joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400066c0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14000f960], rbx
je 0x140006727
cmp rax, rbx
jne 0x14000671a
mov ebx, 1
mov esi, ebx
jmp 0x14000672c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x1400066ff
mov ebx, 1
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x140006744
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400067b0
mov eax, dword [0x14000f968]
test eax, eax
jne 0x1400067a5
mov dword [0x14000f968], ebx
lea r15, [0x1400089b8]
lea rdi, [0x1400089a0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x140006797
test eax, eax
jne 0x14000679b
cmp qword [rdi], r14
je 0x14000678c
mov rax, qword [rdi]
mov rcx, qword [0x140008920]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000676e
test eax, eax
je 0x1400067ab
mov eax, 0xff
jmp 0x140006906
mov dword [0x14000d3e4], ebx
mov edi, 0x1f
mov eax, dword [0x14000f968]
cmp eax, ebx
jne 0x1400067d7
lea rdx, [0x140008998]
lea rcx, [0x140008928]
call sub.msvcrt.dll__initterm
mov dword [0x14000f968], 2
test esi, esi
jne 0x1400067e5
mov rax, r14
xchg qword [0x14000f960], rax
cmp qword [0x14000f970], r14
je 0x140006818
lea rcx, [0x14000f970]
call fcn.140006b30
test eax, eax
je 0x140006818
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000f970]
mov r9, qword [0x140008920]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140006831
mov eax, 0xff
jmp 0x140006906
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400068b7
test ax, ax
je 0x14000684c
test edx, edx
jne 0x1400068b7
sub ax, bx
cmp ax, di
ja 0x140006862
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000684c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400013dc
mov dword [0x14000d3e0], eax
cmp dword [0x14000d400], r14d
jne 0x1400068a0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000d3e4], r14d
jne 0x1400068b5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000d3e0]
jmp 0x140006906
cmp ax, 0x22
jne 0x1400068cb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000683a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140198000
add rsp, 0x28
jmp 0x1400066c0
Function at 0x1800099d0
Capabilities:
Read .ini file

Disassembly:
sub rsp, 0x158
mov rax, qword [0x180064108]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rax, str.C:NobleNoble.Wrapper.ini
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea r8, [0x18005cf30]
mov dword [rsp + 0x20], 0x104
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoll]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.180053b00
add rsp, 0x158
ret
Function at 0x18001bb60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x88
mov rax, qword [0x180064108]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [0x180064940]
call fcn.180006c90
test al, al
je 0x18001bdf4
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0xa8], rdi
call fcn.180006af0
mov rdi, qword [rax + 8]
mov rbx, qword [rax]
cmp rbx, rdi
je 0x18001bde4
mov qword [rsp + 0x98], rbp
lea rbp, str.CaitlynWSnare
mov qword [rsp + 0xa0], rsi
lea rsi, str.eternals_caitlyneheadshottracker
mov qword [rsp + 0x80], r14
lea r14, str.CaitlynWSight
movaps xmmword [rsp + 0x70], xmm6
movss xmm6, dword [0x18005cf90]
movaps xmmword [rsp + 0x60], xmm7
movss xmm7, dword [0x18005a1a0]
movaps xmmword [rsp + 0x50], xmm8
movss xmm8, dword [0x18005cf74]
nop word [rax + rax]
mov rcx, qword [rbx]
test rcx, rcx
je 0x18001bdaf
lea r9, [0x18006a4e8]
mov byte [rsp + 0x20], 0
mov r8b, 1
movaps xmm1, xmm6
call fcn.1800060c0
test al, al
je 0x18001bdaf
xor eax, eax
mov r11d, 0x811c9dc5
inc eax
mov r9d, eax
cmp byte [rax + rsi], 0
jne 0x18001bc43
test eax, eax
je 0x18001bc89
mov r10, rsi
nop word [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
lea eax, [rdx + 0x20]
cmovbe edx, eax
movsx eax, dl
xor eax, r11d
imul r11d, eax, 0x1000193
sub r9, 1
jne 0x18001bc60
mov rcx, qword [rbx]
mov edx, r11d
call fcn.180005e00
test al, al
jne 0x18001bd58
xor eax, eax
mov r11d, 0x811c9dc5
inc eax
mov r9d, eax
cmp byte [rax + rbp], 0
jne 0x18001bca4
test eax, eax
je 0x18001bce9
mov r10, rbp
nop word [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
lea eax, [rdx + 0x20]
cmovbe edx, eax
movsx eax, dl
xor eax, r11d
imul r11d, eax, 0x1000193
sub r9, 1
jne 0x18001bcc0
mov rcx, qword [rbx]
mov edx, r11d
call fcn.180005e00
test al, al
jne 0x18001bd58
xor eax, eax
mov r11d, 0x811c9dc5
inc eax
mov r9d, eax
cmp byte [rax + r14], 0
jne 0x18001bd00
test eax, eax
je 0x18001bd49
mov r10, r14
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10]
lea r10, [r10 + 1]
lea r8d, [rdx - 0x41]
cmp r8b, 0x19
lea eax, [rdx + 0x20]
cmovbe edx, eax
movsx eax, dl
xor eax, r11d
imul r11d, eax, 0x1000193
sub r9, 1
jne 0x18001bd20
mov rcx, qword [rbx]
mov edx, r11d
call fcn.180005e00
test al, al
je 0x18001bdaf
mov rdx, qword [0x180064730]
xor r8d, r8d
mov rcx, qword [rbx]
call fcn.180006000
comiss xmm7, xmm0
jb 0x18001bdaf
call fcn.180006e20
test al, al
je 0x18001bdaf
mov rcx, qword [rbx]
call fcn.180005a60
mov rcx, qword [rbx]
lea rdx, [rsp + 0x30]
mov byte [rsp + 0x28], 1
xorps xmm3, xmm3
movaps xmm2, xmm8
mov byte [rsp + 0x20], 1
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x38], eax
call fcn.180006e70
add rbx, 8
cmp rbx, rdi
jne 0x18001bc10
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa8]
call fcn.18001be20
call fcn.18001e830
call fcn.18001e3d0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180053b00
add rsp, 0x88
ret
Function at 0x18001f140
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18001f2ed
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001f000
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18001f2b6
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001f230
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001f2a5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18001f26d
mov r10, qword [rdx]
cmp r10, rax
je 0x18001f267
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001f2a5
cmp r9, rdx
je 0x18001f281
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18001f2c7
cmp r9, rdx
jne 0x18001f272
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18001f1e0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001f2a5
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x180021960
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x180064ec0]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x180064e98]
shl rcx, 4
add rcx, qword [0x180064ea8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800219f5
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1800219f7
cmp rax, rcx
je 0x1800219f5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800219e4
jmp 0x1800219f7
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x180021a0d
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90

Function at 0x180021a20
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x180064f00]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x180064ed8]
shl rcx, 4
add rcx, qword [0x180064ee8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x180021ab5
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x180021ab7
cmp rax, rcx
je 0x180021ab5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x180021aa4
jmp 0x180021ab7
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x180021acd
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90

Function at 0x180026fa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x38
xor edx, edx
movaps xmmword [rsp + 0x20], xmm6
cmp byte [str.ezrealwattach], dl
mov r11, rcx
mov r10d, 0x811c9dc5
je 0x180027007
lea r8, str.ezrealwattach
inc edx
cmp byte [rdx + r8], 0
jne 0x180026fc3
test edx, edx
je 0x180027007
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
lea edx, [rcx - 0x41]
cmp dl, 0x19
lea eax, [rcx + 0x20]
cmovbe ecx, eax
movsx eax, cl
xor eax, r10d
imul r10d, eax, 0x1000193
sub r9, 1
jne 0x180026fe0
mov edx, r10d
mov rcx, r11
call fcn.180005d10
mov rcx, rax
call fcn.1800093a0
movaps xmm6, xmm0
call fcn.180006bc0
comiss xmm6, xmm0
movaps xmm6, xmmword [rsp + 0x20]
seta al
add rsp, 0x38
ret
Function at 0x18002ec60
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x1800660c0]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x180066098]
shl rcx, 4
add rcx, qword [0x1800660a8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x18002ecf5
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x18002ecf7
cmp rax, rcx
je 0x18002ecf5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x18002ece4
jmp 0x18002ecf7
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x18002ed0d
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90

Function at 0x18002eea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [0x18006a460]
jmp rax
push rbx
sub rsp, 0x20
xor eax, eax
lea r9, str.GwenQ
mov r10d, 0x811c9dc5
nop word [rax + rax]
inc eax
mov r8d, eax
cmp byte [rax + r9], 0
jne 0x18002eec0
test eax, eax
je 0x18002eef7
movzx ecx, byte [r9]
lea r9, [r9 + 1]
lea edx, [rcx - 0x41]
cmp dl, 0x19
lea eax, [rcx + 0x20]
cmovbe ecx, eax
movsx eax, cl
xor eax, r10d
imul r10d, eax, 0x1000193
sub r8, 1
jne 0x18002eed0
mov rcx, qword [0x180064730]
mov edx, r10d
call fcn.180005d10
mov rbx, rax
test rax, rax
je 0x18002ef27
mov rcx, rax
call fcn.180009370
test al, al
je 0x18002ef27
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180009380
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800398c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movsd xmm6, qword [0x18006a4e8]
mov ebx, dword [0x18006a4f0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
lea rcx, [0x180066760]
call fcn.180007a90
movsd qword [rsp + 0x30], xmm6
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
xor edx, edx
call fcn.180006d70
mov rbx, rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18003996a
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x180039965
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180039965
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180053668
test rbx, rbx
je 0x1800399d8
mov r10d, 0x811c9dc5
lea r8, [0x18005b550]
nop dword [rax]
inc edi
mov r9d, edi
cmp byte [rdi + r8], 0
jne 0x180039980
test edi, edi
je 0x1800399b7
movzx ecx, byte [r8]
lea edx, [rcx - 0x41]
lea eax, [rcx + 0x20]
cmp dl, 0x19
cmovbe ecx, eax
movsx eax, cl
xor eax, r10d
imul r10d, eax, 0x1000193
lea r8, [r8 + 1]
sub r9, 1
jne 0x180039990
mov edx, r10d
mov rcx, qword [0x180064730]
call fcn.180005e00
test al, al
jne 0x1800399d8
xor edx, edx
lea rcx, [0x180066760]
call fcn.180007d60
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret
Function at 0x18003b120
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movsd xmm6, qword [0x18006a4e8]
mov ebx, dword [0x18006a4f0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
lea rcx, [0x1800666a0]
call fcn.180007a90
movsd qword [rsp + 0x30], xmm6
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
xor edx, edx
call fcn.180006d70
mov rbx, rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18003b1d8
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x18003b1c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18003b1c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180053668
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
test rbx, rbx
je 0x18003b396
mov rcx, rbx
call fcn.180005b10
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
xor r8, rax
imul r8, r9
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov eax, edx
shr rax, 0x18
xor r8, rax
imul r8, r9
and r8, qword [0x1800668b0]
add r8, r8
mov rcx, qword [0x180066898]
mov rax, qword [rcx + r8*8 + 8]
mov r9, qword [0x180066888]
cmp rax, r9
je 0x18003b271
mov rcx, qword [rcx + r8*8]
cmp edx, dword [rax + 0x10]
je 0x18003b26e
nop
cmp rax, rcx
je 0x18003b271
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18003b260
mov rdi, rax
mov rcx, r9
test rdi, rdi
cmovne rcx, rdi
cmp rcx, r9
je 0x18003b396
mov rcx, qword [rcx + 0x18]
call fcn.180006c90
test al, al
je 0x18003b396
mov rcx, qword [0x180066590]
call fcn.180006c90
test al, al
jne 0x18003b2bd
mov rcx, rbx
call fcn.180005a60
mov rcx, rax
call fcn.180005660
test al, al
jne 0x18003b396
xor r8d, r8d
mov rdx, qword [0x180064730]
mov rcx, rbx
call fcn.180006000
movaps xmm6, xmm0
mov rcx, qword [0x1800665a8]
call fcn.180006ca0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm6, xmm1
jbe 0x18003b396
mov rcx, qword [0x1800665a0]
call fcn.180006c90
test al, al
je 0x18003b314
xor edx, edx
lea rcx, [0x180066760]
call fcn.180008aa0
test al, al
je 0x18003b396
xor edx, edx
lea rcx, [0x180066700]
call fcn.180008aa0
test al, al
je 0x18003b354
mov rcx, qword [0x1800665b0]
call fcn.180006c90
test al, al
je 0x18003b354
mov rcx, qword [0x1800665b8]
call fcn.180006ca0
test eax, eax
jne 0x18003b354
xor edx, edx
lea rcx, [0x180066700]
call fcn.180007d60
xor edx, edx
lea rcx, [0x180066760]
call fcn.180008aa0
test al, al
je 0x18003b384
mov rcx, qword [0x1800665c0]
call fcn.180006c90
test al, al
je 0x18003b384
xor edx, edx
lea rcx, [0x180066760]
call fcn.180007d60
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1800666a0]
call fcn.180007f80
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret
Function at 0x18003cc60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [0x18006a458]
jmp rax
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1800059f0
test al, al
je 0x18003cce4
xor eax, eax
lea r9, str.kalistaexpungemarker
mov r10d, 0x811c9dc5
inc eax
mov r8d, eax
cmp byte [rax + r9], 0
jne 0x18003cc81
test eax, eax
je 0x18003ccb8
movzx ecx, byte [r9]
lea r9, [r9 + 1]
lea edx, [rcx - 0x41]
cmp dl, 0x19
lea eax, [rcx + 0x20]
cmovbe ecx, eax
movsx eax, cl
xor eax, r10d
imul r10d, eax, 0x1000193
sub r8, 1
jne 0x18003cc91
mov edx, r10d
mov rcx, rbx
call fcn.180005d10
mov rbx, rax
test rax, rax
je 0x18003cce4
mov rcx, rax
call fcn.180009370
test al, al
je 0x18003cce4
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180009390
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180042770
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x180067a10]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x1800679e8]
shl rcx, 4
add rcx, qword [0x1800679f8]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x180042805
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x180042807
cmp rax, rcx
je 0x180042805
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800427f4
jmp 0x180042807
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x18004281d
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90

Function at 0x180048560
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x180068950]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x180068928]
shl rcx, 4
add rcx, qword [0x180068938]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800485f5
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1800485f7
cmp rax, rcx
je 0x1800485f5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800485e4
jmp 0x1800485f7
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x18004860d
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90
Function at 0x180048620
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
call fcn.180005b10
mov r8d, eax
movabs r9, 0x100000001b3
shr eax, 8
movabs rcx, 0xcbf29ce484222325
movzx edx, al
movzx eax, r8b
xor rax, rcx
imul rax, r9
xor rdx, rax
mov eax, r8d
imul rdx, r9
shr eax, 0x10
movzx ecx, al
mov eax, r8d
xor rdx, rcx
shr rax, 0x18
mov rcx, qword [0x180068990]
imul rdx, r9
xor rdx, rax
imul rdx, r9
and rcx, rdx
mov rdx, qword [0x180068968]
shl rcx, 4
add rcx, qword [0x180068978]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800486b5
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1800486b7
cmp rax, rcx
je 0x1800486b5
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1800486a4
jmp 0x1800486b7
xor eax, eax
test rax, rax
mov rcx, rdx
cmovne rcx, rax
cmp rcx, rdx
jne 0x1800486cd
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x18]
add rsp, 0x28
jmp fcn.180006c90
Function at 0x18004bca0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
movsd xmm6, qword [0x18006a4e8]
mov ebx, dword [0x18006a4f0]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
xor edi, edi
mov qword [rsp + 0x50], rdi
mov rcx, qword [0x180068cb0]
call fcn.180006ca0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movsd qword [rsp + 0x30], xmm6
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8b, 1
lea edx, [rdi + 1]
call fcn.180006d70
mov rbx, rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18004bd60
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004bd4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004bd4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180053668
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
test rbx, rbx
je 0x18004be6b
mov rcx, rbx
call fcn.180005b10
mov edx, eax
shr eax, 8
movzx r8d, al
movzx eax, dl
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
xor r8, rax
imul r8, r9
mov eax, edx
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov eax, edx
shr rax, 0x18
xor r8, rax
imul r8, r9
and r8, qword [0x180068ee0]
add r8, r8
mov rcx, qword [0x180068ec8]
mov rax, qword [rcx + r8*8 + 8]
mov r9, qword [0x180068eb8]
cmp rax, r9
je 0x18004bdf7
mov rcx, qword [rcx + r8*8]
cmp edx, dword [rax + 0x10]
je 0x18004bdf4
cmp rax, rcx
je 0x18004bdf7
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18004bde6
mov rdi, rax
mov rcx, r9
test rdi, rdi
cmovne rcx, rdi
cmp rcx, r9
je 0x18004be6b
mov rcx, qword [rcx + 0x18]
call fcn.180006c90
test al, al
je 0x18004be6b
mov rcx, rbx
call fcn.180005b60
movaps xmm6, xmm0
mov rcx, qword [0x180068cb8]
call fcn.180006ca0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm6
jbe 0x18004be6b
mov rcx, rbx
call fcn.180005b60
movaps xmm6, xmm0
mov rcx, qword [0x180068cc0]
call fcn.180006ca0
movd xmm1, eax
cvtdq2ps xmm1, xmm1
comiss xmm6, xmm1
jbe 0x18004be6b
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x180068e50]
call fcn.180007f80
mov rbx, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rdi
ret