov rax, qword [rax + 8]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rdi + rbx + 8]
mov dword [rdi + rbx + 0x18], eax
call fcn.18013da90
movss xmm1, dword [rdi + rbx]
add r14, 8
movaps xmm0, xmm1
xorps xmm0, xmm6
mov rcx, qword [rax + 0x10]
addss xmm1, xmm0
movss dword [rdi + rbx + 0x2c], xmm0
mov qword [rdi + rbx + 0x20], rcx
mov byte [rdi + rbx + 0x28], r12b
mov qword [rdi + rbx + 0x30], r12
movss dword [rdi + rbx + 0x38], xmm1
mov qword [rdi + rbx + 0x3c], r12
add rdi, 0x48
mov word [r15], r12w
add r15, 2
cmp rdi, 0x1b0
jl 0x18011eba3
mov rcx, rsi
call fcn.1800b3df0
cvttss2si ecx, xmm0
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov rax, qword [rbp]
cmp rax, qword [rsi + 0x108]
je 0x18011ec67
nop dword [rax + rax]
mov dword [rax + 0x14], 1
mov dword [rax + 0x10], edx
add rax, 0x48
cmp rax, qword [rsi + 0x108]
jne 0x18011ec50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
lea rax, [0x18011f1a0]
mov rbp, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov qword [rsi + 0xa0], rax
xor eax, eax
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18013fb50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
sub r9, r8
mov rax, rdx
sub rax, rcx
mov r14, r8
xor rax, r9
mov rbp, rdx
mov rbx, rcx
test rax, 0xfffffffffffffffe
je 0x18013fb90
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp rcx, rbp
je 0x18013fbdc
sub r14, rcx
mov rax, qword [rsp + 0x50]
movzx edx, word [rbx]
movzx esi, word [r14 + rbx]
mov rcx, qword [rax + 8]
call qword [0x18019d468]
mov rcx, qword [rsp + 0x50]
movzx edx, si
movzx edi, ax
mov rcx, qword [rcx + 8]
call qword [0x18019d468]
cmp di, ax
jne 0x18013fbf9
add rbx, 2
cmp rbx, rbp
jne 0x18013fba2
mov al, 1
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x18013fbde
Function at 0x18014fb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov r11, r9
movzx r9d, r8b
mov rsi, rdx
mov r15, rcx
mov r14, qword [rcx]
mov r10, qword [r14 + 8]
mov rdi, r14
mov r8b, 1
cmp byte [r10 + 0x19], 0
jne 0x18014fc60
mov rdi, r10
test r9b, r9b
je 0x18014fc0d
mov rax, qword [r10 + 0x20]
test rax, rax
je 0x18014fbfb
mov r8, qword [r11]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18014fbf3
inc rax
test ecx, ecx
jne 0x18014fbe0
test edx, edx
sets r8b
jmp 0x18014fc07
mov eax, dword [r11 + 8]
cmp dword [r10 + 0x28], eax
setb r8b
xor r8b, 1
jmp 0x18014fc47
mov rax, qword [r11]
test rax, rax
je 0x18014fc3b
mov r8, qword [r10 + 0x20]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18014fc33
inc rax
test ecx, ecx
jne 0x18014fc20
test edx, edx
sets r8b
jmp 0x18014fc47
mov eax, dword [r10 + 0x28]
cmp dword [r11 + 8], eax
setb r8b
test r8b, r8b
je 0x18014fc51
mov r10, qword [r10]
jmp 0x18014fc55
mov r10, qword [r10 + 0x10]
cmp byte [r10 + 0x19], 0
je 0x18014fbc6
mov rbx, rdi
test r8b, r8b
je 0x18014fd0a
cmp rdi, qword [r14]
jne 0x18014fca8
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
mov r9, rdi
mov r8b, 1
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.18014f5c0
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x18014fdb1
cmp byte [rdi + 0x19], 0
je 0x18014fcb4
mov rbx, qword [rdi + 0x10]
jmp 0x18014fd0a
mov rax, qword [rdi]
cmp byte [rax + 0x19], 0
jne 0x18014fcdf
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
jne 0x18014fd0a
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], 0
je 0x18014fcd0
jmp 0x18014fd0a
mov rax, qword [rdi + 8]
cmp byte [rax + 0x19], 0
jne 0x18014fd02
nop dword [rax]
cmp rbx, qword [rax]
jne 0x18014fd02
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18014fcf0
cmp byte [rbx + 0x19], 0
cmove rbx, rax
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x18014fd3a
mov r9, qword [r11]
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x18014fd33
inc rax
test ecx, ecx
jne 0x18014fd20
test edx, edx
sets al
jmp 0x18014fd44
mov eax, dword [r11 + 8]
cmp dword [rbx + 0x28], eax
setb al
test al, al
je 0x18014fd79
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r11
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, r15
call fcn.18014f5c0
mov rax, qword [rax]
mov qword [rsi], rax
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x18014fdb1
mov rdi, qword [rsp + 0x80]
lea rcx, [rdi + 0x30]
call fcn.1801503a0
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x18014fd9f
cmp dword [rdi + 0x28], 1
jne 0x18014fd9f
call qword [0x18019da90]
mov rcx, rdi
call fcn.18017ab90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180175aa0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180175b0a
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180175ae4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180175b35
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180175b76
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180175b5a
jmp 0x180175b40
mov rdx, qword [rsp + 0x78]
mov rcx, r11
call fcn.180176c60
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180175c12
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180175bb5
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180175bd3
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180175bff
cmp rax, rbx
jne 0x180175bdd
mov qword [rdx], rdi
jmp 0x180175bff
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180175bff
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180176ba0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1801782f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r8
jne 0x1801783b1
cmp qword [rcx], r8
jne 0x1801783a7
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1801783bc
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1801783bc
cmp qword [rcx], r8
jne 0x1801783c1
mov rax, qword [r8]
mov qword [rcx], rax
mov r8, qword [rsp + 0x40]
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.1801786e0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x180178890
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r11, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x30]
and rcx, r9
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r9, qword [rdx + rcx*8]
lea r10, [rdx + rcx*8]
cmp r9, r8
jne 0x18017893f
mov rcx, r8
jmp 0x180178946
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180178970
mov rcx, qword [r11]
cmp qword [rax + 0x10], rcx
je 0x180178959
mov rax, qword [rax]
jmp 0x180178935
mov rcx, qword [rax + 0x10]
cmp qword [r11], rcx
cmovne rax, r8
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rbx], r8
mov rax, rbx
mov rbx, qword [rsp + 8]
ret