joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b8154
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov ebx, edx
mov rdi, rcx
mov word [rbp + 0x20], r8w
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rbp + r10 + 0x18]
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
inc r10
cmp r10, 4
jb 0x1401b818a
mov rcx, qword [rdi + 0x30]
and rcx, r9
add rcx, rcx
mov rdx, qword [rdi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rdi + 8]
je 0x1401b81d9
mov rdx, qword [rdx + rcx*8]
jmp 0x1401b81d2
cmp rax, rdx
je 0x1401b81d9
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x1401b81c9
jmp 0x1401b81db
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 8]
cmp rax, qword [rdi + 8]
je 0x1401b8213
lea rcx, [rax + 0x18]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1401b8205
mov word [rdx], r8w
add qword [rcx + 8], 2
jmp 0x1401b829c
lea r8, [rbp + 0x20]
call fcn.1401c589c
jmp 0x1401b829c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
lea r8, [rbp + 0x20]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1401c589c
mov dword [rbp - 0x28], ebx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1401c6044
nop
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401c4e50
nop
lea rcx, [rbp - 0x20]
call fcn.14004dba4
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1401b829c
mov rcx, rdx
mov rax, qword [rbp - 0x30]
sub rax, rdx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x1401b8293
mov rdx, qword [rdx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1401b8293
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1401b82b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rdi
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rbx, rdx
mov word [rbp + 0x30], r8w
lea rdi, [rcx + 0x40]
mov dword [rbp + 0x20], ebx
movabs r11, 0xcbf29ce484222325
mov rcx, r11
xor edx, edx
movabs r9, 0x100000001b3
movzx eax, byte [rbp + rdx + 0x20]
xor rcx, rax
imul rcx, r9
inc rdx
cmp rdx, 4
jb 0x1401b82f0
movzx r10d, byte [rbp + 0x2c]
mov eax, r10d
xor rax, r11
imul rax, r9
imul rdx, rcx, 0x18d
xor rdx, rax
and rdx, qword [rdi + 0x30]
add rdx, rdx
mov r9, qword [rdi + 0x18]
mov rax, qword [r9 + rdx*8 + 8]
cmp rax, qword [rdi + 8]
je 0x1401b8358
mov r9, qword [r9 + rdx*8]
cmp ebx, dword [rax + 0x10]
jne 0x1401b8347
cmp r10b, byte [rax + 0x14]
jne 0x1401b8347
xor cl, cl
jmp 0x1401b8349
mov cl, 1
test cl, cl
je 0x1401b835a
cmp rax, r9
je 0x1401b8358
mov rax, qword [rax + 8]
jmp 0x1401b8338
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 8]
cmp rax, qword [rdi + 8]
je 0x1401b8392
lea rcx, [rax + 0x18]
mov rdx, qword [rax + 0x20]
cmp rdx, qword [rax + 0x28]
je 0x1401b8384
mov word [rdx], r8w
add qword [rax + 0x20], 2
jmp 0x1401b841c
lea r8, [rbp + 0x30]
call fcn.1401c589c
jmp 0x1401b841c
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
lea r8, [rbp + 0x30]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1401c589c
mov qword [rbp - 0x28], rbx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1401c6044
nop
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401c50b0
nop
lea rcx, [rbp - 0x20]
call fcn.14004dba4
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1401b841c
mov rcx, rdx
mov rax, qword [rbp - 0x30]
sub rax, rdx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x1401b8413
mov rdx, qword [rdx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1401b8413
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
Function at 0x1401b8424
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
movzx ebx, dl
mov word [rbp + 0x18], r8w
lea rdi, [rcx + 0x80]
mov eax, ebx
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rcx, qword [rdi + 0x30]
and rcx, rax
add rcx, rcx
mov rdx, qword [rdi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rdi + 8]
je 0x1401b849a
mov rdx, qword [rdx + rcx*8]
jmp 0x1401b8493
cmp rax, rdx
je 0x1401b849a
mov rax, qword [rax + 8]
cmp bl, byte [rax + 0x10]
jne 0x1401b848a
jmp 0x1401b849c
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 8]
cmp rax, qword [rdi + 8]
je 0x1401b84d4
lea rcx, [rax + 0x18]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1401b84c6
mov word [rdx], r8w
add qword [rcx + 8], 2
jmp 0x1401b855d
lea r8, [rbp + 0x18]
call fcn.1401c589c
jmp 0x1401b855d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
lea r8, [rbp + 0x18]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1401c589c
mov byte [rbp - 0x28], bl
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.1401c6044
nop
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.1401c534c
nop
lea rcx, [rbp - 0x20]
call fcn.14004dba4
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x1401b855d
mov rcx, rdx
mov rax, qword [rbp - 0x30]
sub rax, rdx
sar rax, 1
add rax, rax
cmp rax, 0x1000
jb 0x1401b8554
mov rdx, qword [rdx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1401b8554
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1401c2830
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x28
call fcn.14024eae0
sub rsp, rax
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x1401c2905
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r15, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r14, rax
imul r14, r8
cmp rdx, 4
jb 0x1401c2887
and r14, qword [rcx + 0x30]
add r14, r14
mov rax, qword [r12 + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.14004dba4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1401c2919
cmp rsi, rbp
jne 0x1401c28bd
cmp qword [rsp + 0x80], r13
jne 0x1401c28fe
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x1401c2931
mov r13, qword [rsp + 0x78]
mov qword [r12 + r14*8], r13
mov rax, r13
jmp 0x1401c2934
mov rax, r15
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
je 0x1401c28fe
xor edx, edx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rsi + rdx + 0x10]
inc rdx
xor r14, rax
imul r14, r13
cmp rdx, 4
jb 0x1401c2954
and r14, qword [rcx + 0x30]
mov r13, qword [rsp + 0x78]
add r14, r14
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.14004dba4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x1401c29bb
cmp rsi, rbp
je 0x1401c28fa
jmp 0x1401c2982
mov qword [r12 + r14*8], r13
mov qword [r12 + r14*8 + 8], r13
jmp 0x1401c2939
Function at 0x1401c5be4
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov rdx, qword [rcx + 0x10]
lea edi, [rax - 0x1f]
add rdx, rdi
mov rbx, qword [rcx + 0x38]
mov rsi, rcx
xorps xmm0, xmm0
js 0x1401c5c1f
cvtsi2ss xmm0, rdx
jmp 0x1401c5c34
mov rax, rdx
and rdx, rdi
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14031bb90]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1401c5c62
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1401c5c62
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1401c5c90
cmp rbx, 0x200
jae 0x1401c5c8d
shl rbx, 3
cmp rbx, rcx
jae 0x1401c5c90
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rdi
shl rax, cl
cmp rbx, rax
jbe 0x1401c5cb7
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rbx - 1]
mov rbx, qword [rsi + 8]
or rax, rdi
mov r8, rbx
bsr rcx, rax
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400b57b4
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401c5db2
movzx edx, byte [rax + 0x10]
movabs r8, 0xcbf29ce484222325
mov rdi, qword [rsi + 0x18]
mov r11d, edx
mov rcx, qword [rcx]
xor r11, r8
movabs r8, 0x100000001b3
imul r11, r8
and r11, qword [rsi + 0x30]
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x1401c5d3b
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1401c5da6
mov r10, qword [rdi + r11*8 + 8]
cmp dl, byte [r10 + 0x10]
jne 0x1401c5d7b
mov r10, qword [r10]
cmp r10, rax
je 0x1401c5d34
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401c5d34
mov r10, qword [r10 + 8]
cmp dl, byte [r10 + 0x10]
je 0x1401c5dc8
cmp qword [rdi + r11*8], r10
jne 0x1401c5d71
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1401c5cfa
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401c5da6
Function at 0x1401d1130
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, r8
mov rdi, rdx
mov r13, rcx
mov qword [rbp - 0x28], rdx
xor ecx, ecx
mov r14, qword [r8 + 0x10]
test r14, r14
jne 0x1401d1182
mov qword [rdx], rcx
mov qword [rdx + 8], rcx
jmp 0x1401d12ef
mov qword [rbp - 0x48], rcx
mov r15, rcx
mov qword [rbp - 0x38], rcx
mov esi, 0xf
mov qword [rbp - 0x30], rsi
mov byte [rbp - 0x48], cl
mov r12, rbx
cmp qword [r8 + 0x18], 0x10
jb 0x1401d11a6
mov r12, qword [r8]
test r14, r14
je 0x1401d11c7
mov r8, r14
mov edx, 0x2c
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
xor ecx, ecx
test rax, rax
je 0x1401d11c7
sub rax, r12
jmp 0x1401d11cb
or rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
je 0x1401d120f
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rsi
cmp r14, rax
cmovb rax, r14
cmp qword [rbx + 0x18], 0x10
jb 0x1401d11ee
mov rbx, qword [rbx]
mov r8, rax
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.14000fd94
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rbp - 0x38], xmm1
jmp 0x1401d1231
lea rax, [rbp - 0x48]
cmp rax, rbx
je 0x1401d1239
cmp qword [rbx + 0x18], 0x10
jb 0x1401d1222
mov rbx, qword [rbx]
mov r8, r14
mov rdx, rbx
lea rcx, [rbp - 0x48]
call fcn.14000fd94
mov r15, qword [rbp - 0x38]
mov rsi, qword [rbp - 0x30]
lea rdx, [rbp - 0x48]
mov rbx, qword [rbp - 0x48]
cmp rsi, 0x10
cmovae rdx, rbx
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r15, r15
je 0x1401d1277
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r8, 0x100000001b3
imul r9, r8
inc rcx
cmp rcx, r15
jb 0x1401d125a
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x28]
lea rcx, [r13 + 8]
call fcn.140153c70
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1401d1295
mov rcx, qword [r13 + 0x10]
cmp rcx, qword [r13 + 0x10]
je 0x1401d1316
mov rcx, qword [rcx + 0x68]
test rcx, rcx
jne 0x1401d12ab
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov rax, qword [rcx]
mov rdx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x14004a846.0]
nop
nop dword [rax]
cmp rsi, 0x10
jb 0x1401d12ef
lea rax, [rsi + 1]
cmp rax, 0x1000
mov rcx, rbx
jb 0x1401d12e6
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401d1321
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
and qword [rdi], 0
and qword [rdi + 8], 0
jmp 0x1401d12c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1401f2f04
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
cmp qword [rdx + 0x18], 8
lea rsi, [rcx + 0x80]
mov r10, qword [rdx + 0x10]
mov rbx, r8
mov r8, rdx
mov rdi, rcx
jb 0x1401f2f3a
mov r8, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
add r10, r10
je 0x1401f2f69
movzx eax, byte [rcx + r8]
movabs r11, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r11
cmp rcx, r10
jb 0x1401f2f4b
mov r8, rdx
mov rcx, rsi
lea rdx, [rsp + 0x20]
call fcn.1400d4240
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1401f2f86
mov rcx, qword [rsi + 8]
cmp rcx, qword [rdi + 0x88]
jne 0x1401f2f96
mov eax, 0x80004005
jmp 0x1401f2fd8
mov rax, qword [rcx + 0x38]
cmp rax, qword [0x1403069f8]
jne 0x1401f2fb8
mov rax, qword [rcx + 0x40]
cmp rax, qword [0x140306a00]
jne 0x1401f2fb8
mov rax, qword [rdi + 0x30]
or byte [rax + 0x50], 0x20
test rbx, rbx
je 0x1401f2fd6
movups xmm0, xmmword [rcx + 0x30]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rcx + 0x40]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [rcx + 0x50]
movsd qword [rbx + 0x20], xmm0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401f3f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x60
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, rdx
mov r13, rcx
mov rdi, qword [rcx + 0x78]
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 7
lea rcx, [rsp + 0x30]
call fcn.14000ae4c
lea rdx, [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x48]
cmp r15, 8
cmovae rdx, rsi
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
xor ecx, ecx
test r8, r8
je 0x1401f3fb0
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1401f3f93
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x98]
call fcn.1400d4240
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x1401f3fd6
mov rbx, qword [rdi + 0xa0]
cmp r15, 8
jb 0x1401f4010
lea rax, [r15*2 + 2]
mov rcx, rsi
cmp rax, 0x1000
jb 0x1401f4007
mov rsi, qword [rsi - 8]
sub rcx, rsi
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1401f4007
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [r13 + 0x78]
cmp rbx, qword [rcx + 0xa0]
je 0x1401f4025
mov eax, dword [rbx + 0x30]
jmp 0x1401f40b1
xor ebx, ebx
cmp ebx, 0xc00
jae 0x1401f40a5
cmp ebx, 0xa09
jae 0x1401f4044
lea rdi, str.Unit_Test
mov rdi, qword [rdi + rbx*8]
jmp 0x1401f404b
lea rdi, str.Unknown_category
cmp rdi, r14
jne 0x1401f4054
xor eax, eax
jmp 0x1401f4076
test rdi, rdi
jne 0x1401f405e
or eax, 0xffffffff
jmp 0x1401f4076
test r14, r14
jne 0x1401f4069
lea eax, [r14 + 1]
jmp 0x1401f4076
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
nop
test eax, eax
jne 0x1401f40a1
mov rcx, qword [r13 + 0x78]
add rcx, 0x98
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call fcn.1401f4320
mov eax, ebx
jmp 0x1401f40b1
inc ebx
jmp 0x1401f4027
mov eax, 0xc00
jmp 0x1401f40b1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1401f40d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xb0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, rdx
mov r14, rcx
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x98], r13d
mov rax, qword [rcx + 0x78]
cmp qword [rax + 0xe8], r13
jne 0x1401f41d4
mov qword [rsp + 0x50], r13
movdqa xmm0, xmmword [0x14031bbe0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], r13w
mov dword [rsp + 0x98], 0x320f0a06
mov word [rsp + 0x9c], 0xc864
lea rbx, [rsp + 0x98]
lea rax, [rsp + 0x9e]
cmp rbx, rax
je 0x1401f41ca
mov r15b, byte [rbx]
mov cl, r15b
call fcn.14012c590
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.14000ae4c
mov rsi, qword [r14 + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.14000ad78
mov byte [rsp + 0x90], r15b
or edi, 1
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0xd8]
call fcn.1401f45a0
nop
lea rcx, [rsp + 0x70]
call fcn.14000ac30
inc rbx
jmp 0x1401f4161
lea rcx, [rsp + 0x50]
call fcn.14000ac30
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.14000ae4c
mov r14, qword [r14 + 0x78]
lea rsi, [r14 + 0xd8]
lea rdx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
cmp rdi, 8
cmovae rdx, rbx
movabs r9, 0xcbf29ce484222325
mov rax, qword [rsp + 0x40]
lea r8, [rax + rax]
mov rcx, r13
test r8, r8
je 0x1401f424e
movzx eax, byte [rcx + rdx]
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1401f4231
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d4240
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1401f426d
mov rcx, qword [rsi + 8]
cmp rcx, qword [r14 + 0xe0]
je 0x1401f42b2
mov sil, byte [rcx + 0x30]
cmp rdi, 8
jb 0x1401f42ad
lea rax, [rdi*2 + 2]
mov rcx, rbx
cmp rax, 0x1000
jb 0x1401f42a4
mov rbx, qword [rbx - 8]
sub rcx, rbx
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x1401f42dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov al, sil
jmp 0x1401f42f2
cmp rdi, 8
jb 0x1401f42ec
lea rax, [rdi*2 + 2]
mov rcx, rbx
cmp rax, 0x1000
jb 0x1401f42e3
mov rbx, qword [rbx - 8]
sub rcx, rbx
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x1401f42e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor al, al
jmp 0x1401f42f2
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401f75dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
cmp byte [0x14037e110], 0
movzx r12d, r8w
mov r15b, dl
mov ebp, ecx
je 0x1401f77a4
lea rcx, [0x14037e111]
call fcn.1401f72a8
test al, al
jne 0x1401f77a4
mov rdi, qword [0x14037edd8]
mov esi, 1
test rdi, rdi
je 0x1401f7641
lock add dword [rdi + 8], esi
mov rdi, qword [0x14037edd8]
mov r14, qword [0x14037edd0]
test r14, r14
je 0x1401f7761
and dword [rsp + 0x28], 0
lea rax, [0x14036e010]
mov rcx, qword [0x14036e010]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
lock add dword [rsp + 0x28], esi
mov dword [rsp + 0x78], ebp
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x78]
movabs r8, 0x100000001b3
xor rcx, rax
add rdx, rsi
imul rcx, r8
cmp rdx, 4
jb 0x1401f7684
mov rax, qword [r14 + 0x30]
and rax, rcx
mov rcx, qword [r14 + 0x18]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [r14 + 8]
je 0x1401f76d2
mov rcx, qword [rcx + rax*8]
jmp 0x1401f76cb
cmp rbx, rcx
je 0x1401f76d2
mov rbx, qword [rbx + 8]
cmp ebp, dword [rbx + 0x10]
jne 0x1401f76c2
jmp 0x1401f76d4
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [r14 + 8]
cmp rbx, qword [r14 + 8]
je 0x1401f7741
lea rcx, [rbx + 0x18]
mov dl, r15b
call fcn.1401f72a8
test al, al
jne 0x1401f7759
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x28]
sub rcx, rdx
sar rcx, 1
jmp 0x1401f7725
mov r8, rcx
shr r8, 1
lea rax, [rdx + r8*2]
cmp word [rax], r12w
jae 0x1401f7722
lea rdx, [rax + 2]
or rax, 0xffffffffffffffff
sub rax, r8
add rcx, rax
jmp 0x1401f7725
mov rcx, r8
test rcx, rcx
jg 0x1401f7702
cmp rdx, qword [rbx + 0x28]
je 0x1401f773b
cmp r12w, word [rdx]
jb 0x1401f773b
mov al, sil
jmp 0x1401f773d
xor al, al
test al, al
jne 0x1401f7759
xor sil, sil
jmp 0x1401f7759
lock dec dword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov eax, dword [rsp + 0x28]
test eax, eax
jne 0x1401f7746
test rdi, rdi
je 0x1401f779f
or eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1401f779f
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x14004a846.0]
or eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x1401f779f
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
mov al, sil
jmp 0x1401f77a9
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret