joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000894c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140008988
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r13*2]
xor ecx, ecx
test r11, r11
je 0x1400089bf
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x1400089a1
mov r8, qword [r9 + 0x30]
and r8, rdx
mov r14, r8
add r14, r14
mov r12, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [r12 + r14*8]
je 0x140008a8e
mov rdi, qword [r12 + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r14*8]
je 0x140008a8e
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140008a06
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140008a13
mov r11, qword [r10]
cmp r13, rcx
jne 0x1400089e6
mov r15, r13
test r13, r13
je 0x140008a50
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x1400089e6
sub r11, rax
cmp cx, dx
ja 0x1400089e6
cmp r15, 1
je 0x140008a50
dec r15
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140008a32
jmp 0x1400089e6
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.1400022c0
mov edx, 0x38
mov rcx, rbx
call fcn.14004d088
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140008b25
mov rax, qword [rbx]
cmp rdi, rax
je 0x140008ac3
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140008ae3
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140008b12
cmp rax, rdi
jne 0x140008aee
mov qword [rdx + r8*8], rbx
jmp 0x140008b12
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140008b12
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rcx, r9
call fcn.140008b68
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140009300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14000932d
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14000935c
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14000933e
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140009394
cmp qword [rcx + rdx*8], rdi
jne 0x140009389
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14000938d
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400093a1
cmp qword [rcx + rdx*8], rdi
jne 0x1400093a1
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1400022c0
mov edx, 0x38
mov rcx, rdi
call fcn.14004d088
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b7e4
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x2d0
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov qword [rdx + 8], rcx
mov rbx, rdx
mov rdi, rcx
mov byte [rdx], 0
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x250
call fcn.14004e8e0
mov edx, 4
lea r8, [rbx + 0x10]
mov rax, r8
lea rcx, [rsp + 0x30]
lea r9d, [rdx + 0x7c]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x50], xmm1
movups xmm1, xmmword [rcx + 0x70]
add rcx, r9
movups xmmword [rax + 0x60], xmm0
add rax, r9
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x14000b837
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
mov rcx, rdi
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm0
cmp qword [rdi + 0x18], 8
jb 0x14000b8b4
mov rcx, qword [rdi]
and dword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rbx + 8]
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 8]
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x14000b8fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
jne 0x14000b91f
mov byte [rbx], 1
mov rax, rbx
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.14004d060
mov rbx, qword [rsp + 0x2f0]
add rsp, 0x2d0
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x280]
mov r8d, eax
call fcn.14000b700
lea rdx, [0x1400896c0]
lea rcx, [rsp + 0x280]
call fcn.14004f070
int3
Function at 0x14000bbec
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x38], rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
mov esi, eax
xor r14d, r14d
test eax, eax
jne 0x14000bc6d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
mov edx, 0xfaa
lea rcx, [0x14008de10]
call fcn.140002db8
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
jmp 0x14000bd3b
mov rdx, rsi
movdqa xmm0, xmmword [0x140077ef0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
cmp rsi, 7
ja 0x14000bca6
mov qword [rbp - 0x20], rdx
test eax, eax
je 0x14000bc9e
movzx eax, r14w
lea rdi, [rbp - 0x30]
mov rcx, rdx
rep stosw word [rdi], ax
mov word [rbp + rsi*2 - 0x30], r14w
jmp 0x14000bcb3
xor r9d, r9d
lea rcx, [rbp - 0x30]
call fcn.14001718c
nop
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14000bd05
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r8d, eax
mov edx, 0xfaa
lea rcx, [0x14008de10]
call fcn.140002db8
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
jmp 0x14000bd32
lea edx, [rax - 1]
lea rcx, [rbp - 0x30]
call fcn.1400123ac
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x140077ef0]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
lea rcx, [rbp - 0x30]
call fcn.1400022c0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14004d060
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000fbe8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
cmp qword [r8 + 0x18], 8
mov r9, rdx
mov rbx, qword [r8 + 0x10]
mov rdi, rcx
mov r10, r8
jb 0x14000fc13
mov r10, qword [r8]
lea r11, [rbx + rbx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r11, r11
je 0x14000fc46
movzx eax, byte [rcx + r10]
movabs rsi, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, rsi
cmp rcx, r11
jb 0x14000fc28
mov r14, qword [rdi + 0x48]
mov r15, qword [rdi + 0x30]
and r14, rdx
mov rcx, qword [rdi + 0x20]
add r14, r14
mov rax, qword [r15 + r14*8]
cmp qword [r15 + r14*8], rcx
jne 0x14000fc67
mov rdx, rcx
jmp 0x14000fc6f
mov rdx, qword [r15 + r14*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x14000fd27
cmp qword [r8 + 0x18], 8
lea rdx, [rax + 0x10]
mov r10, r8
jb 0x14000fc89
mov r10, qword [r8]
mov rbp, qword [rdx + 0x18]
mov r11, qword [rdx + 0x10]
cmp rbp, 8
jb 0x14000fc9a
mov rdx, qword [rdx]
cmp r11, rbx
jne 0x14000fcd3
test r11, r11
je 0x14000fcd8
movzx edi, word [rdx]
movzx esi, word [r10]
cmp di, si
jb 0x14000fcd3
sub rdx, r10
cmp di, si
ja 0x14000fcd3
cmp r11, 1
je 0x14000fcd8
add r10, 2
dec r11
movzx edi, word [r10 + rdx]
movzx esi, word [r10]
cmp di, si
jae 0x14000fcb6
mov rax, qword [rax]
jmp 0x14000fc5c
lea rdx, [rax + 0x10]
cmp rbp, 8
jb 0x14000fce5
mov rdx, qword [rdx]
cmp qword [r8 + 0x18], 8
jb 0x14000fcef
mov r8, qword [r8]
test rbx, rbx
je 0x14000fd2a
movzx r10d, word [r8]
movzx r11d, word [rdx]
cmp r10w, r11w
jb 0x14000fd27
sub r8, rdx
cmp r10w, r11w
ja 0x14000fd27
cmp rbx, 1
je 0x14000fd2a
add rdx, 2
dec rbx
movzx r10d, word [rdx + r8]
movzx r11d, word [rdx]
cmp r10w, r11w
jae 0x14000fd09
mov rax, rcx
mov qword [rsp + 0x20], rcx
and qword [r9], 0
and qword [r9 + 8], 0
cmp rax, rcx
je 0x14000fd59
mov rdx, qword [rax + 0x38]
test rdx, rdx
je 0x14000fd4e
lock inc dword [rdx + 8]
mov rdx, qword [rax + 0x38]
mov rcx, qword [rax + 0x30]
mov qword [r9], rcx
mov qword [r9 + 8], rdx
mov rbx, qword [rsp + 0x28]
mov rax, r9
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
pop r15
pop r14
pop rdi
ret
Function at 0x140012fb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, 0xffff
xor r14d, r14d
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x140012ff4
movzx eax, r14w
jmp 0x14001312a
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x140013030
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x140013030
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, si
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14001312a
cmp qword [rcx + 0x80], r14
je 0x140013127
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001306e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140013097
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140055984
cmp ax, di
je 0x140013127
movzx edi, si
jmp 0x140013127
lea r8, [rbp + 0xf]
mov word [rbp + 7], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 9]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x17]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 7]
call qword [case.0x140062ace.0]
test eax, eax
js 0x140013127
cmp eax, 1
jle 0x1400130ec
cmp eax, 3
jne 0x140013127
movzx ecx, word [rbp + 7]
jmp 0x14001307a
mov r14, qword [rbp + 0xf]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x140013116
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call fcn.14005672c
cmp r14, rax
jne 0x140013127
lea rax, [rbp + 7]
mov byte [rbx + 0x72], 1
cmp qword [rbp + 0x17], rax
movzx eax, si
jne 0x14001312a
movzx eax, di
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14004d060
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140014700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140014779
cmp byte [rcx + 0x72], 0
je 0x140014779
mov edi, 0xffff
mov edx, edi
call fcn.140012fb0
cmp di, ax
je 0x1400147ce
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140062ace.0]
test eax, eax
je 0x140014794
sub eax, 1
je 0x140014798
cmp eax, 2
jne 0x1400147ce
mov byte [rbx + 0x72], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004d060
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400147c5
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.14005672c
cmp rdi, rax
jne 0x1400147ce
cmp byte [rbx + 0x72], 0
sete al
jmp 0x14001477b
xor al, al
jmp 0x14001477b
Function at 0x140018fc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140018ffc
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r13*2]
xor ecx, ecx
test r11, r11
je 0x140019033
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x140019015
mov r8, qword [r9 + 0x30]
and r8, rdx
mov r14, r8
add r14, r14
mov r12, qword [r9 + 0x18]
lea rax, [r9 + 8]
mov qword [rsp + 0x80], rax
mov rdi, qword [rax]
cmp rdi, qword [r12 + r14*8]
je 0x1400190f3
mov rdi, qword [r12 + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r14*8]
je 0x1400190f3
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140019085
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140019092
mov r11, qword [r10]
cmp r13, rcx
jne 0x140019065
mov r15, r13
test r13, r13
je 0x1400190cf
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x140019065
sub r11, rax
cmp cx, dx
ja 0x140019065
cmp r15, 1
je 0x1400190cf
dec r15
add rax, 2
movzx ecx, word [rax + r11]
movzx edx, word [rax]
cmp cx, dx
jae 0x1400190b1
jmp 0x140019065
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.140019844
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14001918a
mov rax, qword [rbx]
cmp rdi, rax
je 0x140019128
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140019148
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140019177
cmp rax, rdi
jne 0x140019153
mov qword [rdx + r8*8], rbx
jmp 0x140019177
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140019177
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rcx, r9
call fcn.140019738
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140019b70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x140019bac
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r13*2]
xor ecx, ecx
test r11, r11
je 0x140019be3
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x140019bc5
mov r8, qword [r9 + 0x30]
and r8, rdx
mov r14, r8
add r14, r14
mov r12, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [r12 + r14*8]
je 0x140019cb2
mov rdi, qword [r12 + r14*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r12 + r14*8]
je 0x140019cb2
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140019c2a
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x140019c37
mov r11, qword [r10]
cmp r13, rcx
jne 0x140019c0a
mov r15, r13
test r13, r13
je 0x140019c74
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x140019c0a
sub r11, rax
cmp cx, dx
ja 0x140019c0a
cmp r15, 1
je 0x140019c74
dec r15
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140019c56
jmp 0x140019c0a
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.1400022c0
mov edx, 0x38
mov rcx, rbx
call fcn.14004d088
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140019d49
mov rax, qword [rbx]
cmp rdi, rax
je 0x140019ce7
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140019d07
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140019d36
cmp rax, rdi
jne 0x140019d12
mov qword [rdx + r8*8], rbx
jmp 0x140019d36
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140019d36
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rcx, r9
call fcn.14001a3c4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x140019d60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140019d82
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140019db1
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140019d93
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140019de9
cmp qword [rcx + rdx*8], r8
jne 0x140019dde
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140019de2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140019df6
cmp qword [rcx + rdx*8], r8
jne 0x140019df6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140019844
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14001ddf4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x3d8]
sub rsp, 0x4b0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14008c110]
xor rax, rsp
mov qword [rbp + 0x3a0], rax
mov r14d, edx
mov rbx, rcx
mov dword [rsp + 0x40], edx
movabs rcx, 0xcbf29ce484222325
xor edi, edi
mov edx, edi
movzx eax, byte [rsp + rdx + 0x40]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14001de47
mov r8, qword [rbx + 0xd0]
and r8, rcx
add r8, r8
mov r9, qword [rbx + 0xb8]
mov rax, qword [r9 + r8*8]
mov rdx, qword [rbx + 0xa8]
mov qword [rsp + 0x40], rdx
cmp qword [r9 + r8*8], rdx
jne 0x14001de9a
mov qword [rsp + 0x40], rdx
mov rcx, rdx
jmp 0x14001dea7
mov rcx, qword [r9 + r8*8 + 8]
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
cmp rax, rcx
je 0x14001debe
cmp dword [rax + 0x10], r14d
je 0x14001deb7
mov rax, qword [rax]
jmp 0x14001de8a
mov qword [rsp + 0x40], rax
jmp 0x14001dec1
mov rax, rdx
mov qword [rsp + 0x40], rdx
cmp rax, rdx
jne 0x14001dfe4
mov eax, r14d
and eax, 0xff000000
cmp eax, 0x1000000
jne 0x14001df18
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x200
lea r9, [rbp - 0x60]
xor r8d, r8d
mov edx, r14d
mov rax, qword [rax + 0x70]
call qword [case.0x140062ace.0]
test eax, eax
js 0x14001e021
jmp 0x14001df60
cmp eax, 0x2000000
jne 0x14001e044
mov rcx, qword [rbx + 0xf8]
mov rax, qword [rcx]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 0x200
lea r8, [rbp - 0x60]
mov edx, r14d
mov rax, qword [rax + 0x60]
call qword [case.0x140062ace.0]
test eax, eax
js 0x14001e06a
lea r13, [rbx + 0xa0]
lea r15, [r13 + 8]
mov rbx, qword [r15]
mov rbx, qword [rbx]
movabs rax, 0x492492492492492
cmp qword [r15 + 8], rax
je 0x14001e014
mov rsi, qword [rbx + 8]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x50], rdi
mov ecx, 0x38
call fcn.14004d094
mov rdi, rax
mov qword [rsp + 0x50], rax
mov dword [rax + 0x10], r14d
lea rcx, [rax + 0x18]
lea rdx, [rbp - 0x60]
call fcn.14000737c
mov qword [rdi], rbx
mov qword [rdi + 8], rsi
inc qword [r15 + 8]
mov qword [rbx + 8], rdi
mov qword [rsi], rdi
mov rax, qword [r15]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.140020c48
mov rax, qword [rsp + 0x48]
add rax, 0x18
mov rcx, qword [rbp + 0x3a0]
xor rcx, rsp
call fcn.14004d060
lea r11, [rsp + 0x4b0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.140002b64
int3
int3
int3
int3