joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b720
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0x70
mov r14, r8
mov rsi, rdx
mov r13, rcx
cmp qword [rdx + 0x10], 0
jne 0x14007b781
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x14007b910
lea rax, str.Invalid__empty__setting_name__ignored
mov qword [rsp + 0x20], rax
mov r9d, 0x116
lea r8, str.Intel::Analytics::CALEScriptHostImpl::AddSetting
lea rdx, str.E:BT227953e1_7041_41ca_b223_f1309dea168eClientAnalyticsSDK_srcALEScriptHostImplALEScriptHostImpl.cpp
mov ecx, 1
call fcn.14003209c
jmp 0x14007b910
lea rbx, [rcx + 0x10]
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call fcn.1400f6188
test eax, eax
jne 0x14007b924
mov r10, qword [rsi + 0x10]
mov r8, rsi
mov rbp, qword [rsi + 0x18]
cmp rbp, 8
jb 0x14007b7ae
mov r8, qword [rsi]
movabs rdx, 0xcbf29ce484222325
lea r9, [r10 + r10]
xor ecx, ecx
test r9, r9
je 0x14007b7e4
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r11
inc rcx
cmp rcx, r9
jb 0x14007b7d0
mov rcx, qword [r13 + 0x90]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x78]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r13 + 0x68]
je 0x14007b8e7
mov r11, qword [rax + rcx*8]
nop dword [rax + rax]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14007b822
mov rax, qword [rax]
mov r9, rsi
cmp rbp, 8
jb 0x14007b82e
mov r9, qword [rsi]
cmp r10, rcx
jne 0x14007b869
mov r8, r10
test r10, r10
je 0x14007b874
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x14007b869
sub r9, rax
cmp cx, dx
ja 0x14007b869
cmp r8, 1
je 0x14007b874
dec r8
add rax, 2
movzx ecx, word [rax + r9]
movzx edx, word [rax]
cmp cx, dx
jae 0x14007b84d
cmp rdi, r11
je 0x14007b8e7
mov rdi, qword [rdi + 8]
jmp 0x14007b810
test rdi, rdi
je 0x14007b8e7
cmp rdi, qword [r13 + 0x68]
je 0x14007b8e7
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x14007b8e7
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14007b89a
mov rax, qword [r14]
mov qword [rsp + 0x40], rax
add rdi, 0x30
cmp qword [rdi + 0x18], 8
jb 0x14007b8ad
mov rdi, qword [rdi]
mov qword [rsp + 0x48], rdi
mov rax, rsi
cmp qword [rsi + 0x18], 8
jb 0x14007b8bf
mov rax, qword [rsi]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
call fcn.140081910
lea rcx, [r13 + 0x60]
mov r8, rsi
lea rdx, [rsp + 0x50]
call fcn.140036e40
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, r14
call fcn.140036dcc
nop
mov rcx, rbx
call fcn.1400f61ac
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.1400f62bc
int3
Function at 0x14007b930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x14007b930
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rdx
mov r14, rcx
cmp qword [rdx + 0x10], 0
jne 0x14007b990
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x14007bafb
lea rax, str.Invalid__empty__setting_name__ignored
mov qword [rsp + 0x20], rax
mov r9d, 0x127
lea r8, str.Intel::Analytics::CALEScriptHostImpl::RemoveSetting
lea rdx, str.E:BT227953e1_7041_41ca_b223_f1309dea168eClientAnalyticsSDK_srcALEScriptHostImplALEScriptHostImpl.cpp
mov ecx, 1
call fcn.14003209c
jmp 0x14007bafb
lea rbx, [rcx + 0x10]
mov qword [rsp + 0x38], rbx
mov rcx, rbx
call fcn.1400f6188
test eax, eax
jne 0x14007bb0e
mov r11, qword [rdi + 0x10]
mov r8, rdi
mov rbp, qword [rdi + 0x18]
cmp rbp, 8
jb 0x14007b9bd
mov r8, qword [rdi]
movabs rdx, 0xcbf29ce484222325
lea r9, [r11 + r11]
xor ecx, ecx
test r9, r9
je 0x14007b9f4
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x14007b9e0
mov rcx, qword [r14 + 0x90]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x78]
mov r10, qword [rax + rcx*8 + 8]
cmp r10, qword [r14 + 0x68]
je 0x14007ba89
mov rsi, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rax, [r10 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14007ba32
mov rax, qword [rax]
mov r9, rdi
cmp rbp, 8
jb 0x14007ba3e
mov r9, qword [rdi]
cmp r11, rcx
jne 0x14007ba79
mov r8, r11
test r11, r11
je 0x14007ba84
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x14007ba79
sub r9, rax
cmp cx, dx
ja 0x14007ba79
cmp r8, 1
je 0x14007ba84
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14007ba5d
cmp r10, rsi
je 0x14007ba89
mov r10, qword [r10 + 8]
jmp 0x14007ba20
test r10, r10
jne 0x14007ba8d
mov r10, qword [r14 + 0x68]
lea rcx, [r14 + 0x60]
cmp r10, qword [rcx + 8]
jne 0x14007baea
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x14007baf3
cmp qword [rdi + 0x18], 8
jb 0x14007baaf
mov rdi, qword [rdi]
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.No_such_setting:__s__ignored
mov qword [rsp + 0x20], rax
mov r9d, 0x12e
lea r8, str.Intel::Analytics::CALEScriptHostImpl::RemoveSetting
lea rdx, str.E:BT227953e1_7041_41ca_b223_f1309dea168eClientAnalyticsSDK_srcALEScriptHostImplALEScriptHostImpl.cpp
mov ecx, 1
call fcn.1400323dc
jmp 0x14007baf3
mov rdx, r10
call fcn.140034ba8
nop
mov rcx, rbx
call fcn.1400f61ac
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov ecx, eax
call fcn.1400f62bc
int3
Function at 0x14007fcc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r15
sub rsp, 0x30
mov rsi, qword [r9 + 0x10]
mov rbx, r9
mov r15, qword [rsp + 0x70]
mov r11, r8
mov qword [rsp + 0x28], rdx
mov rdi, rdx
test rsi, rsi
jne 0x14007fd0f
mov r8, r15
mov byte [rsp + 0x20], sil
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400821a0
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
mov qword [rsp + 0x50], rbp
mov r8, rbx
mov rbp, qword [r9 + 0x18]
mov qword [rsp + 0x60], r14
cmp rbp, 8
jb 0x14007fd29
mov r8, qword [r9]
lea r9, [rsi + rsi]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r9, r9
je 0x14007fd64
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x14007fd50
mov rcx, qword [r11 + 0x30]
mov rax, qword [r11 + 0x18]
and rcx, rdx
mov r14, qword [r11 + 8]
add rcx, rcx
mov r10, qword [rax + rcx*8 + 8]
cmp r10, r14
je 0x14007fe05
mov r11, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [r10 + 0x28], 8
lea rax, [r10 + 0x10]
mov rcx, qword [rax + 0x10]
jb 0x14007fda2
mov rax, qword [rax]
mov r9, rbx
cmp rbp, 8
jb 0x14007fdae
mov r9, qword [rbx]
cmp rsi, rcx
jne 0x14007fde5
movzx ecx, word [r9]
mov r8, rsi
movzx edx, word [rax]
cmp cx, dx
jb 0x14007fde5
sub r9, rax
cmp cx, dx
ja 0x14007fde5
cmp r8, 1
je 0x14007fdf0
movzx ecx, word [r9 + rax + 2]
add rax, 2
dec r8
movzx edx, word [rax]
cmp cx, dx
jae 0x14007fdc8
cmp r10, r11
je 0x14007fe05
mov r10, qword [r10 + 8]
jmp 0x14007fd90
test r10, r10
je 0x14007fe05
cmp r10, r14
je 0x14007fe05
mov byte [rsp + 0x20], 1
lea r8, [r10 + 0x30]
jmp 0x14007fe0d
mov byte [rsp + 0x20], 0
mov r8, r15
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400821a0
mov rbp, qword [rsp + 0x50]
mov rax, rdi
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
Function at 0x14007fe40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm0
movups xmmword [rdx + 0x20], xmm0
movups xmmword [rdx + 0x30], xmm0
lea rbx, [rcx + 0x10]
mov qword [rsp + 0x40], rbx
mov rcx, rbx
call fcn.1400f6188
test eax, eax
jne 0x14007fff0
lea rdx, [rdi + 0x60]
mov rcx, r14
call fcn.140073b6c
nop
mov rcx, rbx
call fcn.1400f61ac
mov dword [rsp + 0x20], 3
mov rdi, qword [0x1403ed428]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14007ffcf
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
nop
mov rsi, qword [rbx + 0x20]
lea r8, [rbx + 0x10]
mov r15, qword [rbx + 0x28]
cmp r15, 8
jb 0x14007fef6
mov r8, qword [rbx + 0x10]
mov rdx, r13
lea r9, [rsi + rsi]
xor ecx, ecx
test r9, r9
je 0x14007ff24
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r12
inc rcx
cmp rcx, r9
jb 0x14007ff10
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov r10, qword [rax + rcx*8 + 8]
cmp r10, qword [r14 + 8]
je 0x14007ffb2
mov rbp, qword [rax + rcx*8]
lea rax, [r10 + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14007ff53
mov rax, qword [rax]
lea r9, [rbx + 0x10]
cmp r15, 8
jb 0x14007ff61
mov r9, qword [rbx + 0x10]
cmp rsi, rcx
jne 0x14007ff9c
mov r8, rsi
test rsi, rsi
je 0x14007ffa7
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x14007ff9c
sub r9, rax
cmp cx, dx
ja 0x14007ff9c
cmp r8, 1
je 0x14007ffa7
dec r8
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14007ff80
cmp r10, rbp
je 0x14007ffb2
mov r10, qword [r10 + 8]
jmp 0x14007ff41
test r10, r10
je 0x14007ffb2
cmp qword [r14 + 8], r10
jne 0x14007ffc3
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.140075fd4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14007fee0
mov rax, r14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, eax
call fcn.1400f62bc
int3
Function at 0x140082ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140082ae5
cvtsi2ss xmm0, rdx
jmp 0x140082afa
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1402e31b4
movss xmm1, dword [0x14037f960]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140082b28
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140082b28
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140082b5a
cmp rbx, 0x200
jae 0x140082b57
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140082b5a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14007a2a0
Function at 0x140088ce0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov r14, r8
mov rsi, rdx
mov r13, rcx
mov qword [rbp - 0x41], rdx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], r12w
mov rdx, r9
lea rcx, [rbp - 0x31]
call fcn.140031d84
lea rdx, [rbp - 0x31]
mov rdi, qword [rbp - 0x31]
mov r15, qword [rbp - 0x19]
cmp r15, 8
cmovae rdx, rdi
movabs r9, 0xcbf29ce484222325
mov rax, qword [rbp - 0x21]
lea r8, [rax + rax]
mov ecx, r12d
test r8, r8
je 0x140088d75
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140088d62
lea r8, [rbp - 0x31]
lea rdx, [rbp - 1]
mov rcx, r14
call fcn.14007a6c0
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x140088d92
mov rbx, qword [r14 + 8]
cmp r15, 8
jb 0x140088dcd
lea rdx, [r15*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140088dc5
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140088ed6
mov rcx, rdi
call fcn.14011a254
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], r12w
cmp rbx, qword [r14 + 8]
jne 0x140088dfa
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x41], xmm0
lea rdx, [rbp - 0x41]
mov ecx, 1
mov rax, r12
jmp 0x140088e22
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x140088ed0
mov rax, qword [rcx]
mov r8, qword [r13 + 0x38]
lea rdx, [rbp - 0x11]
call qword [rax + 0x10]
lea rdx, [rbp - 0x11]
mov ecx, 0xa
mov rax, qword [rbp - 0x11]
mov qword [rsi], rax
mov rax, qword [rdx + 8]
mov qword [rsi + 8], rax
mov qword [rdx], r12
mov qword [rdx + 8], r12
or ecx, 4
mov dword [rbp - 0x49], ecx
mov edi, 0xffffffff
test cl, 2
je 0x140088e7f
and ecx, 0xfffffffd
mov dword [rbp - 0x49], ecx
mov rbx, qword [rbp - 9]
test rbx, rbx
je 0x140088e7f
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140088e7c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140088e7c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov ecx, dword [rbp - 0x49]
test cl, 1
je 0x140088eb9
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x140088eb9
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140088eb9
mov rbx, qword [rbp - 0x39]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x140088eb9
mov rcx, qword [rbp - 0x39]
mov rdx, qword [rcx]
call qword [rdx + 8]
mov rax, rsi
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400f51ec
int3
call fcn.14013d31c
int3
Function at 0x14008ec10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], rdx
mov rbx, rdx
mov r15, rcx
mov qword [rsp + 0x60], r8
xor r12d, r12d
mov qword [rsp + 0x48], 7
mov rdx, r8
mov qword [rsp + 0x40], r12
lea rcx, [rsp + 0x30]
mov word [rsp + 0x30], r12w
call fcn.140031d84
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
movabs r9, 0xcbf29ce484222325
mov rsi, qword [rsp + 0x30]
cmp rbp, 8
mov ecx, r12d
lea r8, [rax + rax]
cmovae rdx, rsi
test r8, r8
je 0x14008ecb3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14008eca0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [r15 + 0x38]
call fcn.14007a6c0
mov rdi, qword [rax + 8]
test rdi, rdi
jne 0x14008ecd3
mov rdi, qword [r15 + 0x40]
cmp rbp, 8
jb 0x14008ed0e
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14008ed06
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008ed9d
mov rcx, rsi
call fcn.14011a254
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r12w
cmp rdi, qword [r15 + 0x40]
jne 0x14008ed72
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x14008ed69
mov r9d, 0x28
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r8, str.McAfee::Script::CScriptVariableStore::Get
lea rax, str.Unable_to_find_requested_variable__s
lea rdx, str.E:BT_f6ebede3_c182_45d3_88bc_201ba661fbb3ScriptHostJavaScriptScriptableScriptVariableStore_srcScriptVariableStore.cpp
mov qword [rsp + 0x20], rax
lea ecx, [r9 - 0x27]
call fcn.1400323dc
mov qword [rbx], r12
mov qword [rbx + 8], r12
jmp 0x14008ed7e
lea rdx, [rdi + 0x30]
mov rcx, rbx
call fcn.14008f840
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140119fe0
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14013d31c
int3
Function at 0x140090d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1403cd210]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, r8
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x68], r8
test r8, r8
je 0x140090f30
cmp word [r8], 0
je 0x140090f30
lea rbx, [rcx + 0x78]
mov qword [rsp + 0x50], rbx
mov rcx, rbx
call fcn.1400f6188
test eax, eax
jne 0x140090fa1
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.140031d84
lea rdx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
cmp r12, 8
cmovae rdx, r14
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
mov ecx, esi
test r8, r8
je 0x140090e53
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140090e40
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x58]
lea rcx, [r15 + 0x38]
call fcn.14007a6c0
mov rbp, qword [rax + 8]
test rbp, rbp
jne 0x140090e73
mov rbp, qword [r15 + 0x40]
cmp r12, 8
jb 0x140090eae
lea rdx, [r12*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140090ea6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140090f9b
mov rcx, r14
call fcn.14011a254
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
cmp rbp, qword [r15 + 0x40]
jne 0x140090f19
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x140090f08
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, str.Unable_to_find_item_in_context_store._Name:__s
mov qword [rsp + 0x20], rax
mov r9d, 0x3e
lea r8, str.McAfee::Script::ContextItemStorePlugin::Get
lea rdx, str.E:BT_f6ebede3_c182_45d3_88bc_201ba661fbb3ScriptHostJavaScriptScriptablePluginsContextItemStorePlugin_srcContextItemStorePlugin.cpp
lea ecx, [r9 - 0x3d]
call fcn.1400323dc
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov rcx, rbx
call fcn.1400f61ac
jmp 0x140090f70
lea rdx, [rbp + 0x30]
mov rcx, rdi
call fcn.14008f840
nop
mov rcx, rbx
call fcn.1400f61ac
jmp 0x140090f70
mov ecx, 1
call fcn.1400e2070
test eax, eax
je 0x140090f67
lea rax, str.Item_name_is_required_for_lookup_from_context_store
mov qword [rsp + 0x20], rax
mov r9d, 0x35
lea r8, str.McAfee::Script::ContextItemStorePlugin::Get
lea rdx, str.E:BT_f6ebede3_c182_45d3_88bc_201ba661fbb3ScriptHostJavaScriptScriptablePluginsContextItemStorePlugin_srcContextItemStorePlugin.cpp
lea ecx, [r9 - 0x34]
call fcn.14003209c
xor esi, esi
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140119fe0
mov rbx, qword [rsp + 0xd8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14013d31c
nop
mov ecx, eax
call fcn.1400f62bc
int3
Function at 0x14009b1c0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
add rsp, 0x30
pop rbx
ret

Function at 0x14009b250
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
add rsp, 0x30
pop rbx
ret

Function at 0x14009b3c0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x40
mov eax, dword [rsp + 0x88]
mov r10, r9
mov r9d, dword [rsp + 0x70]
mov r11d, r8d
mov dword [rsp + 0x30], eax
mov rcx, rdx
mov eax, dword [rsp + 0x80]
mov r8, r10
mov dword [rsp + 0x28], eax
mov edx, r11d
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getnameinfo]
add rsp, 0x40
pop rbx
ret
Function at 0x14009ed00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x14009ee94
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x14009ee94
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x14009ed9b
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x14009eebb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14009edb2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x14009edb2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x14009edc5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x14009ee12
mov r8d, eax
cmp eax, 0x800
jae 0x14009eddf
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x14009ee12
cmp eax, 0x10000
jae 0x14009edf9
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x14009ee12
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x14009ee94
add qword [r14], 2
test sil, sil
jne 0x14009ee33
cmp r10d, 3
jae 0x14009ee3f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x14009ee71
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x14009ee50
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14009ed4f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14009eea2
Function at 0x1400b88d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400b8a92
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400b8420
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400b8a57
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400b89c3
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400b8a46
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x1400b8a00
mov r10, qword [rax]
cmp r10, rcx
je 0x1400b89fa
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400b8a46
mov r8, rax
cmp r10, rax
je 0x1400b8a22
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400b8a6c
cmp r10, rax
jne 0x1400b8a10
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400b8970
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400b8a46
lea rcx, str.invalid_hash_bucket_count
call fcn.1400f5230
int3