joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036b60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140036c04
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140036bc0
mov ecx, dword [r10]
jmp 0x140036ce7
cmp ecx, 0x4e0
jb 0x140036ce7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140036c20
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140036c70
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x140036ba0
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x140036b90
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret

Function at 0x14003d880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14003d8b4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14003d8a0
ret
Function at 0x140049140
Capabilities:
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x4d0
mov rcx, qword [rcx + 8]
lea r8, [rax + 0x10]
mov rbx, rdx
mov dword [rax + 0x10], 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_getpeername]
xor edi, edi
test eax, eax
jne 0x1400491eb
mov edx, dword [rsp + 0x4e8]
lea r8, [rsp + 0xc0]
mov dword [rsp + 0x30], 2
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
mov r9d, 0x401
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x1400491eb
mov qword [rbx + 0x10], rdi
lea rax, [rsp + 0xc0]
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
mov byte [rbx], dil
nop dword [rax]
inc r8
cmp byte [rax + r8], dil
jne 0x1400491d0
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.1400399d0
jmp 0x1400491fa
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
mov rax, rbx
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4d0
pop rdi
ret
Function at 0x140053970
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [rcx + 8]
mov rbx, rcx
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov dword [rsp + 0x30], 1
xor r9d, r9d
mov qword [r11 + 8], 0x1e
lea ecx, [rax + 1]
xor r8d, r8d
lea rax, [r11 + 8]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jne 0x1400539cd
mov eax, 0xffffffff
jmp 0x1400539e2
js 0x1400539e2
mov rcx, qword [rbx + 8]
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_recv]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005b1c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x14005b25b
mov rdi, r8
test r8, r8
jle 0x14005b250
mov rcx, rbx
call fcn.140036d60
test rax, rax
jle 0x14005b230
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1401f4fc0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14005b248
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14005b250
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14005b1f2
sub r14, rdi
mov rax, r14
jmp 0x14005b30a
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14005b272
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14005b274
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14005b304
test ecx, ecx
jle 0x14005b2ac
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.1401f4fc0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14005b304
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14005b304
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14005b2f1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.140204a20
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14005c440
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, r9
mov r14, rdx
mov rsi, rcx
mov rdx, qword [r8]
movzx r8d, dl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rax, rdx
shr rax, 8
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x28
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x30
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x38
xor r8, rax
imul r8, r9
mov r9, qword [rsi + 0x30]
and r9, r8
add r9, r9
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r9*8]
cmp rbx, rax
je 0x14005c56e
mov rbx, qword [rcx + r9*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14005c56e
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
jne 0x14005c520
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rdi + 0x10]
call fcn.1400612a0
mov edx, 0x38
mov rcx, rdi
call fcn.1401d6ea0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x14005c69b
mov qword [rsp + 0x80], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005c5ab
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r9*8]
cmp rax, qword [rsi + 8]
jne 0x14005c5c8
mov qword [rdx + r9*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r9*8 + 8], rdi
jmp 0x14005c5f7
cmp rax, rbx
jne 0x14005c5d3
mov qword [rdx + r9*8], rdi
jmp 0x14005c5f7
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r9*8 + 8], rcx
cmp rcx, rdi
je 0x14005c5f7
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r9*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140256390]
test rax, rax
jns 0x14005c618
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14005c629
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x14005c690
cmp rdx, 0x200
jae 0x14005c645
lea rdx, [rdx*8]
jmp 0x14005c657
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005c657
add rdx, rdx
mov rcx, rsi
call fcn.140036f80
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x14005c690
mov r15, qword [rax + 8]
nop dword [rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14005c440
cmp rbx, r15
jne 0x14005c670
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x14005d280
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov r10, qword [r8]
mov rbp, rcx
movabs rcx, 0xcbf29ce484222325
mov rbx, rdx
movabs rdx, 0x100000001b3
mov rax, r10
shr rax, 8
mov rdi, r8
mov r8, qword [rbp + 0x30]
movzx r9d, al
movzx eax, r10b
xor rax, rcx
imul rax, rdx
xor r9, rax
mov rax, r10
imul r9, rdx
shr rax, 0x10
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x18
imul r9, rdx
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x20
imul r9, rdx
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x28
imul r9, rdx
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x30
imul r9, rdx
movzx ecx, al
mov rax, r10
xor r9, rcx
shr rax, 0x38
mov rcx, qword [rbp + 0x18]
imul r9, rdx
xor r9, rax
imul r9, rdx
mov rdx, qword [rbp + 8]
and r8, r9
add r8, r8
mov r9, qword [rcx + r8*8]
lea r11, [rcx + r8*8]
mov rax, r9
nop dword [rax]
cmp r9, rdx
jne 0x14005d35a
mov rcx, rdx
jmp 0x14005d361
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14005d38d
cmp qword [rax + 0x10], r10
je 0x14005d371
mov rax, qword [rax]
jmp 0x14005d350
cmp rax, rdx
je 0x14005d38d
mov qword [rbx], rax
mov rax, rbx
mov byte [rbx + 8], 0
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x50]
mov rdi, qword [rdx]
lea r9, [0x140253318]
mov qword [rsp + 0x28], rax
lea rcx, [rbp + 8]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], r14
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r14, qword [rdi + 8]
mov r8, r14
call fcn.14005b7a0
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x14005d41b
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r14], rdx
mov rdx, rbx
mov r9, qword [rbp + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.14005c440
mov r14, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1401b5f70
int3
Function at 0x14005d840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r11, [r8 + 0x10]
mov rbx, qword [r11 + 0x10]
mov rsi, rdx
mov rdi, rcx
jb 0x14005d867
mov r11, qword [r11]
xor r9d, r9d
movabs r10, 0xcbf29ce484222325
test rbx, rbx
je 0x14005d8a4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + r11]
inc r9
xor r10, rax
imul r10, rcx
cmp r9, rbx
jb 0x14005d890
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x18]
and rdx, r10
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x14005d8e4
cmp rax, r8
jne 0x14005d8da
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14005d8ef
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14005d8ef
cmp rax, r8
jne 0x14005d8ef
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
lea rcx, [rdi + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rdx, r8
dec qword [rcx + 8]
call fcn.140063340
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005d930
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r10, rcx
mov rsi, rdx
movabs rdx, 0x100000001b3
mov rdi, r8
mov r8, qword [r8 + 0x10]
movabs rcx, 0xcbf29ce484222325
mov rax, r8
shr rax, 8
movzx r9d, al
movzx eax, r8b
xor rax, rcx
imul rax, rdx
xor r9, rax
mov rax, r8
imul r9, rdx
shr rax, 0x10
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x18
imul r9, rdx
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x20
imul r9, rdx
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x28
imul r9, rdx
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x30
imul r9, rdx
movzx ecx, al
xor r9, rcx
shr r8, 0x38
mov rcx, qword [r10 + 0x18]
imul r9, rdx
xor r9, r8
imul r9, rdx
mov rdx, qword [r10 + 0x30]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14005da1d
cmp rax, rdi
jne 0x14005da13
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14005da28
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14005da28
cmp rax, rdi
jne 0x14005da28
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.1400612a0
mov edx, 0x38
mov rcx, rdi
call fcn.1401d6ea0
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140063400
Capabilities:
Hash data using fnv

Disassembly:
mov r8, qword [rdx]
movabs r11, 0x100000001b3
mov r10, rcx
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, r8
imul r9, r11
shr rax, 8
movzx edx, al
mov rax, r8
xor r9, rdx
shr rax, 0x10
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, r8
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, qword [r10 + 0x30]
xor r9, rcx
imul r9, r11
shr r8, 0x38
xor r9, r8
imul r9, r11
and rax, r9
ret

Function at 0x1400634a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r10, qword [rdx + 0x10]
jb 0x1400634ae
mov rdx, qword [rdx]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1400634e4
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
inc r9
xor r8, rax
imul r8, r11
cmp r9, r10
jb 0x1400634d0
mov rax, qword [rcx + 0x30]
and rax, r8
ret
Function at 0x140065030
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rax, rdx
mov r14, rcx
mov rdi, qword [rcx + 0x20]
cmp rdi, qword [rcx + 0x10]
je 0x1400651c5
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, qword [r14]
mov r12, qword [rdi + 0x10]
mov r8, rdi
mov r9, qword [rdi + 0x18]
cmp r9, 0x10
jb 0x140065094
mov r8, qword [rdi]
mov rdx, rax
xor eax, eax
test r12, r12
je 0x1400650b4
nop
movzx ecx, byte [rax + r8]
xor rdx, rcx
imul rdx, r11
inc rax
cmp rax, r12
jb 0x1400650a0
mov rax, qword [r10 + 0x30]
and rax, rdx
shl rax, 4
mov rcx, qword [r10 + 0x18]
mov qword [rsp + 0x80], rcx
mov r13, qword [rcx + rax]
mov rbx, r13
add rax, 8
mov qword [rsp + 0x90], rax
mov rbp, qword [r10 + 8]
cmp r13, rbp
jne 0x1400650ec
mov rax, rbp
jmp 0x1400650f3
mov rax, qword [rax + rcx]
mov rax, qword [rax]
cmp rbx, rax
je 0x14006516e
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r9, 0x10
jb 0x140065108
mov rdx, qword [rdi]
mov rsi, qword [rcx + 0x10]
mov r15, qword [rcx + 0x18]
cmp r15, 0x10
jb 0x140065119
mov rcx, qword [rcx]
cmp rsi, r12
jne 0x14006512e
mov r8, rsi
call fcn.1401f4ec0
test eax, eax
je 0x140065143
mov r9, qword [rdi + 0x18]
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x90]
jmp 0x1400650e2
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x140065150
mov rdx, qword [rdx]
cmp qword [rdi + 0x18], 0x10
jb 0x14006515a
mov rdi, qword [rdi]
cmp r12, rsi
jne 0x14006516e
mov r8, r12
mov rcx, rdi
call fcn.1401f4ec0
test eax, eax
je 0x140065171
mov rbx, rbp
mov rax, qword [r14]
cmp rbx, qword [rax + 8]
je 0x1400651aa
lea rcx, [r14 + 0x68]
lea r8, [rbx + 0x30]
lea rdx, [rsp + 0x28]
call fcn.14005d280
mov rdi, qword [rsp + 0x28]
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
test al, al
jne 0x140065211
cmp qword [rdi + 0x30], 0
je 0x1400651e7
add qword [r14 + 0x20], 0x20
mov rdi, qword [r14 + 0x20]
cmp rdi, qword [r14 + 0x10]
jne 0x140065069
mov rax, qword [rsp + 0x88]
mov rcx, rax
call fcn.14002c3b0
xor al, al
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsp + 0x88]
mov rdx, qword [r14 + 0x20]
mov rcx, r14
call fcn.140064560
add qword [r14 + 0x20], 0x20
mov rcx, qword [rsp + 0x88]
call fcn.14002c3b0
mov al, 1
jmp 0x1400651cf
mov r8, qword [rsp + 0x88]
mov rdx, qword [r14 + 0x20]
mov rcx, r14
call fcn.140064560
nop
mov rcx, qword [rsp + 0x88]
call fcn.14002c3b0
mov al, 1
jmp 0x1400651cf
Function at 0x1400664a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
mov r11, qword [r8 + 0x18]
mov rdi, r8
mov r14, qword [r8 + 0x10]
mov r12, rdx
mov rsi, rcx
mov r10, r8
cmp r11, 0x10
jb 0x1400664ce
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x140066504
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x1400664f0
mov rax, qword [rsi + 0x18]
mov rcx, qword [rsi + 0x30]
mov rsi, qword [rsi + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r15
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x50], rax
cmp r13, rsi
jne 0x14006653e
mov rax, rsi
jmp 0x140066544
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400665bd
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r11, 0x10
jb 0x140066559
mov rdx, qword [rdi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x14006656a
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x14006657f
mov r8, rbp
call fcn.1401f4ec0
test eax, eax
je 0x140066589
mov r11, qword [rdi + 0x18]
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x140066534
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x140066596
mov rdx, qword [rdx]
cmp qword [rdi + 0x18], 0x10
jb 0x1400665a0
mov rdi, qword [rdi]
cmp r14, rbp
jne 0x1400665b4
mov r8, r14
mov rcx, rdi
call fcn.1401f4ec0
test eax, eax
je 0x1400665b7
mov rbx, rsi
mov qword [r12], rbx
jmp 0x1400665c1
mov qword [r12], rsi
mov r15, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400ab330
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r10, r8
mov r14, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rbx, qword [rsi + 8]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x1400ab440
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400ab440
mov rbx, qword [rbx + 8]
mov rcx, qword [rbx + 0x10]
cmp qword [r10], rcx
jne 0x1400ab3f8
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.1401d6ea0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400ab56b
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400ab47a
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400ab497
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x1400ab4c6
cmp rax, rbx
jne 0x1400ab4a2
mov qword [rdx + r8*8], rdi
jmp 0x1400ab4c6
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x1400ab4c6
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140256390]
test rax, rax
jns 0x1400ab4e7
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400ab4f8
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400ab560
cmp rdx, 0x200
jae 0x1400ab514
lea rdx, [rdx*8]
jmp 0x1400ab526
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400ab526
add rdx, rdx
mov rcx, rsi
call fcn.140036f80
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400ab560
mov r15, qword [rax + 8]
nop dword [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400ab330
cmp rbx, r15
jne 0x1400ab540
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret