joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c97f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r11, qword [r10 + 0x30]
and r11, r9
mov rbx, qword [r10 + 8]
mov rdx, r11
add rdx, rdx
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x1400c98fb
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x1400c98fb
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x1400c98b4
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.1402f1e30
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400c9991
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c9930
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r11, 4
mov rdx, qword [r10 + 0x18]
add rdx, r11
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x1400c9952
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r11 + 8], rdi
jmp 0x1400c997e
cmp rax, rbx
jne 0x1400c995c
mov qword [rdx], rdi
jmp 0x1400c997e
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c997e
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r11 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r11 + 8], rcx
mov rcx, r10
call fcn.1400cca50
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400c9b90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r14, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r12, qword [r14 + 0x30]
and r12, r9
mov rdi, qword [r14 + 8]
mov rbx, r12
add rbx, rbx
mov rax, qword [r14 + 0x18]
mov rcx, qword [rax + rbx*8]
cmp rcx, rdi
jne 0x1400c9c51
mov rbx, rdi
jmp 0x1400c9c60
mov rbx, qword [rax + rbx*8 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rcx
je 0x1400c9c81
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x1400c9c60
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x1400c9d6c
mov rdi, qword [rdi]
mov r13, qword [rdi + 8]
mov r9, r8
mov r8, r13
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.1400c9550
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffe
sub rcx, rax
cmp rcx, 1
jb 0x1400c9d84
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c9d0c
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
shl r12, 4
mov rdx, qword [r14 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, rcx
jne 0x1400c9d2d
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x1400c9d59
cmp rax, rbx
jne 0x1400c9d37
mov qword [rdx], rdi
jmp 0x1400c9d59
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c9d59
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r14
call fcn.1400cca50
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14047d550]
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400c9e60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x1400c9f24
cmp rax, r8
jne 0x1400c9f1a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400c9f2f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x1400c9f2f
cmp rax, r8
jne 0x1400c9f2f
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.1402f1e30
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d1820
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov ebp, r9d
mov rcx, qword [rcx + 8]
mov rbx, r8
mov rsi, rdx
cmp qword [r8 + 0x50], rcx
je 0x1400d1855
lea r9, str.Field_does_not_match_message_type.
mov rdx, rbx
lea r8, str.GetRepeatedEnumValue
call fcn.1400d3b80
cmp dword [rbx + 0x3c], 3
je 0x1400d1875
mov rcx, qword [rdi + 8]
lea r9, str.Field_is_singular__the_method_requires_a_repeated_field.
lea r8, str.GetRepeatedEnumValue
mov rdx, rbx
call fcn.1400d3b80
mov rcx, rbx
call fcn.1400cd080
movsxd rcx, eax
lea rax, [0x140481630]
cmp dword [rax + rcx*4], 8
je 0x1400d18a6
mov rcx, qword [rdi + 8]
lea r8, str.GetRepeatedEnumValue
mov r9d, 8
mov rdx, rbx
call fcn.1400d3c70
cmp byte [rbx + 0x42], 0
je 0x1400d18c1
mov ecx, dword [rdi + 0x30]
mov r8d, ebp
mov edx, dword [rbx + 0x44]
add rcx, rsi
call fcn.1400e9400
mov edi, eax
jmp 0x1400d18db
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1400cd1c0
mov rcx, rax
mov edx, ebp
call fcn.1400e4d70
mov edi, dword [rax]
mov rcx, rbx
call fcn.14011e640
mov rcx, rax
mov edx, edi
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x140110050
Function at 0x1400e8d60
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rbp, r8
mov qword [rsp + 0x30], rbx
mov rcx, r9
mov qword [rsp + 0x40], rsi
mov r11, r9
mov qword [rsp + 0x18], rdi
mov rbx, r9
mov rdi, r9
mov qword [rsp + 8], r14
mov r14, qword [0x14068e3b8]
mov r8, r9
mov rsi, r9
shr rdi, 0x18
mov rax, r9
shr rcx, 0x38
shr r11, 0x30
shr rbx, 0x28
shr r8, 0x20
shr rsi, 0x10
shr rax, 8
mov r10d, edx
test r14, r14
je 0x1400e8ec9
movzx eax, al
mov qword [rsp + 0x10], r12
movabs r12, 0x100000001b3
mov qword [rsp], r15
movabs r15, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, r15
imul rdx, r12
xor rdx, rax
movzx eax, sil
imul rdx, r12
xor rdx, rax
movzx eax, dil
imul rdx, r12
xor rdx, rax
movzx eax, r8b
mov r8, qword [r14 + 8]
imul rdx, r12
xor rdx, rax
movzx eax, bl
imul rdx, r12
xor rdx, rax
movzx eax, r11b
imul rdx, r12
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, r12
xor rdx, rcx
movzx ecx, r10b
xor rcx, r15
mov r15, qword [rsp]
imul rcx, r12
imul rdx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3a]
imul rcx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3b]
imul rcx, r12
xor rcx, rax
imul rcx, r12
mov r12, qword [rsp + 0x10]
xor rcx, rdx
mov rdx, qword [r14 + 0x18]
and rcx, qword [r14 + 0x30]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r11, qword [rdx + rcx*8]
lea rdx, [rdx + rcx*8]
cmp r11, r8
jne 0x1400e8e9d
mov rcx, r8
jmp 0x1400e8ea4
mov rcx, qword [rdx + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400e8ec9
cmp qword [rax + 0x10], r9
jne 0x1400e8eb5
cmp dword [rax + 0x18], r10d
je 0x1400e8eba
mov rax, qword [rax]
jmp 0x1400e8e93
cmovne rax, r8
cmp rax, r8
je 0x1400e8ec9
add rax, 0x20
jmp 0x1400e8ecb
xor eax, eax
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x1400e8eea
add rsp, 0x20
pop rbp
ret
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
mov al, 1
movups xmmword [rbp + 0x10], xmm1
add rsp, 0x20
pop rbp
ret
Function at 0x1400f1da0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rdx + 8]
xor r8d, r8d
mov r11, rcx
mov r9, r10
movzx eax, byte [r10]
test al, al
je 0x1400f1de7
nop dword [rax]
nop dword [rax + rax]
movsx rax, al
lea r8, [r8 + r8*4]
add r8, rax
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x1400f1dd0
mov rbx, qword [rdx]
mov rdx, qword [r11 + 0x18]
imul rcx, rbx, 0x1000193
xor rcx, r8
and rcx, qword [r11 + 0x30]
mov r11, qword [r11 + 8]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov rdi, qword [rdx + rcx*8]
lea rsi, [rdx + rcx*8]
cmp rdi, r11
jne 0x1400f1e1f
mov rcx, r11
jmp 0x1400f1e26
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400f1e8c
cmp qword [rax + 0x10], rbx
jne 0x1400f1e5a
mov rcx, qword [rax + 0x18]
mov r9, r10
sub r9, rcx
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400f1e55
inc rcx
test edx, edx
jne 0x1400f1e40
test r8d, r8d
je 0x1400f1e5f
mov rax, qword [rax]
jmp 0x1400f1e15
mov r8, qword [rax + 0x18]
sub r8, r10
nop word [rax + rax]
movzx edx, byte [r10]
movzx ecx, byte [r10 + r8]
sub edx, ecx
jne 0x1400f1e84
inc r10
test ecx, ecx
jne 0x1400f1e70
test edx, edx
cmovne rax, r11
jmp 0x1400f1e8f
mov rax, r11
cmp rax, r11
jne 0x1400f1ea6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rax, qword [rax + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400f3010
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rdx
mov r9, rcx
movsxd rdx, dword [r8 + 8]
mov r10, qword [r8]
imul r8, rdx, 0x1000193
imul rax, r10, 0x100011b
xor r8, rax
and r8, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r11, r8
shl r11, 4
add r11, qword [rcx + 0x18]
mov rax, qword [r11]
cmp rbx, rax
je 0x1400f30b9
mov rbx, qword [r11 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rax
je 0x1400f30b9
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x1400f3070
cmp edx, dword [rbx + 0x18]
jne 0x1400f3070
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x28
mov rcx, rdi
call fcn.1402f1e30
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f314f
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400f30ee
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r8, 4
mov rdx, qword [r9 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r9 + 8]
jne 0x1400f3110
mov qword [rdx], rdi
mov rax, qword [r9 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x1400f313c
cmp rax, rbx
jne 0x1400f311a
mov qword [rdx], rdi
jmp 0x1400f313c
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400f313c
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r9
call fcn.14011d0d0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f3160
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x1400f31b7
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400f31a0
mov r15, qword [r8]
imul r10, r15, 0x1000193
xor r10, r9
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r10, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r10]
cmp rbx, rax
je 0x1400f324e
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400f324e
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x1400f31e5
mov rcx, qword [r14 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400f3215
inc rcx
test edx, edx
jne 0x1400f3200
test r8d, r8d
jne 0x1400f31e5
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea edx, [r8 + 0x28]
mov rcx, rdi
call fcn.1402f1e30
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f32e0
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400f3283
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1400f32a1
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x1400f32cd
cmp rax, rbx
jne 0x1400f32ab
mov qword [rdx], rdi
jmp 0x1400f32cd
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400f32cd
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.14011d170
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f32f0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x1400f3347
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400f3330
mov r15, qword [r8]
imul r10, r15, 0x1000193
xor r10, r9
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r10, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r10]
cmp rbx, rax
je 0x1400f33de
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400f33de
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x1400f3375
mov rcx, qword [r14 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400f33a5
inc rcx
test edx, edx
jne 0x1400f3390
test r8d, r8d
jne 0x1400f3375
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea edx, [r8 + 0x30]
mov rcx, rdi
call fcn.1402f1e30
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f3470
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400f3413
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1400f3431
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x1400f345d
cmp rax, rbx
jne 0x1400f343b
mov qword [rdx], rdi
jmp 0x1400f345d
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400f345d
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.14011d210
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f3480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r12, r8
mov r15, rcx
mov r13, qword [r8 + 0x10]
mov r9, qword [r8 + 0x18]
cmp r9, 0x10
jb 0x1400f34c1
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r13, r13
je 0x1400f34f4
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r13
jb 0x1400f34e0
mov r14, qword [r15 + 0x30]
and r14, rdx
mov rbx, qword [r15 + 8]
add r14, r14
mov rax, qword [r15 + 0x18]
mov rsi, qword [rax + r14*8]
cmp rbx, rsi
je 0x1400f3589
mov rbx, qword [rax + r14*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rsi
je 0x1400f3589
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x1400f352f
mov rdx, qword [rbx + 0x10]
mov rcx, r12
cmp r9, 0x10
jb 0x1400f353c
mov rcx, qword [r12]
cmp r13, qword [rbx + 0x20]
jne 0x1400f3517
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
mov r9, qword [r12 + 0x18]
jne 0x1400f3517
lea rcx, [r15 + 8]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rcx + 8]
mov rdx, rdi
call fcn.14011da60
mov rax, qword [rsp + 0x78]
mov qword [rax], rbx
mov byte [rax + 8], 0
jmp 0x1400f368c
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400f35be
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r14*8]
cmp rax, qword [r15 + 8]
jne 0x1400f35db
mov qword [rdx + r14*8], rdi
mov rax, qword [r15 + 0x18]
mov qword [rax + r14*8 + 8], rdi
jmp 0x1400f360a
cmp rax, rbx
jne 0x1400f35e6
mov qword [rdx + r14*8], rdi
jmp 0x1400f360a
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r14*8 + 8], rcx
cmp rcx, rdi
je 0x1400f360a
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r14*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r14*8 + 8], rcx
mov rax, qword [r15 + 0x10]
mov rdx, qword [r15 + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14047a024]
test rax, rax
jns 0x1400f362b
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400f363c
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [r15]
jbe 0x1400f367c
cmp rdx, 0x200
jae 0x1400f3659
lea rdx, [rdx*8]
jmp 0x1400f366b
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400f366b
add rdx, rdx
mov rcx, r15
call fcn.1400ccb40
mov rcx, r15
call fcn.14011de50
nop
mov r9, qword [rsp + 0x78]
mov qword [r9], rdi
mov byte [r9 + 8], 1
mov rax, r9
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f39c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r11, qword [r10 + 0x30]
and r11, r9
mov rbx, qword [r10 + 8]
mov rdx, r11
add rdx, rdx
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x1400f3acb
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x1400f3acb
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x1400f3a84
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.1402f1e30
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400f3b61
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400f3b00
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r11, 4
mov rdx, qword [r10 + 0x18]
add rdx, r11
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x1400f3b22
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r11 + rax + 8], rdi
jmp 0x1400f3b4e
cmp rax, rbx
jne 0x1400f3b2c
mov qword [rdx], rdi
jmp 0x1400f3b4e
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400f3b4e
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r11 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r11 + 8], rcx
mov rcx, r10
call fcn.14011d2b0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret