joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023940
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor r9d, r9d
mov r14d, r8d
mov rsi, rdx
mov rbp, rcx
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [0x140316148]
mov qword [rsi + 8], rax
mov rdi, rax
lea r15, [0x14059b930]
test rax, rax
jne 0x1400239b2
call qword [0x140316450]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x140023abe
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [0x140316148]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x140023a01
call qword [0x140316450]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x140023ad0
xor ecx, ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r8, [0x140023af0]
mov r9, rsi
mov dword [rsp + 0x20], ecx
mov edx, r14d
mov dword [rsp + 0x68], ecx
call fcn.1402cf0a8
mov qword [rbp + 8], rax
test rax, rax
jne 0x140023a77
call qword [0x140316450]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x140023a54
mov rcx, rdi
call qword [0x140316430]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140023a63
call qword [0x140316430]
test ebx, ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], r15
setne byte [rsp + 0x34]
test ebx, ebx
jne 0x140023aac
test rdi, rdi
je 0x140023a93
mov edx, 0xffffffff
mov rcx, rdi
call qword [0x140316140]
mov rcx, rdi
call qword [0x140316430]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
lea rdx, [0x14059bb2c]
lea rcx, [rsp + 0x30]
call fcn.140016ed0
int3
lea rdx, [0x14059bb00]
lea rcx, [rsp + 0x30]
call fcn.140016ed0
int3
lea rdx, [0x14059bb18]
lea rcx, [rsp + 0x30]
call fcn.140016ed0
int3
Function at 0x14005fa70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov r14, rcx
mov ebp, edx
jne 0x14005fa90
xor al, al
add rsp, 0x38
pop r14
pop rbp
ret
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x48]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rcx + 0x50]
cmp rbx, rdi
je 0x14005fbbb
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x400000006cc
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x14005fb32
mov rax, rbp
mov rdi, r13
neg rax
mov rcx, rbp
shl rax, 3
add qword [rsi + 0x18], rax
mov rdx, qword [rsi + 0x18]
test ebp, ebp
je 0x14005fb11
mov rax, rdx
nop
xor rdi, qword [rax]
lea rax, [rax + 8]
imul rdi, r12
sub rcx, 1
jne 0x14005fb00
lea rax, [rdx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x14005fb27
mov rcx, rsi
call fcn.14006c770
mov rdx, qword [rsi + 0x18]
lea rax, [rdx + 8]
mov qword [rsi + 0x18], rax
mov qword [rdx], rdi
cmp qword [rbx + 0x30], r15
je 0x14005fb64
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x14005fb64
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.14005fa70
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005fb41
cmp qword [rbx + 0x40], r15
je 0x14005fb96
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x14005fb96
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r15
call fcn.14005fa70
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005fb73
mov rdi, qword [r14 + 0x50]
add rbx, 0x78
cmp rbx, rdi
jne 0x14005fad6
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rax, qword [rdi - 0x70]
mov rbx, qword [rsp + 0x50]
mov byte [rdi - 8], 0
cmp ebp, dword [rax + 0xac]
jae 0x14005fbd7
call fcn.140063860
jmp 0x14005fbe4
cmp ebp, dword [rax + 0xb0]
jbe 0x14005fc1b
call fcn.1400637c0
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x14005fc00
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rdi - 0x60], rax
xor al, al
mov rdi, qword [rsp + 0x60]
mov byte [r14 + 0x98], 0
add rsp, 0x38
pop r14
pop rbp
ret
mov rcx, r14
call fcn.140061800
mov rdi, qword [rsp + 0x60]
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rbp
ret
Function at 0x14005fd70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov esi, edx
mov r14, rcx
je 0x14005feef
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x48]
mov rcx, qword [rcx + 0x50]
cmp rbx, rcx
je 0x14005fecf
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x28], r13
movabs r13, 0x30000000519
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14005fe41
lea ecx, [rsi + rsi]
mov rbp, r13
neg rcx
mov r9d, r15d
shl rcx, 3
add qword [rdi + 0x18], rcx
mov r8, qword [rdi + 0x18]
test esi, esi
je 0x14005fe20
nop word [rax + rax]
lea ecx, [r9 + r9]
inc r9d
mov eax, ecx
lea edx, [rcx + 1]
mov rcx, qword [r8 + rdx*8]
xor rcx, qword [r8 + rax*8]
imul rcx, r12
xor rbp, rcx
cmp r9d, esi
jb 0x14005fe00
lea rax, [r8 + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x14005fe36
mov rcx, rdi
call fcn.14006c770
mov r8, qword [rdi + 0x18]
lea rax, [r8 + 8]
mov qword [rdi + 0x18], rax
mov qword [r8], rbp
cmp qword [rbx + 0x30], r15
je 0x14005fe73
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x14005fe73
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.14005fd70
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005fe50
cmp qword [rbx + 0x40], r15
je 0x14005fea5
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x14005fea5
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, esi
cmove rcx, r15
call fcn.14005fd70
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005fe82
mov rcx, qword [r14 + 0x50]
add rbx, 0x78
cmp rbx, rcx
jne 0x14005fdd0
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
lea rdx, [rcx - 0x78]
mov r8d, esi
mov rcx, qword [rcx - 0x70]
call fcn.1400620e0
mov rbx, qword [rsp + 0x50]
test al, al
jne 0x14005fef9
mov byte [r14 + 0x98], al
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov rcx, r14
call fcn.140061800
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rsi
ret
Function at 0x14005ff20
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rsi
push r12
push r14
push r15
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
movzx r12d, r9b
mov r15d, r8d
mov r14, rdx
mov rsi, rcx
je 0x14006001b
add rcx, 0x68
lea edx, [r15*2 + 1]
mov r8, qword [rcx + 0x18]
add r8, rdx
cmp r8, qword [rcx + 0x20]
jbe 0x14005ff64
call fcn.140069f30
mov rcx, qword [rsi + 0x80]
lea rax, [rcx + 1]
mov qword [rsi + 0x80], rax
mov byte [rcx], 0x2f
test r15d, r15d
je 0x14005fffa
mov rdx, r14
mov r8, r15
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
mov rcx, qword [rsi + 0x80]
cmp al, 0x7e
jne 0x14005ffc3
lea rax, [rcx + 1]
mov qword [rsi + 0x80], rax
mov byte [rcx], 0x7e
mov rcx, qword [rsi + 0x80]
lea rax, [rcx + 1]
mov qword [rsi + 0x80], rax
mov byte [rcx], 0x30
jmp 0x14005fff1
cmp al, 0x2f
lea rax, [rcx + 1]
mov qword [rsi + 0x80], rax
jne 0x14005ffec
mov byte [rcx], 0x7e
mov rcx, qword [rsi + 0x80]
lea rax, [rcx + 1]
mov qword [rsi + 0x80], rax
mov byte [rcx], 0x31
jmp 0x14005fff1
movzx eax, byte [rdx]
mov byte [rcx], al
inc rdx
sub r8, 1
jne 0x14005ff90
mov rdx, qword [rsi + 0x50]
mov r9d, r15d
mov r8, r14
mov rcx, qword [rdx - 0x70]
add rdx, 0xffffffffffffff88
call fcn.140062250
test al, al
jne 0x140060029
mov byte [rsi + 0x98], al
xor al, al
add rsp, 0x38
pop r15
pop r14
pop r12
pop rsi
ret
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsi + 0x48]
cmp rbx, qword [rsi + 0x50]
je 0x14006016c
mov qword [rsp + 0x68], rbp
movabs rax, 0x789e9a398d409253
mov qword [rsp + 0x70], rdi
movabs r8, 0x100000001b3
mov qword [rsp + 0x30], r13
xor r13d, r13d
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x1400600b9
mov rdi, rax
mov rcx, r13
test r15d, r15d
je 0x140060094
nop word [rax + rax]
movzx eax, byte [rcx + r14]
inc rcx
xor rdi, rax
imul rdi, r8
cmp rcx, r15
jb 0x140060080
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x1400600ae
mov rcx, rbp
call fcn.14006c770
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r13
je 0x1400600fb
mov edi, r13d
cmp dword [rbx + 0x38], r13d
jbe 0x1400600fb
nop dword [rax + rax]
mov rax, qword [rbx + 0x30]
movzx r9d, r12b
mov ecx, edi
mov r8d, r15d
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, r14
cmove rcx, r13
call fcn.14005ff20
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400600d0
cmp qword [rbx + 0x40], r13
je 0x14006013b
mov edi, r13d
cmp dword [rbx + 0x48], r13d
jbe 0x14006013b
nop word [rax + rax]
mov rax, qword [rbx + 0x40]
movzx r9d, r12b
mov ecx, edi
mov r8d, r15d
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, r14
cmove rcx, r13
call fcn.14005ff20
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140060110
add rbx, 0x78
movabs rax, 0x789e9a398d409253
movabs r8, 0x100000001b3
cmp rbx, qword [rsi + 0x50]
jne 0x140060062
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov byte [rsi + 0x98], 1
add rsp, 0x38
pop r15
pop r14
pop r12
pop rsi
ret
Function at 0x1400608d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x140615e68]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov rsi, rdx
mov r14, rcx
jne 0x1400608fd
xor al, al
jmp 0x140060af6
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140061c50
test al, al
je 0x140060adf
mov rax, qword [r14 + 0x50]
mov r8, rsi
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140062c90
test al, al
je 0x140060adf
mov rdx, rbx
mov rcx, rdi
call fcn.140063110
test al, al
je 0x140060adf
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x140060ac9
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x140060a3f
mov qword [rsp + 0x20], rsi
xorps xmm0, xmm0
test rsi, rsi
js 0x1400609b1
cvtsi2sd xmm0, rsi
jmp 0x1400609c9
mov rax, rsi
mov rcx, rsi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2sd xmm0, rcx
addsd xmm0, xmm0
movsd qword [rsp + 0x28], xmm0
mov rdi, r13
mov rcx, r15
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x1400609e0
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x140060a34
mov rcx, rbp
call fcn.14006c770
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x140060a74
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140060a74
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.1400608d0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140060a50
cmp qword [rbx + 0x40], r15
je 0x140060aa7
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140060aa7
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.1400608d0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140060a83
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x140060990
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.140061800
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x140060ae9
mov byte [r14 + 0x98], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ba950
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x140060b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x140615e68]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov rsi, rdx
mov r14, rcx
jne 0x140060b3d
xor al, al
jmp 0x140060d16
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.140061c50
test al, al
je 0x140060cff
mov rax, qword [r14 + 0x50]
mov r8, rsi
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140062e90
test al, al
je 0x140060cff
mov rdx, rbx
mov rcx, rdi
call fcn.140063110
test al, al
je 0x140060cff
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x140060ce9
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x140060c5f
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
cvtsi2sd xmm0, rsi
mov rdi, r13
mov rcx, r15
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x140060c00
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x140060c54
mov rcx, rbp
call fcn.14006c770
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x140060c94
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x140060c94
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140060b10
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140060c70
cmp qword [rbx + 0x40], r15
je 0x140060cc7
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140060cc7
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.140060b10
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140060ca3
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x140060bd0
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.140061800
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x140060d09
mov byte [r14 + 0x98], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ba950
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x140060d30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x140615e68]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
mov ebp, edx
jne 0x140060d5c
xor al, al
jmp 0x140060f3e
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140061c50
test al, al
je 0x140060f22
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140062c90
test al, al
je 0x140060f22
mov rdx, rbx
mov rcx, rdi
call fcn.140063110
test al, al
je 0x140060f22
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x140060f0c
mov qword [rsp + 0x60], rsi
movabs rcx, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x140060e7f
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
cvtsi2sd xmm0, rbp
mov rdi, rcx
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140060e20
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x140060e74
mov rcx, rsi
call fcn.14006c770
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x140060eb3
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x140060eb3
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140060d30
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x140060e90
cmp qword [rbx + 0x40], r12
je 0x140060ee5
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140060ee5
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140060d30
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x140060ec2
add rbx, 0x78
movabs rcx, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x140060df0
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140061800
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x140060f2c
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ba950
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140060f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x140615e68]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
movsxd rbp, edx
jne 0x140060f8d
xor al, al
jmp 0x14006116e
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.140061c50
test al, al
je 0x140061152
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.140062e90
test al, al
je 0x140061152
mov rdx, rbx
mov rcx, rdi
call fcn.140063110
test al, al
je 0x140061152
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14006113c
mov qword [rsp + 0x60], rsi
movabs rax, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop word [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x1400610af
movd xmm0, ebp
mov rdi, rax
cvtdq2pd xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x140061050
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x1400610a4
mov rcx, rsi
call fcn.14006c770
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x1400610e3
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x1400610e3
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140060f60
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400610c0
cmp qword [rbx + 0x40], r12
je 0x140061115
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x140061115
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.140060f60
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x1400610f2
add rbx, 0x78
movabs rax, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x140061020
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.140061800
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14006115c
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ba950
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x140061190
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov r14, rcx
movzx esi, dl
jne 0x1400611b1
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov qword [rsp + 0x50], rbx
call fcn.140061c50
test al, al
je 0x1400611f6
mov rax, qword [r14 + 0x50]
mov rcx, qword [rax - 0x70]
lea rbx, [rax - 0x78]
test byte [rcx + 0x50], 2
jne 0x14006120d
call fcn.140063c20
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x1400611f2
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x50]
xor al, al
mov byte [r14 + 0x98], 0
add rsp, 0x38
pop r14
pop rsi
ret
mov rdx, rbx
call fcn.140063110
test al, al
je 0x1400611f6
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14006132c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x84222325cbf29ce4
mov qword [rsp + 0x28], r13
movabs r13, 0x100000001b3
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x58], rbp
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x140061290
mov rcx, qword [rdi + 0x18]
lea rbp, [rsi + 1]
xor rbp, r12
imul rbp, r13
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x140061285
mov rcx, rdi
call fcn.14006c770
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov qword [rcx], rbp
cmp qword [rbx + 0x30], r15
je 0x1400612c5
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x1400612c5
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140061190
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1400612a0
cmp qword [rbx + 0x40], r15
je 0x140061305
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x140061305
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.140061190
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x1400612e0
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x140061257
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, r14
call fcn.140061800
mov rbx, qword [rsp + 0x50]
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rsi
ret