joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140075ac4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r10]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x140075afc
mov r8, qword [r9 + 0x30]
and r8, rcx
lea r11, [r9 + 8]
mov rdi, qword [r11]
add r8, r8
mov rax, qword [r9 + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140075b78
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140075b78
mov rcx, qword [r10]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x140075b59
cmp rdi, qword [rax + r8*8]
jne 0x140075b47
jmp 0x140075b78
mov r8, rbx
lea rdx, [rsp + 0x28]
mov rcx, r11
call fcn.140074d18
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140075c0b
mov rax, qword [rbx]
cmp rdi, rax
je 0x140075bad
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r11]
jne 0x140075bc9
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x140075bf8
cmp rax, rdi
jne 0x140075bd4
mov qword [rdx + r8*8], rbx
jmp 0x140075bf8
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x140075bf8
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r9
call fcn.140075548
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14007e5f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [r8]
mov r9, rdx
xor edx, edx
mov r10, rcx
test rax, rax
jne 0x14007e616
mov rax, qword [rcx + 8]
mov qword [r9], rax
jmp 0x14007e68e
mov r11, qword [rax + 0x40]
movabs r8, 0xcbf29ce484222325
mov qword [rsp + 0x18], r11
movzx eax, byte [rsp + rdx + 0x18]
movabs rcx, 0x100000001b3
xor r8, rax
inc rdx
imul r8, rcx
cmp rdx, 8
jb 0x14007e629
mov rcx, qword [r10 + 0x30]
and rcx, r8
mov r8, qword [r10 + 0x18]
mov rax, rcx
add rax, rax
lea rbx, [rcx + rcx]
mov rcx, qword [r10 + 8]
mov rdx, qword [r8 + rax*8]
cmp qword [r8 + rbx*8], rcx
jne 0x14007e670
mov rax, rcx
jmp 0x14007e678
mov rax, qword [r8 + rbx*8 + 8]
mov rax, qword [rax]
cmp rdx, rax
je 0x14007e688
cmp qword [rdx + 0x10], r11
je 0x14007e68b
mov rdx, qword [rdx]
jmp 0x14007e665
mov rdx, rcx
mov qword [r9], rdx
mov rbx, qword [rsp + 8]
mov rax, r9
ret
Function at 0x140081eec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 8
jb 0x140081f23
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x140081fb8
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x140081fb8
mov rcx, qword [r11]
mov rdi, qword [rdi + 8]
cmp rcx, qword [rdi + 0x10]
je 0x140081f7d
cmp rdi, qword [rax + r8*8]
jne 0x140081f6b
jmp 0x140081fb8
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.1400587d8
mov rcx, rbx
call fcn.1402aed28
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x1400820e6
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140081ff2
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14008200f
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14008203e
cmp rax, rdi
jne 0x14008201a
mov qword [rdx + r8*8], rbx
jmp 0x14008203e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14008203e
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14034f96c]
test rax, rax
jns 0x14008205f
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x140082070
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400820db
cmp rdx, 0x200
jae 0x140082088
shl rdx, 3
jmp 0x14008209a
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14008209a
add rdx, rdx
mov rcx, rsi
call fcn.140068c98
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400820d6
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140081eec
cmp rdi, qword [rsp + 0x20]
jne 0x1400820b4
mov r10, qword [rsp + 0x78]
mov qword [r10], rbx
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14008253c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 8
jb 0x140082561
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400825b9
cmp qword [rcx + rdx*8], rdi
jne 0x1400825ae
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400825b2
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400825c6
cmp qword [rcx + rdx*8], rdi
jne 0x1400825c6
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.1400587d8
mov rcx, rdi
call fcn.1402aed28
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400828ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x18], 8
mov r9, qword [rcx + 0x10]
jb 0x1400828fa
mov rcx, qword [rcx]
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
add r9, r9
je 0x14008292a
movzx eax, byte [r8 + rcx]
movabs r10, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r10
cmp r8, r9
jb 0x14008290c
mov rax, rdx
ret
Function at 0x140082c7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbx, r8
mov r11, rdx
mov rdi, rcx
mov rcx, r8
call fcn.1400828ec
mov r10, rax
mov qword [rsp + 0x28], rax
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x28]
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
inc r8
cmp r8, 8
jb 0x140082ccc
mov rcx, qword [rdi + 0x30]
and rcx, rdx
mov r8, qword [rdi + 0x18]
mov rax, rcx
add rax, rax
mov rax, qword [r8 + rax*8]
lea r9, [rcx + rcx]
mov rdx, qword [rdi + 8]
cmp qword [r8 + r9*8], rdx
jne 0x140082d14
mov rcx, rdx
jmp 0x140082d1c
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140082d36
cmp qword [rax + 0x10], r10
je 0x140082d2c
mov rax, qword [rax]
jmp 0x140082d09
mov qword [rsp + 0x20], rax
mov rcx, rax
jmp 0x140082d41
mov rax, rdx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
cmp rcx, rdx
je 0x140082dcd
mov rdx, qword [rax + 0x18]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140082d5b
mov rcx, qword [rbx]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x140082d68
mov r9, qword [rdx]
mov r8, qword [rdx + 0x10]
cmp r8, qword [rbx + 0x10]
jne 0x140082dfa
test r8, r8
je 0x140082d97
sub r9, rcx
movzx edx, word [rcx + r9]
movzx r10d, word [rcx]
cmp dx, r10w
jne 0x140082dc4
add rcx, 2
sub r8, 1
jne 0x140082d7e
xor ecx, ecx
test ecx, ecx
jne 0x140082dfa
and qword [r11], 0
and qword [r11 + 8], 0
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x140082db3
lock inc dword [rcx + 8]
mov rcx, qword [rax + 0x18]
mov qword [r11], rcx
mov rcx, qword [rax + 0x20]
mov qword [r11 + 8], rcx
jmp 0x140082dd6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140082d99
and qword [r11], 0
and qword [r11 + 8], 0
mov rax, r11
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1402ae860
mov rbx, qword [rsp + 0x108]
add rsp, 0xe0
pop rdi
ret
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14008390c
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140082ec8
lea rcx, [rax + 8]
call fcn.14005e664
mov rcx, rax
call fcn.1400826f0
mov r8, rax
lea rdx, str.hash_collision_in_GenericEtwPropertyDictionary
lea rcx, [rsp + 0x70]
call fcn.140082efc
nop
lea r8, [0x1403131b8]
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140082fa4
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.140083000
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400838b8
lea rdx, [0x14042f170]
lea rcx, [rsp + 0x38]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x140083184
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15, rdx
mov r14, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r8]
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
inc rdx
cmp rdx, 8
jb 0x1400831bb
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rcx, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp qword [rax + rsi*8], rcx
jne 0x1400831f7
mov rbx, rcx
jmp 0x1400831ff
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, qword [rax + rsi*8]
je 0x14008322a
mov rdx, qword [r8]
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14008321a
cmp rbx, qword [rax + rsi*8]
jne 0x140083208
jmp 0x14008322a
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x140083318
mov rdi, qword [rcx]
mov r12, qword [rdi + 8]
mov r9, r8
mov r8, r12
mov rdx, rdi
call fcn.1400835d8
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jae 0x140083267
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400832bb
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x1400832d4
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x140083304
cmp qword [rdx + rsi*8], rbx
jne 0x1400832e0
mov qword [rdx + rsi*8], rdi
jmp 0x140083304
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x140083304
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.140075548
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x140084510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14044e770]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r10d, r8d
mov dword [rbp - 0x29], r8d
mov rbx, rdx
xor r8d, r8d
movabs rdx, 0xcbf29ce484222325
mov r9, rcx
movzx eax, byte [rbp + r8 - 0x29]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x140084548
mov rcx, qword [r9 + 0x48]
and rcx, rdx
mov rdx, qword [r9 + 0x30]
mov rax, rcx
add rax, rax
lea r8, [rcx + rcx]
mov rdi, qword [rdx + r8*8]
mov rax, qword [rdx + rax*8]
cmp rdi, qword [r9 + 0x20]
jne 0x140084591
mov rcx, qword [r9 + 0x20]
jmp 0x140084599
mov rcx, qword [rdx + r8*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400845a9
cmp dword [rax + 0x10], r10d
je 0x1400845ad
mov rax, qword [rax]
jmp 0x140084585
mov rax, qword [r9 + 0x20]
cmp rax, qword [r9 + 0x20]
je 0x1400845f0
mov rdx, qword [rax + 0x20]
mov rcx, qword [rax + 0x18]
jmp 0x1400845d6
mov rax, qword [rcx]
cmp rax, qword [rbx]
jne 0x1400845cf
mov rax, qword [rcx + 8]
cmp rax, qword [rbx + 8]
je 0x1400845db
add rcx, 0x1a8
cmp rcx, rdx
jne 0x1400845bd
cmp rcx, rdx
je 0x1400845f0
call fcn.14004acb4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
ja 0x14008461f
jmp 0x140084667
lea rdx, [rbp - 0x29]
lea rcx, [r9 + 0x18]
call fcn.140084b3c
mov rdx, rbx
mov rcx, rax
call fcn.140084c58
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402ae860
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
and dword [rbp + 0x23], 0
lea rax, str.Config_contains_the_same_ruleId
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x40
mov qword [rbp + 0x27], rbx
mov dword [rbp + 0x2f], reloc.OLEAUT32.dll_SafeArrayGetDim
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x140394fff]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
lea rdx, str.adding_a_rule_with_an_existing_rule_id
lea rcx, [rbp - 0x21]
call fcn.140063f38
lea rdx, [0x14042f0b8]
lea rcx, [rbp - 0x21]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x140084b3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10, rdx
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x140084b5e
mov rcx, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and rcx, r8
mov r8, qword [rbx + 0x18]
mov rax, rcx
add rax, rax
lea r9, [rcx + rcx]
mov rax, qword [r8 + rax*8]
cmp qword [r8 + r9*8], rdx
jne 0x140084ba5
mov rcx, rdx
jmp 0x140084bad
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140084bc4
mov ecx, dword [r10]
cmp dword [rax + 0x10], ecx
je 0x140084bbf
mov rax, qword [rax]
jmp 0x140084b9a
mov rcx, rax
jmp 0x140084bca
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x140084c43
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.140085348
mov rdx, rax
movabs rcx, 0x555555555555554
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jae 0x140084c18
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14008510c
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008510c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r8]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 4
jb 0x140085143
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rdi, qword [rsi + 8]
add r8, r8
mov rax, qword [rsi + 0x18]
cmp rdi, qword [rax + r8*8]
je 0x1400851d7
mov rdi, qword [rax + r8*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [rax + r8*8]
je 0x1400851d7
mov ecx, dword [r11]
mov rdi, qword [rdi + 8]
cmp ecx, dword [rdi + 0x10]
je 0x14008519c
cmp rdi, qword [rax + r8*8]
jne 0x14008518b
jmp 0x1400851d7
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.1400568fc
mov rcx, rbx
call fcn.1402aed28
mov rax, qword [rsp + 0x78]
mov qword [rax], rdi
mov byte [rax + 8], 0
jmp 0x140085305
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx]
cmp rdi, rax
je 0x140085211
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x14008522e
mov qword [rdx + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14008525d
cmp rax, rdi
jne 0x140085239
mov qword [rdx + r8*8], rbx
jmp 0x14008525d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14008525d
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14034f96c]
test rax, rax
jns 0x14008527e
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14008528f
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400852fa
cmp rdx, 0x200
jae 0x1400852a7
shl rdx, 3
jmp 0x1400852b9
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400852b9
add rdx, rdx
mov rcx, rsi
call fcn.140056470
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400852f5
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14008510c
cmp rdi, qword [rsp + 0x20]
jne 0x1400852d3
mov r10, qword [rsp + 0x78]
mov qword [r10], rbx
mov byte [r10 + 8], 1
mov rax, r10
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140085384
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x1400853a9
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140085401
cmp qword [rcx + rdx*8], rdi
jne 0x1400853f6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400853fa
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14008540e
cmp qword [rcx + rdx*8], rdi
jne 0x14008540e
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.1400568fc
mov rcx, rdi
call fcn.1402aed28
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14008a6f4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x14008a721
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x14008a755
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x14008a737
and rcx, qword [0x14044fdd0]
mov r14, qword [0x14044fdb8]
mov rax, rcx
mov r10, qword [0x14044fda8]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x14008a783
mov rcx, r10
jmp 0x14008a78b
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008a838
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x14008a7a5
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x14008a7b5
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x14008a7e7
mov rdi, rsi
test rsi, rsi
je 0x14008a7e1
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x14008a7ec
add r8, 2
sub rdi, 1
jne 0x14008a7c9
xor ecx, ecx
test ecx, ecx
je 0x14008a7f5
mov rax, qword [rax]
jmp 0x14008a778
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008a7e3
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x14008a802
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x14008a80c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x14008a838
test r11, r11
je 0x14008a832
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x14008a844
add rcx, 2
sub r11, 1
jne 0x14008a819
xor ecx, ecx
test ecx, ecx
je 0x14008a83b
mov rax, r10
cmp rax, r10
jne 0x14008a84d
xor al, al
jmp 0x14008a856
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x14008a834
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret