joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402c55b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor r10d, r10d
lea r8, [rdx + 1]
cmp rdx, r8
mov r11d, r10d
mov rbx, rcx
movabs rax, 0xcbf29ce484222325
setbe r11b
mov r9, rdx
ja 0x1402c5608
movzx ecx, byte [r9]
movabs r8, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r8
cmp rcx, r11
jne 0x1402c55e5
mov r11, qword [rbx + 0x30]
mov rdi, qword [rbx + 0x18]
and r11, rax
mov r9, qword [rbx + 8]
add r11, r11
mov rax, qword [rdi + r11*8]
cmp qword [rdi + r11*8], r9
jne 0x1402c5629
mov rcx, r9
jmp 0x1402c5631
mov rcx, qword [rdi + r11*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1402c566f
mov bl, byte [rdx]
cmp byte [rax + 0x10], bl
je 0x1402c5642
mov rax, qword [rax]
jmp 0x1402c561e
mov r8, rax
mov rcx, rax
cmp qword [rdi + r11*8], r9
jne 0x1402c5653
mov rdx, r9
jmp 0x1402c565b
mov rdx, qword [rdi + r11*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1402c566a
cmp bl, byte [rax + 0x10]
jne 0x1402c566a
mov rax, qword [rax]
jmp 0x1402c5648
cmp r8, rax
jne 0x1402c567d
mov rcx, r9
mov rax, r9
jmp 0x1402c567d
mov rcx, qword [rcx]
inc r10
cmp rcx, rax
jne 0x1402c5677
mov rbx, qword [rsp + 8]
mov rax, r10
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1402c5698
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x28
xor r10d, r10d
lea r8, [rdx + 1]
cmp rdx, r8
mov r9, rdx
mov r11, rcx
movabs rax, 0xcbf29ce484222325
setbe r10b
ja 0x1402c56de
movzx ecx, byte [rdx]
movabs r8, 0x100000001b3
xor rax, rcx
inc rdx
mov rcx, rdx
sub rcx, r9
imul rax, r8
cmp rcx, r10
jne 0x1402c56bc
mov r8, qword [r11 + 0x30]
mov r10, qword [r11 + 0x18]
and r8, rax
mov rdx, qword [r11 + 8]
add r8, r8
mov rax, qword [r10 + r8*8]
cmp qword [r10 + r8*8], rdx
jne 0x1402c56ff
mov rcx, rdx
jmp 0x1402c5707
mov rcx, qword [r10 + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1402c5719
mov cl, byte [r9]
cmp byte [rax + 0x10], cl
je 0x1402c571c
mov rax, qword [rax]
jmp 0x1402c56f4
mov rax, rdx
cmp rax, rdx
jne 0x1402c5735
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop dword [rax + rax]
int3
add rax, 0x18
add rsp, 0x28
ret
Function at 0x1402cad24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rsi, rdx
mov rbx, qword [r8 + 0x10]
mov r15, rcx
mov r9, r8
jb 0x1402cad57
mov r9, qword [r8]
xor edi, edi
lea rdx, [rbx + rbx]
lea rcx, [rdx + r9]
movabs rax, 0xcbf29ce484222325
cmp r9, rcx
mov r10, r9
cmova rdx, rdi
test rdx, rdx
je 0x1402cad9d
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x1402cad7a
mov r14, qword [r15 + 0x30]
mov r13, qword [r15 + 0x18]
and r14, rax
mov r11, qword [r15 + 8]
add r14, r14
mov rax, qword [r13 + r14*8]
cmp qword [r13 + r14*8], r11
jne 0x1402cadc0
mov rcx, r11
jmp 0x1402cadc8
mov rcx, qword [r13 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1402caea3
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1402cade2
mov rdx, qword [r8]
mov r12, qword [rcx + 0x18]
mov r9, rcx
cmp r12, 8
jb 0x1402cadf2
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, rbx
jne 0x1402cae36
mov rbp, rdi
test rdi, rdi
je 0x1402cae3e
movzx ecx, word [r9]
movzx r10d, word [rdx]
cmp cx, r10w
jb 0x1402cae36
sub r9, rdx
cmp cx, r10w
ja 0x1402cae36
cmp rbp, 1
je 0x1402cae3e
add rdx, 2
dec rbp
movzx ecx, word [r9 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jae 0x1402cae18
mov rax, qword [rax]
jmp 0x1402cadb4
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x1402cae4b
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x1402cae58
mov rdx, qword [r8]
cmp rbx, rdi
jne 0x1402cae99
xor edi, edi
test rbx, rbx
je 0x1402cae9e
movzx r9d, word [rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x1402cae9b
sub rdx, rcx
cmp r9w, r10w
ja 0x1402cae9b
cmp rbx, 1
je 0x1402cae9e
add rcx, 2
dec rbx
movzx r9d, word [rcx + rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x1402cae79
jmp 0x1402cae9b
xor edi, edi
mov rax, r11
mov rcx, rax
jmp 0x1402caeab
mov rax, r11
mov rcx, r11
xor edi, edi
cmp rcx, r11
jne 0x1402caf25
mov rbx, qword [r11]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1402c2614
mov rdx, rax
movabs rcx, 0x3fffffffffffffe
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1402caeff
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
nop dword [rax + rax]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1402c21b4
jmp 0x1402caf2c
mov qword [rsi], rax
mov byte [rsi + 8], dil
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1402d2a7c
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1405420e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x21], rdx
and dword [rbp - 0x29], 0
mov ecx, 0x28
call fcn.140356b9c
mov rdi, rax
mov qword [rbp - 0x31], rax
mov eax, 1
mov dword [rdi + 8], eax
mov dword [rdi + 0xc], eax
lea rax, vtable.std::_Ref_count_obj_class_sense::machineStateCollection::MachinePropertiesState_.0
mov qword [rdi], rax
lea rbx, [rdi + 0x10]
and dword [rbx], 0
lea rcx, [rbx + 8]
call fcn.1401962c0
mov byte [rbx + 0x14], 0
or eax, 0xffffffff
mov dword [rbx], eax
mov dword [rbx + 0x10], eax
mov qword [r14], rbx
mov qword [r14 + 8], rdi
mov dword [rbp - 0x29], 3
mov rdx, r14
mov rcx, rsi
call fcn.1402d2818
lea rdx, [rsi + 8]
lea rcx, [0x140545430]
call fcn.1402dab10
test al, al
je 0x1402d2bc7
lea r9, [rbp - 0x21]
mov r8d, 2
lea rdx, [rbp - 0x39]
mov ecx, SysAllocStringByteLen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
nop dword [rax + rax]
mov dword [rbp - 0x31], eax
test eax, eax
jns 0x1402d2bb5
call fcn.1400550c0
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1402d2baa
lea rax, str.Machine_properties_state_collector___failed_to_get_SystemSecureBootInformation
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x9e
and dword [rbp + 0x23], 0
lea rax, [rbp - 0x31]
mov qword [rbp + 0x27], rax
mov edx, 4
mov dword [rbp + 0x2f], edx
and dword [rbp + 0x33], 0
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14048a629]
call fcn.140001208
mov rcx, qword [r14]
mov eax, dword [rbp - 0x31]
mov dword [rcx + 0x10], eax
jmp 0x1402d2bc7
mov cl, byte [rbp - 0x39]
mov rdx, qword [r14]
and dword [rdx + 0x10], 0
test cl, cl
setne cl
mov byte [rdx + 0x14], cl
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140356560
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1402d91c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov r9, rdx
mov rbp, rcx
movabs rax, 0xcbf29ce484222325
mov r10, rdx
lea r8, [rdx + 4]
cmp r8, rdx
sbb rdx, rdx
not rdx
and edx, 4
cmp r10, r8
ja 0x1402d9227
movzx ecx, byte [r10]
xor rax, rcx
movabs r8, 0x100000001b3
imul rax, r8
inc r10
mov rcx, r10
sub rcx, r9
cmp rcx, rdx
jne 0x1402d9204
mov r8, qword [rbp + 0x30]
and r8, rax
add r8, r8
mov r11, qword [rbp + 0x18]
mov rbx, qword [r11 + r8*8]
mov rdx, qword [rbp + 8]
cmp qword [r11 + r8*8], rdx
jne 0x1402d9248
mov rax, rdx
jmp 0x1402d9250
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1402d9291
mov r10d, dword [r9]
cmp dword [rbx + 0x10], r10d
je 0x1402d9263
mov rbx, qword [rbx]
jmp 0x1402d923d
mov rcx, rbx
mov rdi, rbx
cmp qword [r11 + r8*8], rdx
jne 0x1402d9274
mov rax, rdx
jmp 0x1402d927c
mov rax, qword [r11 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1402d928c
cmp r10d, dword [rbx + 0x10]
jne 0x1402d928c
mov rbx, qword [rbx]
jmp 0x1402d9269
cmp rcx, rbx
jne 0x1402d9297
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
xor r14d, r14d
cmp rdi, rbx
je 0x1402d92ad
inc r14
mov rax, qword [rax]
cmp rax, rbx
jne 0x1402d92a2
mov rsi, qword [rdx]
cmp rdi, rsi
jne 0x1402d9331
cmp rbx, rdx
jne 0x1402d9331
mov qword [rdx], rdx
mov rax, qword [rbp + 8]
mov qword [rax + 8], rax
and qword [rbp + 0x10], 0
cmp rsi, qword [rbp + 8]
je 0x1402d930e
mov rbx, qword [rsi]
lea rdi, [rsi + 0x18]
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1402d92f8
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
mov rax, qword [rax + 0x20]
call qword [str.p76_]
and qword [rdi + 0x38], 0
mov edx, 0x58
mov rcx, rsi
call fcn.140356b5c
mov rsi, rbx
cmp rbx, qword [rbp + 8]
jne 0x1402d92d0
mov edx, 8
mov rcx, rbp
call fcn.14005e790
nop
jmp 0x1402d9336
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.1402d9354
cmp rdi, rbx
jne 0x1402d931e
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1402d9354
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rbx, r8
lea r8, [r11 + 4]
mov rsi, rdx
cmp r8, r11
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb r10, r10
not r10
and r10d, 4
cmp r11, r8
ja 0x1402d93ba
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, r10
jne 0x1402d9398
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1402d93f2
cmp qword [rcx + rdx*8], rbx
jne 0x1402d93e7
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1402d93eb
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402d93ff
cmp qword [rcx + rdx*8], rbx
jne 0x1402d93ff
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
lea rbp, [r11 + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1402d943d
mov rax, qword [rcx]
cmp rcx, rbp
setne dl
mov rax, qword [rax + 0x20]
call qword [str.p76_]
and qword [rbp + 0x38], 0
mov edx, 0x58
mov rcx, rbx
call fcn.140356b5c
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rbp, qword [rsp + 0x38]
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1402d946c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
lea r9, [r8 + 4]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 4
cmp r8, r9
ja 0x1402d94d8
movzx ecx, byte [r8]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r8
mov rcx, r8
sub rcx, r10
cmp rcx, rdx
jne 0x1402d94b5
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
cmp qword [rcx + r8*8], rdi
je 0x1402d94f8
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x1402d956b
mov rdi, qword [rdi + 8]
mov r9, rdi
mov eax, dword [rdi + 0x10]
cmp dword [r10], eax
jne 0x1402d94fb
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rsi, [rbx + 0x18]
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1402d954e
mov rax, qword [rcx]
cmp rcx, rsi
setne dl
mov rax, qword [rax + 0x20]
call qword [str.p76_]
and qword [rsi + 0x38], 0
mov edx, 0x58
mov rcx, rbx
call fcn.140356b5c
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1402d9690
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp r9, rax
je 0x1402d95a8
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1402d95c5
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1402d95f4
cmp rax, r9
jne 0x1402d95d0
mov qword [rdx + r8*8], rbx
jmp 0x1402d95f4
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1402d95f4
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1404202fc]
test rax, rax
jns 0x1402d9615
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1402d9626
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1402d9685
cmp rdx, 0x200
jae 0x1402d963e
shl rdx, 3
jmp 0x1402d9650
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1402d9650
add rdx, rdx
mov rcx, rsi
call fcn.14005e790
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1402d9685
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1402d946c
cmp rdi, r15
jne 0x1402d9665
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402e40bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movabs rax, 0xcbf29ce484222325
lea r9, [r8 + 8]
cmp r9, r8
sbb rdx, rdx
not rdx
and edx, 8
cmp r8, r9
ja 0x1402e4128
movzx ecx, byte [r8]
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
inc r8
mov rcx, r8
sub rcx, r10
cmp rcx, rdx
jne 0x1402e4105
mov r8, qword [rsi + 0x30]
and r8, rax
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
cmp qword [rcx + r8*8], rdi
je 0x1402e4148
mov rdi, qword [rcx + r8*8 + 8]
mov rdi, qword [rdi]
mov r9, rdi
cmp r9, qword [rcx + r8*8]
je 0x1402e4185
mov rdi, qword [rdi + 8]
mov r9, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r10], rax
jne 0x1402e414b
mov r8, rbx
lea rdx, [rsp + 0x80]
lea rcx, [rsi + 8]
call fcn.1402e4460
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1402e42aa
mov qword [rsp + 0x80], rbx
mov rax, qword [rbx]
cmp r9, rax
je 0x1402e41c2
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r9
mov rcx, qword [r9 + 8]
mov qword [rcx], rbx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax + 8]
mov qword [r9 + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1402e41df
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1402e420e
cmp rax, r9
jne 0x1402e41ea
mov qword [rdx + r8*8], rbx
jmp 0x1402e420e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1402e420e
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1404202fc]
test rax, rax
jns 0x1402e422f
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1402e4240
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1402e429f
cmp rdx, 0x200
jae 0x1402e4258
shl rdx, 3
jmp 0x1402e426a
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1402e426a
add rdx, rdx
mov rcx, rsi
call fcn.14005e790
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1402e429f
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1402e40bc
cmp rdi, r15
jne 0x1402e427f
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402e4554
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rsi, rdx
lea r9, [r11 + 8]
mov r10, rcx
cmp r9, r11
movabs rax, 0xcbf29ce484222325
mov rdi, r11
sbb rbx, rbx
not rbx
and ebx, 8
cmp r11, r9
ja 0x1402e45b1
movzx ecx, byte [rdi]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rdi
mov rcx, rdi
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x1402e458f
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1402e45e9
cmp qword [rcx + rdx*8], r8
jne 0x1402e45de
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1402e45e2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402e45f6
cmp qword [rcx + rdx*8], r8
jne 0x1402e45f6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rsi
call fcn.1402e4460
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1402e6a38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov rdx, qword [rsi + 0x10]
jb 0x1402e6a6b
mov r9, qword [rsi]
add rdx, rdx
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, r11
test rdx, rdx
je 0x1402e6ab1
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x1402e6a8e
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1402e6ae9
cmp qword [rcx + rdx*8], rdi
jne 0x1402e6ade
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1402e6ae2
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402e6af6
cmp qword [rcx + rdx*8], rdi
jne 0x1402e6af6
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x28]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1402d4c1c
mov rcx, rsi
call fcn.140055f70
mov edx, 0x50
mov rcx, rdi
call fcn.140356b5c
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1402e6b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r15, rdx
mov r8, rcx
lea r14, [rdi + 0x10]
cmp qword [r14 + 0x18], 8
mov r9, r14
mov rdx, qword [r14 + 0x10]
jb 0x1402e6b87
mov r9, qword [r14]
add rdx, rdx
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, r9
lea rcx, [rdx + r9]
cmp r9, rcx
cmova rdx, r11
test rdx, rdx
je 0x1402e6bcd
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, r9
imul rax, r11
cmp rcx, rdx
jne 0x1402e6baa
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1402e6c05
cmp qword [rcx + rdx*8], rdi
jne 0x1402e6bfa
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1402e6bfe
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1402e6c12
cmp qword [rcx + rdx*8], rdi
jne 0x1402e6c12
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [r14 + 0x60]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14005e188
lea rcx, [r14 + 0x40]
call fcn.140055f70
lea rcx, [r14 + 0x20]
call fcn.140055f70
mov rcx, r14
call fcn.140055f70
mov edx, 0x88
mov rcx, rdi
call fcn.140356b5c
mov rsi, qword [rsp + 0x38]
mov rax, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [r15], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret
Function at 0x1402e6c84
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r15, rdx
mov r9, rcx
mov r12, qword [r8 + 0x10]
mov r10, r8
cmp qword [r8 + 0x18], 8
jb 0x1402e6cc3
mov r10, qword [r8]
movabs rax, 0xcbf29ce484222325
mov r8, r10
lea rdx, [r12 + r12]
lea rcx, [rdx + r10]
xor r13d, r13d
cmp r10, rcx
cmova rdx, r13
test rdx, rdx
je 0x1402e6d0a
movzx ecx, byte [r8]
xor rax, rcx
movabs rdi, 0x100000001b3
imul rax, rdi
inc r8
mov rcx, r8
sub rcx, r10
cmp rcx, rdx
jne 0x1402e6ce7
mov r8, qword [r9 + 0x30]
and r8, rax
add r8, r8
mov r14, qword [r9 + 0x18]
mov rdi, qword [r9 + 8]
cmp rdi, qword [r14 + r8*8]
je 0x1402e6df1
mov rdi, qword [r14 + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r14 + r8*8]
je 0x1402e6df1
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x1402e6d4d
mov rcx, qword [rax]
mov r10, r11
cmp qword [r11 + 0x18], 8
jb 0x1402e6d5a
mov r10, qword [r11]
cmp r12, qword [rax + 0x10]
jne 0x1402e6d2e
mov rsi, r12
test r12, r12
je 0x1402e6d98
movzx eax, word [r10]
movzx edx, word [rcx]
cmp ax, dx
jb 0x1402e6d2e
sub r10, rcx
cmp ax, dx
ja 0x1402e6d2e
cmp rsi, 1
je 0x1402e6d98
dec rsi
add rcx, 2
movzx eax, word [r10 + rcx]
movzx edx, word [rcx]
cmp ax, dx
jae 0x1402e6d7a
jmp 0x1402e6d2e
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rbx + 0x70]
call fcn.14005e188
lea rcx, [rbx + 0x50]
call fcn.140055f70
lea rcx, [rbx + 0x30]
call fcn.140055f70
lea rcx, [rbx + 0x10]
call fcn.140055f70
mov edx, 0x88
mov rcx, rbx
call fcn.140356b5c
mov qword [r15], rdi
mov byte [r15 + 8], r13b
mov rax, r15
jmp 0x1402e6e86
mov rax, qword [rbx]
cmp rdi, rax
je 0x1402e6e26
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x1402e6e43
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1402e6e72
cmp rax, rdi
jne 0x1402e6e4e
mov qword [rdx + r8*8], rbx
jmp 0x1402e6e72
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1402e6e72
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.1402e67c0
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret