joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400565a0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov r14, rcx
movzx ebp, dl
jne 0x1400565c1
xor al, al
add rsp, 0x38
pop r14
pop rbp
ret
mov qword [rsp + 0x50], rbx
call fcn.140056110
test al, al
je 0x140056606
mov rax, qword [r14 + 0x50]
mov rcx, qword [rax - 0x70]
lea rbx, [rax - 0x78]
test byte [rcx + 0x50], 2
jne 0x14005661d
call fcn.14005ccb0
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x140056602
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x50]
xor al, al
mov byte [r14 + 0x98], 0
add rsp, 0x38
pop r14
pop rbp
ret
mov rdx, rbx
call fcn.140057760
test al, al
je 0x140056606
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005674c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x84222325cbf29ce4
mov qword [rsp + 0x28], r13
movabs r13, 0x100000001b3
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x58], rsi
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400566a5
mov rcx, qword [rdi + 0x18]
lea rsi, [rbp + 1]
xor rsi, r12
imul rsi, r13
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x14005669a
mov edx, 1
mov rcx, rdi
call fcn.140042020
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov qword [rcx], rsi
cmp qword [rbx + 0x30], r15
je 0x1400566e5
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x1400566e5
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, bpl
cmove rcx, r15
call fcn.1400565a0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400566c0
cmp qword [rbx + 0x40], r15
je 0x140056725
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140056725
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, bpl
cmove rcx, r15
call fcn.1400565a0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140056700
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x140056667
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.1400596e0
mov rbx, qword [rsp + 0x50]
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rbp
ret

Function at 0x140056770
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edi, dl
mov rcx, qword [rcx + 0x18]
inc rdi
movabs rax, 0x84222325cbf29ce4
xor rdi, rax
movabs rax, 0x100000001b3
imul rdi, rax
lea rax, [rcx + 8]
cmp rax, qword [rbx + 0x20]
jbe 0x1400567bd
mov edx, 1
mov rcx, rbx
call fcn.140041ed0
mov rcx, qword [rbx + 0x18]
lea rax, [rcx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
mov qword [rcx], rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140058d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov r14, rcx
mov ebp, edx
jne 0x140058d90
xor al, al
add rsp, 0x38
pop r14
pop rbp
ret
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x48]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rcx + 0x50]
cmp rbx, rdi
je 0x140058eca
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x400000006cc
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140058e37
mov rax, rbp
mov rdi, r13
neg rax
mov rcx, rbp
shl rax, 3
add qword [rsi + 0x18], rax
mov rdx, qword [rsi + 0x18]
test ebp, ebp
je 0x140058e11
mov rax, rdx
nop
xor rdi, qword [rax]
lea rax, [rax + 8]
imul rdi, r12
sub rcx, 1
jne 0x140058e00
lea rax, [rdx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140058e2c
mov edx, 1
mov rcx, rsi
call fcn.140042020
mov rdx, qword [rsi + 0x18]
lea rax, [rdx + 8]
mov qword [rsi + 0x18], rax
mov qword [rdx], rdi
cmp qword [rbx + 0x30], r15
je 0x140058e73
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140058e73
nop word [rax + rax]
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.140058d70
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140058e50
cmp qword [rbx + 0x40], r15
je 0x140058ea5
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140058ea5
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.140058d70
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140058e82
mov rdi, qword [r14 + 0x50]
add rbx, 0x78
cmp rbx, rdi
jne 0x140058dd6
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rax, qword [rdi - 0x70]
mov rbx, qword [rsp + 0x50]
mov byte [rdi - 8], 0
cmp ebp, dword [rax + 0xac]
jae 0x140058ee6
call fcn.14005bdb0
jmp 0x140058ef3
cmp ebp, dword [rax + 0xb0]
jbe 0x140058f2a
call fcn.14005ba50
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x140058f0f
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rdi - 0x60], rax
xor al, al
mov rdi, qword [rsp + 0x60]
mov byte [r14 + 0x98], 0
add rsp, 0x38
pop r14
pop rbp
ret
mov rcx, r14
call fcn.1400596e0
mov rdi, qword [rsp + 0x60]
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rbp
ret
Function at 0x140059220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov esi, edx
mov r14, rcx
je 0x1400593af
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x48]
mov rcx, qword [rcx + 0x50]
cmp rbx, rcx
je 0x14005938f
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x30000000519
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400592f6
lea ecx, [rsi + rsi]
mov rbp, r13
neg rcx
mov r9d, r15d
shl rcx, 3
add qword [rdi + 0x18], rcx
mov r8, qword [rdi + 0x18]
test esi, esi
je 0x1400592d0
nop word [rax + rax]
lea ecx, [r9 + r9]
inc r9d
mov eax, ecx
lea edx, [rcx + 1]
mov rcx, qword [r8 + rdx*8]
xor rcx, qword [r8 + rax*8]
imul rcx, r12
xor rbp, rcx
cmp r9d, esi
jb 0x1400592b0
lea rax, [r8 + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x1400592eb
mov edx, 1
mov rcx, rdi
call fcn.140042020
mov r8, qword [rdi + 0x18]
lea rax, [r8 + 8]
mov qword [rdi + 0x18], rax
mov qword [r8], rbp
cmp qword [rbx + 0x30], r15
je 0x140059333
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140059333
nop word [rax + rax]
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.140059220
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140059310
cmp qword [rbx + 0x40], r15
je 0x140059365
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140059365
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.140059220
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140059342
mov rcx, qword [r14 + 0x50]
add rbx, 0x78
cmp rbx, rcx
jne 0x140059280
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
lea rdx, [rcx - 0x78]
mov r8d, esi
mov rcx, qword [rcx - 0x70]
call fcn.140059520
mov rbx, qword [rsp + 0x50]
test al, al
jne 0x1400593b9
mov byte [r14 + 0x98], al
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov rcx, r14
call fcn.1400596e0
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rsi
ret
Function at 0x14005cf90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x28], rdx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov qword [rdx], r15
mov qword [rdx + 8], r15
mov qword [rdx + 0x10], r15
mov dword [rsp + 0x20], 1
mov rbp, qword [rcx + 8]
mov rbx, qword [rcx]
mov rdx, rbp
sub rdx, rbx
sar rdx, 5
test rdx, rdx
je 0x14005d014
movabs rax, 0x7ffffffffffffff
cmp rdx, rax
ja 0x14005d17c
lfence
mov rcx, rdi
call fcn.140066310
mov rbp, qword [r14 + 8]
mov rbx, qword [r14]
cmp rbx, rbp
je 0x14005d154
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14005d042
mov rdx, qword [rbx]
mov r9, r13
mov rcx, r15
test r8, r8
je 0x14005d063
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r12
inc rcx
cmp rcx, r8
jb 0x14005d050
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [r14 + 0x18]
call fcn.14004e120
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14005d081
mov rcx, qword [r14 + 0x20]
mov r8, qword [rdi + 0x10]
mov rax, qword [rdi + 8]
cmp rcx, qword [r14 + 0x20]
je 0x14005d0be
cmp rax, r8
je 0x14005d0aa
lea rdx, [rcx + 0x30]
mov rcx, rax
call fcn.140018de0
add qword [rdi + 8], 0x20
jmp 0x14005d147
lea r8, [rcx + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.14004ddb0
jmp 0x14005d147
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
cmp rax, r8
je 0x14005d0fd
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm1
mov eax, 0xf
mov byte [rsp + 0x40], 0
add qword [rdi + 8], 0x20
jmp 0x14005d112
lea r8, [rsp + 0x40]
mov rdx, rax
mov rcx, rdi
call fcn.14004df40
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x14005d147
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d142
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d182
call fcn.140069cb8
add rbx, 0x20
cmp rbx, rbp
jne 0x14005d031
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140069d50
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140066990
int3
call fcn.14007b2e8
int3
Function at 0x14005dbd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov rsi, rdx
mov r14, rcx
jne 0x14005dbfd
xor al, al
jmp 0x14005dde3
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140056110
test al, al
je 0x14005ddcc
mov rax, qword [r14 + 0x50]
mov r8, rsi
mov rbx, qword [rax - 0x70]
lea rdi, [rax - 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.140056bb0
test al, al
je 0x14005ddcc
mov rdx, rdi
mov rcx, rbx
call fcn.140057760
test al, al
je 0x14005ddcc
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005ddb6
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x14005dd24
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
cvtsi2sd xmm0, rsi
mov rdi, r13
mov rcx, r15
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x14005dcc0
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x14005dd19
mov edx, 1
mov rcx, rbp
call fcn.140042020
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x14005dd57
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x14005dd57
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.14005dbd0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005dd33
cmp qword [rbx + 0x40], r15
je 0x14005dd94
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x14005dd94
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.14005dbd0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005dd70
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x14005dc90
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400596e0
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14005ddd6
mov byte [r14 + 0x98], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x14005e220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
movsxd rbp, edx
jne 0x14005e24d
xor al, al
jmp 0x14005e43c
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140056110
test al, al
je 0x14005e420
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rbx, qword [rax - 0x70]
lea rdi, [rax - 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.140056bb0
test al, al
je 0x14005e420
mov rdx, rdi
mov rcx, rbx
call fcn.140057760
test al, al
je 0x14005e420
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005e40a
mov qword [rsp + 0x60], rsi
movabs rax, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop word [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x14005e374
movd xmm0, ebp
mov rdi, rax
cvtdq2pd xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x14005e310
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x14005e369
mov edx, 1
mov rcx, rsi
call fcn.140042020
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x14005e3a6
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x14005e3a6
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005e220
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005e383
cmp qword [rbx + 0x40], r12
je 0x14005e3e3
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x14005e3e3
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005e220
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005e3c0
add rbx, 0x78
movabs rax, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x14005e2e0
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400596e0
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14005e42a
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140061900
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
cmp rax, qword [rcx + 0x18]
jae 0x140061920
inc rax
mov qword [rcx + 0x20], rax
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x38], 0
jne 0x14006196c
mov rax, qword [rcx + 0x28]
mov edx, 1
add qword [rcx + 0x30], rax
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
call fcn.1400ac074
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x14006196c
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140063f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov rsi, rdx
mov r14, rcx
jne 0x140063f8d
xor al, al
jmp 0x140064193
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140056110
test al, al
je 0x14006417c
mov rax, qword [r14 + 0x50]
mov r8, rsi
mov rbx, qword [rax - 0x70]
lea rdi, [rax - 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.140056d60
test al, al
je 0x14006417c
mov rdx, rdi
mov rcx, rbx
call fcn.140057760
test al, al
je 0x14006417c
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x140064166
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x1400640d4
mov qword [rsp + 0x20], rsi
xorps xmm0, xmm0
test rsi, rsi
js 0x140064041
cvtsi2sd xmm0, rsi
jmp 0x140064059
mov rax, rsi
mov rcx, rsi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
movsd qword [rsp + 0x28], xmm0
mov rdi, r13
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x140064070
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x1400640c9
mov edx, 1
mov rcx, rbp
call fcn.140042020
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x140064107
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140064107
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140063f60
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400640e3
cmp qword [rbx + 0x40], r15
je 0x140064144
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140064144
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140063f60
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140064120
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x140064020
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400596e0
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x140064186
mov byte [r14 + 0x98], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x1400645d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x140103a28]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
mov ebp, edx
jne 0x1400645fc
xor al, al
jmp 0x1400647ec
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140056110
test al, al
je 0x1400647d0
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rbx, qword [rax - 0x70]
lea rdi, [rax - 0x78]
mov rdx, rdi
mov rcx, rbx
call fcn.140056d60
test al, al
je 0x1400647d0
mov rdx, rdi
mov rcx, rbx
call fcn.140057760
test al, al
je 0x1400647d0
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x1400647ba
mov qword [rsp + 0x60], rsi
movabs rcx, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140064724
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
cvtsi2sd xmm0, rbp
mov rdi, rcx
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x1400646c0
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140064719
mov edx, 1
mov rcx, rsi
call fcn.140042020
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140064756
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140064756
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400645d0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140064733
cmp qword [rbx + 0x40], r12
je 0x140064793
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140064793
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400645d0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140064770
add rbx, 0x78
movabs rcx, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x140064690
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.1400596e0
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x1400647da
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140069d50
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140064e70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x140064ec4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140064eb0
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140064ee3
mov edx, 1
mov rcx, rdi
call fcn.140041ed0
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140064f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x140064f54
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140064f40
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140064f73
mov edx, 1
mov rcx, rdi
call fcn.140042020
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140092ce0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140092acf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140092acf
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140092acf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140092acf
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140092acf
cmp dword [rcx + 0x84], 0xe
jbe 0x140092acf
cmp dword [rcx + 0xf8], 0
je 0x140092acf
mov ecx, ebx
call fcn.140092c00
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140092854
cmp dword [rbp + 0x20], 0
je 0x140092b1c
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140092b24
int3
xor r8d, r8d
xor edx, edx
jmp 0x140092a68