joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007d00
Capabilities:
Query service status
Stop service

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x1f8
mov qword [rsp + 0x1d0], 0xfffffffffffffffe
mov byte [rsp + 0x28], 1
mov rax, qword [rsp + 0x208]
cmp qword [rax + 0x20], 0x10
jb 0x140007d4c
mov rax, qword [rsp + 0x208]
mov rax, qword [rax + 8]
mov qword [rsp + 0x1d8], rax
jmp 0x140007d60
mov rax, qword [rsp + 0x208]
add rax, 8
mov qword [rsp + 0x1d8], rax
mov r8d, 0xf01ff
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0x200]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140007d90
xor al, al
jmp 0x140007f64
mov r8, qword [rsp + 0x208]
lea rdx, str.__stopping_service:
lea rcx, [rsp + 0x58]
call fcn.14000d8b0
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x1e8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x58]
call fcn.140009910
mov dword [rsp + 0x50], 0
jmp 0x140007df3
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x210]
cmp dword [rsp + 0x50], eax
jae 0x140007f55
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140007e22
mov byte [rsp + 0x28], 0
jmp 0x140007f55
cmp dword [rsp + 0x34], 1
je 0x140007e55
cmp dword [rsp + 0x50], 0
jne 0x140007e53
lea r8, [rsp + 0x30]
mov edx, 1
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x140007e53
mov byte [rsp + 0x28], 0
jmp 0x140007f55
jmp 0x140007ed2
lea rax, [rsp + 0xf1]
mov qword [rsp + 0xf8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140009910
lea rcx, str.__stopped
call fcn.140015f90
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x128]
lea rdx, str.__stopped
lea rcx, [rsp + 0x80]
call fcn.14000a940
nop
lea rcx, [rsp + 0x80]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x80]
call fcn.140009910
mov byte [rsp + 0x28], 1
jmp 0x140007f55
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x151]
mov qword [rsp + 0x158], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.140009910
lea rcx, [0x1400259f0]
call fcn.140015f90
mov qword [rsp + 0x188], rax
mov r8, qword [rsp + 0x188]
lea rdx, [0x1400259f0]
lea rcx, [rsp + 0xa8]
call fcn.14000a940
nop
lea rcx, [rsp + 0xa8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xa8]
call fcn.140009910
jmp 0x140007de8
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, byte [rsp + 0x28]
add rsp, 0x1f8
ret
Function at 0x1400109a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x1d8
mov qword [rsp + 0x1c0], 0xfffffffffffffffe
mov rcx, qword [rsp + 0x1e0]
call fcn.14000f530
nop
mov rcx, qword [rsp + 0x1e0]
lea rax, vtable.DiasInstall::FirewallPecker_FWAS.0
mov qword [rcx], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0x1e0]
add rax, 8
mov qword [rsp + 0x20], rax
lea r9, [0x140026c00]
mov r8d, 1
xor edx, edx
lea rcx, [0x140026bf0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jge 0x140010b20
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x100], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xa8]
call fcn.140009910
lea rcx, str.FirewallPcker_FWAS::FirewallPcker_FWAS__
call fcn.140015f90
mov qword [rsp + 0x128], rax
mov r8, qword [rsp + 0x128]
lea rdx, str.FirewallPcker_FWAS::FirewallPcker_FWAS__
lea rcx, [rsp + 0xa8]
call fcn.14000a940
nop
lea rax, [rsp + 0x130]
mov qword [rsp + 0x138], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.140009910
lea rcx, str.CoCreateInstance___fail
call fcn.140015f90
mov qword [rsp + 0x160], rax
mov r8, qword [rsp + 0x160]
lea rdx, str.CoCreateInstance___fail
lea rcx, [rsp + 0xd0]
call fcn.14000a940
nop
mov r9d, dword [rsp + 0x30]
lea r8, [rsp + 0xa8]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x38]
call fcn.14000ed60
lea rdx, [0x14002c780]
lea rcx, [rsp + 0x38]
call fcn.1400170f8
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd0]
call fcn.140009910
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xa8]
call fcn.140009910
nop
mov rax, qword [rsp + 0x1e0]
add rsp, 0x1d8
ret
Function at 0x140017974
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x1400179fd
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400179bf
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a0d
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x1400179d5
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a0d
cmp dword [rax + 0x84], 0xe
ja 0x1400179e9
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a0d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x140017a0d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.14001c3d0
test eax, eax
jne 0x140017a3d
cmp dword [0x14003fbb8], 1
jne 0x140017a29
call fcn.14001b6d0
mov ecx, 0x1c
call fcn.14001b4a8
mov ecx, 0xff
call fcn.14001b06c
call fcn.140018284
test eax, eax
jne 0x140017a68
cmp dword [0x14003fbb8], 1
jne 0x140017a54
call fcn.14001b6d0
mov ecx, 0x10
call fcn.14001b4a8
mov ecx, 0xff
call fcn.14001b06c
call fcn.14001c360
nop
call fcn.14001c070
test eax, eax
jns 0x140017a81
mov ecx, 0x1b
call fcn.14001b000
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140040c70], rax
call fcn.14001bebc
mov qword [0x14003fba8], rax
call fcn.14001bdc4
test eax, eax
jns 0x140017aad
mov ecx, 8
call fcn.14001b000
call fcn.14001bac4
test eax, eax
jns 0x140017ac0
mov ecx, 9
call fcn.14001b000
mov ecx, 1
call fcn.14001b10c
test eax, eax
je 0x140017ad5
mov ecx, eax
call fcn.14001b000
call fcn.14001ba48
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call section..text
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140017b0c
mov ecx, eax
call fcn.14001b348
call fcn.14001b360
jmp 0x140017b2d
mov eax, edi
jmp 0x140017b36
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400d0000
add rsp, 0x28
jmp 0x140017974
Function at 0x140019d43
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002e260]
jne 0x14001675a
rol rcx, 0x10
test cx, 0xffff
jne 0x140016756
repz ret
ror rcx, 0x10
jmp 0x140019c9c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14003fc70]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov r11, qword [0x14003fd68]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140019d21
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14003fc70]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140019d43
mov rax, qword [rsp + 0x88]
mov qword [0x14003fd68], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14003fd08], rax
mov rax, qword [0x14003fd68]
mov qword [0x14003fbe0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14003fcf0], rax
mov dword [0x14003fbd0], 0xc0000409
mov dword [0x14003fbd4], 1
mov rax, qword [0x14002e260]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002e268]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14003fc68], eax
mov ecx, 1
call fcn.14001ad88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140027148]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14003fc68], 0
jne 0x140019dca
mov ecx, 1
call fcn.14001ad88
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14001b348
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], r8d
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12d, r8d
mov ebx, edx
mov r15d, ecx
mov ecx, 8
call fcn.14001d4e8
nop
cmp dword [0x1400401f8], 1
je 0x14001b2f4
mov dword [0x1400401f4], 1
mov byte [0x1400401f0], r12b
test ebx, ebx
jne 0x14001b2e0
mov rcx, qword [0x140040c50]
call sub.KERNEL32.dll_DecodePointer
mov rsi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14001b2cd
mov rcx, qword [0x140040c48]
call sub.KERNEL32.dll_DecodePointer
mov rdi, rax
mov qword [rsp + 0x20], rax
mov r14, rsi
mov qword [rsp + 0x28], rsi
mov r13, rax
mov qword [rsp + 0x38], rax
sub rdi, 8
mov qword [rsp + 0x20], rdi
cmp rdi, rsi
jb 0x14001b26c
call fcn.140017fb4
cmp qword [rdi], rax
jne 0x14001b26c
jmp 0x14001b252
cmp rdi, rsi
jb 0x14001b2cd
mov rcx, qword [rdi]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
call fcn.140017fb4
mov qword [rdi], rax
call rbx
mov rcx, qword [0x140040c50]
call sub.KERNEL32.dll_DecodePointer
mov rbx, rax
mov rcx, qword [0x140040c48]
call sub.KERNEL32.dll_DecodePointer
cmp r14, rbx
jne 0x14001b2ab
cmp r13, rax
je 0x14001b2cb
mov r14, rbx
mov qword [rsp + 0x28], rbx
mov rsi, rbx
mov qword [rsp + 0x30], rbx
mov r13, rax
mov qword [rsp + 0x38], rax
mov rdi, rax
mov qword [rsp + 0x20], rax
jmp 0x14001b252
lea rdx, [0x1400253b0]
lea rcx, [0x1400253a8]
call fcn.14001b09c
lea rdx, [0x1400253c0]
lea rcx, [0x1400253b8]
call fcn.14001b09c
nop
test r12d, r12d
je 0x14001b303
mov ecx, 8
call fcn.14001d3e8
test r12d, r12d
jne 0x14001b32e
mov dword [0x1400401f8], 1
lea ecx, [r12 + 8]
call fcn.14001d3e8
mov ecx, r15d
call fcn.14001b030
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001b1bc

Function at 0x14001b354
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
lea edx, [r8 + 1]
jmp 0x14001b1bc
Function at 0x14001e94c
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
mov ebp, r8d
mov r13, rdx
mov r14, rcx
call fcn.140017fb4
xor ebx, ebx
mov rdi, rax
cmp qword [0x140040938], rbx
jne 0x14001ea52
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x14001eb27
lea rdx, [0x140028ba0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14001eb27
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x140040938], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140040940], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
lea rdx, str.GetUserObjectInformationA
mov rcx, rsi
mov qword [0x140040948], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov r11, rax
mov qword [0x140040958], rax
test rax, rax
je 0x14001ea49
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call sub.KERNEL32.dll_EncodePointer
mov qword [0x140040950], rax
jmp 0x14001ea59
mov rax, qword [0x140040950]
jmp 0x14001ea60
mov rax, qword [0x140040950]
mov r11, qword [0x140040958]
cmp rax, rdi
je 0x14001eac8
cmp r11, rdi
je 0x14001eac8
mov rcx, rax
call sub.KERNEL32.dll_DecodePointer
mov rcx, qword [0x140040958]
mov rsi, rax
call sub.KERNEL32.dll_DecodePointer
mov r12, rax
test rsi, rsi
je 0x14001eac8
test rax, rax
je 0x14001eac8
call rsi
test rax, rax
je 0x14001eac2
lea rcx, [rsp + 0x88]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14001eac2
test byte [rsp + 0x38], 1
jne 0x14001eac8
bts ebp, 0x15
jmp 0x14001eb06
mov rcx, qword [0x140040940]
cmp rcx, rdi
je 0x14001eb06
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001eb06
call rax
mov rbx, rax
test rax, rax
je 0x14001eb06
mov rcx, qword [0x140040948]
cmp rcx, rdi
je 0x14001eb06
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001eb06
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x140040938]
call sub.KERNEL32.dll_DecodePointer
test rax, rax
je 0x14001eb27
mov r9d, ebp
mov r8, r13
mov rdx, r14
mov rcx, rbx
call rax
jmp 0x14001eb29
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140003ae0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.140255e30
sub rsp, rax
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x140003b1d
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140255050
add rsp, 0x18
ret
mov r8, qword [r8]
xor edx, edx
mov qword [rsp], r8
movzx eax, byte [rsp + 1]
movzx ecx, r8b
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
mov eax, ecx
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140003bb4
cmp qword [rax + 8], r8
je 0x140003bb4
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140003ba3
test r10, r10
je 0x140003bbc
mov dword [r10], ecx
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.140255050
add rsp, 0x18
ret
Function at 0x140004060
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x420
call fcn.140255e30
sub rsp, rax
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x3c0
call fcn.140257fe0
xor eax, eax
xor edx, edx
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], rax
mov qword [rsp + 0x400], rax
mov qword [rsp + 0x408], rax
lea r8, [0x14029efb0]
nop dword [rax]
movzx ecx, byte [rdx + r8]
inc rdx
movzx eax, cl
xor cl, 0x5c
xor al, 0x36
mov byte [rsp + rdx + 0x3df], cl
mov byte [rsp + rdx + 0x1f], al
cmp rdx, 0x10
jb 0x1400040e0
lea rdx, [0x140004690]
lea rcx, [0x14039b508]
call fcn.14000cbc0
mov rax, qword [0x14039b4f8]
mov dword [rsp + 0x34], 0x2b0c
mov ecx, dword [rax + 0x60]
mov dword [rsp + 0x30], ecx
call fcn.14000cc20
mov dword [rsp + 0x38], eax
call fcn.14000ca60
lea rdx, [0x140004690]
lea rcx, [0x14039b508]
mov dword [rsp + 0x3c], eax
call fcn.14000cbc0
mov rax, qword [0x14039b4f8]
mov qword [rsp + 0x48], rbx
mov rcx, qword [rax + 0x38]
xor ebx, ebx
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x40], rcx
nop dword [rax + rax]
lea rdx, [0x140004690]
lea rcx, [0x14039b508]
call fcn.14000cbc0
mov rax, qword [0x14039b4f8]
mov rcx, qword [rax + 0x28]
movsxd rax, dword [rcx]
cmp rbx, rax
jae 0x14000422a
lea rdx, [0x140004690]
lea rcx, [0x14039b508]
call fcn.14000cbc0
mov rax, qword [0x14039b4f8]
xor edx, edx
mov r9, qword [rax + 0x28]
movsxd r8, dword [r9]
test r8, r8
jle 0x1400041d9
lea rax, [r9 + 8]
mov rcx, qword [rax]
cmp dword [rcx], ebx
je 0x1400041e3
inc rdx
add rax, 8
cmp rdx, r8
jl 0x1400041c6
mov eax, 0x65
jmp 0x14000428e
mov rcx, qword [r9 + rdx*8 + 8]
inc rbx
add rdi, 0x1c
mov rax, qword [rcx + 0x148]
mov qword [rdi - 0x2c], rax
mov rax, qword [rcx + 0x150]
mov qword [rdi - 0x24], rax
mov eax, dword [rcx + 0x298]
mov dword [rdi - 0x1c], eax
mov eax, dword [rcx + 0x290]
mov dword [rdi - 0x18], eax
mov eax, dword [rcx + 0x294]
mov dword [rdi - 0x14], eax
cmp rbx, 0x20
jb 0x140004170
movabs rcx, 0xb3b3b3b3b3b3b3b3
lea rdx, [rsp + 0x20]
mov r8d, 0x3c0
mov qword [rsp + 0x3d0], rcx
mov qword [rsp + 0x3d8], rcx
lea rcx, [rsp + 0x3f0]
call fcn.1400043c0
movabs rcx, 0x2020202020202020
lea rdx, [rsp + 0x3e0]
mov qword [rsp + 0x3f0], rcx
mov qword [rsp + 0x3f8], rcx
mov r8d, 0x30
mov rcx, rsi
call fcn.1400043c0
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.140255050
lea r11, [rsp + 0x420]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400042c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x50
call fcn.140255e30
sub rsp, rax
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ecx, ecx
call fcn.140266cb4
lea rdx, [0x14029eea0]
lea rcx, [rsp + 0x20]
mov rbx, rax
call qword [0x14039c200]
test eax, eax
jne 0x14000432c
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140004060
test eax, eax
jne 0x1400043a6
mov rax, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
mov rdx, rbx
mov ecx, 0x2b0c
call qword [rax + 8]
test eax, eax
je 0x140004346
mov ecx, eax
call fcn.1400036f0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140255050
add rsp, 0x50
pop rbx
ret
xor r8b, r8b
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rsp + rax + 0x3b]
movzx ecx, byte [rsp + rax + 0x3a]
add rax, 4
xor cl, byte [rsp + rax + 0x26]
xor dl, byte [rsp + rax + 0x27]
or dl, cl
movzx ecx, byte [rsp + rax + 0x35]
xor cl, byte [rsp + rax + 0x25]
or dl, cl
movzx ecx, byte [rsp + rax + 0x24]
xor cl, byte [rsp + rax + 0x34]
or dl, cl
or r8b, dl
cmp rax, 0x10
jb 0x140004350
test r8b, r8b
je 0x1400043a4
mov eax, 0x67
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140255050
add rsp, 0x50
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140255050
add rsp, 0x50
pop rbx
ret
Function at 0x1400043c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x78
call fcn.140255e30
sub rsp, rax
mov rax, qword [0x140391620]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov r10, r8
mov r9, rdx
mov r11, rcx
cmp rax, 0x10
jae 0x1400045b4
mov byte [rsp + rax + 0x50], 0
inc rax
cmp rax, 0x10
jb 0x1400043f1
xor r8b, r8b
xor edx, edx
mov qword [rsp + 0x70], rbx
lea rbx, str._.C
test r10, r10
je 0x140004444
nop word [rax + rax]
movzx ecx, byte [rdx + r9]
movzx eax, r8b
xor rcx, rax
mov rax, rdx
inc rdx
movzx r8d, byte [rcx + rbx]
and eax, 0xf
mov byte [rsp + rax + 0x50], r8b
cmp rdx, r10
jb 0x140004420
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
test r10, r10
je 0x14000452a
lea rax, [rsp + 0x30]
sub r9, rax
add r9, 2
dec r10
shr r10, 4
inc r10
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
add rdx, r8
add r8, 4
movzx ecx, byte [rdx + r9 - 2]
movzx eax, byte [rdx - 0x10]
xor al, cl
mov byte [rdx], cl
movzx ecx, byte [rdx + r9 - 1]
mov byte [rdx + 0x10], al
movzx eax, byte [rdx - 0xf]
mov byte [rdx + 1], cl
xor al, cl
movzx ecx, byte [rdx + r9]
mov byte [rdx + 0x11], al
movzx eax, byte [rdx - 0xe]
mov byte [rdx + 2], cl
xor al, cl
movzx ecx, byte [rdx + r9 + 1]
mov byte [rdx + 0x12], al
movzx eax, byte [rdx - 0xd]
mov byte [rdx + 3], cl
xor al, cl
mov byte [rdx + 0x13], al
cmp r8, 0x10
jb 0x140004493
xor ecx, ecx
xor r8d, r8d
xor eax, eax
movzx edx, byte [rcx + rbx]
movzx ecx, byte [rsp + rax + 0x20]
inc rax
xor edx, ecx
mov byte [rsp + rax + 0x1f], dl
movzx ecx, dl
cmp rax, 0x2f
jb 0x1400044f2
lea rax, [rcx + r8]
inc r8
movzx ecx, al
cmp r8, 0x11
jb 0x1400044f0
add r9, 0x10
dec r10
jne 0x140004490
xor edx, edx
nop dword [rax]
movzx ecx, byte [rsp + rdx + 0x50]
movzx eax, byte [rsp + rdx + 0x20]
inc rdx
xor al, cl
mov byte [rsp + rdx + 0x2f], cl
mov byte [rsp + rdx + 0x3f], al
cmp rdx, 0x10
jb 0x140004530
xor eax, eax
xor r8d, r8d
nop word [rax + rax]
xor edx, edx
movzx ecx, byte [rax + rbx]
movzx eax, byte [rsp + rdx + 0x20]
inc rdx
xor ecx, eax
mov byte [rsp + rdx + 0x1f], cl
movzx eax, cl
cmp rdx, 0x2f
jb 0x140004562
add rax, r8
inc r8
movzx eax, al
cmp r8, 0x11
jb 0x140004560
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
mov qword [r11], rax
mov rax, qword [rsp + 0x28]
mov qword [r11 + 8], rax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140255050
add rsp, 0x78
ret
call fcn.1402551e8
int3
Function at 0x14000a9a0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, 0x40
call fcn.140255e30
sub rsp, rax
mov rsi, qword [rdx]
lea r14, [rcx + 0x60]
mov rbx, rdx
mov edx, dword [r14]
mov rdi, rcx
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x20]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
call fcn.140003ae0
test rax, rax
je 0x14000aa23
mov rax, qword [rax]
test rax, rax
je 0x14000aa23
mov rax, qword [rax + 0x10]
cmp byte [rax + 4], 0
je 0x14000aa11
cmp byte [rbx + 0x1c], 0
je 0x14000aa11
mov edx, 1
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov byte [rax + 4], dl
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov edx, dword [rdi + 0xe8]
mov rcx, qword [rdi + 0xf8]
lea r8, [rsp + 0x28]
xor r9d, r9d
call fcn.140003ae0
test rax, rax
je 0x14000aa45
mov rax, qword [rax]
mov rdi, qword [rax + 0x10]
mov r8, qword [rbx + 8]
lea rcx, [rsp + 0x38]
mov rdx, qword [rdi + 8]
call qword [0x14039bd68]
cmp eax, 0x1f4
je 0x14000abbe
test eax, eax
je 0x14000aa7d
mov ecx, eax
call fcn.1400036f0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x18
call fcn.14000cad0
test rax, rax
je 0x14000abcb
mov edx, dword [rbx + 0x18]
mov r9, qword [rsp + 0x38]
movzx r8d, byte [rbx + 0x1c]
mov dword [rax], edx
lea rdx, [rsp + 0x28]
mov rcx, r14
mov byte [rax + 4], r8b
mov qword [rax + 8], rsi
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rax
call fcn.14000b400
mov ecx, dword [rdi + 0x60]
test ecx, ecx
jne 0x14000aae0
lea edx, [rcx + 1]
lea rcx, [rdi + 0x60]
call fcn.14000bb70
mov ecx, dword [rdi + 0x60]
test ecx, ecx
je 0x14000abcb
mov r8, qword [rdi + 0x70]
test ecx, ecx
jne 0x14000aaf3
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
jmp 0x14000ab82
movzx eax, byte [rsp + 0x21]
movzx ebp, sil
xor edx, edx
xor ebp, 0x811c9dc5
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x22]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x23]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x24]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x25]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x26]
imul ebp, ebp, 0x1000193
xor ebp, eax
movzx eax, byte [rsp + 0x27]
imul ebp, ebp, 0x1000193
xor ebp, eax
imul ebp, ebp, 0x1000193
mov eax, ebp
div ecx
mov rax, qword [r8 + rdx*8]
lea rbx, [r8 + rdx*8]
test rax, rax
je 0x14000ab82
cmp qword [rax + 8], rsi
je 0x14000ab82
mov rbx, rax
mov rax, qword [rax]
test rax, rax
jne 0x14000ab71
cmp qword [rbx], 0
jne 0x14000abbe
mov ecx, 0x18
call fcn.14000cad0
test rax, rax
je 0x14000aba5
mov qword [rax], 0
mov qword [rax + 8], rsi
mov dword [rax + 0x10], ebp
mov qword [rbx], rax
test rax, rax
je 0x14000abcb
inc qword [rdi + 0x68]
mov rdx, qword [rdi + 0x68]
lea rcx, [rdi + 0x60]
call fcn.14000bb70
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 2
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret