joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r15
mov rax, qword [rdx + 8]
mov r15, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 8], rax
je 0x1400430b9
mov eax, 0xfffffffc
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret
mov r11d, dword [rcx]
mov eax, dword [rdx]
sar eax, 1
mov qword [rsp + 0x18], rbx
and eax, 1
sar r11d, 1
and r11d, 1
mov qword [rsp + 0x28], r14
xor eax, r11d
mov ebx, eax
and ebx, r11d
mov dword [r8], ebx
mov r14, qword [rcx + 8]
test r14, r14
je 0x1400431b0
mov qword [rsp + 0x20], rbp
mov ebp, 1
sub ebp, r11d
nop dword [rax]
mov rcx, qword [rdi + 0x10]
mov r10d, 1
sub r10d, eax
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rsi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
and ecx, r8d
shr r9, 0x3f
and r9d, edx
or r9d, ecx
and r10d, r9d
or eax, r9d
and r10d, r11d
or r10d, ebx
mov ebx, 1
mov dword [r15], r10d
sub ebx, eax
mov rcx, qword [rsi + 0x10]
and ebx, ebp
mov r8, qword [rcx + r14*8 - 8]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rcx + r14*8 - 8]
mov rcx, rdx
sub rdx, r8
xor rcx, r8
shr rdx, 0x3f
mov r9, rcx
shr r8, 0x3f
not r9
shr rcx, 0x3f
shr r9, 0x3f
and ecx, r8d
and r9d, edx
or r9d, ecx
and ebx, r9d
or eax, r9d
or ebx, r10d
mov dword [r15], ebx
sub r14, 1
jne 0x140043100
mov rbp, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x30]
pop r15
pop rdi
ret

Function at 0x140047e80
Capabilities:
Encode data using add xor sub operations
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, dword [rcx]
mov r10, rcx
mov ebx, dword [rcx + 4]
test rdx, rdx
je 0x140047ee2
sub r8, r9
nop word [rax + rax]
lea eax, [r11 + 1]
movzx r11d, al
lea r9, [r9 + 1]
movzx ecx, byte [r11 + r10 + 8]
lea eax, [rbx + rcx]
movzx ebx, al
movzx eax, byte [rbx + r10 + 8]
mov byte [r11 + r10 + 8], al
add al, cl
mov byte [rbx + r10 + 8], cl
movzx eax, al
movzx ecx, byte [rax + r10 + 8]
xor cl, byte [r8 + r9 - 1]
mov byte [r9 - 1], cl
sub rdx, 1
jne 0x140047ea0
mov dword [r10 + 4], ebx
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [r10], r11d
ret
Function at 0x140048a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x28
xor r15d, r15d
mov r12, r9
mov rbx, r8
mov r14, rdx
mov rdi, rcx
test rdx, rdx
je 0x140048a8b
mov r10, rbx
mov rcx, r9
sub r10, r9
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rdi + 0x80]
cmp rdx, 0x40
jae 0x140048a8b
movzx eax, byte [r10 + rcx]
inc r15
xor al, byte [rdx + rdi + 0x40]
mov byte [rcx], al
inc rcx
inc qword [rdi + 0x80]
sub r14, 1
jne 0x140048a60
lea rbp, [rdi + 0x40]
cmp r14, 0x40
jb 0x140048b81
mov qword [rsp + 0x60], rsi
mov r12, r14
shr r12, 6
mov rsi, rdi
imul rax, r12, 0xffffffffffffffc0
sub rsi, r15
mov qword [rsp + 0x20], r13
add r14, rax
mov r13, rbx
sub rsi, r9
lea rbx, [r9 + 1]
mov rax, r12
sub r13, r9
shl rax, 6
add rbx, r15
add rsi, 0x40
add r15, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140048250
inc dword [rdi + 0x30]
mov ecx, 8
nop dword [rax + rax]
movzx eax, byte [rbx + r13 - 1]
xor al, byte [rbx + rsi - 1]
mov byte [rbx - 1], al
movzx eax, byte [rbx + rsi]
xor al, byte [rbx + r13]
mov byte [rbx], al
movzx eax, byte [rbx + r13 + 1]
xor al, byte [rbx + rsi + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + r13 + 2]
xor al, byte [rbx + rsi + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + rsi + 3]
xor al, byte [rbx + r13 + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + rsi + 4]
xor al, byte [rbx + r13 + 4]
mov byte [rbx + 4], al
movzx eax, byte [rbx + rsi + 5]
xor al, byte [rbx + r13 + 5]
mov byte [rbx + 5], al
movzx eax, byte [rbx + rsi + 6]
xor al, byte [rbx + r13 + 6]
mov byte [rbx + 6], al
add rbx, 8
sub rcx, 1
jne 0x140048af0
sub rsi, 0x40
sub r12, 1
jne 0x140048ad5
mov r13, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
test r14, r14
je 0x140048bc0
mov rdx, rbp
mov rcx, rdi
call fcn.140048250
inc dword [rdi + 0x30]
mov rcx, r14
sub r15, rdi
lea rdx, [r15 + rbx]
lea r8, [r15 + r12]
movzx eax, byte [rdx + rbp - 0x40]
xor al, byte [rbp]
mov byte [r8 + rbp - 0x40], al
lea rbp, [rbp + 1]
sub rcx, 1
jne 0x140048ba2
mov qword [rdi + 0x80], r14
xor eax, eax
add rsp, 0x28
pop r15
pop r14
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140048f70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rax, qword [0x14009f320]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov rbx, rdx
mov rdi, qword [rsp + 0xc8]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rdx
mov edx, 1
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rbx
call fcn.140048bd0
test eax, eax
jne 0x14004907c
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0x50]
xor edx, edx
xorps xmm4, xmm4
sub rcx, rax
xorps xmm3, xmm3
nop
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
add rax, rdx
add rdx, 8
movd xmm2, dword [rcx + rax]
movd xmm1, dword [rax]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rax + 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rax + rcx + 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rdx, 0x10
jb 0x140048ff0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x14004907a
mov rdx, rbx
mov rcx, rdi
call fcn.140020050
mov eax, 0xffffffaa
jmp 0x14004907c
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14006ab10
add rsp, 0x78
pop rdi
pop rbx
ret
Function at 0x140049240
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14009f320]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.140047b10
test eax, eax
jne 0x140049409
movzx eax, byte [rsp + 0x39]
movzx r8d, byte [rsp + 0x38]
movzx r9d, byte [rsp + 0x40]
movzx ecx, byte [rsp + 0x3c]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rsp + 0x3a]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x3b]
shl r8d, 8
or r8, rax
mov qword [rbx + 0xd8], 0
movzx eax, byte [rsp + 0x3d]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rsp + 0x3e]
shl ecx, 8
or eax, ecx
mov qword [rbx + 0x58], 0
movzx ecx, byte [rsp + 0x44]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rsp + 0x3f]
or r8, rax
mov r10d, 4
movzx eax, byte [rsp + 0x41]
or r9d, eax
mov qword [rbx + 0x118], r8
movzx eax, byte [rsp + 0x42]
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x43]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x45]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rsp + 0x46]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x47]
or r9, rax
mov qword [rbx + 0x98], r9
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov qword [rbx + r10*8 + 0x58], r9
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
mov qword [rbx + r10*8 + 0xd8], r8
shr r10d, 1
jne 0x140049361
mov r11d, 2
mov r8d, r11d
nop dword [rax]
mov r9, qword [rbx + r8*8 + 0xd8]
mov r10, qword [rbx + r8*8 + 0x58]
cmp r8, 1
jle 0x1400493f8
lea rax, [rbx + 0x60]
lea rdx, [r8 - 1]
nop dword [rax + rax]
mov rcx, r9
xor rcx, qword [rax + 0x80]
mov qword [rax + r8*8 + 0x80], rcx
lea rax, [rax + 8]
mov rcx, r10
xor rcx, qword [rax - 8]
mov qword [rax + r8*8 - 8], rcx
sub rdx, 1
jne 0x1400493d0
lea eax, [r11 + r11]
add r8, r8
mov r11d, eax
cmp eax, 8
jle 0x1400493b0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006ab10
add rsp, 0x50
pop rbx
ret
Function at 0x140049960
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14009f320]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa8]
mov rsi, rcx
mov rcx, qword [rsp + 0xa0]
mov rbp, rdx
mov rdi, qword [rsp + 0xb0]
xor edx, edx
mov rbx, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rsi
call fcn.140049dd0
test eax, eax
jne 0x140049af7
mov r9, r14
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14004a0d0
test eax, eax
jne 0x140049af7
mov rbx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x30]
mov r8, rbx
mov rcx, rsi
call fcn.140049b90
test eax, eax
jne 0x140049af7
xor ecx, ecx
mov eax, ecx
test rbx, rbx
je 0x140049af5
cmp rbx, 8
jb 0x140049aa9
mov r8, rbx
lea rcx, [rsp + 0x30]
and r8, 0xfffffffffffffff8
mov rdx, rdi
sub rdx, rcx
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax]
movd xmm2, dword [rdi + rax]
lea rcx, [rdx + rax]
movd xmm1, dword [rsp + rax + 0x30]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rsp + rax + 0x34]
orps xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rsp + rcx + 0x34]
add rax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, r8
jb 0x140049a30
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
cmp rax, rbx
jae 0x140049adf
jmp 0x140049ac0
lea rdx, [rsp + 0x30]
sub rdi, rdx
mov rdx, rdi
nop dword [rax]
nop dword [rax + rax]
lea r8, [rsp + 0x30]
add r8, rax
inc rax
movzx r9d, byte [rdx + r8]
movzx r8d, byte [r8]
xor r9d, r8d
or ecx, r9d
cmp rax, rbx
jb 0x140049ac0
test ecx, ecx
je 0x140049af5
mov rdx, rbp
mov rcx, r14
call fcn.140020050
mov eax, 0xffffffee
jmp 0x140049af7
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14006ab10
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004a860
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14009f320]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, qword [rsp + 0xe8]
mov rdi, rdx
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
test rbx, rbx
jne 0x14004a8aa
lea eax, [rbx - 0xd]
jmp 0x14004a9d3
mov qword [rsp + 0x50], rbx
lea r10, [rsp + 0x60]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
mov edx, 1
mov qword [rsp + 0x20], r9
mov r9, r8
mov r8, rdi
call fcn.14004a290
mov r10d, eax
test eax, eax
jne 0x14004a9d0
mov r11, qword [rsp + 0xe0]
xor r10d, r10d
xor dl, dl
mov ecx, r10d
cmp rbx, 8
jb 0x14004a997
mov r8, rbx
xorps xmm4, xmm4
and r8, 0xfffffffffffffff8
xorps xmm3, xmm3
mov eax, r10d
nop
movd xmm2, dword [rax + r11]
xorps xmm0, xmm0
movd xmm1, dword [rsp + rax + 0x60]
lea eax, [rdx + 4]
punpcklbw xmm2, xmm0
add dl, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movzx ecx, al
orps xmm4, xmm2
movzx eax, dl
movd xmm2, dword [rcx + r11]
movd xmm1, dword [rsp + rcx + 0x60]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp rax, r8
jb 0x14004a920
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
movzx eax, dl
cmp rax, rbx
jae 0x14004a9bb
nop
movzx r9d, byte [rax + r11]
inc dl
movzx r8d, byte [rsp + rax + 0x60]
xor r9d, r8d
movzx eax, dl
or ecx, r9d
cmp rax, rbx
jb 0x14004a9a0
test ecx, ecx
je 0x14004a9d0
mov rdx, rdi
mov rcx, rsi
call fcn.140020050
mov r10d, 0xfffffff1
mov eax, r10d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14006ab10
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004e5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx r10d, byte [r8 + 1]
mov rbx, rcx
movzx ecx, byte [r8 + 5]
mov r11d, edx
movzx eax, byte [r8]
mov r14, r9
movzx edi, byte [r8 + 4]
movzx edx, byte [r8 + 3]
shl eax, 8
shl edi, 8
or eax, r10d
movzx r10d, byte [r8 + 2]
or edi, ecx
movzx ecx, byte [r8 + 6]
shl eax, 8
shl edi, 8
or eax, r10d
or edi, ecx
shl eax, 8
movzx ecx, byte [r8 + 7]
or eax, edx
shl edi, 8
or edi, ecx
test r11d, r11d
mov r11d, reloc.WS2_32.dll_recv
jne 0x14004e6b3
lea rsi, [rbx + 0x44]
nop dword [rax]
nop word [rax + rax]
xor eax, dword [rsi]
lea rsi, [rsi - 4]
mov ecx, eax
mov r10d, eax
shr ecx, 8
movzx r9d, cl
shr ecx, 8
mov edx, ecx
shr rdx, 8
movzx ecx, cl
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
xor r8d, dword [rbx + r9*4 + 0x848]
movzx ecx, al
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r10d
sub r11, 1
jne 0x14004e660
xor r10d, dword [rbx]
xor eax, dword [rbx + 4]
jmp 0x14004e712
mov rsi, rbx
nop word [rax + rax]
xor eax, dword [rsi]
lea rsi, [rsi + 4]
mov ecx, eax
mov r10d, eax
shr ecx, 8
movzx r9d, cl
shr ecx, 8
mov edx, ecx
shr rdx, 8
movzx ecx, cl
mov r8d, dword [rbx + rdx*4 + 0x48]
add r8d, dword [rbx + rcx*4 + 0x448]
xor r8d, dword [rbx + r9*4 + 0x848]
movzx ecx, al
mov eax, r8d
add eax, dword [rbx + rcx*4 + 0xc48]
xor eax, edi
mov edi, r10d
sub r11, 1
jne 0x14004e6c0
xor r10d, dword [rbx + 0x44]
xor eax, dword [rbx + 0x40]
mov rbx, qword [rsp + 8]
mov ecx, r10d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
shr ecx, 0x18
mov byte [r14], cl
mov ecx, r10d
shr ecx, 0x10
mov byte [r14 + 1], cl
mov ecx, r10d
shr ecx, 8
mov byte [r14 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r14 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r14 + 5], cl
mov ecx, eax
mov byte [r14 + 7], al
xor eax, eax
shr ecx, 8
mov byte [r14 + 6], cl
mov byte [r14 + 3], r10b
mov r14, qword [rsp + 0x20]
ret
Function at 0x140051000
Capabilities:
Hash data using sha384
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
add rcx, 0x4ac
call fcn.14003c6e0
mov rcx, qword [rbx + 0x70]
add rcx, 0x504
call fcn.14003e9b0
mov rcx, qword [rbx + 0x70]
xor edx, edx
add rcx, 0x560
call fcn.140041990
mov rcx, qword [rbx + 0x70]
mov edx, 1
add rcx, 0x5d0
add rsp, 0x20
pop rbx
jmp fcn.14003b670
Function at 0x14006b7cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14006b816
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006b816
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006b816
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006b816
cmp dword [rcx + 0x84], 0xe
jbe 0x14006b816
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006b818
xor al, al
add rsp, 0x28
ret
Function at 0x1400012c0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov r10, rdx
mov qword [rdx], rax
mov r9, rcx
movabs r11, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov rax, r8
imul rdx, r11
shr rax, 8
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
imul rdx, r11
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
imul rdx, r11
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
imul rdx, r11
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
imul rdx, r11
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
imul rdx, r11
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r9 + 0x88]
imul rdx, r11
xor rdx, rax
imul rdx, r11
and rcx, rdx
mov rdx, qword [r9 + 0x60]
shl rcx, 4
add rcx, qword [r9 + 0x70]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400013a3
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x1400013a5
cmp rax, rcx
je 0x1400013a3
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x140001386
test rax, rax
cmove rax, rdx
mov qword [r10], rax
mov rax, r10
ret
xor eax, eax
test rax, rax
cmove rax, rdx
mov qword [r10], rax
mov rax, r10
ret

Function at 0x140001c00
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
mov rdi, r8
mov r8, qword [rdx + 8]
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + 8]
add r8, 8
movabs rax, 0xcbf29ce484222325
mov r9, qword [r10 + 0xc0]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 1]
xor rdx, rax
movzx eax, byte [r8 + 2]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 3]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 4]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 5]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 6]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 7]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r10 + 0xe8]
and rcx, rdx
mov rdx, qword [r10 + 0xd0]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, r9
je 0x140001cff
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [r8]
cmp rcx, qword [rax + 0x10]
je 0x140001ccf
nop word [rax + rax]
cmp rax, rdx
je 0x140001cff
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140001cc0
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x140001cff
cmp byte [rax + 0x38], 0
je 0x140001cff
cmp qword [rax + 0x30], 8
lea rcx, [rax + 0x18]
jb 0x140001cf0
mov rcx, qword [rax + 0x18]
xor edx, edx
mov qword [rax + 0x28], rdx
mov word [rcx], dx
add rsp, 0x30
pop rdi
ret
lea rcx, [r10 + 0xb8]
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x20]
call fcn.1400054e0
mov r8, 0xffffffffffffffff
mov rbx, qword [rax]
mov rax, qword [rdi + 0x10]
mov rdx, qword [rax]
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140001d30
lea rcx, [rbx + 0x18]
call fcn.140003e10
mov byte [rbx + 0x38], 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140001d60
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov r10, rcx
mov rdi, r8
mov r8, qword [rdx + 8]
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + 8]
add r8, 8
movabs rax, 0xcbf29ce484222325
mov r9, qword [r10 + 0xc0]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [r8 + 1]
xor rdx, rax
movzx eax, byte [r8 + 2]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 3]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 4]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 5]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 6]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 7]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r10 + 0xe8]
and rcx, rdx
mov rdx, qword [r10 + 0xd0]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, r9
je 0x140001e5f
mov rdx, qword [rdx + rcx*8]
mov rcx, qword [r8]
cmp rcx, qword [rax + 0x10]
je 0x140001e2f
nop word [rax + rax]
cmp rax, rdx
je 0x140001e5f
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140001e20
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x140001e5f
cmp byte [rax + 0x38], 0
jne 0x140001ead
cmp qword [rax + 0x30], 8
lea rcx, [rax + 0x18]
jb 0x140001e50
mov rcx, qword [rax + 0x18]
xor edx, edx
mov qword [rax + 0x28], rdx
mov word [rcx], dx
add rsp, 0x30
pop rdi
ret
lea rcx, [r10 + 0xb8]
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x20]
call fcn.1400054e0
mov r8, 0xffffffffffffffff
mov rbx, qword [rax]
mov rax, qword [rdi + 0x10]
mov rdx, qword [rax]
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140001e90
lea rcx, [rbx + 0x18]
call fcn.140003e10
mov byte [rbx + 0x38], 0
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140003220
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rdx + 8]
mov rbp, rcx
movabs r10, 0x100000001b3
mov r9, qword [rax + 8]
movabs rax, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, rax
mov rax, r9
imul rdx, r10
shr rax, 8
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x10
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x18
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x20
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x28
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x30
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rbp + 0x88]
imul rdx, r10
xor rdx, rax
mov rax, qword [rbp + 0x70]
imul rdx, r10
and rcx, rdx
mov rdx, qword [rbp + 0x60]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rdx
je 0x140003319
mov rax, qword [rax + rcx*8]
cmp r9, qword [rbx + 0x10]
je 0x14000331b
cmp rbx, rax
je 0x140003319
mov rbx, qword [rbx + 8]
cmp r9, qword [rbx + 0x10]
jne 0x140003308
jmp 0x14000331b
xor ebx, ebx
mov rax, qword [r8 + 8]
test rbx, rbx
lea r8, [rsp + 0x58]
cmove rbx, rdx
lea rdx, [rsp + 0x30]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x58], rcx
lea rcx, [rbp + 0x18]
mov rsi, qword [rbx + 0x18]
call fcn.1400057f0
mov rdi, qword [rax]
mov eax, dword [rsi + 0x18]
add rdi, 0x18
mov dword [rdi + 0x18], eax
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
cmp word [rbx + 0x20], 0
je 0x1400033af
mov rcx, rbp
call fcn.140003630
lea rcx, [rbp + 0x178]
mov word [rsp + 0x50], ax
lea r8, [rsp + 0x50]
mov word [rdi], ax
lea rdx, [rsp + 0x30]
call fcn.1400052a0
mov rcx, qword [rax]
add rcx, 0x18
cmp qword [rcx + 0x18], 0x10
jb 0x1400033a9
mov rcx, qword [rcx]
mov qword [rdi + 8], rcx
jmp 0x1400033c1
movzx eax, word [rsi]
mov word [rdi], ax
mov rax, qword [rsi + 8]
mov qword [rdi + 8], rax
inc word [rbx + 0x20]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.140006600
mov qword [rbp + 0x1b8], rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140026a70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140003570
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rdx, qword [rdx + 8]
add rcx, 0xf8
add rdx, 8
call fcn.1400038d0
mov rdx, qword [rbx + 8]
lea rcx, [rdi + 0x18]
add rdx, 8
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140003af0