joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b8ec
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18001b946
mov r11b, 0x23
lea rdi, [0x1800bb9a0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18001b930
cmp rdx, 2
jb 0x18001b930
cmp byte [r10], r11b
jne 0x18001b930
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18001b90e
jmp 0x18001b987
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18001b987
mov r11b, 0x23
lea rdi, [0x1800bb9a0]
cmp dl, r11b
jne 0x18001b96b
cmp byte [r10], r11b
jne 0x18001b96b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18001b959
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18001babc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x18001badc
and qword [r8], 0
lea rdx, [0x1800c0ab4]
call fcn.18001b998
mov rbx, rax
test rax, rax
je 0x18001bbcd
mov rcx, rax
call qword [sym.imp.msvcrt.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001bbc4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x18001bbc4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001bbc4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x18001bbc4
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x18001bbc4
mov rax, qword [0x18010ebd0]
test rax, rax
je 0x18001bb61
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18001bbc4
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x18001bbb1
call qword [sym.imp.msvcrt.dll_fclose]
mov rax, qword [0x18010ebd0]
test rax, rax
je 0x18001bba6
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x18001bbcd
call qword [sym.imp.msvcrt.dll_fclose]
test rsi, rsi
je 0x18001bbbf
mov qword [rsi], rbp
mov rax, rdi
jmp 0x18001bbcf
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001de70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xf8]
lea r9, [rsp + 0x10]
mov dword [rsp + 0x10], edx
mov r10d, 4
movsxd rdx, dword [rcx + 0xf0]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx ecx, byte [r9]
lea rax, [0x1800bb9a0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18001de95
not r8d
mov eax, r8d
ret
Function at 0x18003e230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov r10d, ebx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rsp + r10 + 0x38]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x18003e25c
mov rcx, qword [r11 + 0x38]
mov r8, qword [r11 + 0x20]
and rcx, r9
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [r11 + 0x10]
je 0x18003e2ab
mov r8, qword [r8 + rcx*8]
jmp 0x18003e2a4
cmp rax, r8
je 0x18003e2ab
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18003e29b
jmp 0x18003e2ae
mov rax, rbx
test rax, rax
cmove rax, qword [r11 + 0x10]
cmp rax, qword [r11 + 0x10]
je 0x18003e2e1
mov rsi, qword [rax + 0x20]
mov rdi, qword [rax + 0x18]
cmp rdi, rsi
je 0x18003e2e1
mov bl, 1
mov rcx, qword [rdi]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8 + 8]
add rdi, 8
cmp rdi, rsi
jne 0x18003e2cb
mov rbp, qword [rsp + 0x40]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18003e800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
movabs r8, 0xcbf29ce484222325
mov r10, rcx
xor r9d, r9d
movzx eax, byte [rbx + r9 + 0x10]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x18003e825
mov rcx, qword [r10 + 0x30]
mov rdx, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x18003e875
cmp qword [rdx + rcx*8], rbx
jne 0x18003e86a
mov rax, qword [r10 + 8]
mov qword [rdx + rcx*8], rax
jmp 0x18003e86e
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x18003e882
cmp qword [rdx + rcx*8], rbx
jne 0x18003e882
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rdi, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18003e8e1
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18003e8cd
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003e904
mov rcx, r8
call fcn.180090a0c
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov edx, 0x30
mov rcx, rbx
call fcn.180090a0c
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.1800948a0
int3
Function at 0x18003eb0c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rdx + r8]
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
inc rdx
cmp rdx, 4
jb 0x18003eb3d
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x18003ebda
mov rbx, rbp
movabs rax, 0x555555555555555
cmp qword [r14 + 0x10], rax
je 0x18003ed22
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.180090580
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xor r12d, r12d
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18003ec12
cvtsi2ss xmm0, rcx
jmp 0x18003ec27
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x18003ebec
cmp rbx, rdx
je 0x18003ec0b
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18003ebe3
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18003eb7f
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18003ed02
mov rbp, rbx
xor eax, eax
jmp 0x18003ebfa
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18003ec3a
cvtsi2ss xmm1, rcx
jmp 0x18003ec4f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x18003eca9
mov rcx, r14
call fcn.18000acb4
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x18003ec9f
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x18003ec97
mov rbx, rax
cmp rax, r8
je 0x18003ecdd
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18003ec8b
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x18003ece4
mov qword [rcx + rax*8], rdi
jmp 0x18003ecf6
mov qword [rsp + 0x20], rax
jmp 0x18003eca4
cmp r8, rbp
jne 0x18003ecef
mov qword [rcx + rax*8], rdi
jmp 0x18003ecfb
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18003ecfb
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18008e678
int3
Function at 0x18003f334
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 8
jb 0x18003f341
mov rax, rdx
ret

Function at 0x18003f6d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov ecx, r9d
mov rdx, r8
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov rcx, qword [0x18010e9c0]
mov esi, eax
cmp ebx, dword [rcx + 0xd0]
je 0x18003f711
lea rdx, str.dlc
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strcat]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18004094c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov r9d, 0xc
lea r8, [0x180109c08]
mov edx, 0x14b
call fcn.18003e2f8
mov ecx, 8
call fcn.180090580
lea rcx, [0x180040920]
mov qword [rax], rcx
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180040a0c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800409dd
cmp dword [rsp + 0x38], 0
je 0x1800409d2
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.18008ef78
test eax, eax
jne 0x1800409d2
add rsp, 0x58
ret
mov ecx, 1
call fcn.18008ece0
nop
and dword [rsp + 0x38], 0
mov ecx, 6
call fcn.18008ece0
int3

Function at 0x1800414d4
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov dword [rsp + 0x38], edx
mov r8, rcx
mov rsi, r9
movabs r10, 0xcbf29ce484222325
xor r11d, r11d
movzx eax, byte [rsp + r11 + 0x38]
movabs rcx, 0x100000001b3
xor r10, rax
inc r11
imul r10, rcx
cmp r11, 4
jb 0x1800414fd
mov rax, qword [r8 + 0x50]
mov rcx, qword [r8 + 0x38]
and rax, r10
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [r8 + 0x28]
je 0x18004154c
mov rcx, qword [rcx + rax*8]
jmp 0x180041545
cmp rbx, rcx
je 0x18004154c
mov rbx, qword [rbx + 8]
cmp edx, dword [rbx + 0x10]
jne 0x18004153c
jmp 0x18004154e
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [r8 + 0x28]
cmp rbx, qword [r8 + 0x28]
jne 0x180041560
xor al, al
jmp 0x180041599
test rdi, rdi
je 0x180041589
mov rdx, qword [rbx + 0x18]
mov r8, qword [rbx + 0x20]
mov eax, dword [r9]
sub r8, rdx
sar r8, 4
cmp rax, r8
jb 0x180041589
shl r8, 4
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rbx + 0x20]
mov al, 1
sub rcx, qword [rbx + 0x18]
sar rcx, 4
mov dword [rsi], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800415ac
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10, rcx
mov dword [rsp + 0x38], edx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x38]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x1800415c4
mov rcx, qword [r10 + 0x50]
and rcx, r8
mov r8, qword [r10 + 0x38]
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [r10 + 0x28]
je 0x180041613
mov r8, qword [r8 + rcx*8]
jmp 0x18004160c
cmp rax, r8
je 0x180041613
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180041603
jmp 0x180041615
xor eax, eax
test rax, rax
cmove rax, qword [r10 + 0x28]
cmp rax, qword [r10 + 0x28]
jne 0x180041635
mov dword [rsp + 0x38], edx
lea rcx, [r10 + 0x20]
lea rdx, [rsp + 0x38]
call fcn.180041fd0
add rsp, 0x28
ret
Function at 0x180041fd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor r9d, r9d
mov r10, rdx
mov r11, rcx
movabs r8, 0xcbf29ce484222325
lea edi, [r9 + 1]
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
add r9, rdi
imul r8, rcx
cmp r9, 4
jb 0x180041ff1
mov rcx, qword [r11 + 0x30]
mov rdx, qword [r11 + 0x18]
and rcx, r8
mov rax, qword [r11 + 8]
add rcx, rcx
mov rbx, qword [rdx + rcx*8 + 8]
cmp rbx, rax
je 0x180042043
mov r8d, dword [r10]
jmp 0x18004203b
cmp rbx, qword [rdx + rcx*8]
je 0x180042043
mov rbx, qword [rbx + 8]
cmp r8d, dword [rbx + 0x10]
jne 0x180042031
jmp 0x180042045
xor ebx, ebx
test rbx, rbx
je 0x1800420e7
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x18004206c
cmp qword [rdx + rcx*8], rbx
jne 0x180042061
mov qword [rdx + rcx*8], rax
jmp 0x180042065
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x180042079
cmp qword [rdx + rcx*8], rbx
jne 0x180042079
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rcx, qword [rbx]
dec qword [r11 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1800420d8
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x1800420c4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800420f7
mov rcx, r8
call fcn.180090a0c
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov edx, 0x30
mov rcx, rbx
call fcn.180090a0c
jmp 0x1800420e9
xor edi, edi
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
call fcn.1800948a0
int3
Function at 0x1800421a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rdx + r8]
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
inc rdx
cmp rdx, 4
jb 0x1800421d9
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x180042276
mov rbx, rbp
movabs rax, 0x555555555555555
cmp qword [r14 + 0x10], rax
je 0x1800423be
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.180090580
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xor r12d, r12d
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1800422ae
cvtsi2ss xmm0, rcx
jmp 0x1800422c3
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x180042288
cmp rbx, rdx
je 0x1800422a7
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18004227f
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18004221b
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18004239e
mov rbp, rbx
xor eax, eax
jmp 0x180042296
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800422d6
cvtsi2ss xmm1, rcx
jmp 0x1800422eb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x180042345
mov rcx, r14
call fcn.18000acb4
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x18004233b
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x180042333
mov rbx, rax
cmp rax, r8
je 0x180042379
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180042327
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x180042380
mov qword [rcx + rax*8], rdi
jmp 0x180042392
mov qword [rsp + 0x20], rax
jmp 0x180042340
cmp r8, rbp
jne 0x18004238b
mov qword [rcx + rax*8], rdi
jmp 0x180042397
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180042397
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18008e678
int3

Function at 0x1800428a4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamInventory.2.virtual_168
Function at 0x1800428b0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInventory.2.virtual_32

Function at 0x1800428d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamInventory.2.virtual_32

Function at 0x1800428e0
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInventory.2.virtual_8

Function at 0x180042910
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamInventory.2.virtual_8

Function at 0x18004294c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInventory.2.virtual_168
Function at 0x180043354
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rdx
mov dword [rsp + 0x18], r8d
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rsp + r10 + 0x18]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x180043371
mov rcx, qword [r11 + 0x48]
mov rdx, qword [r11 + 0x30]
and rcx, r9
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [r11 + 0x20]
je 0x1800433c1
mov rdx, qword [rdx + rcx*8]
jmp 0x1800433b9
cmp rax, rdx
je 0x1800433c1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800433b0
jmp 0x1800433c3
xor eax, eax
test rax, rax
cmove rax, qword [r11 + 0x20]
cmp rax, qword [r11 + 0x20]
je 0x1800433f7
cmp qword [rax + 0x38], 0
je 0x1800433f7
mov rdx, qword [rax + 0x28]
mov rcx, qword [rax + 0x20]
dec rdx
and rdx, qword [rax + 0x30]
mov rax, qword [rcx + rdx*8]
mov ecx, dword [rax + 0x10]
test ecx, ecx
mov dword [rbx], ecx
setne al
jmp 0x1800433f9
xor al, al
mov rbx, qword [rsp + 8]
ret

Function at 0x180043428
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rsp + 0x58]
mov rbp, rdx
mov dword [rax + 0x30], edi
mov rsi, rcx
movabs r10, 0xcbf29ce484222325
xor r11d, r11d
movzx eax, byte [rsp + r11 + 0x58]
movabs rcx, 0x100000001b3
xor r10, rax
inc r11
imul r10, rcx
cmp r11, 4
jb 0x180043456
mov rax, qword [rsi + 0x48]
mov rcx, qword [rsi + 0x30]
and rax, r10
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, qword [rsi + 0x20]
je 0x1800434a5
mov rcx, qword [rcx + rax*8]
jmp 0x18004349e
cmp rbx, rcx
je 0x1800434a5
mov rbx, qword [rbx + 8]
cmp edi, dword [rbx + 0x10]
jne 0x180043495
jmp 0x1800434a7
xor ebx, ebx
test rbx, rbx
cmove rbx, qword [rsi + 0x20]
cmp rbx, qword [rsi + 0x20]
je 0x180043581
cmp qword [rbx + 0x38], 0
je 0x180043581
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x28]
dec rcx
and rcx, qword [rbx + 0x30]
mov rdx, qword [rax + rcx*8]
mov eax, dword [rdx + 0x10]
mov dword [r9], eax
cmp eax, r8d
ja 0x180043581
cmp qword [rdx + 0x18], 0x10
jb 0x1800434f0
mov rdx, qword [rdx]
mov r8, rax
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_memcpy]
mov rcx, qword [rbx + 0x28]
mov rax, qword [rbx + 0x20]
dec rcx
and rcx, qword [rbx + 0x30]
mov rdi, qword [rax + rcx*8]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180043545
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180043540
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180043598
mov rcx, r8
call fcn.180090a0c
and qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
sub qword [rbx + 0x38], 1
jne 0x180043563
and qword [rbx + 0x30], 0
jmp 0x180043567
inc qword [rbx + 0x30]
mov rcx, qword [0x18010e9c0]
mov al, 1
mov rdx, qword [rcx + 8]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rdx]
mov qword [rcx], r8
jmp 0x180043583
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
call fcn.1800948a0
int3
Function at 0x1800437d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x1800438a4
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r15, qword [rdx + 8]
movabs r14, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r14, rax
imul r14, r8
cmp rdx, 4
jb 0x180043822
and r14, qword [rcx + 0x30]
add r14, r14
mov rax, qword [r12 + r14*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.180043660
mov edx, 0x40
mov rcx, rbx
call fcn.180090a0c
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x1800438b8
cmp rsi, rbp
jne 0x180043858
cmp qword [rsp + 0x80], r13
jne 0x18004389d
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x1800438d0
mov r13, qword [rsp + 0x78]
mov qword [r12 + r14*8], r13
mov rax, r13
jmp 0x1800438d3
mov rax, r15
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
je 0x18004389d
xor edx, edx
movabs r14, 0xcbf29ce484222325
movabs r13, 0x100000001b3
movzx eax, byte [rsi + rdx + 0x10]
inc rdx
xor r14, rax
imul r14, r13
cmp rdx, 4
jb 0x1800438f3
and r14, qword [rcx + 0x30]
mov r13, qword [rsp + 0x78]
add r14, r14
mov rax, qword [r12 + r14*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.180043660
mov edx, 0x40
mov rcx, rbx
call fcn.180090a0c
mov rcx, qword [rsp + 0x70]
dec qword [rcx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x18004395e
cmp rsi, rbp
je 0x180043899
jmp 0x180043921
mov qword [r12 + r14*8], r13
mov qword [r12 + r14*8 + 8], r13
jmp 0x1800438d8