joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ac568
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov rbx, rcx
mov r9, rdx
jb 0x1400ac598
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r10, r10
je 0x1400ac5cb
movzx eax, byte [rcx + r9]
movabs rdi, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdi
cmp rcx, r10
jb 0x1400ac5ad
mov rcx, qword [rbx + 0x30]
mov r14, qword [rbx + 0x18]
and rcx, r8
mov r10, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400ac5f3
mov rcx, r10
jmp 0x1400ac5fb
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400ac6a8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400ac615
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400ac625
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400ac657
mov rdi, rsi
test rsi, rsi
je 0x1400ac651
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400ac65c
add r8, 2
sub rdi, 1
jne 0x1400ac639
xor ecx, ecx
test ecx, ecx
je 0x1400ac665
mov rax, qword [rax]
jmp 0x1400ac5e8
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400ac653
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400ac672
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400ac67c
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400ac6a8
test r11, r11
je 0x1400ac6a2
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400ac6b4
add rcx, 2
sub r11, 1
jne 0x1400ac689
xor ecx, ecx
test ecx, ecx
je 0x1400ac6ab
mov rax, r10
cmp rax, r10
jne 0x1400ac6bd
xor al, al
jmp 0x1400ac6c6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400ac6a4
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400af80c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [rdx + 0x18], 8
mov r12, r8
mov r11, qword [rdx + 0x10]
mov r9, rdx
jb 0x1400af839
mov r9, qword [rdx]
lea r10, [r11 + r11]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
test r10, r10
je 0x1400af86d
movzx eax, byte [r8 + r9]
movabs rbx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rbx
cmp r8, r10
jb 0x1400af84f
and rcx, qword [0x1404a4570]
mov r14, qword [0x1404a4558]
mov rax, rcx
mov r10, qword [0x1404a4548]
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], r10
jne 0x1400af89b
mov rcx, r10
jmp 0x1400af8a3
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400af950
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400af8bd
mov r8, qword [rdx]
mov rbp, qword [rcx + 0x18]
mov r9, rcx
cmp rbp, 8
jb 0x1400af8cd
mov r9, qword [rcx]
mov rsi, qword [rcx + 0x10]
cmp rsi, r11
jne 0x1400af8ff
mov rdi, rsi
test rsi, rsi
je 0x1400af8f9
sub r9, r8
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jne 0x1400af904
add r8, 2
sub rdi, 1
jne 0x1400af8e1
xor ecx, ecx
test ecx, ecx
je 0x1400af90d
mov rax, qword [rax]
jmp 0x1400af890
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400af8fb
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400af91a
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400af924
mov rdx, qword [rdx]
cmp r11, rsi
jne 0x1400af950
test r11, r11
je 0x1400af94a
sub rdx, rcx
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jne 0x1400af95c
add rcx, 2
sub r11, 1
jne 0x1400af931
xor ecx, ecx
test ecx, ecx
je 0x1400af953
mov rax, r10
cmp rax, r10
jne 0x1400af965
xor al, al
jmp 0x1400af96e
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400af94c
mov ecx, dword [rax + 0x30]
mov al, 1
mov dword [r12], ecx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1400b7270
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rdx + 8]
sub rax, qword [rdx]
jne 0x1400b72ba
lea rdx, [0x14033f0f2]
call fcn.1400673e4
jmp 0x1400b73c9
or dword [rbp - 0x50], 0xffffffff
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0x40000001
mov edx, eax
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x1400b73eb
mov edx, dword [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140076f04
nop
mov rdx, qword [rsi + 8]
sub rdx, qword [rsi]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rbp - 0x40]
mov r9, rbx
mov r8d, 0x40000001
mov rcx, qword [rsi]
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x1400b7429
mov esi, dword [rbp - 0x50]
movdqa xmm0, xmmword [0x14038ac50]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x28]
cmp rsi, 0xf
ja 0x1400b7353
mov qword [rbp - 0x18], rsi
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_memmove]
mov byte [rbp + rsi - 0x28], 0
jmp 0x1400b735e
mov r9, rbx
mov rdx, rsi
call fcn.1400672b8
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x18]
movups xmmword [rdi + 0x10], xmm1
movdqa xmm0, xmmword [0x14038ac50]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x28]
call fcn.1400550a8
nop
test rbx, rbx
je 0x1400b73c9
mov rcx, rbx
mov rax, qword [rbp - 0x30]
sub rax, rbx
cmp rax, 0x1000
jb 0x1400b73c1
test cl, 0x1f
jne 0x1400b73ba
mov rbx, qword [rbx - 8]
cmp rbx, rcx
jae 0x1400b73ba
sub rcx, rbx
sub rcx, 8
cmp rcx, 0x1f
jbe 0x1400b73c1
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1402e0278
mov rax, rdi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140048a6c
mov r9d, eax
mov rcx, qword [rbp + 0x18]
lea rax, str.ConvertByteArrayToBase64String_failed_to_calculate_needed_size_of_converted_message
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x125
call fcn.14004d1a0
nop
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140048a6c
mov r9d, eax
mov rcx, qword [rbp + 0x18]
lea rax, str.ConvertByteArrayToBase64String_failed_conversion
mov qword [rsp + 0x20], rax
lea r8, str.amcorewcd_sourceincconverters.h
mov edx, 0x12c
call fcn.14004d1a0
int3
Function at 0x1400bf110
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov rbx, rdx
mov rdi, rcx
mov ecx, 0x80
mov rax, qword gs:[0x58]
mov r8, qword [rax]
mov eax, dword [rcx + r8]
cmp dword [0x1404bfe6c], eax
jg 0x1400bf178
lea rcx, [rdi + 0x110]
mov rdx, rbx
call fcn.1400c0f44
mov r9d, 2
mov r8, rbx
lea rdx, [0x1404bfe48]
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1400bf1bc
lea rcx, [0x1404bfe6c]
call fcn.1402e5a88
cmp dword [0x1404bfe6c], 0xffffffff
jne 0x1400bf147
lea rdx, str.EventType
lea rcx, [0x1404bfe48]
call fcn.1400673e4
lea rcx, [0x14031c630]
call fcn.1402e022c
nop
lea rcx, [0x1404bfe6c]
call fcn.1402e5a28
jmp 0x1400bf147
Function at 0x1400ca048
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
lea rsi, [r8 + 0x10]
mov rdi, r8
cmp qword [rsi + 0x18], 0x10
mov r14, rdx
mov r9, rcx
mov r10, rsi
jb 0x1400ca077
mov r10, qword [rsi]
xor r8d, r8d
movabs rcx, 0xcbf29ce484222325
cmp qword [rsi + 0x10], r8
jbe 0x1400ca0a9
movzx eax, byte [r8 + r10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, rdx
cmp r8, qword [rsi + 0x10]
jb 0x1400ca08a
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400ca0e1
cmp qword [rcx + rdx*8], rdi
jne 0x1400ca0d6
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400ca0da
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400ca0ee
cmp qword [rcx + rdx*8], rdi
jne 0x1400ca0ee
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.1400550a8
mov rcx, rsi
call fcn.1400550a8
mov rcx, rdi
call fcn.1402e0278
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1401883f8
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
cmp qword [r8 + 0x18], 8
mov rdi, rdx
mov r11, qword [r8 + 0x10]
mov rbx, rcx
mov r10, r8
jb 0x140188428
mov r10, qword [r8]
lea rdx, [r11 + r11]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x14018845b
movzx eax, byte [rcx + r10]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x14018843d
mov rcx, qword [rbx + 0x30]
mov r15, qword [rbx + 0x18]
and rcx, r9
mov r10, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r12, [rcx + rcx]
mov rax, qword [r15 + rax*8]
cmp qword [r15 + r12*8], r10
jne 0x140188483
mov rcx, r10
jmp 0x14018848b
mov rcx, qword [r15 + r12*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140188548
cmp qword [r8 + 0x18], 8
lea rcx, [rax + 0x10]
mov rdx, r8
jb 0x1401884a5
mov rdx, qword [r8]
mov r14, qword [rcx + 0x18]
mov r9, rcx
cmp r14, 8
jb 0x1401884b5
mov r9, qword [rcx]
mov rbp, qword [rcx + 0x10]
cmp rbp, r11
jne 0x1401884e6
mov rsi, rbp
test rbp, rbp
je 0x1401884e0
sub r9, rdx
movzx ecx, word [rdx + r9]
movzx ebx, word [rdx]
cmp cx, bx
jne 0x1401884eb
add rdx, 2
sub rsi, 1
jne 0x1401884c9
xor ecx, ecx
test ecx, ecx
je 0x1401884f4
mov rax, qword [rax]
jmp 0x140188478
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401884e2
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x140188501
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x14018850b
mov r8, qword [r8]
cmp r11, rbp
jne 0x140188537
test r11, r11
je 0x140188531
sub r8, rcx
movzx edx, word [rcx + r8]
movzx r9d, word [rcx]
cmp dx, r9w
jne 0x14018853f
add rcx, 2
sub r11, 1
jne 0x140188518
xor ecx, ecx
test ecx, ecx
je 0x14018853a
mov rax, r10
mov qword [rdi], rax
jmp 0x14018854b
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140188533
mov qword [rdi], r10
mov rbx, qword [rsp + 0x20]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop r12
ret
Function at 0x14018856c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov r10, rdx
mov r14, rcx
mov r15, qword [rdx + 0x10]
mov r9, rdx
cmp qword [rdx + 0x18], 8
jb 0x1401885a3
mov r9, qword [rdx]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
lea rdx, [r15 + r15]
test rdx, rdx
je 0x1401885d6
movzx eax, byte [rcx + r9]
xor r8, rax
movabs r11, 0x100000001b3
imul r8, r11
inc rcx
cmp rcx, rdx
jb 0x1401885b8
mov rax, qword [r14 + 0x30]
and rax, r8
mov r12, qword [r14 + 0x18]
mov rbx, rax
add rbx, rbx
mov rbx, qword [r12 + rbx*8]
lea rbp, [rax + rax]
mov rsi, qword [r14 + 8]
cmp qword [r12 + rbp*8], rsi
jne 0x1401885fe
mov rax, rsi
jmp 0x140188606
mov rax, qword [r12 + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1401886ea
lea rcx, [rbx + 0x10]
mov rax, r10
cmp qword [r10 + 0x18], 8
jb 0x140188620
mov rax, qword [r10]
mov r8, rcx
cmp qword [rcx + 0x18], 8
jb 0x14018862d
mov r8, qword [rcx]
mov rdx, qword [rcx + 0x10]
cmp rdx, r15
jne 0x14018865d
test rdx, rdx
je 0x140188657
sub r8, rax
movzx ecx, word [rax + r8]
movzx r9d, word [rax]
cmp cx, r9w
jne 0x140188662
add rax, 2
sub rdx, 1
jne 0x14018863e
xor eax, eax
test eax, eax
je 0x14018866b
mov rbx, qword [rbx]
jmp 0x1401885f3
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140188659
mov rax, rbx
mov rdi, rbx
cmp qword [r12 + rbp*8], rsi
jne 0x14018867c
mov rcx, rsi
jmp 0x140188684
mov rcx, qword [r12 + rbp*8 + 8]
mov rcx, qword [rcx]
cmp rbx, rcx
je 0x1401886e5
lea rcx, [rbx + 0x10]
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14018869a
mov rdx, qword [rcx]
mov r8, r10
cmp qword [r10 + 0x18], 8
jb 0x1401886a7
mov r8, qword [r10]
cmp r15, qword [rcx + 0x10]
jne 0x1401886e5
mov r11, r15
test r15, r15
je 0x1401886d1
sub r8, rdx
movzx ecx, word [rdx + r8]
movzx r9d, word [rdx]
cmp cx, r9w
jne 0x1401886dc
add rdx, 2
sub r11, 1
jne 0x1401886b8
xor ecx, ecx
test ecx, ecx
jne 0x1401886e5
mov rbx, qword [rbx]
jmp 0x140188671
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1401886d3
cmp rax, rbx
jne 0x1401886f0
mov rdi, rsi
mov rbx, rsi
mov rax, rdi
xor ebp, ebp
cmp rdi, rbx
je 0x140188705
inc rbp
mov rax, qword [rax]
cmp rax, rbx
jne 0x1401886fa
mov rax, rsi
mov rsi, qword [rsi]
cmp rdi, rsi
jne 0x140188774
cmp rbx, rax
jne 0x140188774
mov qword [rax], rax
mov rax, qword [r14 + 8]
mov qword [rax + 8], rax
and qword [r14 + 0x10], 0
cmp rsi, qword [r14 + 8]
je 0x140188751
mov rdi, qword [rsi]
lea rcx, [rsi + 0x30]
call fcn.1401892c8
lea rcx, [rsi + 0x10]
call fcn.14004e0f0
mov rcx, rsi
call fcn.1402e0278
mov rsi, rdi
cmp rdi, qword [r14 + 8]
jne 0x14018872b
mov edx, 8
mov rcx, r14
call fcn.1400591e0
nop
jmp 0x140188779
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140188af4
cmp rdi, rbx
jne 0x140188761
mov rax, rbp
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401889d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [r8 + 0x10]
mov r10, rcx
mov qword [rsp + 0x30], rax
mov rbx, rdx
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rsp + rcx + 0x30]
movabs rdx, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rdx
cmp rcx, 8
jb 0x1401889f9
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r9
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x140188a50
cmp qword [rcx + rdx*8], r8
jne 0x140188a45
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140188a49
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140188a5d
cmp qword [rcx + rdx*8], r8
jne 0x140188a5d
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
lea rdx, [rsp + 0x30]
call fcn.14006bc88
mov rcx, qword [rax]
mov rax, rbx
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x140188af4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x140188b27
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x140188b56
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x140188b38
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140188b8e
cmp qword [rcx + rdx*8], rdi
jne 0x140188b83
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140188b87
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140188b9b
cmp qword [rcx + rdx*8], rdi
jne 0x140188b9b
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.1401892c8
mov rcx, rsi
call fcn.14004e0f0
mov rcx, rdi
call fcn.1402e0278
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x14018963c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rdi, r8
mov r15, rdx
mov r14, rcx
lea rcx, [r8 + 0x40]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14018967b
mov rcx, qword [rcx]
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
add r9, r9
je 0x1401896ab
movzx eax, byte [r8 + rcx]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
inc r8
cmp r8, r9
jb 0x14018968d
mov rsi, qword [r14 + 0x30]
and rsi, rdx
mov rbx, qword [r14 + 8]
add rsi, rsi
mov r12, qword [r14 + 0x18]
cmp rbx, qword [r12 + rsi*8]
je 0x1401896f9
mov rbx, qword [r12 + rsi*8 + 8]
mov rbx, qword [rbx]
jmp 0x1401896e1
mov rbx, qword [rbx + 8]
lea r8, [rbx + 0x10]
mov rdx, rdi
call fcn.14018aaa8
test al, al
je 0x1401896e9
cmp rbx, qword [r12 + rsi*8]
jne 0x1401896cd
jmp 0x1401896f9
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x1401897eb
mov rax, qword [r14 + 8]
mov r13, qword [rax]
mov r12, qword [r13 + 8]
mov r9, rdi
mov r8, r12
mov rdx, r13
call fcn.14018c050
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x249249249249248
sub rcx, rax
cmp rcx, 1
jae 0x14018973a
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [r13 + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14018978e
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x1401897a7
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x1401897d7
cmp qword [rdx + rsi*8], rbx
jne 0x1401897b3
mov qword [rdx + rsi*8], rdi
jmp 0x1401897d7
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x1401897d7
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14018a8f8
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14018a1d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15, rdx
mov r14, rcx
mov r9, qword [r8]
mov qword [rax + 0x18], r9
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r10, 0x100000001b3
imul rcx, r10
inc rdx
cmp rdx, 8
jb 0x14018a20c
mov rsi, qword [r14 + 0x30]
and rsi, rcx
mov rcx, qword [r14 + 8]
add rsi, rsi
mov rax, qword [r14 + 0x18]
cmp qword [rax + rsi*8], rcx
jne 0x14018a248
mov rbx, rcx
jmp 0x14018a25c
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
jmp 0x14018a25c
mov rbx, qword [rbx + 8]
cmp r9, qword [rbx + 0x10]
je 0x14018a264
cmp rbx, qword [rax + rsi*8]
jne 0x14018a252
jmp 0x14018a274
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14018a362
mov rdi, qword [rcx]
mov r12, qword [rdi + 8]
mov r9, r8
mov r8, r12
mov rdx, rdi
call fcn.140066144
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffe
sub rcx, rax
cmp rcx, 1
jae 0x14018a2b1
lea rcx, str.list_T__too_long
call qword [sym.imp.msvcp_win.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r12], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x70], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14018a305
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
mov rdx, qword [r14 + 0x18]
cmp qword [rdx + rsi*8], rcx
jne 0x14018a31e
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x14018a34e
cmp qword [rdx + rsi*8], rbx
jne 0x14018a32a
mov qword [rdx + rsi*8], rdi
jmp 0x14018a34e
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x14018a34e
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.14018a848
nop
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14018a9a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r11, qword [r8 + 0x60]
mov rdi, r8
add r8, 0x50
mov r14, rdx
mov r10, rcx
cmp qword [r8 + 0x18], 8
jb 0x14018a9d8
mov r8, qword [r8]
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x14018aa08
movzx eax, byte [r9 + r8]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, r11
jb 0x14018a9ea
mov rdx, qword [r10 + 0x30]
and rdx, rcx
mov rcx, qword [r10 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x14018aa40
cmp qword [rcx + rdx*8], rdi
jne 0x14018aa35
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x14018aa39
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x14018aa4d
cmp qword [rcx + rdx*8], rdi
jne 0x14018aa4d
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x50]
dec qword [r10 + 0x10]
call fcn.14004e0f0
lea rcx, [rdi + 0x30]
call fcn.14004e0f0
lea rcx, [rdi + 0x10]
call fcn.14004e0f0
mov rcx, rdi
call fcn.1402e0278
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret