joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092303
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
cmp qword [0x14019a160], 0
jne 0x14009245a
mov ecx, 0x18
call fcn.1400b7270
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [0x14019a160], rax
mov rdi, qword [0x14018afd8]
cmp qword [rdi + 0x10], 0
je 0x1400923aa
cmp qword [rdi + 0x18], 0x10
jb 0x140092369
mov rdi, qword [rdi]
movaps xmm0, xmmword [section..rdata]
lea rbx, [rbp - 0x60]
movups xmmword [rbx + 0x10], xmm0
mov byte [rbx], 0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov rdx, rdi
mov r8, rax
call fcn.14000451c
mov rcx, rsi
mov rdx, rbx
call fcn.140005b04
lea rcx, [rbp - 0x60]
call fcn.140005a44
jmp 0x14009245a
mov rcx, rsi
call fcn.140092536
lea rcx, [rbp - 0x60]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x140092412
mov rsi, qword [0x14019a160]
movaps xmm0, xmmword [section..rdata]
lea rdi, [rbp + 0xb0]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rbx, [rbp - 0x60]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14000451c
mov rcx, rsi
mov rdx, rdi
call fcn.140005b04
lea rcx, [rbp + 0xb0]
call fcn.140005a44
mov rsi, qword [0x14019a160]
movaps xmm0, xmmword [section..rdata]
lea rdi, [rbp + 0xb0]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rdx, [0x14012a15c]
mov r8d, 2
mov rcx, rdi
call fcn.14000451c
mov rcx, rsi
mov rdx, rdi
call fcn.140005b04
lea rcx, [rbp + 0xb0]
call fcn.140005a44
mov rax, qword [0x14019a160]
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x140092536
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
mov rsi, rcx
call fcn.140072dba
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1400925bc
movaps xmm0, xmmword [section..rdata]
lea rdi, [rbp + 0xa8]
movups xmmword [rdi + 0x10], xmm0
mov byte [rdi], 0
lea rbx, [rbp - 0x60]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rdi
mov rdx, rbx
mov r8, rax
call fcn.14000451c
mov rcx, rsi
mov rdx, rdi
call fcn.140005b04
lea rcx, [rbp + 0xa8]
call fcn.140005a44
movaps xmm6, xmmword [section..rdata]
lea rdi, [rbp + 0xa8]
movups xmmword [rdi + 0x10], xmm6
mov byte [rdi], 0
lea rdx, str.C:_tmp_
mov r8d, 7
mov rcx, rdi
call fcn.14000451c
mov rcx, rsi
mov rdx, rdi
call fcn.140005b04
lea rcx, [rbp + 0xa8]
call fcn.140005a44
lea rdi, [rbp + 0xa8]
movups xmmword [rdi + 0x10], xmm6
mov byte [rdi], 0
lea rdx, str.C:_temp_
mov r8d, 8
mov rcx, rdi
call fcn.14000451c
mov rcx, rsi
mov rdx, rdi
call fcn.140005b04
lea rcx, [rbp + 0xa8]
call fcn.140005a44
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14009d58c
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov eax, r9d
and eax, 3
mov rsi, 0xffffffffffffffff
cmp eax, 3
jne 0x14009d5cb
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov rbx, rdx
mov r12, rcx
mov ecx, dword [rbp + 0x60]
test r9b, 4
jne 0x14009d673
mov edx, r9d
and edx, 1
mov edi, ecx
not edi
or edi, edx
je 0x14009d5b9
cmp r8d, 7
ja 0x14009d5b9
mov edx, 0xbb
bt edx, r8d
jae 0x14009d5b9
movsxd r15, r8d
lea rdx, [0x1401197dc]
mov r14d, dword [rdx + r15*4]
cmp eax, 1
jne 0x14009d68b
mov eax, dword [0x1401a0cc8]
mov ecx, dword [0x140185358]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14009d719
mov rcx, qword [0x1401a0cc0]
add rbx, rcx
dec rbx
mov rax, rbx
xor edx, edx
div rcx
sub rbx, rdx
mov rcx, r12
mov rdx, rbx
mov r8d, 0x3000
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14009d711
jmp 0x14009d5b9
test r8b, 2
je 0x14009d5de
cmp ecx, 0xffffffff
jne 0x14009d5b9
jmp 0x14009d5de
mov rsi, 0xffffffffffffffff
mov rax, 0xffffffffffffffff
test r9b, 1
jne 0x14009d6a4
call sub.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle
mov r9, rbx
shr r9, 0x20
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x14009d5b9
mov rbx, rax
lea rax, [0x1401197bc]
mov r9d, dword [rbp + 0x70]
mov r8d, dword [rbp + 0x68]
mov edx, dword [rax + r15*4]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
xor edi, edi
cmp rax, 1
sbb rdi, rdi
or rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, rdi
jmp 0x14009d5b9
lea rcx, [0x1401a0cc8]
call fcn.1400b7088
cmp dword [0x1401a0cc8], 0xffffffff
jne 0x14009d635
lea rcx, [0x1401a0cd0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1401a0cf8]
mov qword [0x1401a0cc0], rax
lea rcx, [0x1401a0cc8]
call fcn.1400b7120
jmp 0x14009d635

Function at 0x14009e9e3
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov r14, qword [sym.imp.WS2_32.dll_send]
call r14
movsxd rbx, eax
mov rdi, qword [0x1401828a8]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, eax
call rdi
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], esi
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400a037c
Capabilities:
Check if file exists

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1c0], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov r15d, edx
test r9, r9
je 0x1400a03af
mov byte [rdi], 0
mov qword [r14], 0
xor eax, eax
xor edx, edx
movzx ebx, word [rcx + rax*2]
test bx, bx
je 0x1400a03e0
mov word [rbp + rax*2 - 0x60], bx
add rdx, 0xfffffffffffffffe
inc rax
cmp rax, 0x104
jne 0x1400a03ba
lea rcx, [rbp - 0x60]
sub rcx, rdx
jmp 0x1400a03ef
lea rcx, [rbp - 0x60]
sub rcx, rdx
cmp rax, 0x104
jne 0x1400a03f3
add rcx, 0xfffffffffffffffe
mov word [rcx], 0
xor eax, eax
cmp word [rbp + rax - 0x60], 0
je 0x1400a0410
add rax, 2
cmp rax, 0x208
jne 0x1400a03fa
jmp 0x1400a045d
lea rcx, [rax - 0x208]
neg rax
lea rdx, [0x140130fea]
movzx ebx, word [rdx]
test bx, bx
je 0x1400a0448
add rdx, 2
mov word [rbp + rcx + 0x1a8], bx
add rax, 0xfffffffffffffffe
add rcx, 2
jne 0x1400a0421
lea rdx, [rbp - 0x60]
sub rdx, rax
jmp 0x1400a0454
lea rdx, [rbp - 0x60]
sub rdx, rax
test rcx, rcx
jne 0x1400a0458
add rdx, 0xfffffffffffffffe
mov word [rdx], 0
xor esi, esi
lea rbx, [rbp - 0x60]
mov ecx, 0x1f0003
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp + 0x1a8], rax
test rax, rax
je 0x1400a04b7
lea rdx, [rbp + 0x1b8]
mov dword [rdx], esi
mov dword [rbp + 0x1bc], esi
mov rcx, rax
call fcn.1400a0690
mov esi, eax
test eax, eax
js 0x1400a04e7
test r15b, r15b
je 0x1400a0507
mov eax, 0x104
cmp word [rbx], 0
je 0x1400a050e
add rbx, 2
dec rax
jne 0x1400a04a6
jmp 0x1400a0522
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 2
je 0x1400a05c6
mov rcx, qword [rbp + 0x1f8]
lea r8, [0x1401255d3]
mov edx, 0xc9
call fcn.1400a0648
mov esi, eax
jmp 0x1400a05c6
mov rcx, qword [rbp + 0x1f8]
lea r8, [0x1401255d3]
mov edx, 0xcf
mov r9d, esi
call fcn.14009f972
jmp 0x1400a05c6
xor eax, eax
jmp 0x1400a05af
mov word [rbx], 0x68
cmp rax, 1
je 0x1400a051d
add rbx, 2
mov word [rbx], 0
lea r8, [rbp - 0x60]
mov ecx, 0x1f0003
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp + 0x1b0], rax
test rax, rax
je 0x1400a0578
lea rdx, [rbp + 0x1bc]
mov rcx, rax
call fcn.1400a0690
mov ebx, eax
test eax, eax
jns 0x1400a0571
mov rcx, qword [rbp + 0x1f8]
lea r8, [0x1401255d3]
mov edx, 0xd7
mov r9d, ebx
call fcn.14009f972
mov esi, ebx
test ebx, ebx
setns bl
jmp 0x1400a0594
mov rcx, qword [rbp + 0x1f8]
lea r8, [0x1401255d3]
mov edx, 0xd5
call fcn.1400a0648
mov esi, eax
xor ebx, ebx
lea rcx, [rbp + 0x1b0]
call fcn.1400a086a
test bl, bl
je 0x1400a05c6
movsxd rax, dword [rbp + 0x1bc]
shl rax, 0x1f
movsxd rcx, dword [rbp + 0x1b8]
test rdi, rdi
je 0x1400a05be
mov byte [rdi], 1
or rax, rcx
mov qword [r14], rax
xor esi, esi
lea rcx, [rbp + 0x1a8]
call fcn.1400a086a
mov eax, esi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400a4f1e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r10, r9
mov rax, r8
mov r14, rdx
mov rsi, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
movabs rdx, 0x100000001b3
movzx ebx, byte [rax + rcx]
xor r9, rbx
imul r9, rdx
inc rcx
cmp rcx, 4
jne 0x1400a4f57
and r9, qword [rsi + 0x30]
mov rdi, qword [rsi + 8]
mov rcx, qword [rsi + 0x18]
mov rdx, r9
shl rdx, 4
mov r8, qword [rcx + rdx]
cmp r8, rdi
je 0x1400a4f9a
lea rdx, [r9 + r9]
shl rdx, 3
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rdi, qword [rcx]
mov eax, dword [rax]
cmp rdi, r8
je 0x1400a4fd0
mov rdi, qword [rdi + 8]
cmp eax, dword [rdi + 0x10]
jne 0x1400a4f9c
mov rax, qword [r10]
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov rax, qword [r10]
mov qword [rax + 8], rcx
dec qword [rsi + 0x10]
mov edx, 0x18
mov rcx, r10
call fcn.1400b72ac
xor ebx, ebx
jmp 0x1400a501e
mov rax, qword [r10]
cmp r8, rax
je 0x1400a4ffd
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r8
mov rdx, qword [r8 + 8]
mov qword [rdx], r10
mov qword [r8 + 8], rcx
mov rcx, qword [r10 + 8]
mov qword [rax + 8], rcx
mov qword [r10 + 8], rdx
mov rcx, rsi
mov qword [rbp - 0x10], r10
mov rdx, r10
call fcn.14005da90
mov bl, 1
mov rcx, rsi
mov qword [rbp - 0x18], rsi
call fcn.1400a50e0
mov rdi, qword [rbp - 0x10]
mov qword [r14], rdi
mov byte [r14 + 8], bl
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400a5180
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rdi + rax + 0x10]
xor r8, rdx
imul r8, rcx
inc rax
cmp rax, 4
jne 0x1400a51ae
and r8, qword [rbx + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.1400a5286
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [rbx + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.1400b72ac
mov qword [r14], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400a5646
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rax, r8
mov r14, rdx
mov rbx, rcx
movzx ecx, byte [r8]
movabs rdx, 0xcbf29ce484222325
xor rdx, rcx
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx r9d, byte [r8 + 1]
xor r9, rdx
imul r9, rcx
and r9, qword [rbx + 0x30]
mov rdi, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov rdx, r9
shl rdx, 4
mov r8, qword [rcx + rdx]
cmp r8, rdi
je 0x1400a56c3
lea rdx, [r9 + r9]
shl rdx, 3
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rdi, qword [rcx]
movzx eax, word [rax]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x18], rbx
cmp rdi, r8
je 0x1400a5705
mov rdi, qword [rdi + 8]
cmp ax, word [rdi + 0x10]
jne 0x1400a56ce
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rcx], rax
mov rax, qword [rsi]
mov qword [rax + 8], rcx
lea rcx, [rbx + 8]
dec qword [rbx + 0x10]
mov rdx, rsi
call fcn.1400a3f9e
mov qword [r14], rdi
xor eax, eax
jmp 0x1400a574e
mov rax, qword [rsi]
cmp r8, rax
je 0x1400a5732
mov rcx, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r8
mov rdx, qword [r8 + 8]
mov qword [rdx], rsi
mov qword [r8 + 8], rcx
mov rcx, qword [rsi + 8]
mov qword [rax + 8], rcx
mov qword [rsi + 8], rdx
mov rcx, rbx
mov rdx, rsi
call fcn.14005da90
mov rcx, rbx
call fcn.1400a5a90
mov rax, qword [rbp - 0x10]
mov qword [r14], rax
mov al, 1
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400a5bce
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov rbx, rcx
movzx eax, byte [r8 + 0x10]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx r8d, byte [r8 + 0x11]
xor r8, rcx
imul r8, rax
and r8, qword [rbx + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.14005de14
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [rbx + 0x10]
add rbx, 8
mov rcx, rbx
mov rdx, rdi
call fcn.1400a3f9e
mov qword [r14], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400a6068
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov rax, rdx
movzx edx, byte [r8]
movabs rsi, 0x4bf29ce484222325
xor rsi, rdx
movabs rdx, 0x100000001b3
imul rsi, rdx
movzx edi, byte [r8 + 1]
xor rdi, rsi
imul rdi, rdx
and rdi, qword [rcx + 0x30]
mov r10, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
lea r11, [rdi + rdi]
inc r11
shl rdi, 4
mov rcx, qword [r9 + rdi]
movzx r8d, word [r8]
mov rdx, rcx
cmp r10, rcx
je 0x1400a60cc
mov rsi, qword [r9 + r11*8]
mov rsi, qword [rsi]
jmp 0x1400a60cf
mov rsi, rcx
cmp rdx, rsi
je 0x1400a60e3
cmp word [rdx + 0x10], r8w
je 0x1400a60e0
mov rdx, qword [rdx]
jmp 0x1400a60be
mov r10, rdx
mov qword [rax], r10
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a60ea
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov r12, r9
mov r15, r8
mov r14, rdx
mov r13, rcx
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rcx, r8
jbe 0x1400a6124
mov rcx, qword [r15]
test rax, rax
je 0x1400a6157
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs rdi, 0x100000001b3
movzx ebx, byte [rcx + rdx]
xor rbx, rsi
imul rbx, rdi
inc rdx
mov rsi, rbx
cmp rax, rdx
jne 0x1400a613f
jmp 0x1400a6161
movabs rbx, 0xcbf29ce484222325
and rbx, qword [r13 + 0x30]
lea rdi, [rbx + rbx]
mov rsi, qword [r13 + 8]
mov rax, qword [r13 + 0x18]
mov rcx, rbx
shl rcx, 4
cmp qword [rax + rcx], rsi
je 0x1400a6191
lea rcx, [rdi*8]
or rcx, 8
mov rcx, qword [rax + rcx]
mov rsi, qword [rcx]
cmp rsi, qword [rax + rdi*8]
mov qword [rbp - 8], r12
mov qword [rbp - 0x10], r13
je 0x1400a61bd
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
mov rcx, r15
call fcn.1400473f2
test al, al
jne 0x1400a6210
mov rax, qword [r13 + 0x18]
cmp rsi, qword [rax + rdi*8]
jne 0x1400a619f
mov rax, qword [r12]
cmp rsi, rax
je 0x1400a61ee
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], r12
mov qword [rsi + 8], rcx
mov rcx, qword [r12 + 8]
mov qword [rax + 8], rcx
mov qword [r12 + 8], rdx
mov rcx, r13
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.14005da90
mov dil, 1
mov rcx, r13
call fcn.1400a63c8
mov rsi, qword [rbp - 8]
jmp 0x1400a6236
mov rax, qword [r12]
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rax, qword [r12]
mov qword [rax + 8], rcx
lea rcx, [r13 + 8]
dec qword [r13 + 0x10]
mov rdx, r12
call fcn.14008dd42
xor edi, edi
mov qword [r14], rsi
mov byte [r14 + 8], dil
mov rax, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400a6468
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov rax, qword [r8 + 0x20]
cmp qword [r8 + 0x28], 0xf
jbe 0x1400a6493
mov rcx, qword [rdi + 0x10]
jmp 0x1400a6497
lea rcx, [rdi + 0x10]
test rax, rax
je 0x1400a64cb
movabs rbx, 0xcbf29ce484222325
xor edx, edx
movabs rsi, 0x100000001b3
movzx r8d, byte [rcx + rdx]
xor r8, rbx
imul r8, rsi
inc rdx
mov rbx, r8
cmp rax, rdx
jne 0x1400a64b2
jmp 0x1400a64d5
movabs r8, 0xcbf29ce484222325
and r8, qword [r15 + 0x30]
mov rcx, r15
mov rdx, rdi
call fcn.1400a5286
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [r15 + 0x10]
add r15, 8
mov rcx, r15
mov rdx, rdi
call fcn.14008dd42
mov qword [r14], rsi
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x1400a772a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov r15, r8
mov r14, rdx
mov r12, rcx
mov rax, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
mov rcx, r8
jbe 0x1400a775f
mov rcx, qword [r15]
test rax, rax
je 0x1400a7792
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs rdi, 0x100000001b3
movzx ebx, byte [rcx + rdx]
xor rbx, rsi
imul rbx, rdi
inc rdx
mov rsi, rbx
cmp rax, rdx
jne 0x1400a777a
jmp 0x1400a779c
movabs rbx, 0xcbf29ce484222325
and rbx, qword [r12 + 0x30]
lea rdi, [rbx + rbx]
mov rsi, qword [r12 + 8]
mov rax, qword [r12 + 0x18]
mov rcx, rbx
shl rcx, 4
cmp qword [rax + rcx], rsi
je 0x1400a77ea
lea rcx, [rdi*8]
or rcx, 8
mov rcx, qword [rax + rcx]
mov rsi, qword [rcx]
jmp 0x1400a77ea
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
mov rcx, r15
call fcn.1400473f2
test al, al
jne 0x1400a7860
mov rax, qword [r12 + 0x18]
cmp rsi, qword [rax + rdi*8]
jne 0x1400a77d1
lea rcx, [r12 + 8]
mov rax, qword [r12 + 8]
mov rdx, qword [rax]
mov r8, r15
call fcn.1400a62b6
mov rax, qword [r12 + 8]
mov rdx, qword [rax]
mov rax, qword [rdx]
cmp rsi, rax
je 0x1400a783a
mov rcx, qword [rdx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rsi
mov rdi, qword [rsi + 8]
mov qword [rdi], rdx
mov qword [rsi + 8], rcx
mov rcx, qword [rdx + 8]
mov qword [rax + 8], rcx
mov qword [rdx + 8], rdi
mov rcx, r12
mov qword [rbp - 0x10], rdx
mov r8, rsi
mov r9, rbx
call fcn.14005da90
mov rcx, r12
mov qword [rbp - 0x18], r12
call fcn.1400a63c8
mov al, 1
mov rsi, qword [rbp - 0x10]
jmp 0x1400a7862
xor eax, eax
mov qword [r14], rsi
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x1400a8ca6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov rax, rdx
movabs rdx, 0xcbf29ce484222325
xor esi, esi
movabs r9, 0x100000001b3
movzx edi, byte [r8 + rsi]
xor rdx, rdi
imul rdx, r9
inc rsi
cmp rsi, 8
jne 0x1400a8cc5
and rdx, qword [rcx + 0x30]
mov r9, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov rcx, rdx
shl rcx, 4
mov r11, qword [r10 + rcx]
lea rdi, [rdx + rdx]
inc rdi
mov rdx, qword [r8]
mov rcx, r11
cmp r9, r11
je 0x1400a8d0c
mov rsi, qword [r10 + rdi*8]
mov rsi, qword [rsi]
jmp 0x1400a8d0f
mov rsi, r11
cmp rcx, rsi
je 0x1400a8d22
cmp qword [rcx + 0x10], rdx
je 0x1400a8d1f
mov rcx, qword [rcx]
jmp 0x1400a8cfe
mov r9, rcx
mov qword [rax], r9
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a8daa
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, r9
mov rax, r8
mov r14, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor ecx, ecx
movabs rdx, 0x100000001b3
movzx edi, byte [rax + rcx]
xor r9, rdi
imul r9, rdx
inc rcx
cmp rcx, 8
jne 0x1400a8de3
and r9, qword [rbx + 0x30]
mov rdi, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov rdx, r9
shl rdx, 4
mov r8, qword [rcx + rdx]
cmp r8, rdi
je 0x1400a8e26
lea rdx, [r9 + r9]
shl rdx, 3
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rdi, qword [rcx]
mov rax, qword [rax]
mov qword [rbp - 0x10], rsi
mov qword [rbp - 0x18], rbx
cmp rdi, r8
je 0x1400a8e68
mov rdi, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
jne 0x1400a8e31
mov rax, qword [rsi]
mov rcx, qword [rsi + 8]
mov qword [rcx], rax
mov rax, qword [rsi]
mov qword [rax + 8], rcx
lea rcx, [rbx + 8]
dec qword [rbx + 0x10]
mov rdx, rsi
call fcn.14008e374
mov qword [r14], rdi
xor eax, eax
jmp 0x1400a8eb1
mov rax, qword [rsi]
cmp r8, rax
je 0x1400a8e95
mov rcx, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], r8
mov rdx, qword [r8 + 8]
mov qword [rdx], rsi
mov qword [r8 + 8], rcx
mov rcx, qword [rsi + 8]
mov qword [rax + 8], rcx
mov qword [rsi + 8], rdx
mov rcx, rbx
mov rdx, rsi
call fcn.14005da90
mov rcx, rbx
call fcn.1400a8fd6
mov rax, qword [rbp - 0x10]
mov qword [r14], rax
mov al, 1
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400a91d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
mov eax, send
movabs rcx, 0x100000001b3
movzx edx, byte [rdi + rax]
xor r8, rdx
imul r8, rcx
inc rax
cmp rax, 0x18
jne 0x1400a9209
and r8, qword [rbx + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.14005de14
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [rbx + 0x10]
add rbx, 8
mov rcx, rbx
mov rdx, rdi
call fcn.14008e374
mov qword [r14], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400a9e36
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov rax, rdx
movabs rsi, 0xcbf29ce484222325
xor edx, edx
movabs r9, 0x100000001b3
movzx edi, byte [r8 + rdx]
xor rsi, rdi
imul rsi, r9
inc rdx
cmp rdx, 8
jne 0x1400a9e55
and rsi, qword [rcx + 0x30]
mov r10, qword [rcx + 8]
mov r9, qword [rcx + 0x18]
mov rcx, rsi
shl rcx, 4
mov rdx, qword [r9 + rcx]
lea r11, [rsi + rsi]
inc r11
mov r8, qword [r8]
mov rcx, rdx
cmp r10, rdx
je 0x1400a9e9c
mov rsi, qword [r9 + r11*8]
mov rsi, qword [rsi]
jmp 0x1400a9e9f
mov rsi, rdx
cmp rcx, rsi
je 0x1400a9ee1
cmp qword [rcx + 0x10], r8
je 0x1400a9eaf
mov rcx, qword [rcx]
jmp 0x1400a9e8e
mov rsi, rcx
cmp r10, rdx
je 0x1400a9ec0
mov rdi, qword [r9 + r11*8]
mov rdi, qword [rdi]
jmp 0x1400a9ec3
mov rdi, rdx
cmp rsi, rdi
je 0x1400a9ed3
cmp r8, qword [rsi + 0x10]
jne 0x1400a9ed3
mov rsi, qword [rsi]
jmp 0x1400a9eb2
cmp rcx, rsi
je 0x1400a9ee1
mov qword [rax], rcx
mov qword [rax + 8], rsi
jmp 0x1400a9ee8
mov qword [rax], r10
mov qword [rax + 8], r10
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400a9fde
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rdi, r8
mov r14, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rdi + rax + 0x10]
xor r8, rdx
imul r8, rcx
inc rax
cmp rax, 8
jne 0x1400aa00c
and r8, qword [rbx + 0x30]
mov rcx, rbx
mov rdx, rdi
call fcn.14005de14
mov rsi, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rsi
mov rcx, qword [rdi]
mov qword [rcx + 8], rax
dec qword [rbx + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.1400b72ac
mov qword [r14], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret

Function at 0x1400b4c26
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov esi, ecx
mov eax, dword [0x1401a1250]
mov ecx, dword [0x140185358]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400b4c94
test rdi, rdi
je 0x1400b4c89
mov rax, qword [0x1401a1248]
xor ecx, ecx
mov dl, byte [rbx + rcx]
xor dl, sil
shr esi, 8
movzx edx, dl
xor esi, dword [rax + rdx*4]
inc rcx
cmp rdi, rcx
jne 0x1400b4c72
mov eax, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1401a1250]
call fcn.1400b7088
cmp dword [0x1401a1250], 0xffffffff
jne 0x1400b4c64
call fcn.1400b4cec
mov qword [0x1401a1248], rax
lea rcx, [0x1401a1250]
call fcn.1400b7120
jmp 0x1400b4c64