joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009dc98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov rsi, rdx
mov r9, rcx
mov r10d, dword [r8]
mov dword [rax + 0x18], r10d
movabs rdi, 0xcbf29ce484222325
mov rcx, rdi
xor edx, edx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x60]
xor rcx, rax
imul rcx, r14
inc rdx
cmp rdx, 4
jb 0x14009dce0
movzx r11d, byte [r8 + 4]
mov eax, r11d
xor rax, rdi
imul rax, r14
imul rdx, rcx, 0x18d
xor rdx, rax
and rdx, qword [r9 + 0x30]
mov rdi, qword [r9 + 8]
mov r8, rdx
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x14009dd95
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x14009dd95
add rdx, rdx
mov rdi, qword [rdi + 8]
cmp r10d, dword [rdi + 0x10]
jne 0x14009dd4e
cmp r11b, byte [rdi + 0x14]
jne 0x14009dd4e
mov eax, 1
jmp 0x14009dd50
xor eax, eax
test al, al
jne 0x14009dd5c
cmp rdi, qword [rcx + rdx*8]
jne 0x14009dd37
jmp 0x14009dd95
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140015ba0
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14009de29
mov rax, qword [rbx]
cmp rdi, rax
je 0x14009ddca
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14009dde7
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14009de16
cmp rax, rdi
jne 0x14009ddf2
mov qword [rdx + r8*8], rbx
jmp 0x14009de16
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14009de16
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1400a6cd4
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14009dfb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov rsi, rdx
mov r9, rcx
movzx edx, byte [r8]
mov eax, edx
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rcx, qword [r9 + 0x30]
and rcx, rax
mov rdi, qword [r9 + 8]
mov r8, rcx
add r8, r8
mov rax, qword [r9 + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14009e06a
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14009e06a
add rcx, rcx
mov rdi, qword [rdi + 8]
cmp dl, byte [rdi + 0x10]
je 0x14009e031
cmp rdi, qword [rax + rcx*8]
jne 0x14009e020
jmp 0x14009e06a
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140015ba0
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14009e0fe
mov rax, qword [rbx]
cmp rdi, rax
je 0x14009e09f
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14009e0bc
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14009e0eb
cmp rax, rdi
jne 0x14009e0c7
mov qword [rdx + r8*8], rbx
jmp 0x14009e0eb
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14009e0eb
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1400a6e34
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a7974
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x1400a7999
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400a79f1
cmp qword [rcx + rdx*8], rdi
jne 0x1400a79e6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400a79ea
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400a79fe
cmp qword [rcx + rdx*8], rdi
jne 0x1400a79fe
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140015ba0
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a7a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
movabs r10, 0xcbf29ce484222325
mov rsi, rdx
mov r8, rcx
mov rcx, r10
xor r9d, r9d
movabs rdx, 0x100000001b3
mov eax, dword [rdi + 0x10]
mov dword [rsp + 0x30], eax
movzx eax, byte [rsp + r9 + 0x30]
inc r9
xor rcx, rax
imul rcx, rdx
cmp r9, 4
jb 0x1400a7a79
movzx eax, byte [rdi + 0x14]
xor rax, r10
imul rax, rdx
imul rdx, rcx, 0x18d
mov rcx, qword [r8 + 0x18]
xor rdx, rax
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400a7ad9
cmp qword [rcx + rdx*8], rdi
jne 0x1400a7ace
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400a7ad2
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400a7ae6
cmp qword [rcx + rdx*8], rdi
jne 0x1400a7ae6
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140015ba0
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a7b28
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [r8 + 0x10]
mov r9, rcx
mov rdi, r8
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
mov rsi, rdx
movabs rcx, 0x100000001b3
mov r8, qword [r9 + 0x30]
imul rax, rcx
mov rcx, qword [r9 + 0x18]
and r8, rax
add r8, r8
cmp qword [rcx + r8*8 + 8], rdi
jne 0x1400a7b98
cmp qword [rcx + r8*8], rdi
jne 0x1400a7b8d
mov rax, qword [r9 + 8]
mov qword [rcx + r8*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400a7b91
mov rax, qword [rdi + 8]
mov qword [rcx + r8*8 + 8], rax
jmp 0x1400a7ba5
cmp qword [rcx + r8*8], rdi
jne 0x1400a7ba5
mov rax, qword [rdi]
mov qword [rcx + r8*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r9 + 0x10]
call fcn.140015ba0
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a819c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, r8
movabs r9, 0xcbf29ce484222325
mov r8, rcx
xor r10d, r10d
movzx eax, byte [r10 + r11]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x1400a81af
mov rcx, qword [r8 + 0x30]
and rcx, r9
mov r9, qword [r8 + 0x18]
mov r8, qword [r8 + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + r10*8], r8
jne 0x1400a81f6
mov rcx, r8
jmp 0x1400a81fe
mov rcx, qword [r9 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a821f
mov ecx, dword [r11]
cmp dword [rax + 0x10], ecx
je 0x1400a8210
mov rax, qword [rax]
jmp 0x1400a81eb
mov ecx, dword [rax + 0x10]
cmp dword [r11], ecx
cmovne rax, r8
mov qword [rdx], rax
jmp 0x1400a8222
mov qword [rdx], r8
mov rax, rdx
ret
Function at 0x1400ad5e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r14, rdx
mov r15, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x1400ad620
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x1400ad64f
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x1400ad631
mov r13, qword [r15 + 0x30]
and r13, rdx
lea r8, [r15 + 8]
mov qword [rsp + 0x80], r8
mov rdi, qword [r8]
mov rsi, r13
add rsi, rsi
mov rax, qword [r15 + 0x18]
cmp rdi, qword [rax + rsi*8]
je 0x1400ad6f2
mov rdi, qword [rax + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + rsi*8]
je 0x1400ad6f2
add r13, r13
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400ad699
mov rdx, qword [rdi + 0x10]
mov rcx, r12
cmp qword [r12 + 0x18], 0x10
jb 0x1400ad6a8
mov rcx, qword [r12]
cmp r9, qword [rdi + 0x20]
jne 0x1400ad6e4
mov r8, r9
call fcn.140210b10
test eax, eax
jne 0x1400ad6df
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.1400b1370
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400ad786
mov r9, qword [r12 + 0x10]
mov rax, qword [r15 + 0x18]
cmp rdi, qword [rax + r13*8]
jne 0x1400ad686
lea r8, [r15 + 8]
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400ad727
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r8]
jne 0x1400ad743
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x1400ad772
cmp rax, rdi
jne 0x1400ad74e
mov qword [rdx + rsi*8], rbx
jmp 0x1400ad772
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x1400ad772
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.1400b0a08
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b12c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x1400b12e2
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
test rbx, rbx
je 0x1400b1311
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x1400b12f3
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400b1349
cmp qword [rcx + rdx*8], r8
jne 0x1400b133e
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1400b1342
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400b1356
cmp qword [rcx + rdx*8], r8
jne 0x1400b1356
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.1400b1370
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400b1400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov rdi, r8
mov r14, qword [r8 + 0x10]
mov rsi, rdx
mov rbp, rcx
jb 0x1400b1434
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r14, r14
je 0x1400b1463
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r9
cmp rcx, r14
jb 0x1400b1445
mov rax, qword [rbp + 0x30]
mov r15, qword [rbp + 0x18]
and rax, rdx
mov rbp, qword [rbp + 8]
mov rbx, rax
add rbx, rbx
lea r12, [rax + rax]
mov rbx, qword [r15 + rbx*8]
cmp qword [r15 + r12*8], rbp
jne 0x1400b148b
mov rax, rbp
jmp 0x1400b1493
mov rax, qword [r15 + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400b1501
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1400b14a5
mov rdx, qword [rdi]
cmp qword [rbx + 0x28], 0x10
lea rcx, [rbx + 0x10]
jb 0x1400b14b4
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
cmp r8, r14
jne 0x1400b14c6
call fcn.140210b10
test eax, eax
je 0x1400b14cb
mov rbx, qword [rbx]
jmp 0x1400b1480
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x1400b14da
mov rdx, qword [rbx + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x1400b14e4
mov rdi, qword [rdi]
cmp r14, qword [rbx + 0x20]
jne 0x1400b14f9
mov r8, r14
mov rcx, rdi
call fcn.140210b10
test eax, eax
je 0x1400b14fc
mov rbx, rbp
mov qword [rsi], rbx
jmp 0x1400b1504
mov qword [rsi], rbp
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400c2b18
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
mov dil, 1
cmp ecx, 0xffffffff
je 0x1400c2cc3
cmp ecx, 0x7c
je 0x1400c2cc3
cmp ecx, 0x29
jne 0x1400c2b5e
cmp dword [rbx + 0x1c], 0
jne 0x1400c2cc3
test dword [rbx + 0x80], 0x10000000
je 0x1400c2ce4
cmp ecx, 0x2e
jne 0x1400c2b7e
lea rcx, [rbx + 0x40]
mov edx, 5
call fcn.1400c4b9c
mov rcx, rbx
call fcn.1400c4c24
jmp 0x1400c2cae
cmp ecx, 0x5c
jne 0x1400c2bed
mov rcx, rbx
call fcn.1400c4c24
mov eax, dword [rbx + 0x80]
and eax, 0x80
je 0x1400c2bba
cmp word [rbx + 0x78], 0x62
jne 0x1400c2bba
mov edx, 4
lea rcx, [rbx + 0x40]
call fcn.1400c4b9c
mov rcx, rbx
call fcn.1400c4c24
jmp 0x1400c2cb6
test eax, eax
je 0x1400c2be0
cmp word [rbx + 0x78], 0x42
jne 0x1400c2be0
lea rcx, [rbx + 0x40]
mov edx, 4
call fcn.1400c4b9c
mov rax, qword [rbx + 0x48]
add rax, 0xc
xor dword [rax], 1
jmp 0x1400c2bad
mov rcx, rbx
call fcn.1400c2d1c
jmp 0x1400c2cae
cmp ecx, 0x5b
jne 0x1400c2c14
mov rcx, rbx
call fcn.1400c4c24
mov rcx, rbx
call fcn.1400c3270
cmp dword [rbx + 0x7c], 0x5d
mov rcx, rbx
je 0x1400c2b74
jmp 0x1400c2cce
cmp ecx, 0x28
jne 0x1400c2c3a
mov rcx, rbx
call fcn.1400c4c24
mov rcx, rbx
call fcn.1400c55c0
cmp dword [rbx + 0x7c], 0x29
mov dil, al
mov rcx, rbx
je 0x1400c2ca4
jmp 0x1400c2cd9
cmp ecx, 0x5e
jne 0x1400c2c47
lea edx, [rcx - 0x5c]
jmp 0x1400c2ba4
cmp ecx, 0x24
jne 0x1400c2c54
lea edx, [rcx - 0x21]
jmp 0x1400c2ba4
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400c2d0e
cmp ecx, 0x3f
je 0x1400c2d0e
cmp ecx, 0x7b
je 0x1400c2d0e
cmp ecx, 0x7d
jne 0x1400c2c83
test dword [rbx + 0x80], 0x10000000
je 0x1400c2cf2
cmp ecx, 0x5d
jne 0x1400c2c94
test dword [rbx + 0x80], 0x10000000
je 0x1400c2d00
movzx edx, word [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.14014a668
mov rcx, rbx
call fcn.1400c4c24
test dil, dil
je 0x1400c2cb6
mov rcx, rbx
call fcn.1400c4cf8
mov ecx, dword [rbx + 0x7c]
mov al, 1
mov dil, al
jmp 0x1400c2b2d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 4
call fcn.14014bb64
int3
mov edx, 5
call fcn.14014bb64
int3
mov edx, 5
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 6
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 4
mov rcx, rbx
call fcn.14014bb64
int3
mov edx, 0xa
mov rcx, rbx
call fcn.14014bb64
int3
Function at 0x1400d523c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov rbx, r9
mov rsi, rdx
mov r9, rcx
mov r10d, dword [r8]
mov dword [rax + 0x18], r10d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x60]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400d5272
mov rax, qword [r9 + 0x30]
and rax, rcx
mov rdi, qword [r9 + 8]
mov r8, rax
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x1400d5308
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x1400d5308
add rax, rax
mov rdi, qword [rdi + 8]
cmp r10d, dword [rdi + 0x10]
je 0x1400d52cf
cmp rdi, qword [rcx + rax*8]
jne 0x1400d52bd
jmp 0x1400d5308
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x20]
call fcn.140015ba0
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400d539c
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400d533d
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1400d535a
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400d5389
cmp rax, rdi
jne 0x1400d5365
mov qword [rdx + r8*8], rbx
jmp 0x1400d5389
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400d5389
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1400d653c
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400d56c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, rdx
lea rax, [r8 - 1]
mov r10, rdx
mov rdi, rdx
cqo
mov r11, rcx
sub rax, rdx
sar rax, 1
mov rdx, rax
cmp rbx, rax
jge 0x1400d571d
lea rbx, [rbx*2 + 2]
movzx ecx, word [r11 + rbx*2 - 2]
cmp word [r11 + rbx*2], cx
jae 0x1400d570b
dec rbx
movzx eax, word [r11 + rbx*2]
mov word [r11 + r10*2], ax
mov r10, rbx
cmp rbx, rdx
jl 0x1400d56f3
cmp rbx, rdx
jne 0x1400d5741
mov rax, r8
cqo
and eax, 1
xor rax, rdx
cmp rax, rdx
jne 0x1400d5741
movzx eax, word [r11 + r8*2 - 2]
mov word [r11 + r10*2], ax
lea r10, [r8 - 1]
cmp rdi, r10
jge 0x1400d576a
lea rax, [r10 - 1]
cqo
sub rax, rdx
sar rax, 1
movzx ecx, word [r11 + rax*2]
cmp cx, word [r9]
jae 0x1400d576a
mov word [r11 + r10*2], cx
mov r10, rax
cmp rdi, rax
jl 0x1400d5746
movzx eax, word [r9]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov word [r11 + r10*2], ax
ret
Function at 0x1400d66c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 0x10]
mov rdi, r8
mov r9, rcx
mov dword [rsp + 0x30], eax
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rsp + rcx + 0x30]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x1400d66f4
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400d674b
cmp qword [rcx + rdx*8], rdi
jne 0x1400d6740
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400d6744
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400d6758
cmp qword [rcx + rdx*8], rdi
jne 0x1400d6758
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x20]
dec qword [r9 + 0x10]
call fcn.140015ba0
mov rcx, rdi
call fcn.140210c50
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400dbd70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400dbda8
mov rax, qword [r9 + 0x30]
and rax, rcx
mov rdi, qword [r9 + 8]
mov r8, rax
add r8, r8
mov rcx, qword [r9 + 0x18]
cmp rdi, qword [rcx + r8*8]
je 0x1400dbe40
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rcx + r8*8]
je 0x1400dbe40
mov edx, dword [r10]
add rax, rax
mov rdi, qword [rdi + 8]
cmp edx, dword [rdi + 0x10]
je 0x1400dbe07
cmp rdi, qword [rcx + rax*8]
jne 0x1400dbdf6
jmp 0x1400dbe40
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14007e580
mov rcx, rbx
call fcn.140210c50
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400dbed4
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400dbe75
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1400dbe92
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400dbec1
cmp rax, rdi
jne 0x1400dbe9d
mov qword [rdx + r8*8], rbx
jmp 0x1400dbec1
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400dbec1
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1400e1e70
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret