joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005dcb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rdi, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 8
jb 0x14005dccd
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005dd25
cmp qword [rcx + rdx*8], r8
jne 0x14005dd1a
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14005dd1e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005dd32
cmp qword [rcx + rdx*8], r8
jne 0x14005dd32
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.1402e0278
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14005ddb8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14005ddf0
mov r8, qword [r9 + 0x30]
and r8, rcx
mov rdi, qword [r9 + 8]
add r8, r8
mov rax, qword [r9 + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x14005de7a
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x14005de7a
mov rcx, qword [r10]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x14005de4a
cmp rdi, qword [rax + r8*8]
jne 0x14005de38
jmp 0x14005de7a
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, rbx
call fcn.1402e0278
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14005df0e
mov rax, qword [rbx]
cmp rdi, rax
je 0x14005deaf
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14005decc
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14005defb
cmp rax, rdi
jne 0x14005ded7
mov qword [rdx + r8*8], rbx
jmp 0x14005defb
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14005defb
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14005dc00
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14005fe58
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x59], r9
mov rsi, rcx
mov qword [rbp - 0x61], rcx
xor r14d, r14d
mov dword [rbp - 0x69], r14d
cmp qword [r8 + 0x10], r14
jne 0x14005feb1
xor r8d, r8d
lea rcx, [rbp - 0x29]
call fcn.140062650
lea rax, [rbp - 0x29]
lea ebx, [r14 + 5]
jmp 0x14005febf
lea rcx, [rbp - 9]
call fcn.14006008c
mov ebx, 2
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x49], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x39], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
test bl, 2
je 0x14005fef0
and ebx, 0xfffffffd
lea rcx, [rbp - 9]
call fcn.14004e0f0
nop
mov edi, 1
test dil, bl
je 0x14005ff03
lea rcx, [rbp - 0x29]
call fcn.14004e0f0
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
movabs rdx, 0xcbf29ce484222325
mov rcx, r14
mov r11, qword [rbp - 0x39]
lea r9, [r11 + r11]
test r9, r9
je 0x14005ff49
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
add rcx, rdi
cmp rcx, r9
jb 0x14005ff2b
mov rcx, qword [rsi + 0x30]
and rcx, rdx
mov r15, qword [rsi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [r15 + rax*8]
add rcx, rcx
mov qword [rbp - 0x69], rcx
mov rdx, qword [rsi + 8]
cmp qword [r15 + rcx*8], rdx
jne 0x14005ff74
mov rcx, rdx
jmp 0x14005ff7c
mov rcx, qword [r15 + rcx*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140060048
lea r8, [rax + 0x10]
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae rcx, qword [rbp - 0x49]
mov r10, r8
mov r14, qword [r8 + 0x18]
cmp r14, 8
jb 0x14005ffa7
mov r10, qword [r8]
mov rsi, qword [r8 + 0x10]
cmp rsi, r11
jne 0x14005ffd9
mov rbx, rsi
test rsi, rsi
je 0x14005ffd3
sub r10, rcx
movzx r8d, word [r10 + rcx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14005ffe2
add rcx, 2
sub rbx, rdi
jne 0x14005ffbb
xor ecx, ecx
test ecx, ecx
je 0x14005ffeb
mov rax, qword [rax]
mov rcx, qword [rbp - 0x69]
jmp 0x14005ff69
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, edi
jmp 0x14005ffd5
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x14005fff8
mov rcx, qword [rcx]
lea r8, [rbp - 0x49]
cmp qword [rbp - 0x31], 8
cmovae r8, qword [rbp - 0x49]
xor r14d, r14d
cmp r11, rsi
jne 0x14006004b
test r11, r11
je 0x14006002e
sub r8, rcx
movzx r9d, word [rcx + r8]
movzx r10d, word [rcx]
cmp r9w, r10w
jne 0x14006003f
add rcx, 2
sub r11, rdi
jne 0x140060016
mov ecx, r14d
test ecx, ecx
jne 0x14006004b
mov rdx, qword [rbp - 0x61]
mov rdx, qword [rdx + 8]
jmp 0x14006004e
sbb ecx, ecx
and ecx, 0xfffffffe
add ecx, edi
jmp 0x140060031
xor r14d, r14d
mov rax, rdx
cmp rax, rdx
je 0x140060060
movzx ecx, word [rax + 0x30]
mov rax, qword [rbp - 0x59]
mov word [rax], cx
jmp 0x140060063
mov dil, r14b
lea rcx, [rbp - 0x49]
call fcn.14004e0f0
mov al, dil
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140061864
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov r9, r8
mov r11, qword [r8 + 0x10]
mov rsi, rdx
mov r15, rcx
mov r10, r8
jb 0x14006189a
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x1400618cd
movzx eax, byte [rcx + r10]
movabs rbx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rbx
cmp rcx, rdx
jb 0x1400618af
mov rcx, qword [r15 + 0x30]
mov r12, qword [r15 + 0x18]
and rcx, r8
mov rbx, qword [r15 + 8]
mov rax, rcx
add rax, rax
lea r13, [rcx + rcx]
mov rax, qword [r12 + rax*8]
cmp qword [r12 + r13*8], rbx
jne 0x1400618f5
mov rcx, rbx
jmp 0x1400618fd
mov rcx, qword [r12 + r13*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400619bf
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x140061917
mov rdx, qword [r9]
mov r14, qword [rcx + 0x18]
mov r8, rcx
cmp r14, 8
jb 0x140061927
mov r8, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x14006195a
mov rdi, rbp
test rbp, rbp
je 0x140061954
sub r8, rdx
movzx ecx, word [r8 + rdx]
movzx r10d, word [rdx]
cmp cx, r10w
jne 0x14006195f
add rdx, 2
sub rdi, 1
jne 0x14006193b
xor ecx, ecx
test ecx, ecx
je 0x140061968
mov rax, qword [rax]
jmp 0x1400618ea
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140061956
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x140061975
mov rcx, qword [rcx]
cmp qword [r9 + 0x18], 8
mov rdx, r9
jb 0x140061982
mov rdx, qword [r9]
cmp r11, rbp
jne 0x1400619ae
test r11, r11
je 0x1400619a8
sub rdx, rcx
movzx r8d, word [rdx + rcx]
movzx r10d, word [rcx]
cmp r8w, r10w
jne 0x1400619b6
add rcx, 2
sub r11, 1
jne 0x14006198f
xor ecx, ecx
test ecx, ecx
je 0x1400619b1
mov rax, rbx
mov rcx, rax
jmp 0x1400619c5
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400619aa
mov rax, rbx
mov rcx, rbx
cmp rcx, rbx
jne 0x140061a39
mov rbx, qword [rbx]
lea rax, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1400622e4
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140061a13
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140062028
jmp 0x140061a40
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140061f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
movabs rcx, 0xcbf29ce484222325
movzx eax, word [rdi + 0x14]
movzx r10d, word [rdi + 0x16]
xor r10, rax
mov eax, dword [rdi + 0x10]
xor r10, rax
xor r9d, r9d
movzx eax, byte [rdi + r9 + 0x20]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x140061f67
mov rax, r10
mov rdx, r10
shr rdx, 2
shl rax, 6
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
mov rcx, qword [r8 + 0x18]
xor rdx, r10
and rdx, qword [r8 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140061fdb
cmp qword [rcx + rdx*8], rdi
jne 0x140061fd0
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140061fd4
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140061fe8
cmp qword [rcx + rdx*8], rdi
jne 0x140061fe8
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x28]
dec qword [r8 + 0x10]
call fcn.14005fb44
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14006233c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x140062369
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x140062398
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14006237a
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400623d0
cmp qword [rcx + rdx*8], rdi
jne 0x1400623c5
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400623c9
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400623dd
cmp qword [rcx + rdx*8], rdi
jne 0x1400623dd
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14004e0f0
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140062d98
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [rdx]
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov rax, qword [rax + 0x50]
call qword [case.0x140245398.0]
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rbx, 0xcbf29ce484222325
cmovae rdx, qword [rsp + 0x20]
xor ecx, ecx
lea r8, [rax + rax]
test r8, r8
je 0x140062e0a
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor rbx, rax
inc rcx
imul rbx, r9
cmp rcx, r8
jb 0x140062ded
lea rcx, [rsp + 0x20]
call fcn.14004e0f0
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0x50
pop rbx
ret
Function at 0x140063830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbp, rcx
movzx esi, word [rdx + 0x28]
mov r15d, 1
xor r14d, r14d
cmp byte [rdx + 0x2b], 0xb
je 0x14006389f
movzx edx, r14w
cmp r14w, word [rdi + 0x54]
jae 0x1400638df
mov rcx, qword [rdi + 0x58]
movzx eax, dx
add rax, rax
cmp word [rcx + rax*8 + 2], 0xb
je 0x14006389f
add dx, r15w
cmp dx, word [rdi + 0x54]
jb 0x140063885
jmp 0x1400638df
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.1400805d4
mov r8d, dword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rdx, rbx
mov rcx, rdi
call fcn.140063a10
mov esi, eax
test rbx, rbx
je 0x1400638df
mov rcx, rbx
call fcn.1402e0244
movups xmm6, xmmword [rdi + 0x18]
lea rdi, [rbp + 0x258]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
movups xmmword [rsp + 0x38], xmm6
mov dword [rsp + 0x48], esi
movq rcx, xmm6
mov r8, rcx
shr r8, 0x30
mov rax, rcx
shr rax, 0x20
movzx eax, ax
xor r8, rax
mov eax, ecx
xor r8, rax
movabs rcx, 0xcbf29ce484222325
mov rdx, r14
movzx eax, byte [rsp + rdx + 0x48]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
add rdx, r15
cmp rdx, 4
jb 0x140063927
mov rax, r8
shl rax, 6
mov rdx, r8
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rdx, rax
add rdx, rcx
xor rdx, r8
and rdx, qword [rbp + 0x2a0]
mov r10, qword [rbp + 0x288]
mov rax, rdx
add rax, rax
mov rax, qword [r10 + rax*8]
lea r11, [rdx + rdx]
mov rdx, qword [rbp + 0x278]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x38]
cmp qword [r10 + r11*8], rdx
jne 0x14006399d
mov rcx, rdx
jmp 0x1400639a5
mov rcx, qword [r10 + r11*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400639d1
cmp qword [rax + 0x10], r9
jne 0x1400639bb
cmp qword [rax + 0x18], r8
jne 0x1400639bb
cmp dword [rax + 0x20], esi
je 0x1400639c0
mov rax, qword [rax]
jmp 0x140063992
cmp r9, qword [rax + 0x10]
jne 0x1400639d1
cmp r8, qword [rax + 0x18]
jne 0x1400639d1
cmp esi, dword [rax + 0x20]
je 0x1400639d4
mov rax, rdx
cmp rax, rdx
setne bl
test rdi, rdi
je 0x1400639e8
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov al, bl
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063a10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r10, rdx
cmp byte [rcx + 0x2b], 0xb
lea esi, [rbx + 1]
je 0x140063a6d
movzx r9d, bx
cmp bx, word [rcx + 0x54]
jae 0x140063a64
mov rdx, qword [rcx + 0x58]
movzx eax, r9w
add rax, rax
cmp word [rdx + rax*8 + 2], 0xb
je 0x140063a6d
add r9w, si
cmp r9w, word [rcx + 0x54]
jb 0x140063a4a
movzx eax, word [rcx + 0x28]
jmp 0x140063afa
cmp dword [r10 + 0x44], ebx
jne 0x140063a78
mov rdx, rbx
jmp 0x140063a8b
mov edx, dword [r10 + 0x44]
mov eax, r8d
lea rcx, [rdx + 2]
cmp rcx, rax
jae 0x140063a73
add rdx, r10
movdqa xmm0, xmmword [0x14038ac40]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], bx
call fcn.14004d5c4
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
mov rax, qword [rsp + 0x30]
movabs rdi, 0xcbf29ce484222325
cmovae rcx, qword [rsp + 0x20]
lea rdx, [rax + rax]
test rdx, rdx
je 0x140063aee
movzx eax, byte [rbx + rcx]
movabs r8, 0x100000001b3
xor rdi, rax
add rbx, rsi
imul rdi, r8
cmp rbx, rdx
jb 0x140063ad1
lea rcx, [rsp + 0x20]
call fcn.14004e0f0
mov eax, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140065924
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x14006595b
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x1400659ef
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x1400659ef
mov rcx, qword [r9]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x1400659b5
cmp rdi, qword [rax + r8*8]
jne 0x1400659a3
jmp 0x1400659ef
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.140062b78
mov rcx, rbx
call fcn.1402e0278
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140065ae8
mov rax, qword [rbx]
cmp rdi, rax
je 0x140065a24
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140065a41
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140065a70
cmp rax, rdi
jne 0x140065a4c
mov qword [rdx + r8*8], rbx
jmp 0x140065a70
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140065a70
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14038ac0c]
test rax, rax
jns 0x140065a91
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140065aa2
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140065add
cmp rdx, 0x200
jae 0x140065aba
shl rdx, 3
jmp 0x140065acc
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140065acc
add rdx, rdx
mov rcx, rsi
call fcn.1400591e0
mov rcx, rsi
call fcn.1400651f0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140065f28
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x140065f5f
mov r14, qword [rsi + 0x30]
and r14, rcx
mov rcx, qword [rsi + 8]
add r14, r14
mov rax, qword [rsi + 0x18]
cmp qword [rax + r14*8], rcx
jne 0x140065f9b
mov rbx, rcx
jmp 0x140065fa3
mov rbx, qword [rax + r14*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + r14*8]
je 0x140065fce
mov rdx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140065fbe
cmp rbx, qword [rax + r14*8]
jne 0x140065fac
jmp 0x140065fce
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140066120
mov rdi, qword [rcx]
mov r12, qword [rdi + 8]
mov r9, r8
mov r8, r12
mov rdx, rdi
call fcn.140066888
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0x12f684bda12f683
sub rcx, rax
cmp rcx, 1
jae 0x14006600b
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [rsi + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r12], rdx
mov rcx, qword [rsi + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14006605f
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x18]
cmp qword [rdx + r14*8], rcx
jne 0x140066078
mov qword [rdx + r14*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x1400660a8
cmp qword [rdx + r14*8], rbx
jne 0x140066084
mov qword [rdx + r14*8], rdi
jmp 0x1400660a8
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x1400660a8
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14038ac0c]
test rax, rax
jns 0x1400660c9
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400660da
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140066115
cmp rdx, 0x200
jae 0x1400660f2
shl rdx, 3
jmp 0x140066104
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140066104
add rdx, rdx
mov rcx, rsi
call fcn.1400591e0
mov rcx, rsi
call fcn.1400651f0
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140066198
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 8
jb 0x1400661bd
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140066215
cmp qword [rcx + rdx*8], rdi
jne 0x14006620a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14006620e
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140066222
cmp qword [rcx + rdx*8], rdi
jne 0x140066222
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140062b78
mov rcx, rdi
call fcn.1402e0278
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret