joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006c760
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14006c7d5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x14006c7d5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x14006c7c5
nop
cmp rbx, rcx
jae 0x14006c7d5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x14006c7b0
cmp rbx, rcx
jae 0x14006c7d5
cmp word [rbx], 0
je 0x14006c7d5
mov rax, rbx
jmp 0x14006c7d7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400869b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp qword [r8 + 0x50], rcx
je 0x1400869e0
lea r9, str.Field_does_not_match_message_type.
mov rdx, rbx
lea r8, str.GetEnumValue
call fcn.140089920
cmp dword [rbx + 0x3c], 3
jne 0x1400869ff
mov rcx, qword [rdi]
lea r9, str.Field_is_repeated__the_method_requires_a_singular_field.
lea r8, str.GetEnumValue
mov rdx, rbx
call fcn.140089920
mov rcx, rbx
call fcn.14008d6b0
movsxd rcx, eax
lea rax, [0x1402e98b0]
cmp dword [rax + rcx*4], 8
je 0x140086a2f
mov rcx, qword [rdi]
lea r8, str.GetEnumValue
mov r9d, 8
mov rdx, rbx
call fcn.140089a10
cmp byte [rbx + 0x42], 0
je 0x140086a53
mov rcx, rbx
call fcn.1400ffab0
mov ecx, dword [rdi + 0x28]
mov edx, dword [rbx + 0x44]
add rcx, rsi
mov r8d, dword [rax + 0x10]
call fcn.1400b5910
mov edi, eax
jmp 0x140086a63
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140081560
mov edi, dword [rax]
mov rcx, rbx
call fcn.1400ffc30
mov rcx, rax
mov edx, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp 0x1400ea740
Function at 0x14008dbf0
Capabilities:
Hash data using fnv

Disassembly:
mov r9, rdx
movabs rax, 0xcbf29ce484222325
mov rdx, rcx
movabs rcx, 0x100000001b3
movzx r8d, byte [r9]
xor r8, rax
movzx eax, byte [r9 + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rdx + 0x30]
and rcx, r8
mov r8, qword [rdx + 0x18]
mov rdx, qword [rdx + 8]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
nop dword [rax]
cmp r10, rdx
jne 0x14008dc9a
mov rcx, rdx
jmp 0x14008dca1
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14008dcbe
mov rcx, qword [r9]
cmp qword [rax + 0x10], rcx
je 0x14008dcb4
mov rax, qword [rax]
jmp 0x14008dc90
cmp rax, rdx
je 0x14008dcbe
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x14008e6b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r11, qword [r10 + 0x30]
and r11, r9
mov rbx, qword [r10 + 8]
mov rdx, r11
add rdx, rdx
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x14008e7bb
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x14008e7bb
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x14008e774
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.14026f798
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x14008e851
mov rax, qword [rdi]
cmp rbx, rax
je 0x14008e7f0
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r11, 4
mov rdx, qword [r10 + 0x18]
add rdx, r11
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x14008e812
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r11 + 8], rdi
jmp 0x14008e83e
cmp rax, rbx
jne 0x14008e81c
mov qword [rdx], rdi
jmp 0x14008e83e
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14008e83e
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r11 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r11 + 8], rcx
mov rcx, r10
call fcn.140091e20
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14008ea50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r14, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r12, qword [r14 + 0x30]
and r12, r9
mov rdi, qword [r14 + 8]
mov rbx, r12
add rbx, rbx
mov rax, qword [r14 + 0x18]
mov rcx, qword [rax + rbx*8]
cmp rcx, rdi
jne 0x14008eb11
mov rbx, rdi
jmp 0x14008eb20
mov rbx, qword [rax + rbx*8 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rcx
je 0x14008eb41
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x14008eb20
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x14008ec2c
mov rdi, qword [rdi]
mov r13, qword [rdi + 8]
mov r9, r8
mov r8, r13
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.14008e3b0
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffe
sub rcx, rax
cmp rcx, 1
jb 0x14008ec44
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14008ebcc
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
shl r12, 4
mov rdx, qword [r14 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, rcx
jne 0x14008ebed
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x14008ec19
cmp rax, rbx
jne 0x14008ebf7
mov qword [rdx], rdi
jmp 0x14008ec19
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14008ec19
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r14
call fcn.140091e20
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.14026e7de
int3
Function at 0x14008ed20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14008ede4
cmp rax, r8
jne 0x14008edda
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14008edef
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14008edef
cmp rax, r8
jne 0x14008edef
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.14026f798
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a0fc0
Capabilities:
Encode data using base64

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1403e5188]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r8
mov r10, rcx
test edx, edx
jg 0x1400a0ff1
xor eax, eax
jmp 0x1400a120f
lea ecx, [rdx*4]
lea eax, [r9 + r9*2]
cmp ecx, eax
jg 0x1400a0fea
mov rbx, rsi
movsxd r8, r9d
add r8, rsi
movsxd rdi, edx
add rdi, r10
lea rdx, [rdi - 3]
mov r9, qword [rsp + 0xb0]
cmp r10, rdx
jae 0x1400a1075
mov ecx, dword [r10]
bswap ecx
shr ecx, 8
mov eax, ecx
shr rax, 0x12
movzx eax, byte [rax + r9]
mov byte [rbx], al
and ecx, 0x3ffff
mov eax, ecx
shr rax, 0xc
movzx eax, byte [rax + r9]
mov byte [rbx + 1], al
and ecx, 0xfff
mov eax, ecx
shr rax, 6
movzx eax, byte [rax + r9]
mov byte [rbx + 2], al
and ecx, 0x3f
movzx ecx, byte [rcx + r9]
mov byte [rbx + 3], cl
add rbx, 4
add r10, 3
cmp r10, rdx
jb 0x1400a1020
sub r8d, ebx
sub edi, r10d
mov ecx, edi
je 0x1400a120b
sub ecx, 1
je 0x1400a11bf
sub ecx, 1
je 0x1400a1159
cmp ecx, 1
je 0x1400a10ed
mov r9d, 0x890
lea r8, str.G:protobuf_cpp_3.9.1protobuf_3.9.1_srcgoogleprotobuf_stubs_strutil.cc
mov edx, 3
lea rcx, [rsp + 0x30]
call fcn.140077fb0
nop
lea rdx, str.Logic_problem__szsrc_
mov rcx, rax
call fcn.140078cb0
mov rcx, rax
mov edx, edi
call fcn.140078700
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.1400781b0
nop
lea rcx, [rsp + 0x30]
call fcn.1400780e0
jmp 0x1400a120b
lea eax, [r8 - 4]
test eax, eax
js 0x1400a0fea
movzx eax, word [r10 + 1]
ror ax, 8
movzx ecx, ax
movzx eax, byte [r10]
shl eax, 0x10
add ecx, eax
mov eax, ecx
shr rax, 0x12
movzx eax, byte [rax + r9]
mov byte [rbx], al
and ecx, 0x3ffff
mov edx, ecx
mov eax, ecx
shr rax, 0xc
movzx eax, byte [rax + r9]
mov byte [rbx + 1], al
and edx, 0xfff
mov eax, edx
shr rax, 6
movzx eax, byte [rax + r9]
mov byte [rbx + 2], al
and edx, 0x3f
movzx eax, byte [rdx + r9]
mov byte [rbx + 3], al
add rbx, 4
jmp 0x1400a120b
sub r8d, 3
js 0x1400a0fea
movzx eax, word [r10]
ror ax, 8
movzx ecx, ax
mov eax, ecx
shr rax, 0xa
movzx eax, byte [rax + r9]
mov byte [rbx], al
and ecx, 0x3ff
mov eax, ecx
shr rax, 4
movzx eax, byte [rax + r9]
mov byte [rbx + 1], al
and ecx, 0xf
shl ecx, 2
movzx ecx, byte [rcx + r9]
mov byte [rbx + 2], cl
add rbx, 3
cmp byte [rsp + 0xb8], 0
je 0x1400a120b
lea eax, [r8 - 1]
test eax, eax
js 0x1400a0fea
mov byte [rbx], 0x3d
inc rbx
jmp 0x1400a120b
sub r8d, 2
js 0x1400a0fea
movzx ecx, byte [r10]
mov eax, ecx
shr rax, 2
movzx eax, byte [rax + r9]
mov byte [rbx], al
and ecx, 3
shl ecx, 4
movzx ecx, byte [rcx + r9]
mov byte [rbx + 1], cl
add rbx, 2
cmp byte [rsp + 0xb8], 0
je 0x1400a120b
lea eax, [r8 - 2]
test eax, eax
js 0x1400a0fea
mov word [rbx], 0x3d3d
add rbx, 2
sub ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14026fc70
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b5090
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
push rbp
sub rsp, 0x20
mov r9, qword [rcx + 8]
mov rbp, r8
mov qword [rsp + 0x30], rbx
mov rcx, r9
mov qword [rsp + 0x40], rsi
mov r11, r9
mov qword [rsp + 0x18], rdi
mov rbx, r9
mov rdi, r9
mov qword [rsp + 8], r14
mov r14, qword [0x1403f1fd8]
mov r8, r9
mov rsi, r9
shr rdi, 0x18
mov rax, r9
shr rcx, 0x38
shr r11, 0x30
shr rbx, 0x28
shr r8, 0x20
shr rsi, 0x10
shr rax, 8
mov r10d, edx
test r14, r14
je 0x1400b51f9
movzx eax, al
mov qword [rsp + 0x10], r12
movabs r12, 0x100000001b3
mov qword [rsp], r15
movabs r15, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, r15
imul rdx, r12
xor rdx, rax
movzx eax, sil
imul rdx, r12
xor rdx, rax
movzx eax, dil
imul rdx, r12
xor rdx, rax
movzx eax, r8b
mov r8, qword [r14 + 8]
imul rdx, r12
xor rdx, rax
movzx eax, bl
imul rdx, r12
xor rdx, rax
movzx eax, r11b
imul rdx, r12
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, r12
xor rdx, rcx
movzx ecx, r10b
xor rcx, r15
mov r15, qword [rsp]
imul rcx, r12
imul rdx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3a]
imul rcx, r12
xor rcx, rax
movzx eax, byte [rsp + 0x3b]
imul rcx, r12
xor rcx, rax
imul rcx, r12
mov r12, qword [rsp + 0x10]
xor rcx, rdx
mov rdx, qword [r14 + 0x18]
and rcx, qword [r14 + 0x30]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r11, qword [rdx + rcx*8]
lea rdx, [rdx + rcx*8]
cmp r11, r8
jne 0x1400b51cd
mov rcx, r8
jmp 0x1400b51d4
mov rcx, qword [rdx + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b51f9
cmp qword [rax + 0x10], r9
jne 0x1400b51e5
cmp dword [rax + 0x18], r10d
je 0x1400b51ea
mov rax, qword [rax]
jmp 0x1400b51c3
cmovne rax, r8
cmp rax, r8
je 0x1400b51f9
add rax, 0x20
jmp 0x1400b51fb
xor eax, eax
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
test rax, rax
jne 0x1400b521a
add rsp, 0x20
pop rbp
ret
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
mov al, 1
movups xmmword [rbp + 0x10], xmm1
add rsp, 0x20
pop rbp
ret

Function at 0x1400bbc00
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [rdx + 1]
movabs r11, 0x100000001b3
movzx r9d, byte [rdx]
mov r8, rdx
mov r10, rcx
movabs rcx, 0xcbf29ce484222325
xor r9, rcx
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 2]
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 3]
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 4]
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 5]
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 6]
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 7]
movzx edx, byte [rdx + 8]
xor rdx, rcx
movzx ecx, byte [r8 + 0xb]
imul r9, r11
imul rdx, r11
xor r9, rax
movzx eax, byte [r8 + 9]
imul r9, r11
xor rdx, rax
movzx eax, byte [r8 + 0xa]
imul rdx, r11
xor rax, rdx
imul rax, r11
xor rax, rcx
imul rax, r11
xor rax, r9
and rax, qword [r10 + 0x30]
ret
Function at 0x1400c2df0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, qword [rdx + 8]
xor r8d, r8d
mov r11, rcx
mov r9, r10
movzx eax, byte [r10]
test al, al
je 0x1400c2e37
nop dword [rax]
nop dword [rax + rax]
movsx rax, al
lea r8, [r8 + r8*4]
add r8, rax
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x1400c2e20
mov rbx, qword [rdx]
mov rdx, qword [r11 + 0x18]
imul rcx, rbx, 0x1000193
xor rcx, r8
and rcx, qword [r11 + 0x30]
mov r11, qword [r11 + 8]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov rdi, qword [rdx + rcx*8]
lea rsi, [rdx + rcx*8]
cmp rdi, r11
jne 0x1400c2e6f
mov rcx, r11
jmp 0x1400c2e76
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400c2edc
cmp qword [rax + 0x10], rbx
jne 0x1400c2eaa
mov rcx, qword [rax + 0x18]
mov r9, r10
sub r9, rcx
nop dword [rax + rax]
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400c2ea5
inc rcx
test edx, edx
jne 0x1400c2e90
test r8d, r8d
je 0x1400c2eaf
mov rax, qword [rax]
jmp 0x1400c2e65
mov r8, qword [rax + 0x18]
sub r8, r10
nop word [rax + rax]
movzx edx, byte [r10]
movzx ecx, byte [r10 + r8]
sub edx, ecx
jne 0x1400c2ed4
inc r10
test ecx, ecx
jne 0x1400c2ec0
test edx, edx
cmovne rax, r11
jmp 0x1400c2edf
mov rax, r11
cmp rax, r11
jne 0x1400c2ef6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rax, qword [rax + 0x20]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400c5840
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rdx
mov r9, rcx
movsxd rdx, dword [r8 + 8]
mov r10, qword [r8]
imul r8, rdx, 0x1000193
imul rax, r10, 0x100011b
xor r8, rax
and r8, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r11, r8
shl r11, 4
add r11, qword [rcx + 0x18]
mov rax, qword [r11]
cmp rbx, rax
je 0x1400c58e9
mov rbx, qword [r11 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rax
je 0x1400c58e9
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x1400c58a0
cmp edx, dword [rbx + 0x18]
jne 0x1400c58a0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x28
mov rcx, rdi
call fcn.14026f798
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400c597f
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c591e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r8, 4
mov rdx, qword [r9 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r9 + 8]
jne 0x1400c5940
mov qword [rdx], rdi
mov rax, qword [r9 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x1400c596c
cmp rax, rbx
jne 0x1400c594a
mov qword [rdx], rdi
jmp 0x1400c596c
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c596c
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r9
call fcn.1400f92d0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c5990
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov rsi, rdx
mov r9, rcx
movsxd rdx, dword [r8 + 8]
mov r10, qword [r8]
imul r8, rdx, 0x1000193
imul rax, r10, 0x100011b
xor r8, rax
and r8, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r11, r8
shl r11, 4
add r11, qword [rcx + 0x18]
mov rax, qword [r11]
cmp rbx, rax
je 0x1400c5a39
mov rbx, qword [r11 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rax
je 0x1400c5a39
mov rbx, qword [rbx + 8]
cmp r10, qword [rbx + 0x10]
jne 0x1400c59f0
cmp edx, dword [rbx + 0x18]
jne 0x1400c59f0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov edx, 0x28
mov rcx, rdi
call fcn.14026f798
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400c5acf
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c5a6e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r8, 4
mov rdx, qword [r9 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r9 + 8]
jne 0x1400c5a90
mov qword [rdx], rdi
mov rax, qword [r9 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x1400c5abc
cmp rax, rbx
jne 0x1400c5a9a
mov qword [rdx], rdi
jmp 0x1400c5abc
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c5abc
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r9
call fcn.1400f9370
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c5ae0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, r8
mov rsi, rdx
mov r11, rcx
mov r10, qword [r8 + 8]
xor r9d, r9d
movzx eax, byte [r10]
test al, al
je 0x1400c5b37
nop dword [rax]
lea r9, [r9 + r9*4]
movsx rax, al
add r9, rax
lea r10, [r10 + 1]
movzx eax, byte [r10]
test al, al
jne 0x1400c5b20
mov r15, qword [r8]
imul r10, r15, 0x1000193
xor r10, r9
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
shl r10, 4
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + r10]
cmp rbx, rax
je 0x1400c5bce
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400c5bce
mov rbx, qword [rbx + 8]
cmp r15, qword [rbx + 0x10]
jne 0x1400c5b65
mov rcx, qword [r14 + 8]
mov r9, qword [rbx + 0x18]
sub r9, rcx
nop
movzx r8d, byte [rcx]
movzx edx, byte [rcx + r9]
sub r8d, edx
jne 0x1400c5b95
inc rcx
test edx, edx
jne 0x1400c5b80
test r8d, r8d
jne 0x1400c5b65
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r11 + 0x10]
lea edx, [r8 + 0x28]
mov rcx, rdi
call fcn.14026f798
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x1400c5c60
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400c5c03
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1400c5c21
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x1400c5c4d
cmp rax, rbx
jne 0x1400c5c2b
mov qword [rdx], rdi
jmp 0x1400c5c4d
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400c5c4d
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1400f9410
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret