joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003c818
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r9, rdx
mov r15, qword [rdx + 0x10]
mov rbx, rcx
jb 0x14003c845
mov rdx, qword [rdx]
xor r10d, r10d
lea r11, [r15 + r15]
movabs r8, 0xcbf29ce484222325
mov ecx, r10d
test r11, r11
je 0x14003c87b
movzx eax, byte [rcx + rdx]
movabs rdi, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdi
cmp rcx, r11
jb 0x14003c85e
mov r14, qword [rbx + 0x30]
mov r12, qword [rbx + 0x18]
and r14, r8
mov rdi, qword [rbx + 8]
add r14, r14
mov rax, qword [r12 + r14*8]
cmp qword [r12 + r14*8], rdi
jne 0x14003c89c
mov rcx, rdi
jmp 0x14003c8a4
mov rcx, qword [r12 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14003c98c
cmp qword [r9 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r9
jb 0x14003c8be
mov rdx, qword [r9]
cmp qword [rcx + 0x18], 8
mov r8, qword [rcx + 0x10]
jb 0x14003c8cc
mov rcx, qword [rcx]
cmp r8, r15
jne 0x14003c907
test r8, r8
je 0x14003c90c
movzx r11d, word [rcx]
movzx ebx, word [rdx]
cmp r11w, bx
jb 0x14003c907
sub rcx, rdx
cmp r11w, bx
ja 0x14003c907
cmp r8, 1
je 0x14003c90c
add rdx, 2
dec r8
movzx r11d, word [rdx + rcx]
movzx ebx, word [rdx]
cmp r11w, bx
jae 0x14003c8ea
mov rax, qword [rax]
jmp 0x14003c891
mov r8, rax
mov rcx, rax
cmp qword [r12 + r14*8], rdi
jne 0x14003c91d
mov rdx, rdi
jmp 0x14003c925
mov rdx, qword [r12 + r14*8 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x14003c987
lea rdx, [rax + 0x10]
cmp qword [rdx + 0x18], 8
mov r11, qword [rdx + 0x10]
jb 0x14003c93c
mov rdx, qword [rdx]
cmp qword [r9 + 0x18], 8
mov rsi, r9
jb 0x14003c949
mov rsi, qword [r9]
cmp r15, r11
jne 0x14003c987
mov rbp, r15
test r15, r15
je 0x14003c994
movzx r11d, word [rsi]
movzx ebx, word [rdx]
cmp r11w, bx
jb 0x14003c987
sub rsi, rdx
cmp r11w, bx
ja 0x14003c987
cmp rbp, 1
je 0x14003c994
add rdx, 2
dec rbp
movzx r11d, word [rdx + rsi]
movzx ebx, word [rdx]
cmp r11w, bx
jae 0x14003c966
cmp r8, rax
jne 0x14003c9a2
mov rcx, rdi
mov rax, rdi
jmp 0x14003c9a2
mov rax, qword [rax]
jmp 0x14003c912
mov rcx, qword [rcx]
inc r10
cmp rcx, rax
jne 0x14003c99c
mov rbx, qword [rsp + 0x20]
mov rax, r10
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x14003de10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x14003de4d
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x14003de80
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r11
jb 0x14003de62
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov rbx, qword [r9 + 8]
mov r12, qword [rcx + rax*8]
cmp rbx, r12
je 0x14003df4e
mov rbx, qword [rcx + rax*8 + 8]
mov rbx, qword [rbx]
cmp rbx, r12
je 0x14003df4e
mov rbx, qword [rbx + 8]
lea rax, [rbx + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14003dec9
mov rax, qword [rax]
mov r11, r10
cmp qword [r10 + 0x18], 8
jb 0x14003ded6
mov r11, qword [r10]
cmp r15, rcx
jne 0x14003deaa
mov r14, r15
test r15, r15
je 0x14003df13
movzx ecx, word [r11]
movzx edx, word [rax]
cmp cx, dx
jb 0x14003deaa
sub r11, rax
cmp cx, dx
ja 0x14003deaa
cmp r14, 1
je 0x14003df13
dec r14
add rax, 2
movzx ecx, word [r11 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x14003def5
jmp 0x14003deaa
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
lea rcx, [rdi + 0x10]
xor edx, edx
call fcn.14000b630
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14003dfe4
mov rdx, qword [rdi]
cmp rbx, rdx
je 0x14003df83
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx + 8]
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
mov qword [rdi + 8], rcx
add r8, r8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r9 + 8]
jne 0x14003dfa3
mov qword [rdx + r8*8], rdi
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x14003dfd2
cmp rax, rbx
jne 0x14003dfae
mov qword [rdx + r8*8], rdi
jmp 0x14003dfd2
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x14003dfd2
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.14003e084
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14003e134
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14003e161
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14003e190
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14003e172
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14003e1c8
cmp qword [rcx + rdx*8], rdi
jne 0x14003e1bd
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14003e1c1
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14003e1d5
cmp qword [rcx + rdx*8], rdi
jne 0x14003e1d5
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
xor edx, edx
dec qword [r8 + 0x10]
call fcn.14000b630
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003e384
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x14003e3a6
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x14003e3d5
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x14003e3b7
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14003e40d
cmp qword [rcx + rdx*8], r8
jne 0x14003e402
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14003e406
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14003e41a
cmp qword [rcx + rdx*8], r8
jne 0x14003e41a
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.14003e25c
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14003e678
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x14003e6a5
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14003e6d4
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x14003e6b6
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14003e70c
cmp qword [rcx + rdx*8], rdi
jne 0x14003e701
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x14003e705
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14003e719
cmp qword [rcx + rdx*8], rdi
jne 0x14003e719
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140036d68
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400435a4
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rcx
lea rax, [0x1402c7e88]
mov qword [rcx + 8], rax
lea rax, [0x1402b6548]
mov qword [rcx], rax
lea rax, [0x1402b65e0]
mov qword [rcx + 0xc0], rax
mov dword [rcx + 0x10], edx
xor esi, esi
mov byte [rcx + 0x14], sil
add rcx, 0x18
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x18], 7
mov word [rcx], si
lea rdx, str.InvalidApp
call fcn.14000b3a4
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x40], rsi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x50], rsi
lea rcx, [rbx + 0x58]
call fcn.140044f04
nop
lea rcx, [rbx + 0x68]
call fcn.140044f78
lea rcx, [rbx + 0x78]
call fcn.140044fe0
mov qword [rbx + 0x88], rsi
or dword [rbx + 0x90], 0xffffffff
mov byte [rbx + 0x94], sil
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
nop dword [rax]
mov dword [rbx + 0x90], eax
cmp eax, 0xffffffff
jne 0x140043660
lea ecx, [rsi + 7]
int 0x29
lea rcx, str._e_
mov qword [rbx + 0x98], rcx
mov qword [rbx + 0xa0], rcx
test rcx, rcx
je 0x140043688
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov qword [rbx + 0xa8], rsi
mov qword [rbx + 0xb0], rsi
mov qword [rbx + 0xb8], rsi
call fcn.14000fe28
mov qword [rbx + 0xb0], rax
call fcn.140063720
nop
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x140045e60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140045e82
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x140045eb1
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x140045e93
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140045ee9
cmp qword [rcx + rdx*8], r8
jne 0x140045ede
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140045ee2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140045ef6
cmp qword [rcx + rdx*8], r8
jne 0x140045ef6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140045d64
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400469d8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov r14, rdx
mov r15, rcx
mov r11, qword [r8 + 0x10]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x140046a0e
mov r9, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r10, [r11 + r11]
xor ecx, ecx
test r10, r10
je 0x140046a41
movzx eax, byte [rcx + r9]
xor rdx, rax
movabs rbx, 0x100000001b3
imul rdx, rbx
inc rcx
cmp rcx, r10
jb 0x140046a23
mov rsi, qword [r15 + 0x30]
and rsi, rdx
mov rdi, rsi
add rdi, rdi
mov rax, qword [r15 + 0x18]
mov rbx, qword [r15 + 8]
mov r12, qword [rax + rdi*8]
cmp r12, rbx
jne 0x140046a64
mov rdi, rbx
jmp 0x140046a6c
mov rdi, qword [rax + rdi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x140046ae1
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x140046a87
mov rax, qword [rax]
mov r9, r8
cmp qword [r8 + 0x18], 8
jb 0x140046a94
mov r9, qword [r8]
cmp r11, rcx
jne 0x140046a6c
mov r10, r11
test r11, r11
je 0x140046ad1
movzx ecx, word [r9]
movzx edx, word [rax]
cmp cx, dx
jb 0x140046a6c
sub r9, rax
cmp cx, dx
ja 0x140046a6c
cmp r10, 1
je 0x140046ad1
dec r10
add rax, 2
movzx ecx, word [r9 + rax]
movzx edx, word [rax]
cmp cx, dx
jae 0x140046ab3
jmp 0x140046a6c
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140046bc7
mov rbx, qword [rbx]
mov r12, qword [rbx + 8]
mov r9, r8
mov r8, r12
mov rdx, rbx
call fcn.14003e4dc
mov rdx, rax
mov rax, qword [r15 + 0x10]
movabs rcx, 0x555555555555554
sub rcx, rax
cmp rcx, 1
jb 0x140046bd9
inc rax
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [r12], rdx
mov rax, qword [r15 + 8]
mov rbx, qword [rax]
mov qword [rsp + 0x70], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x140046b68
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rax, qword [r15 + 8]
add rsi, rsi
mov rdx, qword [r15 + 0x18]
cmp qword [rdx + rsi*8], rax
jne 0x140046b84
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x140046bb4
cmp qword [rdx + rsi*8], rdi
jne 0x140046b90
mov qword [rdx + rsi*8], rbx
jmp 0x140046bb4
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x140046bb4
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.14003e084
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.list_T__too_long
call fcn.1402328c4
int3
Function at 0x1400537f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [r8 + 0x18], 8
mov rsi, rdx
mov rbx, qword [r8 + 0x10]
mov r15, rcx
mov r10, r8
jb 0x140053827
mov r10, qword [r8]
lea rdx, [rbx + rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x14005385a
movzx eax, byte [rcx + r10]
movabs r11, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r11
cmp rcx, rdx
jb 0x14005383c
mov r14, qword [r15 + 0x30]
mov r13, qword [r15 + 0x18]
and r14, r9
mov r11, qword [r15 + 8]
add r14, r14
mov rax, qword [r13 + r14*8]
cmp qword [r13 + r14*8], r11
jne 0x14005387d
mov rcx, r11
jmp 0x140053885
mov rcx, qword [r13 + r14*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140053957
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x14005389f
mov rdx, qword [r8]
mov r12, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r12, 8
jb 0x1400538b0
mov rcx, qword [rcx]
cmp rbp, rbx
jne 0x1400538f0
mov rdi, rbp
test rbp, rbp
je 0x1400538f8
movzx r9d, word [rcx]
movzx r10d, word [rdx]
cmp r9w, r10w
jb 0x1400538f0
sub rcx, rdx
cmp r9w, r10w
ja 0x1400538f0
cmp rdi, 1
je 0x1400538f8
add rdx, 2
dec rdi
movzx r9d, word [rcx + rdx]
movzx r10d, word [rdx]
cmp r9w, r10w
jae 0x1400538d2
mov rax, qword [rax]
jmp 0x140053871
lea rcx, [rax + 0x10]
cmp r12, 8
jb 0x140053905
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
mov rdx, r8
jb 0x140053912
mov rdx, qword [r8]
cmp rbx, rbp
jne 0x14005394f
test rbx, rbx
je 0x140053952
movzx r9d, word [rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jb 0x14005394f
sub rdx, rcx
cmp r9w, r10w
ja 0x14005394f
cmp rbx, 1
je 0x140053952
add rcx, 2
dec rbx
movzx r9d, word [rcx + rdx]
movzx r10d, word [rcx]
cmp r9w, r10w
jae 0x140053931
mov rax, r11
mov rcx, rax
jmp 0x14005395d
mov rax, r11
mov rcx, r11
cmp rcx, r11
jne 0x1400539c3
mov rbx, qword [r11]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r8
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.140053c28
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400539ea
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov rdx, rsi
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140045afc
jmp 0x1400539ca
mov qword [rsi], rax
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x68]
mov rax, rsi
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1402328c4
int3
Function at 0x14005af00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r9, rcx
mov rbx, rdx
movabs rcx, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x14005af19
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005af71
cmp qword [rcx + rdx*8], r8
jne 0x14005af66
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x14005af6a
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14005af7e
cmp qword [rcx + rdx*8], r8
jne 0x14005af7e
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r9 + 8]
mov rdx, rbx
call fcn.14005af94
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14005b100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x14005b137
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r11, qword [rcx + rax*8]
cmp r11, rdi
je 0x14005b17c
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r11
je 0x14005b1b4
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov eax, dword [rdi + 0x10]
cmp dword [r9], eax
jne 0x14005b17f
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 8]
call fcn.14005af94
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005b2b0
mov r9, qword [rbx]
cmp rdx, r9
je 0x14005b1e9
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14005b209
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14005b238
cmp rax, rdx
jne 0x14005b214
mov qword [r9 + r8*8], rbx
jmp 0x14005b238
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14005b238
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x14005b259
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14005b26a
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14005b2a5
cmp rdx, 0x200
jae 0x14005b282
shl rdx, 3
jmp 0x14005b294
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005b294
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rcx, rsi
call fcn.14005aeb0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14005c174
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x30
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
test rcx, rcx
je 0x14005c2c0
test rdx, rdx
je 0x14005c2c0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x14005c1ae
lea rcx, [rbx + 1]
call fcn.140261ad4
mov r8, rax
test rax, rax
je 0x14005c2f6
mov rcx, rbp
test rbx, rbx
je 0x14005c1ea
mov al, byte [rsi + rcx*2]
shr al, 1
and al, 0x20
or al, byte [rsi + rcx*2]
mov byte [r8 + rcx], al
inc rcx
cmp rcx, rbx
jb 0x14005c1d4
lea rax, [rbx + r8]
mov byte [rax], bpl
movabs rdx, 0xcbf29ce484222325
mov rcx, r8
cmp r8, rax
cmova rbx, rbp
movabs r11, 0x100000001b3
test rbx, rbx
je 0x14005c22c
movzx eax, byte [rcx]
xor rdx, rax
imul rdx, r11
inc rcx
mov rax, rcx
sub rax, r8
cmp rax, rbx
jb 0x14005c214
lea r10, [0x1402ca150]
mov r9, r10
lea rax, [0x1402ca160]
cmp rax, r10
sbb rcx, rcx
not rcx
and ecx, 0x10
jbe 0x14005c264
movzx eax, byte [r9]
xor rdx, rax
imul rdx, r11
inc r9
mov rax, r9
sub rax, r10
cmp rax, rcx
jb 0x14005c24b
mov rcx, rdx
movabs rax, 0xfffffffffffffff
and rcx, rax
shr rdx, 0x3c
xor rcx, rdx
mov dword [rdi], 0x66006f
mov eax, 0x30
mov word [rdi + 0x1c], ax
lea edx, [rax - 0x23]
mov rax, rcx
and eax, 0x1f
lea r9, str.abcdefghijklmnopqrstuvwxyz123456
movzx eax, word [r9 + rax*2]
mov word [rdi + rdx*2], ax
shr rcx, 5
dec rdx
cmp rdx, 2
jae 0x14005c28d
mov word [rdi + 0x1e], bp
mov rcx, r8
call fcn.140261814
xor eax, eax
jmp 0x14005c2e1
lea r9, str.FeatureMapping.cpp___GetBaseFlightName___Cant_convert_featurename_to_flightname._Invalid_buffer_parameter_or_featurename.
mov edx, 0x43b
mov ecx, 0x270d8e2
mov r8d, 0xa
call fcn.140143574
mov eax, 0x80070057
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call fcn.140147a48
nop
jmp 0x14005c2fe
nop
nop