joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2910
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400c2938
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1400c29ac
test rax, rax
jle 0x1400c298c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1400c29ac
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400c29ac
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400c3280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14013e880]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], rdx
lea r8, [rbp - 0x30]
mov rbx, rdx
xor edi, edi
mov rdx, qword [rcx]
mov rcx, qword [0x140144068]
add rdx, 0x18
mov qword [rbp - 0x30], rdi
lea r9d, [rdi + 8]
call fcn.1400cafc0
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x1400c32fe
mov rcx, qword [0x140144068]
lea r9d, [rdi + 8]
add rdx, 8
mov qword [rbp - 0x20], rdi
lea r8, [rbp - 0x20]
call fcn.1400cafc0
mov rdx, qword [rbp - 0x20]
mov rcx, rbx
call fcn.1400c38e0
jmp 0x1400c3409
mov cl, 0x3f
call fcn.14007b7a0
mov edx, 1
mov byte [rbp - 0x20], al
mov cl, 0x3f
call fcn.14007b7a0
mov edx, 2
mov byte [rbp - 0x1f], al
mov cl, 0x3f
call fcn.14007b7a0
mov edx, 3
mov byte [rbp - 0x1e], al
mov cl, 0x5f
call fcn.14007b7a0
mov edx, 4
mov byte [rbp - 0x1d], al
mov cl, 0x63
call fcn.14007b7a0
mov edx, 5
mov byte [rbp - 0x1c], al
mov cl, 0x6c
call fcn.14007b7a0
mov edx, 6
mov byte [rbp - 0x1b], al
mov cl, 0x61
call fcn.14007b7a0
mov edx, 7
mov byte [rbp - 0x1a], al
mov cl, reloc.WSOCK32.dll_WSAStartup
call fcn.14007b7a0
mov edx, 8
mov byte [rbp - 0x19], al
mov cl, reloc.WSOCK32.dll_WSAStartup
call fcn.14007b7a0
mov edx, 9
mov byte [rbp - 0x18], al
mov cl, WSAGetLastError
call fcn.14007b7a0
mov edx, 0xa
mov byte [rbp - 0x17], al
mov cl, 0x61
call fcn.14007b7a0
mov edx, ntohl
mov byte [rbp - 0x16], al
mov cl, 0x6d
call fcn.14007b7a0
mov edx, reloc.WSOCK32.dll_ioctlsocket
mov byte [rbp - 0x15], al
mov cl, 0x65
call fcn.14007b7a0
mov byte [rbp - 0x14], al
xor eax, eax
mov byte [rbp - 0x13], al
movsxd rcx, eax
lea rdx, [rbp - 0x20]
add rdx, rcx
lea ecx, [rax + 0x13]
inc eax
xor byte [rdx], cl
cmp eax, 0xd
jb 0x1400c33c1
xorps xmm0, xmm0
mov byte [rbp - 0x13], dil
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
lea rax, [rbp - 0x20]
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400c33f4
lea rdx, [rbp - 0x20]
mov rcx, rbx
call fcn.14007af20
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140104220
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x1400c36f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x40]
mov rdx, qword [rcx]
xor edi, edi
mov rcx, qword [0x140144068]
add rdx, 0x48
mov qword [rsp + 0x40], rdi
lea r9d, [rdi + 8]
call fcn.1400cafc0
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400c3740
mov rcx, rbx
call fcn.1400c37e0
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov cl, 0x3f
call fcn.14007b7a0
mov edx, 1
mov byte [rsp + 0x40], al
mov cl, 0x3f
call fcn.14007b7a0
mov edx, 2
mov byte [rsp + 0x41], al
mov cl, 0x3f
call fcn.14007b7a0
mov byte [rsp + 0x42], al
xor eax, eax
mov byte [rsp + 0x43], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x40]
add rdx, rcx
lea ecx, [rax + 0x13]
inc eax
xor byte [rdx], cl
cmp eax, 3
jb 0x1400c3780
xorps xmm0, xmm0
mov byte [rsp + 0x43], dil
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0x40]
mov qword [rbx + 0x18], rdi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400c37b6
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14007af20
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c9dc0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c9dde
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
ret
xor eax, eax
ret

Function at 0x1400c9df0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400c9ef1
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x1400c9ef1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x1400c9e55
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x1400c9efc
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x30]
cmp rbx, rbp
jae 0x1400c9edf
nop dword [rax]
mov edx, dword [rbx + 4]
test edx, edx
je 0x1400c9edf
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp rcx, r8
je 0x1400c9eb8
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x1400c9ed4
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.1400c9580
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x1400c9e70
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x1400c9efc
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ca420
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14013e880]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
lea rcx, [0x14011b1b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1400ca5f8
mov r8, rdi
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x28]
call fcn.1400c9f20
nop
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 7
cmova rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x58]
call sub.ntdll.dll_RtlInitUnicodeString
mov r8, rdi
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x48]
call fcn.1400c9f20
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rdx, qword [rbp - 0x48]
lea r8, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1400ca4cc
cmp eax, 2
sete bl
jmp 0x1400ca55c
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x58]
call rax
mov ebx, eax
lea rdx, [0x14010e0b5]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400c3a10
test ebx, ebx
je 0x1400ca537
lea rdx, [0x14010e0b5]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.1400c3a10
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rdx, qword [rbp - 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
xor bl, bl
jmp 0x1400ca55c
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 7
cmova rdx, qword [rbp - 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
test eax, eax
je 0x1400ca55a
xor bl, bl
jmp 0x1400ca55c
mov bl, 1
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x1400ca59f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ca59a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ca59a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140103e64
movdqa xmm0, xmmword [0x140112680]
movdqu xmmword [rbp - 0x38], xmm0
xor eax, eax
mov word [rbp - 0x48], ax
mov rdx, qword [rbp - 0x10]
cmp rdx, 7
jbe 0x1400ca5f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ca5f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ca5f0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140103e64
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140104220
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400ca9e0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, r8
mov r15, rdx
mov rbp, rcx
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdi + rcx], 0
jne 0x1400caa07
movsxd rcx, dword [rdx + 0x3c]
lea r13, [rdx + 0x18]
add r13, rcx
mov qword [rsp + 0x50], rbx
xor esi, esi
movzx eax, word [rcx + rdx + 0x14]
movzx r14d, word [rcx + rdx + 6]
add r13, rax
test r14d, r14d
je 0x1400caa85
nop word [rax + rax]
lea rcx, [rsi + rsi*4]
mov r8, rdi
lea rbx, [rcx*8]
mov rdx, rbp
add rbx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400caa7e
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x1400caa70
cmp rdi, rax
je 0x1400caaa4
inc esi
cmp esi, r14d
jb 0x1400caa40
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp dword [rbx + 0xc], 0
je 0x1400caa85
test r12, r12
je 0x1400caab6
mov eax, dword [rbx + 8]
mov dword [r12], eax
mov eax, dword [rbx + 0xc]
add rax, r15
jmp 0x1400caa87

Function at 0x1400caac0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14013e880]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x20a
xor edi, edi
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x1400cab73
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov rax, r8
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x1400cab23
cmp word [rsp + rax*2 + 0x2e], 0x5c
jne 0x1400cab4f
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x1400cabca
mov word [rsp + rax + 0x30], di
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
inc r8
cmp word [rax + r8*2], di
jne 0x1400cab62
lea rdx, [rsp + 0x30]
jmp 0x1400cab9e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [0x14010e0b5]
call fcn.1400c3a10
xorps xmm0, xmm0
lea rdx, [0x14011af08]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
mov rcx, rbx
call fcn.14007b030
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140104220
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
call fcn.140104664
int3
Function at 0x1400cabd0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x14013e880]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400cac5d
nop
test rbx, rbx
je 0x1400cac26
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, ntohl
mov rbx, rax
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x1400cac10
test eax, eax
jns 0x1400cac7e
test rbx, rbx
je 0x1400cac83
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400cad82
test rbx, rbx
jne 0x1400cac8a
xor eax, eax
jmp 0x1400cad82
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x1400cad62
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x1400cace0
lea rcx, [rsp + 0x28]
call fcn.14007af20
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x1400cad00
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400cad98
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400cad58
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cad53
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cade1
call fcn.140103e64
inc edi
cmp edi, dword [rbx]
jb 0x1400caca3
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140104220
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400caded
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cade8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cade8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140103e64
mov rax, rdi
jmp 0x1400cad75
Function at 0x1400dfd10
Capabilities:
Hash data using fnv

Disassembly:
push rbx
cmp qword [rcx + 0x10], 0
mov rbx, rcx
je 0x1400dfdc2
mov r10d, dword [rdx]
mov r11d, dword [rbx + 0x18]
mov edx, r10d
mov r8d, r10d
shr edx, 0x18
mov ecx, r10d
shr r8d, 0x10
shr ecx, 8
cmp r10d, r11d
je 0x1400dfdc2
mov r9, qword [rbx + 8]
mov rbx, qword [rbx]
dec r9
movzx ecx, cl
mov qword [rsp + 0x10], rdi
movabs rdi, 0xcbf29ce484222325
movzx eax, r10b
xor rax, rdi
movabs rdi, 0x100000001b3
imul rax, rdi
xor rax, rcx
movzx ecx, r8b
imul rax, rdi
xor rax, rcx
mov ecx, edx
imul rax, rdi
xor rax, rcx
imul rax, rdi
mov rdi, qword [rsp + 0x10]
and rax, r9
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
cmp edx, r10d
je 0x1400dfdc6
cmp edx, r11d
je 0x1400dfdc2
inc rax
add rax, rcx
inc rcx
and rax, r9
cmp rcx, r9
jbe 0x1400dfda0
xor eax, eax
pop rbx
ret
mov rax, r8
pop rbx
ret

Function at 0x1400e0000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov r13, rdx
mov rdi, rcx
je 0x1400e0102
mov r15d, dword [r13 + 0x80]
lea rdx, [rcx + 0x18]
mov qword [rsp + 0x60], rdx
cmp r15d, dword [rdx + 0x80]
jne 0x1400e005a
lea r8, [r15*4]
mov rcx, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e0102
lea rdx, [rdi + 0x18]
mov r14, qword [rdi + 8]
xor ebp, ebp
dec r14
mov eax, 0x811c9dc5
mov ecx, ebp
test r15, r15
je 0x1400e0083
nop
xor eax, dword [r13 + rcx*4]
inc rcx
imul eax, eax, 0x1000193
cmp rcx, r15
jb 0x1400e0070
mov ebx, eax
mov rax, qword [rdi]
and rbx, r14
mov qword [rsp + 0x70], rax
imul rdi, rbx, 0x88
add rdi, rax
mov esi, dword [rdi + 0x80]
mov r12d, esi
cmp esi, r15d
jne 0x1400e00c4
lea r8, [rsi*4]
mov rdx, r13
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e00fd
mov rdx, qword [rsp + 0x60]
cmp esi, dword [rdx + 0x80]
jne 0x1400e00e5
lea r8, [r12*4]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e0102
mov rdx, qword [rsp + 0x60]
inc rbx
add rbx, rbp
inc rbp
and rbx, r14
cmp rbp, r14
ja 0x1400e0102
mov rax, qword [rsp + 0x70]
jmp 0x1400e0090
mov rax, rdi
jmp 0x1400e0104
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400e02e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
mov r9, qword [rcx]
mov r8, rax
test rax, rax
je 0x1400e030c
nop
movzx edx, byte [r9 + r8 - 1]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub r8, 1
jne 0x1400e02f0
ret
Function at 0x1400e0310
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rcx + 8]
mov rsi, rcx
movzx eax, byte [rdx]
mov r11, rdx
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
dec r10
mov rbx, qword [rsi]
movzx ecx, byte [r11 + 2]
movzx r8d, byte [r11 + 1]
mov edi, dword [rsi + 0x18]
imul rax, rdx
xor rax, r8
imul rax, rdx
xor rax, rcx
movzx ecx, byte [r11 + 3]
imul rax, rdx
xor rax, rcx
imul rax, rdx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov edx, dword [rbx + rax*8]
lea r8, [rbx + rax*8]
mov r9d, dword [r11]
cmp edx, edi
je 0x1400e03b6
cmp edx, r9d
je 0x1400e03bd
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1400e0380
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [r8], r9d
inc qword [rsi + 0x10]
mov rbx, qword [rsp + 8]
mov rax, r8
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x1400e05b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rcx + 8]
xor ebp, ebp
mov r13d, dword [rdx + 0x80]
dec r15
mov r14, rdx
mov eax, 0x811c9dc5
mov r8d, ebp
test r13, r13
je 0x1400e0602
nop dword [rax]
nop word [rax + rax]
xor eax, dword [rdx + r8*4]
inc r8
imul eax, eax, 0x1000193
cmp r8, r13
jb 0x1400e05f0
mov edi, eax
lea rax, [rcx + 0x18]
mov qword [rsp + 0x68], rax
and rdi, r15
mov qword [rsp + 0x70], r12
nop word [rax + rax]
imul rbx, rdi, 0x88
add rbx, qword [rcx]
mov esi, dword [rbx + 0x80]
mov r12d, esi
cmp esi, dword [rax + 0x80]
jne 0x1400e0652
lea r8, [rsi*4]
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e068b
cmp esi, r13d
jne 0x1400e066e
lea r8, [r12*4]
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e06e7
inc rdi
add rdi, rbp
inc rbp
and rdi, r15
cmp rbp, r15
ja 0x1400e06ec
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
jmp 0x1400e0620
movups xmm0, xmmword [r14]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rbx + 0x10], xmm1
movups xmm0, xmmword [r14 + 0x20]
movups xmmword [rbx + 0x20], xmm0
movups xmm1, xmmword [r14 + 0x30]
movups xmmword [rbx + 0x30], xmm1
movups xmm0, xmmword [r14 + 0x40]
movups xmmword [rbx + 0x40], xmm0
movups xmm1, xmmword [r14 + 0x50]
movups xmmword [rbx + 0x50], xmm1
movups xmm0, xmmword [r14 + 0x60]
movups xmmword [rbx + 0x60], xmm0
movups xmm1, xmmword [r14 + 0x70]
movups xmmword [rbx + 0x70], xmm1
mov eax, dword [r14 + 0x80]
mov dword [rbx + 0x80], eax
mov rax, qword [rsp + 0x60]
inc qword [rax + 0x10]
mov rax, rbx
jmp 0x1400e06ee
xor eax, eax
mov r12, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400e0970
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
sub rsp, 0x48
mov qword [rax + 0x10], rbx
mov ebx, dword [rcx + 0x18]
mov qword [rax + 0x18], rbp
lea rbp, [rcx + 0x18]
mov qword [rax + 0x20], rsi
mov rsi, rcx
mov qword [rax - 8], rdi
mov rdi, qword [rcx + 8]
mov qword [rax - 0x18], r13
mov qword [rax - 0x20], r14
mov r14, rbp
mov qword [rax - 0x28], r15
test rdi, rdi
jne 0x1400e09c3
mov edi, select
lea ecx, [rdi + 0x70]
call fcn.140103e28
mov rdx, rax
mov r11, rax
xor ecx, ecx
mov r13d, edi
jmp 0x1400e0a00
xor r11d, r11d
lea rax, [rcx + 8]
xor r13d, r13d
add rdi, rdi
je 0x1400e0a19
lea rcx, [rdi*8]
call fcn.140103e28
xor ecx, ecx
mov rdx, rax
mov r11, rax
mov r13, rdi
lea rax, [rsi + 8]
test rdi, rdi
je 0x1400e0a19
nop dword [rax]
nop word [rax + rax]
mov eax, dword [r14]
mov dword [rdx + rcx*8], eax
xor eax, eax
mov word [rdx + rcx*8 + 4], ax
inc rcx
cmp rcx, rdi
jb 0x1400e0a00
lea rax, [rsi + 8]
xor edi, edi
cmp qword [rsi + 8], rdi
jbe 0x1400e0ae6
mov qword [rsp + 0x38], r12
movabs r14, 0x100000001b3
movabs r12, 0xcbf29ce484222325
nop
mov rax, qword [rsi]
mov r9d, dword [rax + rdi*8]
mov edx, r9d
mov r8d, r9d
mov ecx, r9d
shr edx, 0x18
shr r8d, 0x10
shr ecx, 8
cmp r9d, dword [rbp]
je 0x1400e0ad0
movzx ecx, cl
lea r10, [r13 - 1]
movzx eax, r9b
xor rax, r12
imul rax, r14
xor rax, rcx
movzx ecx, r8b
imul rax, r14
xor rax, rcx
mov ecx, edx
imul rax, r14
xor rax, rcx
imul rax, r14
and rax, r10
xor ecx, ecx
mov r8d, dword [r11 + rax*8]
lea rdx, [r11 + rax*8]
cmp r8d, ebx
je 0x1400e0ab9
cmp r8d, r9d
je 0x1400e0abc
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x1400e0a92
xor edx, edx
jmp 0x1400e0abc
mov dword [rdx], r9d
mov rax, qword [rsi]
lea rcx, [rax + rdi*8]
mov eax, dword [rax + rdi*8]
mov dword [rdx], eax
movzx eax, word [rcx + 4]
mov word [rdx + 4], ax
inc rdi
cmp rdi, qword [rsi + 8]
jb 0x1400e0a40
mov r12, qword [rsp + 0x38]
lea rax, [rsi + 8]
mov rcx, qword [rsi]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov qword [rsi], r11
mov rsi, qword [rsp + 0x68]
mov qword [rax], r13
mov r13, qword [rsp + 0x30]
test rcx, rcx
je 0x1400e0b20
add rsp, 0x48
jmp fcn.140104a6c
add rsp, 0x48
ret