joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008d7b0
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], r9d
push rdi
push r12
xor r9d, r9d
mov edi, 0x10
mov rbx, r8
mov r11, rcx
mov edx, r9d
lea r10d, [rdi + 9]
test rcx, rcx
je 0x14008d952
test rbx, rbx
je 0x14008d952
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x14008d952
mov ecx, r9d
lea r12, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [r11]
dec edi
mov byte [rsp + rcx + 0x30], al
inc r11
mov bpl, byte [rsp + 0x31]
inc rcx
inc edx
cmp rcx, 3
jne 0x14008d88c
cmp r10d, 4
jb 0x14008d894
movzx edx, byte [rsp + 0x32]
movzx eax, byte [rsp + 0x30]
shr rax, 2
movzx ecx, bpl
shr rcx, 4
mov al, byte [r12 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x30]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r12 + rcx*2]
mov cl, bpl
mov byte [r8 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
shl cl, 2
or rcx, rax
and ecx, 0x3f
mov al, byte [r12 + rcx*2]
mov rcx, r9
mov byte [r8 + 2], al
mov al, byte [r12 + rdx*2]
mov edx, r9d
mov byte [r8 + 3], al
add r8, 4
add r10d, 0xfffffffc
test edi, edi
jne 0x14008d805
test edx, edx
jle 0x14008d934
cmp r10d, 4
jb 0x14008d932
movzx edi, byte [rsp + 0x32]
cmp edx, 1
movzx eax, byte [rsp + 0x30]
mov r11b, 0x3d
movzx ebp, bpl
cmovle ebp, r9d
cmp edx, 2
movzx ecx, bpl
cmovle edi, r9d
shr rax, 2
shr rcx, 4
mov al, byte [r12 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x30]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r12 + rcx*2]
mov byte [r8 + 1], al
cmp edx, 1
jle 0x14008d90c
mov al, bpl
movzx ecx, dil
shl al, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [r12 + rcx*2]
jmp 0x14008d90f
mov al, r11b
mov byte [r8 + 2], al
cmp edx, 2
jle 0x14008d923
movzx eax, dil
and eax, 0x3f
mov r11b, byte [r12 + rax*2]
mov byte [r8 + 3], r11b
mov edx, r9d
add r8, 4
add r10d, 0xfffffffc
test edx, edx
jne 0x14008d941
cmp r10d, 1
jb 0x14008d941
mov byte [r8], r9b
jmp 0x14008d947
mov r9d, 0x800700ea
sub r8d, ebx
mov eax, r9d
mov dword [rsi], r8d
jmp 0x14008d957
mov eax, 0x80070057
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
pop r12
pop rdi
ret
Function at 0x140098cf4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r15, rdx
mov r14, qword [r8 + 0x10]
mov rdx, r8
mov rdi, r8
mov rbp, rcx
jb 0x140098d2a
mov rdx, qword [r8]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x140098d58
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r8, rax
inc rcx
imul r8, r9
cmp rcx, r14
jb 0x140098d3b
mov rax, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and r12, r8
add r12, r12
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x140098d7e
mov rax, rbp
jmp 0x140098d86
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140098dfb
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x140098d9c
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r13, qword [rsi + 0x10]
jb 0x140098dad
mov rcx, qword [rsi]
cmp r13, r14
jne 0x140098dbe
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140098dc8
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x140098d73
cmp qword [rsi + 0x18], 0x10
jb 0x140098dd2
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
jb 0x140098ddc
mov rdi, qword [rdi]
cmp r14, r13
jne 0x140098df3
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140098df6
mov rbx, rbp
mov qword [r15], rbx
jmp 0x140098dfe
mov qword [r15], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140099800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x140099822
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x140099852
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x140099834
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14009988a
cmp qword [rcx + rdx*8], r8
jne 0x14009987f
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x140099883
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140099897
cmp qword [rcx + rdx*8], r8
jne 0x140099897
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.140099690
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14009fcd8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
mov rbp, qword [rdx + 0x10]
mov r15, rcx
mov r8, rdx
jb 0x14009fd0b
mov r8, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rbp, rbp
je 0x14009fd3a
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r9
cmp rcx, rbp
jb 0x14009fd1c
mov r12, qword [r15 + 0x30]
mov rax, qword [r15 + 0x18]
and r12, rdx
mov rsi, qword [r15 + 8]
add r12, r12
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rsi
jne 0x14009fd5b
mov rax, rsi
jmp 0x14009fd63
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14009fdd7
cmp qword [rdi + 0x18], 0x10
lea r14, [rbx + 0x10]
mov rdx, rdi
jb 0x14009fd79
mov rdx, qword [rdi]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
mov r13, qword [r14 + 0x10]
jb 0x14009fd8a
mov rcx, qword [r14]
cmp r13, rbp
jne 0x14009fd9b
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14009fda4
mov rbx, qword [rbx]
mov rax, qword [r15 + 0x18]
jmp 0x14009fd50
cmp qword [r14 + 0x18], 0x10
jb 0x14009fdae
mov r14, qword [r14]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x14009fdbb
mov rcx, qword [rdi]
cmp rbp, r13
jne 0x14009fdcf
mov r8, rbp
mov rdx, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14009fdd2
mov rbx, rsi
mov rax, rbx
jmp 0x14009fddd
mov rbx, rsi
mov rax, rsi
cmp rax, rsi
jne 0x14009fe56
mov rbx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1400a0170
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x14009fe2b
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400992b4
mov rbx, qword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x40]
lea rax, [rbx + 0x30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400b9298
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400b92fd
mov rax, qword [rbx + 0x28]
sub rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, 0x1000
jb 0x1400b92e8
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b9367
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov rax, qword [rbx + 8]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
and qword [rbx + 0x10], 0
mov rcx, qword [rbx + 8]
cmp rdi, rcx
je 0x1400b9351
mov rsi, qword [rdi]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400b933c
and qword [rdi + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
nop
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rsi
mov rcx, qword [rbx + 8]
cmp rsi, rcx
jne 0x1400b931d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
mov rdi, rdx
mov r10, rcx
test rsi, rsi
jne 0x1400b93a8
lea edx, [rsi + 2]
mov r8d, 0x2887612
mov rcx, rdi
call fcn.1400c05c8
mov rax, rdi
jmp 0x1400b94a5
mov dword [rsp + 0x50], r8d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x50]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, 4
jb 0x1400b93b9
mov rdx, qword [r10 + 0x40]
mov r11, qword [r10 + 0x28]
and rdx, rcx
mov rcx, qword [r10 + 0x18]
add rdx, rdx
mov rbx, qword [r11 + rdx*8]
cmp qword [r11 + rdx*8], rcx
jne 0x1400b93f9
mov rax, rcx
jmp 0x1400b9401
mov rax, qword [r11 + rdx*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400b9411
cmp dword [rbx + 0x10], r8d
je 0x1400b9414
mov rbx, qword [rbx]
jmp 0x1400b93ee
mov rbx, rcx
cmp rbx, rcx
jne 0x1400b942e
xor edx, edx
mov r8d, 0x2887613
mov rcx, rdi
call fcn.1400c0190
mov rax, rdi
jmp 0x1400b94a5
test r9, r9
je 0x1400b9488
mov rdx, qword [rsi]
cmp qword [rbx + 0x28], rdx
ja 0x1400b9488
lea r8, [rbx + 0x18]
cmp qword [r8 + 0x18], 8
jb 0x1400b944a
mov r8, qword [r8]
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
je 0x1400b946d
movsxd rdx, eax
mov r8d, 0x2887615
mov rcx, rdi
call fcn.1400c0540
mov rax, rdi
jmp 0x1400b94a5
mov rax, qword [rbx + 0x28]
inc rax
mov qword [rsi], rax
mov rax, rdi
and dword [rdi], 0
and qword [rdi + 8], 0
and dword [rdi + 0x10], 0
jmp 0x1400b94a5
mov rax, qword [rbx + 0x28]
xor edx, edx
inc rax
mov r8d, 0x2887614
mov rcx, rdi
mov qword [rsi], rax
call fcn.1400c0108
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b9370
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400b92fd
mov rax, qword [rbx + 0x28]
sub rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, 0x1000
jb 0x1400b92e8
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b9367
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov rax, qword [rbx + 8]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
and qword [rbx + 0x10], 0
mov rcx, qword [rbx + 8]
cmp rdi, rcx
je 0x1400b9351
mov rsi, qword [rdi]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400b933c
and qword [rdi + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
nop
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdi, rsi
mov rcx, qword [rbx + 8]
cmp rsi, rcx
jne 0x1400b931d
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
nop
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
mov rdi, rdx
mov r10, rcx
test rsi, rsi
jne 0x1400b93a8
lea edx, [rsi + 2]
mov r8d, 0x2887612
mov rcx, rdi
call fcn.1400c05c8
mov rax, rdi
jmp 0x1400b94a5
mov dword [rsp + 0x50], r8d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x50]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, 4
jb 0x1400b93b9
mov rdx, qword [r10 + 0x40]
mov r11, qword [r10 + 0x28]
and rdx, rcx
mov rcx, qword [r10 + 0x18]
add rdx, rdx
mov rbx, qword [r11 + rdx*8]
cmp qword [r11 + rdx*8], rcx
jne 0x1400b93f9
mov rax, rcx
jmp 0x1400b9401
mov rax, qword [r11 + rdx*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400b9411
cmp dword [rbx + 0x10], r8d
je 0x1400b9414
mov rbx, qword [rbx]
jmp 0x1400b93ee
mov rbx, rcx
cmp rbx, rcx
jne 0x1400b942e
xor edx, edx
mov r8d, 0x2887613
mov rcx, rdi
call fcn.1400c0190
mov rax, rdi
jmp 0x1400b94a5
test r9, r9
je 0x1400b9488
mov rdx, qword [rsi]
cmp qword [rbx + 0x28], rdx
ja 0x1400b9488
lea r8, [rbx + 0x18]
cmp qword [r8 + 0x18], 8
jb 0x1400b944a
mov r8, qword [r8]
mov rcx, r9
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
je 0x1400b946d
movsxd rdx, eax
mov r8d, 0x2887615
mov rcx, rdi
call fcn.1400c0540
mov rax, rdi
jmp 0x1400b94a5
mov rax, qword [rbx + 0x28]
inc rax
mov qword [rsi], rax
mov rax, rdi
and dword [rdi], 0
and qword [rdi + 8], 0
and dword [rdi + 0x10], 0
jmp 0x1400b94a5
mov rax, qword [rbx + 0x28]
xor edx, edx
inc rax
mov r8d, 0x2887614
mov rcx, rdi
mov qword [rsi], rax
call fcn.1400c0108
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b9d90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10d, dword [rdx]
mov r11, rdx
mov dword [rsp + 0x50], r10d
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x50]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1400b9dba
mov r9, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and r9, r8
mov r8, qword [rbx + 0x18]
add r9, r9
mov rax, qword [r8 + r9*8]
cmp qword [r8 + r9*8], rdx
jne 0x1400b9dfb
mov rcx, rdx
jmp 0x1400b9e03
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b9e18
cmp dword [rax + 0x10], r10d
je 0x1400b9e13
mov rax, qword [rax]
jmp 0x1400b9df0
mov rcx, rax
jmp 0x1400b9e1e
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1400b9e97
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1400ba620
mov rdx, rax
movabs rcx, 0x7fffffffffffffe
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1400b9e6c
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400ba00c
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b9eac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10d, dword [rdx]
mov r11, rdx
mov dword [rsp + 0x50], r10d
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x50]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1400b9ed6
mov r9, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and r9, r8
mov r8, qword [rbx + 0x18]
add r9, r9
mov rax, qword [r8 + r9*8]
cmp qword [r8 + r9*8], rdx
jne 0x1400b9f17
mov rcx, rdx
jmp 0x1400b9f1f
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b9f34
cmp dword [rax + 0x10], r10d
je 0x1400b9f2f
mov rax, qword [rax]
jmp 0x1400b9f0c
mov rcx, rax
jmp 0x1400b9f3a
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1400b9fb3
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1400ba830
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x1400b9f88
lea rcx, str.list_T__too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400ba430
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400ba00c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
mov r9d, dword [r8]
mov dword [rax + 0x18], r9d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400ba048
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400ba08d
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400ba0f0
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r9d, dword [rdi + 0x10]
jne 0x1400ba090
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400ba0d7
and qword [rbx + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x1400ee2b6.0]
nop
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400ba215
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400ba12a
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400ba14a
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400ba179
cmp rax, rdx
jne 0x1400ba155
mov qword [r9 + r8*8], rbx
jmp 0x1400ba179
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400ba179
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140186800]
test rax, rax
jns 0x1400ba19a
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400ba1ab
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400ba20a
cmp rdx, 0x200
jae 0x1400ba1c3
shl rdx, 3
jmp 0x1400ba1d5
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400ba1d5
add rdx, rdx
mov rcx, rsi
call fcn.14000bd3c
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400ba20a
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400ba00c
cmp rdi, r15
jne 0x1400ba1ea
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400ba22c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
mov r9d, dword [r8]
mov dword [rax + 0x18], r9d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400ba268
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400ba2ad
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400ba2f4
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r9d, dword [rdi + 0x10]
jne 0x1400ba2b0
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400ba419
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400ba32e
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400ba34e
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400ba37d
cmp rax, rdx
jne 0x1400ba359
mov qword [r9 + r8*8], rbx
jmp 0x1400ba37d
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400ba37d
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140186800]
test rax, rax
jns 0x1400ba39e
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400ba3af
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400ba40e
cmp rdx, 0x200
jae 0x1400ba3c7
shl rdx, 3
jmp 0x1400ba3d9
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400ba3d9
add rdx, rdx
mov rcx, rsi
call fcn.14000bd3c
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400ba40e
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400ba22c
cmp rdi, r15
jne 0x1400ba3ee
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret