joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014690
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014790
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140016bd0
cmp esi, dword [rbx + 0x48]
jae 0x140014710
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140016c10
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x14001479d
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x14001479d
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x1400146df
call fcn.140013940
mov rbx, rax
jmp 0x1400146ca
mov rcx, r13
call fcn.140016c10
mov eax, 0xc
jmp 0x1400146fd

Function at 0x140014820
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014848
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.140013940
test rax, rax
jne 0x14001483a
add rsp, 0x28
ret

Function at 0x1400148b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400148d8
add rax, 0x18
add rsp, 0x28
ret
call fcn.140013940
test rax, rax
jne 0x1400148ca
jmp 0x1400148ce

Function at 0x1400149f0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140031c18]
test eax, eax
jne 0x140014a08
xor eax, eax
add rsp, 0x28
ret
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014a38
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x1400149fe
test byte [rax + 0x40], 3
je 0x1400149fe
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140014a00
call fcn.140013940
test rax, rax
jne 0x140014a1e
jmp 0x1400149fe

Function at 0x140014a50
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014a90
test ebx, ebx
jle 0x140014a80
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.140013940
test rax, rax
jne 0x140014a6d
add rsp, 0x20
pop rbx
ret
Function at 0x140014b80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014bf8
test byte [rbx + 0x40], 0xc
jne 0x140014baf
mov eax, dword [0x140031c18]
test eax, eax
jne 0x140014bc0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140012af0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140014be3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140014be3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140014c0c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140012de0
call fcn.140013940
mov rbx, rax
test rax, rax
jne 0x140014b9f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140014c2a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140012de0
call fcn.140014aa0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140014cb0
call fcn.140015d60
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140014ce8
call fcn.140013890
mov ecx, dword [0x140025118]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014d40
test esi, esi
je 0x140014cc6
call fcn.140014b80
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014d20
mov edx, edi
call fcn.140015e10
call fcn.140014b80
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014d30
call fcn.140014b80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140014b80
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140013890
mov ecx, dword [0x140025118]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140014c85
call fcn.140013940
mov rbx, rax
jmp 0x140014c85
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014c9e
call fcn.140013940
jmp 0x140014cc6
call fcn.140013940
mov rbx, rax
jmp 0x140014c81
Function at 0x140014c40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014bf8
test byte [rbx + 0x40], 0xc
jne 0x140014baf
mov eax, dword [0x140031c18]
test eax, eax
jne 0x140014bc0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140012af0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140014be3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140014be3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140014c0c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140012de0
call fcn.140013940
mov rbx, rax
test rax, rax
jne 0x140014b9f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140014c2a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140012de0
call fcn.140014aa0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140014cb0
call fcn.140015d60
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140014ce8
call fcn.140013890
mov ecx, dword [0x140025118]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014d40
test esi, esi
je 0x140014cc6
call fcn.140014b80
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014d20
mov edx, edi
call fcn.140015e10
call fcn.140014b80
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140014d30
call fcn.140014b80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140014b80
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140013890
mov ecx, dword [0x140025118]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140014c85
call fcn.140013940
mov rbx, rax
jmp 0x140014c85
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014c9e
call fcn.140013940
jmp 0x140014cc6
call fcn.140013940
mov rbx, rax
jmp 0x140014c81

Function at 0x140014d50
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140013890
mov ecx, dword [0x140025118]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140014dc0
test esi, esi
je 0x140014da0
call fcn.140014b80
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140014dd0
mov edx, esi
call fcn.140015e10
call fcn.140014b80
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140014b80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140014b80
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140013940
mov rbx, rax
jmp 0x140014d71
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140014d8a
Function at 0x1400240b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x180
call fcn.14000b8f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea r8, section..rdata
mov edx, 0x65
mov rsi, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x1400240fe
lea rcx, str.Cannot_find_the_resource_n
call fcn.1400181d0
or eax, 0xffffffff
jmp 0x1400242f5
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
lea rcx, str.Size_of_the_resource_is__lu_bytes_n
mov ebx, eax
mov edx, ebx
call fcn.1400181d0
test ebx, ebx
jne 0x140024134
lea rcx, str.The_resource_seems_empty_n
call fcn.1400181d0
mov eax, 0xfffffffe
jmp 0x1400242f5
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbp, rax
test rax, rax
jne 0x14002415e
lea rcx, str.Failed_to_load_HKP_n
call fcn.1400181d0
mov eax, 0xfffffffd
jmp 0x1400242f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x14002418b
lea rcx, str.Failed_to_lock_resource_n
call fcn.1400181d0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, 0xfffffffc
jmp 0x1400242f5
mov rdx, qword [rax]
xor ecx, ecx
lea r12, [rax + rbx]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x2c], rdx
mov edx, dword [rax + 8]
mov qword [rsp + 0x40], rcx
lea rdi, [rax + rdx]
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x48], rcx
cmp r12, rdi
je 0x14002420c
sub rbx, rdx
jns 0x1400241c9
lea rcx, str.vector::_M_range_insert
call fcn.140024540
mov rcx, rbx
call fcn.140023b00
mov r8, rax
xor edx, edx
xor ecx, ecx
mov rsi, rax
call fcn.14001e800
mov rdx, r12
mov rcx, rdi
mov r8, rax
call fcn.14001e7d0
xor edx, edx
xor ecx, ecx
mov r8, rax
call fcn.14001e800
mov qword [rsp + 0x38], rsi
add rsi, rbx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
lea rdi, [rsp + 0x80]
lea rsi, [0x1400260a0]
mov ecx, 0x40
xor eax, eax
rep movsd dword [rdi], dword [rsi]
mov rdi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov rsi, rdi
mov qword [rsp + 0x60], rax
sub rsi, r12
je 0x140024259
jns 0x14002424c
call fcn.140024350
mov rcx, rsi
call fcn.140023b00
mov rbx, rax
jmp 0x14002425b
xor ebx, ebx
mov rdx, rdi
add rsi, rbx
mov r8, rbx
mov rcx, r12
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
call fcn.14001e7d0
mov rdx, rax
mov qword [rsp + 0x58], rax
xor eax, eax
sub rdx, rbx
cmp rax, rdx
jae 0x14002429a
movzx ecx, al
mov cl, byte [rsp + rcx + 0x80]
xor byte [rbx + rax], cl
inc rax
jmp 0x140024283
lea r8, [rsp + 0x68]
mov rcx, rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x68], 1
mov qword [rsp + 0x78], rdx
call fcn.14000253b
mov rcx, rax
call fcn.140001db1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeResource]
xor ecx, ecx
call sub.msvcrt.dll_exit
lea rcx, [rsp + 0x50]
mov rbx, rax
call fcn.14001ecf0
jmp 0x1400242e3
lea rcx, [rsp + 0x38]
call fcn.14001ecf0
mov rcx, rbx
call fcn.14000cc90
add rsp, 0x180
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x180011270
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001144b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180010760
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180011414
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001138c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180011403
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1800113c9
mov r10, qword [rdx]
cmp r10, rax
je 0x1800113c3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180011403
cmp r9, rdx
je 0x1800113df
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180011425
cmp r9, rdx
jne 0x1800113d0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180011310
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180011403
lea rcx, str.invalid_hash_bucket_count
call fcn.1800b48fc
int3
Function at 0x180014ca0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov qword [0x180210800], rcx
cmp edx, 1
jne 0x180014d9c
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180014d54
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180014d54
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0xf0d9809d
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x180014d4f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180014d30
cmp edx, 0x44f13661
je 0x180014da6
test r8d, r8d
jne 0x180014d10
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x180014d6a
cmp qword [rax + 0x30], 0
jne 0x180014ce0
xor eax, eax
mov qword [rsp + 0x28], 0
lea r8, [0x180014ab0]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call rax
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x38
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x180014d6c
Function at 0x180015390
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180210ce0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180210d08]
js 0x1800153b4
cvtsi2ss xmm0, rcx
jmp 0x1800153c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180210cd0]
call fcn.1800d7d94
movss xmm1, dword [0x1800fdb0c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800153fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800153fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18001542d
cmp rbx, 0x200
jae 0x18001542a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18001542d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180015460
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001560e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180210cd8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180210ce8]
lea rdx, [rdi + rdi]
call fcn.180010760
mov rax, qword [0x180210cd8]
lea r9, [rdi - 1]
mov qword [0x180210d00], r9
mov qword [0x180210d08], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180015603
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180210ce8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001554f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800155c4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18001558c
mov r10, qword [rdx]
cmp r10, rax
je 0x180015586
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800155c4
cmp r9, rdx
je 0x1800155a0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800155d8
cmp r9, rdx
jne 0x180015591
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800155fe
mov r9, qword [0x180210d00]
jmp 0x180015500
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800155c4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800b48fc
int3
Function at 0x180015460
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x180210ce0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x180210d08]
js 0x1800153b4
cvtsi2ss xmm0, rcx
jmp 0x1800153c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180210cd0]
call fcn.1800d7d94
movss xmm1, dword [0x1800fdb0c]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800153fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800153fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18001542d
cmp rbx, 0x200
jae 0x18001542a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18001542d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180015460
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001560e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180210cd8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180210ce8]
lea rdx, [rdi + rdi]
call fcn.180010760
mov rax, qword [0x180210cd8]
lea r9, [rdi - 1]
mov qword [0x180210d00], r9
mov qword [0x180210d08], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180015603
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180210ce8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001554f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800155c4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18001558c
mov r10, qword [rdx]
cmp r10, rax
je 0x180015586
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800155c4
cmp r9, rdx
je 0x1800155a0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800155d8
cmp r9, rdx
jne 0x180015591
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800155fe
mov r9, qword [0x180210d00]
jmp 0x180015500
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800155c4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800b48fc
int3
Function at 0x180029b60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x180210a40]
test rax, rax
jne 0x180029dcb
movups xmm0, xmmword [str.jQPXJ__f0_]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800ec1d8]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x1800ec1e0]
mov dword [rsp + 0x58], eax
movzx eax, word [0x1800ec1e4]
mov word [rsp + 0x5c], ax
cmp byte [0x1800ec1e5], 0
je 0x180029d3c
xor ecx, ecx
cmp dword [0x180111088], 2
jl 0x180029d02
movdqa xmm5, xmmword [0x1800fdc00]
movdqa xmm4, xmmword [0x1800fde70]
movdqa xmm6, xmmword [0x1800fdc60]
movdqa xmm0, xmmword [0x1800fddc0]
movdqa xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x44]
mov r8d, dword [rsp + 0x20]
nop word [rax + rax]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800fdd90]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800fdd90]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x180029c00
cmp ecx, 0x1e
jge 0x180029d3c
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
sub al, dl
add al, 0x39
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1e
jl 0x180029d10
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180029d60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.180013b40
nop
lea rcx, [rsp + 0x20]
call fcn.18002bf90
mov qword [0x180210a40], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180029dcb
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180029dbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180029dd5
call fcn.1800b5498
mov rax, qword [0x180210a40]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
call fcn.1800bc2fc
int3