joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1503469a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x15007e060]
mov edi, 1
add rcx, rdi
mov rbx, qword [0x15007e088]
xorps xmm0, xmm0
js 0x1503469cc
cvtsi2ss xmm0, rcx
jmp 0x1503469e1
mov rax, rcx
and rcx, rdi
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x15007e050]
call fcn.1504413bc
movss xmm1, dword [0x1502703c8]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x150346a13
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x150346a13
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x150346a41
cmp rbx, 0x200
jae 0x150346a3e
shl rbx, 3
cmp rbx, rcx
jae 0x150346a41
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rdi
shl rax, cl
cmp rbx, rax
ja 0x150346ba4
lea rax, [rbx - 1]
mov rbx, qword [0x15007e058]
or rax, rdi
mov r8, rbx
bsr rcx, rax
inc ecx
shl rdi, cl
lea rcx, [0x15007e068]
lea rdx, [rdi + rdi]
call fcn.1502ae44c
mov rax, qword [0x15007e058]
lea rdx, [rdi - 1]
mov qword [0x15007e080], rdx
mov qword [0x15007e088], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x150346b99
movzx r8d, byte [rax + 0x10]
movabs r9, 0xcbf29ce484222325
mov rdi, qword [0x15007e068]
mov r11d, r8d
mov rcx, qword [rcx]
xor r11, r9
movabs r9, 0x100000001b3
imul r11, r9
and r11, rdx
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x150346af4
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x150346b5f
mov r10, qword [rdi + r11*8 + 8]
cmp r8b, byte [r10 + 0x10]
jne 0x150346b34
mov r10, qword [r10]
cmp r10, rax
je 0x150346aed
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x150346aed
mov r10, qword [r10 + 8]
cmp r8b, byte [r10 + 0x10]
je 0x150346b73
cmp qword [rdi + r11*8], r10
jne 0x150346b2a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x150346b99
mov rdx, qword [0x15007e080]
jmp 0x150346ab0
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x150346b5f
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x150175640]
call fcn.15040822c
int3
Function at 0x150355f68
Capabilities:
Hash data using sha1

Disassembly:
test rcx, rcx
jne 0x150355f71
lea eax, [rcx + 0x10]
ret
and dword [rcx + 0x1c], 0
xor eax, eax
and qword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret
Function at 0x1503583b4
Capabilities:
Hash data using sha256

Disassembly:
test rcx, rcx
jne 0x1503583bd
lea eax, [rcx + 0x10]
ret
and dword [rcx + 0x28], 0
xor eax, eax
and qword [rcx], 0
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret
Function at 0x15036ee90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea rbp, [r8 - 1]
mov r12, r9
sar rbp, 1
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r15, rdx
mov rbx, rdx
cmp rdx, rbp
jge 0x15036ef0c
add rbx, rbx
lea rax, [rbx + 2]
lea rax, [rax + rax*4]
lea rdx, [rsi + rax*8]
lea r8, [rdx - 0x28]
call fcn.15036aa10
movzx eax, al
xor rax, 1
inc rax
add rbx, rax
lea rax, [rbx + rbx*4]
lea rdx, [rsi + rax*8]
lea rax, [rdi + rdi*4]
lea rcx, [rsi + rax*8]
call fcn.1503676f0
mov rdi, rbx
cmp rbx, rbp
jl 0x15036eeca
cmp rbx, rbp
jne 0x15036ef34
test r14b, 1
jne 0x15036ef34
lea rax, [r14 - 1]
lea rax, [rax + rax*4]
lea rdx, [rsi + rax*8]
lea rax, [rdi + rdi*4]
lea rcx, [rsi + rax*8]
call fcn.1503676f0
lea rdi, [r14 - 1]
cmp r15, rdi
jge 0x15036ef6f
lea rbx, [rdi - 1]
mov r8, r12
sar rbx, 1
lea rax, [rbx + rbx*4]
lea rbp, [rsi + rax*8]
mov rdx, rbp
call fcn.15036aa10
test al, al
je 0x15036ef6f
lea rax, [rdi + rdi*4]
mov rdx, rbp
lea rcx, [rsi + rax*8]
call fcn.1503676f0
mov rdi, rbx
cmp r15, rbx
jl 0x15036ef39
lea rax, [rdi + rdi*4]
mov rdx, r12
lea rcx, [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1503676f0

Function at 0x1503737b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r10, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x1503737c0
mov rcx, qword [r10 + 0x30]
and rcx, r8
mov r8, qword [r10 + 0x18]
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [r10 + 8]
je 0x150373812
mov r8, qword [r8 + rcx*8]
mov rcx, qword [rdx]
jmp 0x15037380a
cmp rax, r8
je 0x150373812
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x150373801
jmp 0x150373814
xor eax, eax
test rax, rax
cmove rax, qword [r10 + 8]
cmp rax, qword [r10 + 8]
jne 0x150373825
xor eax, eax
ret
mov rax, qword [rax + 0x18]
ret
Function at 0x150373948
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rdx + r8]
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
inc rdx
cmp rdx, 8
jb 0x150373979
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x150373a0a
mov rbx, rbp
movabs rax, 0x7ffffffffffffff
cmp qword [r14 + 0x10], rax
je 0x150373b55
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r12]
movdqu xmmword [rax + 0x10], xmm0
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x150373a43
cvtsi2ss xmm0, rcx
jmp 0x150373a58
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x150373a1c
cmp rbx, rdx
je 0x150373a3c
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x150373a13
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x1503739bb
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x150373b35
mov rbp, rbx
xor eax, eax
jmp 0x150373a2b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x150373a6b
cvtsi2ss xmm1, rcx
jmp 0x150373a80
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x150373adc
mov rcx, r14
call fcn.15032be84
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x150373ad2
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x150373ac9
mov rbx, rax
cmp rax, rdx
je 0x150373b10
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x150373abd
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x150373b17
mov qword [rcx + rax*8], rdi
jmp 0x150373b29
mov qword [rsp + 0x20], rax
jmp 0x150373ad7
cmp r8, rbp
jne 0x150373b22
mov qword [rcx + rax*8], rdi
jmp 0x150373b2e
cmp qword [rcx + rax*8 + 8], rdx
jne 0x150373b2e
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3
Function at 0x150377460
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x150012098]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rcx, rdx
call fcn.150366e84
mov ecx, eax
xor ebx, ebx
lea r14, [0x150264cf0]
cmp eax, 6
jg 0x1503775c2
je 0x1503775de
sub ecx, 1
je 0x150377584
sub ecx, 1
je 0x150377547
sub ecx, 1
je 0x150377509
sub ecx, 1
jne 0x1503775d9
mov rcx, rdi
call fcn.150367098
mov rcx, rdi
call fcn.150367098
mov qword [rbp - 0x50], rax
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
movzx eax, byte [rbp + rbx - 0x50]
xor rcx, rax
imul rcx, rdx
inc rbx
cmp rbx, 8
jb 0x1503774f2
jmp 0x15037757c
mov rcx, rdi
call fcn.150367324
mov rcx, rdi
call fcn.150367324
mov dword [rbp - 0x50], eax
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
movzx eax, byte [rbp + rbx - 0x50]
xor rcx, rax
imul rcx, rdx
inc rbx
cmp rbx, 4
jb 0x150377530
jmp 0x15037757c
mov rcx, rdi
call fcn.150366f50
mov qword [rbp - 0x50], rax
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
movzx eax, byte [rbp + rbx - 0x50]
xor rcx, rax
imul rcx, rdx
inc rbx
cmp rbx, 8
jb 0x150377567
mov rax, rcx
jmp 0x1503776cc
mov rcx, rdi
call fcn.1503671dc
mov rcx, rdi
call fcn.1503671dc
mov dword [rbp - 0x50], eax
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
movzx eax, byte [rbp + rbx - 0x50]
xor rcx, rax
imul rcx, rdx
inc rbx
cmp rbx, 4
jb 0x1503775ab
jmp 0x15037757c
sub ecx, 7
je 0x1503776a6
sub ecx, 1
je 0x1503775de
sub ecx, 1
je 0x150377686
cmp ecx, 1
jne 0x150377630
mov dword [rbp - 0x48], 3
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x38], 0x11f
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x150270450]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], bl
mov r8d, SafeArrayGetDim
lea rdx, [0x150264f88]
lea rcx, [rbp - 0x30]
call fcn.1502a9928
lea rdx, [rbp - 0x48]
call fcn.150365534
nop
lea rcx, [rbp - 0x48]
call fcn.15036544c
mov dword [rbp - 0x48], 3
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x38], 0x137
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x150270450]
movdqu xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x30], bl
mov r8d, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rdx, [0x150264128]
lea rcx, [rbp - 0x30]
call fcn.1502a9928
lea rdx, [rbp - 0x48]
call fcn.150365534
nop
lea rcx, [rbp - 0x48]
call fcn.15036544c
xor eax, eax
jmp 0x1503776cc
mov rcx, rdi
call fcn.1503675ac
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x15037769c
mov rax, qword [rax]
mov rcx, rax
call fcn.1502b08e4
jmp 0x1503776cc
mov rcx, rdi
call fcn.150367468
movzx eax, al
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rdx, 0x100000001b3
imul rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.15040aca0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x15037b650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
mov r12, qword [rcx + 8]
mov qword [rsp + 0x20], r12
mov rcx, qword [rcx + 0x28]
cmp r12, 1
jne 0x15037b6d1
lea eax, [r12 + 7]
mov qword [rsi + 0x18], rax
mov qword [rsi + 8], rax
test rcx, rcx
jne 0x15037b69a
lea ebx, [rax + 0x38]
mov ecx, ebx
call fcn.15040af44
jmp 0x15037b6ad
lea r8, [0x15002f388]
mov ebx, 0x40
mov edx, ebx
call fcn.150371598
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.15040dca0
mov qword [rsi + 0x20], rdi
mov rax, rsi
shr rax, 4
mov qword [rsi + 0x10], rax
jmp 0x15037b881
mov r15, qword [rsi + 0x20]
mov qword [rsi + 8], rdx
lea rbx, [rdx*8]
test rcx, rcx
jne 0x15037b6f0
mov rcx, rbx
call fcn.15040af44
jmp 0x15037b704
lea rdx, [rbx + 7]
and rdx, 0xfffffffffffffff8
lea r8, [0x15002f388]
call fcn.150371598
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.15040dca0
mov qword [rsi + 0x20], rdi
mov r14, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
mov qword [rsi + 0x18], rax
cmp r14, r12
jae 0x15037b86a
movabs rdi, 0x9e3779b97f4a7c15
mov rbp, qword [r15 + r14*8]
mov rax, r14
xor rax, 1
test rbp, rbp
je 0x15037b85e
cmp rbp, qword [r15 + rax*8]
je 0x15037b790
mov rbx, qword [rbp + 0x38]
mov rdx, rbp
call fcn.150377460
xor rax, qword [rsi + 0x10]
imul rax, rdi
shr rax, 0x20
mov r8, qword [rsi + 8]
dec r8
and r8, rax
mov r9, rbp
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.15037b3d8
mov rbp, rbx
test rbx, rbx
jne 0x15037b751
jmp 0x15037b85e
test rbp, rbp
je 0x15037b85e
cmp rbp, qword [r15 + rax*8]
jne 0x15037b85e
inc r14
mov rbx, qword [rbp + 8]
mov rbx, qword [rbx]
movabs r12, 0x9e3779b97f4a7c15
mov rdi, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
call fcn.150377460
xor rax, qword [rsi + 0x10]
imul rax, r12
shr rax, 0x20
mov r8, qword [rsi + 8]
dec r8
and r8, rax
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.15037b3d8
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x15037b812
mov rax, qword [rbx + 8]
jmp 0x15037b807
cmp rbx, qword [rax + 0x10]
jne 0x15037b80d
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x15037b7fa
mov rbx, rax
jmp 0x15037b82d
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x15037b82d
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x15037b81e
cmp rbx, qword [rbp + 8]
jne 0x15037b7b7
cmp qword [rsi + 0x28], 0
mov r12, qword [rsp + 0x20]
jne 0x15037b854
mov rcx, rbp
call fcn.15037ad04
mov edx, 0x18
mov rcx, rbp
call fcn.15040acc0
movabs rdi, 0x9e3779b97f4a7c15
inc r14
cmp r14, r12
jb 0x15037b737
cmp qword [rsi + 0x28], 0
jne 0x15037b881
lea rdx, [r12*8]
mov rcx, r15
call fcn.15040acc0
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x15037be4c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x30
mov r9, qword [0x150046e70]
xor ebx, ebx
mov r10d, edx
mov r11, rcx
test r9, r9
je 0x15037bf22
xorps xmm0, xmm0
mov word [rax - 0x2c], bx
movups xmmword [rax - 0x28], xmm0
mov byte [rax - 0x2a], bl
movabs rdi, 0x100000001b3
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rsp], rcx
movabs rcx, 0xcbf29ce484222325
mov dword [rax - 0x30], edx
mov r8, rcx
mov edx, ebx
movzx eax, byte [rsp + rdx + 8]
inc rdx
xor r8, rax
imul r8, rdi
cmp rdx, 4
jb 0x15037bea6
mov rdx, rbx
movzx eax, byte [rsp + rdx]
inc rdx
xor rcx, rax
imul rcx, rdi
cmp rdx, 8
jb 0x15037bebe
mov rdx, qword [r9 + 0x18]
xor rcx, r8
and rcx, qword [r9 + 0x30]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [r9 + 8]
je 0x15037bf06
mov rdx, qword [rdx + rcx*8]
cmp r11, qword [rax + 0x10]
jne 0x15037befb
cmp r10d, dword [rax + 0x18]
je 0x15037bf09
cmp rax, rdx
je 0x15037bf06
mov rax, qword [rax + 8]
jmp 0x15037beef
mov rax, rbx
test rax, rax
cmove rax, qword [r9 + 8]
cmp rax, qword [r9 + 8]
lea rcx, [rax + 0x10]
cmove rcx, rbx
mov rax, rcx
jmp 0x15037bf24
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x150382fc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r15b, r8b
mov rdi, rdx
mov rbx, rcx
and dword [rax - 0x38], 0
mov bpl, r8b
mov r13d, 1
xor bpl, r13b
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rcx], 0
mov dword [rax - 0x38], r13d
mov rax, qword [rdx + 0x10]
cmp rax, 0xf
jbe 0x150383036
mov rdx, rax
call fcn.1502bbb74
and qword [rbx + 0x10], 0
mov rax, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x150383048
mov rsi, qword [rdi]
mov rcx, rsi
mov rdi, rsi
jmp 0x15038304e
mov rsi, rdi
mov rcx, rdi
lea r14, [rax + rcx]
cmp rdi, r14
je 0x15038310b
movzx r9d, byte [rsi]
cmp r9b, 0x5f
jne 0x15038306d
mov bpl, r13b
jmp 0x1503830ff
test bpl, bpl
je 0x1503830c5
lea ecx, [r9 - 0x61]
lea eax, [r9 - 0x20]
movzx edx, al
cmp cl, 0x19
cmova edx, r9d
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1503830ad
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1503830a3
mov rax, qword [rbx]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x1503830c0
mov r9b, dl
mov r8b, byte [rsp + 0x70]
mov rdx, r13
mov rcx, rbx
call fcn.1502d9d44
xor bpl, bpl
jmp 0x1503830ff
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1503830ef
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1503830e4
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1503830ff
mov r8b, byte [rsp + 0x70]
mov rdx, r13
mov rcx, rbx
call fcn.1502d9d44
add rsi, r13
cmp rsi, r14
jne 0x15038305b
test r15b, r15b
je 0x150383148
cmp qword [rbx + 0x10], 0
je 0x150383148
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x150383124
mov rax, qword [rbx]
movzx edx, byte [rax]
lea ecx, [rdx - 0x41]
lea eax, [rdx + 0x20]
movzx r8d, al
cmp cl, 0x19
cmova r8d, edx
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x150383145
mov rax, qword [rbx]
mov byte [rax], r8b
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x150385064
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x60
movaps xmm0, xmmword [r9]
mov rsi, rcx
movaps xmm1, xmm0
xor r9d, r9d
movdqu xmmword [rsp + 0x40], xmm0
mov r15, r8
mov r14, rdx
psrldq xmm0, 8
movq r10, xmm1
movq rcx, xmm0
add rcx, r10
jmp 0x1503850b8
movsx rax, byte [r10]
lea r9, [r9 + r9*4]
add r9, rax
inc r10
cmp r10, rcx
jb 0x1503850aa
mov rcx, qword [rsi + 0x18]
imul rax, r15, 0x1000193
xor rax, r9
and rax, qword [rsi + 0x30]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rsi + 8]
je 0x150385135
mov rbp, qword [rcx + rax*8]
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x20]
call fcn.150383584
cmp r15, qword [rax]
jne 0x15038512a
movups xmm1, xmmword [rax + 8]
mov rax, qword [rax + 0x10]
cmp qword [rsp + 0x48], rax
jne 0x15038512a
movq rdx, xmm1
cmp qword [rsp + 0x40], rdx
je 0x150385137
cmp qword [rsp + 0x48], 0
jbe 0x150385137
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call fcn.15040e0e0
test eax, eax
je 0x150385137
cmp rbx, rbp
je 0x150385135
mov rbx, qword [rbx + 8]
jmp 0x1503850e1
xor ebx, ebx
test rbx, rbx
je 0x150385148
cmp rbx, qword [rsi + 8]
je 0x150385148
mov rax, qword [rbx + 0x10]
jmp 0x15038514f
lea rax, [0x150174e28]
lea r11, [rsp + 0x60]
mov qword [r14], rax
mov rbx, qword [r11 + 0x10]
mov rax, r14
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x1503a4c20
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
movsxd rax, dword [r8 + 0x20]
mov rsi, r8
mov rbp, qword [rcx + 0x18]
mov rdi, rdx
imul r9, rax, 0x1000193
imul rax, qword [r8 + 0x18], 0x100011b
mov r14, rcx
xor r9, rax
and r9, qword [rcx + 0x30]
add r9, r9
mov rbx, qword [rbp + r9*8 + 8]
cmp rbx, qword [rcx + 8]
je 0x1503a4c9d
mov rbp, qword [rbp + r9*8]
lea rcx, [rbx + 0x10]
lea rdx, [rsp + 0x20]
call fcn.15038385c
mov edx, dword [rsi + 0x20]
mov rcx, qword [rax]
cmp qword [rsi + 0x18], rcx
jne 0x1503a4c92
cmp edx, dword [rax + 8]
je 0x1503a4c9f
cmp rbx, rbp
je 0x1503a4c9d
mov rbx, qword [rbx + 8]
jmp 0x1503a4c73
xor ebx, ebx
test rbx, rbx
jne 0x1503a4ca8
mov rbx, qword [r14 + 8]
mov rbp, qword [rsp + 0x48]
mov rax, rdi
mov rsi, qword [rsp + 0x50]
mov qword [rdi], rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1503a4ccc
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov r8, qword [rdx + 8]
mov rbx, rcx
mov rcx, qword [rdx + 0x10]
xor r10d, r10d
add rcx, r8
jmp 0x1503a4cf3
movsx rax, byte [r8]
lea r10, [r10 + r10*4]
add r10, rax
inc r8
cmp r8, rcx
jb 0x1503a4ce5
imul r9, qword [rdx], 0x1000193
mov r8, rdx
mov rcx, rbx
xor r9, r10
lea rdx, [rsp + 0x20]
call fcn.1503abbac
mov rax, qword [rax + 8]
test rax, rax
je 0x1503a4d27
cmp rax, qword [rbx + 8]
je 0x1503a4d27
mov rax, qword [rax + 0x28]
jmp 0x1503a4d29
xor eax, eax
add rsp, 0x30
pop rbx
ret
Function at 0x1503a7ba8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r9, qword [r8 + 8]
mov rcx, qword [r8 + 0x10]
add rcx, r9
jmp 0x1503a7beb
lea rdx, [rdx + rdx*4]
movsx rax, byte [r9]
add rdx, rax
inc r9
cmp r9, rcx
jb 0x1503a7bdd
imul r14, qword [r8], 0x1000193
xor r14, rdx
mov r9, r14
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1503abbac
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1503a7c20
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1503a7db1
movabs rax, 0x555555555555555
cmp qword [rbp + 0x10], rax
je 0x1503a7dd3
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, gethostbyname
call fcn.15040af44
mov rdi, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x10], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rax + 0x20], xmm1
and qword [rax + 0x28], 0
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1503a7c7f
cvtsi2ss xmm0, rcx
jmp 0x1503a7c94
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1503a7ca7
cvtsi2ss xmm2, rbx
jmp 0x1503a7cbf
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x1503a7d5a
divss xmm0, dword [rbp]
call fcn.1504413bc
xor ecx, ecx
movss xmm1, dword [0x1502703c8]
comiss xmm0, xmm1
jb 0x1503a7d04
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1503a7d04
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1503a7d32
cmp rbx, 0x200
jae 0x1503a7d2f
shl rbx, 3
cmp rbx, rcx
jae 0x1503a7d32
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.1503a8d80
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1503abbac
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1503a7d93
mov qword [rcx + rax*8], rdi
jmp 0x1503a7da5
cmp r9, rdx
jne 0x1503a7d9e
mov qword [rcx + rax*8], rdi
jmp 0x1503a7daa
cmp qword [rcx + rax*8 + 8], r8
jne 0x1503a7daa
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, [0x1501755e8]
call fcn.15040822c
int3