joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009ff0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000a068
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a040
mov ecx, r12d
sub r10d, 1
je 0x14000a08f
sub r10d, 1
je 0x14000a085
cmp r10d, 1
jne 0x14000a095
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000a11f
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a124
cmp r14, rbx
jne 0x14000a100
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000a1b3
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___void____ptr64___long_int__void____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a1b3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000a1c0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a1e0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000a258
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a230
mov ecx, r12d
sub r10d, 1
je 0x14000a27f
sub r10d, 1
je 0x14000a275
cmp r10d, 1
jne 0x14000a285
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000a30f
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a314
cmp r14, rbx
jne 0x14000a2f0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000a3a3
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___void____ptr64__unsigned_long_int___long_int__void____ptr64__unsigned_long_int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a3a3
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000a3b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a3d0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000a448
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a420
mov ecx, r12d
sub r10d, 1
je 0x14000a46f
sub r10d, 1
je 0x14000a465
cmp r10d, 1
jne 0x14000a475
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000a4ff
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a504
cmp r14, rbx
jne 0x14000a4e0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000a593
lea rcx, [0x14015e158]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a593
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000a5a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a5c0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000a638
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a610
mov ecx, r12d
sub r10d, 1
je 0x14000a65f
sub r10d, 1
je 0x14000a655
cmp r10d, 1
jne 0x14000a665
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000a6ef
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a6f4
cmp r14, rbx
jne 0x14000a6d0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000a783
lea rcx, [0x14015e030]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a783
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000a790
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a7b0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000a828
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a800
mov ecx, r12d
sub r10d, 1
je 0x14000a84f
sub r10d, 1
je 0x14000a845
cmp r10d, 1
jne 0x14000a855
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000a8df
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000a8e4
cmp r14, rbx
jne 0x14000a8c0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000a973
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int___long_int__void____ptr64____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__unsigned_long_int_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a973
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000a980
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000a9a0
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000aa18
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000a9f0
mov ecx, r12d
sub r10d, 1
je 0x14000aa3f
sub r10d, 1
je 0x14000aa35
cmp r10d, 1
jne 0x14000aa45
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000aacf
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000aad4
cmp r14, rbx
jne 0x14000aab0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000ab63
lea rcx, [0x14015e098]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000ab63
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000ab70
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000ab90
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
xor r12d, r12d
mov r10d, dword [rcx + 0x10]
mov r11d, r10d
mov r8, qword [rcx]
mov r9d, dword [rcx + 0x14]
cmp r10d, 4
jl 0x14000ac08
mov edx, r10d
shr rdx, 2
mov eax, edx
neg eax
lea r10d, [r10 + rax*4]
nop dword [rax]
imul eax, dword [r8], 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, ecx, 0x5bd1e995
imul r9d, r9d, 0x5bd1e995
xor r9d, eax
add r8, 4
sub rdx, 1
jne 0x14000abe0
mov ecx, r12d
sub r10d, 1
je 0x14000ac2f
sub r10d, 1
je 0x14000ac25
cmp r10d, 1
jne 0x14000ac35
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [r8]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r8d, ecx, 0x5bd1e995
imul eax, r11d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul edx, ecx, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor eax, r8d
imul ecx, eax, 0x5bd1e995
xor ecx, edx
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0x5bd1e995
mov r15d, ecx
shr r15d, 0xf
xor r15d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov r14, qword [rcx + 0x18]
mov rbx, r14
nop word [rax + rax]
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000acbf
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000acc4
cmp r14, rbx
jne 0x14000aca0
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [rdi + 8]
call rax
mov ecx, dword [rdi + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rdi + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rsi + 0x38], r12
test rax, rax
je 0x14000ad53
lea rcx, [0x14015e108]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rsi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000ad53
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rsi
jmp 0x14000ad60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000af20
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x80
mov rdi, rdx
mov r14, rcx
xor r12d, r12d
mov r9d, dword [rcx + 0x14]
mov r8d, dword [rcx + 0x10]
mov rdx, qword [rcx]
call fcn.14000c150
mov r15d, eax
mov rdx, qword gs:[0x60]
mov r8, qword [rdx + 0x18]
mov rsi, qword [r8 + 0x18]
mov rbx, rsi
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
je 0x14000af90
lea rdx, [0x14015ce80]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14000af95
cmp rsi, rbx
jne 0x14000af71
mov dword [rsp + 0x20], 0xa
mov r9d, ntohs
mov r8d, 0x929d631a
mov rdx, qword [rbx + 0x30]
call fcn.14000bac0
mov rcx, qword [r14 + 8]
call rax
mov ecx, dword [r14 + 0x14]
mov dword [rsp + 0x20], ecx
mov r9d, dword [r14 + 0x10]
mov r8d, r15d
mov rdx, rax
call fcn.14000bac0
mov qword [rsp + 0x78], r12
mov qword [rdi + 0x38], r12
test rax, rax
je 0x14000b025
lea rcx, vtable.std::_Func_impl_no_alloc_long_int____cdecl___struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__wchar_t____ptr64___long_int__struct_HWND______ptr64__int__void____ptr64__unsigned_long_int__wchar_t____ptr64_.0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov qword [rdi + 0x38], rax
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000b025
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov rax, rdi
jmp 0x14000b032
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x14000bac0
Capabilities:
Encode data using xor
Hash data using murmur2
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rsi
push r15
sub rsp, 0x28
movsxd rax, dword [rdx + 0x3c]
xor r11d, r11d
mov qword [rsp + 0x48], rbx
mov rsi, rdx
mov qword [rsp + 0x20], rbp
mov r15d, 0xffffffff
mov qword [rsp + 0x18], rdi
mov qword [rsp + 8], r13
mov qword [rsp], r14
mov r14d, dword [rax + rdx + 0x88]
add r14, rdx
mov edi, r9d
mov ebx, dword [r14 + 0x20]
mov r13d, dword [r14 + 0x24]
add rbx, rdx
mov ebp, dword [r14 + 0x18]
add r13, rdx
sub ebp, 1
je 0x14000bc23
imul eax, edi, 0x5bd1e995
mov qword [rsp + 0x10], r12
mov r12d, dword [rsp + 0x60]
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul r9d, ecx, 0x5bd1e995
mov dword [rsp + 0x40], r9d
nop word [rax + rax]
mov eax, dword [rbx]
mov r8d, edi
add rax, rsi
mov r10d, r12d
cmp edi, 4
jl 0x14000bb9e
mov r9, rdi
shr r9, 2
lea ecx, [r9*4]
sub r8d, ecx
imul ecx, dword [rax], 0x5bd1e995
add rax, 4
imul r10d, r10d, 0x5bd1e995
mov edx, ecx
shr edx, 0x18
xor edx, ecx
imul edx, edx, 0x5bd1e995
xor r10d, edx
sub r9, 1
jne 0x14000bb72
mov r9d, dword [rsp + 0x40]
xor edx, edx
sub r8d, 1
je 0x14000bbc2
sub r8d, 1
je 0x14000bbb9
cmp r8d, 1
jne 0x14000bbc7
movzx edx, byte [rax + 2]
shl edx, 0x10
movzx ecx, byte [rax + 1]
shl ecx, 8
xor edx, ecx
movzx ecx, byte [rax]
xor edx, ecx
imul eax, edx, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul eax, r10d, 0x5bd1e995
imul ecx, ecx, 0x5bd1e995
xor ecx, eax
imul edx, ecx, 0x5bd1e995
xor edx, r9d
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
cmp dword [rsp + 0x50], eax
je 0x14000bc18
inc r11d
add rbx, 4
cmp r11d, ebp
jb 0x14000bb50
jmp 0x14000bc1e
movzx r15d, word [r13 + r11*2]
mov r12, qword [rsp + 0x10]
mov ecx, dword [r14 + 0x1c]
mov r14, qword [rsp]
add rcx, rsi
mov r13, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
cmp r15d, ecx
jbe 0x14000bc4b
xor eax, eax
jmp 0x14000bc54
mov eax, r15d
mov eax, dword [rcx + rax*4]
add rax, rsi
add rsp, 0x28
pop r15
pop rsi
ret

Function at 0x14000c150
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r11d, r8d
cmp r8d, 4
jl 0x14000c197
mov r10d, r8d
shr r10, 2
mov eax, r10d
neg eax
lea r8d, [r8 + rax*4]
nop dword [rax]
imul eax, dword [rdx], 0x5bd1e995
add rdx, 4
imul r9d, r9d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r9d, ecx
sub r10, 1
jne 0x14000c170
xor ecx, ecx
sub r8d, 1
je 0x14000c1bb
sub r8d, 1
je 0x14000c1b2
cmp r8d, 1
jne 0x14000c1c0
movzx ecx, byte [rdx + 2]
shl ecx, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor ecx, eax
movzx eax, byte [rdx]
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
imul r8d, r11d, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, r9d, 0x5bd1e995
xor ecx, eax
mov eax, r8d
shr eax, 0x18
xor eax, r8d
imul edx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor edx, eax
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret