joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a370
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140079c3c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x140079bca
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x14007a370
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x140079c0a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.140036bd0
mov rcx, rbx
test rbx, rbx
jne 0x140079bf0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400389f0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14007a474
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140036bd0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x14007a480
cmp rbx, rbp
jne 0x14007a420
cmp qword [rsp + 0x20], r14
jne 0x14007a44d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14007a48f
mov qword [r15], r12
mov rax, r12
jmp 0x14007a492
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14007a44d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.140036bd0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14007a526
cmp rbx, rbp
jne 0x14007a500
jmp 0x14007a44a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14007a4a0
jmp 0x14007a44d
Function at 0x14007a540
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140079cfc
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x140079c8a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x14007a540
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x140079cca
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x50
call fcn.140036bd0
mov rcx, rbx
test rbx, rbx
jne 0x140079cb0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400389f0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14007a644
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x50
call fcn.140036bd0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x14007a650
cmp rbx, rbp
jne 0x14007a5f0
cmp qword [rsp + 0x20], r14
jne 0x14007a61d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14007a65f
mov qword [r15], r12
mov rax, r12
jmp 0x14007a662
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14007a61d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x50
call fcn.140036bd0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14007a6f6
cmp rbx, rbp
jne 0x14007a6d0
jmp 0x14007a61a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14007a670
jmp 0x14007a61d
Function at 0x14007a810
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov r10, rdx
mov r11, qword [rdx + 0x10]
jb 0x14007a827
mov r10, qword [rdx]
xor ebx, ebx
movabs r9, 0xcbf29ce484222325
mov r8d, ebx
test r11, r11
je 0x14007a869
mov qword [rsp + 0x40], rdi
movabs rdi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rdi
cmp r8, r11
jb 0x14007a850
mov rdi, qword [rsp + 0x40]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.140038b90
cmp qword [rax + 8], rbx
setne bl
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140080bc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
mov rsi, rcx
movzx r13d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r13, rax
movabs rcx, 0x100000001b3
imul r13, rcx
movzx eax, byte [r8 + 1]
xor r13, rax
imul r13, rcx
movzx eax, byte [r8 + 2]
xor r13, rax
imul r13, rcx
movzx eax, byte [r8 + 3]
xor r13, rax
imul r13, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r13
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x140080c47
mov rbx, r15
mov rbp, r15
jmp 0x140080c8a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140080c61
cmp rbx, rcx
je 0x140080c84
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140080c53
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rsi + 0x10], rax
jne 0x140080ca8
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1401302e8
mov rdi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r12]
movups xmmword [rax + 0x10], xmm0
mov rdx, qword [rsi + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x140080ce5
cvtsi2ss xmm0, rdx
jmp 0x140080cfd
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140080d10
cvtsi2ss xmm1, rcx
jmp 0x140080d25
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140080da1
mov rcx, rsi
call fcn.140038650
mov rdx, rax
mov rcx, rsi
call fcn.1400799e0
mov rdx, qword [rsi + 0x30]
and rdx, r13
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x140080d6d
mov qword [rsp + 0x28], 0
jmp 0x140080d94
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140080d91
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x140080dd5
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140080d80
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r13
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x140080de5
mov qword [rcx + rax*8], rdi
jmp 0x140080df7
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x140080d99
cmp r8, rbp
jne 0x140080df0
mov qword [rcx + rax*8], rdi
jmp 0x140080dfc
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140080dfc
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140080c69
Function at 0x140085f30
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140085ffc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140085ffc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140086015
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x140085fec
cmp byte [rax], 0x5c
jne 0x140085fe6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x140085fe6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x140085fd2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x140085fe3
test r8b, 0x10
jne 0x140085fe6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x140085fe6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140081de0
test edi, edi
jne 0x140085f50
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140081dd0
int3
Function at 0x1400953a0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x14009545a
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x14009545d
nop word [rax + rax]
cmp rax, rdx
je 0x14009545a
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140095440
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x140095b20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
mov rsi, rcx
movzx r13d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r13, rax
movabs rcx, 0x100000001b3
imul r13, rcx
movzx eax, byte [r8 + 1]
xor r13, rax
imul r13, rcx
movzx eax, byte [r8 + 2]
xor r13, rax
imul r13, rcx
movzx eax, byte [r8 + 3]
xor r13, rax
imul r13, rcx
mov rcx, qword [rsi + 0x30]
and rcx, r13
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x140095ba7
mov rbx, r15
mov rbp, r15
jmp 0x140095bea
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140095bc1
cmp rbx, rcx
je 0x140095be4
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140095bb3
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rsi + 0x10], rax
jne 0x140095c08
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1401302e8
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
xor r12d, r12d
mov qword [rdi + 0x14], r12
mov dword [rdi + 0x1c], r12d
mov rdx, qword [rsi + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x140095c4e
cvtsi2ss xmm0, rdx
jmp 0x140095c66
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140095c79
cvtsi2ss xmm1, rcx
jmp 0x140095c8e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140095cf8
mov rcx, rsi
call fcn.140038650
mov rdx, rax
mov rcx, rsi
call fcn.1400799e0
mov rdx, qword [rsi + 0x30]
and rdx, r13
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x140095ceb
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140095ce8
mov rbx, rax
cmp rax, rdx
je 0x140095d2c
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140095cd7
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r13
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x140095d33
mov qword [rcx + rax*8], rdi
jmp 0x140095d45
mov qword [rsp + 0x20], rax
jmp 0x140095cf0
cmp r8, rbp
jne 0x140095d3e
mov qword [rcx + rax*8], rdi
jmp 0x140095d4a
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140095d4a
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140095bc9
Function at 0x140096f70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14018c010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x50], edx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea rsi, [0x1401972a8]
mov qword [rsp + 0x58], rsi
mov rcx, rsi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rsp + 0x60], 1
mov r8d, dword [rsp + 0x50]
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x51]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x52]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x53]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x140197180]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x140197168]
mov rax, qword [rcx + 8]
cmp rax, qword [0x140197158]
je 0x140097041
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x140097044
cmp rax, rcx
je 0x140097041
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x140097030
jmp 0x140097044
mov rax, rbx
test rax, rax
je 0x140097091
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x40]
lea rcx, [0x140197150]
call fcn.14009cb00
mov rbx, qword [rax]
lea rdx, [rbx + 0x18]
mov rcx, rdi
call fcn.1400200c0
nop
mov edx, dword [rbx + 0x38]
mov dword [rdi + 0x20], edx
mov edx, dword [rbx + 0x3c]
mov dword [rdi + 0x24], edx
mov edx, dword [rbx + 0x40]
mov dword [rdi + 0x28], edx
lea rcx, [rdi + 0x30]
lea rdx, [rbx + 0x48]
call fcn.1400200c0
nop
jmp 0x1400970d6
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8d, 7
lea rdx, [0x14014de30]
mov rcx, rdi
call fcn.140023450
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], recvfrom
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x48], recvfrom
mov byte [rdi + 0x30], 0
mov rcx, rsi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140130030
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140097100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14018c010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x50], rdx
xor ebx, ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea rbp, [0x1401972a8]
mov qword [rsp + 0x58], rbp
mov rcx, rbp
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov byte [rsp + 0x60], 1
mov r8, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14009715f
mov rdx, qword [rsi]
movabs r9, 0xcbf29ce484222325
mov rcx, rbx
test r8, r8
je 0x140097193
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140097180
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [0x140197110]
call fcn.140038b90
cmp qword [rax + 8], 0
je 0x1400971f4
mov r8, rsi
lea rdx, [rsp + 0x40]
lea rcx, [0x140197110]
call fcn.140038760
mov rbx, qword [rax]
lea rdx, [rbx + 0x30]
mov rcx, rdi
call fcn.1400200c0
nop
mov eax, dword [rbx + 0x50]
mov dword [rdi + 0x20], eax
mov edx, dword [rbx + 0x54]
mov dword [rdi + 0x24], edx
mov edx, dword [rbx + 0x58]
mov dword [rdi + 0x28], edx
lea rcx, [rdi + 0x30]
lea rdx, [rbx + 0x60]
call fcn.1400200c0
nop
jmp 0x140097239
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
mov r8d, 7
lea rdx, [0x14014de30]
mov rcx, rdi
call fcn.140023450
mov qword [rdi + 0x20], rbx
mov dword [rdi + 0x28], recvfrom
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x48], recvfrom
mov byte [rdi + 0x30], 0
mov rcx, rbp
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
nop
mov rcx, rsi
call fcn.140021950
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140130030
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400991c0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14018c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1401982bc], 0
mov edi, edx
mov ebx, ecx
je 0x140099325
cmp byte [0x140197fa8], 0
je 0x140099325
mov eax, dword [0x140197fb4]
test eax, eax
jne 0x14009920c
call fcn.14012cf40
mov eax, dword [0x140197fb4]
cmp eax, 1
jne 0x140099302
cmp qword [0x140195438], 0
jbe 0x140099325
inc dword [0x140195448]
mov dword [0x14019544c], 0xaede7345
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movups xmm1, xmmword [0x140195410]
mov rcx, qword [0x140195438]
lea rdx, [0x140195440]
mov dword [0x140195444], eax
xor r9d, r9d
movsx eax, bx
mov dword [0x140195404], eax
movsx eax, di
mov dword [0x140195408], eax
lea r8d, [r9 + 0x48]
movups xmm0, xmmword [0x140195400]
lea rax, [0x140195c80]
mov dword [rsp + 0x28], recvfrom
movaps xmmword [0x140195460], xmm1
movsd xmm1, qword [0x140195430]
movaps xmmword [0x140195450], xmm0
movups xmm0, xmmword [0x140195420]
mov qword [rsp + 0x20], rax
movsd qword [0x140195480], xmm1
movaps xmmword [0x140195470], xmm0
call qword [sym.imp.WSOCK32.dll_sendto]
mov rcx, qword [0x140195438]
lea rdx, [0x140195860]
xor eax, eax
mov dword [rsp + 0x30], recvfrom
mov qword [0x140195404], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
mov r8d, 0x400
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WSOCK32.dll_recvfrom]
mov eax, dword [0x140197fb4]
cmp eax, 2
jne 0x140099316
mov edx, edi
mov ecx, ebx
call fcn.14012cfb0
mov eax, dword [0x140197fb4]
cmp eax, 3
jne 0x140099325
mov edx, edi
mov ecx, ebx
call qword [0x1401953f0]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140130030
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14009c8f0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14009c925
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140025ef0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14009ca66
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14009c9e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14009ca55
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14009ca1d
mov r10, qword [rdx]
cmp r10, rax
je 0x14009ca17
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14009ca55
cmp r9, rdx
je 0x14009ca31
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14009ca77
cmp r9, rdx
jne 0x14009ca22
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14009c990
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14009ca55