joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032810
Capabilities:
Reference sql statements

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor r14d, r14d
xor eax, eax
xorps xmm0, xmm0
mov rbp, r8
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov rdi, rcx
mov qword [rcx + 0x18], rdx
lea rax, vtable.SqliteStatement.0
mov qword [rcx + 0x30], rdx
lea r8d, [r14 + 6]
lea rdx, str.SELECT_FILES.FILE_ID__SEGMENTS_SLOW.CLUSTERS__SEGMENTS_FAST.CLUSTERS_FROM_FILES_LEFT_JOIN_SEGMENTS_AS_SEGMENTS_SLOW_ON_FILES.FILE_ID__SEGMENTS_SLOW.FILE_ID_AND_SEGMENTS_SLOW.SEGMENT_ID__0__LEFT_JOIN_SEGMENTS_AS_SEGMENTS_FAST_ON_FILES.FILE_ID__SEGMENTS_FAST.FILE_ID_AND_SEGMENTS_FAST.SEGMENT_ID__1__WHERE_FILES.FILE_STATE__1_AND_FILES.FILE_ID____file_id_ORDER_BY_FILES.FILE_ID_LIMIT__maxfiles
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x38], rdx
mov esi, r9d
mov dword [rcx + 0x28], r14d
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], r14
mov byte [rcx + 0x50], r14b
lea rcx, [0x14029b200]
call fcn.1400e3d50
test eax, eax
jne 0x140032888
mov byte [rdi + 0x50], 1
mov r8, rbp
mov dword [rdi + 0x58], r14d
mov edx, 1
lea rcx, [rdi + 0x20]
call fcn.14002ab40
test eax, eax
jne 0x1400328b0
mov r8d, esi
lea edx, [rax + 2]
lea rcx, [rdi + 0x20]
call fcn.140032140
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400339a0
Capabilities:
Check if file exists
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x1400339b9
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140033a73
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 2
jne 0x140033a2b
xor edi, edi
mov rcx, qword [0x1402eb3e0]
lea rax, [0x1402eb3e0]
cmp rcx, rax
je 0x140033a73
test dword [rcx + 0x44], 0x100
je 0x140033a73
cmp byte [rcx + 0x41], 4
jb 0x140033a73
cmp qword [rbx + 0x18], 8
jb 0x140033a06
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x1402a0178]
mov edx, 0xa
mov r9, rbx
call fcn.140033550
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x1402eb3e0]
lea rax, [0x1402eb3e0]
cmp rcx, rax
je 0x140033a73
test dword [rcx + 0x44], 0x100
je 0x140033a73
cmp byte [rcx + 0x41], 2
jb 0x140033a73
cmp qword [rbx + 0x18], 8
jb 0x140033a57
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x38]
lea r8, [0x1402a0178]
mov edx, VariantTimeToDosDateTime
mov dword [rsp + 0x20], edi
mov r9, rbx
call fcn.1400335c0
mov rbx, qword [rsp + 0x40]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x14005a0f0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
cmp rax, qword [rcx + 0x18]
jae 0x14005a110
inc rax
mov qword [rcx + 0x20], rax
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x38], 0
jne 0x14005a15c
mov rax, qword [rcx + 0x28]
mov edx, 1
add qword [rcx + 0x30], rax
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
call fcn.140251ba0
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x14005a15c
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
add rsp, 0x20
pop rbx
ret
Function at 0x140066420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edi, dl
mov rcx, qword [rcx + 0x18]
inc rdi
movabs rax, 0x84222325cbf29ce4
xor rdi, rax
movabs rax, 0x100000001b3
imul rdi, rax
lea rax, [rcx + 8]
cmp rax, qword [rbx + 0x20]
jbe 0x140066468
mov rcx, rbx
call fcn.140071f90
mov rcx, qword [rbx + 0x18]
lea rax, [rcx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
mov qword [rcx], rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400665a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x38
cmp byte [rcx + 0xa0], 0
mov r14, rcx
mov ebp, edx
jne 0x1400665c0
xor al, al
add rsp, 0x38
pop r14
pop rbp
ret
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x40]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rcx + 0x48]
cmp rbx, rdi
je 0x1400666eb
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x400000006cc
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140066662
mov rax, rbp
mov rdi, r13
neg rax
mov rcx, rbp
shl rax, 3
add qword [rsi + 0x18], rax
mov rdx, qword [rsi + 0x18]
test ebp, ebp
je 0x140066641
mov rax, rdx
nop
xor rdi, qword [rax]
lea rax, [rax + 8]
imul rdi, r12
sub rcx, 1
jne 0x140066630
lea rax, [rdx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140066657
mov rcx, rsi
call fcn.140072150
mov rdx, qword [rsi + 0x18]
lea rax, [rdx + 8]
mov qword [rsi + 0x18], rax
mov qword [rdx], rdi
cmp qword [rbx + 0x30], r15
je 0x140066694
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140066694
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.1400665a0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140066671
cmp qword [rbx + 0x40], r15
je 0x1400666c6
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x1400666c6
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.1400665a0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x1400666a3
mov rdi, qword [r14 + 0x48]
add rbx, 0x78
cmp rbx, rdi
jne 0x140066606
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rax, qword [rdi - 0x70]
mov rbx, qword [rsp + 0x50]
mov byte [rdi - 8], 0
cmp ebp, dword [rax + 0xb4]
jae 0x140066707
call fcn.140061e20
jmp 0x140066714
cmp ebp, dword [rax + 0xb8]
jbe 0x14006674b
call fcn.140061d70
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x140066730
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rdi - 0x60], rax
xor al, al
mov rdi, qword [rsp + 0x60]
mov byte [r14 + 0xa0], 0
add rsp, 0x38
pop r14
pop rbp
ret
mov rcx, r14
call fcn.140068af0
mov rdi, qword [rsp + 0x60]
test al, al
setne al
mov byte [r14 + 0xa0], al
add rsp, 0x38
pop r14
pop rbp
ret
Function at 0x1400668a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0xa0], 0
mov esi, edx
mov r14, rcx
je 0x140066a1f
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x40]
mov rcx, qword [rcx + 0x48]
cmp rbx, rcx
je 0x1400669ff
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x30000000519
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140066971
lea ecx, [rsi + rsi]
mov rbp, r13
neg rcx
mov r9d, r15d
shl rcx, 3
add qword [rdi + 0x18], rcx
mov r8, qword [rdi + 0x18]
test esi, esi
je 0x140066950
nop word [rax + rax]
lea ecx, [r9 + r9]
inc r9d
mov eax, ecx
lea edx, [rcx + 1]
mov rcx, qword [r8 + rdx*8]
xor rcx, qword [r8 + rax*8]
imul rcx, r12
xor rbp, rcx
cmp r9d, esi
jb 0x140066930
lea rax, [r8 + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140066966
mov rcx, rdi
call fcn.140072150
mov r8, qword [rdi + 0x18]
lea rax, [r8 + 8]
mov qword [rdi + 0x18], rax
mov qword [r8], rbp
cmp qword [rbx + 0x30], r15
je 0x1400669a3
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x1400669a3
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.1400668a0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140066980
cmp qword [rbx + 0x40], r15
je 0x1400669d5
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x1400669d5
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.1400668a0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x1400669b2
mov rcx, qword [r14 + 0x48]
add rbx, 0x78
cmp rbx, rcx
jne 0x140066900
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
lea rdx, [rcx - 0x78]
mov r8d, esi
mov rcx, qword [rcx - 0x70]
call fcn.1400692b0
mov rbx, qword [rsp + 0x50]
test al, al
jne 0x140066a29
mov byte [r14 + 0xa0], al
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov rcx, r14
call fcn.140068af0
test al, al
setne al
mov byte [r14 + 0xa0], al
add rsp, 0x38
pop r14
pop rsi
ret
Function at 0x140067340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov rsi, rdx
mov r14, rcx
jne 0x14006736d
xor al, al
jmp 0x140067566
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140068f00
test al, al
je 0x14006754f
mov rax, qword [r14 + 0x48]
mov r8, rsi
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14006a2c0
test al, al
je 0x14006754f
mov rdx, rbx
mov rcx, rdi
call fcn.14006a670
test al, al
je 0x14006754f
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140067539
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x1400674af
mov qword [rsp + 0x20], rsi
xorps xmm0, xmm0
test rsi, rsi
js 0x140067421
cvtsi2sd xmm0, rsi
jmp 0x140067439
mov rax, rsi
mov rcx, rsi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
movsd qword [rsp + 0x28], xmm0
mov rdi, r13
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x140067450
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x1400674a4
mov rcx, rbp
call fcn.140072150
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x1400674e4
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x1400674e4
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140067340
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400674c0
cmp qword [rbx + 0x40], r15
je 0x140067517
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140067517
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140067340
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x1400674f3
add rbx, 0x78
cmp rbx, qword [r14 + 0x48]
jne 0x140067400
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.140068af0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x140067559
mov byte [r14 + 0xa0], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140154650
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x140067580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov rsi, rdx
mov r14, rcx
jne 0x1400675ad
xor al, al
jmp 0x140067786
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140068f00
test al, al
je 0x14006776f
mov rax, qword [r14 + 0x48]
mov r8, rsi
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14006a4c0
test al, al
je 0x14006776f
mov rdx, rbx
mov rcx, rdi
call fcn.14006a670
test al, al
je 0x14006776f
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140067759
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x1400676cf
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
cvtsi2sd xmm0, rsi
mov rdi, r13
mov rcx, r15
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x140067670
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x1400676c4
mov rcx, rbp
call fcn.140072150
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x140067704
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140067704
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140067580
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400676e0
cmp qword [rbx + 0x40], r15
je 0x140067737
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140067737
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140067580
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140067713
add rbx, 0x78
cmp rbx, qword [r14 + 0x48]
jne 0x140067640
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.140068af0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x140067779
mov byte [r14 + 0xa0], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140154650
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x1400677a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov r14, rcx
mov ebp, edx
jne 0x1400677cc
xor al, al
jmp 0x1400679ae
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140068f00
test al, al
je 0x140067992
mov rax, qword [r14 + 0x48]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14006a2c0
test al, al
je 0x140067992
mov rdx, rbx
mov rcx, rdi
call fcn.14006a670
test al, al
je 0x140067992
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x14006797c
mov qword [rsp + 0x60], rsi
movabs rcx, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x1400678ef
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
cvtsi2sd xmm0, rbp
mov rdi, rcx
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140067890
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x1400678e4
mov rcx, rsi
call fcn.140072150
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140067923
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140067923
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400677a0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140067900
cmp qword [rbx + 0x40], r12
je 0x140067955
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140067955
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400677a0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140067932
add rbx, 0x78
movabs rcx, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x48]
jne 0x140067860
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140068af0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x14006799c
mov byte [r14 + 0xa0], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140154650
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x1400679d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1402e7d18]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0xa0], 0
mov r14, rcx
movsxd rbp, edx
jne 0x1400679fd
xor al, al
jmp 0x140067bde
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140068f00
test al, al
je 0x140067bc2
mov rax, qword [r14 + 0x48]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14006a4c0
test al, al
je 0x140067bc2
mov rdx, rbx
mov rcx, rdi
call fcn.14006a670
test al, al
je 0x140067bc2
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140067bac
mov qword [rsp + 0x60], rsi
movabs rax, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop word [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140067b1f
movd xmm0, ebp
mov rdi, rax
cvtdq2pd xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140067ac0
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140067b14
mov rcx, rsi
call fcn.140072150
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140067b53
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140067b53
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400679d0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140067b30
cmp qword [rbx + 0x40], r12
je 0x140067b85
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140067b85
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.1400679d0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140067b62
add rbx, 0x78
movabs rax, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x48]
jne 0x140067a90
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140068af0
test al, al
setne al
mov byte [r14 + 0xa0], al
jmp 0x140067bcc
mov byte [r14 + 0xa0], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140154650
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140067c00
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0xa0], 0
mov r14, rcx
movzx esi, dl
jne 0x140067c21
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov qword [rsp + 0x50], rbx
call fcn.140068f00
test al, al
je 0x140067c66
mov rax, qword [r14 + 0x48]
mov rcx, qword [rax - 0x70]
lea rbx, [rax - 0x78]
test byte [rcx + 0x58], 2
jne 0x140067c7d
call fcn.1400627c0
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x140067c62
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x50]
xor al, al
mov byte [r14 + 0xa0], 0
add rsp, 0x38
pop r14
pop rsi
ret
mov rdx, rbx
call fcn.14006a670
test al, al
je 0x140067c66
mov rbx, qword [r14 + 0x40]
cmp rbx, qword [r14 + 0x48]
je 0x140067d9c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x84222325cbf29ce4
mov qword [rsp + 0x28], r13
movabs r13, 0x100000001b3
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x58], rbp
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140067d00
mov rcx, qword [rdi + 0x18]
lea rbp, [rsi + 1]
xor rbp, r12
imul rbp, r13
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140067cf5
mov rcx, rdi
call fcn.140072150
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov qword [rcx], rbp
cmp qword [rbx + 0x30], r15
je 0x140067d35
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140067d35
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140067c00
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140067d10
cmp qword [rbx + 0x40], r15
je 0x140067d75
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140067d75
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140067c00
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140067d50
add rbx, 0x78
cmp rbx, qword [r14 + 0x48]
jne 0x140067cc7
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, r14
call fcn.140068af0
mov rbx, qword [rsp + 0x50]
test al, al
setne al
mov byte [r14 + 0xa0], al
add rsp, 0x38
pop r14
pop rsi
ret

Function at 0x140068150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x1400681a4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140068190
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x1400681be
mov rcx, rdi
call fcn.140071f90
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140069c40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
movabs rax, 0x84222325cbf29ce4
xor rbx, rax
mov rdi, rcx
movabs rcx, 0x100000001b3
xor edx, edx
imul rbx, rcx
test r9, r9
je 0x140069c94
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rbx, rax
imul rbx, rcx
cmp rdx, r9
jb 0x140069c80
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140069cae
mov rcx, rdi
call fcn.140072150
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov al, 1
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret