joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051df0
Capabilities:
Send data
Send data on socket

Disassembly:
cmp edx, 0x1f
jne 0x140051f98
push rbp
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx]
mov r14, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov rdi, qword [rbp + 0x1e0]
lea rsi, [rdi + 0x1cb8]
lea rbx, [rdi + 0x1eb8]
mov qword [rbx], rsi
cmp rsi, rbx
jae 0x140051e55
lea rax, [rsi + 1]
mov byte [rsi], 0xff
mov qword [rbx], rax
cmp rax, rbx
jae 0x140051e55
mov byte [rax], 0xfa
inc qword [rbx]
mov rax, qword [rbx]
cmp rax, rbx
jae 0x140051e55
mov byte [rax], dl
inc qword [rbx]
movzx ecx, word [rdi + 0x1ca8]
call qword [sym.imp.WS2_32.dll_htons]
movzx ecx, word [rdi + 0x1caa]
movzx r15d, ax
mov word [rsp + 0x48], ax
call qword [sym.imp.WS2_32.dll_htons]
mov r9, qword [rbx]
movzx ecx, ax
cmp r9, rbx
jae 0x140051e8c
mov byte [r9], r15b
inc qword [rbx]
mov r9, qword [rbx]
mov r15, qword [rsp + 0x58]
cmp r9, rbx
jae 0x140051ee2
movzx eax, byte [rsp + 0x49]
mov byte [r9], al
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140051ee2
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140051ee2
shr cx, 8
mov byte [r9], cl
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140051ee2
mov byte [r9], 0xff
inc qword [rbx]
mov r9, qword [rbx]
cmp r9, rbx
jae 0x140051ee2
mov byte [r9], 0xf0
mov r9, qword [rbx]
inc r9
mov qword [rdi + 0x1ec0], r9
lea r8, [rdi + 0x1cba]
sub r9, rsi
mov qword [rbx], rsi
sub r9, 2
mov edx, 0x3e
mov rcx, rbp
call fcn.1400518a0
mov rcx, qword [r14 + 0x4c0]
xor r9d, r9d
mov rdx, rsi
lea r8d, [r9 + 3]
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x140051f44
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14002dc50
lea rdx, [rdi + 0x1cbb]
mov r8d, 4
mov rcx, r14
call fcn.140051c70
mov rcx, qword [r14 + 0x4c0]
lea rdx, [rdi + 0x1cbf]
xor r9d, r9d
lea r8d, [r9 + 2]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x140051f90
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov rcx, rbp
mov r8d, eax
call fcn.14002dc50
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140053700
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x140082080]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, qword [rcx + 0xa00]
lea rax, [rsp + 0x30]
mov rdi, qword [rcx]
mov r14, rcx
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, dword [rbx + 0x15c]
mov rdx, qword [rbx + 0x168]
add r8d, 4
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [rbx + 0x150], 0
mov dword [rbx + 0x154], eax
jne 0x140053795
movsxd r8, dword [rsp + 0x30]
lea rcx, [rbx + 0xd0]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x150], eax
mov r8d, dword [rbx + 0x154]
mov qword [rsp + 0xf8], rbp
mov qword [rsp + 0x100], rsi
cmp r8d, 4
jge 0x1400537f6
lea rdx, str.Received_too_short_packet
mov rcx, rdi
call fcn.14002dc50
mov dword [rbx + 0xc], 7
xor eax, eax
mov rsi, qword [rsp + 0x100]
mov rbp, qword [rsp + 0xf8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140066860
add rsp, 0xd0
pop r14
pop rdi
pop rbx
ret
mov rdx, qword [rbx + 0x168]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rbx + 0xc], ecx
sub ecx, 3
je 0x1400538b1
sub ecx, 1
je 0x140053924
sub ecx, 1
je 0x140053860
cmp ecx, 1
je 0x140053843
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rdi
lea rdx, [0x140072750]
call fcn.14002dc50
jmp 0x140053924
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rbx
call fcn.140053430
test eax, eax
je 0x140053924
jmp 0x1400537ca
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
movsxd rbp, eax
lea rsi, [rdx + 4]
movzx eax, byte [rdx + 3]
mov r8, rbp
shl ecx, 8
xor edx, edx
or ecx, eax
mov dword [rbx + 8], ecx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140053924
sub rax, rsi
cmp rax, rbp
jae 0x140053924
mov r8, rsi
lea rdx, str.TFTP_error:__s_n
mov rcx, rdi
call fcn.14002ddd0
jmp 0x140053924
cmp r8d, 4
jle 0x140053924
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rbx + 0x48]
inc eax
movzx eax, ax
cmp eax, ecx
jne 0x140053924
lea eax, [r8 - 4]
mov rcx, r14
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.14002db70
mov esi, eax
test eax, eax
je 0x140053903
mov edx, 5
mov rcx, rbx
call fcn.1400543f0
mov eax, esi
jmp 0x1400537ca
mov eax, dword [rbx + 0x154]
mov rcx, rdi
sub eax, 4
cdqe
add qword [rdi + 0xf8], rax
mov rdx, qword [rdi + 0xf8]
call fcn.14003c650
mov rcx, r14
call fcn.14003c930
test eax, eax
je 0x1400537c8
mov edx, 5
mov rcx, rbx
call fcn.1400543f0
mov eax, Ordinal_45
jmp 0x1400537ca
Function at 0x1400666c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140066702
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140066749
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400667a2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140066760
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400667e3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140077eda]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140077edb]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400667b0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140067508
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140067552
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140067552
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140067552
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140067552
cmp dword [rcx + 0x84], 0xe
jbe 0x140067552
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140067554
xor al, al
add rsp, 0x28
ret
Function at 0xf41058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xf411df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xf41089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf4106f
add dl, dl
jne 0xf41096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf410f6
xor eax, eax
add dl, dl
jne 0xf410a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xf411ad
add dl, dl
jne 0xf410b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf410c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf410d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf410dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xf410ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xf4107e
mov eax, 1
add dl, dl
jne 0xf41106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xf41113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf410fb
sub eax, ebx
mov ebx, 1
jne 0xf4114c
mov ecx, 1
add dl, dl
jne 0xf4112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf4113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf41123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xf41168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xf41175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xf4115d
cmp eax, 0x7d00
jae 0xf4119b
cmp eax, 0x500
jb 0xf41196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4107e
cmp eax, 0x7f
ja 0xf4119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xf4107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xf411d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xf4107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x402494
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [0x00401018]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, section..text
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407070], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401028]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407068], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401040]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407060], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401060]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407058], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401078]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407050], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401090]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407048], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010b0]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407040], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010d4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407038], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010dc]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407030], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010e4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407028], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010ec]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407020], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010f4]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407018], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x004010fc]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401104]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407010], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x0040110c]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x00407008], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x00401114]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [section..data], rax
add rsp, 0x20
pop rbx
ret
Function at 0x402a68
Capabilities:
Check for time delay via gettickcount
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
xor r13d, r13d
mov rbx, rcx
mov edi, r13d
cmp dword [rax + rcx + 0x8c], r13d
je 0x402af2
mov esi, dword [rax + rcx + 0x88]
mov ebp, r13d
add rsi, rcx
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x20]
add r14, rcx
add r15, rcx
cmp dword [rsi + 0x14], r13d
jbe 0x402af2
mov r12d, ebp
lea rdx, [0x004015b4]
mov ecx, dword [r15 + r12*4]
add rcx, rbx
call qword [0x00407020]
test eax, eax
je 0x402ae0
inc ebp
cmp ebp, dword [rsi + 0x14]
jb 0x402abc
jmp 0x402af2
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx eax, word [rcx + r12*2]
mov edi, dword [r14 + rax*4]
add rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x00407080]
mov rbx, qword [rsp + 0x50]
cmp eax, 0x7fff
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmova rdi, r13
mov rax, rdi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x4039a8
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rdi, rcx
mov dword [rbp - 0x80], 0x11c
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x7c], 6
jae 0x403acc
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
xor ecx, ecx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x403a79
mov ecx, dword [rsp + 0x78]
xor edx, edx
mov rax, qword [rsp + 0x20]
div rcx
test rdx, rdx
jne 0x403a4d
cmp qword [rsp + 0x38], 0x1000
jne 0x403a4d
cmp dword [rsp + 0x40], 0x1000
jne 0x403a4d
cmp dword [rsp + 0x48], 0x20000
jne 0x403a4d
cmp dword [rsp + 0x44], 4
jne 0x403a4d
movabs rax, 0x74636a6e696d7678
cmp qword [rbx], rax
je 0x403a60
add rbx, qword [rsp + 0x38]
cmp rbx, 0x7fff0000
jae 0x403acc
mov rcx, rbx
jmp 0x4039ef
mov r8d, 0x20
mov rdx, rbx
mov rcx, rdi
call qword [0x00407038]
mov eax, 1
jmp 0x403ad1
or edi, 0xffffffff
lea rdx, [0x00401268]
mov r8d, edi
lea rcx, [0x00407090]
call fcn.004028ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov r8d, 0xa
call fcn.004027dc
mov r8d, edi
lea rdx, [0x0040127c]
lea rcx, [0x00407090]
call fcn.004028ac
mov r8d, 0x10
mov edx, ebx
call fcn.004027dc
xor eax, eax
jmp 0x403ad1
mov eax, 2
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x180018780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
lea rsi, [0x1800a80a0]
mov qword [rsp + 0x70], rsi
mov rcx, rsi
call qword [0x18006f2a8]
test eax, eax
je 0x1800187bd
mov ecx, 5
call qword [0x18006f298]
int3
cmp dword [0x1800a80ec], 0x7fffffff
jne 0x1800187df
mov dword [0x1800a80ec], 0x7ffffffe
mov ecx, 6
call qword [0x18006f298]
nop
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1800187f0
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180018823
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180018810
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180019420
cmp qword [rax + 8], 0
je 0x18001884e
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018e00
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x18001887f
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18001885b
mov rdx, qword [rdi]
mov rcx, qword [0x180123ce8]
call qword [0x18006f138]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018e00
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018e00
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x1800188c7
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018e00
mov rax, qword [rax]
mov rdx, qword [rax + 0x30]
mov rcx, r14
call rdx
mov rbx, rax
mov rcx, rsi
call qword [0x18006f2b0]
mov rax, rbx
jmp 0x1800188d0
mov rcx, rsi
call qword [0x18006f2b0]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x18001a960
Capabilities:
Parse pe header

Disassembly:
cmp ecx, 0x200
jg 0x18001a994
je 0x18001a98e
test ecx, ecx
je 0x18001a988
sub ecx, 1
je 0x18001a982
cmp ecx, 1
jne case.default.0x18001a9b7
mov eax, 4
ret
mov eax, 2
ret
mov eax, 1
ret
mov eax, 9
ret
add ecx, 0xfffffdff
cmp ecx, 0x66
ja case.default.0x18001a9b7
movsxd rax, ecx
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x1ac28]
add rcx, rdx
jmp rcx
mov eax, 0x25
ret
mov eax, 0x27
ret
mov eax, 0x26
ret
mov eax, 0x28
ret
mov eax, 0x21
ret
mov eax, 0x22
ret
mov eax, 0x24
ret
mov eax, 0x23
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 8
ret
mov eax, 0x20
ret
mov eax, 0xd
ret
mov eax, 0x1b
ret
mov eax, 0xde
ret
mov eax, 0xbc
ret
mov eax, 0xbd
ret
mov eax, 0xbe
ret
mov eax, 0xbf
ret
mov eax, 0xba
ret
mov eax, 0xbb
ret
mov eax, 0xdb
ret
mov eax, 0xdc
ret
mov eax, 0xdd
ret
mov eax, 0xc0
ret
mov eax, 0x14
ret
mov eax, 0x91
ret
mov eax, 0x90
ret
mov eax, 0x2c
ret
mov eax, 0x13
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x67
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x6e
ret
mov eax, 0x6f
ret
mov eax, 0x6a
ret
mov eax, 0x6d
ret
mov eax, 0x6b
ret
mov eax, 0x10d
ret
mov eax, 0xa0
ret
mov eax, 0xa2
ret
mov eax, 0xa4
ret
mov eax, 0x5b
ret
mov eax, 0xa1
ret
mov eax, 0xa3
ret
mov eax, 0xa5
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x5a
ret
mov eax, 0x70
ret
mov eax, 0x71
ret
mov eax, 0x72
ret
mov eax, 0x73
ret
mov eax, 0x74
ret
mov eax, 0x75
ret
mov eax, 0x76
ret
mov eax, 0x77
ret
mov eax, 0x78
ret
mov eax, 0x79
ret
mov eax, 0x7a
ret
mov eax, 0x7b
ret
xor eax, eax
ret
Function at 0x18001bb00
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18001bc06
mov rax, qword [rsi + 0x38]
shr rax, 3
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rdi
cmp rax, rcx
jbe 0x18001bca7
mov qword [r11 + 0x18], rbp
mov qword [r11 - 0x20], r14
mov r14, qword [rsi + 8]
mov rbp, qword [r14]
cmp rbp, r14
je 0x18001bbf2
movzx ecx, byte [rbp + 0x10]
movabs rax, 0xcbf29ce484222325
mov rdx, qword [rsi + 0x18]
xor rcx, rax
movzx eax, byte [rbp + 0x11]
movabs r8, 0x100000001b3
imul rcx, r8
mov qword [r11 - 0x10], r12
mov rbx, rbp
mov r12, qword [rbp + 8]
xor rcx, rax
imul rcx, r8
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x28], r15
mov r15, qword [rsi + 0x30]
and r15, rcx
mov qword [rsp + 0x20], rdx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov r13, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18006a524
dec qword [rsi + 0x10]
cmp rdi, r13
je 0x18001bc0c
cmp rbx, r14
jne 0x18001bbb0
cmp qword [rsp + 0x28], rbp
jne 0x18001bbdb
mov qword [r15], rbx
mov r13, qword [rsp + 0x40]
mov r15, qword [rsp + 0x30]
mov qword [r12], rbx
mov qword [rbx + 8], r12
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
cmp qword [rsp + 0x28], rbp
jne 0x18001bc1b
mov qword [r15], r14
mov rax, r14
jmp 0x18001bc1e
mov rax, r12
mov qword [r15 + 8], rax
cmp rbx, r14
je 0x18001bbdb
mov r13, qword [rsp + 0x20]
nop dword [rax]
movzx r15d, byte [rbx + 0x10]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rdx, 0x100000001b3
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, r13
mov rbp, qword [r15 + 8]
nop word [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18006a524
dec qword [rsi + 0x10]
cmp rdi, rbp
je 0x18001bc96
cmp rbx, r14
jne 0x18001bc70
jmp 0x18001bbd8
mov qword [r15], r14
mov qword [r15 + 8], r14
cmp rbx, r14
jne 0x18001bc30
jmp 0x18001bbdb
mov rcx, qword [rsi + 8]
xor edi, edi
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rcx, qword [rcx]
test rcx, rcx
je 0x18001bcd5
nop dword [rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.18006a524
mov rcx, rbx
test rbx, rbx
jne 0x18001bcc0
mov rax, qword [rsi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rsi + 8]
mov qword [rax + 8], rax
mov qword [rsi + 0x10], rdi
mov rax, qword [rsi + 8]
mov rdx, qword [rsi + 0x20]
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.18001cb10
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret
Function at 0x18001c7d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x18001c805
lea rcx, str.invalid_hash_bucket_count
call qword [0x18006f410]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1800179d0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x18001c935
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx r11d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r11, rbp
mov rcx, qword [rcx]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x18001c8a7
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001c924
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x18001c8e6
mov r10, qword [rdx]
cmp r10, rax
je 0x18001c8e0
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001c924
cmp r8, rdx
je 0x18001c900
nop dword [rax + rax]
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x18001c946
cmp r8, rdx
jne 0x18001c8f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x18001c870
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001c924