joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180014060
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x180057a00]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180013530
mov r9, rax
test rax, rax
je 0x1800140b9
mov r8, qword [rsp + 0x20]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x180014239
lea rdx, [0x180043c20]
mov rcx, rbx
call fcn.180032ec0
test rax, rax
je 0x1800140f0
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x180014237
cmp edi, 0x78
jne 0x1800140f2
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800143a0
jmp 0x1800140ff
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180032e0c
mov rax, qword [rsp + 0x20]
lea rbp, [0x180042fc0]
cmp rax, rbx
je 0x180014144
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x180014132
nop word [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x180014120
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x180014223
mov edx, 0x2e
mov rcx, rbx
call fcn.180027b90
mov rsi, rax
test rax, rax
je 0x180014237
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x180014164
cmp rcx, 0xc8
ja 0x180014237
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180014190
call fcn.18002f7f8
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x1800141c6
call fcn.1800143a0
jmp 0x1800141cb
call fcn.180032e0c
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x180014237
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x180014202
nop dword [rax]
nop dword [rax + rax]
inc rax
mov qword [rsp + 0x20], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800141f0
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x180014237
lea rcx, [rsp + 0x30]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x180014237
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x180014239
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.18003e8e0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800143a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r13, rdx
mov rbx, rcx
call fcn.18002f7f8
xor esi, esi
lea r11, [0x180042fc0]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x18001440f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x180014400
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180014426
mov r12d, ebp
jmp 0x18001442f
cmp al, 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x180014578
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180014578
movsd xmm2, qword [0x180043c98]
lea r13, [0x180042fc0]
add rdx, 2
nop
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x18001447b
test edi, edi
jne 0x1800144d0
mov edi, ebp
inc rdx
jmp 0x180014460
test byte [r8 + r13 + 1], 0x10
je 0x1800144d0
test r10d, r10d
jne 0x180014493
cmp r8b, 0x30
jne 0x180014493
inc r14d
jmp 0x1800144c4
inc r10d
cmp r10d, 0x1e
jg 0x1800144c1
test byte [rcx + r13 + 1], 2
je 0x1800144a9
add ecx, 0xffffffd0
jmp 0x1800144af
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800144c4
inc r9d
test edi, edi
je 0x1800144cb
dec r9d
inc rdx
jmp 0x180014460
mov r13, qword [rsp + 0x58]
lea eax, [r14 + r10]
test eax, eax
je 0x180014578
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x18001455f
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x180014507
lea rdx, [r11 + 2]
jmp 0x180014511
cmp al, 0x2b
jne 0x18001450f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180042fc0]
test byte [r8 + r11 + 1], 2
je 0x180014578
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x180014530
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x18001456b
xorps xmm1, xmmword [0x180043ca0]
mov edx, r9d
movaps xmm0, xmm1
call fcn.18002c300
jmp 0x18001457b
xorps xmm0, xmm0
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x180019920
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r9, rcx
xor eax, r8d
test rdx, rdx
je 0x18001994f
nop dword [rax]
movzx r8d, byte [r9 + rdx - 1]
mov ecx, eax
shl ecx, 5
add r8d, ecx
mov ecx, eax
shr ecx, 2
add r8d, ecx
xor eax, r8d
sub rdx, 1
jne 0x180019930
ret
Function at 0x180019bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x180019bd5
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.180019650
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x180019c3d
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, 0x14
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.18000e080
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
call fcn.180040fe0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.1800132c0
int3
Function at 0x180011420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800115d3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18000fd70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180011591
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180011510
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180011585
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x18001154d
mov r8, qword [rax]
cmp r8, rcx
je 0x180011547
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180011585
cmp r9, rax
je 0x180011561
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x1800115ad
cmp r9, rax
jne 0x180011552
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1800114c0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180011585
lea rcx, str.invalid_hash_bucket_count
call fcn.180034bc8
int3
Function at 0x1800115e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180011793
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18000fd70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180011751
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800116d0
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180011745
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x18001170d
mov r8, qword [rax]
cmp r8, rcx
je 0x180011707
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180011745
cmp r9, rax
je 0x180011721
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x18001176d
cmp r9, rax
jne 0x180011712
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180011680
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180011745
lea rcx, str.invalid_hash_bucket_count
call fcn.180034bc8
int3
Function at 0x1800117a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180011953
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18000fd70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180011911
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180011890
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180011905
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x1800118cd
mov r8, qword [rax]
cmp r8, rcx
je 0x1800118c7
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180011905
cmp r9, rax
je 0x1800118e1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x18001192d
cmp r9, rax
jne 0x1800118d2
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180011840
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180011905
lea rcx, str.invalid_hash_bucket_count
call fcn.180034bc8
int3
Function at 0x180011e40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov rbp, r8
mov r13, rdx
mov rdx, rcx
cmp r13, r8
je 0x180012075
lea r15, [rcx + 8]
mov r12, qword [r15]
mov qword [rsp + 0x30], r12
mov r8, qword [rcx + 0x18]
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x48], r15
mov rax, qword [r13 + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rax
mov r14, r13
mov qword [rsp + 0x58], r13
mov rax, qword [r13 + 8]
mov qword [rsp + 0x20], rax
movzx ecx, byte [r13 + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
movzx eax, byte [r13 + 0x11]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r13 + 0x12]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r13 + 0x13]
xor rcx, rax
imul rcx, r9
mov rax, qword [rdx + 0x30]
and rax, rcx
shl rax, 4
add rax, r8
mov qword [rsp + 0xb8], rax
mov rcx, qword [rax]
mov qword [rsp + 0xc0], rcx
mov rax, qword [rax + 8]
mov qword [rsp + 0xc8], rax
nop dword [rax]
nop word [rax + rax]
cmp r14, rax
sete dil
mov rbx, r14
mov rsi, qword [r14]
mov r14, rsi
mov qword [rsp + 0x58], rsi
lea rcx, [rbx + 0x10]
mov qword [rsp + 0x40], rcx
add rcx, 8
call fcn.18000f6d0
mov edx, 0x20
mov rcx, rbx
call fcn.180036590
dec qword [r15 + 8]
test dil, dil
jne 0x180011f88
cmp rsi, rbp
mov rax, qword [rsp + 0xc8]
jne 0x180011f20
cmp qword [rsp + 0xc0], r13
jne 0x180012069
mov rax, qword [rsp + 0xb8]
mov qword [rax], rsi
jmp 0x180012069
mov rax, qword [rsp + 0xb8]
cmp qword [rsp + 0xc0], r13
jne 0x180011f9f
mov qword [rax], r12
jmp 0x180011fa4
mov r12, qword [rsp + 0x20]
mov qword [rax + 8], r12
cmp rsi, rbp
je 0x180012069
movzx ecx, byte [r14 + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [r14 + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r14 + 0x12]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r14 + 0x13]
xor rcx, rax
imul rcx, rdx
mov rax, qword [rsp + 0xb0]
mov r13, qword [rax + 0x30]
and r13, rcx
shl r13, 4
add r13, qword [rsp + 0x28]
mov r12, qword [r13 + 8]
nop dword [rax]
nop word [rax + rax]
cmp r14, r12
sete sil
mov rdi, r14
mov rbx, qword [r14]
mov r14, rbx
mov qword [rsp + 0x58], rbx
lea rcx, [rdi + 0x10]
mov qword [rsp + 0xb8], rcx
add rcx, 8
call fcn.18000f6d0
mov edx, 0x20
mov rcx, rdi
call fcn.180036590
dec qword [r15 + 8]
test sil, sil
jne 0x180012089
cmp rbx, rbp
jne 0x180012020
mov qword [r13], rbx
mov rax, qword [rsp + 0x38]
mov qword [rax], r14
mov qword [r14 + 8], rax
mov rax, rbp
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rsp + 0x30]
mov qword [r13], rdx
mov qword [r13 + 8], rdx
cmp rbx, rbp
jmp 0x180011fab
Function at 0x180021770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, rdx
mov rdi, r8
mov rdx, rcx
mov r10, r8
cmp r15, 0x10
jb 0x1800217a2
mov r10, qword [r8]
mov rsi, qword [r8 + 0x10]
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
test rsi, rsi
je 0x1800217e4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rsi
jb 0x1800217d0
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
and rcx, r9
mov r12, qword [rdx + 8]
add rcx, rcx
mov qword [rsp + 0x40], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x180021852
mov rbp, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x18002181f
mov rdx, qword [rbx + 0x10]
mov rcx, rdi
cmp r15, 0x10
jb 0x18002182b
mov rcx, qword [rdi]
cmp rsi, qword [rbx + 0x20]
jne 0x18002183d
mov r8, rsi
call fcn.180038e40
test eax, eax
je 0x180021848
cmp rbx, rbp
je 0x180021852
mov rbx, qword [rbx + 8]
jmp 0x180021810
test rbx, rbx
je 0x180021852
mov qword [r14], rbx
jmp 0x180021855
mov qword [r14], r12
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1800228a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov r14, r8
mov rbp, rdx
mov r10, rcx
cmp rdx, r8
je 0x180022ab9
lea r12, [rcx + 8]
mov qword [rsp + 0x28], r12
mov rax, qword [r12]
mov qword [rsp + 0xc0], rax
mov r11, qword [rcx + 0x18]
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x40], r12
mov rax, qword [rdx + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov qword [rsp + 0x50], rdx
mov rax, qword [rdx + 8]
mov qword [rsp + 0x20], rax
lea r8, [rdx + 0x10]
cmp qword [rdx + 0x28], 0x10
jb 0x180022918
mov r8, qword [rdx + 0x10]
movabs rdx, 0xcbf29ce484222325
mov r9, qword [rbp + 0x20]
xor ecx, ecx
movabs rbx, 0x100000001b3
test r9, r9
je 0x180022954
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, r9
jb 0x180022940
mov r13, qword [r10 + 0x30]
and r13, rdx
shl r13, 4
add r13, r11
mov rax, qword [r13]
mov qword [rsp + 0xb8], rax
mov rax, qword [r13 + 8]
mov qword [rsp + 0xc8], rax
nop word [rax + rax]
cmp rsi, rax
sete dil
mov rbx, rsi
mov r15, qword [rsi]
mov rsi, r15
mov qword [rsp + 0x50], r15
lea rcx, [rbx + 0x10]
call fcn.180022d20
mov edx, 0x40
mov rcx, rbx
call fcn.180036590
dec qword [r12 + 8]
test dil, dil
jne 0x1800229d9
cmp r15, r14
mov rax, qword [rsp + 0xc8]
jne 0x180022980
cmp qword [rsp + 0xb8], rbp
jne 0x180022aad
mov qword [r13], r15
jmp 0x180022aad
cmp qword [rsp + 0xb8], rbp
jne 0x1800229f1
mov rax, qword [rsp + 0xc0]
mov qword [r13], rax
jmp 0x1800229f6
mov rax, qword [rsp + 0x20]
mov qword [r13 + 8], rax
cmp r15, r14
je 0x180022aad
lea r8, [rsi + 0x10]
cmp qword [rsi + 0x28], 0x10
jb 0x180022a12
mov r8, qword [rsi + 0x10]
movabs rdx, 0xcbf29ce484222325
mov r9, qword [rsi + 0x20]
xor eax, eax
test r9, r9
je 0x180022a4a
movabs r12, 0x100000001b3
movzx ecx, byte [rax + r8]
xor rdx, rcx
imul rdx, r12
inc rax
cmp rax, r9
jb 0x180022a31
mov r12, qword [rsp + 0x28]
mov rax, qword [rsp + 0xb0]
mov r15, qword [rax + 0x30]
and r15, rdx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r13, qword [r15 + 8]
nop word [rax + rax]
cmp rsi, r13
sete dil
mov rbx, rsi
mov rbp, qword [rsi]
mov rsi, rbp
mov qword [rsp + 0x50], rbp
lea rcx, [rbx + 0x10]
call fcn.180022d20
mov edx, 0x40
mov rcx, rbx
call fcn.180036590
dec qword [r12 + 8]
test dil, dil
jne 0x180022acd
cmp rbp, r14
jne 0x180022a70
mov qword [r15], rbp
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov rax, r14
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0xc0]
mov qword [r15], rcx
mov qword [r15 + 8], rcx
cmp rbp, r14
jmp 0x1800229fd
Function at 0x10000e360
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
push rdi
push rsi
lea rsp, [rsp - 0x20]
mov ax, word [0x10003b2a0]
cmp ax, 0xcb
je 0x10000e49c
cmp ax, 0xcc
je 0x10000e49c
nop
mov rax, qword [0x1000539f0]
test rax, rax
je 0x10000e39d
mov ecx, dword [0x1000537e0]
call rax
mov rbx, rax
jmp 0x10000e3a4
lea rbx, [0x1000537e8]
cmp word [0x1000537d0], 0
jle 0x10000e3cc
lea rcx, [0x1000537a0]
call fcn.10000e680
mov rcx, rbx
call fcn.10000de20
mov rcx, rbx
call fcn.10000deb0
nop
mov rsi, qword [rbx]
jmp 0x10000e3f9
mov rdi, qword [rsi + 8]
mov rax, qword [rsi]
and rax, 1
jne 0x10000e3f2
mov rdx, rsi
mov rcx, rbx
call fcn.10000d0a0
jmp 0x10000e3f6
and qword [rsi], 0xfffffffffffffffe
mov rsi, rdi
test rsi, rsi
jne 0x10000e3d8
mov qword [rbx], 0
mov dword [rbx + 0x90], 0
cmp word [0x1000537d0], 0
jle 0x10000e49c
lea rdx, [0x1000536b0]
mov rcx, rbx
call fcn.10000d220
mov rsi, rax
test rax, rax
je 0x10000e468
mov rax, qword [0x100053750]
mov qword [rsi + 0x18], rax
cmp qword [0x100053750], 0
je 0x10000e458
mov rax, qword [0x100053750]
mov qword [rax + 0x10], rsi
nop dword [rax]
mov rax, qword [rbx + 0xa0]
mov qword [0x100053750], rax
nop
sub word [0x1000537d0], 1
cmp word [0x1000537d0], 0
sete bl
lea rcx, [0x1000537a0]
call fcn.10000e6a0
test bl, bl
je 0x10000e49c
lea rcx, [0x1000537a0]
call fcn.10000e660
nop dword [rax]
nop
lea rsp, [rsp + 0x20]
pop rsi
pop rdi
pop rbx
ret
Function at 0x100010af0
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push rsi
push r12
push r13
push r14
lea rsp, [rsp - 0x128]
xor esi, esi
mov qword [0x1000533d0], 0
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x24]
mov r8d, 0x104
xor ecx, ecx
call sub.kernel32.dll_GetModuleFileNameA
mov ebx, eax
and eax, eax
mov byte [rsp + rax + 0x24], 0
mov r8d, ebx
xor edx, edx
mov rcx, rsp
call fcn.100010cd0
movsxd rax, ebx
lea r8, [rax + 1]
mov rax, qword [0x1000533d0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x24]
call fcn.100001ea0
call sub.kernel32.dll_GetCommandLineA
mov qword [0x10003b310], rax
mov r14, rax
jmp 0x100010c77
add r14, 1
movzx eax, byte [r14]
sub eax, 1
cmp eax, 0x20
jb 0x100010b78
cmp byte [r14], 0
je 0x100010c81
nop
xor dil, dil
mov r12, r14
xor ebx, ebx
jmp 0x100010be0
mov al, byte [r14]
cmp al, 1
jb 0x100010bd8
sub al, 0x20
jbe 0x100010bb4
sub al, 2
je 0x100010bc0
jmp 0x100010bd8
test dil, dil
je 0x100010be6
add ebx, 1
jmp 0x100010bdc
cmp byte [r14 + 1], 0x22
je 0x100010bd0
test dil, dil
sete dil
jmp 0x100010bdc
add r14, 1
jmp 0x100010bdc
add ebx, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100010ba0
test esi, esi
je 0x100010c74
mov r8d, ebx
mov edx, esi
mov rcx, rsp
call fcn.100010cd0
xor dil, dil
mov r14, r12
mov rdx, qword [0x1000533d0]
movsxd rax, esi
mov r13, qword [rdx + rax*8]
jmp 0x100010c68
mov al, byte [r14]
cmp al, 1
jb 0x100010c58
sub al, 0x20
jbe 0x100010c2c
sub al, 2
je 0x100010c40
jmp 0x100010c58
test dil, dil
je 0x100010c6e
mov al, byte [r14]
mov byte [r13], al
add r13, 1
jmp 0x100010c64
cmp byte [r14 + 1], 0x22
je 0x100010c50
test dil, dil
sete dil
jmp 0x100010c64
add r14, 1
jmp 0x100010c64
mov al, byte [r14]
mov byte [r13], al
add r13, 1
nop
add r14, 1
cmp byte [r14], 0
jne 0x100010c18
mov byte [r13], 0
nop
add esi, 1
cmp byte [r14], 0
jne 0x100010b7c
mov dword [0x1000533c0], esi
movsxd rax, esi
lea rdx, [rax + 1]
shl rdx, 3
lea rcx, [0x1000533d0]
call fcn.10000e140
mov rax, qword [0x1000533d0]
movsxd rsi, esi
mov qword [rax + rsi*8], 0
nop
lea rsp, [rsp + 0x128]
pop r14
pop r13
pop r12
pop rsi
pop rdi
pop rbx
ret

Function at 0x100014670
Capabilities:
Create process on windows

Disassembly:
jmp qword [sym.imp.kernel32.dll_CreateProcessA]
jmp 0x1000014c0

Function at 0x100014690
Capabilities:
Get file attributes

Disassembly:
jmp qword [sym.imp.kernel32.dll_GetFileAttributesA]
jmp 0x1000014b0