joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bc35c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x1400bc37e
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x1400bc3ae
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x1400bc390
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400bc3e6
cmp qword [rcx + rdx*8], r8
jne 0x1400bc3db
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x1400bc3df
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400bc3f3
cmp qword [rcx + rdx*8], r8
jne 0x1400bc3f3
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.1400bc1e4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400c29dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp qword [rdx + 0x18], 0x10
mov rdi, rdx
mov rbp, qword [rdx + 0x10]
mov r15, rcx
mov r8, rdx
jb 0x1400c2a0f
mov r8, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rbp, rbp
je 0x1400c2a3e
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc rcx
imul rdx, r9
cmp rcx, rbp
jb 0x1400c2a20
mov r12, qword [r15 + 0x30]
mov rax, qword [r15 + 0x18]
and r12, rdx
mov rsi, qword [r15 + 8]
add r12, r12
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rsi
jne 0x1400c2a5f
mov rax, rsi
jmp 0x1400c2a67
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400c2adb
cmp qword [rdi + 0x18], 0x10
lea r14, [rbx + 0x10]
mov rdx, rdi
jb 0x1400c2a7d
mov rdx, qword [rdi]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
mov r13, qword [r14 + 0x10]
jb 0x1400c2a8e
mov rcx, qword [r14]
cmp r13, rbp
jne 0x1400c2a9f
mov r8, r13
call fcn.140239710
test eax, eax
je 0x1400c2aa8
mov rbx, qword [rbx]
mov rax, qword [r15 + 0x18]
jmp 0x1400c2a54
cmp qword [r14 + 0x18], 0x10
jb 0x1400c2ab2
mov r14, qword [r14]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x1400c2abf
mov rcx, qword [rdi]
cmp rbp, r13
jne 0x1400c2ad3
mov r8, rbp
mov rdx, r14
call fcn.140239710
test eax, eax
je 0x1400c2ad6
mov rbx, rsi
mov rax, rbx
jmp 0x1400c2ae1
mov rbx, rsi
mov rax, rsi
cmp rax, rsi
jne 0x1400c2b4c
mov rbx, qword [rsi]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x70], rdi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.1400c2e70
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [r15 + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400c2b6e
inc rax
mov rcx, r15
mov qword [r15 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [r15 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400bbdf0
mov rbx, qword [rsp + 0x30]
lea r11, [rsp + 0x40]
mov rbp, qword [r11 + 0x40]
lea rax, [rbx + 0x30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1402328c4
int3
Function at 0x1400ddb30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400ddab8
mov rax, qword [rbx + 0x28]
sub rax, rcx
and rax, 0xfffffffffffffff8
cmp rax, 0x1000
jb 0x1400ddaa4
mov rdx, qword [rcx - 8]
sub rcx, rdx
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400ddb1f
mov rcx, rdx
call fcn.140261814
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov rax, qword [rbx + 8]
mov rdi, qword [rax]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
and qword [rbx + 0x10], 0
mov rcx, qword [rbx + 8]
cmp rdi, rcx
je 0x1400ddb0b
mov rsi, qword [rdi]
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400ddaf7
and qword [rdi + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov rcx, rdi
call fcn.140261814
mov rdi, rsi
mov rcx, qword [rbx + 8]
cmp rsi, rcx
jne 0x1400ddad8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp fcn.140261814
call fcn.140261a5c
nop
jmp 0x1400ddb28
nop
nop
nop
nop
nop
nop
nop
nop
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rsp + 0x50]
mov rdi, rdx
mov r10, rcx
test rsi, rsi
jne 0x1400ddb68
lea edx, [rsi + 2]
mov r8d, 0x2887612
mov rcx, rdi
call fcn.1400e4fac
mov rax, rdi
jmp 0x1400ddc64
mov dword [rsp + 0x50], r8d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x50]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, 4
jb 0x1400ddb79
mov rdx, qword [r10 + 0x40]
mov r11, qword [r10 + 0x28]
and rdx, rcx
mov rcx, qword [r10 + 0x18]
add rdx, rdx
mov rbx, qword [r11 + rdx*8]
cmp qword [r11 + rdx*8], rcx
jne 0x1400ddbb9
mov rax, rcx
jmp 0x1400ddbc1
mov rax, qword [r11 + rdx*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400ddbd1
cmp dword [rbx + 0x10], r8d
je 0x1400ddbd4
mov rbx, qword [rbx]
jmp 0x1400ddbae
mov rbx, rcx
cmp rbx, rcx
jne 0x1400ddbee
xor edx, edx
mov r8d, 0x2887613
mov rcx, rdi
call fcn.1400e4b54
mov rax, rdi
jmp 0x1400ddc64
test r9, r9
je 0x1400ddc47
mov rdx, qword [rsi]
cmp qword [rbx + 0x28], rdx
ja 0x1400ddc47
lea r8, [rbx + 0x18]
cmp qword [r8 + 0x18], 8
jb 0x1400ddc0a
mov r8, qword [r8]
mov rcx, r9
call fcn.140263744
test eax, eax
je 0x1400ddc2c
movsxd rdx, eax
mov r8d, 0x2887615
mov rcx, rdi
call fcn.1400e4f20
mov rax, rdi
jmp 0x1400ddc64
mov rax, qword [rbx + 0x28]
inc rax
mov qword [rsi], rax
mov rax, rdi
and dword [rdi], 0
and qword [rdi + 8], 0
and dword [rdi + 0x10], 0
jmp 0x1400ddc64
mov rax, qword [rbx + 0x28]
xor edx, edx
inc rax
mov r8d, 0x2887614
mov rcx, rdi
mov qword [rsi], rax
call fcn.1400e4ac8
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400de56c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10d, dword [rdx]
mov r11, rdx
mov dword [rsp + 0x50], r10d
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x50]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1400de596
mov r9, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and r9, r8
mov r8, qword [rbx + 0x18]
add r9, r9
mov rax, qword [r8 + r9*8]
cmp qword [r8 + r9*8], rdx
jne 0x1400de5d7
mov rcx, rdx
jmp 0x1400de5df
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400de5f4
cmp dword [rax + 0x10], r10d
je 0x1400de5ef
mov rax, qword [rax]
jmp 0x1400de5cc
mov rcx, rax
jmp 0x1400de5fa
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1400de665
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1400dee00
mov rdx, rax
movabs rcx, 0x7fffffffffffffe
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400de679
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400de7f4
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1402328c4
int3

Function at 0x1400de688
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov r10d, dword [rdx]
mov r11, rdx
mov dword [rsp + 0x50], r10d
mov rbx, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x50]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1400de6b2
mov r9, qword [rbx + 0x30]
mov rdx, qword [rbx + 8]
and r9, r8
mov r8, qword [rbx + 0x18]
add r9, r9
mov rax, qword [r8 + r9*8]
cmp qword [r8 + r9*8], rdx
jne 0x1400de6f3
mov rcx, rdx
jmp 0x1400de6fb
mov rcx, qword [r8 + r9*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400de710
cmp dword [rax + 0x10], r10d
je 0x1400de70b
mov rax, qword [rax]
jmp 0x1400de6e8
mov rcx, rax
jmp 0x1400de716
mov rax, rdx
mov rcx, rdx
cmp rcx, rdx
jne 0x1400de781
mov rdi, qword [rdx]
lea rax, [rsp + 0x50]
mov rdx, rdi
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi + 8]
mov r8, rsi
call fcn.1400df010
mov rdx, rax
movabs rcx, 0x492492492492491
mov rax, qword [rbx + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400de795
inc rax
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rbx + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400dec10
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rax, 0x18
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.1402328c4
int3
Function at 0x1400de7f4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
mov r9d, dword [r8]
mov dword [rax + 0x18], r9d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400de830
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400de875
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400de8d7
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r9d, dword [rdi + 0x10]
jne 0x1400de878
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400de8bf
and qword [rbx + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov rcx, rbx
call fcn.140261814
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400de9fc
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400de911
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400de931
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400de960
cmp rax, rdx
jne 0x1400de93c
mov qword [r9 + r8*8], rbx
jmp 0x1400de960
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400de960
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x1400de981
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400de992
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400de9f1
cmp rdx, 0x200
jae 0x1400de9aa
shl rdx, 3
jmp 0x1400de9bc
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400de9bc
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400de9f1
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400de7f4
cmp rdi, r15
jne 0x1400de9d1
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400dea10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
mov r9d, dword [r8]
mov dword [rax + 0x18], r9d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400dea4c
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400dea91
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400dead7
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r9d, dword [rdi + 0x10]
jne 0x1400dea94
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
mov rcx, rbx
call fcn.140261814
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400debfc
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400deb11
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400deb31
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400deb60
cmp rax, rdx
jne 0x1400deb3c
mov qword [r9 + r8*8], rbx
jmp 0x1400deb60
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400deb60
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x1400deb81
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400deb92
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400debf1
cmp rdx, 0x200
jae 0x1400debaa
shl rdx, 3
jmp 0x1400debbc
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400debbc
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400debf1
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400dea10
cmp rdi, r15
jne 0x1400debd1
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400dec10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rbx, r9
mov r14, rdx
mov rsi, rcx
mov r9d, dword [r8]
mov dword [rax + 0x18], r9d
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x70]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 4
jb 0x1400dec4c
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r11, qword [rcx + rax*8]
cmp r11, rdi
je 0x1400dec91
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r11
je 0x1400decc7
mov rdi, qword [rdi + 8]
mov rdx, rdi
cmp r9d, dword [rdi + 0x10]
jne 0x1400dec94
mov r8, rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 8]
call fcn.1400d8220
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400dedec
mov qword [rsp + 0x70], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400ded01
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400ded21
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400ded50
cmp rax, rdx
jne 0x1400ded2c
mov qword [r9 + r8*8], rbx
jmp 0x1400ded50
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400ded50
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x1400ded71
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400ded82
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400dede1
cmp rdx, 0x200
jae 0x1400ded9a
shl rdx, 3
jmp 0x1400dedac
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400dedac
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400dede1
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1400dec10
cmp rdi, r15
jne 0x1400dedc1
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400dee20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, r8
mov rsi, rdx
mov r10, rcx
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x40], eax
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x40]
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
inc r9
cmp r9, 4
jb 0x1400dee57
mov rdx, qword [r10 + 0x30]
and rdx, r8
add rdx, rdx
mov rcx, qword [r10 + 0x18]
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400deeaf
cmp qword [rcx + rdx*8], rbx
jne 0x1400deea4
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r10 + 8]
mov rcx, qword [r10 + 0x18]
jmp 0x1400deea8
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400deebc
cmp qword [rcx + rdx*8], rbx
jne 0x1400deebc
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rdi, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400deef1
and qword [rbx + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
nop
mov rcx, rbx
call fcn.140261814
mov qword [rsi], rdi
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400def30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [r8 + 0x10]
mov r9, rcx
mov dword [rsp + 0x30], eax
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor r10d, r10d
movzx eax, byte [rsp + r10 + 0x30]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x1400def55
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400defad
cmp qword [rcx + rdx*8], r8
jne 0x1400defa2
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400defa6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400defba
cmp qword [rcx + rdx*8], r8
jne 0x1400defba
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov rax, qword [r8 + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r9 + 0x10]
call fcn.140261814
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [r8 + 0x10]
mov r9, rcx
mov dword [rsp + 0x30], eax
movabs rcx, 0xcbf29ce484222325
mov rbx, rdx
xor r10d, r10d
movzx eax, byte [rsp + r10 + 0x30]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, 4
jb 0x1400df061
mov rdx, qword [r9 + 0x30]
and rdx, rcx
mov rcx, qword [r9 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400df0b9
cmp qword [rcx + rdx*8], r8
jne 0x1400df0ae
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400df0b2
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400df0c6
cmp qword [rcx + rdx*8], r8
jne 0x1400df0c6
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r9 + 8]
mov rdx, rbx
call fcn.1400d8220
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400df998
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rbp, rdx
mov rsi, rcx
add rcx, 0x50
mov qword [rax - 0x30], rcx
and dword [rax - 0x28], 0
and dword [rax - 0x24], 0
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rsp + 0x30], eax
test eax, eax
jne 0x1400df9f1
cmp dword [rsp + 0x34], eax
jne 0x1400dfb10
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x60], rbp
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rsp + rdx + 0x60]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x1400dfa02
mov r8, qword [rsi + 0x40]
and r8, rcx
add r8, r8
mov r9, qword [rsi + 0x28]
mov rbx, qword [r9 + r8*8]
mov rdx, qword [rsi + 0x18]
mov rcx, rbx
cmp qword [r9 + r8*8], rdx
jne 0x1400dfa45
mov rax, rdx
jmp 0x1400dfa4d
mov rax, qword [r9 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400dfa88
cmp qword [rbx + 0x10], rbp
je 0x1400dfa5d
mov rbx, qword [rbx]
jmp 0x1400dfa37
mov rdi, rbx
cmp qword [r9 + r8*8], rdx
jne 0x1400dfa6b
mov rax, rdx
jmp 0x1400dfa73
mov rax, qword [r9 + r8*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400dfa83
cmp rbp, qword [rbx + 0x10]
jne 0x1400dfa83
mov rbx, qword [rbx]
jmp 0x1400dfa60
cmp rcx, rbx
jne 0x1400dfa8e
mov rdi, rdx
mov rbx, rdx
mov rax, rdi
cmp rdi, rbx
je 0x1400dfaa1
mov rcx, qword [rax]
mov rax, rcx
cmp rcx, rbx
jne 0x1400dfa96
cmp rdi, qword [rdx]
jne 0x1400dfadc
cmp rbx, rdx
jne 0x1400dfadc
lea rcx, [rsi + 0x18]
call fcn.1400e0168
mov edx, 8
lea rcx, [rsi + 0x10]
nop dword [rax]
call fcn.140017084
jmp 0x1400dfae1
mov r8, rdi
mov rdi, qword [rdi]
lea rdx, [rsp + 0x68]
lea rcx, [rsi + 0x10]
call fcn.1400e0304
nop
cmp rdi, rbx
jne 0x1400dfac7
cmp qword [rsi + 0x20], 0
jne 0x1400dfaf3
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
lea rcx, [rsp + 0x28]
call fcn.1400261e0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
nop
jmp 0x1400dfb20
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop