joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001eea0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140190040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140190fd0]
mov edi, ecx
cmp byte [rbx + 0x4d3d], 0
jne 0x14001ef01
cmp byte [rbx + 0x4d3e], 0
jne 0x14001ef01
movsx r9d, word [rbx + 0x66a0]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000ce40
test dil, 2
je 0x14001f02f
jmp 0x14001ef8c
movss xmm1, dword [rbx + 0x39c4]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x66a0]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1401859a4]
mov edx, 0x10
mulss xmm1, dword [0x14018599c]
addss xmm0, dword [rbx + 0xf8]
addss xmm1, dword [rbx + 0xfc]
mov qword [rbx + 0x4a30], rax
mov dword [rbx + 0x4a1c], 1
movss dword [rbx + 0x4a28], xmm0
movss dword [rbx + 0x4a2c], xmm1
movss xmm0, dword [rbx + 0x3a30]
mulss xmm0, dword [0x14018590c]
or dword [rbx + 0x4a18], 0x41
movss dword [rbx + 0x4a78], xmm0
call fcn.14000ce40
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001efe0
lea r11, [0x14007b340]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001efc3
cmp byte [r8], r9b
jne 0x14001efc3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001efb0
not ecx
call fcn.140014b10
test rax, rax
je 0x14001f02f
cmp byte [rax + 0xbe], 0
je 0x14001f02f
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc6], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x66a0]
movsx r9d, word [rbx + 0x66a0]
call fcn.14000ce40
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2030347
call fcn.1400176a0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400593d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1400241c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x67f8], 0
lea rbx, [rcx + 0x6800]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140024267
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002421a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140026b30
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000da00
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x67f8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x6808]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140190fc8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002426f
mov rcx, rbx
call fcn.14000da00
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140024590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [0x140190fd0]
xor ebp, ebp
cmp byte [rbx + 0x6750], bpl
jne 0x14002466f
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140024668
lea r8, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
call fcn.14000d2c0
mov rsi, rax
test rax, rax
je 0x140024668
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400245f4
mov rcx, rax
call fcn.1400247c0
mov r8, qword [0x140190fd0]
test r8, r8
je 0x14002465f
movsx rdx, word [r8 + 0x68d8]
lea rcx, [r8 + 0x68dc]
mov r9d, dword [r8 + 0x3f70]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x140024654
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x68d8], cx
movsx rax, cx
lea rcx, [r8 + 0x68dc]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], ebp
inc word [rcx + 6]
inc dword [r8 + 0x68d4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [rbx + 0x6750], 1
movss xmm0, dword [rbx + 0x6754]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1400246fe
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x6754], xmm0
jb 0x1400246fe
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x1400246f1
mov rax, qword [0x140190fd0]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rbp
mov dword [rax + 0x6754], ebp
call fcn.140024a20
lea rdx, [0x14007ae54]
mov rcx, rdi
mov rsi, rax
call fcn.14000d110
mov rdi, rax
test rax, rax
je 0x1400246f8
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1400246f8
mov byte [rbx + 0xd0], 1
mov dword [rbx + 0x6754], ebp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140024720
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140190fd0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140024783
mov qword [rsp], rbx
lea rbx, [0x14007b340]
nop dword [rax]
cmp r9b, 0x23
jne 0x140024763
cmp byte [r8], r9b
jne 0x140024763
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140024750
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x6768]
not eax
mov r8, qword [r10 + 0x6770]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x1400247af
cmp dword [r8 + 8], eax
je 0x1400247b6
add r8, 0x48
cmp r8, rcx
jne 0x1400247a0
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x1400303b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x140191240]
and rcx, r15
add rcx, rcx
mov rax, qword [0x140191228]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x140191218]
cmp rbx, r14
jne 0x14003043a
mov rbx, r14
mov rbp, r14
jmp 0x140030479
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140030454
cmp rbx, rcx
je 0x140030473
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140030446
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x555555555555555
cmp qword [0x140191220], rax
jne 0x14003049a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x140191218]
mov qword [rsp + 0x20], rax
xor r13d, r13d
mov qword [rsp + 0x28], r13
mov ecx, 0x30
call fcn.14005968c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r12]
mov dword [rdi + 0x10], eax
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x20], r13
mov qword [rdi + 0x28], r13
mov rdx, qword [0x140191220]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400304ed
cvtsi2ss xmm0, rcx
jmp 0x140030502
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x140191248]
xorps xmm1, xmm1
test rcx, rcx
js 0x140030518
cvtsi2ss xmm1, rcx
jmp 0x14003052d
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x140191210]
jbe 0x14003059f
lea rcx, [0x140191210]
call fcn.140030740
mov rcx, qword [0x140191240]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x140191228]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x140191218]
cmp rax, rbx
je 0x14003058b
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140030588
mov rbx, rax
cmp rax, rdx
je 0x1400305e2
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140030577
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x140191220]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x140191220], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x140191240]
and rax, r15
add rax, rax
mov rcx, qword [0x140191228]
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x140191218]
jne 0x1400305e9
mov qword [rcx + rax*8], rdi
jmp 0x1400305fb
mov qword [rsp + 0x20], rax
jmp 0x140030590
cmp rdx, rbp
jne 0x1400305f4
mov qword [rcx + rax*8], rdi
jmp 0x140030600
cmp qword [rcx + rax*8 + 8], r8
jne 0x140030600
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x14003045b
Function at 0x140030a70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x140030af7
mov rbx, r12
mov r15, r12
jmp 0x140030b3a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140030b11
cmp rbx, rcx
je 0x140030b34
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140030b03
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0x555555555555555
cmp qword [rbp + 0x10], rax
jne 0x140030b58
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.14005968c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x18]
lea rdx, [r13 + 8]
call fcn.140030ce0
nop
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140030ba1
cvtsi2ss xmm0, rcx
jmp 0x140030bb6
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140030bc9
cvtsi2ss xmm1, rcx
jmp 0x140030bde
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140030c44
mov rcx, rbp
call fcn.140030740
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
jne 0x140030c17
mov qword [rsp + 0x28], 0
jmp 0x140030c37
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140030c34
mov rbx, rax
cmp rax, rdx
je 0x140030c75
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140030c23
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x140030c85
mov qword [rax + rsi*8], rdi
jmp 0x140030c97
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x140030c3c
cmp rdx, r15
jne 0x140030c90
mov qword [rax + rsi*8], rdi
jmp 0x140030c9c
cmp qword [rax + rsi*8 + 8], rcx
jne 0x140030c9c
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x140030b19
Function at 0x140036c70
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140036ca5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140030240
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140036e14
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140036d8c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140036e03
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140036dc9
mov r10, qword [rdx]
cmp r10, rax
je 0x140036dc3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140036e03
cmp r9, rdx
je 0x140036ddf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140036e25
cmp r9, rdx
jne 0x140036dd0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140036d10
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140036e03
Function at 0x140039c50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push r15
sub rsp, 0x28
mov rsi, qword [rcx + 8]
mov rbp, rcx
mov r15, qword [rcx + 0x10]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x140039de5
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x68], r13
movabs r13, 0xcbf29ce484222325
mov qword [rsp + 0x20], r14
nop dword [rax]
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140039cad
lock inc dword [rax + 8]
mov rax, qword [rbx + 0x18]
mov rdi, qword [rbx + 0x20]
movzx r14d, byte [rax + 0x10]
test rdi, rdi
je 0x140039cee
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140039cee
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140039cee
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
test r14b, r14b
jne 0x140039dc5
movzx eax, byte [rbx + 0x11]
lea r14, [rbx + 0x10]
movzx edx, byte [r14]
mov rdi, rbx
xor rdx, r13
imul rdx, r12
xor rdx, rax
movzx eax, byte [rbx + 0x12]
imul rdx, r12
xor rdx, rax
movzx eax, byte [rbx + 0x13]
imul rdx, r12
xor rdx, rax
imul rdx, r12
and rdx, qword [rbp + 0x30]
shl rdx, 4
add rdx, qword [rbp + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140039d5b
cmp rax, rbx
jne 0x140039d51
mov rax, qword [rbp + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140039d66
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140039d66
cmp rax, rbx
jne 0x140039d66
mov rax, qword [rbx]
mov qword [rdx], rax
mov rbx, qword [rbx]
dec qword [rbp + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rax, qword [rdi + 8]
mov qword [rbx + 8], rax
mov r14, qword [r14 + 0x10]
test r14, r14
je 0x140039db6
mov eax, 0xffffffff
lock xadd dword [r14 + 8], eax
cmp eax, 1
jne 0x140039db6
mov rax, qword [r14]
mov rcx, r14
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [r14 + 0xc], eax
cmp eax, 1
jne 0x140039db6
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 8]
mov edx, 0x28
mov rcx, rdi
call fcn.140059910
jmp 0x140039dc8
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x140039ca0
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
sub r15, qword [rbp + 0x10]
mov rax, r15
add rsp, 0x28
pop r15
pop rsi
pop rbp
pop rbx
ret
Function at 0x14003a340
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x14003a3c7
mov rbx, r12
mov r15, r12
jmp 0x14003a40a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x14003a3e1
cmp rbx, rcx
je 0x14003a404
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14003a3d3
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [rbp + 0x10], rax
jne 0x14003a428
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x58
call fcn.14005968c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
lea rcx, [rdi + 0x18]
lea rdx, [r13 + 8]
call fcn.14003a020
nop
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14003a471
cvtsi2ss xmm0, rcx
jmp 0x14003a486
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14003a499
cvtsi2ss xmm1, rcx
jmp 0x14003a4ae
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x14003a514
mov rcx, rbp
call fcn.140030740
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
jne 0x14003a4e7
mov qword [rsp + 0x28], 0
jmp 0x14003a507
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x14003a504
mov rbx, rax
cmp rax, rdx
je 0x14003a545
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14003a4f3
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x14003a555
mov qword [rax + rsi*8], rdi
jmp 0x14003a567
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x14003a50c
cmp rdx, r15
jne 0x14003a560
mov qword [rax + rsi*8], rdi
jmp 0x14003a56c
cmp qword [rax + rsi*8 + 8], rcx
jne 0x14003a56c
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x14003a3e9
Function at 0x140043310
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
movss xmm0, dword [rcx + 0xc]
mov rdi, r9
mulss xmm2, dword [0x140185a6c]
mov rsi, rdx
mov rbx, rcx
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
subss xmm0, xmm2
maxss xmm0, xmm6
ucomiss xmm0, xmm6
movss dword [rcx + 0xc], xmm0
jp 0x140043355
jne 0x140043355
mov al, 1
jmp 0x140043357
xor al, al
mov byte [rcx + 8], al
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140043530
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x1400433b6
mov r8d, 0x1505
lea r9, [0x140180275]
lea rdx, str.pos_y
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
imul r8d, r8d, 0x21
xor r8d, eax
cmp rdx, r9
jne 0x140043390
movss xmm3, dword [0x1401858ec]
mov edx, dword [rcx + 0x10]
call fcn.140035200
mov qword [rbx + 0x10], rax
mov rdx, qword [0x140190fd0]
movaps xmm3, xmm6
mov byte [rax + 0x10], 1
mov r8d, dword [rsi]
mov r9d, r8d
shr r9d, 3
mov rax, qword [rdx + 0x4b28]
and r9b, 1
shr r8d, 1
and r8b, 1
mov rcx, qword [rax]
movss xmm1, dword [rcx + 0x14]
movss xmm4, dword [rcx + 0x10]
movaps xmm0, xmm1
mov rcx, qword [rbx + 0x10]
comiss xmm6, xmm1
seta al
mov byte [rcx + 0x3c], al
test al, al
je 0x140043407
movaps xmm0, xmm6
movaps xmm3, xmm1
movss xmm2, dword [rcx + 0x30]
subss xmm0, xmm3
mulss xmm2, dword [rcx + 0x2c]
addss xmm2, dword [rcx + 0x28]
movss dword [rcx + 0x2c], xmm0
movss dword [rcx + 0x28], xmm3
subss xmm2, xmm3
divss xmm2, xmm0
movss xmm0, dword [rcx + 0x34]
ucomiss xmm0, xmm2
jp 0x140043438
je 0x140043441
movss dword [rcx + 0x30], xmm2
mov byte [rcx + 8], 0
mov rcx, qword [rbx + 0x10]
xorps xmm0, xmm0
movss xmm2, dword [rdx + 0x3938]
test rdi, rdi
js 0x14004345c
cvtsi2ss xmm0, rdi
jmp 0x140043471
mov rax, rdi
and edi, 1
shr rax, 1
or rax, rdi
cvtsi2ss xmm0, rax
addss xmm0, xmm0
addss xmm2, xmm2
mulss xmm2, xmm0
mulss xmm0, dword [rbx + 0x2c]
addss xmm2, xmm0
movss xmm0, dword [rcx + 0x34]
subss xmm2, dword [rcx + 0x28]
divss xmm2, dword [rcx + 0x2c]
ucomiss xmm0, xmm2
jp 0x140043498
je 0x1400434a5
movss dword [rcx + 0x30], xmm2
mov byte [rcx + 8], 0
mov rcx, qword [rbx + 0x10]
movss xmm3, dword [0x1401900b8]
movaps xmm2, xmm3
mulss xmm3, dword [rsi + 8]
mulss xmm2, dword [rsi + 4]
test r8b, r8b
jne 0x1400434cb
subss xmm4, dword [rbx + 0x28]
subss xmm4, xmm2
movaps xmm2, xmm4
test r9b, r9b
je 0x1400434e5
movss xmm1, dword [rcx + 0x34]
mulss xmm1, dword [rcx + 0x2c]
addss xmm1, dword [rcx + 0x28]
addss xmm1, xmm3
jmp 0x140043501
movss xmm0, dword [rcx + 0x34]
mulss xmm0, dword [rcx + 0x2c]
addss xmm0, dword [rcx + 0x28]
subss xmm1, xmm0
subss xmm1, dword [rbx + 0x2c]
subss xmm1, xmm3
or dword [rdx + 0x4a18], 1
movaps xmm0, xmm6
unpcklps xmm0, xmm6
movsd qword [rdx + 0x4a30], xmm0
movss dword [rdx + 0x4a28], xmm2
movss dword [rdx + 0x4a2c], xmm1
mov dword [rdx + 0x4a1c], 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x140055490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rdi
mov eax, 0x13d0
call fcn.14005a630
sub rsp, rax
mov rax, qword [0x140190040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov rdi, rcx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13b4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x34], eax
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x34], eax
inc r8
cmp r8, 0x270
jb 0x1400554d0
mov edx, 0xbb8
mov dword [rsp + 0x30], 0x270
sub rdx, rdi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
cmp rdx, 0xffffffffffffffff
jne 0x140055542
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x13e0], rbx
call fcn.140055dd0
mov ebx, eax
lea rcx, [rsp + 0x30]
shl rbx, 0x20
call fcn.140055dd0
mov eax, eax
or rax, rbx
mov rbx, qword [rsp + 0x13e0]
jmp 0x14005554f
inc rdx
lea rcx, [rsp + 0x20]
call fcn.140055be0
add rax, rdi
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400593d0
add rsp, 0x13d0
pop rdi
ret