joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140045d00
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
lea r15, [0x1402c3cc0]
mov qword [rsp + 0x70], r15
mov rcx, r15
call fcn.14005eff0
nop
xor r14d, r14d
mov qword [0x1402c3cf8], r14
mov qword [0x1402c3d00], 7
mov word [0x1402c3ce8], r14w
mov qword [0x1402c3d18], r14
mov qword [0x1402c3d20], 7
mov word [0x1402c3d08], r14w
mov qword [rsp + 0x40], r15
mov rcx, r15
call fcn.14005f3d0
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.140190db0
mov edx, 0x104
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movdqa xmm0, xmmword [0x140288fb0]
mov word [rsp + 0x20], r14w
movdqu xmmword [rsp + 0x30], xmm0
test eax, eax
je 0x140045e0b
mov edx, eax
lea rcx, [rsp + 0x20]
cmp rdx, 7
ja 0x140045e01
mov qword [rsp + 0x30], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.1401907f0
mov word [rsp + rbx + 0x20], r14w
jmp 0x140045e0b
lea r9, [rbp - 0x70]
call fcn.1400033a0
nop
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
mov edx, 2
cmp qword [rsp + 0x30], rdx
cmovb rdx, qword [rsp + 0x30]
lea r9, [rsp + 0x20]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 8
cmovae r9, rdi
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x140045e6d
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
call fcn.1401907f0
mov word [rsp + rbx + 0x48], r14w
jmp 0x140045e7c
call fcn.1400033a0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x20]
lea rcx, [0x1402c3ce8]
call fcn.140003950
movups xmm0, xmmword [rsp + 0x48]
movups xmmword [0x1402c3ce8], xmm0
movups xmm1, xmmword [rsp + 0x58]
movups xmmword [0x1402c3cf8], xmm1
movdqa xmm0, xmmword [0x140288fb0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
cmp rsi, 8
jb 0x140045eef
lea rdx, [rsi*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140045ee7
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045f71
mov rcx, rdi
call fcn.14018e2f4
cmp qword [0x1402c3cf8], 2
jne 0x140045f37
lea rdx, [0x1402c3ce8]
lea rcx, [rsp + 0x48]
call fcn.14000e620
lea rdx, [0x1402c3d08]
mov rcx, rax
call fcn.1400449d0
test al, al
je 0x140045f37
mov r8d, 1
lea rdx, [0x1402772c8]
lea rcx, [0x1402c3d08]
call fcn.14000d5c0
nop
lea rcx, [rsp + 0x40]
call fcn.14000e600
nop
mov rax, r15
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14018e2d0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.1401997dc
nop
int3
Function at 0x140049190
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2070
call fcn.14018ef70
sub rsp, rax
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r12, qword [rsp + 0x20d0]
lea rax, [rsp + 0x50]
mov r15, r9
mov qword [rsp + 0x20], rax
mov r14d, r8d
mov dword [rsp + 0x58], 0x1000
mov rbp, rdx
xor r13d, r13d
mov r9d, 0x20019
lea rdx, [0x140275b60]
xor r8d, r8d
mov rcx, 0xffffffff80000003
mov edi, r13d
mov ebx, 0xc000000d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140049268
call fcn.140004b70
mov dword [rsp + 0x40], esi
lea rcx, [0x140275b60]
mov qword [rsp + 0x38], rcx
lea rsi, str.MbCommonSigVerify
lea rcx, str.Error_opening__ws__x
mov r9d, 0x55b
mov r10, qword [rax]
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x30], rcx
lea rdx, str.EnumerateStores
mov qword [rsp + 0x28], rsi
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x14004939e
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140049393
lea rsi, str.MbCommonSigVerify
mov r8, rbp
lea rcx, [rsp + 0x60]
mov edx, 0x1000
call fcn.1401a9f40
mov ebx, eax
call fcn.140004b70
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
lea rdx, str.EnumerateStores
mov rcx, qword [rax]
mov r10, qword [rcx + 0x20]
lea rcx, [rsp + 0x60]
test ebx, ebx
jne 0x1400493cb
mov qword [rsp + 0x40], rcx
mov r9d, 0x56a
lea rcx, [0x140275b60]
mov qword [rsp + 0x38], rcx
lea rcx, str.Checking_store:__ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r14d
call fcn.140049410
mov ebx, eax
test eax, eax
je 0x140049393
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc edi
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, edi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400492b3
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14018e2d0
mov rbx, qword [rsp + 0x20b0]
add rsp, 0x2070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x40], rbp
mov r9d, 0x566
mov qword [rsp + 0x38], rcx
lea rcx, str.Registry_path_was_too_long____ws__ws
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call r10
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xc000000d
jmp 0x1400493a0
Function at 0x140049410
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x2070
call fcn.14018ef70
sub rsp, rax
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x2060], rax
mov r15, qword [rsp + 0x20d0]
mov rsi, rcx
mov rax, rdx
mov dword [rsp + 0x58], 0x1000
lea rcx, [rsp + 0x50]
mov r14, r9
mov qword [rsp + 0x20], rcx
mov ebp, r8d
xor r12d, r12d
mov rcx, rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov edi, 0xc000000d
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400495ad
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400495a2
mov qword [rsp + 0x20c0], r13
lea r13, str.____Checking_Sub_store:__ws__ws
nop dword [rax + rax]
call fcn.140004b70
lea rcx, [rsp + 0x60]
mov r9d, 0x59e
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], rsi
lea rcx, str.MbCommonSigVerify
mov r10, qword [rax]
lea rdx, str.EnumerateCerts
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rcx
mov rcx, rax
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9d, ebp
mov qword [rsp + 0x20], r15
mov r8, r14
call fcn.1400495e0
mov edi, eax
test eax, eax
je 0x14004959a
xor edx, edx
mov dword [rsp + 0x58], 0x1000
mov r8d, 0x1000
lea rcx, [rsp + 0x60]
inc ebx
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r12
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r12
mov edx, ebx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1400494e0
mov r13, qword [rsp + 0x20c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x2060]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x2070
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140049bf0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r12, qword [rsp + 0x4d0]
lea rax, [rsp + 0x50]
mov rbp, r8
mov dword [rsp + 0x58], 0x200
mov r14d, edx
mov qword [rsp + 0x20], rax
mov r15, rcx
xor r13d, r13d
mov rdx, rbp
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov edi, 0xc000000d
mov ebx, r13d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
je 0x140049cb7
call fcn.140004b70
mov dword [rsp + 0x40], esi
lea rcx, str.Failed_to_open__ws__x
mov qword [rsp + 0x38], rbp
lea rsi, str.MbCommonSigVerify
mov qword [rsp + 0x30], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x28], rsi
mov r9d, 0x666
mov rcx, rax
mov dword [rsp + 0x20], 2
call qword [r10 + 0x20]
jmp 0x140049dc7
mov r8d, dword [rsp + 0x58]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140049dbc
lea rsi, str.MbCommonSigVerify
call fcn.140004b70
lea rcx, [rsp + 0x60]
mov r9d, 0x670
mov qword [rsp + 0x40], rcx
lea r8, str.d:jenkinsworkspace_n_mbcommon_srcmbcommon_fileverify.cpp
mov qword [rsp + 0x38], rbp
lea rcx, str.Checking__ws__ws
mov r10, qword [rax]
lea rdx, str.FindCert
mov qword [rsp + 0x30], rcx
mov rcx, rax
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 5
call qword [r10 + 0x20]
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov r9, r15
mov qword [rsp + 0x20], r12
mov edx, r14d
call fcn.140049e00
mov edi, eax
test eax, eax
jns 0x140049dbc
xor edx, edx
mov dword [rsp + 0x58], 0x200
mov r8d, 0x200
lea rcx, [rsp + 0x60]
inc ebx
call fcn.140190db0
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x38], r13
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], r13
mov edx, ebx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140049d02
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.14018e2d0
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140052f30
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140042680
cmp qword [rax + 0x18], 8
jb 0x140052f4d
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x140052f96
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140052f91
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140052f9e
call fcn.14018e2f4
mov eax, ebx
add rsp, 0x40
pop rbx
ret
call fcn.1401997dc
int3

Function at 0x1400561a0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add rsp, 0x40
pop rbx
ret

Function at 0x140056200
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [rsp + 0x90]
mov r10, r9
mov r9, qword [rsp + 0x70]
mov r11d, r8d
mov qword [rsp + 0x38], rax
mov rcx, rdx
mov rax, qword [rsp + 0x88]
mov r8, r10
mov qword [rsp + 0x30], rax
mov edx, r11d
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add rsp, 0x40
pop rbx
ret

Function at 0x140056380
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rsp + 0x70]
mov r10, r9
mov r9, qword [rsp + 0x60]
mov r11, r8
mov qword [rsp + 0x28], rax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8, r10
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add rsp, 0x30
pop rbx
ret

Function at 0x140056400
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov r10d, r9d
mov r9d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x28], eax
mov rcx, rdx
mov rax, qword [rsp + 0x68]
mov r8d, r10d
mov rdx, r11
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
pop rbx
ret
Function at 0x14005aa70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x18
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp], rax
mov r14, qword [r8 + 0x18]
mov r10, r8
mov rbx, qword [r8 + 0x10]
mov r15, rdx
mov r11, rcx
mov r9, r8
cmp r14, 8
jb 0x14005aaa9
mov r9, qword [r8]
lea r8, [rbx + rbx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test r8, r8
je 0x14005aae4
movabs rdi, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rdi
cmp rcx, r8
jb 0x14005aad0
mov rax, qword [r11 + 0x30]
mov rdi, qword [r11 + 8]
and rax, rdx
mov rdx, qword [r11 + 0x18]
mov rcx, rax
add rcx, rcx
mov qword [rsp + 0x10], rsi
add rax, rax
mov rcx, qword [rdx + rcx*8]
mov rbp, qword [rdx + rax*8]
lea r12, [rdx + rax*8]
nop dword [rax]
cmp rbp, rdi
jne 0x14005ab1a
mov rax, rdi
jmp 0x14005ab22
mov rax, qword [r12 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14005abc9
mov rax, r10
cmp r14, 8
jb 0x14005ab37
mov rax, qword [r10]
mov rsi, qword [rcx + 0x28]
lea r9, [rcx + 0x10]
cmp rsi, 8
jb 0x14005ab49
mov r9, qword [rcx + 0x10]
mov r11, qword [rcx + 0x20]
cmp r11, rbx
jne 0x14005abb9
mov r8, r11
test r11, r11
je 0x14005ab74
sub r9, rax
nop dword [rax]
movzx edx, word [rax]
cmp word [rax + r9], dx
jne 0x14005abb9
add rax, 2
sub r8, 1
jne 0x14005ab60
lea rdx, [rcx + 0x10]
cmp rsi, 8
jb 0x14005ab81
mov rdx, qword [rdx]
cmp r14, 8
jb 0x14005ab8a
mov r10, qword [r10]
cmp rbx, r11
jne 0x14005abc1
test rbx, rbx
je 0x14005abc4
sub r10, rdx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rdx + r10], ax
jne 0x14005abc1
add rdx, 2
sub rbx, 1
jne 0x14005aba0
mov qword [r15], rcx
jmp 0x14005abcc
mov rcx, qword [rcx]
jmp 0x14005ab10
mov rcx, rdi
mov qword [r15], rcx
jmp 0x14005abcc
mov qword [r15], rdi
mov rsi, qword [rsp + 0x10]
mov rax, r15
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x18
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x14005af30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r10, r8
mov r14, rdx
mov r15, rcx
mov qword [rsp + 0x20], rcx
mov r11, qword [r8 + 0x10]
mov rbx, qword [r8 + 0x18]
cmp rbx, 8
jb 0x14005af75
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r9, [r11 + r11]
xor ecx, ecx
test r9, r9
je 0x14005afb4
movabs rdi, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, r9
jb 0x14005afa0
mov r12, qword [r15 + 0x30]
and r12, rdx
mov rsi, qword [r15 + 8]
mov rcx, r12
add rcx, rcx
mov rax, qword [r15 + 0x18]
mov r9, qword [rax + rcx*8]
cmp r9, rsi
jne 0x14005afd7
mov rdi, rsi
jmp 0x14005afe0
mov rdi, qword [rax + rcx*8 + 8]
mov rdi, qword [rdi]
nop
cmp rdi, r9
je 0x14005b039
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x14005aff8
mov rax, qword [rdi + 0x10]
mov r8, r10
cmp rbx, 8
jb 0x14005b004
mov r8, qword [r10]
cmp r11, qword [rdi + 0x20]
jne 0x14005afe0
mov rdx, r11
test r11, r11
je 0x14005b029
sub r8, rax
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14005afe0
add rax, 2
sub rdx, 1
jne 0x14005b015
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005b120
mov rbx, qword [rsi]
mov rsi, qword [rbx + 8]
mov r9, r10
mov r8, rsi
mov rdx, rbx
call fcn.14005b710
mov rdx, rax
mov rax, qword [r15 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x14005b13b
inc rax
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rsi], rdx
mov rcx, qword [r15 + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x38], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14005b0bf
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r15 + 8]
shl r12, 4
mov r8, qword [r15 + 0x18]
add r8, r12
mov rax, qword [r8]
cmp rax, rcx
jne 0x14005b0e0
mov qword [r8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + r12 + 8], rbx
jmp 0x14005b10c
cmp rax, rdi
jne 0x14005b0ea
mov qword [r8], rbx
jmp 0x14005b10c
mov rax, qword [r8 + 8]
mov rdx, qword [rax]
mov qword [r8 + 8], rdx
cmp rdx, rbx
je 0x14005b10c
mov r8, qword [r15 + 0x18]
mov rax, qword [r8 + r12 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r12 + 8], rdx
mov rcx, r15
call fcn.14005b1e0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x58
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.14018c838
int3
Function at 0x14005b2a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x20], rax
cmp qword [r8 + 0x28], 8
lea r9, [r8 + 0x10]
mov r10, qword [r9 + 0x10]
mov rdi, rdx
mov r11, rcx
jb 0x14005b2d1
mov r9, qword [r9]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x14005b304
movabs rbx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r10
jb 0x14005b2f0
mov r9, qword [r11 + 0x30]
mov rcx, qword [r11 + 0x18]
and r9, rdx
shl r9, 4
add rcx, r9
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14005b344
cmp rax, r8
jne 0x14005b33a
mov rax, qword [r11 + 8]
mov qword [rcx], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x14005b34f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14005b34f
cmp rax, r8
jne 0x14005b34f
mov rax, qword [r8]
mov qword [rcx], rax
mov rcx, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rcx], rbx
mov rdx, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rdx + 8], rcx
mov rdx, r8
dec qword [r11 + 0x10]
call fcn.14005abf0
mov rax, rdi
mov qword [rdi], rbx
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.14018e2d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14005b4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x58
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1402b9ae8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov r11, qword [r8 + 0x10]
mov r12, qword [r8 + 0x18]
cmp r12, 8
jb 0x14005b52c
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r9, [r11 + r11]
xor ecx, ecx
test r9, r9
je 0x14005b564
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, r9
jb 0x14005b550
mov r9, qword [rsi + 0x30]
and r9, rdx
mov rbx, qword [rsi + 8]
mov rcx, r9
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov r15, qword [rax + rcx*8]
cmp rbx, r15
je 0x14005b60a
mov rbx, qword [rax + rcx*8 + 8]
mov rbx, qword [rbx]
nop
cmp rbx, r15
je 0x14005b60a
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
cmp qword [rbx + 0x28], 8
jb 0x14005b5a8
mov rax, qword [rbx + 0x10]
mov r8, r10
cmp r12, 8
jb 0x14005b5b4
mov r8, qword [r10]
cmp r11, qword [rbx + 0x20]
jne 0x14005b590
mov rdx, r11
test r11, r11
je 0x14005b5d9
sub r8, rax
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x14005b590
add rax, 2
sub rdx, 1
jne 0x14005b5c5
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi]
mov qword [rdx], rcx
mov rdx, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rdx + 8], rcx
dec qword [rsi + 0x10]
mov rdx, rdi
call fcn.14005abf0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005b6a1
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005b63f
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r9, 4
mov rcx, qword [rsi + 0x18]
add rcx, r9
mov rax, qword [rcx]
cmp rax, qword [rsi + 8]
jne 0x14005b661
mov qword [rcx], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r9 + 8], rdi
jmp 0x14005b68d
cmp rax, rbx
jne 0x14005b66b
mov qword [rcx], rdi
jmp 0x14005b68d
mov rax, qword [rcx + 8]
mov rdx, qword [rax]
mov qword [rcx + 8], rdx
cmp rdx, rdi
je 0x14005b68d
mov r8, qword [rsi + 0x18]
mov rax, qword [r8 + r9 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r9 + 8], rdx
mov rcx, rsi
call fcn.14005b1e0
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14018e2d0
add rsp, 0x58
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret

Function at 0x14005cac0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x238
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov ecx, 0x202
lea rdx, [rsp + 0x90]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14005caef
add rsp, 0x238
ret
lea rdx, str.Failed_to_initialize_network_subsystem
lea rcx, [rsp + 0x28]
call fcn.1400035f0
nop
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.14005cb70
lea rdx, [0x1402b0398]
lea rcx, [rsp + 0x48]
call fcn.140190700
int3