joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400de144
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x130
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x58], rax
xor r15d, r15d
mov dword [rsp + 0x50], r15d
lea r13, [0x1401e38c8]
mov qword [rsp + 0x58], r13
xorps xmm0, xmm0
movdqu xmmword [0x1401e38c8], xmm0
mov qword [0x1401e38d8], r15
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9d, [r15 + 1]
xor r8d, r8d
lea rdx, str.Control_PanelInternational
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400de378
mov dword [rsp + 0x40], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 0x20000020
lea r8, str.Languages
lea rdx, str.User_Profile
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400de36d
cmp dword [rsp + 0x40], 3
jbe 0x1400de36d
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x1400de36d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 0x20]
lea r8, str.Languages
lea rdx, str.User_Profile
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400de364
mov edi, dword [rsp + 0x40]
cmp edi, 3
jbe 0x1400de364
mov edx, r15d
shr edi, 1
lea eax, [rdi - 1]
mov word [rbx + rax*2], r15w
mov esi, r15d
je 0x1400de364
mov r14, rbx
mov eax, edx
cmp word [rbx + rax*2], r15w
jne 0x1400de2be
cmp edx, edi
jae 0x1400de2be
inc edx
cmp word [rbx + rdx*2], r15w
je 0x1400de2b1
cmp word [r14], r15w
jne 0x1400de356
cmp esi, edx
jbe 0x1400de356
mov word [rsp + 0x70], r15w
mov eax, edx
lea rcx, [rbx + rax*2]
mov r8d, 0x55
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
test eax, eax
je 0x1400de353
cmp word [rsp + 0x70], r15w
je 0x1400de353
mov rax, qword [0x1401e38d0]
cmp qword [0x1401e38d8], rax
je 0x1400de343
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rcx, [rsp + 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], r15w
jne 0x1400de322
lea rdx, [rsp + 0x70]
mov rcx, rax
call fcn.14001c6b0
add qword [0x1401e38d0], 0x20
jmp 0x1400de353
lea r8, [rsp + 0x70]
mov rdx, rax
mov rcx, r13
call fcn.1400ddd30
lea edx, [rsi + 1]
inc esi
add r14, 2
cmp esi, edi
jb 0x1400de2a8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r13
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.140118d00
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400e6a0c
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
xor r11d, r11d
mov r9, rcx
test rcx, rcx
jne 0x1400e6a1b
or eax, 0xffffffff
ret
movzx r8d, word [rcx]
mov edx, 0x1505
test r8w, r8w
je 0x1400e6a56
mov r10, r11
movzx eax, r8w
sub r8w, 0x41
cmp r8w, 0x19
lea ecx, [rax + 0x20]
cmova ecx, eax
imul eax, edx, 0x21
inc r10
mov edx, ecx
movzx r8d, word [r9 + r10*2]
xor edx, eax
test r8w, r8w
jne 0x1400e6a2d
imul eax, edx, 0x41c64e6d
imul ecx, edx, 0x10dcd
add eax, 0x3039
inc ecx
shr eax, 0x10
and ecx, 0xffff0000
or eax, ecx
ret

Function at 0x1400ec5e8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor ebx, ebx
cmp dword [0x1401e32a4], ebx
jne 0x1400ec778
mov rax, qword [str.p_f_r_]
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x30], ebx
lea edx, [rbx + 0x1e]
mov dword [rsp + 0x28], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rax, qword [rax + 8]
lea rcx, str.p_f_r_
call qword [case.0x140007d11.0]
test eax, eax
jne 0x1400ec6c1
lea r9, str.msi_based_gimme_DoOleoInit_FGimmeFileEx_failed
mov edx, 0x572
mov ecx, 0x23814a2
lea r8d, [rbx + 0x32]
call fcn.140030428
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x30], rax
lea r9d, [rbx + 2]
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r8, str.office.odf
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400ec6c1
lea r9, str.msi_based_gimme_DoOleoInit_GetFallBackOleoOdfPath_failed
mov ecx, 0x23814a3
mov r8d, 0x32
jmp 0x1400ec76e
mov r8d, 0x18000
lea rcx, [rsp + 0x60]
call fcn.1400e4b98
test eax, eax
jns 0x1400ec744
cmp eax, 0x8ff00004
je 0x1400ec74b
mov dword [rsp + 0x58], eax
lea rcx, [0x14012dcb8]
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x48]
lea rcx, str.HResult
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x50], rcx
lea rax, str.msi_based_gimme_DoOleoInit_MsoHrInitializeOleo_failed
mov ecx, 0x23814c0
mov word [rsp + 0x5c], bx
mov r8d, 0xa
mov qword [rsp + 0x20], rax
call fcn.14006072c
mov rax, qword [0x1401d3d78]
lea rcx, [0x1401d3d78]
mov edx, 0x85e609
mov rax, qword [rax + 8]
call qword [case.0x140007d11.0]
xor al, al
jmp 0x1400ec77a
cmp eax, 0x8ff00004
jne 0x1400ec75c
lea r9, str.msi_based_gimme_DoOleoInit_MsoHrInitializeOleo_DataFileError
mov ecx, 0x23814c1
jmp 0x1400ec6b6
lea r9, str.msi_based_gimme_DoOleoInit_MsoHrInitializeOleo_succeeded
mov ecx, 0x23814c2
mov r8d, 0x64
mov edx, 0x572
call fcn.140030428
mov al, 1
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140118d00
add rsp, 0x280
pop rbx
ret
Function at 0x1400ee590
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
and dword [rsp + 0x40], 0
xor ebx, ebx
cmp byte [0x1401dc6b0], bl
jne 0x1400ee616
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401dc6a0], rax
test rax, rax
je 0x1400ee616
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1401dc6a8], rax
test rax, rax
je 0x1400ee616
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [0x1401dc698]
and dword [rsp + 0x20], ebx
lea r8, [0x1400ecb70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
mov byte [0x1401dc6b0], 1
test rax, rax
jne 0x1400ee63a
mov rcx, qword [0x1401dc6a0]
test rcx, rcx
je 0x1400ee628
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1401dc6a8]
test rcx, rcx
je 0x1400ee63a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400f0b98
Capabilities:
Delete registry key

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400f0c39
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400f0c12
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f0c32
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400f0c32
and qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call qword [case.0x140007d11.0]
jmp 0x1400f0c22
cmp dword [rdi + 8], 0
je 0x1400f0c32
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
nop
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, 1
jmp 0x1400f0c22
cmp byte [0x1401e34c0], 0
jne 0x1400f0c84
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f0c70
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
mov qword [0x1401e34c8], rax
jmp 0x1400f0c77
mov r10, qword [0x1401e34c8]
mov eax, 1
mov byte [0x1401e34c0], al
jmp 0x1400f0c8b
mov r10, qword [0x1401e34c8]
mov rdx, rsi
mov rcx, qword [rbx]
test r10, r10
je 0x1400f0c1b
xor r9d, r9d
mov r8d, dword [rbx + 8]
mov rax, r10
call qword [case.0x140007d11.0]
jmp 0x1400f0c22
Function at 0x1400f1830
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x40], 0
mov esi, edx
mov rbx, rcx
jne 0x1400f18e3
lea rdi, [rcx + 0x10]
mov rcx, rdi
cmp r8d, 1
jne 0x1400f18a9
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, rbx
call fcn.1400f16fc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 1
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400f1899
or edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test rbx, rbx
je 0x1400f18e3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400f18e3
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
jne 0x1400f18bd
mov rcx, rbx
call fcn.1400f16fc
jmp 0x1400f18d5
mov rcx, qword [0x1401e34b8]
mov edx, esi
call fcn.1400ed374
mov edx, esi
mov rcx, rbx
call fcn.1400f322c
call fcn.1400f35c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400f2b20
Capabilities:
Get memory capacity

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r14b, r14b
mov rbx, rcx
cmp byte [rcx + 0x41], r14b
je 0x1400f2c85
xor eax, eax
cmp dword [rcx + 0x5c], eax
jbe 0x1400f2c16
lea ecx, [rax + 0x50]
lea rdi, [rbp - 0x59]
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x50
lea rdx, [rbp - 0x59]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x1400f2bea
mov rax, qword [rbp - 0x11]
shr rax, 0x14
cmp eax, dword [rbx + 0x5c]
seta r14b
jbe 0x1400f2bea
cmp byte [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
je 0x1400f2bd8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffffffff
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r14b, r14b
mov byte [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
jmp 0x1400f2bea
mov r8d, 0x80043071
mov byte [rbx + 0x41], 0
mov rcx, rbx
call fcn.1400f25f8
inc dword [rbx + 0x70]
cmp dword [rbx + 0x70], 0xa
jbe 0x1400f2c85
cmp byte [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 0
jne 0x1400f2c85
test r14b, r14b
jne 0x1400f2c85
and dword [rbx + 0x70], 0
mov byte [reloc.AppVIsvSubsystems64.dll_Ordinal_1], 1
jmp 0x1400f2c85
mov edx, 0x40
lea rdi, [rbp - 0x59]
mov ecx, edx
rep stosb byte [rdi], al
lea rcx, [rbp - 0x59]
mov dword [rbp - 0x59], edx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400f2c85
cmp dword [rbp - 0x55], 0x50
jbe 0x1400f2c85
xor eax, eax
lea rdi, [rbp - 9]
lea ecx, [rax + 0x50]
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x50
lea rdx, [rbp - 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
je 0x1400f2c85
mov rax, qword [rbp - 0x51]
sub rax, qword [rbp - 0x49]
shr rax, 1
cmp qword [rbp + 0x3f], rax
jbe 0x1400f2c85
mov r8d, 0x80043071
mov byte [rbx + 0x41], 0
mov rcx, rbx
call fcn.1400f25f8
cmp byte [rbx + 0x42], 0
je 0x1400f2cce
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rcx, qword [rbx + 0x68]
mov rdi, rax
test rcx, rcx
jne 0x1400f2caa
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbx + 0x68], rax
mov rcx, rax
mov rdx, rdi
sub rdx, rcx
cmp dword [rbx + 0x60], 0x64
jae 0x1400f2cce
imul eax, dword [rbx + 0x58], 0x3e8
cmp rdx, rax
jbe 0x1400f2cce
mov rcx, rbx
mov qword [rbx + 0x68], rdi
call fcn.1400f285c
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140118d00
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400f3db0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x18]
mov rdi, rcx
mov rbx, qword [rcx + 0x28]
xor edx, edx
mov ecx, 0x100000
mov r8, qword [r8]
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov rdx, qword [rdi + 0x10]
mov qword [rdx], rax
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400f3df7
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400f3e01
mov rax, qword [rdi + 0x20]
mov dword [rax], 0x80004005
mov rcx, qword [rbx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetEvent]
Function at 0x140101db8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1401d3050]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
and qword [r11 - 0x40], 0
mov qword [r11 - 0x38], 0xf
mov byte [rsp + 0x38], 0
lea rcx, [r11 - 0x50]
call fcn.140005de8
lea r8, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0x10
cmovae r8, rdi
movabs rcx, 0xcbf29ce484222325
xor edx, edx
cmp qword [rsp + 0x48], rdx
jbe 0x140101e53
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, qword [rsp + 0x48]
jb 0x140101e33
mov r14, qword [rsi + 0x38]
and r14, rcx
add r14, r14
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, qword [rax + r14*8]
mov rbp, qword [rsi + 0x10]
cmp qword [rax + r14*8], rbp
jne 0x140101e79
mov rax, rbp
jmp 0x140101e81
mov rax, qword [rax + r14*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140101ef4
lea rsi, [rbx + 0x10]
lea rdx, [rsp + 0x38]
cmp r15, 0x10
cmovae rdx, rdi
mov r13, qword [rsi + 0x10]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140101ea8
mov rcx, qword [rsi]
cmp r13, qword [rsp + 0x48]
jne 0x140101ebb
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140101ec5
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x20]
jmp 0x140101e6e
cmp qword [rsi + 0x18], 0x10
jb 0x140101ecf
mov rsi, qword [rsi]
lea rcx, [rsp + 0x38]
cmp r15, 0x10
cmovae rcx, rdi
cmp qword [rsp + 0x48], r13
jne 0x140101ef4
mov r8, qword [rsp + 0x48]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140101ef7
mov rbx, rbp
cmp r15, 0x10
jb 0x140101f2e
mov rcx, rdi
lea rax, [r15 + 1]
cmp rax, 0x1000
jb 0x140101f24
mov rdi, qword [rdi - 8]
sub rcx, rdi
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140101f24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rax, qword [rsp + 0x28]
cmp rbx, qword [rax + 0x10]
setne al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140118d00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x140102030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r8
mov r15, rdx
mov r14, rcx
mov r12, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14010206b
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
test r12, r12
je 0x14010209a
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, r12
jb 0x14010207c
mov rsi, qword [r14 + 0x30]
and rsi, rcx
add rsi, rsi
mov r13, qword [r14 + 0x18]
mov rdi, qword [r14 + 8]
cmp rdi, qword [r13 + rsi*8]
je 0x140102105
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r13 + rsi*8]
je 0x140102105
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401020d8
mov rdx, qword [rdx]
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1401020e5
mov rcx, qword [rbx]
cmp r12, rax
jne 0x1401020bb
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1401020bb
mov qword [r15], rdi
mov byte [r15 + 8], al
mov rax, r15
jmp 0x1401021f7
mov rax, qword [r14 + 8]
mov r13, qword [rax]
mov r12, qword [r13 + 8]
mov r9, rbx
mov r8, r12
mov rdx, r13
call fcn.140102594
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jae 0x140102146
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [r13 + 8], rdx
mov qword [r12], rdx
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14010219a
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rax
jne 0x1401021b3
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1401021e3
cmp qword [rdx + rsi*8], rdi
jne 0x1401021bf
mov qword [rdx + rsi*8], rbx
jmp 0x1401021e3
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1401021e3
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.140102210
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401022c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
mov rdi, r8
cmp qword [r10 + 0x18], 0x10
mov rsi, rdx
mov r9, rcx
mov r11, r10
jb 0x1401022e9
mov r11, qword [r10]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [r10 + 0x10], r8
jbe 0x14010231b
movzx eax, byte [r8 + r11]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [r10 + 0x10]
jb 0x1401022fc
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140102353
cmp qword [rcx + rdx*8], rdi
jne 0x140102348
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14010234c
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140102360
cmp qword [rcx + rdx*8], rdi
jne 0x140102360
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r10
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
xor edx, edx
dec qword [r9 + 0x10]
call fcn.14002ea58
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401023a4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x1401023e0
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x14010240f
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x1401023f1
mov rsi, qword [r14 + 0x30]
and rsi, rdx
add rsi, rsi
mov rax, qword [r14 + 0x18]
mov rdi, qword [r14 + 8]
cmp rdi, qword [rax + rsi*8]
je 0x1401024b0
mov rdi, qword [rax + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + rsi*8]
je 0x1401024b0
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14010244f
mov rdx, qword [rdx]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14010245e
mov rcx, qword [r12]
cmp r13, r8
jne 0x140102433
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov rax, qword [r14 + 0x18]
jne 0x140102433
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
lea rcx, [rbx + 0x10]
xor edx, edx
call fcn.14002ea58
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140102544
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x1401024e5
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x140102502
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x140102531
cmp rax, rdi
jne 0x14010250d
mov qword [rdx + rsi*8], rbx
jmp 0x140102531
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x140102531
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.140102210
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret