joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e0ca0
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0xc8
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x24], xmm0
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rax - 0x74], xmm0
movups xmmword [rax - 0x64], xmm0
movups xmmword [rax - 0x54], xmm0
movups xmmword [rax - 0x44], xmm0
movups xmmword [rax - 0x34], xmm0
movups xmmword [rax - 0x24], xmm0
mov dword [rsp + 0x20], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x24], 5
seta al
add rsp, 0xc8
ret

Function at 0x1401e6d10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r8, rdx
jb 0x1401e6d1d
mov r8, qword [rdx]
mov r9, qword [rdx + 0x10]
movabs rax, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1401e6d54
movabs r10, 0x100000001b3
nop dword [rax]
movzx ecx, byte [rdx + r8]
inc rdx
xor rax, rcx
imul rax, r10
cmp rdx, r9
jb 0x1401e6d40
ret

Function at 0x1401e9ed0
Capabilities:
Hash data using fnv

Disassembly:
movsxd r8, dword [rdx + 8]
mov r9, qword [rdx]
mov rdx, qword [rcx + 8]
imul rax, r9, 0x100011b
imul r10, r8, 0x1000193
xor r10, rax
and r10, qword [rcx + 0x30]
shl r10, 4
add r10, qword [rcx + 0x18]
mov rax, qword [r10 + 8]
cmp rax, rdx
je 0x1401e9f2c
mov rcx, qword [r10]
cmp r9, qword [rax + 0x10]
jne 0x1401e9f10
cmp r8d, dword [rax + 0x18]
je 0x1401e9f1b
cmp rax, rcx
je 0x1401e9f2c
mov rax, qword [rax + 8]
jmp 0x1401e9f04
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1401e9f2c
mov rax, qword [rax + 0x20]
ret
xor eax, eax
ret
Function at 0x1401ed300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov r10, rdx
jb 0x1401ed313
mov r10, qword [rdx]
mov r11, qword [rdx + 0x10]
xor ebx, ebx
movabs r9, 0xcbf29ce484222325
mov r8d, ebx
test r11, r11
je 0x1401ed359
mov qword [rsp + 0x40], rdi
movabs rdi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rdi
cmp r8, r11
jb 0x1401ed340
mov rdi, qword [rsp + 0x40]
mov r8, rdx
lea rdx, [rsp + 0x20]
call fcn.1401ebb40
cmp qword [rax + 8], rbx
setne bl
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1401ed630
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
xor r9d, r9d
mov r10, qword [r8 + 8]
mov rdx, qword [r8 + 0x10]
add rdx, r10
cmp r10, rdx
jae 0x1401ed683
nop word [rax + rax]
lea r9, [r9 + r9*4]
movsx rax, byte [r10]
add r9, rax
inc r10
cmp r10, rdx
jb 0x1401ed670
imul r14, qword [r8], 0x1000193
xor r14, r9
mov r9, r14
lea rdx, [rsp + 0x20]
call fcn.1401eba50
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1401ed6b0
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1401ed84e
movabs rax, 0x555555555555555
cmp qword [rbp + 0x10], rax
je 0x1401ed870
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
mov ecx, 0x30
call fcn.14031dc78
mov rdi, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x20], xmm1
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
movss xmm3, dword [rbp]
xorps xmm0, xmm0
test rcx, rcx
js 0x1401ed713
cvtsi2ss xmm0, rcx
jmp 0x1401ed728
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1401ed73b
cvtsi2ss xmm2, rbx
jmp 0x1401ed753
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
seta al
test al, al
je 0x1401ed7f3
divss xmm0, xmm3
call fcn.140338164
xor ecx, ecx
movss xmm1, dword [0x14048ccf0]
comiss xmm0, xmm1
jb 0x1401ed796
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1401ed796
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401ed7c8
cmp rbx, 0x200
jae 0x1401ed7c5
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1401ed7c8
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.140217d20
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1401eba50
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1401ed830
mov qword [rcx + rax*8], rdi
jmp 0x1401ed842
cmp r9, rdx
jne 0x1401ed83b
mov qword [rcx + rax*8], rdi
jmp 0x1401ed847
cmp qword [rcx + rax*8 + 8], r8
jne 0x1401ed847
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, [0x1404a16d0]
call fcn.14031f248
int3
Function at 0x1401ed880
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
xor r9d, r9d
mov r10, qword [r8 + 8]
mov rdx, qword [r8 + 0x10]
add rdx, r10
cmp r10, rdx
jae 0x1401ed8d3
nop word [rax + rax]
lea r9, [r9 + r9*4]
movsx rax, byte [r10]
add r9, rax
inc r10
cmp r10, rdx
jb 0x1401ed8c0
imul r14, qword [r8], 0x1000193
xor r14, r9
mov r9, r14
lea rdx, [rsp + 0x20]
call fcn.1401eba50
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1401ed900
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1401edaa8
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
je 0x1401edaca
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0
mov ecx, 0x38
call fcn.14031dc78
mov rdi, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x20], xmm1
movsd xmm0, qword [rbx + 0x20]
movsd qword [rax + 0x30], xmm0
mov r9, qword [rbp + 0x10]
lea rcx, [r9 + 1]
movss xmm3, dword [rbp]
xorps xmm0, xmm0
test rcx, rcx
js 0x1401ed96d
cvtsi2ss xmm0, rcx
jmp 0x1401ed982
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1401ed995
cvtsi2ss xmm2, rbx
jmp 0x1401ed9ad
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
seta al
test al, al
je 0x1401eda4d
divss xmm0, xmm3
call fcn.140338164
xor ecx, ecx
movss xmm1, dword [0x14048ccf0]
comiss xmm0, xmm1
jb 0x1401ed9f0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1401ed9f0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401eda22
cmp rbx, 0x200
jae 0x1401eda1f
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1401eda22
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.140217d20
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1401eba50
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
lea rax, [r9 + 1]
mov qword [rbp + 0x10], rax
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1401eda8a
mov qword [rcx + rax*8], rdi
jmp 0x1401eda9c
cmp r9, rdx
jne 0x1401eda95
mov qword [rcx + rax*8], rdi
jmp 0x1401edaa1
cmp qword [rcx + rax*8 + 8], r8
jne 0x1401edaa1
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, [0x1404a16d0]
call fcn.14031f248
int3
Function at 0x140207bb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov r12, r8
mov r15, rdx
mov rsi, rcx
lea rdi, [rcx + 0x88]
xor r9d, r9d
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x140207db4
xor ebp, ebp
cmp dword [rsp + 0x90], ebp
je 0x140207cc5
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 4
mov rax, qword [rsi + 0xe8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x140207caf
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x140207c42
mov rcx, qword [rcx]
cmp byte [rdx + 0x43], 0
je 0x140207c57
mov r8, qword [rdx + 0x60]
test r8, r8
jne 0x140207c5b
mov r8, qword [rdx + 0x28]
jmp 0x140207c5b
mov r8, qword [rdx + 0x50]
mov rax, rbp
test rcx, rcx
je 0x140207c79
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140207c70
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x40]
call fcn.1401ed630
mov rax, qword [rbx]
mov rbx, rax
cmp rax, qword [rsi + 0xe8]
jne 0x140207c30
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140207db4
movups xmm1, xmmword [r12]
mov rdx, rbp
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r8, xmm0
movq rcx, xmm1
add r8, rcx
cmp rcx, r8
jae 0x140207d03
nop dword [rax + rax]
lea rdx, [rdx + rdx*4]
movsx rax, byte [rcx]
add rdx, rax
inc rcx
cmp rcx, r8
jb 0x140207cf0
imul rcx, r15, 0x1000193
xor rcx, rdx
and rcx, qword [rsi + 0x70]
add rcx, rcx
mov rax, qword [rsi + 0x58]
mov rbx, qword [rax + rcx*8 + 8]
mov rsi, qword [rsi + 0x48]
cmp rbx, rsi
je 0x140207d98
mov rdi, qword [rax + rcx*8]
nop word [rax + rax]
cmp r15, qword [rbx + 0x10]
jne 0x140207d7f
movups xmm1, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x20], xmm0
psrldq xmm0, 8
movq r8, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp r8, rax
jne 0x140207d7f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
je 0x140207d8a
test r8, r8
jle 0x140207d8a
call fcn.1403229e0
test eax, eax
je 0x140207d8a
cmp rbx, rdi
je 0x140207d98
mov rbx, qword [rbx + 8]
jmp 0x140207d30
test rbx, rbx
je 0x140207d98
cmp rbx, rsi
je 0x140207d98
mov rbp, qword [rbx + 0x28]
mov rax, rbp
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140333208
int3
Function at 0x140207e60
Capabilities:
Hash data using fnv

Disassembly:
mov r9, qword [rcx + 0xe8]
movsxd rax, r8d
imul r10, rax, 0x1000193
imul rax, rdx, 0x100011b
xor r10, rax
and r10, qword [rcx + 0x110]
shl r10, 4
add r10, qword [rcx + 0xf8]
mov rax, qword [r10 + 8]
cmp rax, r9
je 0x140207ec8
mov rcx, qword [r10]
nop dword [rax]
cmp rdx, qword [rax + 0x10]
jne 0x140207eac
cmp r8d, dword [rax + 0x18]
je 0x140207eb7
cmp rax, rcx
je 0x140207ec8
mov rax, qword [rax + 8]
jmp 0x140207ea0
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x140207ec8
mov rax, qword [rax + 0x20]
ret
xor eax, eax
ret

Function at 0x140208190
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x50
movups xmm1, xmmword [r9]
mov qword [rsp + 0x60], rbx
mov rsi, rdx
mov qword [rsp + 0x68], rbp
mov rdx, rcx
mov qword [rsp + 0x78], r12
movq r11, xmm1
mov r12, r9
mov qword [rsp + 0x48], r14
xor r14d, r14d
mov qword [rsp + 0x40], r15
movdqa xmm0, xmm1
mov rbp, r8
psrldq xmm0, 8
mov r10d, r14d
movq r9, xmm0
add r9, r11
cmp r11, r9
jae 0x1402081f3
movsx rax, byte [r11]
lea r10, [r10 + r10*4]
add r10, rax
inc r11
cmp r11, r9
jb 0x1402081e0
mov rax, qword [rdx + 0x18]
mov r15, qword [rdx + 8]
imul rcx, rbp, 0x1000193
mov qword [rsp + 0x70], rdi
xor rcx, r10
and rcx, qword [rdx + 0x30]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r15
je 0x14020827f
mov rdi, qword [rax + rcx*8]
nop
cmp rbp, qword [rbx + 0x10]
jne 0x14020826f
movups xmm1, xmmword [rbx + 0x18]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
psrldq xmm0, 8
psrldq xmm1, 8
movq r8, xmm0
movq rax, xmm1
cmp r8, rax
jne 0x14020826f
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
je 0x14020827a
test r8, r8
jle 0x14020827a
call fcn.1403229e0
test eax, eax
je 0x14020827a
cmp rbx, rdi
je 0x14020827f
mov rbx, qword [rbx + 8]
jmp 0x140208220
test rbx, rbx
jne 0x140208282
mov rbx, r15
movups xmm1, xmmword [0x1405d9c50]
mov r12, qword [rsp + 0x78]
lea rax, [rbx + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rbx, r15
mov r15, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x68]
cmovne r14, rax
mov rbx, qword [rsp + 0x60]
test r14, r14
jne 0x1402082b7
movups xmm0, xmm1
jmp 0x1402082bb
movups xmm0, xmmword [r14]
mov r14, qword [rsp + 0x48]
movd eax, xmm0
cmp eax, dword [rsp + 0x80]
mov rax, rsi
je 0x1402082d9
movups xmmword [rsi], xmm1
add rsp, 0x50
pop rsi
ret
movups xmmword [rsi], xmm0
add rsp, 0x50
pop rsi
ret

Function at 0x140208970
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx + 0x10]
mov r10, rcx
mov r9, qword [rax + 0x90]
movsxd rax, edx
imul r8, rax, 0x1000193
imul rax, rcx, 0x100011b
mov rcx, qword [r9 + 0x138]
xor r8, rax
and r8, qword [r9 + 0x150]
shl r8, 4
add rcx, r8
mov r8, qword [r9 + 0x128]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1402089e7
mov rcx, qword [rcx]
nop word [rax + rax]
cmp r10, qword [rax + 0x10]
jne 0x1402089cb
cmp edx, dword [rax + 0x18]
je 0x1402089d6
cmp rax, rcx
je 0x1402089e7
mov rax, qword [rax + 8]
jmp 0x1402089c0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1402089e7
mov rax, qword [rax + 0x20]
ret
xor eax, eax
ret
Function at 0x1402099c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x1405bdab8]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rsi, rdx
mov r13, rcx
xor r14d, r14d
mov dword [rbp - 0x49], r14d
mov qword [rbp - 0x41], rcx
mov qword [rbp - 0x39], r8
lea rbx, [rcx + 0x1a0]
xor r9d, r9d
lea r8, [rbp - 0x49]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
test eax, eax
je 0x140209bf7
cmp dword [rbp - 0x49], r14d
je 0x140209a59
mov qword [rbp - 0x31], rbx
mov dword [rbp - 0x29], 4
lea rcx, [rbp - 0x41]
call fcn.1401fadf0
nop
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
test eax, eax
je 0x140209bf7
mov qword [rbp - 0x21], r14
mov rcx, r14
mov qword [rbp - 0x11], rcx
mov edi, recv
mov qword [rbp - 9], rdi
mov byte [rbp - 0x21], cl
mov dword [rbp - 0x49], 1
mov r12, qword [rsi + 8]
mov rsi, qword [rsi]
mov rbx, rsi
cmp rsi, r12
je 0x140209b22
lea rax, [rbp - 1]
mov r15, 0xfffffffffffffff0
sub r15, rax
cmp rbx, rsi
je 0x140209ae6
mov rax, rdi
sub rax, rcx
cmp rax, 1
jb 0x140209ac6
lea rax, [rcx + 1]
mov qword [rbp - 0x11], rax
lea rax, [rbp - 0x21]
cmp rdi, 0x10
cmovae rax, qword [rbp - 0x21]
mov word [rax + rcx], 0x2c
jmp 0x140209ae6
mov qword [rsp + 0x20], 1
lea r9, [0x14048c658]
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x21]
call fcn.1400f8cc0
lea rax, [rbp + 0xf]
mov qword [rbp - 1], rax
lea rdx, [rbp + 0xf]
mov ecx, dword [rbx]
call fcn.140237c30
add rax, r15
mov qword [rbp + 7], rax
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x21]
call fcn.140238700
add rbx, 4
mov rdi, qword [rbp - 9]
mov rcx, qword [rbp - 0x11]
cmp rbx, r12
jne 0x140209a98
lea r8, [rbp - 0x21]
mov rbx, qword [rbp - 0x21]
cmp rdi, 0x10
cmovae r8, rbx
movabs r9, 0xcbf29ce484222325
mov rdx, r14
test rcx, rcx
je 0x140209b64
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + r8]
xor r9, rax
imul r9, r10
inc rdx
cmp rdx, rcx
jb 0x140209b50
lea r8, [rbp - 0x21]
lea rdx, [rbp - 0x31]
lea rcx, [r13 + 0x1a8]
call fcn.1401ebb40
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140209b8e
cmp rcx, qword [r13 + 0x1b0]
je 0x140209b8e
mov r14, qword [rcx + 0x30]
cmp rdi, 0x10
jb 0x140209bc1
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140209bb9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140209bf1
mov rcx, rbx
call fcn.14031dc44
mov rax, r14
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14031e660
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14032c23c
int3
call fcn.140333208
int3
Function at 0x140212e90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x1405bdab8]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r8, rdx
mov r13, rcx
cmp qword [rcx + 8], 0
jne 0x140212ed0
xor al, al
jmp 0x14021305b
mov rdx, qword [rdx]
xor ebx, ebx
mov edi, recv
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov byte [rsp + 0x30], bl
test rdx, rdx
jne 0x140212ef6
mov esi, ebx
jmp 0x140212f0e
mov r8, qword [r8 + 8]
lea rcx, [rsp + 0x30]
call fcn.1400f6dc0
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov r8, qword [r13 + 0x20]
lea rcx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
cmp rdi, 0x10
cmovae rcx, r14
movabs rdx, 0xcbf29ce484222325
test rsi, rsi
je 0x140212f53
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rbx + rcx]
xor rdx, rax
imul rdx, r9
inc rbx
cmp rbx, rsi
jb 0x140212f40
mov rcx, qword [r8 + 0x48]
and rcx, rdx
add rcx, rcx
mov rax, qword [r8 + 0x30]
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r8 + 0x20]
je 0x140212fb2
mov r15, qword [rax + rcx*8]
lea rdx, [rbx + 0x10]
cmp qword [rbx + 0x28], 0x10
jb 0x140212f7f
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
cmp rdi, 0x10
cmovae rcx, r14
cmp rsi, qword [rbx + 0x20]
jne 0x140212f9e
mov r8, rsi
call fcn.1403229e0
test eax, eax
je 0x140212fa9
cmp rbx, r15
je 0x140212fb2
mov rbx, qword [rbx + 8]
jmp 0x140212f70
test rbx, rbx
je 0x140212fb2
xor bl, bl
jmp 0x140213025
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1402677a0
lea rax, vtable.google::protobuf::FileDescriptorProto.0
mov qword [rsp + 0x50], rax
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
call qword [rax + VariantCopy]
test al, al
je 0x140212ff8
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.1401f97c0
test rax, rax
je 0x140212ff8
mov bl, 1
jmp 0x140213011
mov rcx, qword [r13 + 0x20]
add rcx, 0x18
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.1401ee200
xor bl, bl
lea rcx, [rsp + 0x50]
call fcn.140268aa0
mov rdi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x30]
cmp rdi, 0x10
jb 0x140213058
lea rdx, [rdi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140213050
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140213083
mov rcx, r14
call fcn.14031dc44
movzx eax, bl
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14031e660
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
call fcn.14032c23c
int3
Function at 0x140217b80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140217d06
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x38], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140216f60
mov rcx, qword [rsi + 8]
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140217ccb
nop dword [rax + rax]
movsxd r9, dword [rcx + 0x18]
mov rdi, qword [rcx + 0x10]
mov rdx, qword [rdx]
imul r11, r9, 0x1000193
imul rax, rdi, 0x100011b
xor r11, rax
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x140217c3c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140217cbf
mov rax, qword [r11 + 8]
cmp rdi, qword [rax + 0x10]
jne 0x140217c7b
cmp r9d, dword [rax + 0x18]
jne 0x140217c7b
mov r10, qword [rax]
cmp r10, rcx
je 0x140217c75
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140217cbf
mov r10, rax
cmp r8, rax
je 0x140217c9b
mov rax, qword [rax + 8]
mov r10, rax
cmp rdi, qword [rax + 0x10]
jne 0x140217c96
cmp r9d, dword [rax + 0x18]
je 0x140217ce0
cmp r8, rax
jne 0x140217c83
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140217c00
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140217cbf
lea rcx, [0x1404a1680]
call fcn.14031f248
int3
Function at 0x1402184a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x140218683
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140216f60
mov rdx, qword [rsi + 8]
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x140218648
mov qword [rsp + 0x30], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x1402185bc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140218637
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x1402185f9
mov r10, qword [rax]
cmp r10, rcx
je 0x1402185f3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140218637
mov r8, rax
cmp r10, rax
je 0x140218613
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14021865d
cmp r10, rax
jne 0x140218601
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x140218540
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140218637
lea rcx, [0x1404a1680]
call fcn.14031f248
int3