joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400db200
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
cmp byte [rcx + 8], 1
mov rbx, rcx
jne 0x1400db278
mov dword [rbp + 0x67], 0x44898000
call qword [sym.imp.KERNEL32.dll_GetTickCount]
btr eax, 0x1f
lea rcx, [rbp + 0x6f]
sub eax, dword [rbx + 0xc]
movd xmm1, eax
lea rax, [rbp + 0x67]
cvtdq2ps xmm1, xmm1
subss xmm1, dword [0x14017b4c0]
mulss xmm1, dword [0x14017b43c]
divss xmm1, dword [0x14017b424]
addss xmm1, dword [0x14017b4c0]
comiss xmm1, dword [0x14017b564]
movss dword [rbp + 0x6f], xmm1
cmovbe rax, rcx
mov eax, dword [rax]
mov dword [rbx + 0x18], eax
mov r8d, dword [0x14019f0cc]
lea rcx, [rbp + 0x17]
movabs rdx, 0x329894daafedb293
call fcn.140044250
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movzx eax, byte [rbx + 8]
movups xmmword [rbp - 0x29], xmm0
mov edi, dword [rbp - 0x21]
movups xmmword [rbp - 0x19], xmm1
test al, al
jne 0x1400db2c3
test edi, edi
jle 0x1400db30c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
btr eax, 0x1f
mov byte [rbx + 8], 1
mov dword [rbx + 0xc], eax
jmp 0x1400db2c7
cmp al, 1
jne 0x1400db30a
test edi, edi
jne 0x1400db357
mov rax, qword [0x14019eb48]
mov byte [rbx + 8], dil
mov dword [rbx + 0x18], 0x43c80000
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400db30e
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call fcn.140064ed0
jmp 0x1400db30e
test edi, edi
jne 0x1400db357
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400db357
cmp byte [rbx + 8], 0
jne 0x1400db357
movss xmm1, dword [0x14017b4a0]
lea rax, [0x140175588]
mov qword [rbp - 0x29], rax
lea r8, [rbp - 0x29]
lea rax, [rbp - 0x29]
mov qword [rbp - 0x21], rbx
mov qword [rbp + 0xf], rax
call fcn.140042190
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x1400db419
mov rdx, qword [0x14019a8e8]
mov ecx, dword [0x14019f0cc]
add rdx, 0x38
add rdx, rcx
je 0x1400db3e8
mov rcx, qword [0x14019e1e0]
lea r8, [rbp + 0x67]
xor eax, eax
xor edi, edi
cmp byte [0x14019e189], al
mov dword [rbp + 0x67], eax
mov rcx, qword [rcx]
lea r9d, [rax + 4]
mov qword [rsp + 0x20], rdi
je 0x1400db3b9
call fcn.14011f0f0
jmp 0x1400db3bf
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
cmovns edi, dword [rbp + 0x67]
test dil, 1
je 0x1400db3e8
mov ecx, dword [0x14019f0cc]
add rcx, 0x488
add rcx, qword [0x14019a8e8]
call fcn.1400457c0
test al, al
jne 0x1400db419
cmp byte [rbx + 8], 0
jne 0x1400db419
movss xmm1, dword [0x14017b348]
lea rax, [0x1401763c8]
mov qword [rbp + 0x17], rax
lea r8, [rbp + 0x17]
lea rax, [rbp + 0x17]
mov dword [rbx + 0x18], 0x43c80000
mov qword [rbp + 0x4f], rax
call fcn.140042190
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400db430
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x180
mov rsi, rcx
mov edx, dword [0x14019f0cc]
add rdx, 0x38
xor ebp, ebp
add rdx, qword [0x14019a8e8]
je 0x1400db491
xor eax, eax
mov dword [r11 + 0x10], eax
mov qword [rsp + 0x20], rbp
lea r9d, [rbp + 4]
lea r8, [r11 + 0x10]
mov rcx, qword [0x14019e1e0]
mov rcx, qword [rcx]
cmp byte [0x14019e189], al
je 0x1400db48b
call fcn.14011f0f0
jmp 0x1400db491
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
shr ecx, 0xf
and cl, 1
jne 0x1400db69f
mov edx, dword [0x14019f0cc]
add rdx, 0x38
add rdx, qword [0x14019a8e8]
jne 0x1400db4cb
mov ecx, ebp
jmp 0x1400db510
xor eax, eax
mov dword [rsp + 0x198], eax
mov qword [rsp + 0x20], rbp
lea r9d, [rax + 4]
lea r8, [rsp + 0x198]
mov rcx, qword [0x14019e1e0]
mov rcx, qword [rcx]
cmp byte [0x14019e189], al
je 0x1400db4fe
call fcn.14011f0f0
jmp 0x1400db504
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, ebp
test eax, eax
cmovns ecx, dword [rsp + 0x198]
test cl, 1
je 0x1400db69f
mov ecx, dword [0x14019f0cc]
add rcx, 0x488
add rcx, qword [0x14019a8e8]
call fcn.1400457c0
test al, al
je 0x1400db69f
cmp byte [rsi + 8], bpl
jne 0x1400db69f
mov ebx, dword [0x14019f0cc]
mov ecx, ebx
call fcn.140047500
test al, al
jne 0x1400db69f
mov rcx, qword [0x14019a8e8]
add rcx, 0x20
add rcx, rbx
call fcn.1400ee7e0
test eax, eax
je 0x1400db599
mov rcx, qword [0x14019a8e8]
add rcx, 0x20
add rcx, rbx
call fcn.1400ee7e0
mov ecx, eax
add rcx, 0xe8
call fcn.1400ee850
test al, al
jne 0x1400db69f
mov edx, dword [0x14019f0cc]
movsd xmm0, qword [0x14019fc78]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [0x14019fc80]
mov dword [rsp + 0x38], eax
lea r9, [rsp + 0x30]
movss xmm2, dword [0x14017b564]
mov rcx, qword [0x14019eaa8]
call fcn.140075ae0
mov rdi, rax
test rax, rax
je 0x1400db69f
lea rdx, [rsi + 0x80]
lea rcx, [rsp + 0x110]
call fcn.14008fe10
mov rbx, rax
mov qword [rsp + 0x198], rax
mov qword [rax + 0x40], rdi
mov byte [rsp + 0x20], 1
mov r9b, 1
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [0x14019eb68]
call fcn.1400881a0
nop
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x1400db66a
mov rax, qword [rbx + 0x38]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
cmp rdx, 0x1000
jb 0x1400db659
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400db6b8
mov rcx, r8
call fcn.140120ef8
mov qword [rbx + 0x28], rbp
mov qword [rbx + 0x30], rbp
mov qword [rbx + 0x38], rbp
xorps xmm0, xmm0
comiss xmm0, dword [rsp + 0xf8]
jbe 0x1400db681
cmp dword [rsp + 0xfc], 3
jl 0x1400db695
mov rax, qword [0x14019eb48]
movzx ecx, byte [rax + 0xd8]
call fcn.140064e30
nop
lea rcx, [rsp + 0x40]
call fcn.14008ff10
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140127e7c
int3
Function at 0x1400e4400
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
lea rcx, [0x1401738c0]
jmp 0x1407b0f06

Function at 0x1400e4980
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [0x14019f640]
xor ebx, ebx
movss xmm0, dword [0x14017afd4]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
lea r9d, [rbx + 1]
mov dword [rsp + 0x20], ebx
mov rax, qword [rax + 0x158]
call qword [case.0x14011a6f9.0]
mov rcx, qword [0x14019f640]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rax, qword [rcx]
mov rax, qword [rax + 0x88]
call qword [case.0x14011a6f9.0]
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14003c270
call fcn.14003c4b0
call fcn.14001e320
mov rcx, qword [0x14019f640]
test rcx, rcx
je 0x1400e4a13
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14011a6f9.0]
mov rcx, qword [0x14019f5b8]
test rcx, rcx
je 0x1400e4a2c
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x14011a6f9.0]
mov rcx, qword [0x14019e1c8]
test rcx, rcx
je 0x1400e4a45
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [0x14019e1c8], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400e7f70
Capabilities:
Contain obfuscated stackstrings
Hash data with md5
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xd90]
sub rsp, 0xe90
mov r8d, 0x104
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x20]
call fcn.140041ba0
nop
mov r8d, 4
lea rdx, [0x140173ac8]
mov rcx, rax
call fcn.140009ae0
cmp qword [rax + 0x18], 0x10
jb 0x1400e7fcb
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x370]
call fcn.1401341fc
nop
lea rcx, [rbp + 0x20]
call fcn.140009900
lea rcx, [0x140173ac0]
jmp 0x1407b19e9

Function at 0x1400e9c30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x40
jb 0x1400e9c32
mov rax, rcx
ret

Function at 0x1400e9c50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x1400e9c52
mov rax, rcx
ret

Function at 0x1400e9c70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2c
jb 0x1400e9c72
mov rax, rcx
ret

Function at 0x1400e9c90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xc
jb 0x1400e9c92
mov rax, rcx
ret

Function at 0x1400e9cb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x12
jb 0x1400e9cb2
mov rax, rcx
ret

Function at 0x1400e9cd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x14
jb 0x1400e9cd2
mov rax, rcx
ret

Function at 0x1400e9cf0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xe
jb 0x1400e9cf2
mov rax, rcx
ret

Function at 0x1400e9d10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x19
jb 0x1400e9d12
mov rax, rcx
ret

Function at 0x1400e9d30
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [rax - 0x12]
movsx edx, dl
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x15
jb 0x1400e9d32
mov rax, rcx
ret

Function at 0x1400e9d50
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400e9d60
mov rax, rcx
ret

Function at 0x1400eace0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x1400eacf0
mov rax, rcx
ret

Function at 0x1400ec0d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x1400ec0e0
mov rax, rcx
ret
Function at 0x1400ed420
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400ed4f6
cmp byte [rcx + 0x71], 0
je 0x1400ed4f6
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14011a6f9.0]
cmp eax, 0xffffffff
je 0x1400ed4e9
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x14011a6f9.0]
test eax, eax
je 0x1400ed4a6
sub eax, 1
je 0x1400ed4aa
cmp eax, 2
jne 0x1400ed4e9
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400ed4d7
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.14012c0b0
cmp rdi, rax
jne 0x1400ed4e9
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x1400eecd0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x14019f520]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [0x14019f508]
mov rax, qword [rdx + 8]
cmp rax, qword [0x14019f4f8]
je 0x1400eed8a
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1400eed8d
cmp rax, rdx
je 0x1400eed8a
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400eed70
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret

Function at 0x1400eef60
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x14019f590]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [0x14019f578]
mov rax, qword [rdx + 8]
cmp rax, qword [0x14019f568]
je 0x1400ef01a
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1400ef01d
cmp rax, rdx
je 0x1400ef01a
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400ef000
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x1400ef820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [0x14019aca8], 0x10
lea rdx, [0x14019ac90]
mov r10, qword [0x14019aca0]
movabs r9, 0xcbf29ce484222325
cmovae rdx, qword [0x14019ac90]
xor ebx, ebx
mov ecx, ebx
test r10, r10
je 0x1400ef874
movabs r11, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r10
jb 0x1400ef861
lea r8, [0x14019ac90]
lea rdx, [rsp + 0x20]
call fcn.1400fd710
cmp qword [rax + 8], rbx
setne bl
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400f0630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, rdx
lea rdx, [0x14019ac90]
cmp qword [0x14019aca8], 0x10
cmovae rdx, qword [0x14019ac90]
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
mov r8, qword [0x14019aca0]
test r8, r8
je 0x1400f0694
movabs r9, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x1400f0681
mov r9, rdi
lea r8, [0x14019ac90]
lea rdx, [rsp + 0x20]
call fcn.1400fd710
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400f06bf
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400f080d
movabs rax, 0x492492492492492
cmp qword [0x14019f8c0], rax
je 0x1400f0826
lea rax, [0x14019f8b8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
mov ecx, 0x38
call fcn.140120ebc
mov rsi, rax
mov qword [rsp + 0x38], rax
lea rdx, [0x14019ac90]
lea rcx, [rax + 0x10]
call fcn.140009150
nop
mov dword [rsi + 0x30], 0
mov r9, qword [0x14019f8c0]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400f072f
cvtsi2ss xmm0, rcx
jmp 0x1400f0744
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14019f8e8]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400f075a
cvtsi2ss xmm1, rcx
jmp 0x1400f076f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14019f8b0]
seta al
test al, al
je 0x1400f07a6
call fcn.1400f60b0
lea r8, [rsi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
call fcn.1400fd710
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x14019f8c0]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x14019f8c0], r9
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [0x14019f8c8]
mov rax, qword [0x14019f8e0]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x14019f8b8]
jne 0x1400f07ee
mov qword [rcx + rax*8], rsi
jmp 0x1400f0800
cmp r9, rdx
jne 0x1400f07f9
mov qword [rcx + rax*8], rsi
jmp 0x1400f0805
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400f0805
mov qword [rcx + rax*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
lea rcx, [0x140179578]
call fcn.14011f30c
int3
Function at 0x1400f0840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1400f0871
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor ebp, ebp
mov ecx, ebp
test r8, r8
je 0x1400f08a3
movabs r9, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x1400f0890
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.1400fd710
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400f08c9
mov qword [rsi], rax
mov byte [rsi + 8], bpl
jmp 0x1400f0a2a
movabs rax, 0x492492492492492
cmp qword [0x14019f8c0], rax
je 0x1400f0a48
lea rax, [0x14019f8b8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbp
mov ecx, 0x38
call fcn.140120ebc
mov rdi, rax
mov qword [rsp + 0x38], rax
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rbp
mov qword [rax + 0x28], rbp
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rax + 0x20], xmm1
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x18], recv
mov byte [r14], 0
mov dword [rax + 0x30], ebp
mov r9, qword [0x14019f8c0]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400f094d
cvtsi2ss xmm0, rcx
jmp 0x1400f0962
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14019f8e8]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400f0978
cvtsi2ss xmm1, rcx
jmp 0x1400f098d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14019f8b0]
seta al
test al, al
je 0x1400f09c4
call fcn.1400f60b0
lea r8, [rdi + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x30]
call fcn.1400fd710
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov r9, qword [0x14019f8c0]
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x14019f8c0], r9
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [0x14019f8c8]
mov rax, qword [0x14019f8e0]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x14019f8b8]
jne 0x1400f0a0c
mov qword [rcx + rax*8], rdi
jmp 0x1400f0a1e
cmp r9, rdx
jne 0x1400f0a17
mov qword [rcx + rax*8], rdi
jmp 0x1400f0a23
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400f0a23
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
lea rcx, [0x140179578]
call fcn.14011f30c
int3
Function at 0x1400f6690
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14019f610]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x14019f638]
js 0x1400f66b4
cvtsi2ss xmm0, rcx
jmp 0x1400f66c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x14019f600]
call fcn.14015153c
movss xmm1, dword [0x14017b69c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1400f66fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400f66fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400f672d
cmp rbx, 0x200
jae 0x1400f672a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400f672d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400f8890
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400f8a50
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14019f608]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14019f618]
lea rdx, [rdi + rdi]
call fcn.1400eded0
mov rcx, qword [0x14019f608]
lea r9, [rdi - 1]
mov qword [0x14019f630], r9
mov qword [0x14019f638], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400f8a45
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14019f618]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400f8982
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400f8a06
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x1400f89bf
mov r10, qword [rax]
cmp r10, rcx
je 0x1400f89b9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400f8a06
mov r8, rax
cmp r10, rax
je 0x1400f89e2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x1400f8a1a
cmp r10, rax
jne 0x1400f89d0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1400f8a40
mov r9, qword [0x14019f630]
jmp 0x1400f8930
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400f8a06
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140179608]
call fcn.14011f30c
int3