joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032914
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
lea rcx, [0x140041a40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041a30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003299d
lea rcx, [0x140041a58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserSendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003299d
lea rcx, [0x140041a6c]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.SendInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14003299d
xor al, al
jmp 0x140032a4f
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041a78]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140032a1f
lea rcx, [0x140041ab0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtUserGetAsyncKeyState
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140032a1f
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [0x140041ab8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140032a1f
xor al, al
jmp 0x140032a4f
mov r8d, 0x1e
mov rdx, qword [rsp + 0x20]
lea rcx, [0x140049610]
call fcn.14003a0fe
mov r8d, 0x1e
mov rdx, qword [rsp + 0x28]
lea rcx, [0x140049630]
call fcn.14003a0fe
mov al, 1
add rsp, 0x38
ret
Function at 0x140033988
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400339ba
xor eax, eax
jmp 0x140033a10
mov r8d, 0x1e
lea rdx, [0x140049630]
mov rcx, qword [rsp + 0x28]
call fcn.14003a0fe
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
call qword [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov r8d, 0x1000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, dword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x14003464c
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x44], 0xc0000001
mov dword [rsp + 0x50], 0x30
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x68], 0x240
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwOpenKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034722
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x140034712
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
jmp 0x1400347b4
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x50]
mov edx, 0xf003f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x1400347a9
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xa8]
xor r8d, r8d
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jl 0x1400347a9
mov byte [rsp + 0x40], 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_ZwClose]
mov al, byte [rsp + 0x40]
add rsp, 0x88
ret
Function at 0x140037604
Capabilities:
Create thread
Hide graphical window

Disassembly:
push rdi
sub rsp, 0xc0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14003403c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
mov qword [rsp + 0xa0], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x88], 0
lea rax, [0x1400344f4]
mov qword [rsp + 0x78], rax
lea rax, [0x1400417b8]
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x70], 3
lea rcx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x1400376bc
lea rdx, str._n_n_notepad
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140028c90
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [rsp + 0x64], eax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0x80000000
xor r8d, r8d
lea rdx, [0x1400417d0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140049680], rax
mov edx, 5
mov rcx, qword [0x140049680]
call qword [sym.imp.USER32.dll_ShowWindow]
lea rdx, [0x1400417a8]
mov rcx, qword [0x140049680]
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov r8d, 0x800a0
mov edx, 0xffffffec
mov rcx, qword [0x140049680]
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, qword [0x140049680]
call qword [sym.imp.USER32.dll_UpdateWindow]
add rsp, 0xc0
pop rdi
ret
Function at 0x140038e1c
Capabilities:
Create thread
Execute command

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0xc0
mov rax, qword [0x140048ac0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rcx, str.color_3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x140041720]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsp + 0x58], rax
call fcn.140032914
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x14003392c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.140032b18
lea rdx, [0x14003744c]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [0x140041724]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.14002ca00
mov rcx, rax
call fcn.14002c7a0
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call fcn.140028c90
cmp qword [0x1400490f0], 0
jne 0x140038f4e
lea rdx, str.Fortnite
lea rcx, [rsp + 0x80]
call fcn.14002b220
lea rcx, [rsp + 0x80]
call fcn.140035e28
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400490f0], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140038f04
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rdx, [0x140041738]
mov rcx, qword [rsp + 0x48]
call fcn.14002b8a0
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.140034cbc
mov dword [0x1400490f8], eax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
xor edx, edx
mov rcx, qword [0x1400495b0]
call fcn.140032694
movzx eax, al
test eax, eax
je 0x140038fd0
mov edx, dword [0x1400490f8]
mov rcx, qword [0x1400495b0]
call fcn.14002cda0
lea rdx, str.FortniteClient_Win64_Shipping.exe
mov rcx, qword [0x1400495b0]
call fcn.1400323cc
mov qword [0x1400490e8], rax
call fcn.140037604
call fcn.140037790
call fcn.1400389e0
call fcn.140038d48
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400395b0
add rsp, 0xc0
pop rdi
ret
Function at 0x140039cb8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140039d02
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140039d02
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140039d02
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140039d02
cmp dword [rcx + 0x84], 0xe
jbe 0x140039d02
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140039d04
xor al, al
add rsp, 0x28
ret
Function at 0x140076eb0
Capabilities:
Hash data using fnv

Disassembly:
mov eax, 0x18
call fcn.1401fb9b0
sub rsp, rax
mov rax, qword [0x1402c4828]
xor rax, rsp
mov qword [rsp + 8], rax
mov r10, r9
mov r11, rcx
mov r9d, edx
test edx, edx
jne 0x140076eed
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1401fba20
add rsp, 0x18
ret
mov r8, qword [r8]
xor edx, edx
mov qword [rsp], r8
movzx eax, byte [rsp + 1]
movzx ecx, r8b
xor ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [rsp + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul ecx, ecx, 0x1000193
mov eax, ecx
div r9d
mov rax, qword [r11 + rdx*8]
lea rdx, [r11 + rdx*8]
test rax, rax
je 0x140076f84
cmp qword [rax + 8], r8
je 0x140076f84
mov rdx, rax
mov rax, qword [rax]
test rax, rax
jne 0x140076f73
test r10, r10
je 0x140076f8c
mov dword [r10], ecx
mov rax, rdx
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.1401fba20
add rsp, 0x18
ret
Function at 0x14008d3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r11, rcx
test rdx, rdx
jne 0x14008d3ce
mov rcx, qword [rcx]
mov dl, 0x30
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax]
mov qword [rsp + 0x30], rbx
lea r9, [rcx + 0x10]
mov qword [rsp + 0x20], rdi
test rdx, rdx
jns 0x14008d4ed
mov rax, rdx
mov byte [rcx + 0x10], 0x2d
cqo
mov ecx, 1
mov r8, rax
xor r8, rdx
sub r8, rdx
mov rdx, r8
cmp r8, 0xa
jb 0x14008d447
movabs r10, 0x346dc5d63886594b
nop
cmp rdx, 0x64
jb 0x14008d4e6
cmp rdx, 0x3e8
jb 0x14008d4de
cmp rdx, 0x2710
jb 0x14008d4d6
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x14008d410
inc ecx
mov r10d, ecx
lea rdi, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
add r9, r10
cmp r8, 0x64
jb 0x14008d4b2
mov qword [rsp + 0x38], rsi
movabs rsi, 0x47ae147ae147ae15
nop dword [rax + rax]
mov rcx, r8
mov rax, rsi
mul r8
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub rcx, rax
mov eax, ecx
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
add r9, 0xfffffffffffffffe
movzx eax, byte [rcx + rdi]
mov byte [r9], al
cmp r8, 0x64
jae 0x14008d470
mov rsi, qword [rsp + 0x38]
cmp r8, 0xa
jb 0x14008d54a
mov eax, r8d
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
movzx eax, byte [rcx + rdi]
mov byte [r9 - 2], al
jmp 0x14008d552
add ecx, 3
jmp 0x14008d447
add ecx, 2
jmp 0x14008d447
inc ecx
jmp 0x14008d447
mov ecx, 1
cmp rdx, 0xa
jb 0x14008d449
movabs r10, 0x346dc5d63886594b
cmp rdx, 0x64
jb 0x14008d447
cmp rdx, 0x3e8
jb 0x14008d542
cmp rdx, 0x2710
jb 0x14008d53a
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x14008d506
jmp 0x14008d449
add ecx, 3
jmp 0x14008d449
add ecx, 2
jmp 0x14008d449
add r8b, 0x30
mov byte [r9 - 1], r8b
mov rcx, qword [r11]
lea rdx, [r11 + 0x10]
mov r8, r10
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp qword [rax + 8]
Function at 0x1400a09c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400a0b71
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14009cdf0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400a0b36
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400a0ab0
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400a0b25
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x1400a0aed
mov r8, qword [rax]
cmp r8, rcx
je 0x1400a0ae7
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400a0b25
cmp r9, rax
je 0x1400a0b01
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x1400a0b4b
cmp r9, rax
jne 0x1400a0af2
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400a0a60
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400a0b25
lea rcx, str.invalid_hash_bucket_count
call fcn.1401fb102
int3
Function at 0x1400a0e00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400a100f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14009cdf0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400a0fd4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rcx + 0x10]
mov r11, qword [rsi + 0x30]
mov rax, r8
mov rdx, qword [rdx]
shr rax, 8
movzx r9d, al
mov rax, r8
shr rax, 0x10
movzx r10d, r8b
xor r10, rbp
imul r10, rdi
xor r10, r9
movzx r9d, al
imul r10, rdi
mov rax, r8
xor r10, r9
shr rax, 0x18
imul r10, rdi
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x20
imul r10, rdi
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x28
imul r10, rdi
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x30
imul r10, rdi
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x38
imul r10, rdi
xor r10, rax
imul r10, rdi
and r11, r10
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400a0f4c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400a0fc3
mov rax, qword [r11 + 8]
cmp r8, qword [rax + 0x10]
jne 0x1400a0f85
mov r8, qword [rax]
cmp r8, rcx
je 0x1400a0f7f
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400a0fc3
cmp r9, rax
je 0x1400a0f9f
nop word [rax + rax]
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x1400a0fe9
cmp r9, rax
jne 0x1400a0f90
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400a0ea0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400a0fc3
lea rcx, str.invalid_hash_bucket_count
call fcn.1401fb102
int3
Function at 0x1400a36d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402c4828]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp qword [rdx + 0x18], 0x10
mov rbp, r8
mov r8, qword [rdx + 0x10]
mov rbx, rdx
mov r10, qword [rcx]
mov rsi, rcx
jb 0x1400a3708
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov rdi, r10
test r8, r8
je 0x1400a3743
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r8
jb 0x1400a3730
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, r10
call fcn.14008a880
mov rax, qword [rax + 8]
test rax, rax
je 0x1400a37bd
cmp rax, qword [rdi + 8]
je 0x1400a37bd
mov rdx, qword [rax + 0x38]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
test rdx, rdx
je 0x1400a377c
lock inc dword [rdx + 8]
mov rdx, qword [rax + 0x38]
mov rax, qword [rax + 0x30]
mov r9, rbp
mov qword [rsp + 0x28], rdx
mov r8, rbx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.1400b4680
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401fba20
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140097cd0
lea rdx, [0x1402bae88]
lea rcx, [rsp + 0x40]
call fcn.1401fc522
int3
Function at 0x1400a4690
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1402c4828]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rdx
mov r8, qword [rcx + 0x28]
cmp r8, qword [rcx + 0x18]
je 0x1400a4793
movabs r13, 0xcbf29ce484222325
movabs r15, 0x100000001b3
nop dword [rax + rax]
mov rbp, qword [rsi]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x1400a4704
mov rdx, qword [r8]
mov r9, r13
xor eax, eax
test r10, r10
je 0x1400a4723
nop
movzx ecx, byte [rax + rdx]
xor r9, rcx
imul r9, r15
inc rax
cmp rax, r10
jb 0x1400a4710
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.14008a880
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1400a4877
cmp rbx, qword [rbp + 8]
je 0x1400a4877
lea rcx, [rsi + 0x70]
lea r8, [rbx + 0x30]
lea rdx, [rsp + 0x30]
call fcn.14008cac0
mov rbp, qword [rax]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
test al, al
jne 0x1400a485f
cmp qword [rbp + 0x30], 0
je 0x1400a480e
mov r8, qword [rsi + 0x28]
add r8, 0x20
mov qword [rsi + 0x28], r8
cmp r8, qword [rsi + 0x18]
jne 0x1400a46f0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400a47cd
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400a47c8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a4870
mov rcx, r8
call fcn.1401fb3a8
xor al, al
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401fba20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov r8, rdi
mov rdx, qword [rsi + 0x28]
mov rcx, rsi
call fcn.1400a36d0
add qword [rsi + 0x28], 0x20
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1400a4858
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rdi]
jb 0x1400a4853
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400a4870
mov rcx, r8
call fcn.1401fb3a8
mov al, 1
jmp 0x1400a47cf
mov r8, rdi
mov rdx, qword [rsi + 0x28]
mov rcx, rsi
call fcn.1400a36d0
jmp 0x1400a4822
call qword [0x1402118d8]
nop
lea rcx, [rsi + 0x28]
call fcn.14009aed0
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140097cd0
lea rdx, [0x1402bae88]
lea rcx, [rsp + 0x48]
call fcn.1401fc522
int3
Function at 0x1400a48a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp qword [rdx + 0x18], 0x10
mov rsi, rcx
mov rdi, qword [rcx]
mov r8, rdx
mov r10, qword [rdx + 0x10]
jb 0x1400a48d1
mov r8, qword [rdx]
xor ebx, ebx
movabs r14, 0xcbf29ce484222325
mov r9, r14
mov ecx, ebx
movabs rbp, 0x100000001b3
test r10, r10
je 0x1400a4905
movzx eax, byte [rcx + r8]
inc rcx
xor r9, rax
imul r9, rbp
cmp rcx, r10
jb 0x1400a48f1
mov r8, rdx
mov rcx, rdi
lea rdx, [rsp + 0x20]
call fcn.14008a880
mov r8, qword [rax + 8]
test r8, r8
je 0x1400a49ff
cmp r8, qword [rdi + 8]
je 0x1400a49ff
mov r8, qword [r8 + 0x30]
movzx edx, r8b
mov rax, r8
xor rdx, r14
shr rax, 8
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
imul rdx, rbp
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rsi + 0xa0]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rcx, rdx
mov rdx, qword [rsi + 0x78]
shl rcx, 4
add rcx, qword [rsi + 0x88]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400a49f2
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x1400a49ef
nop word [rax + rax]
cmp rax, rcx
je 0x1400a49f2
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x1400a49e0
mov rbx, rax
test rbx, rbx
cmove rbx, rdx
mov rax, qword [rbx + 0x30]
jmp 0x1400a4a01
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret