joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094654
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdx, rcx
mov edi, reloc.OLEAUT32.dll_SafeArrayGetLBound
lea rcx, [rsp + 0x20]
lea ebx, [rdi - 0x12]
mov r8b, bl
call fcn.140062650
cmp qword [rsp + 0x38], 8
lea r8, [rsp + 0x20]
mov r11, qword [rsp + 0x30]
movabs rcx, 0xcbf29ce484222325
cmovae r8, qword [rsp + 0x20]
xor edx, edx
lea r9, [r11 + r11]
test r9, r9
je 0x1400946da
movzx eax, byte [rdx + r8]
movabs r10, 0x100000001b3
xor rcx, rax
add rdx, rbx
imul rcx, r10
cmp rdx, r9
jb 0x1400946bc
and rcx, qword [0x1404a42f0]
mov r15, qword [0x1404a42d8]
mov rax, rcx
mov r10, qword [0x1404a42c8]
add rax, rax
lea r12, [rcx + rcx]
mov rax, qword [r15 + rax*8]
cmp qword [r15 + r12*8], r10
jne 0x140094708
mov rcx, r10
jmp 0x140094710
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400947c7
cmp qword [rsp + 0x38], 8
lea rdx, [rax + 0x10]
mov r14, qword [rdx + 0x18]
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
mov r8, rdx
cmp r14, 8
jb 0x14009473e
mov r8, qword [rdx]
mov rbp, qword [rdx + 0x10]
cmp rbp, r11
jne 0x140094770
mov rsi, rbp
test rbp, rbp
je 0x14009476a
sub r8, rcx
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jne 0x140094775
add rcx, 2
sub rsi, rbx
jne 0x140094752
xor ecx, ecx
test ecx, ecx
je 0x14009477e
mov rax, qword [rax]
jmp 0x1400946fd
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, ebx
jmp 0x14009476c
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14009478b
mov rcx, qword [rcx]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
cmovae rdx, qword [rsp + 0x20]
cmp r11, rbp
jne 0x1400947c7
test r11, r11
je 0x1400947c1
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400947d3
add rcx, 2
sub r11, rbx
jne 0x1400947a9
xor ecx, ecx
test ecx, ecx
je 0x1400947ca
mov rax, r10
cmp rax, r10
jne 0x1400947dc
xor bl, bl
jmp 0x1400947df
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, ebx
jmp 0x1400947c3
mov edi, dword [rax + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14004e0f0
mov eax, reloc.OLEAUT32.dll_SafeArrayGetLBound
test bl, bl
cmove edi, eax
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14009cb94
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009cbc1
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14009cbf5
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14009cbd7
and rcx, qword [0x1404a4350]
mov r14, qword [0x1404a4338]
mov rax, rcx
mov r10, qword [0x1404a4328]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009cc23
mov rcx, r10
jmp 0x14009cc2b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009ccd8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14009cc45
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14009cc55
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14009cc87
mov rdi, rsi
test rsi, rsi
je 0x14009cc81
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009cc8c
add r8, 2
sub rdi, 1
jne 0x14009cc69
xor ecx, ecx
test ecx, ecx
je 0x14009cc95
mov rax, qword [rax]
jmp 0x14009cc18
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009cc83
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009cca2
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009ccac
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14009ccd8
test r11, r11
je 0x14009ccd2
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14009cce4
add rcx, 2
sub r11, 1
jne 0x14009ccb9
xor ecx, ecx
test ecx, ecx
je 0x14009ccdb
mov rax, r10
cmp rax, r10
jne 0x14009cced
xor al, al
jmp 0x14009ccf6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009ccd4
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14009d180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [rdx]
mov ebx, r8d
xor edx, edx
mov r9, rcx
test rax, rax
je 0x14009d2b2
mov r11, qword [rax + 0x40]
movabs r8, 0xcbf29ce484222325
mov qword [rsp + 0x58], r11
mov r10, r8
mov ecx, edx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rcx + 0x58]
inc rcx
xor r10, rax
imul r10, rbp
cmp rcx, 8
jb 0x14009d1ca
mov rcx, qword [r9 + 0x70]
and rcx, r10
mov r10, qword [r9 + 0x58]
mov rax, rcx
add rax, rax
lea rdi, [rcx + rcx]
mov rsi, qword [r10 + rdi*8]
mov rax, qword [r10 + rax*8]
cmp rsi, qword [r9 + 0x48]
jne 0x14009d208
mov rcx, qword [r9 + 0x48]
jmp 0x14009d210
mov rcx, qword [r10 + rdi*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009d220
cmp qword [rax + 0x10], r11
je 0x14009d224
mov rax, qword [rax]
jmp 0x14009d1fc
mov rax, qword [r9 + 0x48]
cmp rax, qword [r9 + 0x48]
jne 0x14009d289
mov qword [rsp + 0x58], r11
movzx eax, byte [rsp + rdx + 0x58]
inc rdx
xor r8, rax
imul r8, rbp
cmp rdx, 8
jb 0x14009d22f
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 0x30]
and rcx, r8
mov rax, rcx
add rax, rax
lea r8, [rcx + rcx]
mov r10, qword [rdx + r8*8]
mov rax, qword [rdx + rax*8]
cmp r10, qword [r9 + 8]
jne 0x14009d26d
mov rcx, qword [r9 + 8]
jmp 0x14009d275
mov rcx, qword [rdx + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009d285
cmp qword [rax + 0x10], r11
je 0x14009d289
mov rax, qword [rax]
jmp 0x14009d261
mov rax, qword [r9 + 8]
cmp rax, qword [r9 + 8]
je 0x14009d29d
cmp ebx, dword [rax + 0x130]
jge 0x14009d29d
mov dword [rax + 0x130], ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rdx, str.name_is_null
lea rcx, [rsp + 0x20]
call fcn.140067138
lea rdx, [0x14047c000]
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x14009f2c4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009f2f1
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14009f325
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14009f307
and rcx, qword [0x1404a43d0]
mov r14, qword [0x1404a43b8]
mov rax, rcx
mov r10, qword [0x1404a43a8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009f353
mov rcx, r10
jmp 0x14009f35b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009f408
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14009f375
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14009f385
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14009f3b7
mov rdi, rsi
test rsi, rsi
je 0x14009f3b1
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009f3bc
add r8, 2
sub rdi, 1
jne 0x14009f399
xor ecx, ecx
test ecx, ecx
je 0x14009f3c5
mov rax, qword [rax]
jmp 0x14009f348
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009f3b3
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009f3d2
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009f3dc
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14009f408
test r11, r11
je 0x14009f402
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14009f414
add rcx, 2
sub r11, 1
jne 0x14009f3e9
xor ecx, ecx
test ecx, ecx
je 0x14009f40b
mov rax, r10
cmp rax, r10
jne 0x14009f41d
xor al, al
jmp 0x14009f426
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009f404
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400a01a4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400a01d1
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400a0205
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400a01e7
and rcx, qword [0x1404a4450]
mov r14, qword [0x1404a4438]
mov rax, rcx
mov r10, qword [0x1404a4428]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400a0233
mov rcx, r10
jmp 0x1400a023b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a02e8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400a0255
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400a0265
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400a0297
mov rdi, rsi
test rsi, rsi
je 0x1400a0291
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400a029c
add r8, 2
sub rdi, 1
jne 0x1400a0279
xor ecx, ecx
test ecx, ecx
je 0x1400a02a5
mov rax, qword [rax]
jmp 0x1400a0228
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a0293
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400a02b2
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a02bc
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400a02e8
test r11, r11
je 0x1400a02e2
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400a02f4
add rcx, 2
sub r11, 1
jne 0x1400a02c9
xor ecx, ecx
test ecx, ecx
je 0x1400a02eb
mov rax, r10
cmp rax, r10
jne 0x1400a02fd
xor al, al
jmp 0x1400a0306
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a02e4
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400a0324
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400a0351
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400a0385
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400a0367
and rcx, qword [0x1404a4410]
mov r14, qword [0x1404a43f8]
mov rax, rcx
mov r10, qword [0x1404a43e8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400a03b3
mov rcx, r10
jmp 0x1400a03bb
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a0468
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400a03d5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400a03e5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400a0417
mov rdi, rsi
test rsi, rsi
je 0x1400a0411
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400a041c
add r8, 2
sub rdi, 1
jne 0x1400a03f9
xor ecx, ecx
test ecx, ecx
je 0x1400a0425
mov rax, qword [rax]
jmp 0x1400a03a8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a0413
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400a0432
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a043c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400a0468
test r11, r11
je 0x1400a0462
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400a0474
add rcx, 2
sub r11, 1
jne 0x1400a0449
xor ecx, ecx
test ecx, ecx
je 0x1400a046b
mov rax, r10
cmp rax, r10
jne 0x1400a047d
xor al, al
jmp 0x1400a0486
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a0464
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400a1e20
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edx, dword [rcx + 0x7c]
xor al, al
mov rbx, rcx
cmp edx, 0xffffffff
je 0x1400a1fc7
mov ecx, edx
cmp ecx, 0x7c
je 0x1400a1fc7
cmp ecx, 0x29
jne 0x1400a1e69
cmp dword [rbx + 0x1c], 0
jne 0x1400a1fc7
cmp ecx, ecx
jne 0x1400a1e69
test dword [rbx + 0x80], 0x10000000
je 0x1400a1fe8
cmp ecx, 0x2e
jne 0x1400a1e89
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1400a2014
mov rcx, rbx
call fcn.1400a1dbc
jmp 0x1400a1faf
cmp ecx, 0x5c
jne 0x1400a1ef0
mov rcx, rbx
call fcn.1400a1dbc
test byte [rbx + 0x80], 0x80
je 0x1400a1ee3
cmp word [rbx + 0x78], 0x62
jne 0x1400a1ec1
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1400a2014
mov rcx, rbx
call fcn.1400a1dbc
jmp 0x1400a1fb7
cmp word [rbx + 0x78], 0x42
jne 0x1400a1ee3
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1400a2014
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x1400a1eb4
mov rcx, rbx
call fcn.1400a2224
jmp 0x1400a1faf
cmp ecx, 0x5b
jne 0x1400a1f14
mov rcx, rbx
call fcn.1400a1dbc
mov rcx, rbx
call fcn.1400a20bc
cmp dword [rbx + 0x7c], 0x5d
jne 0x1400a1fd2
jmp 0x1400a1e7c
cmp ecx, 0x28
jne 0x1400a1f38
mov rcx, rbx
call fcn.1400a1dbc
mov rcx, rbx
call fcn.1400a2380
cmp dword [rbx + 0x7c], 0x29
mov dil, al
jne 0x1400a1fdd
jmp 0x1400a1fa2
cmp ecx, 0x5e
jne 0x1400a1f45
lea edx, [rcx - 0x5c]
jmp 0x1400a1eab
cmp ecx, 0x24
jne 0x1400a1f52
lea edx, [rcx - 0x21]
jmp 0x1400a1eab
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400a2009
cmp ecx, 0x3f
je 0x1400a2009
cmp ecx, 0x7b
je 0x1400a2009
cmp edx, 0x7d
jne 0x1400a1f81
test dword [rbx + 0x80], 0x10000000
je 0x1400a1ff3
cmp edx, 0x5d
jne 0x1400a1f92
test dword [rbx + 0x80], 0x10000000
je 0x1400a1ffe
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400a2644
mov dil, 1
mov rcx, rbx
call fcn.1400a1dbc
test dil, dil
je 0x1400a1fb7
mov rcx, rbx
call fcn.1400a2544
mov edx, dword [rbx + 0x7c]
mov al, 1
mov ecx, edx
cmp edx, 0xffffffff
jne 0x1400a1e3d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 4
call fcn.1400a18fc
int3
mov edx, 5
call fcn.1400a18fc
int3
mov edx, 5
call fcn.1400a18fc
int3
mov edx, 6
call fcn.1400a18fc
int3
mov edx, 4
call fcn.1400a18fc
int3
mov edx, 0xa
call fcn.1400a18fc
int3
Function at 0x1400a71c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov r12, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x1400a71fb
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
test r12, r12
je 0x1400a722a
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, r12
jb 0x1400a720c
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rdi, qword [r14 + 8]
add rsi, rsi
mov r13, qword [r14 + 0x18]
cmp rdi, qword [r13 + rsi*8]
je 0x1400a7295
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
jmp 0x1400a728e
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400a7260
mov rdx, qword [rdi + 0x10]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400a726d
mov rcx, qword [rbx]
cmp r12, qword [rdi + 0x20]
jne 0x1400a728e
mov r8, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x1400a728e
mov qword [r15], rdi
mov byte [r15 + 8], al
mov rax, r15
jmp 0x1400a7387
cmp rdi, qword [r13 + rsi*8]
jne 0x1400a724d
mov rax, qword [r14 + 8]
mov r13, qword [rax]
mov r12, qword [r13 + 8]
mov r9, rbx
mov r8, r12
mov rdx, r13
call fcn.1400a771c
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jae 0x1400a72d6
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [r13 + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400a732a
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x1400a7343
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400a7373
cmp qword [rdx + rsi*8], rdi
jne 0x1400a734f
mov qword [rdx + rsi*8], rbx
jmp 0x1400a7373
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400a7373
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400a73a0
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400a7450
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
mov rdi, r8
cmp qword [r10 + 0x18], 0x10
mov rsi, rdx
mov r9, rcx
mov r11, r10
jb 0x1400a7479
mov r11, qword [r10]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [r10 + 0x10], r8
jbe 0x1400a74ab
movzx eax, byte [r8 + r11]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [r10 + 0x10]
jb 0x1400a748c
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400a74e3
cmp qword [rcx + rdx*8], rdi
jne 0x1400a74d8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400a74dc
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400a74f0
cmp qword [rcx + rdx*8], rdi
jne 0x1400a74f0
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r10
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.1400550a8
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a7530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r15, r8
mov r12, rdx
mov r14, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x1400a756c
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x1400a759b
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x1400a757d
mov rsi, qword [r14 + 0x30]
and rsi, rdx
mov rdi, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + rsi*8]
je 0x1400a7639
mov rdi, qword [rax + rsi*8 + 8]
mov rdi, qword [rdi]
jmp 0x1400a7633
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400a75d4
mov rdx, qword [rdi + 0x10]
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400a75e1
mov rcx, qword [r15]
cmp r13, qword [rdi + 0x20]
jne 0x1400a762f
mov r8, r13
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x1400a762f
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.1400550a8
mov rcx, rbx
call fcn.1402e0278
mov qword [r12], rdi
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x1400a76d0
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + rsi*8]
jne 0x1400a75c1
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400a766e
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x1400a768b
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400a76ba
cmp rax, rdi
jne 0x1400a7696
mov qword [rdx + rsi*8], rbx
jmp 0x1400a76ba
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400a76ba
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.1400a73a0
nop
mov qword [r12], rbx
mov byte [r12 + 8], 1
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400abee4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400abf11
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400abf45
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400abf27
and rcx, qword [0x1404bfe30]
mov r14, qword [0x1404bfe18]
mov rax, rcx
mov r10, qword [0x1404bfe08]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400abf73
mov rcx, r10
jmp 0x1400abf7b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400ac028
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400abf95
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400abfa5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400abfd7
mov rdi, rsi
test rsi, rsi
je 0x1400abfd1
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400abfdc
add r8, 2
sub rdi, 1
jne 0x1400abfb9
xor ecx, ecx
test ecx, ecx
je 0x1400abfe5
mov rax, qword [rax]
jmp 0x1400abf68
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400abfd3
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400abff2
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400abffc
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400ac028
test r11, r11
je 0x1400ac022
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400ac034
add rcx, 2
sub r11, 1
jne 0x1400ac009
xor ecx, ecx
test ecx, ecx
je 0x1400ac02b
mov rax, r10
cmp rax, r10
jne 0x1400ac03d
xor al, al
jmp 0x1400ac046
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400ac024
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret