joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028a00
Capabilities:
Hash data using fnv

Disassembly:
mov r9, rcx
mov dword [rsp + 0x10], edx
cmp edx, dword [rcx + 0xd0]
ja 0x140028aac
movabs rcx, 0x100000001b3
movzx r8d, dl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rsp + 0x11]
imul r8, rcx
xor r8, rax
movzx eax, byte [rsp + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [rsp + 0x13]
imul r8, rcx
xor r8, rax
mov rax, qword [r9 + 0x98]
imul r8, rcx
and r8, qword [r9 + 0xc0]
shl r8, 4
add r8, qword [r9 + 0xa8]
mov rcx, qword [r8 + 8]
cmp rcx, rax
je 0x140028a9c
mov r8, qword [r8]
cmp edx, dword [rcx + 0x10]
je 0x140028a9e
cmp rcx, r8
je 0x140028a9c
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x140028a80
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
xor ecx, ecx
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
xor al, al
ret
Function at 0x140029150
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1400292ff
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140029010
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1400292c4
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14002923d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400292b3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14002927a
mov r10, qword [rdx]
cmp r10, rax
je 0x140029274
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400292b3
cmp r9, rdx
je 0x14002928f
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400292d9
cmp r9, rdx
jne 0x140029280
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1400291f0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400292b3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140029310
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14002940e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x14002941a
cmp rbx, rbp
jne 0x1400293c0
cmp qword [rsp + 0x68], r14
jne 0x1400293ed
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x140029429
mov qword [r15], r12
mov rax, r12
jmp 0x14002942c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400293ed
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1400294c6
cmp rbx, rbp
jne 0x1400294a0
jmp 0x1400293ea
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140029440
jmp 0x1400293ed
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14002958c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14002951a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x140029310
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002955a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14016cca4
mov rcx, rbx
test rbx, rbx
jne 0x140029540
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400240e0
add rsp, 0x20
pop rdi
ret
Function at 0x1400294e0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14002940e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x14002941a
cmp rbx, rbp
jne 0x1400293c0
cmp qword [rsp + 0x68], r14
jne 0x1400293ed
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x140029429
mov qword [r15], r12
mov rax, r12
jmp 0x14002942c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400293ed
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x1400294c6
cmp rbx, rbp
jne 0x1400294a0
jmp 0x1400293ea
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140029440
jmp 0x1400293ed
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14002958c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14002951a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x140029310
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002955a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14016cca4
mov rcx, rbx
test rbx, rbx
jne 0x140029540
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.1400240e0
add rsp, 0x20
pop rdi
ret
Function at 0x1400a97e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400a996f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140029010
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400a9934
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400a98b2
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400a9923
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1400a98eb
mov r10, qword [rdx]
cmp r10, rax
je 0x1400a98e5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400a9923
cmp r8, rdx
je 0x1400a98ff
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1400a9949
cmp r8, rdx
jne 0x1400a98f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400a9880
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400a9923
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400a9980
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400a9a76
mov rax, qword [rsi + 0x38]
shr rax, 3
mov qword [r11 + 0x18], rbx
mov qword [r11 - 0x18], rdi
cmp rax, rcx
jbe 0x1400a9b08
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x30], r14
mov r14, qword [rsi + 8]
mov rbp, qword [r14]
cmp rbp, r14
je 0x1400a9a62
mov rdx, qword [rsi + 0x18]
movabs rax, 0xcbf29ce484222325
movzx ecx, byte [rbp + 0x10]
mov rbx, rbp
xor rcx, rax
mov qword [r11 - 0x20], r12
mov r12, qword [rbp + 8]
movabs rax, 0x100000001b3
imul rcx, rax
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x38], r15
mov r15, qword [rsi + 0x30]
and r15, rcx
mov qword [rsp + 0x68], rdx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov r13, qword [r15 + 8]
mov qword [rsp + 0x60], rax
nop
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, r13
je 0x1400a9a7c
cmp rbx, r14
jne 0x1400a9a20
cmp qword [rsp + 0x60], rbp
jne 0x1400a9a4b
mov qword [r15], rbx
mov r13, qword [rsp + 0x30]
mov r15, qword [rsp + 0x20]
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r12, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
cmp qword [rsp + 0x60], rbp
jne 0x1400a9a8b
mov qword [r15], r14
mov rax, r14
jmp 0x1400a9a8e
mov rax, r12
mov qword [r15 + 8], rax
cmp rbx, r14
je 0x1400a9a4b
mov r13, qword [rsp + 0x68]
nop dword [rax]
movzx ecx, byte [rbx + 0x10]
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
and r15, rcx
shl r15, 4
add r15, r13
mov rbp, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14016cca4
dec qword [rsi + 0x10]
cmp rdi, rbp
je 0x1400a9af7
cmp rbx, r14
jne 0x1400a9ad1
jmp 0x1400a9a48
mov qword [r15], r14
mov qword [r15 + 8], r14
cmp rbx, r14
jne 0x1400a9aa0
jmp 0x1400a9a4b
mov rcx, qword [rsi + 8]
xor edi, edi
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400a9b35
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14016cca4
mov rcx, rbx
test rbx, rbx
jne 0x1400a9b20
mov rax, qword [rsi + 8]
lea r8, [rsp + 0x60]
mov qword [rax], rax
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
mov qword [rsi + 0x10], rdi
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x60], rax
call fcn.1400240e0
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x40]
add rsp, 0x50
pop rsi
ret
Function at 0x1400b7230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rbx, rcx
xor r15d, r15d
mov ebp, r15d
cmp dword [rcx + 0xf0], r15d
jbe 0x1400b73c8
lea r12, vtable.MP2kTrack.0
nop dword [rax]
nop word [rax + rax]
mov edi, dword [rbx + 0x38]
add edi, 8
lea edi, [rdi + rbp*4]
cmp byte [rbx + 0xe8], 0
je 0x1400b72a9
mov rsi, qword [rbx + 0xd0]
cmp edi, dword [rsi + 0x10]
jb 0x1400b7296
lea eax, [rdi + 4]
cmp eax, dword [rsi + 0x14]
jbe 0x1400b72a0
mov edx, edi
mov rcx, rsi
call fcn.140121da0
sub edi, dword [rsi + 0x10]
mov rdx, qword [rsi + 8]
jmp 0x1400b72b6
sub edi, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
lea eax, [rdi + 3]
movzx esi, byte [rax + rdx]
lea eax, [rdi + 2]
movzx eax, byte [rax + rdx]
shl esi, 8
or esi, eax
lea eax, [rdi + 1]
movzx eax, byte [rax + rdx]
shl esi, 8
or esi, eax
movzx eax, byte [rdi + rdx]
shl esi, 8
or esi, eax
mov ecx, 0x178
call fcn.14016cc68
mov rdi, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x1400b737e
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], 0xf
mov ecx, dword [0x140184138]
mov dword [rsp + 0x30], ecx
movzx eax, byte [0x14018413c]
mov byte [rsp + 0x34], al
mov byte [rsp + 0x35], 0
lea r8d, [rsi - 0x8000000]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call fcn.140024170
mov qword [rdi], r12
mov byte [rdi + 0x150], 0
mov dword [rdi + 0x154], r15d
mov byte [rdi + 0x158], 0
mov qword [rdi + 0x160], r15
mov qword [rdi + 0x168], r15
mov qword [rdi + 0x170], r15
jmp 0x1400b7381
mov rdi, r15
mov qword [rsp + 0x80], rdi
mov rdx, qword [rbx + 0x140]
cmp rdx, qword [rbx + 0x148]
je 0x1400b73a6
mov qword [rdx], rdi
add qword [rbx + 0x140], 8
jmp 0x1400b73ba
lea r8, [rsp + 0x80]
lea rcx, [rbx + 0x138]
call fcn.140006b30
inc ebp
cmp ebp, dword [rbx + 0xf0]
jb 0x1400b7270
mov r9, qword [rbx + 0x140]
mov rcx, qword [rbx + 0x138]
cmp rcx, r9
je 0x1400b740d
mov edx, dword [rbx + 0x38]
nop
mov rax, qword [rcx]
mov r8d, dword [rax + 0x38]
cmp r8d, edx
jae 0x1400b7404
mov eax, dword [rbx + 0x3c]
test eax, eax
je 0x1400b73fb
sub eax, r8d
add eax, edx
mov dword [rbx + 0x3c], eax
mov rax, qword [rcx]
mov edx, dword [rax + 0x38]
mov dword [rbx + 0x38], edx
add rcx, 8
cmp rcx, r9
jne 0x1400b73e0
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c24d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rbp, rcx
mov edx, dword [rcx + 0x44]
sub edx, 4
call fcn.140018a00
mov r14d, dword [rbp + 0x44]
mov edi, eax
shr edi, 0x10
mov esi, 1
movzx ebx, ax
and edi, 0x7f
mov word [r15], bx
mov ecx, dword [rbp + 0x48]
add ecx, dword [rbp + 0x44]
cmp r14d, ecx
jae 0x1400c2201
mov qword [rsp + 0x50], r12
mov r12d, 0x7fff
mov qword [rsp + 0x58], r13
mov r13d, 0xffff8001
nop
mov edx, r14d
mov rcx, rbp
inc r14d
call fcn.140018550
movsxd rcx, edi
lea r10, [0x140000000]
movzx edx, al
mov r9d, dword [r10 + rcx*4 + 0x18df10]
mov r8d, r9d
shr r8d, 3
test al, 1
je 0x1400c2107
mov ecx, r9d
shr ecx, 2
add r8d, ecx
test dl, 2
je 0x1400c2114
mov eax, r9d
shr eax, 1
add r8d, eax
test dl, 4
lea eax, [r9 + r8]
cmove eax, r8d
test dl, 8
jne 0x1400c2131
add eax, ebx
cmp eax, r12d
mov ebx, eax
cmovg ebx, r12d
jmp 0x1400c213a
sub ebx, eax
cmp ebx, r13d
cmovl ebx, r13d
mov rax, rdx
and eax, 7
mov ecx, dword [r10 + rax*4 + 0x18e078]
add ecx, edi
cmp ecx, 0x58
jle 0x1400c2159
mov ecx, 0x58
xor r11d, r11d
jmp 0x1400c2165
test ecx, ecx
mov r11d, 0
cmovs ecx, r11d
mov eax, esi
inc esi
shr dl, 4
mov word [r15 + rax*2], bx
movsxd rax, ecx
mov r9d, dword [r10 + rax*4 + 0x18df10]
mov r8d, r9d
shr r8d, 3
test dl, 1
je 0x1400c2191
mov eax, r9d
shr eax, 2
add r8d, eax
test dl, 2
je 0x1400c219e
mov eax, r9d
shr eax, 1
add r8d, eax
test dl, 4
lea eax, [r9 + r8]
cmove eax, r8d
test dl, 8
jne 0x1400c21b9
add ebx, eax
cmp ebx, r12d
cmovg ebx, r12d
jmp 0x1400c21c2
sub ebx, eax
cmp ebx, r13d
cmovl ebx, r13d
and edx, 7
mov edi, dword [r10 + rdx*4 + 0x18e078]
add edi, ecx
cmp edi, 0x58
jle 0x1400c21db
mov edi, 0x58
jmp 0x1400c21e1
test edi, edi
cmovs edi, r11d
mov word [r15 + rsi*2], bx
inc esi
mov eax, dword [rbp + 0x48]
add eax, dword [rbp + 0x44]
cmp r14d, eax
jb 0x1400c20d0
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx eax, byte [rcx + 0x90]
mov rdi, rdx
mov rbx, rcx
cmp al, 2
jne 0x1400c24fa
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400c2070
mov r8d, dword [rcx + 0x48]
mov r9, rdi
mov edx, dword [rcx + 0x44]
test al, al
jne 0x1400c252a
call fcn.1400185c0
xor eax, eax
cmp dword [rbx + 0x48], eax
jbe 0x1400c252f
xor byte [rax + rdi], 0x80
inc eax
cmp eax, dword [rbx + 0x48]
jb 0x1400c2514
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1400185c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140122980
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov ebp, dword [rsp + 0x40]
xor esi, esi
mov edi, r9d
mov r14d, r8d
mov r15, rdx
mov r12, rcx
test ebp, ebp
je 0x140122a8b
mov qword [rsp + 0x20], rbx
mov ebx, r9d
shr ebx, 0x10
nop word [rax + rax]
mov eax, esi
lea r10d, [rsi + 0x6000000]
shr rax, 2
xor r10d, r14d
movzx edx, r10w
add esi, 4
not dx
lea r11, [rax*4]
movzx eax, dx
mov ecx, eax
shl ax, 2
shr ecx, 0xe
or cx, ax
add cx, dx
movzx eax, cx
mov r9d, eax
shl ax, 4
shr r9d, 0xc
or r9w, ax
movzx eax, di
xor ax, dx
and ax, cx
xor r9w, ax
mov eax, r10d
shr eax, 0x10
not ax
xor r9w, ax
movzx eax, r9w
mov edx, eax
shl ax, 2
shr edx, 0xe
or dx, ax
add dx, r9w
movzx ecx, dx
mov eax, ecx
shl cx, 4
shr eax, 0xc
movzx r8d, ax
movzx eax, cx
mov ecx, ebx
or r8d, eax
movzx eax, r9w
xor ecx, eax
movzx eax, dx
and ecx, eax
movzx eax, di
xor r8d, ecx
mov ecx, dword [r11 + r12]
xor r8d, eax
movzx eax, r10w
xor r8d, eax
bswap ecx
mov eax, r8d
shl eax, 0x10
or eax, r8d
xor ecx, eax
bswap ecx
mov dword [r11 + r15], ecx
cmp esi, ebp
jb 0x1401229c0
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x140123e80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r12
push r13
push r15
sub rsp, 0x38
movsxd r13, dword [rsp + 0x80]
mov r15, r8
mov r12, rdx
mov rsi, rcx
test r13, r13
jle 0x14012402f
mov qword [rsp + 0x60], rbx
sub r12, rcx
mov qword [rsp + 0x68], rbp
mov ebp, dword [rsp + 0x88]
mov qword [rsp + 0x70], rdi
mov edi, dword [rsp + 0x98]
mov qword [rsp + 0x30], r14
mov r14d, dword [rsp + 0x90]
movzx eax, r14w
movzx edx, bp
mov dword [rsp + 0x20], eax
lea eax, [r9 + rdi]
sar ebp, 0x10
sar r14d, 0x10
mov dword [rsp + 0x80], eax
sub r15, rcx
mov dword [rsp + 0x24], edx
nop word [rax + rax]
movzx ecx, byte [rsi]
movzx ebx, al
mov r8d, ebx
call fcn.140123d20
mov ecx, eax
mov r8d, ebx
and ecx, 0x7f
sar eax, 7
add ecx, ecx
and eax, 1
or ecx, eax
mov edx, ebp
call fcn.140123dd0
xor eax, dword [rsp + 0xa0]
mov ebx, dword [rsp + 0x80]
mov ecx, eax
mov edx, dword [rsp + 0x20]
and ecx, 0x7f
sar eax, 7
add ecx, ecx
and eax, 1
sar ebx, 8
or ecx, eax
mov r8d, ebx
call fcn.140123dd0
mov ecx, eax
mov r8d, ebx
and ecx, 0x7f
sar eax, 7
add ecx, ecx
and eax, 1
or ecx, eax
mov edx, r14d
call fcn.140123d20
mov edx, dword [rsp + 0x24]
mov byte [r12 + rsi], al
mov eax, dword [rsp + 0x80]
movzx ecx, byte [rsi]
sub eax, edi
xor eax, 0x1fc0
inc eax
add edi, eax
movzx ebx, dil
mov r8d, ebx
call fcn.140123d20
mov ecx, eax
mov r8d, ebx
and ecx, 0x7f
sar eax, 7
add ecx, ecx
and eax, 1
or ecx, eax
mov edx, ebp
call fcn.140123dd0
xor eax, dword [rsp + 0xa0]
mov edx, dword [rsp + 0x20]
mov ecx, eax
and ecx, 0x7f
sar eax, 7
add ecx, ecx
sar edi, 8
and eax, 1
mov r8d, edi
or ecx, eax
call fcn.140123dd0
mov ecx, eax
mov r8d, edi
and ecx, 0x7f
sar eax, 7
add ecx, ecx
and eax, 1
or ecx, eax
mov edx, r14d
call fcn.140123d20
mov edi, dword [rsp + 0x98]
mov byte [r15 + rsi], al
lea rsi, [rsi + 1]
mov eax, dword [rsp + 0x80]
inc eax
mov dword [rsp + 0x80], eax
sub r13, 1
mov edx, dword [rsp + 0x24]
jne 0x140123f00
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x38
pop r15
pop r13
pop r12
pop rsi
ret
Function at 0x14014a6a0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x14014a75e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x14014a760
cmp rax, rdx
je 0x14014a75e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x14014a741
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret