joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4030ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409820
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fde0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4030c0
cmp byte [0x00649e70], 0
je 0x461e95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45eee0
jmp 0x4030c0

Function at 0x461ea0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0064a1a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00649e70], 0
je 0x461ed5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0064a4e0]
aesenc xmm0, xmmword [0x0064a4f0]
aesenc xmm0, xmmword [0x0064a500]
movq rax, xmm0
ret
jmp 0x409a20

Function at 0x461ee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0064a1a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00649e70], 0
je 0x461f16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0064a4e0]
aesenc xmm0, xmmword [0x0064a4f0]
aesenc xmm0, xmmword [0x0064a500]
movq rax, xmm0
ret
jmp 0x409a80

Function at 0x463960
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0064a460]
mov qword [rsp + 8], rdx
lea r8d, [0x00649e90]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00461dc0
add rsp, 0x30
ret

Function at 0x463ea0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x463ecc
call fcn.00461dc0
shl rcx, 3
add rcx, 0x1480
mov qword [0x0064a070], rcx
ret
Function at 0x4d5980
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4d5a55
movdqa xmm0, xmmword [0x0053ad30]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4d59c1
movdqa xmm0, xmmword [0x0053ad40]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4d5ad7
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4d5aab
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0053aa80]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0053b150]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x939e90
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x939e9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x939ead
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x939e95
lea eax, [rcx + 1]
jmp 0x939ebb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x939ece
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x939eb4
sub eax, 3
jb 0x939eee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x939f3d
sar eax, 1
movsxd rbp, eax
jb 0x939f24
jmp 0x939efc
add ebx, ebx
jne 0x939efa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x939f24
inc ecx
add ebx, ebx
jne 0x939f0a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x939f24
call r11
adc ecx, ecx
add ebx, ebx
jne 0x939f1d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x939f0c
add ecx, 2
jmp 0x939f29
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00939e52
jmp 0x939e9d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x238000
mov dl, 0x55
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x939f89
cmp rsi, rcx
jae 0x939f91
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x939f70
cmp al, 0x8f
ja 0x939f70
cmp byte [rsi - 2], 0xf
je 0x939f76
sub al, 0xe8
cmp al, 1
ja 0x939f5a
cmp rsi, rcx
jae 0x939f91
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x939f60
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x939f91
lodsb al, byte [rsi]
jmp 0x939f70
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x52c000]
mov eax, dword [rdi]
or eax, eax
je 0x939fee
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x53a000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x939f9e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x939fe8
mov qword [rbx], rax
add rbx, 8
jmp 0x939fbe
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x93a032
cmp al, 0xef
ja 0x93a01a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x939ffa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x93a009
mov eax, dword [rdi]
add rdi, 4
jmp 0x93a009
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x93a086
sub rsp, 0xffffffffffffff80
jmp 0x4646e0
Function at 0x1400037f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
movsxd rdx, dword [rdx]
mov rcx, qword [rdi + 0x18]
mov rcx, qword [rcx + 0x40]
call fcn.14003e530
mov rdx, rax
mov rcx, qword [rdi + 0x10]
test byte [rax + 8], 0xf
jne 0x140003820
mov byte [rcx + 8], 0
jmp 0x14000382d
mov rax, qword [rax]
mov qword [rcx], rax
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
add qword [rdi + 0x10], 0x10
mov edx, 0xffffffff
mov rcx, rdi
call fcn.140012590
mov rbx, rax
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.140011fc0
nop
movzx r8d, bl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rcx, rbx
shr rcx, 8
movzx edx, cl
xor r8, rdx
imul r8, r9
mov rax, rbx
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x28
movzx eax, al
xor rax, r8
imul rax, r9
mov rcx, rbx
shr rcx, 0x30
movzx edx, cl
xor rax, rdx
imul rax, r9
shr rbx, 0x38
xor rax, rbx
imul rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400073c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rdi, r9
mov r15, r8
mov r14, rdx
mov rbp, rcx
movups xmm0, xmmword [r8]
movaps xmmword [rsp + 0x20], xmm0
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov r8, qword [r8 + 8]
test r8, r8
je 0x140007423
movabs r9, 0x100000001b3
mov rcx, qword [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r9
inc rdx
cmp rdx, r8
jb 0x140007410
mov r9, rbx
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140007dd0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x14000745e
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rax + 0x30], xmm1
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x140007601
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
jne 0x14000747c
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r13, [rbp + 8]
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], 0
mov ecx, gethostname
call fcn.140131d68
mov rsi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r15]
movups xmmword [rax + 0x10], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x20], xmm0
movsd xmm1, qword [rdi + 0x10]
movsd qword [rax + 0x30], xmm1
mov rcx, qword [rbp + 0x10]
movss xmm3, dword [rbp]
add rcx, 1
xorps xmm0, xmm0
js 0x1400074d2
cvtsi2ss xmm0, rcx
jmp 0x1400074e7
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [rbp + 0x38]
xorps xmm2, xmm2
test rdi, rdi
js 0x1400074fa
cvtsi2ss xmm2, rdi
jmp 0x140007512
mov rcx, rdi
shr rcx, 1
mov rax, rdi
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
jbe 0x1400075a9
divss xmm0, xmm3
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x14015e388]
comiss xmm0, xmm1
jb 0x140007550
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140007550
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x140007582
cmp rdi, 0x200
jae 0x14000757f
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x140007582
mov rdi, rcx
mov rdx, rdi
mov rcx, rbp
call fcn.140007b90
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140007dd0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r13]
jne 0x1400075e2
mov qword [rcx + rax*8], rsi
jmp 0x1400075f4
cmp r9, rdx
jne 0x1400075ed
mov qword [rcx + rax*8], rsi
jmp 0x1400075f9
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400075f9
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007b90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
sub rsp, 0x78
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x40], rcx
mov rbp, rcx
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140007bca
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0xa0], rsi
mov rsi, qword [rbp + 8]
or rax, rbx
bsr rcx, rax
mov qword [rsp + 0x70], rdi
mov r8, rsi
inc ecx
mov qword [rsp + 0x58], r14
shl rbx, cl
lea r14, [rbp + 0x18]
mov rcx, r14
mov qword [rsp + 0x20], r14
lea rdx, [rbx + rbx]
call fcn.140006120
lea rax, [rbx - 1]
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x30], rax
mov rbx, qword [rbp + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rsi
je 0x140007d90
mov qword [rsp + 0x68], r12
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x60], r13
movabs r10, 0x100000001b3
mov qword [rsp + 0x50], r15
nop word [rax + rax]
movups xmm0, xmmword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
xor ecx, ecx
mov rdi, qword [rdi]
mov rdx, rax
movaps xmmword [rsp + 0x30], xmm0
test r8, r8
je 0x140007c84
mov r9, qword [rsp + 0x30]
nop
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r8
jb 0x140007c70
mov r12, qword [rbp + 0x30]
and r12, rdx
shl r12, 4
add r12, qword [r14]
mov r15, qword [r12]
cmp r15, rsi
jne 0x140007ca9
mov qword [r12], rbx
mov qword [r12 + 8], rbx
jmp 0x140007d66
mov r14, qword [r12 + 8]
cmp r8, qword [r14 + 0x18]
jne 0x140007cf6
mov rdx, qword [r14 + 0x10]
movq rcx, xmm0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007cf6
mov r8, qword [r14]
cmp r8, rbx
je 0x140007cef
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + 8], rbx
jmp 0x140007d57
cmp r15, r14
je 0x140007d32
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x30], xmm0
mov rbp, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
nop
mov r14, qword [r14 + 8]
cmp rbp, qword [r14 + 0x18]
jne 0x140007d2d
mov rdx, qword [r14 + 0x10]
mov r8, rbp
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007da9
cmp r15, r14
jne 0x140007d10
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r14
mov rax, qword [r14 + 8]
mov qword [rax], rbx
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12], rbx
mov r14, qword [rsp + 0x20]
movabs r10, 0x100000001b3
mov rbp, qword [rsp + 0x40]
mov rbx, rdi
movabs rax, 0xcbf29ce484222325
cmp rdi, rsi
jne 0x140007c50
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x58]
add rsp, 0x78
pop rbp
pop rbx
ret
mov r8, qword [r14]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x140007d57
Function at 0x140007ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
movups xmm0, xmmword [r8 + 0x10]
mov r11, qword [r8 + 0x18]
mov rdi, rdx
xor edx, edx
mov r10, rcx
movaps xmmword [rsp + 0x20], xmm0
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x140007ef3
mov rcx, qword [rsp + 0x20]
movabs rbx, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
inc rdx
xor r9, rax
imul r9, rbx
cmp rdx, r11
jb 0x140007ee0
mov rdx, qword [r10 + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x140007f27
cmp rax, r8
jne 0x140007f1d
mov rax, qword [r10 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140007f32
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x140007f32
cmp rax, r8
jne 0x140007f32
mov rax, qword [r8]
mov qword [rdx], rax
mov rbx, qword [r8]
mov edx, gethostname
dec qword [r10 + 0x10]
mov rcx, qword [r8 + 8]
mov qword [rcx], rbx
mov rcx, qword [r8 + 8]
mov qword [rbx + 8], rcx
mov rcx, r8
call fcn.140131c40
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140011610
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140011641
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x70], rsi
mov rsi, qword [0x1401ca8a8]
or rax, rbx
bsr rcx, rax
mov r8, rsi
mov qword [rsp + 0x78], rdi
inc ecx
shl rbx, cl
lea rcx, [0x1401ca8b8]
lea rdx, [rbx + rbx]
call fcn.140006120
lea r10, [rbx - 1]
mov qword [0x1401ca8d8], rbx
mov rbx, qword [0x1401ca8a8]
mov qword [0x1401ca8d0], r10
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rsi
je 0x140011835
mov qword [rsp + 0x60], rbp
movabs r11, 0x100000001b3
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
movups xmm0, xmmword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
xor edx, edx
mov rdi, qword [rdi]
movabs rax, 0xcbf29ce484222325
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rax
test r8, r8
je 0x140011704
mov r9, qword [rsp + 0x20]
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor rcx, rax
imul rcx, r11
cmp rdx, r8
jb 0x1400116f0
mov r12, qword [0x1401ca8b8]
and rcx, r10
shl rcx, 4
add r12, rcx
mov r15, qword [r12]
cmp r15, rsi
jne 0x14001172c
mov qword [r12], rbx
mov qword [r12 + 8], rbx
jmp 0x1400117e2
mov r14, qword [r12 + 8]
cmp r8, qword [r14 + 0x18]
jne 0x140011779
mov rdx, qword [r14 + 0x10]
movq rcx, xmm0
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140011779
mov r8, qword [r14]
cmp r8, rbx
je 0x140011772
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + 8], rbx
jmp 0x1400117d8
cmp r15, r14
je 0x1400117b3
movups xmm0, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x20], xmm0
mov rbp, qword [rsp + 0x28]
mov r13, qword [rsp + 0x20]
mov r14, qword [r14 + 8]
cmp rbp, qword [r14 + 0x18]
jne 0x1400117ae
mov rdx, qword [r14 + 0x10]
mov r8, rbp
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400117f6
cmp r15, r14
jne 0x140011791
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r14
mov rax, qword [r14 + 8]
mov qword [rax], rbx
mov qword [r14 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12], rbx
movabs r11, 0x100000001b3
mov rbx, rdi
cmp rdi, rsi
je 0x14001181c
mov r10, qword [0x1401ca8d0]
jmp 0x1400116c0
mov r8, qword [r14]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400117d8
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbx
ret
Function at 0x140022ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov eax, 1
mov qword [rsp + 0x38], rsi
mov r11, rcx
mov rdi, rdx
movzx ecx, byte [rdx + 0xb]
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
jge 0x140022f30
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x140022f30
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x140022f33
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x140022f6e
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov ebx, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x140022f5f
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x140022f5f
mov rcx, r11
call fcn.140022af0
add r10, 0x10
sub rbx, 1
jne 0x140022f41
mov rbx, qword [rsp + 0x30]
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x140022fd0
nop word [rax + rax]
movzx eax, byte [r10 + 9]
and al, 0x40
test byte [r10 + 8], 0xf
jne 0x140022f99
test al, al
je 0x140022fc7
mov byte [r10 + 9], ntohs
jmp 0x140022fc7
test al, al
je 0x140022faf
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x140022faf
mov rcx, r11
call fcn.140022af0
test byte [r10 + 8], 0x40
je 0x140022fc7
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x140022fc7
mov rcx, r11
call fcn.140022af0
add r10, 0x18
cmp r10, rsi
jb 0x140022f80
movzx eax, byte [rdi + 9]
mov rsi, qword [rsp + 0x38]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x140023007
mov rcx, rdi
call fcn.140022a60
mov rcx, qword [r11 + 0x90]
mov qword [rax], rcx
mov qword [r11 + 0x90], rdi
and byte [rdi + 9], 0xc7
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x140023011
xor al, 2
mov byte [rdi + 9], al
add rsp, 0x20
pop rdi
ret
Function at 0x14002e370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x38
mov qword [rsp + 0x80], rbx
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rdx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor esi, esi
lea r11, [0x140149560]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x14002e3df
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x14002e3d0
mov qword [rsp + 0x30], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x14002e3f6
mov r12d, ebp
jmp 0x14002e400
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x80]
jne 0x14002e559
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x14002e559
movsd xmm2, qword [0x14015e210]
lea r13, [0x140149560]
add rdx, 2
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x14002e45b
test edi, edi
jne 0x14002e4b0
mov edi, ebp
inc rdx
jmp 0x14002e440
test byte [r8 + r13 + 1], 0x10
je 0x14002e4b0
test r10d, r10d
jne 0x14002e473
cmp r8b, 0x30
jne 0x14002e473
inc r14d
jmp 0x14002e4a4
inc r10d
cmp r10d, 0x1e
jg 0x14002e4a1
test byte [rcx + r13 + 1], 2
je 0x14002e489
add ecx, 0xffffffd0
jmp 0x14002e48f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x14002e4a4
inc r9d
test edi, edi
je 0x14002e4ab
dec r9d
inc rdx
jmp 0x14002e440
mov r13, qword [rsp + 0x20]
lea eax, [r14 + r10]
test eax, eax
je 0x14002e559
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x14002e53f
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x14002e4e7
lea rdx, [r11 + 2]
jmp 0x14002e4f1
cmp al, 0x2b
jne 0x14002e4ef
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x140149560]
test byte [r8 + r11 + 1], 2
je 0x14002e559
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x14002e510
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x14002e54b
xorps xmm1, xmmword [0x14015ec20]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x14002e55c
xorps xmm0, xmm0
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret