joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400fa030
Capabilities:
Parse pe header

Disassembly:
mov r9, rdx
mov edx, 0x48
cmp ecx, 0x1c
ja case.0x1400fa056.3
movsxd rax, ecx
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0xfa20c]
add rcx, r8
jmp rcx
mov edx, 0x49
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 2
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x44
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x46
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x42
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x47
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x43
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x45
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x41
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4e
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4c
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4a
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4d
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x56
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x51
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x55
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x50
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4f
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x54
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x57
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x52
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x53
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x4b
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x58
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x59
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x5a
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
mov edx, 0x5b
xor r8d, r8d
mov rcx, r9
jmp fcn.1400b38e0
ret
Function at 0x1401001b0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov r10d, dword [rcx + 0x10]
mov r9, rdx
sub r10d, dword [rcx + 8]
mov rbp, r8
mov edi, dword [rcx + 0x14]
mov esi, r10d
sub edi, dword [rcx + 0xc]
mov ebx, r10d
mov r11, qword [rcx]
and ebx, 7
lea eax, [r10 + 7]
sar esi, 3
and eax, 0xfffffff8
cdq
and edx, 7
add eax, edx
mov edx, dword [rcx + 0x18]
sar eax, 3
sub edx, eax
movsxd rax, r10d
sub rbp, rax
test edi, edi
jle 0x1401002d1
mov qword [rsp + 0x10], r14
movsxd r14, edx
mov r10d, edi
test esi, esi
jle 0x14010028c
mov edx, esi
nop word [rax + rax]
movzx ecx, byte [r9 + 6]
movzx eax, byte [r9 + 5]
shr ecx, 1
and eax, 0xffffff9f
and ecx, 0x7fffffc0
or ecx, eax
movzx eax, byte [r9 + 4]
and eax, 0xffffff8f
shr ecx, 1
or ecx, eax
movzx eax, byte [r9 + 3]
and eax, 0xffffff87
shr ecx, 1
or ecx, eax
movzx eax, byte [r9 + 2]
and eax, 0xffffff83
shr ecx, 1
or ecx, eax
movzx eax, byte [r9 + 1]
and eax, 0xffffff81
shr ecx, 1
or ecx, eax
movzx eax, byte [r9 + 7]
shr eax, 7
shr ecx, 1
or ecx, eax
movzx eax, byte [r9]
and eax, 0xffffff80
add r9, 8
or ecx, eax
mov byte [r11], cl
inc r11
sub rdx, 1
jne 0x140100220
test ebx, ebx
je 0x1401002bc
xor edx, edx
lea ecx, [rdx + 7]
test ebx, ebx
je 0x1401002b6
mov r8d, ebx
nop dword [rax]
movzx eax, byte [r9]
inc r9
shr eax, 7
shl eax, cl
dec ecx
or edx, eax
sub r8, 1
jne 0x1401002a0
mov byte [r11], dl
inc r11
add r9, rbp
add r11, r14
sub r10, 1
jne 0x140100211
mov r14, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop rdi
ret

Function at 0x14010e6a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
mov rdx, rcx
mov rcx, rax
jmp fcn.14010e3c0

Function at 0x14010e8e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x14045d620], 2
mov r10d, edx
mov r11, rcx
mov r9, r8
mov eax, 1
movd xmm1, r10d
movq xmm4, r11
pshufd xmm1, xmm1, 0
punpcklqdq xmm4, xmm4
jl 0x14010e970
movdqa xmm3, xmmword [0x1403c41b0]
movq xmm0, xmm1
paddd xmm3, xmmword [0x1403afbe0]
movq xmm1, xmm1
pxor xmm3, xmm0
mov eax, 2
psubd xmm3, xmm1
movdqa xmm1, xmm3
movd xmm0, eax
mov eax, 4
psrad xmm1, xmm0
pmovsxdq xmm0, xmm3
pandn xmm1, xmmword [0x1403afdb0]
pmovsxdq xmm2, xmm1
pand xmm2, xmm0
movd xmm0, eax
psllq xmm2, xmm0
paddq xmm2, xmm4
movdqu xmmword [r8], xmm2
ret
mov r8d, eax
lea r9, [r9 + 8]
xor r8d, r10d
inc eax
sub r8d, r10d
mov ecx, r8d
sar ecx, 2
not ecx
movsxd rdx, ecx
movsxd rcx, r8d
and rdx, rcx
shl rdx, 4
add rdx, r11
mov qword [r9 - 8], rdx
cmp eax, 3
jl 0x14010e970
ret
Function at 0x140128c30
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r10d, dword [rdx]
mov edi, 1
mov r9d, dword [rcx + 4]
mov eax, r10d
shr eax, 0x10
mov r14, rdx
xor eax, r10d
mov rsi, rcx
imul r8d, eax, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul r8d, eax, 0xc2b2ae35
mov eax, r8d
shr eax, 0x10
xor eax, r8d
cmovne edi, eax
lea eax, [r9 - 1]
and eax, edi
xor r8d, r8d
test r9d, r9d
jle 0x140128ccd
mov r11, qword [rcx + 8]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
mov ecx, dword [r11 + rdx*8 + 0x10]
lea rbx, [r11 + rdx*8]
test ecx, ecx
je 0x140128cfa
cmp edi, ecx
jne 0x140128cbd
cmp r10d, dword [rbx]
je 0x140128ce5
sub eax, 1
jns 0x140128cc5
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x140128ca0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
lea rdx, [r14 + 8]
mov dword [rbx], r10d
lea rcx, [rbx + 8]
call fcn.140093ec0
mov rax, rbx
jmp 0x140128ccf
lea rdx, [r14 + 8]
mov dword [rbx], r10d
lea rcx, [rbx + 8]
call fcn.140093ec0
mov dword [rbx + 0x10], edi
mov rax, rbx
inc dword [rsi]
jmp 0x140128ccf

Function at 0x140129a00
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r8d, dword [rdx + 0x10]
mov rdi, rdx
mov r11d, dword [rcx + 8]
mov r10, rcx
shr r8d, 0x10
xor r8d, dword [rdx + 0x10]
xor edx, edx
imul eax, r8d, 0x85ebca6b
lea ebx, [r11 - 1]
mov r8d, eax
shr r8d, 0xd
xor r8d, eax
imul r9d, r8d, 0xc2b2ae35
mov eax, r9d
shr eax, 0x10
xor eax, r9d
and eax, ebx
test r11d, r11d
jle 0x140129a8a
mov r9, qword [rcx + 0x10]
movsxd rcx, eax
mov r8, qword [r9 + rcx*8]
test r8, r8
je 0x140129a80
cmp r8, 1
je 0x140129a7c
inc eax
add eax, edx
inc edx
and eax, ebx
cmp edx, r11d
jl 0x140129a52
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
dec dword [r10 + 4]
inc dword [r10]
movsxd rcx, eax
mov qword [r9 + rcx*8], rdi
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140129b40
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rdi, dword [rcx + 8]
mov rsi, rcx
mov rbx, qword [rcx + 0x10]
mov dword [rcx + 8], edx
mov qword [rcx], 0
movsxd rcx, edx
shl rcx, 3
call fcn.14008b2d0
mov qword [rsi + 0x10], rax
mov r14, rdi
test edi, edi
jle 0x140129c0c
mov qword [rsp + 0x30], rbp
xor r10d, r10d
nop dword [rax]
mov rbp, qword [rbx + r10*8]
cmp rbp, 2
jb 0x140129bff
mov r11d, dword [rsi + 8]
mov ecx, dword [rbp + 0x10]
shr ecx, 0x10
xor ecx, dword [rbp + 0x10]
imul eax, ecx, 0x85ebca6b
lea edi, [r11 - 1]
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
xor edx, edx
and eax, edi
test r11d, r11d
jle 0x140129bff
mov r9, qword [rsi + 0x10]
movsxd rcx, eax
mov r8, qword [r9 + rcx*8]
test r8, r8
je 0x140129bf6
cmp r8, 1
je 0x140129bf3
inc eax
add eax, edx
inc edx
and eax, edi
cmp edx, r11d
jl 0x140129bd2
jmp 0x140129bff
dec dword [rsi + 4]
inc dword [rsi]
movsxd rcx, eax
mov qword [r9 + rcx*8], rbp
inc r10
cmp r10, r14
jl 0x140129b90
mov rbp, qword [rsp + 0x30]
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14008b300
Function at 0x140135520
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
movsxd rax, dword [rcx + 0x88]
mov rdi, rdx
mov rbx, rcx
test eax, eax
je 0x14013555b
mov rdx, qword [rcx + 0x90]
mov r8, rax
shl r8, 2
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1402e2940
mov ecx, dword [rcx]
test ecx, ecx
je 0x14013561b
sub ecx, 1
je 0x1401355db
sub ecx, 1
je 0x1401355be
cmp ecx, 1
jne 0x140135597
lea rcx, [rbx + 8]
mov qword [rsp + 0x30], rsi
call fcn.140135140
test eax, eax
js 0x1401355a2
mov rdx, rdi
lea rcx, [rbx + 8]
call fcn.140135630
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x18]
mov rsi, qword [rsp + 0x30]
mov dword [rdi], eax
movzx eax, byte [rbx + 0x14]
mov dword [rdi + 4], eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movups xmm0, xmmword [rbx + 8]
movups xmmword [rdx], xmm0
xor edx, edx
cmp byte [rbx + 0x18], dl
setne dl
mov dword [rdi + 0x10], edx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 8]
call fcn.1400d9f50
xor edx, edx
mov eax, 0x80000000
cmp dword [rbx + 0x3c], 1
cmove edx, eax
mov dword [rdi + 0x30], edx
movzx eax, byte [rbx + 0x44]
neg al
sbb ecx, ecx
and ecx, 0x40000000
or ecx, edx
mov dword [rdi + 0x30], ecx
mov eax, dword [rbx + 0x40]
or eax, ecx
mov dword [rdi + 0x30], eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdx], 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140159190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x60
cmp byte [rcx + 0x40], 0
mov r14, r8
mov eax, dword [rsp + 0xa8]
mov rsi, rdx
mov dword [rsp + 0x38], eax
je 0x1401591b7
or eax, 2
mov dword [rsp + 0x38], eax
cmp dword [rcx + 0x30], 0
lea r8, [rsp + 0x38]
mov eax, dword [rcx + 0x2c]
mov dword [rsp + 0x3c], eax
mov eax, dword [rcx + 0x24]
mov dword [rsp + 0x40], eax
mov eax, dword [rcx + 0x28]
mov dword [rsp + 0x44], eax
mov eax, dword [rcx + 0x20]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0xb0]
mov qword [rsp + 0x88], rbp
mov byte [rsp + 0x50], al
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0x4c], r9d
jne 0x140159245
mov r9d, dword [rcx + 0x38]
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.140159ba0
xor ebp, ebp
mov rdx, qword [rax]
mov qword [rax], rbp
test rdx, rdx
jne 0x14015922c
mov rax, qword [rsp + 0x80]
mov ebx, ebp
jmp 0x140159283
mov rax, qword [rdx + 8]
lea rbx, [rdx + 8]
movsxd rcx, dword [rax + 4]
mov rax, qword [rsp + 0x80]
add rbx, rcx
jmp 0x140159283
mov eax, dword [rcx + 0x38]
lea rdx, [rsp + 0x30]
movzx r9d, byte [rcx + 0x34]
mov rcx, r14
mov dword [rsp + 0x20], eax
call fcn.14015a140
xor ebp, ebp
mov rdx, qword [rax]
mov qword [rax], rbp
test rdx, rdx
jne 0x14015926f
mov ebx, ebp
jmp 0x14015927e
mov rax, qword [rdx + 8]
lea rbx, [rdx + 8]
movsxd rcx, dword [rax + 4]
add rbx, rcx
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1401592c0
mov rcx, qword [rax + 8]
movsxd rdi, dword [rcx + 4]
add rdi, rax
sub dword [rdi + 0x10], 1
jne 0x1401592a6
lea rcx, [rdi + 8]
call fcn.140112fc0
test al, al
je 0x1401592c0
cmp dword [rdi + 0x14], ebp
jne 0x1401592c0
cmp dword [rdi + 0x18], ebp
jne 0x1401592c0
cmp dword [rdi + 0x10], ebp
jne 0x1401592c0
xor edx, edx
lea rcx, [rdi + 8]
call fcn.140112f80
test rbx, rbx
jne 0x1401592ca
mov qword [rsi], rbp
jmp 0x140159345
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
cmp byte [rsp + 0xa0], 0
mov ecx, dword [rsp + 0xb8]
mov dword [rax + 0x20], ecx
je 0x140159342
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
test rax, rax
je 0x140159305
mov rdx, rax
mov rcx, r14
call fcn.140159970
test rax, rax
jne 0x140159342
sub dword [rbx + 8], 1
lea rdi, [rbx + 8]
mov qword [rsi], rbp
jne 0x140159325
test rdi, rdi
mov rcx, rbx
cmove rcx, rbp
call fcn.140112fc0
test al, al
je 0x140159345
cmp dword [rdi + 4], 0
jne 0x140159345
cmp dword [rdi + 8], 0
jne 0x140159345
cmp dword [rdi], 0
jne 0x140159345
xor edx, edx
mov rcx, rbx
call fcn.140112f80
jmp 0x140159345
mov qword [rsi], rbx
mov rdi, qword [rsp + 0x90]
mov rax, rsi
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rsi
pop rbx
ret
Function at 0x14016a7c0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rdx]
mov r10d, 1
mov r9d, dword [rcx + 4]
mov eax, r11d
shr eax, 0x10
xor eax, r11d
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
cmovne r10d, eax
lea eax, [r9 - 1]
and eax, r10d
xor r8d, r8d
test r9d, r9d
jle 0x14016a83d
mov rbx, qword [rcx + 8]
nop dword [rax]
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
lea rcx, [rbx + rdx*8]
mov edx, dword [rbx + rdx*8 + 0x10]
test edx, edx
je 0x14016a83d
cmp r10d, edx
jne 0x14016a82d
cmp r11d, dword [rcx]
je 0x14016a845
sub eax, 1
jns 0x14016a835
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x14016a810
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, rcx
ret
Function at 0x14016ac20
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov r11d, dword [rdx]
mov edi, 1
mov ebx, dword [rcx + 4]
mov eax, r11d
shr eax, 0x10
mov r10, rcx
xor eax, r11d
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
cmovne edi, eax
lea eax, [rbx - 1]
and eax, edi
xor r8d, r8d
test ebx, ebx
jle 0x14016aca0
mov r9, qword [rcx + 8]
nop
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
cmp edi, dword [r9 + rdx*4 + 8]
jne 0x14016ac84
cmp r11d, dword [r9 + rdx*4]
je 0x14016ac95
sub eax, 1
jns 0x14016ac8b
add eax, ebx
inc r8d
cmp r8d, ebx
jl 0x14016ac70
jmp 0x14016aca0
dec dword [r10]
nop dword [rax + rax]
mov r11, qword [r10 + 8]
mov r8d, eax
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
lea rbx, [r11 + rdx*4]
sub eax, 1
jns 0x14016acbb
add eax, dword [r10 + 4]
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
mov r9d, dword [r11 + rdx*4 + 8]
test r9d, r9d
je 0x14016ad0b
mov ecx, dword [r10 + 4]
dec ecx
and ecx, r9d
cmp eax, ecx
jg 0x14016acff
cmp ecx, r8d
jl 0x14016acb2
cmp r8d, eax
jge 0x14016ace7
cmp eax, ecx
jle 0x14016acb2
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
mov rcx, qword [r11 + rdx*4]
mov qword [rbx], rcx
mov ecx, dword [r11 + rdx*4 + 8]
mov dword [rbx + 8], ecx
jmp 0x14016aca0
cmp ecx, r8d
jge 0x14016acde
cmp r8d, eax
jl 0x14016acb2
jmp 0x14016ace7
mov rax, qword [rsp]
mov qword [rbx], rax
mov dword [rbx + 8], 0
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
pop rdi
ret

Function at 0x14016aef0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r11d, dword [rdx]
mov r10d, 1
mov r9d, dword [rcx + 4]
mov eax, r11d
shr eax, 0x10
mov rsi, rdx
xor eax, r11d
mov rdi, rcx
imul r8d, eax, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul r8d, eax, 0xc2b2ae35
mov eax, r8d
shr eax, 0x10
xor eax, r8d
cmovne r10d, eax
lea eax, [r9 - 1]
and eax, r10d
xor r8d, r8d
test r9d, r9d
jle 0x14016af8d
mov rbx, qword [rcx + 8]
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
lea rcx, [rbx + rdx*8]
mov edx, dword [rbx + rdx*8 + 0x10]
test edx, edx
je 0x14016afb8
cmp r10d, edx
jne 0x14016af7d
cmp r11d, dword [rcx]
je 0x14016af9f
sub eax, 1
jns 0x14016af85
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x14016af60
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movups xmm0, xmmword [rsi]
mov rax, rcx
movups xmmword [rcx], xmm0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
movups xmm0, xmmword [rsi]
mov rbx, qword [rsp + 8]
mov rax, rcx
mov rsi, qword [rsp + 0x10]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], r10d
inc dword [rdi]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14016afe0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov ebx, dword [rdx]
mov r11d, 1
mov r10d, dword [rcx + 4]
mov eax, ebx
shr eax, 0x10
mov r14, rdx
xor eax, ebx
mov rsi, rcx
imul r8d, eax, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul r8d, eax, 0xc2b2ae35
mov eax, r8d
shr eax, 0x10
xor eax, r8d
cmovne r11d, eax
lea eax, [r10 - 1]
and eax, r11d
xor r9d, r9d
test r10d, r10d
jle 0x14016b07d
mov rdi, qword [rcx + 8]
nop dword [rax]
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rcx + rcx*2]
mov ecx, dword [rdi + rdx*4 + 8]
lea r8, [rdi + rdx*4]
test ecx, ecx
je 0x14016b09f
cmp r11d, ecx
jne 0x14016b06d
cmp ebx, dword [r8]
je 0x14016b094
sub eax, 1
jns 0x14016b075
add eax, r10d
inc r9d
cmp r9d, r10d
jl 0x14016b050
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
mov rcx, qword [r14]
mov rax, r8
mov qword [r8], rcx
jmp 0x14016b07f
mov rax, qword [r14]
mov qword [r8], rax
mov rax, r8
mov dword [r8 + 8], r11d
inc dword [rsi]
jmp 0x14016b07f

Function at 0x14016bd90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movzx eax, byte [rcx + 0x39]
mov rdi, rdx
mov esi, dword [rcx]
mov r14, rcx
movzx r8d, byte [rdx + 0x3a]
sub esi, eax
movzx eax, byte [rcx + 0x3a]
xor r8d, eax
test r8d, 0xfffffffe
jne 0x14016be99
movzx eax, byte [rdx + 0x39]
mov ecx, dword [rdx]
sub ecx, eax
cmp esi, ecx
jne 0x14016be99
movzx eax, byte [rdx + 0x38]
cmp byte [r14 + 0x38], al
jne 0x14016be99
mov qword [rsp + 0x30], rbx
xor ebx, ebx
test esi, esi
jle 0x14016be22
movzx eax, byte [rdi + 0x39]
add eax, ebx
movsxd rcx, eax
mov rax, qword [rdi + 8]
mov rdx, qword [rax + rcx*8]
movzx eax, byte [r14 + 0x39]
add eax, ebx
movsxd rcx, eax
mov rax, qword [r14 + 8]
mov rcx, qword [rax + rcx*8]
call fcn.1400f0170
test al, al
je 0x14016be49
inc ebx
cmp ebx, esi
jl 0x14016bdf0
mov rbx, qword [r14 + 0x30]
test rbx, rbx
jne 0x14016be5a
cmp qword [rdi + 0x30], rbx
jne 0x14016be4d
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14016be33
test rbx, rbx
jne 0x14016be5a
call fcn.14013d340
mov rbx, rax
mov rdx, qword [rdi + 0x30]
test rdx, rdx
jne 0x14016be6b
call fcn.14013d340
mov rdx, rax
mov eax, dword [rdx + 8]
cmp dword [rbx + 8], eax
jne 0x14016be49
movzx eax, byte [rdx + 0x14]
cmp byte [rbx + 0x14], al
jne 0x14016be49
movzx eax, byte [rdx + 0x15]
cmp byte [rbx + 0x15], al
jne 0x14016be49
movzx eax, byte [rdx + 0x16]
cmp byte [rbx + 0x16], al
jne 0x14016be49
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x40]
jmp 0x14016be33
mov rsi, qword [rsp + 0x38]
xor al, al
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14016f520
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [rdx]
mov rdi, rcx
mov r11d, 1
mov rsi, rdx
mov r10d, dword [rax + 0x68]
mov eax, r10d
mov r9d, dword [rdi + 0x34]
shr eax, 0x10
xor eax, r10d
imul r8d, eax, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
cmovne r11d, eax
xor r14d, r14d
lea eax, [r9 - 1]
mov r8d, r14d
and eax, r11d
test r9d, r9d
jle 0x14016f5bb
mov rbx, qword [rdi + 0x38]
nop dword [rax]
movsxd rcx, eax
imul rdx, rcx, 0x38
add rdx, rbx
mov ecx, dword [rdx + 0x30]
test ecx, ecx
je 0x14016f5bb
cmp r11d, ecx
jne 0x14016f5ab
cmp r10d, dword [rdx]
je 0x14016f5be
sub eax, 1
jns 0x14016f5b3
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x14016f590
mov rdx, r14
test rdx, rdx
lea r8, [rdx + 8]
cmove r8, r14
test r8, r8
jne 0x14016f60b
movzx eax, byte [rsp + 0x38]
lea rcx, [rsp + 0x40]
and al, 0xfd
mov qword [rsp + 0x28], rcx
and al, 0xfe
mov dword [rsp + 0x20], r10d
lea r8, [rsp + 0x20]
mov byte [rsp + 0x38], al
mov edx, r10d
mov dword [rsp + 0x30], r14d
lea rcx, [rdi + 0x30]
mov dword [rsp + 0x34], 1
call fcn.140170e30
mov r8, rax
mov rbx, qword [rsi]
mov qword [rbx + 8], r14
mov rcx, qword [rdi + 0x20]
mov qword [rbx + 0x10], rcx
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14016f627
mov qword [rax + 8], rbx
mov qword [rdi + 0x20], rbx
cmp qword [rdi + 0x28], r14
jne 0x14016f635
mov qword [rdi + 0x28], rbx
mov rax, qword [rsi]
lea rdx, [rsp + 0x70]
mov rcx, r8
mov qword [rsp + 0x70], rax
mov qword [rsi], r14
call fcn.14016f6a0
mov rdx, rbx
mov rcx, rdi
call fcn.14016f780
mov rbx, qword [rsi]
test rbx, rbx
je 0x14016f680
or eax, 0xffffffff
lock xadd dword [rbx], eax
cmp eax, 1
jne 0x14016f680
mov rcx, rbx
call fcn.1400cc9a0
mov rcx, qword [rbx + 0x30]
mov rdx, rbx
call fcn.140129db0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x14016f780
Capabilities:
Hash data using murmur3

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
and byte [rax - 0x38], 0xfc
mov r14, rdx
mov qword [rax + 0x18], r13
mov rdi, rcx
xor r13d, r13d
mov qword [rax - 0x28], r15
xor edx, edx
mov qword [rax - 0x40], r13
lea rcx, [rax - 0x48]
mov qword [rax - 0x48], r13
call fcn.140170770
and byte [rsp + 0x30], 0xfd
lea rbx, [rdi + 0x70]
test rbx, rbx
je 0x14016f7d5
or eax, 0xffffffff
lock xadd dword [rbx], eax
test eax, eax
jg 0x14016f7d5
mov rcx, rbx
call fcn.1400c39b0
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x58]
call fcn.140171040
test rbx, rbx
je 0x14016f7f0
mov rcx, rbx
call fcn.1401de5f0
mov r15, qword [rsp + 0x20]
mov rsi, r15
test r15, r15
je 0x14016f92d
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x78], r12
lea r12, [r15 + rax*4]
cmp r15, r12
je 0x14016f928
mov qword [rsp + 0x70], rbp
nop dword [rax]
mov r11d, dword [rsi]
mov r10d, 1
mov r9d, dword [rdi + 0x34]
mov eax, r11d
shr eax, 0x10
mov r8d, r13d
xor eax, r11d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
cmovne r10d, eax
lea eax, [r9 - 1]
and eax, r10d
test r9d, r9d
jle 0x14016f89b
mov rbx, qword [rdi + 0x38]
nop word [rax + rax]
movsxd rcx, eax
imul rdx, rcx, 0x38
add rdx, rbx
mov ecx, dword [rdx + 0x30]
test ecx, ecx
je 0x14016f89b
cmp r10d, ecx
jne 0x14016f88b
cmp r11d, dword [rdx]
je 0x14016f89e
sub eax, 1
jns 0x14016f893
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x14016f870
mov rdx, r13
test rdx, rdx
lea rax, [rdx + 8]
cmove rax, r13
test rax, rax
je 0x14016f916
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14016f8c1
movsxd rax, dword [rax + 0x10]
lea r9, [rcx + rax*8]
jmp 0x14016f8c4
mov r9, r13
cmp rcx, r9
je 0x14016f90a
nop dword [rax]
mov r8, qword [rcx]
mov rdx, qword [r8 + 8]
mov rax, qword [r8 + 0x10]
test rdx, rdx
je 0x14016f8e6
mov qword [rdx + 0x10], rax
jmp 0x14016f8ea
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14016f8f5
mov qword [rax + 8], rdx
jmp 0x14016f8f9
mov qword [rdi + 0x28], rdx
add rcx, 8
mov qword [r8 + 8], r13
mov qword [r8 + 0x10], r13
cmp rcx, r9
jne 0x14016f8d0
mov rdx, rsi
lea rcx, [rdi + 0x30]
call fcn.1401708f0
add rsi, 4
cmp rsi, r12
jne 0x14016f820
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
test byte [rsp + 0x30], 1
mov r13, qword [rsp + 0x80]
je 0x14016f944
mov rcx, r15
call fcn.14008b300
mov rax, qword [rdi + 0x50]
mov r15, qword [rsp + 0x40]
cmp qword [rdi], rax
jbe 0x14016f98c
mov rbx, qword [rdi + 0x28]
mov rsi, rbx
test rbx, rbx
je 0x14016f97b
cmp rbx, r14
je 0x14016f97b
mov rbx, qword [rbx + 8]
mov rdx, rsi
mov rcx, rdi
call fcn.140170b50
mov rax, qword [rdi + 0x50]
cmp qword [rdi], rax
ja 0x14016f956
test r14, r14
je 0x14016f98c
cmp rsi, r14
jne 0x14016f98c
mov rcx, qword [rdi + 0x48]
call qword [rdi + 0x40]
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401703e0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rdx]
mov r10d, 1
mov r9d, dword [rcx + 4]
mov eax, r11d
shr eax, 0x10
xor eax, r11d
imul edx, eax, 0x85ebca6b
mov eax, edx
shr eax, 0xd
xor eax, edx
imul edx, eax, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
cmovne r10d, eax
lea eax, [r9 - 1]
and eax, r10d
xor r8d, r8d
test r9d, r9d
jle 0x14017045b
mov rbx, qword [rcx + 8]
nop dword [rax]
movsxd rcx, eax
imul rdx, rcx, 0x38
add rdx, rbx
mov ecx, dword [rdx + 0x30]
test ecx, ecx
je 0x14017045b
cmp r10d, ecx
jne 0x14017044b
cmp r11d, dword [rdx]
je 0x140170463
sub eax, 1
jns 0x140170453
add eax, r9d
inc r8d
cmp r8d, r9d
jl 0x140170430
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, rdx
ret