joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005a6e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, rdx
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x14005a71f
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rcx, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp qword [rax + rsi*8], rcx
jne 0x14005a75b
mov rbx, rcx
jmp 0x14005a763
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + rsi*8]
je 0x14005a78e
mov rdx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14005a77e
cmp rbx, qword [rax + rsi*8]
jne 0x14005a76c
jmp 0x14005a78e
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14005a87c
mov rdi, qword [rcx]
mov r12, qword [rdi + 8]
mov r9, r8
mov r8, r12
mov rdx, rdi
call fcn.14005afe4
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jae 0x14005a7cb
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005a81f
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x14005a838
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x14005a868
cmp qword [rdx + rsi*8], rbx
jne 0x14005a844
mov qword [rdx + rsi*8], rdi
jmp 0x14005a868
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x14005a868
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14005abe0
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14005ac90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x14005acad
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005ad05
cmp qword [rcx + rdx*8], r8
jne 0x14005acfa
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14005acfe
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005ad12
cmp qword [rcx + rdx*8], r8
jne 0x14005ad12
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.1402aed28
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ad98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14005add0
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
add r8, r8
mov rax, qword [r9 + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14005ae5a
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14005ae5a
mov rcx, qword [r10]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x14005ae2a
cmp rdi, qword [rax + r8*8]
jne 0x14005ae18
jmp 0x14005ae5a
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.1402aed28
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14005aeee
mov rax, qword [rbx]
cmp rdi, rax
je 0x14005ae8f
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14005aeac
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14005aedb
cmp rax, rdi
jne 0x14005aeb7
mov qword [rdx + r8*8], rbx
jmp 0x14005aedb
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14005aedb
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14005abe0
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14005cdb8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x59], r9
mov rsi, rcx
mov qword [rbp - 0x61], rcx
xor r14d, r14d
mov dword [rbp - 0x69], r14d
cmp qword [r8 + 0x10], r14
jne 0x14005ce11
xor r8d, r8d
lea rcx, [rbp - 0x29]
call fcn.14005f560
lea rax, [rbp - 0x29]
lea ebx, [r14 + 5]
jmp 0x14005ce1f
lea rcx, [rbp - 9]
call fcn.14005cfec
mov ebx, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
test bl, 2
je 0x14005ce50
and ebx, 0xfffffffd
lea rcx, [rbp - 9]
call fcn.14004b500
nop
mov edi, 1
test dil, bl
je 0x14005ce63
lea rcx, [rbp - 0x29]
call fcn.14004b500
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
movabs rdx, 0xcbf29ce484222325
mov rcx, r14
mov r11, qword [rbp - 0x39]
lea r9, [r11 + r11]
test r9, r9
je 0x14005cea9
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
add rcx, rdi
cmp rcx, r9
jb 0x14005ce8b
mov rcx, qword [rsi + 0x30]
and rcx, rdx
mov r15, qword [rsi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [r15 + rax*8]
add rcx, rcx
mov qword [rbp - 0x69], rcx
mov rdx, qword [rsi + 8]
cmp qword [r15 + rcx*8], rdx
jne 0x14005ced4
mov rcx, rdx
jmp 0x14005cedc
mov rcx, qword [r15 + rcx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14005cfa8
lea r8, [rax + 0x10]
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rcx, qword [rbp - 0x49]
mov r10, r8
mov r14, qword [r8 + 0x18]
cmp r14, 8
jb 0x14005cf07
mov r10, qword [r8]
mov rsi, qword [r8 + 0x10]
cmp rsi, r11
jne 0x14005cf39
mov rbx, rsi
test rsi, rsi
je 0x14005cf33
sub r10, rcx
movzx r8d, word [r10 + rcx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14005cf42
add rcx, 2
sub rbx, rdi
jne 0x14005cf1b
xor ecx, ecx
test ecx, ecx
je 0x14005cf4b
mov rax, qword [rax]
mov rcx, qword [rbp - 0x69]
jmp 0x14005cec9
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, edi
jmp 0x14005cf35
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14005cf58
mov rcx, qword [rcx]
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
xor r14d, r14d
cmp r11, rsi
jne 0x14005cfab
test r11, r11
je 0x14005cf8e
sub r8, rcx
movzx r9d, word [rcx + r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jne 0x14005cf9f
add rcx, 2
sub r11, rdi
jne 0x14005cf76
mov ecx, r14d
test ecx, ecx
jne 0x14005cfab
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + 8]
jmp 0x14005cfae
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, edi
jmp 0x14005cf91
xor r14d, r14d
mov rax, rdx
cmp rax, rdx
je 0x14005cfc0
movzx ecx, word [rax + 0x30]
mov rax, qword [rbp - 0x59]
mov word [rax], cx
jmp 0x14005cfc3
mov dil, r14b
lea rcx, [rbp - 0x49]
call fcn.14004b500
mov al, dil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005e774
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov r9, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r15, rcx
mov r10, r8
jb 0x14005e7aa
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x14005e7dd
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rbx
cmp rcx, rdx
jb 0x14005e7bf
mov rcx, qword [r15 + 0x30]
mov r12, qword [r15 + 0x18]
and rcx, r8
mov rbx, qword [r15 + 8]
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rbx
jne 0x14005e805
mov rcx, rbx
jmp 0x14005e80d
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14005e8cf
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x14005e827
mov rdx, qword [r9]
mov r14, qword [rcx + 0x18]
mov r8, rcx
cmp r14, 8
jb 0x14005e837
mov r8, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x14005e86a
mov rdi, rbp
test rbp, rbp
je 0x14005e864
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jne 0x14005e86f
add rdx, 2
sub rdi, 1
jne 0x14005e84b
xor ecx, ecx
test ecx, ecx
je 0x14005e878
mov rax, qword [rax]
jmp 0x14005e7fa
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14005e866
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14005e885
mov rcx, qword [rcx]
cmp qword [r9 + 0x18], 8
mov rdx, r9
jb 0x14005e892
mov rdx, qword [r9]
cmp r11, rbp
jne 0x14005e8be
test r11, r11
je 0x14005e8b8
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r10d, word [rcx]
cmp r8w, r10w
jne 0x14005e8c6
add rcx, 2
sub r11, 1
jne 0x14005e89f
xor ecx, ecx
test ecx, ecx
je 0x14005e8c1
mov rax, rbx
mov rcx, rax
jmp 0x14005e8d5
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14005e8ba
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x14005e949
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.14005f1f4
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14005e923
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14005ef38
jmp 0x14005e950
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005ee40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
movabs rcx, 0xcbf29ce484222325
movzx eax, word [rdi + 0x14]
movzx r10d, word [rdi + 0x16]
xor r10, rax
mov eax, dword [rdi + 0x10]
xor r10, rax
xor r9d, r9d
movzx eax, byte [rdi + r9 + 0x20]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x14005ee77
mov rax, r10
mov rdx, r10
shr rdx, 2
shl rax, 6
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
mov rcx, qword [r8 + 0x18]
xor rdx, r10
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14005eeeb
cmp qword [rcx + rdx*8], rdi
jne 0x14005eee0
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14005eee4
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005eef8
cmp qword [rcx + rdx*8], rdi
jne 0x14005eef8
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x28]
dec qword [r8 + 0x10]
call fcn.14005caa4
mov rcx, rdi
call fcn.1402aed28
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f24c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14005f279
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14005f2a8
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14005f28a
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14005f2e0
cmp qword [rcx + rdx*8], rdi
jne 0x14005f2d5
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14005f2d9
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005f2ed
cmp qword [rcx + rdx*8], rdi
jne 0x14005f2ed
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14004b500
mov rcx, rdi
call fcn.1402aed28
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005fca8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rdx]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [str.PM_]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
cmovae rdx, qword [rsp + 0x20]
xor ecx, ecx
lea r8, [rax + rax]
test r8, r8
je 0x14005fd1a
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor rbx, rax
inc rcx
imul rbx, r9
cmp rcx, r8
jb 0x14005fcfd
lea rcx, [rsp + 0x20]
call fcn.14004b500
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0x50
pop rbx
ret
Function at 0x1400606f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbp, rcx
movzx esi, word [rdx + 0x28]
mov r15d, 1
xor r14d, r14d
cmp byte [rdx + 0x2b], 0xb
je 0x14006075f
movzx edx, r14w
cmp r14w, word [rdi + 0x54]
jae 0x14006079f
mov rcx, qword [rdi + 0x58]
movzx eax, dx
add rax, rax
cmp word [rcx + rax*8 + 2], 0xb
je 0x14006075f
add dx, r15w
cmp dx, word [rdi + 0x54]
jb 0x140060745
jmp 0x14006079f
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14007cd44
mov r8d, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rdi
call fcn.1400608d0
mov esi, eax
test rbx, rbx
je 0x14006079f
mov rcx, rbx
call fcn.1402aecf4
movups xmm6, xmmword [rdi + 0x18]
lea rdi, [rbp + 0x258]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x48], esi
movq rcx, xmm6
mov r8, rcx
shr r8, 0x30
mov rax, rcx
shr rax, 0x20
movzx eax, ax
xor r8, rax
mov eax, ecx
xor r8, rax
movabs rcx, 0xcbf29ce484222325
mov rdx, r14
movzx eax, byte [rsp + rdx + 0x48]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
add rdx, r15
cmp rdx, 4
jb 0x1400607e7
mov rax, r8
shl rax, 6
mov rdx, r8
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
xor rdx, r8
and rdx, qword [rbp + 0x2a0]
mov r10, qword [rbp + 0x288]
mov rax, rdx
add rax, rax
mov rax, qword [r10 + rax*8]
lea r11, [rdx + rdx]
mov rdx, qword [rbp + 0x278]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp qword [r10 + r11*8], rdx
jne 0x14006085d
mov rcx, rdx
jmp 0x140060865
mov rcx, qword [r10 + r11*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140060891
cmp qword [rax + 0x10], r9
jne 0x14006087b
cmp qword [rax + 0x18], r8
jne 0x14006087b
cmp dword [rax + 0x20], esi
je 0x140060880
mov rax, qword [rax]
jmp 0x140060852
cmp r9, qword [rax + 0x10]
jne 0x140060891
cmp r8, qword [rax + 0x18]
jne 0x140060891
cmp esi, dword [rax + 0x20]
je 0x140060894
mov rax, rdx
cmp rax, rdx
setne bl
test rdi, rdi
je 0x1400608a8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400608d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r10, rdx
cmp byte [rcx + 0x2b], 0xb
lea esi, [rbx + 1]
je 0x14006092a
movzx r9d, bx
cmp bx, word [rcx + 0x54]
jae 0x140060924
mov rdx, qword [rcx + 0x58]
movzx eax, r9w
add rax, rax
cmp word [rdx + rax*8 + 2], 0xb
je 0x14006092a
add r9w, si
cmp r9w, word [rcx + 0x54]
jb 0x14006090a
movzx eax, word [rcx + 0x28]
jmp 0x1400609a4
cmp dword [r10 + 0x44], ebx
jne 0x140060935
mov rdx, rbx
jmp 0x140060948
mov edx, dword [r10 + 0x44]
mov eax, r8d
lea rcx, [rdx + 2]
cmp rcx, rax
jae 0x140060930
add rdx, r10
lea rcx, [rsp + 0x20]
call fcn.14004a9e4
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rdi, 0xcbf29ce484222325
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rax + rax]
test rdx, rdx
je 0x140060998
movzx eax, byte [rbx + rcx]
movabs r8, 0x100000001b3
xor rdi, rax
add rbx, rsi
imul rdi, r8
cmp rbx, rdx
jb 0x14006097b
lea rcx, [rsp + 0x20]
call fcn.14004b500
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140062744
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14006277b
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14006280f
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14006280f
mov rcx, qword [r9]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x1400627d5
cmp rdi, qword [rax + r8*8]
jne 0x1400627c3
jmp 0x14006280f
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.14005fa88
mov rcx, rbx
call fcn.1402aed28
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140062908
mov rax, qword [rbx]
cmp rdi, rax
je 0x140062844
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140062861
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140062890
cmp rax, rdi
jne 0x14006286c
mov qword [rdx + r8*8], rbx
jmp 0x140062890
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140062890
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14034f96c]
test rax, rax
jns 0x1400628b1
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400628c2
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400628fd
cmp rdx, 0x200
jae 0x1400628da
shl rdx, 3
jmp 0x1400628ec
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400628ec
add rdx, rdx
mov rcx, rsi
call fcn.140056470
mov rcx, rsi
call fcn.140062010
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret