joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ff300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x28
call fcn.14024eae0
sub rsp, rax
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x1401ff3d5
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r15, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r14, rax
imul r14, r8
cmp rdx, 4
jb 0x1401ff357
and r14, qword [rcx + 0x30]
add r14, r14
mov rax, qword [r12 + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.1400b62c8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1401ff3e9
cmp rsi, rbp
jne 0x1401ff38d
cmp qword [rsp + 0x80], r13
jne 0x1401ff3ce
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x1401ff401
mov r13, qword [rsp + 0x78]
mov qword [r12 + r14*8], r13
mov rax, r13
jmp 0x1401ff404
mov rax, r15
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
je 0x1401ff3ce
xor edx, edx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rsi + rdx + 0x10]
inc rdx
xor r14, rax
imul r14, r13
cmp rdx, 4
jb 0x1401ff424
and r14, qword [rcx + 0x30]
mov r13, qword [rsp + 0x78]
add r14, r14
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.1400b62c8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x1401ff48b
cmp rsi, rbp
je 0x1401ff3ca
jmp 0x1401ff452
mov qword [r12 + r14*8], r13
mov qword [r12 + r14*8 + 8], r13
jmp 0x1401ff409
Function at 0x1401ff49c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x28
call fcn.14024eae0
sub rsp, rax
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x1401ff571
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r15, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r14, rax
imul r14, r8
cmp rdx, 4
jb 0x1401ff4f3
and r14, qword [rcx + 0x30]
add r14, r14
mov rax, qword [r12 + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.140023378
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1401ff585
cmp rsi, rbp
jne 0x1401ff529
cmp qword [rsp + 0x80], r13
jne 0x1401ff56a
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x1401ff59d
mov r13, qword [rsp + 0x78]
mov qword [r12 + r14*8], r13
mov rax, r13
jmp 0x1401ff5a0
mov rax, r15
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
je 0x1401ff56a
xor edx, edx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rsi + rdx + 0x10]
inc rdx
xor r14, rax
imul r14, r13
cmp rdx, 4
jb 0x1401ff5c0
and r14, qword [rcx + 0x30]
mov r13, qword [rsp + 0x78]
add r14, r14
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.140023378
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x1401ff627
cmp rsi, rbp
je 0x1401ff566
jmp 0x1401ff5ee
mov qword [r12 + r14*8], r13
mov qword [r12 + r14*8 + 8], r13
jmp 0x1401ff5a5
Function at 0x1401ff86c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
xor r10d, r10d
movabs rdi, 0xcbf29ce484222325
mov rbp, r9
mov r11, rdi
mov ebx, r10d
mov r14, r8
mov rsi, rcx
movabs r9, 0x100000001b3
movzx eax, byte [rdx + rbx]
inc rbx
xor r11, rax
imul r11, r9
cmp rbx, 4
jb 0x1401ff8ad
mov rcx, qword [rcx + 0x30]
mov r8, qword [rsi + 0x18]
and rcx, r11
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [rsi + 8]
je 0x1401ff8f2
mov r8, qword [r8 + rcx*8]
mov ecx, dword [rdx]
jmp 0x1401ff8eb
cmp rax, r8
je 0x1401ff8f2
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1401ff8e2
jmp 0x1401ff8f5
mov rax, r10
test rax, rax
cmove rax, qword [rsi + 8]
cmp rax, qword [rsi + 8]
je 0x1401ff97a
movzx r8d, word [r14]
mov rdx, r10
mov word [rsp + 0x50], r8w
movzx ecx, byte [rsp + rdx + 0x50]
inc rdx
xor rdi, rcx
imul rdi, r9
cmp rdx, 2
jb 0x1401ff910
mov rdx, qword [rax + 0x48]
mov r9, qword [rax + 0x30]
and rdx, rdi
add rdx, rdx
mov rcx, qword [r9 + rdx*8 + 8]
cmp rcx, qword [rax + 0x20]
je 0x1401ff956
mov r9, qword [r9 + rdx*8]
jmp 0x1401ff94d
cmp rcx, r9
je 0x1401ff956
mov rcx, qword [rcx + 8]
cmp r8w, word [rcx + 0x10]
jne 0x1401ff944
jmp 0x1401ff959
mov rcx, r10
test rcx, rcx
cmove rcx, qword [rax + 0x20]
cmp rcx, qword [rax + 0x20]
je 0x1401ff97a
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140199808
mov r10b, 1
mov rbx, qword [rsp + 0x58]
mov al, r10b
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1401ff990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov esi, dword [rdx]
xor r10d, r10d
movabs r11, 0xcbf29ce484222325
mov dword [rsp + 0x50], esi
mov r15, r9
mov rbx, r11
mov edi, r10d
mov r14, r8
mov rbp, rcx
movabs r9, 0x100000001b3
movzx eax, byte [rsp + rdi + 0x50]
inc rdi
xor rbx, rax
imul rbx, r9
cmp rdi, 4
jb 0x1401ff9dd
movzx r8d, byte [rdx + 4]
mov rdx, qword [rbp + 0x18]
mov eax, r8d
xor rax, r11
imul rax, r9
imul rcx, rbx, 0x18d
xor rcx, rax
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rbp + 8]
je 0x1401ffa3b
mov rdx, qword [rdx + rcx*8]
cmp esi, dword [rax + 0x10]
jne 0x1401ffa30
cmp r8b, byte [rax + 0x14]
je 0x1401ffa3e
cmp rax, rdx
je 0x1401ffa3b
mov rax, qword [rax + 8]
jmp 0x1401ffa25
mov rax, r10
test rax, rax
cmove rax, qword [rbp + 8]
cmp rax, qword [rbp + 8]
je 0x1401ffac3
movzx r8d, word [r14]
mov rdx, r10
mov word [rsp + 0x50], r8w
movzx ecx, byte [rsp + rdx + 0x50]
inc rdx
xor r11, rcx
imul r11, r9
cmp rdx, 2
jb 0x1401ffa59
mov rdx, qword [rax + 0x48]
mov r9, qword [rax + 0x30]
and rdx, r11
add rdx, rdx
mov rcx, qword [r9 + rdx*8 + 8]
cmp rcx, qword [rax + 0x20]
je 0x1401ffa9f
mov r11, qword [r9 + rdx*8]
jmp 0x1401ffa96
cmp rcx, r11
je 0x1401ffa9f
mov rcx, qword [rcx + 8]
cmp r8w, word [rcx + 0x10]
jne 0x1401ffa8d
jmp 0x1401ffaa2
mov rcx, r10
test rcx, rcx
cmove rcx, qword [rax + 0x20]
cmp rcx, qword [rax + 0x20]
je 0x1401ffac3
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140199808
mov r10b, 1
mov rbx, qword [rsp + 0x58]
mov al, r10b
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1401ffae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
movzx edx, byte [rdx]
mov rdi, r8
mov r8, qword [rcx + 0x30]
mov eax, edx
mov rbx, qword [rcx + 0x18]
movabs r11, 0xcbf29ce484222325
xor rax, r11
movabs rbp, 0x100000001b3
imul rax, rbp
mov rsi, r9
xor r10d, r10d
mov r9, qword [rcx + 8]
and r8, rax
add r8, r8
mov rax, qword [rbx + r8*8 + 8]
cmp rax, r9
je 0x1401ffb58
mov rcx, qword [rbx + r8*8]
jmp 0x1401ffb51
cmp rax, rcx
je 0x1401ffb58
mov rax, qword [rax + 8]
cmp dl, byte [rax + 0x10]
jne 0x1401ffb48
jmp 0x1401ffb5b
mov rax, r10
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x1401ffbde
movzx r8d, word [rdi]
mov rdx, r10
mov word [rsp + 0x40], r8w
movzx ecx, byte [rsp + rdx + 0x40]
inc rdx
xor r11, rcx
imul r11, rbp
cmp rdx, 2
jb 0x1401ffb74
mov rdx, qword [rax + 0x48]
mov r9, qword [rax + 0x30]
and rdx, r11
add rdx, rdx
mov rcx, qword [r9 + rdx*8 + 8]
cmp rcx, qword [rax + 0x20]
je 0x1401ffbba
mov r11, qword [r9 + rdx*8]
jmp 0x1401ffbb1
cmp rcx, r11
je 0x1401ffbba
mov rcx, qword [rcx + 8]
cmp r8w, word [rcx + 0x10]
jne 0x1401ffba8
jmp 0x1401ffbbd
mov rcx, r10
test rcx, rcx
cmove rcx, qword [rax + 0x20]
cmp rcx, qword [rax + 0x20]
je 0x1401ffbde
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140199808
mov r10b, 1
mov rbx, qword [rsp + 0x48]
mov al, r10b
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1402007b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov r11d, dword [r8]
movabs rdi, 0xcbf29ce484222325
mov rbx, rcx
mov dword [rsp + 8], r11d
mov r9, rdi
xor r10d, r10d
movabs rcx, 0x100000001b3
movzx eax, byte [rsp + r10 + 8]
inc r10
xor r9, rax
imul r9, rcx
cmp r10, 4
jb 0x1402007e7
movzx r10d, byte [r8 + 4]
mov r8, qword [rbx + 0x18]
mov eax, r10d
xor rax, rdi
imul rax, rcx
imul rcx, r9, 0x18d
xor rcx, rax
and rcx, qword [rbx + 0x30]
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [rbx + 8]
je 0x140200847
mov r8, qword [r8 + rcx*8]
cmp r11d, dword [rax + 0x10]
jne 0x14020083c
cmp r10b, byte [rax + 0x14]
je 0x140200849
cmp rax, r8
je 0x140200847
mov rax, qword [rax + 8]
jmp 0x140200830
xor eax, eax
mov rdi, qword [rsp + 0x18]
test rax, rax
cmove rax, qword [rbx + 8]
mov rbx, qword [rsp + 0x10]
mov qword [rdx], rax
mov rax, rdx
ret
Function at 0x140202490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x1402024c6
cvtsi2ss xmm0, rdx
jmp 0x1402024db
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x14031bb90]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140202509
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140202509
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140202537
cmp rbx, 0x200
jae 0x140202534
shl rbx, 3
cmp rbx, rcx
jae 0x140202537
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
jbe 0x140202560
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [rdi + 8]
lea rax, [rbx - 1]
or rax, 1
mov ebx, 1
bsr rcx, rax
mov r8, rbp
inc ecx
shl rbx, cl
lea rcx, [rdi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1400b57b4
mov qword [rdi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rdi + 0x30], rax
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
cmp rcx, rbp
je 0x140202678
mov rax, rcx
mov rsi, qword [rax + 0x10]
movabs r8, 0xcbf29ce484222325
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x40], rsi
movzx edx, byte [rsp + r9 + 0x40]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 8
jb 0x1402025c2
mov r11, qword [rdi + 0x30]
mov rbx, qword [rdi + 0x18]
and r11, r8
add r11, r11
cmp qword [rbx + r11*8], rbp
jne 0x140202601
mov qword [rbx + r11*8], rax
mov qword [rbx + r11*8 + 8], rax
jmp 0x14020266c
mov r10, qword [rbx + r11*8 + 8]
cmp rsi, qword [r10 + 0x10]
jne 0x140202641
mov r10, qword [r10]
cmp r10, rax
je 0x1402025fa
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1402025fa
mov r10, qword [r10 + 8]
cmp rsi, qword [r10 + 0x10]
je 0x14020268b
cmp qword [rbx + r11*8], r10
jne 0x140202637
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rbx + r11*8], rax
mov rax, rcx
cmp rcx, rbp
jne 0x1402025a9
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14020266c
Function at 0x14020cc30
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
push r15
lea r11, [rcx + 0x20]
mov r8, rcx
mov rcx, r11
mov edx, 0x10
mov eax, dword [rcx]
bswap eax
mov dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x14020cc5a
lea rcx, [r8 + 0x28]
mov edx, 0x40
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rcx + 0x34], eax
sub rdx, 1
jne 0x14020cc73
mov r15d, dword [r8 + 0xc]
lea edi, [rdx + 0x14]
mov r12d, dword [r8 + 0x10]
mov ebp, edi
mov r13d, dword [r8 + 0x14]
mov esi, r15d
mov ebx, dword [r8 + 0x18]
mov r10d, r12d
mov r14d, dword [r8 + 0x1c]
mov r9d, r13d
mov eax, r9d
mov edx, r10d
and eax, r10d
not edx
and edx, ebx
mov ecx, esi
rol ecx, 5
or edx, eax
add ecx, r14d
mov r14d, ebx
add ecx, edx
mov ebx, r9d
add ecx, dword [r11]
mov r9d, r10d
rol r9d, 0x1e
lea r11, [r11 + 4]
mov r10d, esi
lea esi, [rcx + 0x5a827999]
sub rbp, 1
jne 0x14020ccaf
lea rdx, [r8 + 0x70]
mov r11, rdi
mov eax, ebx
mov ecx, esi
xor eax, r9d
rol ecx, 5
xor eax, r10d
add eax, ecx
add eax, dword [rdx]
lea rdx, [rdx + 4]
add eax, r14d
mov r14d, ebx
mov ebx, r9d
mov r9d, r10d
rol r9d, 0x1e
mov r10d, esi
lea esi, [rax + 0x6ed9eba1]
sub r11, 1
jne 0x14020ccf2
lea r11, [r8 + 0xc0]
mov rbp, rdi
mov edx, esi
mov ecx, r9d
or ecx, r10d
rol edx, 5
and ecx, ebx
mov eax, r9d
and eax, r10d
or ecx, eax
add ecx, dword [r11]
lea eax, [r14 + rdx]
add eax, 0x8f1bbcdc
lea r11, [r11 + 4]
add eax, ecx
mov r14d, ebx
mov ebx, r9d
mov r9d, r10d
rol r9d, 0x1e
mov r10d, esi
mov esi, eax
sub rbp, 1
jne 0x14020cd30
lea rdx, [r8 + 0x110]
add r14d, 0xca62c1d6
mov r11d, esi
rol r11d, 5
mov eax, ebx
xor eax, r9d
add r11d, r14d
xor eax, r10d
mov r14d, ebx
add eax, dword [rdx]
mov ebx, r9d
mov r9d, r10d
lea rdx, [rdx + 4]
add r11d, eax
rol r9d, 0x1e
mov r10d, esi
mov esi, r11d
sub rdi, 1
jne 0x14020cd76
add dword [r8 + 0x18], ebx
lea eax, [r15 + r11]
add dword [r8 + 0x1c], r14d
add qword [r8], 0x200
and dword [r8 + 8], edi
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r8 + 0xc], eax
lea eax, [r12 + r10]
mov dword [r8 + 0x10], eax
lea eax, [r9 + r13]
mov dword [r8 + 0x14], eax
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x14020e5e4
Capabilities:
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x108]
mov eax, 0x1e0
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp + 0xd0], rax
xor r13d, r13d
mov dword [rsp + 0x5c], 0x67452301
mov ebx, r13d
mov qword [rsp + 0x50], r13
mov rsi, rdx
mov dword [rsp + 0x58], ebx
mov r12, rcx
mov dword [rsp + 0x60], 0xefcdab89
lea r14d, [r13 + 0x10]
mov dword [rsp + 0x64], 0x98badcfe
mov dword [rsp + 0x68], 0x10325476
lea rdi, [0x140315190]
mov dword [rsp + 0x6c], 0xc3d2e1f0
mov al, byte [rdi]
mov ecx, ebx
mov byte [rsp + rcx + 0x70], al
mov ebx, dword [rsp + 0x58]
inc ebx
mov dword [rsp + 0x58], ebx
cmp ebx, 0x40
jne 0x14020e68e
lea rcx, [rsp + 0x50]
call fcn.14020cc30
mov ebx, dword [rsp + 0x58]
inc rdi
sub r14, 1
jne 0x14020e669
movzx ecx, word [rsi]
test cx, cx
je 0x14020e799
mov edi, r13d
mov r11d, 0x3ff
mov eax, 0x2800
mov r8d, edi
add eax, ecx
add rsi, 2
mov r9d, 1
cmp ax, r11w
ja 0x14020e6e9
movzx edx, word [rsi]
mov eax, 0x2400
add eax, edx
cmp ax, r11w
ja 0x14020e6e9
mov word [rbp + r8*2 + 0xb2], dx
add rsi, 2
mov r9d, 2
movzx r14d, word [rsi]
add edi, r9d
mov word [rbp + r8*2 + 0xb0], cx
test r14w, r14w
je 0x14020e708
cmp edi, 0xf
jb 0x14020e791
mov qword [rsp + 0x40], r13
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x38], r13
lea r8, [rbp + 0xb0]
mov qword [rsp + 0x30], r13
lea rcx, [0x14027367c]
mov dword [rsp + 0x28], edi
mov r9d, edi
mov edx, 0xa00
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
lea r15d, [rdi + rdi]
mov edi, r13d
test r15d, r15d
je 0x14020e782
mov ecx, ebx
mov eax, edi
mov al, byte [rbp + rax + 0xb0]
mov byte [rsp + rcx + 0x70], al
mov ebx, dword [rsp + 0x58]
inc ebx
mov dword [rsp + 0x58], ebx
cmp ebx, 0x40
jne 0x14020e77b
lea rcx, [rsp + 0x50]
call fcn.14020cc30
mov ebx, dword [rsp + 0x58]
inc edi
cmp edi, r15d
jne 0x14020e74f
test r14w, r14w
je 0x14020e799
mov edi, r13d
mov r11d, 0x3ff
movzx ecx, word [rsi]
jmp 0x14020e6ac
mov eax, ebx
lea edi, [rbx*8]
add rdi, qword [rsp + 0x50]
mov byte [rsp + rax + 0x70], 0x80
jmp 0x14020e7b3
mov byte [rsp + rax + 0x70], r13b
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
cmp eax, 0x40
jne 0x14020e7d0
lea rcx, [rsp + 0x50]
call fcn.14020cc30
mov eax, dword [rsp + 0x58]
cmp eax, 0x38
jne 0x14020e7ae
bswap rdi
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x58], rdi
call fcn.14020cc30
lea rcx, [rsp + 0x5c]
mov edx, 5
mov eax, dword [rcx]
bswap eax
mov dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x14020e7f0
mov al, byte [rsp + 0x63]
and al, 0xf
or al, 0x50
mov byte [rsp + 0x63], al
mov rax, r12
movups xmm0, xmmword [rsp + 0x5c]
movdqu xmmword [r12], xmm0
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1402150bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1402150fc
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
add r8, r8
je 0x14021512a
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x14021510d
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d4240
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x140215153
mov qword [rdi], rdx
mov byte [rdi + 8], 0
jmp 0x14021528b
movabs rax, 0x492492492492492
cmp qword [rsi + 0x10], rax
jne 0x140215171
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rsi + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x14021519a
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rsp + 0x38], rbx
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.14000ad78
and qword [rbx + 0x30], 0
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1402151c4
cvtsi2ss xmm0, rcx
jmp 0x1402151d9
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1402151ec
cvtsi2ss xmm1, rcx
jmp 0x140215201
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x140215234
mov rcx, rsi
call fcn.140215680
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d4240
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x14021526d
mov qword [rcx + rax*8], rbx
jmp 0x14021527f
cmp r9, rdx
jne 0x140215278
mov qword [rcx + rax*8], rbx
jmp 0x140215284
cmp qword [rcx + rax*8 + 8], r8
jne 0x140215284
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1402152b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 8
jb 0x1402152ef
mov rdx, qword [r14]
movabs rbp, 0xcbf29ce484222325
xor r13d, r13d
mov ecx, r13d
add r8, r8
je 0x140215321
movzx eax, byte [rcx + rdx]
xor rbp, rax
movabs r9, 0x100000001b3
imul rbp, r9
inc rcx
cmp rcx, r8
jb 0x140215304
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400d4240
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14021534a
mov qword [rdi], rdx
mov byte [rdi + 8], r13b
jmp 0x1402154a4
movabs rax, 0x492492492492492
cmp qword [rsi + 0x10], rax
jne 0x140215368
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rsi + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x38
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140215390
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov qword [rsp + 0x38], rbx
lea r15, [rax + 0x10]
mov qword [r15], r13
mov qword [r15 + 0x10], r13
mov qword [r15 + 0x18], r13
movups xmm0, xmmword [r14]
movups xmmword [r15], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [r15 + 0x10], xmm1
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 7
mov word [r14], r13w
mov qword [r15 + 0x20], r13
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1402153de
cvtsi2ss xmm0, rcx
jmp 0x1402153f3
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140215406
cvtsi2ss xmm1, rcx
jmp 0x14021541b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14021544d
mov rcx, rsi
call fcn.140215680
mov r9, rbp
mov r8, r15
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400d4240
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x140215486
mov qword [rcx + rax*8], rbx
jmp 0x140215498
cmp r9, rdx
jne 0x140215491
mov qword [rcx + rax*8], rbx
jmp 0x14021549d
cmp qword [rcx + rax*8 + 8], r8
jne 0x14021549d
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret