joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005b4f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov dword [rsp + 0x24], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], shutdown
mov byte [rcx], r15b
mov dword [rsp + 0x24], 1
lea esi, [r15 - 6]
lea r12, [rdx + 0x14]
cmp rdx, r12
je 0x14005b63e
mov eax, 0x100
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
movzx ebx, byte [rsp + 0x20]
nop
movzx eax, ax
movzx ecx, r15w
imul ecx, eax
movzx eax, byte [rbp]
add cx, ax
movzx r15d, cx
add si, 8
mov r14d, r15d
js 0x14005b5d5
nop
movzx ecx, sil
mov rax, r14
shr rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14005b5be
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14005b5b3
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14005b5cf
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.14001bc50
add si, 0xfffa
jns 0x14005b580
inc rbp
cmp rbp, r12
mov eax, 0x100
jne 0x14005b560
cmp si, 0xfffa
jle 0x14005b63e
lea ecx, [rsi + 8]
shl r14, 8
sar r14, cl
and r14d, 0x3f
movzx r9d, byte [r14 + r13]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14005b62b
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14005b620
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14005b63e
movzx r8d, byte [rsp + 0x20]
mov edx, 1
mov rcx, rdi
call fcn.14001bc50
mov rcx, qword [rdi + 0x10]
test cl, 3
je 0x14005b692
movzx ebx, byte [rsp + 0x20]
nop dword [rax]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14005b675
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14005b66d
mov rax, qword [rdi]
mov word [rax + rcx], 0x3d
jmp 0x14005b689
mov r9b, 0x3d
movzx r8d, bl
mov edx, 1
mov rcx, rdi
call fcn.14001bc50
mov rcx, qword [rdi + 0x10]
test cl, 3
jne 0x14005b650
mov rax, rdi
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x14005e7b0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 0x38], rdx
mov rbx, rcx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rbx + 0x48], rax
test rax, rax
jne 0x14005e7ee
mov ecx, dword [rbx]
lea rdx, str.Error:_CreateIoCompletionPort___failed.
call fcn.14005a260
xor al, al
add rsp, 0x30
pop rbx
ret
xor eax, eax
lea r8, [0x14005dc30]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx + 0x40], rax
setne al
add rsp, 0x30
pop rbx
ret
Function at 0x140060d30
Capabilities:
Convert ip address from string
Create tcp socket
Create udp socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401dd930]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov edi, 2
mov ecx, edi
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov qword [rbx + 0x460], rax
cmp rax, 0xffffffffffffffff
jne 0x140060d8f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Error:_WSASocket___failed._ErrorCode_d
jmp 0x140060e0b
mov word [rsp + 0x30], di
movzx ecx, word [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x32], ax
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140060db0
mov rdx, qword [rbx]
lea r8, [rsp + 0x34]
mov ecx, edi
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r8d, 0x10
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x460]
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x140060de8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Error:_bind___failed._ErrorCode_d
jmp 0x140060e0b
mov edx, 0x10
mov rcx, qword [rbx + 0x460]
call qword [sym.imp.WS2_32.dll_listen]
test eax, eax
je 0x140060e1d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Error:_listen___failed._ErrorCode_d
mov r8d, eax
mov ecx, dword [rbx + 0x458]
call fcn.14005a260
xor al, al
jmp 0x140060e92
movzx edi, word [rbx + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14005c190
nop
cmp qword [rax + 0x18], 8
jb 0x140060e39
mov rax, qword [rax]
mov r9d, edi
mov r8, rax
lea rdx, str.Info:_listen_websocket_server_at__s:_d
mov ecx, dword [rbx + 0x458]
call fcn.14005a260
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140060e90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140060e8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060eaa
call fcn.14014e5d4
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14014e570
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140155214
int3
Function at 0x140061160
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1401dd930]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [rcx + 0x470]
mov rbx, rdx
mov rdx, qword [rcx + 0x468]
mov rdi, rcx
cmp rdx, rax
je 0x1400611a3
cmp qword [rdx], rbx
je 0x1400611cf
add rdx, 0x118
cmp rdx, rax
jne 0x140061192
mov ecx, dword [rcx + 0x458]
lea rdx, str.Error:_read___invalid_socket.
call fcn.14005a260
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014e570
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rax, [rdx + 0x20]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsp + 0x28], rax
xor r9d, r9d
movups xmmword [rax + 0x10], xmm0
lea r8d, [rcx + 1]
mov qword [rdx + 0x40], rbx
mov dword [rsp + 0x40], ecx
lea rax, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x20], rax
add rdx, 0x48
call qword [sym.imp.WS2_32.dll_WSARecv]
test eax, eax
je 0x140061245
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x140061245
mov ecx, dword [rdi + 0x458]
lea rdx, str.Error:_WSARecv___failed._ErrorCode_d
mov r8d, eax
call fcn.14005a260
mov rdx, rbx
mov rcx, rdi
call fcn.1400614a0
jmp 0x1400611b5
mov al, 1
jmp 0x1400611b7

Function at 0x140080ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test r9b, r9b
je 0x140080f40
xor rdi, 7
test dil, dil
jne 0x140080f29
shr rdi, 0x30
mov qword [rsp + 0x60], rsi
add rdi, rcx
movzx esi, byte [rdx]
nop word [rax + rax]
mov edx, dword [rbx + 1]
mov rcx, rdi
call fcn.1400873c0
add rbx, 5
cmp rbx, qword [r14]
jae 0x140080ef9
cmp byte [rbx], sil
je 0x140080ee0
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x140080f13
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov r9, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
jmp fcn.14008d660
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x140080f5a
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
movzx r8d, byte [rdx + 1]
shr rdi, 0x30
add rdi, rbp
cmp r8d, 0x80
jae 0x140080f75
add rbx, 2
jmp 0x140080f8c
inc rdx
lea rcx, [rsp + 0x30]
call fcn.1400a3bc0
mov r8d, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r9, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140082710
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x140080fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test r9w, r9w
je 0x140081050
xor rdi, 7
test di, di
jne 0x140081039
shr rdi, 0x30
mov qword [rsp + 0x60], rsi
add rdi, rcx
movzx esi, word [rdx]
nop dword [rax + rax]
mov edx, dword [rbx + 2]
mov rcx, rdi
call fcn.1400873c0
add rbx, 6
cmp rbx, qword [r14]
jae 0x140081009
cmp word [rbx], si
je 0x140080ff0
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x140081023
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov r9, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
jmp fcn.14008d660
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x14008106a
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
movzx r8d, byte [rdx + 2]
shr rdi, 0x30
add rdi, rbp
cmp r8d, 0x80
jae 0x140081085
add rbx, 3
jmp 0x14008109d
add rdx, 2
lea rcx, [rsp + 0x30]
call fcn.1400a3bc0
mov r8d, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r9, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140082710
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x1400810c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test r9b, r9b
je 0x140081161
xor rdi, 3
test dil, dil
jne 0x14008114a
shr rdi, 0x30
mov qword [rsp + 0x60], rsi
add rdi, rcx
movzx esi, byte [rdx]
nop word [rax + rax]
mov rdx, qword [rbx + 1]
mov rcx, rdi
call fcn.140087400
add rbx, 9
cmp rbx, qword [r14]
jae 0x14008111a
cmp byte [rbx], sil
je 0x140081100
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x140081134
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov r9, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
jmp fcn.14008d660
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x14008117b
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
movzx r8d, byte [rdx + 1]
shr rdi, 0x30
add rdi, rbp
cmp r8d, 0x80
jae 0x140081196
add rbx, 2
jmp 0x1400811ad
inc rdx
lea rcx, [rsp + 0x30]
call fcn.1400a3bc0
mov r8d, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r9, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140082960
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
Function at 0x1400811d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
mov rdi, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
test r9w, r9w
je 0x140081271
xor rdi, 3
test di, di
jne 0x14008125a
shr rdi, 0x30
mov qword [rsp + 0x60], rsi
add rdi, rcx
movzx esi, word [rdx]
nop dword [rax + rax]
mov rdx, qword [rbx + 2]
mov rcx, rdi
call fcn.140087400
add rbx, 0xa
cmp rbx, qword [r14]
jae 0x14008122a
cmp word [rbx], si
je 0x140081210
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x140081244
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
mov rsi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov r9, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
jmp fcn.14008d660
mov rax, qword [rsp + 0x80]
movzx ecx, word [rax]
test cx, cx
je 0x14008128b
mov eax, dword [rsp + 0x88]
or dword [rcx + rbp], eax
movzx r8d, byte [rdx + 2]
shr rdi, 0x30
add rdi, rbp
cmp r8d, 0x80
jae 0x1400812a6
add rbx, 3
jmp 0x1400812be
add rdx, 2
lea rcx, [rsp + 0x30]
call fcn.1400a3bc0
mov r8d, dword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r9, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140082960
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret

Function at 0x14008ce10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov r11d, r8d
mov qword [rsp + 0x50], r11
mov r10, rcx
movabs rcx, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
mov rdi, r9
xor rdx, rax
movzx eax, byte [rsp + 0x51]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
movabs rax, 0x9e3779b97f4a7c15
imul rdx, rcx
xor rdx, qword [r10 + 0x10]
imul rdx, rax
mov rax, qword [r10 + 8]
dec rax
shr rdx, 0x20
and rdx, rax
mov rax, qword [r10 + 0x20]
mov rax, qword [rax + rdx*8]
movzx r9d, al
test rax, rax
je 0x14008cf1c
movzx ecx, al
not cl
test cl, 1
je 0x14008cf1c
nop dword [rax]
cmp dword [rax + 8], r8d
je 0x14008cf07
mov rax, qword [rax]
test rax, rax
jne 0x14008cee0
mov qword [rbx], 0
mov rax, rbx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test r9b, 1
je 0x14008ceee
mov r8, rdx
mov qword [rsp + 0x30], 0
mov rdx, rbx
mov qword [rsp + 0x38], r11
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call fcn.14010a800
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14008d0c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r10, rcx
movabs rcx, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
mov r11, r9
xor rdx, rax
movzx eax, byte [rsp + 0x61]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x62]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x63]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x64]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x65]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x66]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x67]
imul rdx, rcx
xor rdx, rax
movabs rax, 0x9e3779b97f4a7c15
imul rdx, rcx
xor rdx, qword [r10 + 0x10]
imul rdx, rax
mov rax, qword [r10 + 8]
dec rax
shr rdx, 0x20
and rdx, rax
mov rax, qword [r10 + 0x20]
mov rax, qword [rax + rdx*8]
movzx r9d, al
test rax, rax
je 0x14008d1b3
movzx ecx, al
not cl
test cl, 1
je 0x14008d1b3
cmp qword [rax + 8], r8
je 0x14008d1a3
mov rax, qword [rax]
test rax, rax
jne 0x14008d181
mov qword [rbx], 0
mov rax, rbx
mov qword [rbx + 8], rdx
add rsp, 0x40
pop rbx
ret
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 8], rdx
add rsp, 0x40
pop rbx
ret
test r9b, 1
je 0x14008d18f
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x30]
mov r8, rdx
mov qword [rsp + 0x30], 0
mov rdx, rbx
mov qword [rsp + 0x20], r11
mov rcx, r10
call fcn.14010a800
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x14008d1f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
movzx r11d, r8b
mov qword [rsp + 0x50], r11
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov edx, r11d
mov rdi, r9
xor rdx, rax
movzx eax, byte [rsp + 0x51]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
movabs rax, 0x9e3779b97f4a7c15
imul rdx, rcx
xor rdx, qword [r10 + 0x10]
imul rdx, rax
mov rax, qword [r10 + 8]
dec rax
shr rdx, 0x20
and rdx, rax
mov rax, qword [r10 + 0x20]
mov rax, qword [rax + rdx*8]
movzx r9d, al
test rax, rax
je 0x14008d2fc
movzx ecx, al
not cl
test cl, 1
je 0x14008d2fc
nop dword [rax]
cmp byte [rax + 8], r8b
je 0x14008d2e7
mov rax, qword [rax]
test rax, rax
jne 0x14008d2c0
mov qword [rbx], 0
mov rax, rbx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 8], rdx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
test r9b, 1
je 0x14008d2ce
mov r8, rdx
mov qword [rsp + 0x30], 0
mov rdx, rbx
mov qword [rsp + 0x38], r11
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov rcx, r10
call fcn.14010a800
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14008fcd0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
sub rsp, 0x38
mov rbp, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
mov qword [rsp + 0x50], rbp
cmp rbp, 1
jne 0x14008fd3e
mov qword [rbx + 0x18], 8
mov qword [rbx + 8], 8
test rcx, rcx
jne 0x14008fd0c
lea ecx, [rbp + 0x3f]
call fcn.14014e590
jmp 0x14008fd16
mov edx, 0x40
call fcn.14009e7d0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov qword [rbx + 0x20], rax
mov rax, rbx
shr rax, 4
mov qword [rbx + 0x10], rax
add rsp, 0x38
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
lea rdi, [rdx*8]
mov qword [rsp + 0x28], r14
mov r14, qword [rbx + 0x20]
mov qword [rbx + 8], rdx
test rcx, rcx
jne 0x14008fd6c
mov rcx, rdi
call fcn.14014e590
jmp 0x14008fd74
mov rdx, rdi
call fcn.14009e7d0
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401511b0
mov rax, qword [rbx + 8]
mov qword [rbx + 0x20], rsi
mov rsi, qword [rbx + 0x18]
mov qword [rbx + 0x18], rax
cmp rsi, rbp
jae 0x14008ff0c
mov qword [rsp + 0x68], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x30], r13
movabs r13, 0xcaee32a7d4f6a63
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop word [rax + rax]
mov r8, qword [r14 + rsi*8]
test r8, r8
je 0x14008fed8
movzx eax, r8b
not al
test al, 1
je 0x14008fed8
movabs rbp, 0x9e3779b97f4a7c15
nop word [rax + rax]
mov edx, dword [r8 + 8]
mov rdi, qword [r8]
mov eax, edx
shr rax, 8
movzx ecx, al
mov eax, edx
shr rax, 0x10
movzx r10d, dl
xor r10, r12
shr rdx, 0x18
imul r10, r15
xor r10, rcx
movzx ecx, al
mov rax, qword [rbx + 8]
imul r10, r15
dec rax
xor r10, rcx
imul r10, r15
xor r10, rdx
imul r10, r13
xor r10, qword [rbx + 0x10]
imul r10, rbp
shr r10, 0x20
and r10, rax
mov rax, qword [rbx + 0x20]
lea r9, [r10*8]
mov rdx, qword [r9 + rax]
test rdx, rdx
jne 0x14008fe84
mov qword [r8], rdx
mov rax, qword [rbx + 0x20]
mov qword [r9 + rax], r8
mov rax, qword [rbx + 0x18]
cmp r10, rax
cmovb rax, r10
mov qword [rbx + 0x18], rax
jmp 0x14008fec5
movzx eax, dl
not al
test al, 1
je 0x14008feb0
mov rax, rdx
xor ecx, ecx
mov rax, qword [rax]
inc rcx
test rax, rax
jne 0x14008fe92
cmp rcx, 8
jae 0x14008feb0
mov qword [r8], rdx
mov rax, qword [rbx + 0x20]
mov qword [r9 + rax], r8
jmp 0x14008fec5
mov r9, r8
mov rdx, r10
lea r8, [0x14008f470]
mov rcx, rbx
call fcn.14010a9a0
mov r8, rdi
test rdi, rdi
jne 0x14008fe00
mov rbp, qword [rsp + 0x50]
jmp 0x14008fef1
test r8b, 1
je 0x14008fef1
lea rdx, [r8 - 1]
mov rcx, rbx
lea r8, [0x14008f470]
call fcn.14010ab60
inc rsi
cmp rsi, rbp
jb 0x14008fdd0
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
cmp qword [rbx + 0x28], 0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jne 0x14008ff2d
lea rdx, [rbp*8]
mov rcx, r14
call fcn.14014e5d4
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x1400901b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
sub rsp, 0x38
mov rbp, qword [rcx + 8]
mov rbx, rcx
mov rcx, qword [rcx + 0x28]
cmp rbp, 1
jne 0x140090219
mov qword [rbx + 0x18], 8
mov qword [rbx + 8], 8
test rcx, rcx
jne 0x1400901e7
lea ecx, [rbp + 0x3f]
call fcn.14014e590
jmp 0x1400901f1
mov edx, 0x40
call fcn.14009e7d0
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov qword [rbx + 0x20], rax
mov rax, rbx
shr rax, 4
mov qword [rbx + 0x10], rax
add rsp, 0x38
pop rbp
pop rbx
ret
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
lea rdi, [rdx*8]
mov qword [rsp + 0x28], r14
mov r14, qword [rbx + 0x20]
mov qword [rbx + 8], rdx
test rcx, rcx
jne 0x140090247
mov rcx, rdi
call fcn.14014e590
jmp 0x14009024f
mov rdx, rdi
call fcn.14009e7d0
mov r8, rdi
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1401511b0
mov rax, qword [rbx + 8]
mov qword [rbx + 0x20], rsi
mov rsi, qword [rbx + 0x18]
mov qword [rbx + 0x18], rax
cmp rsi, rbp
jae 0x140090425
mov qword [rsp + 0x68], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x30], r13
movabs r13, 0x9e3779b97f4a7c15
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop word [rax + rax]
mov r8, qword [r14 + rsi*8]
test r8, r8
je 0x1400903f1
movzx eax, r8b
not al
test al, 1
je 0x1400903f1
nop dword [rax + rax]
mov rdx, qword [r8 + 8]
mov rdi, qword [r8]
mov rax, rdx
shr rax, 8
movzx ecx, al
mov rax, rdx
shr rax, 0x10
movzx r10d, dl
xor r10, r12
imul r10, r15
xor r10, rcx
movzx ecx, al
imul r10, r15
mov rax, rdx
xor r10, rcx
shr rax, 0x18
imul r10, r15
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x20
imul r10, r15
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x28
imul r10, r15
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x30
imul r10, r15
movzx ecx, al
mov rax, qword [rbx + 8]
xor r10, rcx
imul r10, r15
shr rdx, 0x38
dec rax
xor r10, rdx
imul r10, r15
xor r10, qword [rbx + 0x10]
imul r10, r13
shr r10, 0x20
and r10, rax
mov rax, qword [rbx + 0x20]
lea r9, [r10*8]
mov rdx, qword [r9 + rax]
test rdx, rdx
jne 0x14009039a
mov qword [r8], rdx
mov rax, qword [rbx + 0x20]
mov qword [r9 + rax], r8
mov rax, qword [rbx + 0x18]
cmp r10, rax
cmovb rax, r10
mov qword [rbx + 0x18], rax
jmp 0x1400903e3
movzx eax, dl
not al
test al, 1
je 0x1400903ce
mov rax, rdx
xor ecx, ecx
nop dword [rax + rax]
mov rax, qword [rax]
inc rcx
test rax, rax
jne 0x1400903b0
cmp rcx, 8
jae 0x1400903ce
mov qword [r8], rdx
mov rax, qword [rbx + 0x20]
mov qword [r9 + rax], r8
jmp 0x1400903e3
mov r9, r8
mov rdx, r10
lea r8, [0x14008f4c0]
mov rcx, rbx
call fcn.14010a9a0
mov r8, rdi
test rdi, rdi
jne 0x1400902d0
jmp 0x14009040a
test r8b, 1
je 0x14009040a
lea rdx, [r8 - 1]
mov rcx, rbx
lea r8, [0x14008f4c0]
call fcn.14010ab60
inc rsi
cmp rsi, rbp
jb 0x1400902b0
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x68]
cmp qword [rbx + 0x28], 0
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
jne 0x140090446
lea rdx, [rbp*8]
mov rcx, r14
call fcn.14014e5d4
mov r14, qword [rsp + 0x28]
add rsp, 0x38
pop rbp
pop rbx
ret
Function at 0x1400ee820
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov r8, rdx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400ee4e0
mov rbx, rax
mov r8, qword [rax]
test r8, r8
jne 0x1400ee8b8
movzx edx, byte [rax + 8]
movabs r8, 0x100000001b3
movzx ecx, byte [rbx + 9]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rbx + 0xa]
imul rdx, r8
xor rdx, rcx
imul rdx, r8
xor rdx, rax
movzx eax, byte [rbx + 0xb]
imul rdx, r8
xor rdx, rax
movzx eax, byte [rbx + 0xc]
imul rdx, r8
xor rdx, rax
movzx eax, byte [rbx + 0xd]
imul rdx, r8
xor rdx, rax
movzx eax, byte [rbx + 0xe]
imul rdx, r8
xor rdx, rax
movzx eax, byte [rbx + 0xf]
imul rdx, r8
xor rdx, rax
imul rdx, r8
jmp 0x1400ee8fa
mov rbx, qword [rax + 8]
lea rdx, [0x140196a28]
mov r9, rbx
lea rcx, [rsp + 0x40]
call fcn.14006b620
movabs rax, 0xffffffff00000000
mov rcx, rbx
and rcx, rax
mov eax, ebx
or rcx, rax
movabs rax, 0x9ddfea08eb382d69
add rcx, qword [rsp + 0x40]
mul rcx
xor rdx, rax
xor rdx, qword [rdi + 0x10]
movabs rax, 0x9e3779b97f4a7c15
mov rcx, qword [rdi + 8]
mov rbx, qword [rsp + 0x48]
dec rcx
imul rax, rdx
shr rax, 0x20
and rax, rcx
add rsp, 0x30
pop rdi
ret