joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14112ec78
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl cx, 0x87
xor eax, 0x99b05ead
mov qword [rsp + r10 - 0xa380], rdi
and ebp, ebp
sub r10w, 0x25b6
dec eax
add rcx, 0xffffffffd4b46139
bswap eax
sub qword [rsp + rcx + 0x3b8dedf], r10
call fcn.141191368
xor bp, r11w
adc sil, 0x27
movsx edx, bp
xor r11w, 0x8617
not sil
sub rax, r11
sbb r11, 0xfaa2dbe
add r11w, 0x27be
sub sil, 0x28
xor r10b, sil
jmp 0x14113c7c6

Function at 0x14116c7f4
Capabilities:
Encode data using base64
Execute anti-debugging instructions

Disassembly:
mov rcx, qword [rsp + r11 - 0xccabcfb]
movzx r12d, word [rsp + r11 - 0xccabd33]
mov r10, qword [rsp + r11 - 0xccabcf3]
push r11
mov r9, qword [rsp + r11 - 0xccabce3]
mov r12, qword [rsp + r11*4 - 0x332af48c]
mov rbp, qword [rsp + r11*4 - 0x332af484]
mov rbx, qword [rsp + r11*2 - 0x19957a06]
bswap r11
movzx r15d, r8w
lea rax, [r8 + r11 - 0x245de973]
mov r11, qword [rsp + r8 + 0x206f591e]
mov r8, qword [rsp + r15*2 - 0x14e34]
mov r15, qword [rsp + r15*4 - 0x29ce0]
call fcn.141136c18

Function at 0x141183c8c
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [rbx + r11*4 - 0x31cc8]
lea r8, [rsi + r11*4 - 0x29d7c6c4]
movzx ebp, r11b
add sil, r8b
lea rbx, [rbx + r11 - 0xc72e]
neg byte [rsp + r11 - 0xc72a]
xor word [rsp + rbp - 0x28], 0xfc29
movsx ecx, si
xor eax, r10d
pop rcx
call fcn.141128355
lea rbp, [rax + rdi - 0x22eaded8]
xor dword [rsp + r10*8 - 0x4d44c008], r11d
pop r8
dec dil
bswap r10
movsxd r11, r11d
dec eax
add rsi, r11
xor rax, 0x2f8dc229
mov edi, dword [rbx + rdi*2 - 0x1fe]
jno 0x14113c300

Function at 0x141187bfb
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
mov qword [rsp + 8], rax
lea rsp, [rsp + 8]
Function at 0x1411a352b
Capabilities:
Parse pe header

Disassembly:
mov r10, qword [rsp + r11*8 - 0x75530]
setae dl
mov qword [rsp + r11 - 0xea98], 0xffffffffe413211c
inc byte [rsp + rdx - 0x771777ff]
movsxd rbp, ebp
and r8, 0x3316e2b0
rol word [rsp + rdx - 0x771777f1], 0x4d
adc rdi, rbp
xadd word [rsp + r8*2 - 0x6628851e], dx
pop r11
pop rax
pop rdx
jp fcn.1410bdcb0
movzx r11d, byte [rbx + rsi*2 - 0x6354f94c]
lea rbx, [rsi + rbx - 0x31aa7ca5]
mov edx, 0x6196e9a
bswap esi
dec esi
mov qword [rsp + rdx - 0x6196e9a], 0xffffffffbb16e525
push rdx
mov qword [rsp + rdx*4 - 0x1865ba60], r10
movzx r8d, dx
sar dword [rsp + rdx*4 - 0x1865ba66], 0x38
xor dword [rsp + rdx - 0x6196e92], esi
xchg qword [rsp + rdx - 0x6196e9a], r8
lea rax, [r8 + rdx*8 + 0x713ed98e]
rol edx, 0xcd
mov r10, qword [rsp + rdx - 0x2dd340bb]
pop r8
movsx ecx, dx
inc r8
movsxd rsi, esi
sal cx, 0x88
adc rdi, rsi
call fcn.141108ccd
pop rbx
pop r11
dec ebp
movsxd rdx, edx
call fcn.1410cecba
sub cl, r8b
lea rbx, [rbx + rdx - 0x7717780e]
xor ebp, r10d
xadd word [rsp + rdx - 0x77177801], ax
neg rax
mov qword [rsp + rdx - 0x77177812], 0xffffffff80beed90
lea ebp, [rbp + rax + 0x1e676973]
movzx r11d, cx
not ebp
jnp 0x141199012
neg ebp
xor ebp, 0xbc39a591
inc dl
mov qword [rsp + r11*2 - 0x1d540], r10
lea rsi, [r8*4 - 0x5d56d3fb]
jo 0x14113cad5
xor dword [rsp + r11*4 - 0x3aa90], ebp
neg byte [rsp + rdx - 0x77177810]
jg 0x1410c4a8c
pop rax
pop rcx
jmp fcn.14107c294

Function at 0x1411a4e51
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
push 0xffffffffee284c26
sal word [rsp], 0xab
cmp ebx, 4
not word [rsp + 6]
lea rsp, [rsp + 8]
jne 0x1410875f5
mov r9d, 0x3abb1c9f
lea r9, [r9*4 + 0x66b5b196]
mov r9, rax
jmp 0x1410971ac
cmp ebx, 3
lea rsp, [rsp + 0x10]
jne 0x14115ad8a
push 0xffffffffea3283aa
mov r8, rax
lea rsp, [rsp + 8]
jmp 0x1410971ac
Function at 0x14004318c
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov ebx, 0x104
mov qword [r8], r15
mov r9d, ebx
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x1400431ff
movzx eax, word [rcx + rdx]
test ax, ax
je 0x1400431ff
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x1400431dd
lea rax, [rdx - 2]
test r9, r9
lea r8, [0x1402c6dd8]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov word [rax], r15w
call fcn.140041934
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x14004326a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x14004333d
mov edx, 0xc8
mov rcx, qword [rbp + 0x168]
lea r8, [0x1402c6d60]
call fcn.140042f94
mov esi, eax
jmp 0x140043340
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], r15d
mov rcx, rdi
mov dword [rsp + 0x20], r15d
call fcn.140043040
mov esi, eax
test eax, eax
jns 0x1400432a7
mov rcx, qword [rbp + 0x168]
lea r8, [0x1402c6d60]
mov r9d, eax
mov edx, 0xce
call fcn.140042f64
jmp 0x140043340
lea r8, [0x1402c6de0]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140041934
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x1400432df
mov edx, 0xd4
jmp 0x140043250
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140043040
mov esi, eax
test eax, eax
jns 0x14004331c
mov rcx, qword [rbp + 0x168]
lea r8, [0x1402c6d60]
mov r9d, eax
mov edx, 0xd6
call fcn.140042f64
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
jne 0x140043340
jmp 0x140043380
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x140043392
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
mov esi, r15d
test rdi, rdi
je 0x140043352
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
test eax, eax
je 0x1400433a4
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14027a710
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [rbp + 0x168]
mov edx, 0x878
call fcn.140042fac
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x878
call fcn.140042fac
int3
mov rcx, qword [rbp + 0x168]
mov edx, 0x878
call fcn.140042fac
int3
Function at 0x1400475b4
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x21], 0
lea rax, str.Sense
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x31], rax
lea rax, [0x140047300]
mov qword [rbp - 0x29], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
mov rcx, qword [rbp + 0x5f]
lea rdx, str.Failed_to_start_service_control_dispatcher
mov qword [rsp + 0x20], rdx
lea r8, str.amcorewcd_source_service_src_service.cpp
mov edx, 0x22a
mov r9d, eax
call fcn.14004858c
cmp qword [0x1403f10b8], 0
jne 0x14004763a
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x1400476cf
jmp 0x1400476e4
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x1400476cf
call fcn.140048a14
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1400476bb
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x39]
and dword [rbp + 0x33], 0
mov edx, 4
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rax
lea rax, str.Service_stopped_with_unexpected_service_status._Terminating_process
mov qword [rbp + 0x27], rax
lea rax, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x39], 0x507
mov dword [rbp + 0x1f], edx
mov dword [rbp + 0x2f], 0x88
mov dword [rbp + 0x3f], edx
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403450fa]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001078
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 2
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14027a710
add rsp, 0xc0
pop rbp
ret
mov ecx, 0x8007000e
call fcn.1400443b8
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_source_service_src_service.cpp
mov r9d, eax
mov edx, 0x22f
lea rax, str.Service_control_dispatcher_failed_without_saying_so...
mov qword [rsp + 0x20], rax
call fcn.140048380
int3
Function at 0x140054868
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r15, rdx
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x14005489a
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rdi, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp qword [rax + rsi*8], rdi
jne 0x1400548d6
mov rbx, rdi
jmp 0x1400548de
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + rsi*8]
je 0x140054909
mov rcx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x1400548f9
cmp rbx, qword [rax + rsi*8]
jne 0x1400548e7
jmp 0x140054909
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1400549f6
mov rdi, qword [rdi]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.140054d5c
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x140054943
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140054996
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x1400549b3
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x1400549e2
cmp rax, rbx
jne 0x1400549be
mov qword [rdx + rsi*8], rdi
jmp 0x1400549e2
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x1400549e2
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.140054a0c
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140054abc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r8 + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x140054ad9
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140054b31
cmp qword [rcx + rdx*8], r8
jne 0x140054b26
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x140054b2a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140054b3e
cmp qword [rcx + rdx*8], r8
jne 0x140054b3e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.14027abd8
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140054bd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140054c08
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x140054c92
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x140054c92
mov rax, qword [r10]
mov rdi, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x140054c62
cmp rdi, qword [rcx + r8*8]
jne 0x140054c50
jmp 0x140054c92
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.14027abd8
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140054d26
mov rax, qword [rbx]
cmp rdi, rax
je 0x140054cc7
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x140054ce4
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140054d13
cmp rax, rdi
jne 0x140054cef
mov qword [rdx + r8*8], rbx
jmp 0x140054d13
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140054d13
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140054a0c
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140056aa8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x1403f04b0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov qword [rbp - 0x51], r9
mov rsi, rcx
xor r14d, r14d
mov dword [rbp - 0x59], r14d
cmp qword [r8 + 0x10], r14
jne 0x140056afd
xor r8d, r8d
lea rcx, [rbp - 0x21]
call fcn.140059288
lea rax, [rbp - 0x21]
lea ebx, [r14 + 5]
jmp 0x140056b0b
lea rcx, [rbp - 1]
call fcn.140056cd8
mov ebx, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x41], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x31], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
test bl, 2
je 0x140056b3c
and ebx, 0xfffffffd
lea rcx, [rbp - 1]
call fcn.1400492c0
nop
mov edi, 1
test dil, bl
je 0x140056b4f
lea rcx, [rbp - 0x21]
call fcn.1400492c0
lea r8, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r8, qword [rbp - 0x41]
movabs rdx, 0xcbf29ce484222325
mov rcx, r14
mov r11, qword [rbp - 0x31]
lea r9, [r11 + r11]
test r9, r9
je 0x140056b95
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
add rcx, rdi
cmp rcx, r9
jb 0x140056b77
mov rcx, qword [rsi + 0x30]
and rcx, rdx
mov r15, qword [rsi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [r15 + rax*8]
lea rdx, [rcx + rcx]
mov qword [rbp - 0x59], rdx
mov rcx, qword [rsi + 8]
cmp qword [r15 + rdx*8], rcx
jne 0x140056bc1
mov rdx, rcx
jmp 0x140056bc9
mov rdx, qword [r15 + rdx*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x140056c94
lea r8, [rax + 0x10]
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
mov r9, r8
mov r14, qword [r8 + 0x18]
cmp r14, 8
jb 0x140056bf4
mov r9, qword [r8]
mov rsi, qword [r8 + 0x10]
cmp rsi, r11
jne 0x140056c31
mov rbx, rsi
test rsi, rsi
je 0x140056c2b
sub r9, rdx
movzx r8d, word [r9 + rdx]
movzx r10d, word [rdx]
cmp r8w, r10w
jne 0x140056c22
add rdx, 2
sub rbx, rdi
jne 0x140056c08
jmp 0x140056c2b
sbb edx, edx
and edx, 0xfffffffe
add edx, edi
jmp 0x140056c2d
xor edx, edx
test edx, edx
je 0x140056c3d
mov rax, qword [rax]
mov rdx, qword [rbp - 0x59]
jmp 0x140056bb6
lea rdx, [rax + 0x10]
cmp r14, 8
jb 0x140056c4a
mov rdx, qword [rdx]
lea r8, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae r8, qword [rbp - 0x41]
xor r14d, r14d
cmp r11, rsi
jne 0x140056c97
test r11, r11
je 0x140056c8b
sub r8, rdx
movzx r9d, word [r8 + rdx]
movzx r10d, word [rdx]
cmp r9w, r10w
jne 0x140056c82
add rdx, 2
sub r11, rdi
jne 0x140056c68
jmp 0x140056c8b
sbb edx, edx
and edx, 0xfffffffe
add edx, edi
jmp 0x140056c8e
mov edx, r14d
test edx, edx
je 0x140056c9a
jmp 0x140056c97
xor r14d, r14d
mov rax, rcx
cmp rax, rcx
je 0x140056cac
movzx ecx, word [rax + 0x30]
mov rax, qword [rbp - 0x51]
mov word [rax], cx
jmp 0x140056caf
mov dil, r14b
lea rcx, [rbp - 0x41]
call fcn.1400492c0
mov al, dil
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14027a710
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005813c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 8
mov r9, qword [rdx + 0x10]
jb 0x14005814a
mov rdx, qword [rdx]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x14005817a
movzx eax, byte [r8 + rdx]
movabs r10, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r10
cmp r8, r9
jb 0x14005815c
mov rax, rcx
ret

Function at 0x1400583b8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov rbx, qword [r8 + 0x10]
mov r14, rcx
mov r10, r8
jb 0x1400583eb
mov r10, qword [r8]
lea rdx, [rbx + rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x14005841e
movzx eax, byte [rcx + r10]
movabs r11, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r11
cmp rcx, rdx
jb 0x140058400
mov rcx, qword [r14 + 0x30]
mov r12, qword [r14 + 0x18]
and rcx, r9
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rcx, qword [r14 + 8]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rcx
jne 0x140058446
mov rdx, rcx
jmp 0x14005844e
mov rdx, qword [r12 + r13*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1400584ff
cmp qword [r8 + 0x18], 8
lea rdx, [rax + 0x10]
mov r9, r8
jb 0x140058468
mov r9, qword [r8]
mov r15, qword [rdx + 0x18]
mov r10, rdx
cmp r15, 8
jb 0x140058478
mov r10, qword [rdx]
mov rbp, qword [rdx + 0x10]
cmp rbp, rbx
jne 0x1400584ab
mov rsi, rbp
test rbp, rbp
je 0x1400584a5
sub r10, r9
movzx edx, word [r10 + r9]
movzx r11d, word [r9]
cmp dx, r11w
jne 0x1400584b0
add r9, 2
sub rsi, 1
jne 0x14005848c
xor edx, edx
test edx, edx
je 0x1400584b9
mov rax, qword [rax]
jmp 0x14005843b
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x1400584a7
lea rdx, [rax + 0x10]
cmp r15, 8
jb 0x1400584c6
mov rdx, qword [rdx]
cmp qword [r8 + 0x18], 8
mov r9, r8
jb 0x1400584d3
mov r9, qword [r8]
cmp rbx, rbp
jne 0x1400584ff
test rbx, rbx
je 0x1400584f9
sub r9, rdx
movzx r10d, word [r9 + rdx]
movzx r11d, word [rdx]
cmp r10w, r11w
jne 0x14005854d
add rdx, 2
sub rbx, 1
jne 0x1400584e0
xor edx, edx
test edx, edx
je 0x140058502
mov rax, rcx
cmp rax, rcx
jne 0x140058580
mov rbx, qword [rcx]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r8, qword [rbx + 8]
call fcn.140058ff8
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r14 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140058556
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
sbb edx, edx
and edx, 0xfffffffe
inc edx
jmp 0x1400584fb
inc rax
mov rcx, r14
mov qword [r14 + 0x10], rax
mov qword [rbx + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdx, rdi
mov r9, qword [r14 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140058bfc
jmp 0x140058587
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rdi
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140058b04
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
movabs rcx, 0xcbf29ce484222325
movzx eax, word [rdi + 0x14]
movzx r10d, word [rdi + 0x16]
xor r10, rax
mov eax, dword [rdi + 0x10]
xor r10, rax
xor r9d, r9d
movzx eax, byte [rdi + r9 + 0x20]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x140058b3b
mov rax, r10
mov rdx, r10
shr rdx, 2
shl rax, 6
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
mov rcx, qword [r8 + 0x18]
xor rdx, r10
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140058baf
cmp qword [rcx + rdx*8], rdi
jne 0x140058ba4
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140058ba8
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140058bbc
cmp qword [rcx + rdx*8], rdi
jne 0x140058bbc
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x28]
dec qword [r8 + 0x10]
call fcn.140056854
mov rcx, rdi
call fcn.14027abd8
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret