joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180063ed0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov r14, rcx
mov rdi, qword [rcx + 8]
mov rbx, qword [rcx]
lea rsi, [rdi + 0x48]
mov qword [rsp + 0x20], rsi
mov byte [rsp + 0x28], 1
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
mov qword [rsp + 0xd0], rbx
lea rcx, [rdi + 0x50]
lea rdx, [rsp + 0xd0]
call fcn.18004e860
movzx ebx, al
mov rcx, rsi
call sub.KERNEL32.dll_ReleaseSRWLockShared
test bl, bl
je 0x18005fd58
mov eax, dword [0x1804c0678]
mov rbx, qword [r14]
mov rbx, qword [rax + rbx]
mov qword [rsp + 0xd0], rbx
test rbx, rbx
je 0x18005fd58
xor esi, esi
movabs rbp, 0x100000001b3
movabs r15, 0xcbf29ce484222325
nop dword [rax]
mov qword [rsp + 0xa8], rsi
mov rdi, qword [r14 + 8]
add rdi, 0x48
mov qword [rsp + 0x20], rdi
mov byte [rsp + 0x28], 1
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
mov r8, qword [r14 + 8]
movzx edx, bl
xor rdx, r15
imul rdx, rbp
movzx eax, byte [rsp + 0xd1]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd2]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd3]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd4]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd5]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd6]
xor rdx, rax
imul rdx, rbp
movzx eax, byte [rsp + 0xd7]
xor rdx, rax
imul rdx, rbp
mov rcx, qword [r8 + 0x2d8]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x2c0]
mov rax, qword [rcx + 8]
mov rdx, qword [r8 + 0x2b0]
cmp rax, rdx
je 0x18005fc89
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x18005fc8c
cmp rax, rcx
je 0x18005fc89
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x18005fc78
jmp 0x18005fc8c
mov rax, rsi
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x18005fce5
mov qword [rsp + 0x68], rsi
mov rcx, qword [rax + 0x50]
test rcx, rcx
je 0x18005fcb5
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.180020bc0
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18005fce5
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0x68], rsi
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockShared
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18005fd14
mov rax, qword [r14]
mov qword [rsp + 0xd0], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0xd0]
call qword [rax + 0x10]
nop
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x18005fd3a
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rsp + 0xa8], rsi
mov eax, dword [0x1804c0680]
mov rcx, qword [rax + rbx]
mov rbx, rcx
mov qword [rsp + 0xd0], rcx
test rcx, rcx
jne 0x18005fbb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
add rcx, 8
jmp 0x18005fb10
Function at 0x1800645c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800647a1
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18001fd00
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18006475f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x14]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x15]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x16]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x17]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800646dc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180064753
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x180064719
mov r8, qword [rax]
cmp r8, rcx
je 0x180064713
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180064753
cmp r9, rax
je 0x18006472f
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x18006477b
cmp r9, rax
jne 0x180064720
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180064660
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180064753
lea rcx, str.invalid_hash_bucket_count
call fcn.1802657c8
int3
Function at 0x180064b90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180064d71
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18001fd00
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180064d2f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r11d, byte [rcx + 0x10]
xor r11, rbp
imul r11, rdi
movzx eax, byte [rcx + 0x11]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x12]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x13]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x14]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x15]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x16]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x17]
xor r11, rax
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180064ca9
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180064d23
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x180064ce6
mov r8, qword [rax]
cmp r8, rcx
je 0x180064ce0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180064d23
cmp r9, rax
je 0x180064cff
nop dword [rax + rax]
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x180064d4b
cmp r9, rax
jne 0x180064cf0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180064c30
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180064d23
lea rcx, str.invalid_hash_bucket_count
call fcn.1802657c8
int3
Function at 0x180064f70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180065151
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18001fd00
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18006510f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x14]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x15]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x16]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x17]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18006508c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180065103
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x1800650c9
mov r8, qword [rax]
cmp r8, rcx
je 0x1800650c3
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180065103
cmp r9, rax
je 0x1800650df
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x18006512b
cmp r9, rax
jne 0x1800650d0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180065010
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180065103
lea rcx, str.invalid_hash_bucket_count
call fcn.1802657c8
int3
Function at 0x180072c90
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
lea r10, [r9 + 8]
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r9 + 0x30]
shl r8, 4
add r8, qword [r9 + 0x18]
mov r9, qword [r10]
mov rdx, qword [r8 + 8]
cmp rdx, r9
je 0x180072d41
mov rax, qword [r11]
mov rcx, qword [r8]
cmp rax, qword [rdx + 0x10]
je 0x180072d43
nop
cmp rdx, rcx
je 0x180072d41
mov rdx, qword [rdx + 8]
cmp rax, qword [rdx + 0x10]
jne 0x180072d30
jmp 0x180072d43
xor edx, edx
test rdx, rdx
je 0x180072d9c
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x180072d69
cmp rax, rdx
jne 0x180072d5f
mov qword [r8], r9
mov qword [r8 + 8], r9
jmp 0x180072d74
mov r9, qword [rdx + 8]
mov qword [r8 + 8], r9
jmp 0x180072d74
cmp rax, rdx
jne 0x180072d74
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
mov rcx, r10
dec qword [r10 + 8]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.180046180
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x180072db0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r11, rdx
mov r10, rcx
movzx r8d, byte [rdx]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 1]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 2]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 3]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 4]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 5]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 6]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 7]
xor r8, rax
imul r8, rcx
mov rdx, qword [r10 + 0x30]
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
mov r9, qword [r10 + 8]
cmp rcx, r9
je 0x180072e61
mov r8, qword [rdx]
mov rax, qword [r11]
cmp rax, qword [rcx + 0x10]
je 0x180072e63
nop
cmp rcx, r8
je 0x180072e61
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180072e50
jmp 0x180072e63
xor ecx, ecx
test rcx, rcx
je 0x180072ebe
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x180072e89
cmp rax, rcx
jne 0x180072e7f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x180072e94
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x180072e94
cmp rax, rcx
jne 0x180072e94
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.18026a1a0
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800756d0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rax - 0x38], ebx
lea r14, [rcx + 0x48]
mov qword [rax - 0x30], r14
mov byte [rax - 0x28], 1
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
movzx r8d, sil
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rsp + 0x71]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x72]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x73]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x74]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x75]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x76]
xor r8, rax
imul r8, rcx
movzx eax, byte [rsp + 0x77]
xor r8, rax
imul r8, rcx
mov rdx, qword [rdi + 0x100]
and rdx, r8
shl rdx, 4
add rdx, qword [rdi + 0xe8]
mov rcx, qword [rdx + 8]
mov rax, qword [rdi + 0xd8]
cmp rcx, rax
je 0x1800757c2
mov rdx, qword [rdx]
cmp rsi, qword [rcx + 0x10]
je 0x1800757bf
nop
cmp rcx, rdx
je 0x1800757c2
mov rcx, qword [rcx + 8]
cmp rsi, qword [rcx + 0x10]
jne 0x1800757b0
mov rbx, rcx
test rbx, rbx
cmove rbx, rax
mov rcx, rbp
cmp rbx, rax
je 0x1800757dc
lea rdx, [rbx + 0x18]
call fcn.180057720
jmp 0x1800757e1
call fcn.18002b210
mov dword [rsp + 0x20], 1
mov rcx, r14
call sub.KERNEL32.dll_ReleaseSRWLockShared
mov rax, rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18007b1c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800763f0
test al, al
je 0x18007b31e
call fcn.180211640
mov r9, rax
test rax, rax
je 0x18007b31e
mov rcx, qword [rbx]
mov r8, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18007b1f7
mov r8, qword [rcx]
mov r10, qword [rcx + 0x10]
movabs rdx, 0xcbf29ce484222325
add r10, r8
cmp r8, r10
je 0x18007b31e
movabs rcx, 0x100000001b3
nop dword [rax + rax]
movsx rax, byte [r8]
inc r8
xor rdx, rax
imul rdx, rcx
cmp r8, r10
jne 0x18007b220
movabs rax, 0xf19e6c4e521dd53
cmp rdx, rax
je 0x18007b311
movabs rax, 0x461067e41ab0abe5
cmp rdx, rax
je 0x18007b2dc
movabs rax, 0x923927a762652131
cmp rdx, rax
je 0x18007b2a7
movabs rax, 0xe5dc2b75d3c5a308
cmp rdx, rax
jne 0x18007b31e
mov rcx, r9
call fcn.1802119b0
mov rbx, rax
test rax, rax
je 0x18007b31e
call fcn.18022c960
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.18022c980
mov rcx, r9
call fcn.1802119b0
mov rbx, rax
test rax, rax
je 0x18007b31e
call fcn.18022c960
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.18022c980
test rax, rax
je 0x18007b31e
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.18022ce50
mov rcx, r9
call fcn.1802119b0
mov rbx, rax
test rax, rax
je 0x18007b31e
call fcn.18022c960
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call fcn.18022c980
test rax, rax
je 0x18007b31e
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.18022cc10
mov rcx, r9
add rsp, 0x20
pop rbx
jmp fcn.1802119b0
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180088af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180088b21
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x180088b9b
mov rdi, r14
mov rcx, rbx
call fcn.180066360
test rax, rax
jle 0x180088b73
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.180287a80
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180088b8b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180088b93
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180088b35
sub r14, rdi
jmp 0x180088c7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180088bb2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180088bb4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180088be6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180287a80
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180088c7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180088c21
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x180088c5d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18028f2b0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x180088c7c
cmp rbp, rax
ja 0x180088c30
test rbp, rbp
je 0x180088c7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18028f2b0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18008a270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x80]
mov rdi, rdx
test eax, eax
movd edx, xmm3
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x18008a2c1
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x18008a2c4
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x18008a2f5
lea edx, [rax - 0x27]
jmp 0x18008a2fe
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x18008a31c
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x18008a467
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x18008a30c
mov qword [rsp + 0x60], rbx
cmp r10d, r11d
jge 0x18008a35e
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x18008a3e5
mov byte [rdi], 0x2e
lea r11, [0x1803237c8]
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, 0x14
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x18008a3e5
mov edx, 0x100000
test ecx, ecx
je 0x18008a3cf
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x18008a3a7
jmp 0x18008a3e5
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call fcn.180288120
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x18008a400
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x18008a445
mov dword [r14 + 8], 0x84
jmp 0x18008a45f
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.180287a80
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rax, r14
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x18008a480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov eax, dword [rsp + 0x80]
mov rsi, rdx
test eax, eax
movq rdx, xmm3
mov r9, rdx
mov r11d, 0xd
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x18008a4e4
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x18008a4ea
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x18008a524
lea ecx, [rax - 0x27]
jmp 0x18008a53d
cmp edi, 0x64
jae 0x18008a530
mov ecx, 5
jmp 0x18008a53d
cmp edi, 0x3e8
sbb rcx, rcx
add rcx, 7
mov rdx, rbp
movsxd r8, r10d
sub rdx, rsi
cmp rdx, r8
jl 0x18008a67b
xor eax, eax
test r10d, r10d
setg al
sub rdx, r8
add rax, rcx
cmp rdx, rax
jl 0x18008a67b
cmp r10d, r11d
jge 0x18008a592
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x18008a622
mov byte [rsi], 0x2e
lea r11, [0x1803237c8]
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x18008a622
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x18008a60c
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x18008a5e0
jmp 0x18008a622
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call fcn.180288120
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x18008a640
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x18008a685
mov dword [r14 + 8], 0x84
jmp 0x18008a69f
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.180287a80
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret