joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ca40
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
inc dword [rax + 0x2c8]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rcx, qword [rax + 0x30]
lea rdx, [rcx + 0x138]
test byte [rdx], al
mov rdx, rax
mov qword [rcx + 0x138], rax
lea rax, [rdx + 0xe0]
test byte [rax], al
mov rax, qword [rdx + 0x30]
mov qword [rdx + 0xe0], rax
mov dword [rsp], 0
lea rax, fcn.0042fc60
mov qword [rsp + 8], rax
call dbg.runtime.deferproc
test eax, eax
jne 0x43cb72
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x358]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x358], rdx
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x360], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x368], rdx
mov rdx, qword [0x004dac60]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call dbg.runtime.cgocall
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x370]
mov rdx, qword [rax + 0x378]
mov rax, qword [rax + 0x380]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rax
nop
call dbg.runtime.deferreturn
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
nop
call dbg.runtime.deferreturn
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x441cf0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x441dd0
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x18], xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
lea rcx, [0x00447dd0]
mov qword [rsp + 0x10], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x18], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call dbg.runtime.systemstack
mov rax, qword [rsp + 8]
mov qword [rsp + 0x88], rax
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
call dbg.runtime.morestack_noctxt
jmp dbg.runtime.callers
Function at 0x141c9ed80
Capabilities:
Decompress data using aplib

Disassembly:
call 0x141c9ef07
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141c9edb1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c9ed97
add dl, dl
jne 0x141c9edbe
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c9ee1e
xor eax, eax
add dl, dl
jne 0x141c9edcd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141c9eed5
add dl, dl
jne 0x141c9edde
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c9edeb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c9edf8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c9ee05
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141c9ee12
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141c9eda6
mov eax, 1
add dl, dl
jne 0x141c9ee2e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141c9ee3b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c9ee23
sub eax, ebx
mov ebx, 1
jne 0x141c9ee74
mov ecx, 1
add dl, dl
jne 0x141c9ee56
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c9ee63
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c9ee4b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c9eda6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141c9ee90
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141c9ee9d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141c9ee85
cmp eax, 0x7d00
jae 0x141c9eec3
cmp eax, 0x500
jb 0x141c9eebe
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c9eda6
cmp eax, 0x7f
ja 0x141c9eec6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141c9eda6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141c9eefa
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141c9eda6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Encode data using xor
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x2c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.VirtualAlloc
mov dword [rsp + 0x30], 0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlMoveMemory
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualProtect
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CreateThread
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WaitForSingleObject
mov rcx, rbx
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
mov r8d, 4
mov r15, rax
lea rcx, [0x1400022c0]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub r8, 1
jne 0x1400010c0
movups xmm0, xmmword [rcx]
mov eax, dword [rcx + 0x50]
lea r9d, [r8 + 4]
movups xmm1, xmmword [rcx + 0x10]
mov r8d, 0x3000
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rcx + 0x40]
xor ecx, ecx
movups xmmword [rdx + 0x30], xmm1
movups xmmword [rdx + 0x40], xmm0
mov dword [rdx + 0x50], eax
mov edx, 0x254
call rdi
mov ecx, dword [0x140002520]
lea r9, [rsp + 0x50]
movsd xmm0, qword [str.MosseInstitute]
xor r8d, r8d
mov dword [rsp + 0x40], ecx
xor r10d, r10d
movzx ecx, word [0x140002524]
mov rbx, rax
mov word [rsp + 0x44], cx
xor eax, eax
movzx ecx, byte [0x140002526]
mov byte [rsp + 0x46], cl
movsd qword [rsp + 0x38], xmm0
xor ecx, ecx
lea r9, [r9 + 1]
cmp r8d, 0xe
cmovne rcx, rax
movzx eax, byte [rsp + rcx + 0x38]
xor byte [r9 - 1], al
xor eax, eax
cmp r8d, 0xe
cmovne eax, r8d
inc r10d
lea r8d, [rax + 1]
lea rax, [rcx + 1]
cmp r10d, 0x253
jb 0x140001191
mov r8d, 0x254
lea rdx, [rsp + 0x50]
mov rcx, rbx
call rsi
lea r9, [rsp + 0x30]
mov edx, 0x254
mov r8d, 0x20
mov rcx, rbx
call rbp
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call r14
mov edx, 0xffffffff
mov rcx, rax
call r15
xor eax, eax
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140001260
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180003474
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r8d, dword [0x1801a8584]
mov rdi, rcx
movaps xmmword [rax - 0x28], xmm6
xor ebp, ebp
mov rax, qword gs:[0x58]
mov sil, dl
movss xmm6, dword [0x18015743c]
mov ecx, 4
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1801a9060], eax
jg 0x180003619
movabs rbx, 0xcbf29ce484222325
mov rdx, rbp
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x1800034e2
and rcx, qword [0x1801a9050]
mov r8, qword [0x1801a9038]
add rcx, rcx
mov rdx, qword [0x1801a9028]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x180003533
mov r9, qword [r8 + rcx*8]
jmp 0x180003528
cmp rax, r9
je 0x180003533
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x18000351f
test rax, rax
jne 0x180003536
mov rax, rdx
cmp rax, rdx
jne 0x1800035aa
lea r8, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], ebp
call fcn.180003d88
mov rcx, rbp
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x180003556
and rbx, qword [0x1801a9050]
mov rcx, qword [0x1801a9038]
add rbx, rbx
mov rdx, qword [0x1801a9028]
mov rax, qword [rcx + rbx*8 + 8]
cmp rax, rdx
je 0x1800035a7
mov r8, qword [rcx + rbx*8]
jmp 0x18000359c
cmp rax, r8
je 0x1800035a7
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x180003593
test rax, rax
jne 0x1800035aa
mov rax, rdx
mov rcx, qword [0x1801a8b88]
mov edx, 0xff
subss xmm6, dword [rcx + 0x18]
mov ecx, dword [rax + 0x18]
mulss xmm6, dword [0x180157538]
test sil, sil
je 0x1800035dc
cmp ecx, edx
jge 0x1800035f1
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x1800035eb
test ecx, ecx
jle 0x1800035ef
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si ecx, xmm0
cmp ecx, edx
jg 0x1800035fa
test ecx, ecx
mov edx, ecx
cmovs edx, ebp
movaps xmm6, xmmword [rsp + 0x40]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov dword [rax + 0x18], edx
mov eax, edx
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, [0x1801a9060]
call fcn.180065450
cmp dword [0x1801a9060], 0xffffffff
jne 0x1800034c8
mov ecx, 0x20
call fcn.180065280
xorps xmm0, xmm0
lea rcx, [0x1801a9038]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x1801a9028], rax
mov qword [0x1801a9038], rbp
movdqa xmmword [0x1801a9040], xmm0
mov qword [0x1801a9050], 7
mov qword [0x1801a9058], 8
mov dword [0x1801a9020], 0x3f800000
call fcn.180003a0c
lea rcx, [0x1800d15b8]
call fcn.1800658c8
lea rcx, [0x1801a9060]
call fcn.1800653f0
jmp 0x1800034c8
Function at 0x18000374c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x60
mov r8d, dword [0x1801a8584]
mov rdi, rcx
movaps xmmword [rax - 0x18], xmm6
mov sil, dl
movaps xmmword [rax - 0x28], xmm8
movaps xmm6, xmm3
mov rax, qword gs:[0x58]
movss xmm8, dword [0x18015743c]
mov ecx, 4
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1801a9064], eax
jg 0x180003901
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x1800037c1
and rcx, qword [0x1801a9010]
mov r8, qword [0x1801a8ff8]
add rcx, rcx
mov rdx, qword [0x1801a8fe8]
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, rdx
je 0x180003812
mov r9, qword [r8 + rcx*8]
jmp 0x180003807
cmp rax, r9
je 0x180003812
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x1800037fe
test rax, rax
jne 0x180003815
mov rax, rdx
cmp rax, rdx
jne 0x180003889
and dword [rsp + 0x28], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call fcn.180003b44
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x180003835
and rbx, qword [0x1801a9010]
mov rcx, qword [0x1801a8ff8]
add rbx, rbx
mov rdx, qword [0x1801a8fe8]
mov rax, qword [rcx + rbx*8 + 8]
cmp rax, rdx
je 0x180003886
mov r8, qword [rcx + rbx*8]
jmp 0x18000387b
cmp rax, r8
je 0x180003886
mov rax, qword [rax + 8]
cmp rdi, qword [rax + 0x10]
jne 0x180003872
test rax, rax
jne 0x180003889
mov rax, rdx
mov rcx, qword [0x1801a8b88]
movss xmm0, dword [rax + 0x18]
subss xmm8, dword [rcx + 0x18]
mulss xmm8, dword [0x180157364]
test sil, sil
je 0x1800038b5
comiss xmm0, xmm6
jae 0x1800038c3
addss xmm0, xmm8
jmp 0x1800038c3
comiss xmm0, dword [0x180157310]
jbe 0x1800038c3
subss xmm0, xmm8
comiss xmm6, xmm0
jb 0x1800038d9
comiss xmm0, dword [0x180157310]
jae 0x1800038d6
xorps xmm6, xmm6
jmp 0x1800038d9
movaps xmm6, xmm0
lea r11, [rsp + 0x60]
movss dword [rax + 0x18], xmm6
mov rbx, qword [r11 + 0x18]
movaps xmm0, xmm6
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm8, xmmword [r11 - 0x20]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop rdi
ret
lea rcx, [0x1801a9064]
call fcn.180065450
cmp dword [0x1801a9064], 0xffffffff
jne 0x1800037a8
mov ecx, 0x20
call fcn.180065280
xorps xmm0, xmm0
lea rcx, [0x1801a8ff8]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801a8ff8], 0
mov qword [0x1801a8fe8], rax
movdqa xmmword [0x1801a9000], xmm0
mov qword [0x1801a9010], 7
mov qword [0x1801a9018], 8
mov dword [0x1801a8fe0], 0x3f800000
call fcn.180003a0c
lea rcx, [0x1800d15c4]
call fcn.1800658c8
lea rcx, [0x1801a9064]
call fcn.1800653f0
jmp 0x1800037a8
Function at 0x180003b44
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor rbp, rax
inc rcx
imul rbp, rdx
cmp rcx, 8
jb 0x180003b6f
mov rcx, qword [0x1801a9010]
mov rdx, qword [0x1801a8ff8]
and rcx, rbp
mov rsi, qword [0x1801a8fe8]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rsi
je 0x180003be6
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x180003bc5
cmp rax, r8
je 0x180003bdf
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180003bbc
mov rsi, qword [rax]
test rax, rax
je 0x180003be6
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x180003d67
mov rsi, rax
xor eax, eax
jmp 0x180003bce
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801a8ff0], rax
jne 0x180003c07
lea rcx, [0x180152930]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov ecx, 0x20
call fcn.180065280
movups xmm0, xmmword [r14]
mov rbx, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1801a8ff0]
lea rcx, [rdx + 1]
test rcx, rcx
js 0x180003c37
cvtsi2ss xmm1, rcx
jmp 0x180003c4c
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801a9018]
xorps xmm0, xmm0
test rcx, rcx
js 0x180003c62
cvtsi2ss xmm0, rcx
jmp 0x180003c77
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801a8fe0]
comiss xmm0, xmm1
jae 0x180003cfc
call fcn.180003fcc
mov rax, qword [0x1801a9010]
mov r8, qword [0x1801a8ff8]
and rax, rbp
mov rdx, qword [0x1801a8fe8]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x180003cbf
mov qword [rsp + 0x20], rdx
and qword [rsp + 0x28], 0
jmp 0x180003ce5
mov rdx, qword [r8 + rax*8]
mov rax, qword [rbx + 0x10]
jmp 0x180003cd2
cmp rcx, rdx
je 0x180003d3f
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180003cc9
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov rdx, qword [0x1801a8ff0]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x1801a8ff0], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x1801a9010]
mov rcx, qword [0x1801a8ff8]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1801a8fe8]
jne 0x180003d49
mov qword [rcx + rax*8], rbx
jmp 0x180003d5b
mov qword [rsp + 0x20], rcx
jmp 0x180003cb7
cmp rdx, rsi
jne 0x180003d54
mov qword [rcx + rax*8], rbx
jmp 0x180003d60
cmp qword [rcx + rax*8 + 8], r8
jne 0x180003d60
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180003d88
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
movabs rbp, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor rbp, rax
inc rcx
imul rbp, rdx
cmp rcx, 8
jb 0x180003db3
mov rcx, qword [0x1801a9050]
mov rdx, qword [0x1801a9038]
and rcx, rbp
mov rsi, qword [0x1801a9028]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rsi
je 0x180003e2a
mov r8, qword [rdx + rcx*8]
mov rcx, qword [r14]
jmp 0x180003e09
cmp rax, r8
je 0x180003e23
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180003e00
mov rsi, qword [rax]
test rax, rax
je 0x180003e2a
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x180003fab
mov rsi, rax
xor eax, eax
jmp 0x180003e12
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801a9030], rax
jne 0x180003e4b
lea rcx, [0x180152930]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov ecx, 0x20
call fcn.180065280
movups xmm0, xmmword [r14]
mov rbx, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1801a9030]
lea rcx, [rdx + 1]
test rcx, rcx
js 0x180003e7b
cvtsi2ss xmm1, rcx
jmp 0x180003e90
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801a9058]
xorps xmm0, xmm0
test rcx, rcx
js 0x180003ea6
cvtsi2ss xmm0, rcx
jmp 0x180003ebb
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801a9020]
comiss xmm0, xmm1
jae 0x180003f40
call fcn.18000421c
mov rax, qword [0x1801a9050]
mov r8, qword [0x1801a9038]
and rax, rbp
mov rdx, qword [0x1801a9028]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
jne 0x180003f03
mov qword [rsp + 0x20], rdx
and qword [rsp + 0x28], 0
jmp 0x180003f29
mov rdx, qword [r8 + rax*8]
mov rax, qword [rbx + 0x10]
jmp 0x180003f16
cmp rcx, rdx
je 0x180003f83
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180003f0d
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
mov rdx, qword [0x1801a9030]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x1801a9030], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rax, qword [0x1801a9050]
mov rcx, qword [0x1801a9038]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1801a9028]
jne 0x180003f8d
mov qword [rcx + rax*8], rbx
jmp 0x180003f9f
mov qword [rsp + 0x20], rcx
jmp 0x180003efb
cmp rdx, rsi
jne 0x180003f98
mov qword [rcx + rax*8], rbx
jmp 0x180003fa4
cmp qword [rcx + rax*8 + 8], r8
jne 0x180003fa4
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x180003fcc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1801a8ff0]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x180003ff6
cvtsi2ss xmm1, rcx
jmp 0x18000400b
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x1801a8fe0]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x18000403e
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x18000403e
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x180157644]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180004063
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180004063
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1801a9018]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x180004098
cmp rdx, 0x200
jae 0x180004095
shl rdx, 3
cmp rdx, rcx
jae 0x180004098
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x1800040bf
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1801a8fe8]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801a8ff8]
lea rdx, [rdi + rdi]
call fcn.180003a0c
mov rax, qword [0x1801a8fe8]
lea r9, [rdi - 1]
mov qword [0x1801a9010], r9
mov qword [0x1801a9018], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x18000420b
mov rdx, qword [rdx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rcx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x180004124
mov rdi, qword [0x1801a8ff8]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180004162
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x1800041d1
mov rcx, qword [rdi + r11*8 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rcx + 0x10]
jne 0x1800041a6
mov r8, qword [rcx]
cmp r8, rax
je 0x18000415b
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rcx, qword [r8 + 8]
mov qword [rcx], rax
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], rcx
jmp 0x18000415b
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
je 0x1800041e5
cmp qword [rdi + r11*8], rcx
jne 0x18000419c
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rax
mov qword [rcx + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], r8
mov qword [rdi + r11*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x18000420b
mov r9, qword [0x1801a9010]
jmp 0x180004114
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x1800041d1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret