joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014dd0
Capabilities:
Send data

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
mov r14, rcx
mov rdi, qword [rcx]
xor ebp, ebp
mov rdx, qword [rcx + 8]
mov r9d, 8
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rsi, qword [rax]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.WININET.dll_HttpSendRequestExW]
test eax, eax
je 0x140014e7f
mov eax, dword [rdi + 0x78]
mov qword [rsp + 0x58], rbx
mov ebx, ebp
test eax, eax
jle 0x140014e7a
nop word [rax + rax]
sub eax, ebx
mov dword [rsp + 0x50], ebp
mov r8d, 0x400
cmp eax, r8d
cmovl r8d, eax
test r8d, r8d
je 0x140014e7a
mov rcx, qword [rdi + 0x60]
lea r9, [rsp + 0x50]
movsxd rdx, ebx
add rdx, qword [rdi + 0x70]
call qword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x140014e7a
add ebx, dword [rsp + 0x50]
test rsi, rsi
je 0x140014e73
mov rax, qword [rsi]
mov r8d, ebx
mov r9d, dword [rdi + 0x78]
mov rcx, rsi
mov rdx, qword [rdi + 8]
call qword [rax + reloc.WS2_32.dll_htonl]
test al, al
je 0x140014e7a
mov eax, dword [rdi + 0x78]
cmp ebx, eax
jl 0x140014e20
mov rbx, qword [rsp + 0x58]
mov rcx, qword [r14]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x60]
call qword [sym.imp.WININET.dll_HttpEndRequestW]
mov rbp, qword [rsp + 0x60]
test eax, eax
setne al
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14002bfb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r11, rcx
movzx r10d, r8b
mov rdi, rdx
mov ebx, r8d
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r10, rax
mov eax, r8d
imul r10, rdx
shr eax, 8
movzx r9d, al
mov eax, r8d
xor r10, r9
shr eax, 0x10
imul r10, rdx
movzx ecx, al
xor r10, rcx
mov eax, r8d
mov rcx, qword [rdi + 0x30]
xor r8d, r8d
imul r10, rdx
shr rax, 0x18
xor r10, rax
imul r10, rdx
mov rdx, qword [rdi + 8]
and rcx, r10
shl rcx, 4
add rcx, qword [rdi + 0x18]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x14002c048
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x14002c04b
cmp rax, rcx
je 0x14002c048
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x14002c038
jmp 0x14002c04b
mov rax, r8
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x14002c065
mov eax, dword [rax + 0x14]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov word [rsp + 0x5a], r8w
lea r9, [rsp + 0x60]
mov word [rsp + 0x60], r8w
lea rdx, [rsp + 0x58]
mov r8d, 1
mov word [rsp + 0x58], bx
mov rcx, r11
mov dword [rsp + 0x20], 1
call qword [sym.imp.GDI32.dll_GetGlyphIndicesW]
cmp eax, 0xffffffff
je 0x14002c0d9
mov eax, 0xffff
cmp word [rsp + 0x60], ax
je 0x14002c0d9
lea r8, [rsp + 0x68]
mov dword [rsp + 0x68], ebx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140034900
mov rcx, qword [rax]
movzx eax, word [rsp + 0x60]
mov dword [rcx + 0x14], eax
movzx eax, word [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 0xffffffff
add rsp, 0x40
pop rdi
ret
Function at 0x14002c150
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x40
mov r11d, r9d
mov rdi, rcx
movabs r15, 0x100000001b3
mov ebx, r8d
shl rbx, 0x20
movabs r12, 0xcbf29ce484222325
or r11, rbx
mov esi, r8d
mov r10, qword [rdi + 0xe0]
mov rax, r11
shr rax, 8
mov rbp, rdx
mov rdx, qword [rdi + 0xf8]
movzx ecx, al
mov rax, r11
shr rax, 0x10
movzx r9d, r11b
xor r9, r12
imul r9, r15
xor r9, rcx
movzx ecx, al
imul r9, r15
mov rax, r11
xor r9, rcx
shr rax, 0x18
imul r9, r15
movzx ecx, al
xor r9, rcx
movzx eax, r8b
imul r9, r15
xor r9, rax
mov rax, r11
imul r9, r15
shr rax, 0x28
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x30
imul r9, r15
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x38
imul r9, r15
xor ecx, ecx
xor r9, rax
imul r9, r15
and rdx, r9
mov r9, qword [rdi + 0xd0]
add rdx, rdx
mov rax, qword [r10 + rdx*8 + 8]
cmp rax, r9
je 0x14002c251
mov rdx, qword [r10 + rdx*8]
cmp r11, qword [rax + 0x10]
je 0x14002c254
nop dword [rax]
cmp rax, rdx
je 0x14002c251
mov rax, qword [rax + 8]
cmp r11, qword [rax + 0x10]
jne 0x14002c240
jmp 0x14002c254
mov rax, rcx
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14002c26a
movss xmm0, dword [rax + 0x18]
jmp 0x14002c382
mov eax, 0xffffffff
or rbx, rax
mov rax, rbx
shr rax, 8
movzx r8d, al
movzx eax, bl
xor rax, r12
imul rax, r15
xor r8, rax
mov rax, rbx
imul r8, r15
shr rax, 0x10
movzx edx, al
mov rax, rbx
xor r8, rdx
shr rax, 0x18
imul r8, r15
movzx edx, al
mov rax, rbx
xor r8, rdx
shr rax, 0x20
imul r8, r15
movzx edx, al
mov rax, rbx
xor r8, rdx
shr rax, 0x28
imul r8, r15
movzx edx, al
mov rax, rbx
xor r8, rdx
shr rax, 0x30
imul r8, r15
movzx edx, al
mov rax, rbx
xor r8, rdx
shr rax, 0x38
imul r8, r15
xor r8, rax
imul r8, r15
and r8, qword [rdi + 0xf8]
add r8, r8
mov rax, qword [r10 + r8*8 + 8]
cmp rax, r9
je 0x14002c322
mov rdx, qword [r10 + r8*8]
cmp rbx, qword [rax + 0x10]
je 0x14002c31f
nop
cmp rax, rdx
je 0x14002c322
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x14002c310
mov rcx, rax
test rcx, rcx
cmove rcx, r9
cmp rcx, r9
je 0x14002c335
movss xmm0, dword [rcx + 0x18]
jmp 0x14002c382
mov edx, esi
movaps xmmword [rsp + 0x30], xmm6
mov rcx, rbp
call fcn.14002c0f0
movd xmm1, dword [rdi + 0x70]
lea rcx, [rdi + 0xc8]
cvtdq2ps xmm1, xmm1
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rbx
lea rdx, [rsp + 0x20]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
divss xmm6, xmm1
call fcn.140034b40
mov rcx, qword [rax]
movss dword [rcx + 0x18], xmm6
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rdi
ret
Function at 0x1400346c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x14003474f
mov rbx, r15
mov rbp, r15
jmp 0x14003479c
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x14003476e
nop dword [rax + rax]
cmp rbx, rcx
je 0x140034796
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140034760
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 0x10], rax
je 0x1400348e8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400da124
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xor r13d, r13d
mov dword [rax + 0x14], r13d
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400347f2
cvtsi2ss xmm0, rcx
jmp 0x140034807
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14003481a
cvtsi2ss xmm1, rcx
jmp 0x14003482f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x140034889
mov rcx, rsi
call fcn.140035ca0
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x14003487c
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140034879
mov rbx, rax
cmp rax, rdx
je 0x1400348bd
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140034868
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x1400348c4
mov qword [rcx + rax*8], rdi
jmp 0x1400348d6
mov qword [rsp + 0x20], rax
jmp 0x140034881
cmp r8, rbp
jne 0x1400348cf
mov qword [rcx + rax*8], rdi
jmp 0x1400348db
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1400348db
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140034776
lea rcx, str.unordered_map_set_too_long
call fcn.1400d7380
int3
Function at 0x140034900
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x14003498f
mov rbx, r12
mov r15, r12
jmp 0x1400349dc
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1400349ae
nop dword [rax + rax]
cmp rbx, rcx
je 0x1400349d6
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1400349a0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
je 0x140034b2d
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400da124
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xor r13d, r13d
mov dword [rax + 0x14], r13d
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140034a32
cvtsi2ss xmm0, rcx
jmp 0x140034a47
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140034a5a
cvtsi2ss xmm1, rcx
jmp 0x140034a6f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140034ad1
mov rcx, rbp
call fcn.140035ca0
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
je 0x140034ac4
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140034ac1
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x140034b02
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140034ab0
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x140034b09
mov qword [rax + rsi*8], rdi
jmp 0x140034b1b
mov qword [rsp + 0x20], rax
jmp 0x140034ac9
cmp rdx, r15
jne 0x140034b14
mov qword [rax + rsi*8], rdi
jmp 0x140034b20
cmp qword [rax + rsi*8 + 8], rcx
jne 0x140034b20
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x1400349b6
lea rcx, str.unordered_map_set_too_long
call fcn.1400d7380
int3
Function at 0x140035f60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140035cc5
cvtsi2ss xmm0, rdx
jmp 0x140035cda
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1402a0cb4
movss xmm1, dword [0x1403b5ee4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140035d08
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140035d08
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140035d3a
cmp rbx, 0x200
jae 0x140035d37
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140035d3a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140035f60
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140036111
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400337e0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400360d6
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140036050
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400360c5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14003608d
mov r10, qword [rdx]
cmp r10, rax
je 0x140036087
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400360c5
cmp r9, rdx
je 0x1400360a1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400360eb
cmp r9, rdx
jne 0x140036092
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140036000
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400360c5
lea rcx, str.invalid_hash_bucket_count
call fcn.1400d7380
int3
Function at 0x140036120
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400362ff
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400337e0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400362c4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003623c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400362b3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140036279
mov r10, qword [rdx]
cmp r10, rax
je 0x140036273
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400362b3
cmp r9, rdx
je 0x14003628f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1400362d9
cmp r9, rdx
jne 0x140036280
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400361c0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400362b3
lea rcx, str.invalid_hash_bucket_count
call fcn.1400d7380
int3
Function at 0x14004b240
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
push r13
sub rsp, 0x48
mov r13, qword [rcx + 0x10]
mov rdi, rdx
movsxd rax, dword [rcx + 0x1c]
shl rax, 4
add rax, r13
mov qword [rsp + 8], r13
mov qword [rsp + 0x10], rax
cmp r13, rax
je 0x14004b4ae
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax + rax]
movsxd r14, dword [r13 + 4]
mov eax, dword [r13 + 0xc]
mov r11d, dword [r13]
add eax, r14d
mov ebx, dword [r13 + 8]
mov dword [rsp + 0x78], r11d
mov dword [rsp], ebx
cmp r14d, eax
jge 0x14004b47c
mov r15, r14
mov r13d, eax
nop word [rax + rax]
mov r10, qword [rdi]
mov eax, r14d
sub eax, dword [rdi + 0x18]
mov esi, r11d
mov r8, qword [rdi + 8]
cdq
sub esi, dword [rdi + 0x14]
mov ebp, ebx
movsxd r9, dword [r10 + 0x14]
imul r9, r15
add r9, qword [r10]
mov qword [rdi + 0x20], r9
idiv dword [r8 + 0x20]
movsxd rax, dword [r8 + 0x14]
movsxd rcx, edx
imul rcx, rax
add rcx, qword [r8]
mov qword [rdi + 0x28], rcx
movsxd rdx, dword [r10 + 0x18]
mov eax, edx
imul eax, r11d
movsxd rcx, eax
add rcx, r9
cmp dword [rdi + 0x10], 0xfe
jge 0x14004b411
mov r12, rdx
nop dword [rax + rax]
mov r8, qword [rdi + 8]
mov eax, esi
mov r10d, dword [rcx]
cdq
mov r9d, 0x100
inc esi
dec ebp
idiv dword [r8 + 0x1c]
imul edx, dword [r8 + 0x18]
movsxd r8, edx
mov edx, 0x100
add r8, qword [rdi + 0x28]
movzx ebx, byte [r8 + 1]
movzx r11d, byte [r8 + 2]
or ebx, 0xff0000
imul ebx, dword [rdi + 0x10]
shl r11d, 0x10
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub r9d, eax
movzx eax, byte [r8]
or r11d, eax
mov r8d, 0x100
imul r11d, dword [rdi + 0x10]
mov eax, r10d
and eax, 0xff00ff
shr r10d, 8
imul eax, r9d
and r10d, 0xff00ff
imul r10d, r9d
shr r11d, 8
and r11d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r10d, 8
add r11d, eax
and r10d, 0xff00ff
add ebx, r10d
mov eax, ebx
shl ebx, 8
shr eax, 8
and eax, 0xff00ff
sub r8d, eax
mov eax, r11d
shl r8d, 8
shr eax, 8
or r8d, ebx
and eax, 0xff00ff
and r8d, 0xff00ff00
sub edx, eax
or edx, r11d
and edx, 0xff00ff
xor edx, r8d
mov dword [rcx], edx
add rcx, r12
test ebp, ebp
jg 0x14004b320
mov r11d, dword [rsp + 0x78]
mov ebx, dword [rsp]
jmp 0x14004b468
mov r10, rdx
mov r8, qword [rdi + 8]
mov eax, esi
cdq
inc esi
dec ebp
idiv dword [r8 + 0x1c]
mov rax, qword [rdi + 0x28]
imul edx, dword [r8 + 0x18]
movsxd rdx, edx
movzx r8d, byte [rdx + rax + 2]
movzx r9d, word [rdx + rax]
or r8d, 0xffffff00
shl r8d, 8
mov word [rsp + 0x60], r9w
movzx eax, byte [rsp + 0x61]
or r8d, eax
movzx eax, r9b
shl r8d, 8
or r8d, eax
mov dword [rcx], r8d
add rcx, r10
test ebp, ebp
jg 0x14004b414
inc r14d
inc r15
cmp r14d, r13d
jl 0x14004b2c0
mov r13, qword [rsp + 8]
add r13, 0x10
mov qword [rsp + 8], r13
cmp r13, qword [rsp + 0x10]
jne 0x14004b290
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
add rsp, 0x48
pop r13
pop rdi
ret
Function at 0x14004b770
Capabilities:
Encode data using xor

Disassembly:
push r15
sub rsp, 0x30
mov r15, qword [rcx + 0x10]
mov r8, rdx
movsxd rax, dword [rcx + 0x1c]
shl rax, 4
add rax, r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], rax
cmp r15, rax
je 0x14004ba1d
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r13
mov qword [rsp], r14
nop dword [rax]
movsxd rdi, dword [r15 + 4]
mov r12d, dword [r15 + 0xc]
mov r13d, dword [r15]
add r12d, edi
mov eax, dword [r15 + 8]
cmp edi, r12d
jge 0x14004b9e7
mov r14, rdi
mov r15d, eax
nop dword [rax]
nop word [rax + rax]
mov r11, qword [r8]
mov eax, edi
sub eax, dword [r8 + 0x18]
mov ebx, r13d
mov r9, qword [r8 + 8]
cdq
sub ebx, dword [r8 + 0x14]
mov esi, r15d
movsxd r10, dword [r11 + 0x14]
imul r10, r14
add r10, qword [r11]
mov qword [r8 + 0x20], r10
idiv dword [r9 + 0x20]
movsxd rax, dword [r9 + 0x14]
movsxd rcx, edx
imul rcx, rax
add rcx, qword [r9]
mov qword [r8 + 0x28], rcx
movsxd rcx, dword [r11 + 0x18]
mov eax, ecx
mov rbp, rcx
imul eax, r13d
movsxd r11, eax
add r11, r10
cmp dword [r8 + 0x10], 0xfe
jge 0x14004b920
nop
mov rcx, qword [r8 + 8]
mov eax, ebx
cdq
inc ebx
dec esi
idiv dword [rcx + 0x1c]
mov rax, qword [r8 + 0x28]
imul edx, dword [rcx + 0x18]
movsxd rcx, edx
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov r10d, edx
shl r10d, 0x10
or r10d, edx
mov edx, 0x100
imul r10d, dword [r8 + 0x10]
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r9d, eax
shr eax, 8
and eax, 0xff00ff
and r9d, 0xff00ff
imul eax, ecx
imul r9d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
add r9d, r10d
add r10d, eax
mov eax, r10d
shl r10d, 8
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl edx, 8
shr eax, 8
or edx, r10d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r9d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rbp
test esi, esi
jg 0x14004b850
jmp 0x14004b9d4
mov rcx, qword [r8 + 8]
mov eax, ebx
mov r9d, dword [r11]
cdq
mov r10d, r9d
inc ebx
shr r9d, 8
and r10d, 0xff00ff
idiv dword [rcx + 0x1c]
mov rax, qword [r8 + 0x28]
and r9d, 0xff00ff
imul edx, dword [rcx + 0x18]
dec esi
movsxd rcx, edx
movzx edx, byte [rcx + rax]
mov eax, 0x100
sub eax, edx
mov ecx, edx
imul r9d, eax
imul r10d, eax
shl ecx, 0x10
or ecx, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr r10d, 8
add r9d, ecx
and r10d, 0xff00ff
add r10d, ecx
mov eax, r9d
shr eax, 8
mov ecx, 0x100
and eax, 0xff00ff
shl r9d, 8
sub edx, eax
mov eax, r10d
shl edx, 8
shr eax, 8
or edx, r9d
and eax, 0xff00ff
and edx, 0xff00ff00
sub ecx, eax
or ecx, r10d
and ecx, 0xff00ff
xor ecx, edx
mov dword [r11], ecx
add r11, rbp
test esi, esi
jg 0x14004b920
inc edi
inc r14
cmp edi, r12d
jl 0x14004b7f0
mov r15, qword [rsp + 0x50]
add r15, 0x10
mov qword [rsp + 0x50], r15
cmp r15, qword [rsp + 0x58]
jne 0x14004b7c0
mov r14, qword [rsp]
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop r15
ret