joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fad90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, byte [r8]
mov rbx, rcx
mov byte [rcx + 0x608], al
movzx eax, byte [r8 + 1]
mov byte [rcx + 0x609], al
movzx eax, byte [r8 + 2]
mov byte [rcx + 0x60a], al
movzx eax, byte [r8 + 3]
mov byte [rcx + 0x60b], al
movzx eax, byte [r8 + 4]
mov byte [rcx + 0x60c], al
movzx eax, byte [r8 + 5]
mov byte [rcx + 0x60d], al
movzx eax, byte [r8 + 6]
mov byte [rcx + 0x60e], al
movzx eax, byte [r8 + 7]
mov byte [rcx + 0x60f], al
movzx eax, byte [r8 + 8]
mov byte [rcx + 0x610], al
movzx eax, byte [r8 + 9]
mov byte [rcx + 0x611], al
movzx eax, byte [r8 + 0xa]
mov byte [rcx + 0x612], al
movzx eax, byte [r8 + 0xb]
mov byte [rcx + 0x613], al
movzx eax, byte [r8 + 0xc]
mov byte [rcx + 0x614], al
movzx eax, byte [r8 + 0xd]
mov byte [rcx + 0x615], al
movzx eax, byte [r8 + 0xe]
mov byte [rcx + 0x616], al
movzx eax, byte [r8 + 0xf]
mov byte [rcx + 0x617], al
movzx eax, byte [r8 + 0x10]
mov byte [rcx + 0x618], al
movzx eax, byte [r8 + 0x11]
mov byte [rcx + 0x619], al
movzx eax, byte [r8 + 0x12]
mov byte [rcx + 0x61a], al
movzx eax, byte [r8 + 0x13]
mov byte [rcx + 0x61b], al
movzx eax, byte [r8 + 0x14]
mov byte [rcx + 0x61c], al
movzx eax, byte [r8 + 0x15]
mov byte [rcx + 0x61d], al
movzx eax, byte [r8 + 0x16]
mov byte [rcx + 0x61e], al
movzx eax, byte [r8 + 0x17]
mov byte [rcx + 0x61f], al
movzx eax, byte [r8 + 0x18]
mov byte [rcx + 0x620], al
movzx eax, byte [r8 + 0x19]
mov byte [rcx + 0x621], al
movzx eax, byte [r8 + 0x1a]
mov byte [rcx + 0x622], al
movzx eax, byte [r8 + 0x1b]
mov byte [rcx + 0x623], al
movzx eax, byte [r8 + 0x1c]
mov byte [rcx + 0x624], al
movzx eax, byte [r8 + 0x1d]
mov byte [rcx + 0x625], al
movzx eax, byte [r8 + 0x1e]
mov byte [rcx + 0x626], al
movzx eax, byte [r8 + 0x1f]
mov byte [rcx + 0x627], al
mov qword [rcx + 0x600], rdx
call fcn.14005e160
movzx eax, byte [rax + 0x114]
test al, al
jne 0x1400faf40
mov rcx, qword [rbx + 0x6a8]
test rcx, rcx
je 0x1400faf4c
mov rax, qword [rcx]
lea r8, [rbx + 0x540]
lea rdx, [rbx + 0x600]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x6e8]
test rcx, rcx
jne 0x1400faf1f
call fcn.140155c84
int3
Function at 0x140100710
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, byte [r8]
mov rbx, rcx
mov byte [rcx + 0xc78], al
movzx eax, byte [r8 + 1]
mov byte [rcx + 0xc79], al
movzx eax, byte [r8 + 2]
mov byte [rcx + 0xc7a], al
movzx eax, byte [r8 + 3]
mov byte [rcx + 0xc7b], al
movzx eax, byte [r8 + 4]
mov byte [rcx + 0xc7c], al
movzx eax, byte [r8 + 5]
mov byte [rcx + 0xc7d], al
movzx eax, byte [r8 + 6]
mov byte [rcx + 0xc7e], al
movzx eax, byte [r8 + 7]
mov byte [rcx + 0xc7f], al
movzx eax, byte [r8 + 8]
mov byte [rcx + 0xc80], al
movzx eax, byte [r8 + 9]
mov byte [rcx + 0xc81], al
movzx eax, byte [r8 + 0xa]
mov byte [rcx + 0xc82], al
movzx eax, byte [r8 + 0xb]
mov byte [rcx + 0xc83], al
movzx eax, byte [r8 + 0xc]
mov byte [rcx + 0xc84], al
movzx eax, byte [r8 + 0xd]
mov byte [rcx + 0xc85], al
movzx eax, byte [r8 + 0xe]
mov byte [rcx + 0xc86], al
movzx eax, byte [r8 + 0xf]
mov byte [rcx + 0xc87], al
movzx eax, byte [r8 + 0x10]
mov byte [rcx + 0xc88], al
movzx eax, byte [r8 + 0x11]
mov byte [rcx + 0xc89], al
movzx eax, byte [r8 + 0x12]
mov byte [rcx + 0xc8a], al
movzx eax, byte [r8 + 0x13]
mov byte [rcx + 0xc8b], al
movzx eax, byte [r8 + 0x14]
mov byte [rcx + 0xc8c], al
movzx eax, byte [r8 + 0x15]
mov byte [rcx + 0xc8d], al
movzx eax, byte [r8 + 0x16]
mov byte [rcx + 0xc8e], al
movzx eax, byte [r8 + 0x17]
mov byte [rcx + 0xc8f], al
movzx eax, byte [r8 + 0x18]
mov byte [rcx + 0xc90], al
movzx eax, byte [r8 + 0x19]
mov byte [rcx + 0xc91], al
movzx eax, byte [r8 + 0x1a]
mov byte [rcx + 0xc92], al
movzx eax, byte [r8 + 0x1b]
mov byte [rcx + 0xc93], al
movzx eax, byte [r8 + 0x1c]
mov byte [rcx + 0xc94], al
movzx eax, byte [r8 + 0x1d]
mov byte [rcx + 0xc95], al
movzx eax, byte [r8 + 0x1e]
mov byte [rcx + 0xc96], al
movzx eax, byte [r8 + 0x1f]
mov byte [rcx + 0xc97], al
mov qword [rcx + 0xc70], rdx
call fcn.14005e160
movzx eax, byte [rax + 0x114]
test al, al
jne 0x1401008c0
mov rcx, qword [rbx + 0xdc0]
test rcx, rcx
je 0x1401008cc
mov rax, qword [rcx]
lea r8, [rbx + 0xbb0]
lea rdx, [rbx + 0xc70]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0xe00]
test rcx, rcx
jne 0x14010089f
call fcn.140155c84
int3
Function at 0x140119e80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140119f75
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140119f75
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
cmp qword [r10], rcx
jne 0x140119f48
mov rdx, rdi
mov rcx, rsi
call fcn.14011a930
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14011a09b
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140119faf
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140119fcc
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140119ffb
cmp rax, rbx
jne 0x140119fd7
mov qword [rdx + r8*8], rdi
jmp 0x140119ffb
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140119ffb
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1401fbba8]
test rax, rax
jns 0x14011a01c
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14011a02d
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14011a090
cmp rdx, 0x200
jae 0x14011a049
lea rdx, [rdx*8]
jmp 0x14011a05b
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14011a05b
add rdx, rdx
mov rcx, rsi
call fcn.140086860
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14011a090
mov r15, qword [rax + 8]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140119e80
cmp rbx, r15
jne 0x14011a070
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14011a0b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r12, qword [r8 + 0x18]
mov rsi, r8
mov r14, qword [r8 + 0x10]
mov rbp, rcx
mov r10, r8
cmp r12, 0x10
jb 0x14011a0e4
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x14011a114
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x14011a100
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rdi, qword [rbp + 8]
and rcx, r9
shl rcx, 4
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x90], rax
nop dword [rax]
cmp r13, rdi
jne 0x14011a14a
mov rax, rdi
jmp 0x14011a150
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14011a1c6
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r12, 0x10
jb 0x14011a165
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x14011a176
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x14011a187
mov r8, rbp
call fcn.140195ad0
test eax, eax
je 0x14011a194
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x90]
jmp 0x14011a140
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14011a1a1
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0x10
jb 0x14011a1ad
mov rcx, qword [rsi]
cmp r14, rbp
jne 0x14011a1be
mov r8, r14
call fcn.140195ad0
test eax, eax
je 0x14011a1c1
mov rbx, rdi
mov rax, rbx
jmp 0x14011a1cc
mov rbx, rdi
mov rax, rdi
cmp rax, rdi
jne 0x14011a269
mov rbx, qword [rdi]
lea rax, [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
lea r9, [0x1401f5688]
mov qword [rsp + 0x28], rax
mov rdx, rbx
lea rax, [rsp + 0x98]
mov qword [rsp + 0x98], rsi
mov rdi, qword [rbx + 8]
mov r8, rdi
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 8]
call fcn.140119b20
mov rdx, rax
movabs rcx, 0x249249249249248
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x14011a28d
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [rbp + 8]
mov rdx, qword [rsp + 0x88]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140119c10
mov rax, qword [rsp + 0x88]
jmp 0x14011a27c
mov r15, qword [rsp + 0x88]
mov rax, r15
mov qword [r15], rbx
mov byte [r15 + 8], 0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.140155cc8
int3
Function at 0x14011a2a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rdi, r8
mov r15, rdx
mov rsi, rcx
jb 0x14011a2d6
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x14011a314
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x14011a300
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14011a354
cmp rax, rdi
jne 0x14011a34a
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14011a35f
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14011a35f
cmp rax, rdi
jne 0x14011a35f
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rsi + 0x10]
call fcn.14011a720
mov edx, 0x70
mov rcx, rdi
call fcn.140177360
mov rsi, qword [rsp + 0x38]
mov rax, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [r15], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret

Function at 0x14011a3b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14011a470
cmp rax, r8
jne 0x14011a466
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14011a47b
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14011a47b
cmp rax, r8
jne 0x14011a47b
mov rax, qword [r8]
mov qword [rcx], rax
lea rcx, [r10 + 8]
mov rdx, rbx
call fcn.14011b3e0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14011c7b0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov r14, rdx
mov r15, rcx
add rcx, 0x40
call fcn.140157618
test eax, eax
je 0x14011c7f0
mov ecx, eax
call fcn.140157c40
mov rax, qword [r15 + 8]
mov rdi, qword [rax]
cmp rdi, rax
je 0x14011c96c
movabs r8, 0xcbf29ce484222325
movabs r13, 0x100000001b3
xor r12d, r12d
nop word [rax + rax]
mov rax, qword [rdi + 0x38]
mov rbx, qword [rax]
cmp rbx, rax
je 0x14011c95f
mov rcx, qword [rbx + 0x10]
cmp rcx, r14
jae 0x14011c94f
movzx edx, cl
xor rdx, r8
imul rdx, r13
movzx ecx, byte [rbx + 0x11]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x12]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x13]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x14]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x15]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x16]
xor rdx, rcx
imul rdx, r13
movzx ecx, byte [rbx + 0x17]
xor rdx, rcx
imul rdx, r13
mov r8, qword [rdi + 0x60]
and r8, rdx
shl r8, 4
mov rdx, qword [rdi + 0x48]
add rdx, r8
cmp qword [rdx + 8], rbx
jne 0x14011c8cd
cmp qword [rdx], rbx
jne 0x14011c8c3
mov qword [rdx], rax
mov rax, qword [rdi + 0x38]
mov rcx, qword [rdi + 0x48]
mov qword [rcx + r8 + 8], rax
jmp 0x14011c8d8
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14011c8d8
cmp qword [rdx], rbx
jne 0x14011c8d8
mov rax, qword [rbx]
mov qword [rdx], rax
mov rbp, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax], rbp
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rdi + 0x40]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14011c933
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14011c922
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x14011c99e
mov rcx, rax
call fcn.140177360
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x28], r12
mov edx, 0x30
mov rcx, rbx
call fcn.140177360
mov rbx, rbp
movabs r8, 0xcbf29ce484222325
jmp 0x14011c952
mov rbx, qword [rbx]
mov rax, qword [rdi + 0x38]
cmp rbx, rax
jne 0x14011c830
mov rdi, qword [rdi]
cmp rdi, qword [r15 + 8]
jne 0x14011c820
lea rcx, [r15 + 0x40]
call fcn.14015763c
test eax, eax
je 0x14011c981
mov ecx, eax
call fcn.140157c40
nop
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.14019862c
int3
Function at 0x14011f1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 0x10
mov ebp, r9d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
jb 0x14011f1fa
mov rdx, qword [rdx]
mov r8, qword [rbx + 0x10]
call fcn.14002ca50
mov rcx, rax
lea rdx, [0x140206ac8]
call fcn.14002a5a0
mov eax, ebp
mov rcx, rsi
and eax, 3
je 0x14011f37a
sub eax, 1
je 0x14011f31c
sub eax, 1
je 0x14011f2b4
cmp eax, 1
je 0x14011f248
lea rdx, str.__wrong_params__
call fcn.14002a5a0
jmp 0x14011f3c7
lea rdx, str.rotate_
call fcn.14002a5a0
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14011f262
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14002ca50
lea rdx, [0x1401f97bc]
mov rcx, rax
call fcn.14002a5a0
mov r8, rax
shr ebp, 0x10
mov ecx, ebp
mov eax, 0x8421085
mul ebp
sub ecx, edx
shr ecx, 1
add ecx, edx
mov edx, 0x1f
shr ecx, 4
imul eax, ecx, 0x1f
mov rcx, r8
sub ebp, eax
sub edx, ebp
call fcn.1400b4910
lea rdx, [0x140206b00]
jmp 0x14011f3a6
lea rdx, str.rotate_
call fcn.14002a5a0
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14011f2ce
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14002ca50
lea rdx, [0x1401f97bc]
mov rcx, rax
call fcn.14002a5a0
mov r8, rax
shr ebp, 0x10
mov ecx, ebp
mov eax, 0x8421085
mul ebp
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
imul eax, ecx, 0x1f
mov rcx, r8
sub ebp, eax
lea edx, [rbp + 1]
call fcn.1400b4910
lea rdx, [0x140206b00]
jmp 0x14011f3a6
lea rdx, [0x140204134]
call fcn.14002a5a0
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14011f336
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14002ca50
lea rdx, [0x140206a44]
mov rcx, rax
call fcn.14002a5a0
cmp qword [rdi + 0x18], 0x10
mov r8, qword [rdi + 0x10]
jb 0x14011f35e
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.14002ca50
mov rcx, rax
lea rdx, str.___33u
call fcn.14002a5a0
jmp 0x14011f3c7
lea rdx, [0x140204134]
call fcn.14002a5a0
cmp qword [rbx + 0x18], 0x10
mov r8, qword [rbx + 0x10]
jb 0x14011f394
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.14002ca50
lea rdx, str.__33u__
mov rcx, rax
call fcn.14002a5a0
cmp qword [rdi + 0x18], 0x10
mov r8, qword [rdi + 0x10]
jb 0x14011f3bc
mov rdi, qword [rdi]
mov rdx, rdi
mov rcx, rax
call fcn.14002ca50
lea rdx, [0x140206a94]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14002a5a0
Function at 0x140130d60
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0x28
mov r8d, 0x40
xor edx, edx
lea rcx, [0x140a32990]
call fcn.140195bd0
mov eax, 4
imul rax, rax, 1
lea rcx, [0x140a32988]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140a32988]
mov dword [rcx + rax], 0
mov eax, 4
imul rax, rax, 0
lea rcx, [0x140a329d0]
mov dword [rcx + rax], 0x67452301
mov eax, 4
imul rax, rax, 1
lea rcx, [0x140a329d0]
mov dword [rcx + rax], 0xefcdab89
mov eax, 4
imul rax, rax, 2
lea rcx, [0x140a329d0]
mov dword [rcx + rax], 0x98badcfe
mov eax, 4
imul rax, rax, 3
lea rcx, [0x140a329d0]
mov dword [rcx + rax], 0x10325476
add rsp, 0x28
ret
Function at 0x1401486f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x70
mov rax, qword [0x140a23bc8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r11 + 0x18], rsi
mov rdx, rcx
mov qword [r11 + 0x20], rdi
lea rcx, [r11 - 0x50]
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
call fcn.1401482c0
mov rdi, rax
mov r8, rax
mov r13, qword [rax + 0x18]
mov r14, qword [rax + 0x10]
cmp r13, 0x10
jb 0x14014873e
mov r8, qword [rax]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r14, r14
je 0x140148774
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r9
cmp rdx, r14
jb 0x140148760
and rcx, qword [0x140a335d0]
mov rax, qword [0x140a335b8]
mov rsi, qword [0x140a335a8]
shl rcx, 4
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x50], r15
mov r12, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r12
mov qword [rsp + 0x20], rax
nop dword [rax]
cmp r12, rsi
jne 0x1401487ba
mov rax, rsi
jmp 0x1401487c0
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x140148837
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r13, 0x10
jb 0x1401487d5
mov rdx, qword [rdi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x1401487e6
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x1401487f7
mov r8, rbp
call fcn.140195ad0
test eax, eax
je 0x140148801
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x20]
jmp 0x1401487b0
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14014880e
mov rdx, qword [rdx]
cmp r13, 0x10
jb 0x140148817
mov rdi, qword [rdi]
cmp r14, rbp
jne 0x14014882b
mov r8, r14
mov rcx, rdi
call fcn.140195ad0
test eax, eax
je 0x14014882e
mov rbx, rsi
cmp rbx, rsi
je 0x140148837
mov bl, 1
jmp 0x140148839
xor bl, bl
mov rdx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
cmp rdx, 0x10
jb 0x14014889e
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140148899
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401488b4
call fcn.140177360
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401777c0
add rsp, 0x70
pop rbx
ret
call fcn.14019862c
int3
Function at 0x14014a4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14014a4e0
mov qword [rsp + 8], rbx
movsxd r9, r9d
mov r11, r8
mov rbx, rdx
mov r10, rcx
test r9, r9
jle 0x14014a592
sub rbx, r8
nop dword [rax]
mov eax, dword [r10 + 0x104]
inc eax
and eax, 0x800000ff
jge 0x14014a519
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r10 + 0x104], eax
movzx eax, byte [r8 + r10]
add eax, dword [r10 + 0x108]
and eax, 0x800000ff
jge 0x14014a53f
dec eax
or eax, 0xffffff00
inc eax
mov dword [r10 + 0x108], eax
movzx edx, byte [r8 + r10]
movsxd rcx, eax
movzx eax, byte [rcx + r10]
mov byte [r8 + r10], al
mov byte [rcx + r10], dl
movsxd rax, dword [r10 + 0x104]
movzx edx, byte [rax + r10]
movsxd rax, dword [r10 + 0x108]
movzx ecx, byte [rax + r10]
add rdx, rcx
movzx eax, dl
movzx ecx, byte [rax + r10]
xor cl, byte [rbx + r11]
mov byte [r11], cl
inc r11
sub r9, 1
jne 0x14014a500
mov rbx, qword [rsp + 8]
ret

Function at 0x14014a4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14014a4e0
mov qword [rsp + 8], rbx
movsxd r9, r9d
mov r11, r8
mov rbx, rdx
mov r10, rcx
test r9, r9
jle 0x14014a592
sub rbx, r8
nop dword [rax]
mov eax, dword [r10 + 0x104]
inc eax
and eax, 0x800000ff
jge 0x14014a519
dec eax
or eax, 0xffffff00
inc eax
movsxd r8, eax
mov dword [r10 + 0x104], eax
movzx eax, byte [r8 + r10]
add eax, dword [r10 + 0x108]
and eax, 0x800000ff
jge 0x14014a53f
dec eax
or eax, 0xffffff00
inc eax
mov dword [r10 + 0x108], eax
movzx edx, byte [r8 + r10]
movsxd rcx, eax
movzx eax, byte [rcx + r10]
mov byte [r8 + r10], al
mov byte [rcx + r10], dl
movsxd rax, dword [r10 + 0x104]
movzx edx, byte [rax + r10]
movsxd rax, dword [r10 + 0x108]
movzx ecx, byte [rax + r10]
add rdx, rcx
movzx eax, dl
movzx ecx, byte [rax + r10]
xor cl, byte [rbx + r11]
mov byte [r11], cl
inc r11
sub r9, 1
jne 0x14014a500
mov rbx, qword [rsp + 8]
ret

Function at 0x14014a5a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r9d, r9d
mov dword [rcx + 0x100], r8d
mov qword [rcx + 0x104], r9
mov eax, r9d
mov rdi, rdx
mov r11, rcx
mov r8, rcx
nop word [rax + rax]
mov byte [r8], al
lea r8, [r8 + 1]
inc eax
cmp eax, 0x100
jl 0x14014a5d0
mov r8d, r9d
mov r10, r11
nop word [rax + rax]
movzx ebx, byte [r10]
mov eax, r8d
cdq
idiv dword [r11 + 0x100]
movsxd rax, edx
movzx ecx, byte [rax + rdi]
add r9d, ecx
add r9d, ebx
and r9d, 0x800000ff
jge 0x14014a622
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rcx, r9d
inc r8d
movzx eax, byte [rcx + r11]
mov byte [r10], al
inc r10
mov byte [rcx + r11], bl
cmp r8d, 0x100
jl 0x14014a5f0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret