joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1337c103ca10
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1337c103ca7f
xor ecx, ecx
call qword [0x1337c1061448]
test rax, rax
je 0x1337c103ca7f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1337c103ca7f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1337c103ca7f
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1337c103ca7f
cmp dword [rcx + 0x84], 0xe
jbe 0x1337c103ca7f
cmp dword [rcx + 0xf8], 0
je 0x1337c103ca7f
mov ecx, ebx
call fcn.1337c103cb30
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1337c103c90c
nop
cmp dword [rbp + 0x20], 0
je 0x1337c103cacd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1337c103cad8
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1337c103ca10

Function at 0x1337c105b400
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1337c105b428
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1337c105b428
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1337c1060250
Capabilities:
Execute syscall

Disassembly:
push rbx
push r10
pushfq
mov rbx, rsp
mov r10, rcx
push qword [0x1337c12a6ba0]
lea rax, [0x1337c10602cb]
push rax
push qword [0x1337c12a6bc8]
push qword [0x1337c12a6bb8]
sub rsp, 8
mov rax, rsp
push qword [0x1337c12a6bc8]
push qword [0x1337c12a6b90]
push rax
push qword [0x1337c12a6bc8]
push qword [0x1337c12a6ba8]
lea rax, [0x1337c12a6b58]
push rax
push qword [0x1337c12a6bb0]
lea rax, [0x1337c1060210]
push rax
push qword [0x1337c12a6bb8]
push qword [0x1337c12a6bc0]
push qword [0x1337c12a6bc8]
pushfq
pop rax
or rax, 0x40000
push rax
popfq
syscall
mov rsp, rbx
popfq
pop r10
pop rbx
ret
Function at 0x14004e43c
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x140], rax
and qword [r8], 0
mov r14, r8
mov r8, rcx
mov ebx, 0x104
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14004c8e8
lea r8, [0x1403c5818]
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.14004c970
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x14004e4ea
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x14004e5d7
lea edx, [rbx - 0x44]
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403c5764]
call fcn.14004e0e8
mov esi, eax
jmp 0x14004e5d9
and dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
and dword [rsp + 0x20], 0
mov rcx, rdi
call fcn.14004e2b4
mov esi, eax
test eax, eax
jns 0x14004e527
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403c5764]
mov r9d, eax
mov edx, 0xc6
call fcn.14004e0b4
jmp 0x14004e5d9
lea r8, [0x1403c5820]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14004c970
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14004e565
mov edx, 0xcc
jmp 0x14004e4d0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14004e2b4
mov esi, eax
test eax, eax
jns 0x14004e5ac
mov rcx, qword [rbp + 0x168]
lea r8, [0x1403c5764]
mov r9d, eax
mov edx, 0xce
call fcn.14004e0b4
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
je 0x14004e633
jmp 0x14004e5d9
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
je 0x14004e64c
movsxd rcx, dword [rsp + 0x20]
movsxd rax, dword [rsp + 0x24]
shl rcx, 0x1f
or rax, rcx
mov qword [r14], rax
xor esi, esi
test rdi, rdi
je 0x14004e5f1
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test eax, eax
je 0x14004e61a
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.14004e108
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.14004e108
int3
mov rcx, qword [rbp + 0x168]
lea r8, str.internal_sdkincwilopensourcewil_resource.h
mov edx, 0x8f0
call fcn.14004e108
int3
Function at 0x140053664
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x47], rax
and qword [rbp - 0x21], 0
lea rax, str.Sense
and qword [rbp - 0x19], 0
lea rcx, [rbp - 0x31]
mov qword [rbp - 0x31], rax
lea rax, [0x140052fb0]
mov qword [rbp - 0x29], rax
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_StartServiceCtrlDispatcherW]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x5f]
lea rdx, str.Failed_to_start_service_control_dispatcher
mov qword [rsp + 0x20], rdx
lea r8, str.amcorewcd_source_service_src_service.cpp
mov edx, 0x2ab
mov r9d, eax
call fcn.1400546c8
cmp qword [0x140548d58], 0
jne 0x1400536f0
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
jne 0x1400537a6
jmp 0x140053791
cmp dword [reloc.OLEAUT32.dll_SysReAllocString], 1
je 0x140053791
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x140053771
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x39]
and dword [rbp + 0x33], 0
mov edx, 4
and dword [rbp + 0x43], 0
mov qword [rbp + 0x17], rax
lea rax, str.Service_stopped_with_unexpected_service_status._Terminating_process
mov qword [rbp + 0x27], rax
lea rax, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rbp + 0x37], rax
mov dword [rbp - 0x39], 0x507
mov dword [rbp + 0x1f], edx
mov dword [rbp + 0x2f], 0x88
mov dword [rbp + 0x3f], edx
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140477eeb]
xor r8d, r8d
mov dword [rsp + 0x20], 5
call fcn.140001208
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 2
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140356560
add rsp, 0xc0
pop rbp
ret
mov ecx, 0x8007000e
call fcn.14004f7b4
mov rcx, qword [rbp + 0x5f]
lea r8, str.amcorewcd_source_service_src_service.cpp
mov r9d, eax
mov edx, 0x2b0
lea rax, str.Service_control_dispatcher_failed_without_saying_so...
mov qword [rsp + 0x20], rax
call fcn.1400545b8
int3

Function at 0x14005e824
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
lea r9, [r8 + 8]
mov rbx, rcx
cmp r9, r8
movabs rax, 0xcbf29ce484222325
mov r11, r8
sbb r10, r10
not r10
and r10d, 8
cmp r8, r9
ja 0x14005e872
movzx ecx, byte [r11]
movabs r9, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r8
imul rax, r9
cmp rcx, r10
jne 0x14005e84f
mov r9, qword [rbx + 0x30]
mov r11, qword [rbx + 0x18]
and r9, rax
add r9, r9
mov r10, qword [r11 + r9*8]
mov rcx, r10
cmp r10, qword [rbx + 8]
jne 0x14005e893
mov rax, qword [rbx + 8]
jmp 0x14005e89b
mov rax, qword [r11 + r9*8 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14005e8ae
mov rax, qword [r8]
cmp qword [rcx + 0x10], rax
je 0x14005e8b2
mov rcx, qword [rcx]
jmp 0x14005e887
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
Function at 0x14005fb34
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rsi, rdx
lea r9, [r11 + 8]
mov r10, rcx
cmp r9, r11
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb rbx, rbx
not rbx
and ebx, 8
cmp r11, r9
ja 0x14005fb91
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x14005fb6f
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005fbc9
cmp qword [rcx + rdx*8], r8
jne 0x14005fbbe
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14005fbc2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005fbd6
cmp qword [rcx + rdx*8], r8
jne 0x14005fbd6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rsi
call fcn.14005fee8
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140067e1c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
mov r10, r8
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x140067e86
movzx ecx, byte [r10]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r10
mov rcx, r10
sub rcx, r8
cmp rcx, rdx
jne 0x140067e63
mov rdi, qword [rsi + 0x30]
and rdi, rax
add rdi, rdi
mov rdx, qword [rsi + 0x18]
mov r9, qword [rsi + 8]
cmp qword [rdx + rdi*8], r9
jne 0x140067ea3
mov rax, r9
jmp 0x140067eab
mov rax, qword [rdx + rdi*8 + 8]
mov rax, qword [rax]
mov r15, rax
cmp r15, qword [rdx + rdi*8]
je 0x140067ed4
mov rax, qword [rax + 8]
mov r15, rax
mov rcx, qword [rax + 0x10]
cmp qword [r8], rcx
jne 0x140067eae
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140067fc8
mov rbx, qword [r9]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.140068690
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x140067f17
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov qword [rsi + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rcx, qword [rsi + 8]
mov rbx, qword [rcx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp r15, rax
je 0x140067f6b
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r15
mov rcx, qword [r15 + 8]
mov qword [rcx], rbx
mov rdx, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov qword [r15 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x18]
cmp qword [rdx + rdi*8], rcx
jne 0x140067f84
mov qword [rdx + rdi*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + rdi*8 + 8], rbx
jmp 0x140067fb4
cmp qword [rdx + rdi*8], r15
jne 0x140067f90
mov qword [rdx + rdi*8], rbx
jmp 0x140067fb4
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rdi*8 + 8], rcx
cmp rcx, rbx
je 0x140067fb4
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rdi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rdi*8 + 8], rcx
mov rcx, rsi
call fcn.14006826c
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140068324
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rsi, rdx
lea r9, [r11 + 8]
mov r10, rcx
cmp r9, r11
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb rbx, rbx
not rbx
and ebx, 8
cmp r11, r9
ja 0x140068381
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x14006835f
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400683b9
cmp qword [rcx + rdx*8], r8
jne 0x1400683ae
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1400683b2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400683c6
cmp qword [rcx + rdx*8], r8
jne 0x1400683c6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov edx, DispGetParam
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14006846c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs rax, 0xcbf29ce484222325
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x1400684d4
movzx ecx, byte [r8]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r8
mov rcx, r8
sub rcx, r11
cmp rcx, rdx
jne 0x1400684b1
mov r8, qword [r10 + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [r10 + 0x18]
mov rdi, qword [r10 + 8]
cmp qword [rcx + r8*8], rdi
je 0x1400684f4
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x140068542
mov rdi, qword [rdi + 8]
mov r9, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r11], rax
jne 0x1400684f7
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, DispGetParam
mov rcx, rbx
call fcn.140356b5c
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400685d6
mov rax, qword [rbx]
cmp r9, rax
je 0x140068577
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10 + 8]
jne 0x140068594
mov qword [rdx + r8*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400685c3
cmp rax, r9
jne 0x14006859f
mov qword [rdx + r8*8], rbx
jmp 0x1400685c3
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400685c3
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.14006826c
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006a9a4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa8
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov qword [rbp - 0x61], r9
mov r13, rcx
xor r14d, r14d
mov dword [rbp - 0x69], r14d
cmp qword [r8 + 0x10], r14
jne 0x14006a9fd
xor r8d, r8d
lea rcx, [rbp - 0x31]
call fcn.14006d604
lea rax, [rbp - 0x31]
lea ebx, [r14 + 5]
jmp 0x14006aa0b
lea rcx, [rbp - 0x11]
call fcn.14006abf0
mov ebx, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x51], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x41], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
test bl, 2
je 0x14006aa3c
and ebx, 0xfffffffd
lea rcx, [rbp - 0x11]
call fcn.140055f70
nop
mov edi, 1
test dil, bl
je 0x14006aa4f
lea rcx, [rbp - 0x31]
call fcn.140055f70
lea rdx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rdx, qword [rbp - 0x51]
movabs rax, 0xcbf29ce484222325
mov r8, rdx
mov r11, qword [rbp - 0x41]
lea r9, [r11 + r11]
lea rcx, [r9 + rdx]
cmp rdx, rcx
cmova r9, r14
test r9, r9
je 0x14006aaa5
movzx ecx, byte [r8]
xor rax, rcx
movabs r10, 0x100000001b3
imul rax, r10
add r8, rdi
mov rcx, r8
sub rcx, rdx
cmp rcx, r9
jne 0x14006aa82
mov rsi, qword [r13 + 0x30]
and rsi, rax
add rsi, rsi
mov r12, qword [r13 + 0x18]
mov rax, qword [r12 + rsi*8]
mov rdx, qword [r13 + 8]
cmp qword [r12 + rsi*8], rdx
jne 0x14006aac6
mov rcx, rdx
jmp 0x14006aace
mov rcx, qword [r12 + rsi*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14006aba0
lea r8, [rax + 0x10]
lea rcx, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rcx, qword [rbp - 0x51]
mov r10, r8
mov r15, qword [r8 + 0x18]
cmp r15, 8
jb 0x14006aaf9
mov r10, qword [r8]
mov rbx, qword [r8 + 0x10]
cmp rbx, r11
jne 0x14006ab3c
mov r14, rbx
test rbx, rbx
je 0x14006ab44
movzx r8d, word [r10]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x14006ab3c
sub r10, rcx
cmp r8w, r9w
ja 0x14006ab3c
cmp r14, rdi
je 0x14006ab44
sub r14, rdi
add rcx, 2
movzx r8d, word [rcx + r10]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x14006ab1f
mov rax, qword [rax]
jmp 0x14006aabb
lea rcx, [rax + 0x10]
cmp r15, 8
jb 0x14006ab51
mov rcx, qword [rcx]
lea r8, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae r8, qword [rbp - 0x51]
xor r14d, r14d
cmp r11, rbx
jne 0x14006aba3
test r11, r11
je 0x14006aba6
movzx r9d, word [r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x14006aba3
sub r8, rcx
cmp r9w, r10w
ja 0x14006aba3
cmp r11, rdi
je 0x14006aba6
sub r11, rdi
add rcx, 2
movzx r9d, word [rcx + r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x14006ab81
jmp 0x14006aba3
xor r14d, r14d
mov rax, rdx
cmp rax, rdx
je 0x14006abb8
movzx ecx, word [rax + 0x30]
mov rax, qword [rbp - 0x61]
mov word [rax], cx
jmp 0x14006abbb
mov dil, r14b
lea rcx, [rbp - 0x51]
call fcn.140055f70
mov al, dil
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140356560
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14006c2b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx eax, word [rdx + 4]
lea r10, [rdx + 0x10]
movzx r8d, word [rdx + 6]
mov rbx, rcx
xor r8, rax
mov r9, r10
mov eax, dword [rdx]
lea rdx, [r10 + 4]
xor r8, rax
movabs rax, 0xcbf29ce484222325
cmp rdx, r10
sbb r11, r11
not r11
and r11d, 4
cmp r10, rdx
ja 0x14006c313
movzx ecx, byte [r9]
movabs rdx, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, r10
imul rax, rdx
cmp rcx, r11
jne 0x14006c2f0
mov rcx, r8
mov rdx, r8
shl rcx, 6
add rcx, rax
shr rdx, 2
mov eax, 0x9e3779b9
add rax, rdx
add rax, rcx
xor rax, r8
and rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 8]
ret
Function at 0x14006c7c8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rsi, rdx
mov rbx, qword [r8 + 0x10]
mov r15, rcx
mov r9, r8
jb 0x14006c7fb
mov r9, qword [r8]
xor edi, edi
lea rdx, [rbx + rbx]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r10, r9
cmova rdx, rdi
test rdx, rdx
je 0x14006c841
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x14006c81e
mov r14, qword [r15 + 0x30]
mov r13, qword [r15 + 0x18]
and r14, rax
mov r11, qword [r15 + 8]
add r14, r14
mov rax, qword [r13 + r14*8]
cmp qword [r13 + r14*8], r11
jne 0x14006c864
mov rcx, r11
jmp 0x14006c86c
mov rcx, qword [r13 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14006c947
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x14006c886
mov rdx, qword [r8]
mov r12, qword [rcx + 0x18]
mov r9, rcx
cmp r12, 8
jb 0x14006c896
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, rbx
jne 0x14006c8da
mov rbp, rdi
test rdi, rdi
je 0x14006c8e2
movzx ecx, word [r9]
movzx r10d, word [rdx]
cmp cx, r10w
jb 0x14006c8da
sub r9, rdx
cmp cx, r10w
ja 0x14006c8da
cmp rbp, 1
je 0x14006c8e2
add rdx, 2
dec rbp
movzx ecx, word [r9 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jae 0x14006c8bc
mov rax, qword [rax]
jmp 0x14006c858
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x14006c8ef
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x14006c8fc
mov rdx, qword [r8]
cmp rbx, rdi
jne 0x14006c93d
xor edi, edi
test rbx, rbx
je 0x14006c942
movzx r9d, word [rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x14006c93f
sub rdx, rcx
cmp r9w, r10w
ja 0x14006c93f
cmp rbx, 1
je 0x14006c942
add rcx, 2
dec rbx
movzx r9d, word [rcx + rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x14006c91d
jmp 0x14006c93f
xor edi, edi
mov rax, r11
mov rcx, rax
jmp 0x14006c94f
mov rax, r11
mov rcx, r11
xor edi, edi
cmp rcx, r11
jne 0x14006c9c9
mov rbx, qword [r11]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14006d278
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14006c9a3
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14006cfa4
jmp 0x14006c9d0
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14006d2d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov rdx, qword [r9 + 0x10]
jb 0x14006d301
mov r10, qword [r9]
add rdx, rdx
xor ebx, ebx
movabs rax, 0xcbf29ce484222325
mov r11, r10
lea rcx, [rdx + r10]
cmp r10, rcx
cmova rdx, rbx
test rdx, rdx
je 0x14006d346
movzx ecx, byte [r11]
movabs rbx, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r10
imul rax, rbx
cmp rcx, rdx
jne 0x14006d323
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14006d37e
cmp qword [rcx + rdx*8], rdi
jne 0x14006d373
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14006d377
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14006d38b
cmp qword [rcx + rdx*8], rdi
jne 0x14006d38b
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140055f70
mov edx, 0x38
mov rcx, rdi
call fcn.140356b5c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14006dd60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rdx]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [str.p76_]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
cmovae rdx, qword [rsp + 0x20]
xor r9d, r9d
mov rcx, rdx
lea r8, [rax + rax]
lea rax, [r8 + rdx]
cmp rdx, rax
cmova r8, r9
test r8, r8
je 0x14006dde6
movzx eax, byte [rcx]
movabs r9, 0x100000001b3
xor rbx, rax
inc rcx
mov rax, rcx
sub rax, rdx
imul rbx, r9
cmp rax, r8
jne 0x14006ddc4
lea rcx, [rsp + 0x20]
call fcn.140055f70
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140356560
add rsp, 0x50
pop rbx
ret