joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401febec
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, dword [r9]
mov rax, r8
and dword [rbp - 0x15], 0
lea r9, [rbp - 0x15]
and qword [rsp + 0x20], 0
mov rsi, rdx
mov rbx, rcx
add edi, 4
mov rdx, qword [rax]
mov r8d, edi
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x1401fecc0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x19], eax
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401fecae
and dword [rbp + 0x23], 0
lea rax, str.Sample_file_compression_failed___Cannot_write_compressed_block_data_to_file
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x1f], 0x98
mov dword [rbp + 0x2f], 4
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404814f6]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001208
mov ecx, dword [rbp - 0x19]
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1401fed3f
cmp dword [rbp - 0x15], edi
je 0x1401fed33
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x19], eax
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401fecae
and dword [rbp + 0x23], 0
lea rax, str.Sample_file_compression_failed___didnt_write_all_compressed_data_to_file
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x1f], SysAllocStringByteLen
mov dword [rbp + 0x2f], 4
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404814f6]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001208
jmp 0x1401fecae
add qword [rbx + 0x30], rsi
mov eax, edi
add qword [rbx + 0x38], rax
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401fed64
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x1401fee0d
call fcn.1400550c0
mov rbx, qword [rax + 8]
cmp dword [rbx], 5
jbe 0x1401fee09
and dword [rsp + 0x6c], 0
lea rax, [0x1403ec658]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x30
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
and dword [rsp + 0x7c], 0
mov ecx, 4
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], ecx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x14048160e]
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, rbx
call fcn.140001208
xor eax, eax
jmp 0x1401fee12
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140356560
add rsp, 0x90
pop rbx
ret
Function at 0x1402032a4
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
xor esi, esi
mov rdi, rdx
cmp qword [rdx + 0x18], 8
mov rcx, rdx
mov qword [rbp - 0x29], rsi
jb 0x1402032e2
mov rcx, qword [rdx]
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x2000006
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400543c8
mov rbx, qword [rbp - 0x29]
lea rax, [rbx + 1]
test rax, 0xfffffffffffffffe
jne 0x1402033d9
call fcn.1400550c0
mov r14, qword [rax + 8]
cmp dword [r14], 5
jbe 0x14020349f
cmp qword [rdi + 0x18], 8
lea rax, str.Failed_to_get_a_file_handle
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x38
jb 0x14020335f
mov rdi, qword [rdi]
lea rcx, [0x1403cb630]
mov rax, rsi
test rdi, rdi
je 0x14020337e
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x140203375
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404818cc]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r14
call fcn.140001208
jmp 0x14020349f
lea rdx, [rbp - 0x21]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14020349b
call fcn.1400550c0
mov r14, qword [rax + 8]
cmp dword [r14], 5
jbe 0x14020349f
cmp qword [rdi + 0x18], 8
lea rax, [0x1403ec658]
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x30
jb 0x140203424
mov rdi, qword [rdi]
lea rcx, [0x1403cb630]
mov rax, rsi
test rdi, rdi
je 0x140203443
mov rcx, rdi
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], si
jne 0x14020343a
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], esi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1404818cc]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r14
call fcn.140001208
jmp 0x14020349f
mov rsi, qword [rbp - 0x21]
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1402034b8
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14020cdcc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rbx, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rdx, qword [r9 + 0x10]
jb 0x14020cdee
mov r9, qword [r9]
add rdx, rdx
xor edi, edi
movabs rax, 0xcbf29ce484222325
mov r11, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, rdi
test rdx, rdx
je 0x14020ce33
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rdi
cmp rcx, rdx
jne 0x14020ce10
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14020ce6b
cmp qword [rcx + rdx*8], r8
jne 0x14020ce60
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14020ce64
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14020ce78
cmp qword [rcx + rdx*8], r8
jne 0x14020ce78
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.14020c564
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14020d80c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rbx, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rdx, qword [r9 + 0x10]
jb 0x14020d82e
mov r9, qword [r9]
add rdx, rdx
xor edi, edi
movabs rax, 0xcbf29ce484222325
mov r11, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, rdi
test rdx, rdx
je 0x14020d873
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r9
imul rax, rdi
cmp rcx, rdx
jne 0x14020d850
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14020d8ab
cmp qword [rcx + rdx*8], r8
jne 0x14020d8a0
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14020d8a4
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14020d8b8
cmp qword [rcx + rdx*8], r8
jne 0x14020d8b8
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.14020d8d8
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140215af8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r10, rdx
mov r15, rcx
mov r12, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x140215b33
mov r8, qword [rdx]
movabs rax, 0xcbf29ce484222325
mov r9, r8
lea rdx, [r12 + r12]
lea rcx, [rdx + r8]
xor ebp, ebp
cmp r8, rcx
cmova rdx, rbp
test rdx, rdx
je 0x140215b79
movzx ecx, byte [r9]
xor rax, rcx
movabs r11, 0x100000001b3
imul rax, r11
inc r9
mov rcx, r9
sub rcx, r8
cmp rcx, rdx
jne 0x140215b56
mov r14, qword [r15 + 0x30]
and r14, rax
add r14, r14
mov r13, qword [r15 + 0x18]
mov rbx, qword [r13 + r14*8]
lea rsi, [r15 + 8]
mov rdx, qword [rsi]
cmp qword [r13 + r14*8], rdx
jne 0x140215b9f
mov rax, rdx
jmp 0x140215ba7
mov rax, qword [r13 + r14*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140215c9e
lea rcx, [rbx + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x140215bc1
mov rax, qword [r10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x140215bce
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
cmp r8, r12
jne 0x140215c0f
test r8, r8
je 0x140215c17
movzx ecx, word [r9]
movzx r11d, word [rax]
cmp cx, r11w
jb 0x140215c0f
sub r9, rax
cmp cx, r11w
ja 0x140215c0f
cmp r8, 1
je 0x140215c17
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx r11d, word [rax]
cmp cx, r11w
jae 0x140215bf1
mov rbx, qword [rbx]
jmp 0x140215b93
mov rcx, rbx
mov rdi, rbx
cmp qword [r13 + r14*8], rdx
jne 0x140215c29
mov rax, rdx
jmp 0x140215c31
mov rax, qword [r13 + r14*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140215c95
lea rax, [rbx + 0x10]
mov r8, rax
cmp qword [rax + 0x18], 8
jb 0x140215c47
mov r8, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140215c54
mov r11, qword [r10]
cmp r12, qword [rax + 0x10]
jne 0x140215c95
mov rsi, r12
test r12, r12
je 0x140215cd9
movzx eax, word [r11]
movzx r9d, word [r8]
cmp ax, r9w
jb 0x140215c95
sub r11, r8
cmp ax, r9w
ja 0x140215c95
cmp rsi, 1
je 0x140215cd9
dec rsi
add r8, 2
movzx eax, word [r11 + r8]
movzx r9d, word [r8]
cmp ax, r9w
jae 0x140215c73
lea rsi, [r15 + 8]
cmp rcx, rbx
jne 0x140215ca4
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
cmp rdi, rbx
je 0x140215cb7
inc rbp
mov rax, qword [rax]
cmp rax, rbx
jne 0x140215cac
cmp rdi, qword [rdx]
jne 0x140215cf4
cmp rbx, rdx
jne 0x140215cf4
mov rcx, rsi
call fcn.140207d60
mov edx, 8
mov rcx, r15
call fcn.14005e790
nop
jmp 0x140215cf9
mov rbx, qword [rbx]
jmp 0x140215c1d
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14020d80c
cmp rdi, rbx
jne 0x140215ce1
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140216da0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
cmp qword [r8 + 0x18], 8
mov r11, rdx
mov r10, qword [r8 + 0x10]
mov rdi, rcx
mov r9, r8
jb 0x140216dd2
mov r9, qword [r8]
xor r13d, r13d
lea rdx, [r10 + r10]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov rbx, r9
cmova rdx, r13
test rdx, rdx
je 0x140216e18
movzx ecx, byte [rbx]
movabs rsi, 0x100000001b3
xor rax, rcx
inc rbx
mov rcx, rbx
sub rcx, r9
imul rax, rsi
cmp rcx, rdx
jne 0x140216df6
mov r14, qword [rdi + 0x30]
mov r12, qword [rdi + 0x18]
and r14, rax
mov rbx, qword [rdi + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], rbx
jne 0x140216e39
mov rcx, rbx
jmp 0x140216e41
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140216f0e
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x140216e5b
mov rdx, qword [r8]
mov r15, qword [rcx + 0x18]
mov r9, rcx
cmp r15, 8
jb 0x140216e6b
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x140216eaa
mov rbp, rsi
test rsi, rsi
je 0x140216eb2
movzx ecx, word [r9]
movzx edi, word [rdx]
cmp cx, di
jb 0x140216eaa
sub r9, rdx
cmp cx, di
ja 0x140216eaa
cmp rbp, 1
je 0x140216eb2
add rdx, 2
dec rbp
movzx ecx, word [rdx + r9]
movzx edi, word [rdx]
cmp cx, di
jae 0x140216e8e
mov rax, qword [rax]
jmp 0x140216e2e
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x140216ebf
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x140216ec9
mov r8, qword [r8]
cmp r10, rsi
jne 0x140216f06
test r10, r10
je 0x140216f09
movzx edx, word [r8]
movzx r9d, word [rcx]
cmp dx, r9w
jb 0x140216f06
sub r8, rcx
cmp dx, r9w
ja 0x140216f06
cmp r10, 1
je 0x140216f09
add rcx, 2
dec r10
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jae 0x140216ee8
mov rax, rbx
mov qword [r11], rax
jmp 0x140216f11
mov qword [r11], rbx
mov rbx, qword [rsp + 0x28]
mov rax, r11
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1402194dc
Capabilities:
Get geographical location

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
lea rsi, [rcx + 0x30]
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x38], xmm0
xor r12d, r12d
mov word [rbp - 0x48], r12w
lea rdx, str.OrgId
lea rcx, [rbp - 0x48]
call fcn.140055574
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14021b1b0
mov rdx, rbx
mov rcx, rax
call fcn.14006fe84
nop
lea rcx, [rbp - 0x48]
call fcn.140055f70
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
lea rdx, str.CyberEndpoint
lea rcx, [rbp - 0x48]
call fcn.140055574
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14021b1b0
mov rdx, rdi
mov rcx, rax
call fcn.14006fe84
nop
lea rcx, [rbp - 0x48]
call fcn.140055f70
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], r12w
lea rdx, str.VortexGeoLocation
lea rcx, [rbp - 0x48]
call fcn.140055574
nop
lea rdx, [rbp - 0x48]
mov rcx, rsi
call fcn.14021b1b0
mov rdx, r14
mov rcx, rax
call fcn.14006fe84
nop
lea rcx, [rbp - 0x48]
call fcn.140055f70
movdqa xmm0, xmmword [0x140420310]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], r12w
lea rdx, [0x1403c68e0]
lea rcx, [rbp - 0x28]
call fcn.140055574
nop
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x48]
lea rcx, [r15 + 0x70]
call fcn.14021b274
mov rcx, qword [rbp - 0x48]
mov eax, dword [rbp + 0x60]
mov dword [rcx + 0x30], eax
lea rcx, [rbp - 0x28]
call fcn.140055f70
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140356560
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140219700
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x140219751
mov rdx, qword [rdx]
movabs rax, 0xcbf29ce484222325
mov r9, rdx
lea r8, [r10 + r10]
lea rcx, [r8 + rdx]
xor ebx, ebx
cmp rdx, rcx
cmova r8, rbx
test r8, r8
je 0x140219797
movzx ecx, byte [r9]
xor rax, rcx
movabs r11, 0x100000001b3
imul rax, r11
inc r9
mov rcx, r9
sub rcx, rdx
cmp rcx, r8
jne 0x140219774
mov r12, qword [rsi + 0xa0]
and r12, rax
add r12, r12
mov r13, qword [rsi + 0x88]
mov rax, qword [r13 + r12*8]
mov r11, qword [rsi + 0x78]
cmp qword [r13 + r12*8], r11
jne 0x1402197c0
mov rcx, r11
jmp 0x1402197c8
mov rcx, qword [r13 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140219895
lea rcx, [rax + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1402197e2
mov rdx, qword [rdi]
mov r8, rcx
mov r15, qword [rcx + 0x18]
cmp r15, 8
jb 0x1402197f2
mov r8, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r10
jne 0x140219836
mov r14, rsi
test rsi, rsi
je 0x14021983e
movzx ecx, word [r8]
movzx r9d, word [rdx]
cmp cx, r9w
jb 0x140219836
sub r8, rdx
cmp cx, r9w
ja 0x140219836
cmp r14, 1
je 0x14021983e
dec r14
add rdx, 2
movzx ecx, word [rdx + r8]
movzx r9d, word [rdx]
cmp cx, r9w
jae 0x140219818
mov rax, qword [rax]
jmp 0x1402197b4
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x14021984b
mov rcx, qword [rcx]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140219858
mov rdx, qword [rdi]
cmp r10, rsi
jne 0x140219895
test r10, r10
je 0x140219898
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x140219895
sub rdx, rcx
cmp r8w, r9w
ja 0x140219895
cmp r10, 1
je 0x140219898
dec r10
add rcx, 2
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x140219877
mov rax, r11
cmp rax, r11
je 0x1402198ae
mov ecx, dword [rax + 0x30]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], ecx
mov al, 1
jmp 0x140219939
lea rcx, [rsp + 0x30]
call fcn.1401962c0
nop
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, qword [rsp + 0x48]
call fcn.140219650
test al, al
je 0x140219918
lea rcx, [rsp + 0x30]
call fcn.140196848
test al, al
je 0x140219918
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x80]
call qword [str.p76_]
mov rdx, qword [rsp + 0x38]
mov dword [rdx], eax
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [str.p76_]
mov al, 1
jmp 0x140219939
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140219937
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.p76_]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140356560
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140219970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x38], r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rdx
mov r10, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1402199c1
mov rdx, qword [rdx]
movabs rax, 0xcbf29ce484222325
mov r9, rdx
lea r8, [r10 + r10]
lea rcx, [r8 + rdx]
xor edi, edi
cmp rdx, rcx
cmova r8, rdi
test r8, r8
je 0x140219a07
movzx ecx, byte [r9]
xor rax, rcx
movabs r11, 0x100000001b3
imul rax, r11
inc r9
mov rcx, r9
sub rcx, rdx
cmp rcx, r8
jne 0x1402199e4
mov r12, qword [rsi + 0x60]
and r12, rax
add r12, r12
mov r13, qword [rsi + 0x48]
mov rdx, qword [r13 + r12*8]
mov r11, qword [rsi + 0x38]
cmp qword [r13 + r12*8], r11
jne 0x140219a2a
mov rax, r11
jmp 0x140219a32
mov rax, qword [r13 + r12*8 + 8]
mov rax, qword [rax]
cmp rdx, rax
je 0x140219aff
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140219a4c
mov rcx, qword [rbx]
mov r8, rax
mov r15, qword [rax + 0x18]
cmp r15, 8
jb 0x140219a5c
mov r8, qword [rax]
mov rsi, qword [rax + 0x10]
cmp rsi, r10
jne 0x140219aa0
mov r14, rsi
test rsi, rsi
je 0x140219aa8
movzx eax, word [r8]
movzx r9d, word [rcx]
cmp ax, r9w
jb 0x140219aa0
sub r8, rcx
cmp ax, r9w
ja 0x140219aa0
cmp r14, 1
je 0x140219aa8
dec r14
add rcx, 2
movzx eax, word [rcx + r8]
movzx r9d, word [rcx]
cmp ax, r9w
jae 0x140219a82
mov rdx, qword [rdx]
jmp 0x140219a1e
lea rax, [rdx + 0x10]
cmp r15, 8
jb 0x140219ab5
mov rax, qword [rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140219ac2
mov rcx, qword [rbx]
cmp r10, rsi
jne 0x140219aff
test r10, r10
je 0x140219b02
movzx r8d, word [rcx]
movzx r9d, word [rax]
cmp r8w, r9w
jb 0x140219aff
sub rcx, rax
cmp r8w, r9w
ja 0x140219aff
cmp r10, 1
je 0x140219b02
dec r10
add rax, 2
movzx r8d, word [rax + rcx]
movzx r9d, word [rax]
cmp r8w, r9w
jae 0x140219ae1
mov rdx, r11
cmp rdx, r11
je 0x140219b1c
add rdx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.14006fe84
mov al, 1
jmp 0x140219bc9
lea rcx, [rsp + 0x30]
call fcn.1401962c0
nop
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call fcn.140219650
test al, al
je 0x140219ba5
mov rbx, qword [rsp + 0x30]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x58]
call qword [str.p76_]
cmp eax, 2
jne 0x140219b94
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb0]
call qword [str.p76_]
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call fcn.14006fe84
nop
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
mov rax, qword [rax + 0xc0]
call qword [str.p76_]
mov al, 1
jmp 0x140219bc9
jmp 0x140219baa
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140219bc7
mov rax, qword [rbx]
mov rcx, rbx
mov edx, 1
mov rax, qword [rax + 0xc0]
call qword [str.p76_]
xor al, al
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140356560
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14021b274
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rsi, rdx
mov rbx, qword [r8 + 0x10]
mov r15, rcx
mov r9, r8
jb 0x14021b2a7
mov r9, qword [r8]
xor edi, edi
lea rdx, [rbx + rbx]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r10, r9
cmova rdx, rdi
test rdx, rdx
je 0x14021b2ed
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x14021b2ca
mov r14, qword [r15 + 0x30]
mov r13, qword [r15 + 0x18]
and r14, rax
mov r11, qword [r15 + 8]
add r14, r14
mov rax, qword [r13 + r14*8]
cmp qword [r13 + r14*8], r11
jne 0x14021b310
mov rcx, r11
jmp 0x14021b318
mov rcx, qword [r13 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14021b3f3
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x14021b332
mov rdx, qword [r8]
mov r12, qword [rcx + 0x18]
mov r9, rcx
cmp r12, 8
jb 0x14021b342
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, rbx
jne 0x14021b386
mov rbp, rdi
test rdi, rdi
je 0x14021b38e
movzx ecx, word [r9]
movzx r10d, word [rdx]
cmp cx, r10w
jb 0x14021b386
sub r9, rdx
cmp cx, r10w
ja 0x14021b386
cmp rbp, 1
je 0x14021b38e
add rdx, 2
dec rbp
movzx ecx, word [r9 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jae 0x14021b368
mov rax, qword [rax]
jmp 0x14021b304
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x14021b39b
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x14021b3a8
mov rdx, qword [r8]
cmp rbx, rdi
jne 0x14021b3e9
xor edi, edi
test rbx, rbx
je 0x14021b3ee
movzx r9d, word [rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x14021b3eb
sub rdx, rcx
cmp r9w, r10w
ja 0x14021b3eb
cmp rbx, 1
je 0x14021b3ee
add rcx, 2
dec rbx
movzx r9d, word [rcx + rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x14021b3c9
jmp 0x14021b3eb
xor edi, edi
mov rax, r11
mov rcx, rax
jmp 0x14021b3fb
mov rax, r11
mov rcx, r11
xor edi, edi
cmp rcx, r11
jne 0x14021b475
mov rbx, qword [r11]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14021b7e4
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14021b44f
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140216180
jmp 0x14021b47c
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret