joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d0e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r15, r8
mov r12, rdx
mov r14, rcx
mov r13, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14009d124
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x14009d153
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r9, 0x100000001b3
imul rdx, r9
inc rcx
cmp rcx, r13
jb 0x14009d135
mov rsi, qword [r14 + 0x30]
and rsi, rdx
mov rdi, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + rsi*8]
je 0x14009d1f1
mov rdi, qword [rax + rsi*8 + 8]
mov rdi, qword [rdi]
jmp 0x14009d1eb
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x14009d18c
mov rdx, qword [rdi + 0x10]
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x14009d199
mov rcx, qword [r15]
cmp r13, qword [rdi + 0x20]
jne 0x14009d1e7
mov r8, r13
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
jne 0x14009d1e7
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14004c91c
mov rcx, rbx
call fcn.14027abd8
mov qword [r12], rdi
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x14009d288
mov rax, qword [r14 + 0x18]
cmp rdi, qword [rax + rsi*8]
jne 0x14009d179
mov rax, qword [rbx]
cmp rdi, rax
je 0x14009d226
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x14009d243
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x14009d272
cmp rax, rdi
jne 0x14009d24e
mov qword [rdx + rsi*8], rbx
jmp 0x14009d272
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x14009d272
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14009cf58
nop
mov qword [r12], rbx
mov byte [r12 + 8], 1
mov rax, r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009ef24
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009ef51
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14009ef85
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14009ef67
and rcx, qword [0x1404106b0]
mov r14, qword [0x140410698]
mov rax, rcx
mov r10, qword [0x140410688]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009efb3
mov rcx, r10
jmp 0x14009efbb
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009f068
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14009efd5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14009efe5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14009f017
mov rdi, rsi
test rsi, rsi
je 0x14009f011
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009f01c
add r8, 2
sub rdi, 1
jne 0x14009eff9
xor ecx, ecx
test ecx, ecx
je 0x14009f025
mov rax, qword [rax]
jmp 0x14009efa8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009f013
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009f032
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009f03c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14009f068
test r11, r11
je 0x14009f062
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14009f074
add rcx, 2
sub r11, 1
jne 0x14009f049
xor ecx, ecx
test ecx, ecx
je 0x14009f06b
mov rax, r10
cmp rax, r10
jne 0x14009f07d
xor al, al
jmp 0x14009f086
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009f064
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14009fcf0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14009fd1d
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14009fd51
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14009fd33
and rcx, qword [0x1403f1c00]
mov r14, qword [0x1403f1be8]
mov rax, rcx
mov r10, qword [0x1403f1bd8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14009fd7f
mov rcx, r10
jmp 0x14009fd87
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14009fe34
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14009fda1
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14009fdb1
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14009fde3
mov rdi, rsi
test rsi, rsi
je 0x14009fddd
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14009fde8
add r8, 2
sub rdi, 1
jne 0x14009fdc5
xor ecx, ecx
test ecx, ecx
je 0x14009fdf1
mov rax, qword [rax]
jmp 0x14009fd74
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009fddf
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14009fdfe
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14009fe08
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14009fe34
test r11, r11
je 0x14009fe2e
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14009fe40
add rcx, 2
sub r11, 1
jne 0x14009fe15
xor ecx, ecx
test ecx, ecx
je 0x14009fe37
mov rax, r10
cmp rax, r10
jne 0x14009fe49
xor al, al
jmp 0x14009fe52
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14009fe30
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400a1ea0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400a1ecd
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400a1f01
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400a1ee3
and rcx, qword [0x1403f1c40]
mov r14, qword [0x1403f1c28]
mov rax, rcx
mov r10, qword [0x1403f1c18]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400a1f2f
mov rcx, r10
jmp 0x1400a1f37
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400a1fe4
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400a1f51
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400a1f61
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400a1f93
mov rdi, rsi
test rsi, rsi
je 0x1400a1f8d
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400a1f98
add r8, 2
sub rdi, 1
jne 0x1400a1f75
xor ecx, ecx
test ecx, ecx
je 0x1400a1fa1
mov rax, qword [rax]
jmp 0x1400a1f24
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a1f8f
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400a1fae
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400a1fb8
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400a1fe4
test r11, r11
je 0x1400a1fde
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400a1ff0
add rcx, 2
sub r11, 1
jne 0x1400a1fc5
xor ecx, ecx
test ecx, ecx
je 0x1400a1fe7
mov rax, r10
cmp rax, r10
jne 0x1400a1ff9
xor al, al
jmp 0x1400a2002
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400a1fe0
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400ab06c
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rsi, rdx
mov rdi, rcx
or dword [rax + 0x10], 0xffffffff
mov rdx, qword [rdx + 8]
sub rdx, qword [rsi]
lea rcx, [rax + 0x10]
mov qword [rax - 0x38], rcx
xor r9d, r9d
mov r14d, 0x40000001
mov r8d, r14d
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x1400ab0fa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1400443b8
mov r9d, eax
mov rcx, qword [rsp + 0x58]
lea rax, str.ConvertByteArrayToBase64String_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x124
call fcn.140048380
int3
mov edx, dword [rsp + 0x68]
lea rcx, [rsp + 0x38]
call fcn.140076fa0
nop
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rsp + 0x38]
mov r9, rbx
mov r8d, r14d
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
jne 0x1400ab171
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.1400443b8
mov r9d, eax
mov rcx, qword [rsp + 0x58]
lea rax, str.ConvertByteArrayToBase64String_failed_conversion
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x12b
call fcn.140048380
int3
mov esi, dword [rsp + 0x68]
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], SafeArrayLock
mov byte [rdi], 0
cmp rsi, qword [rdi + 0x18]
ja 0x1400ab1b2
mov r14, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400ab198
mov r14, qword [rdi]
mov qword [rdi + 0x10], rsi
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_memmove]
mov byte [r14 + rsi], 0
jmp 0x1400ab1c1
mov r9, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14005d2dc
nop
test rbx, rbx
je 0x1400ab205
mov rax, qword [rsp + 0x48]
sub rax, rbx
cmp rax, 0x1000
jb 0x1400ab1fd
test bl, 0x1f
jne 0x1400ab1f6
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x1400ab1f6
sub rbx, rax
sub rbx, 8
cmp rbx, 0x1f
ja 0x1400ab1f6
mov rbx, rax
jmp 0x1400ab1fd
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14027abd8
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1400b06dc
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x60
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x1404106ec], eax
jle 0x1400b0754
lea rcx, [0x1404106ec]
call fcn.1402801b8
cmp dword [0x1404106ec], 0xffffffff
jne 0x1400b0754
lea rdx, str.EventType
lea rcx, [0x1404106c8]
call fcn.14005d3d4
lea rcx, [0x1402afc00]
call fcn.14027ab8c
nop
lea rcx, [0x1404106ec]
call fcn.140280158
lea rcx, [rdi + 0x110]
mov rdx, rbx
call fcn.1400b1b14
mov r9d, 2
mov r8, rbx
lea rdx, [0x1404106c8]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400b0788
Function at 0x1400b9db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
lea rsi, [r8 + 0x10]
mov rdi, r8
cmp qword [rsi + 0x18], 0x10
mov r14, rdx
mov r9, rcx
mov r10, rsi
jb 0x1400b9ddf
mov r10, qword [rsi]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [rsi + 0x10], r8
jbe 0x1400b9e11
movzx eax, byte [r8 + r10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [rsi + 0x10]
jb 0x1400b9df2
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400b9e49
cmp qword [rcx + rdx*8], rdi
jne 0x1400b9e3e
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400b9e42
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400b9e56
cmp qword [rcx + rdx*8], rdi
jne 0x1400b9e56
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.14004c91c
mov rcx, rsi
call fcn.14004c91c
mov rcx, rdi
call fcn.14027abd8
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14016f5e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r10, rdx
mov r14, rcx
mov r11, qword [rdx + 0x10]
mov r8, rdx
cmp qword [rdx + 0x18], 8
jb 0x14016f617
mov r8, qword [rdx]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
lea r9, [r11 + r11]
test r9, r9
je 0x14016f64a
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs rbx, 0x100000001b3
imul rcx, rbx
inc rdx
cmp rdx, r9
jb 0x14016f62c
mov rax, qword [r14 + 0x30]
and rax, rcx
mov rsi, qword [r14 + 0x18]
mov rdi, rax
add rdi, rdi
mov rdi, qword [rsi + rdi*8]
lea rbp, [rax + rax]
mov r15, qword [rsi + rbp*8]
cmp r15, qword [r14 + 8]
jne 0x14016f673
mov rax, qword [r14 + 8]
jmp 0x14016f67b
mov rax, qword [rsi + rbp*8 + 8]
mov rax, qword [rax]
cmp rdi, rax
je 0x14016f760
lea rcx, [rdi + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x14016f695
mov rax, qword [r10]
mov r8, rcx
cmp qword [rcx + 0x18], 8
jb 0x14016f6a2
mov r8, qword [rcx]
mov rdx, qword [rcx + 0x10]
cmp rdx, r11
jne 0x14016f6dd
test rdx, rdx
je 0x14016f6d7
sub r8, rax
movzx ecx, word [rax + r8]
movzx r9d, word [rax]
cmp cx, r9w
jne 0x14016f6ce
add rax, 2
sub rdx, 1
jne 0x14016f6b3
jmp 0x14016f6d7
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14016f6d9
xor eax, eax
test eax, eax
je 0x14016f6e2
mov rdi, qword [rdi]
jmp 0x14016f667
mov rbx, rdi
cmp r15, qword [r14 + 8]
jne 0x14016f6f1
mov rax, qword [r14 + 8]
jmp 0x14016f6f9
mov rax, qword [rsi + rbp*8 + 8]
mov rax, qword [rax]
cmp rdi, rax
je 0x14016f75b
lea rax, [rdi + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x14016f70f
mov rcx, qword [rax]
mov rdx, r10
cmp qword [r10 + 0x18], 8
jb 0x14016f71c
mov rdx, qword [r10]
cmp r11, qword [rax + 0x10]
jne 0x14016f75b
mov r9, r11
test r11, r11
je 0x14016f750
sub rdx, rcx
movzx eax, word [rcx + rdx]
movzx r8d, word [rcx]
cmp ax, r8w
jne 0x14016f747
add rcx, 2
sub r9, 1
jne 0x14016f72d
jmp 0x14016f750
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x14016f752
xor eax, eax
test eax, eax
jne 0x14016f75b
mov rdi, qword [rdi]
jmp 0x14016f6e5
cmp rbx, rdi
jne 0x14016f767
mov rbx, qword [r14 + 8]
mov rdi, rbx
mov rax, rbx
xor ebp, ebp
cmp rbx, rdi
je 0x14016f77c
inc rbp
mov rax, qword [rax]
cmp rax, rdi
jne 0x14016f771
mov rax, qword [r14 + 8]
mov rsi, qword [rax]
cmp rbx, rsi
jne 0x14016f7ec
cmp rdi, rax
jne 0x14016f7ec
mov qword [rax], rax
mov rax, qword [r14 + 8]
mov qword [rax + 8], rax
and qword [r14 + 0x10], 0
cmp rsi, qword [r14 + 8]
je 0x14016f7c9
mov rdi, qword [rsi]
lea rcx, [rsi + 0x30]
call fcn.14016f558
lea rcx, [rsi + 0x10]
call fcn.1400492c0
mov rcx, rsi
call fcn.14027abd8
mov rsi, rdi
cmp rdi, qword [r14 + 8]
jne 0x14016f7a3
mov edx, 8
mov rcx, r14
call fcn.1400515d0
nop
jmp 0x14016f7f1
mov r8, rbx
mov rbx, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.14016fc88
cmp rbx, rdi
jne 0x14016f7d9
mov rax, rbp
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14016fbe4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [r8 + 0x10]
mov r10, rcx
mov qword [rsp + 0x30], rax
mov rbx, rdx
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x30]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 8
jb 0x14016fc05
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r9
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14016fc5c
cmp qword [rcx + rdx*8], r8
jne 0x14016fc51
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14016fc55
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14016fc69
cmp qword [rcx + rdx*8], r8
jne 0x14016fc69
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
lea rdx, [rsp + 0x30]
call fcn.14006e140
mov rcx, qword [rax]
mov rax, rbx
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x14016fc88
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x14016fcbb
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x14016fcea
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x14016fccc
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14016fd22
cmp qword [rcx + rdx*8], rdi
jne 0x14016fd17
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14016fd1b
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14016fd2f
cmp qword [rcx + rdx*8], rdi
jne 0x14016fd2f
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14016f558
mov rcx, rsi
call fcn.1400492c0
mov rcx, rdi
call fcn.14027abd8
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1401703ac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r13, r8
mov r15, rdx
mov r14, rcx
lea rcx, [r8 + 0x40]
mov r10, qword [rcx + 0x10]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x1401703e9
mov r9, qword [rcx]
xor edx, edx
movabs r8, 0xcbf29ce484222325
add r10, r10
je 0x140170418
movzx eax, byte [rdx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rdx
cmp rdx, r10
jb 0x1401703fa
mov rsi, qword [r14 + 0x30]
and rsi, r8
mov rbx, qword [r14 + 8]
add rsi, rsi
mov r11, qword [r14 + 0x18]
cmp qword [r11 + rsi*8], rbx
jne 0x140170435
mov rdi, rbx
jmp 0x1401704ac
mov rdi, qword [r11 + rsi*8 + 8]
mov rdi, qword [rdi]
jmp 0x1401704ac
mov rdi, qword [rdi + 8]
lea rdx, [rdi + 0x50]
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140170454
mov rax, qword [rdx]
mov r9, rcx
cmp qword [rcx + 0x18], 8
jb 0x140170461
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1401704ac
test r8, r8
je 0x140170497
sub r9, rax
movzx edx, word [r9 + rax]
movzx r10d, word [rax]
cmp dx, r10w
jne 0x14017048e
add rax, 2
sub r8, 1
jne 0x140170473
jmp 0x140170497
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140170499
xor eax, eax
test eax, eax
jne 0x1401704ac
mov qword [r15], rdi
mov byte [r15 + 8], al
mov rax, r15
jmp 0x14017059f
cmp rdi, qword [r11 + rsi*8]
jne 0x14017043f
mov rbx, qword [rbx]
mov r9, r13
mov r8, qword [rbx + 8]
mov rdx, rbx
call fcn.140172624
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x249249249249248
sub rcx, rax
cmp rcx, 1
jae 0x1401704ec
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rbx + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rbx, qword [r14 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x70], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x14017053f
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14 + 8]
jne 0x14017055c
mov qword [rdx + rsi*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x14017058b
cmp rax, rdi
jne 0x140170567
mov qword [rdx + rsi*8], rbx
jmp 0x14017058b
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x14017058b
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.140170f58
nop
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret