joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014d80
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140014d8d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140014d9d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140014d85
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140014db5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140014da2
sub eax, 3
jb 0x140014dcf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140014e06
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140014df6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140014df4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140014de3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140014d42
jmp 0x140014d8d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x8c00
mov dl, 2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140014e52
cmp rsi, rcx
jae 0x140014e5a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140014e39
cmp al, 0x8f
ja 0x140014e39
cmp byte [rsi - 2], 0xf
je 0x140014e3f
sub al, 0xe8
cmp al, 1
ja 0x140014e23
cmp rsi, rcx
jae 0x140014e5a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140014e29
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140014e5a
lodsb al, byte [rsi]
jmp 0x140014e39
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x11000]
mov eax, dword [rdi]
or eax, eax
je 0x140014ec3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x151dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140014e67
jns 0x140014e9c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140014ea6
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140014ebd
mov qword [rbx], rax
add rbx, 8
jmp 0x140014e87
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140014efd
cmp al, 0xef
ja 0x140014eef
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140014ecf
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140014ede
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140014f51
sub rsp, 0xffffffffffffff80
jmp 0x140008a1c
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
push rcx
mov rdx, qword [rdx + 0x20]
push rsi
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
add r8, rdx
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
xor r9, r9
add rsi, rdx
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140003b00
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003b34
cmp word [rcx], 0x5a4d
jne 0x140003b34
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003b34
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003b34
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003a40
test eax, eax
jne 0x140003b50
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003ab0
test rax, rax
je 0x140003b45
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004302
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004664
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1404840f8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1404840f4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400046b2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400046aa
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004799
inc ebx
add rax, 0x28
jmp 0x14000468a
mov rcx, r12
call fcn.140004e91
mov rbp, rax
test rax, rax
jne 0x1400046d1
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004600
movsxd rbx, ebx
mov rax, qword [0x1404840f8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004f3f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1404840f8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004733
mov rax, qword [0x1404840f8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004600
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004793
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004793
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1404840f8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004793
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004600
inc dword [0x1404840f4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140bcb853
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x10]
je 0x140bcb8bc
push rdi
mov edi, 0x39ae5420
lea r8, [0x140bbe548]
mov edi, 0x2d0c639f
movzx edi, byte [rdi + rcx - 0x2d0c639f]
xor edi, r10d
and edi, 0xff
push 0x5404c01b
mov edi, dword [r8 + rdi*4]
shr r10d, 8
xor r10d, edi
neg dword [rsp + 2]
inc rcx
xor r10d, 0xf50ac834
sar word [rsp], 0x81
shl byte [rsp + 3], 0x87
sar dword [rsp], 0x3c
dec rdx
lea rsp, [rsp + 8]
jne 0x140bcb86b
pop rdi
call fcn.140bd7f9e
mov rdx, qword [rdi]
mov r9d, 0xee345eb9
dec r9d
rol r9d, 0xef
mov r9w, word es:[rdx + r9*2 - 0x5eb8ee34]
adc rdi, 6
call fcn.140bbf6c9
jmp 0x140b9e8a9
Function at 0x180004194
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push r14
sub rsp, 0x60
and dword [rax - 0x48], 0
mov rdi, rcx
mov r8d, dword [0x1801a9b20]
mov sil, dl
movaps xmmword [rax - 0x18], xmm6
movss xmm6, dword [0x18015851c]
mov dword [rax - 0x40], 0xff
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801aa5f0], eax
jg 0x180004365
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x18000420b
mov rax, qword [0x1801aa5e0]
mov rdx, qword [0x1801aa5c8]
and rax, rcx
mov r9, qword [0x1801aa5b8]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x18000425c
mov r8, qword [rdx + rax*8]
jmp 0x180004254
cmp rcx, r8
je 0x18000425c
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18000424b
jmp 0x18000425e
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x1800042df
and dword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x30], rdi
call fcn.180004af8
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x180004288
and rbx, qword [0x1801aa5e0]
mov rdx, qword [0x1801aa5c8]
add rbx, rbx
mov rax, qword [0x1801aa5b8]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x1800042d6
mov r8, qword [rdx + rbx*8]
jmp 0x1800042ce
cmp rcx, r8
je 0x1800042d6
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800042c5
jmp 0x1800042d8
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801aa2d0]
lea r8, [rax + 0x18]
mov edx, dword [r8]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x180158600]
test sil, sil
je 0x180004314
cmp edx, 0xff
jge 0x18000432a
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x180004323
test edx, edx
jle 0x18000432a
movd xmm0, edx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si edx, xmm0
mov dword [r8], edx
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
lea rcx, [rsp + 0x20]
mov rsi, qword [r11 + 0x20]
lea rax, [rsp + 0x28]
mov rdi, qword [r11 + 0x28]
test edx, edx
cmovns rcx, r8
cmp edx, 0xff
cmovle rax, rcx
mov eax, dword [rax]
mov dword [r8], eax
mov rsp, r11
pop r14
ret
lea rcx, [0x1801aa5f0]
call fcn.1800660ac
cmp dword [0x1801aa5f0], 0xffffffff
jne 0x1800041f2
mov ecx, 0x20
call fcn.180065fc8
xorps xmm0, xmm0
lea rcx, [0x1801aa5c8]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801aa5c8], 0
mov qword [0x1801aa5b8], rax
movdqa xmmword [0x1801aa5d0], xmm0
mov qword [0x1801aa5e0], 7
mov qword [0x1801aa5e8], 8
mov dword [0x1801aa5b0], 0x3f800000
call fcn.180004774
lea rcx, [0x1800d2134]
call fcn.18006647c
lea rcx, [0x1801aa5f0]
call fcn.180066040
jmp 0x1800041f2
Function at 0x18000449c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
movss dword [rax + 0x20], xmm3
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x70
and dword [rax - 0x68], 0
mov rdi, rcx
mov r8d, dword [0x1801a9b20]
mov sil, dl
movaps xmmword [rax - 0x28], xmm6
movss xmm6, dword [0x18015851c]
movaps xmmword [rax - 0x38], xmm7
movaps xmm7, xmm3
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801aa5f4], eax
jg 0x180004669
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x90]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x180004511
mov rax, qword [0x1801aa5a0]
mov rdx, qword [0x1801aa588]
and rax, rcx
mov r9, qword [0x1801aa578]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x180004565
mov r8, qword [rdx + rax*8]
jmp 0x18000455d
cmp rcx, r8
je 0x180004565
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180004554
jmp 0x180004567
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x1800045eb
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
call fcn.1800048b4
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x90]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x180004591
and rbx, qword [0x1801aa5a0]
mov rdx, qword [0x1801aa588]
add rbx, rbx
mov rax, qword [0x1801aa578]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x1800045e2
mov r8, qword [rdx + rbx*8]
jmp 0x1800045da
cmp rcx, r8
je 0x1800045e2
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x1800045d1
jmp 0x1800045e4
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801aa2d0]
lea rdx, [rax + 0x18]
movss xmm0, dword [rdx]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x18015844c]
test sil, sil
je 0x180004617
comiss xmm0, xmm7
jae 0x180004628
addss xmm0, xmm6
jmp 0x180004624
comiss xmm0, dword [0x1801583fc]
jbe 0x180004628
subss xmm0, xmm6
movss dword [rdx], xmm0
comiss xmm0, dword [0x1801583fc]
mov rbx, qword [rsp + 0x98]
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0xa8]
movaps xmm6, xmmword [rsp + 0x60]
cmovae rcx, rdx
comiss xmm7, xmm0
movaps xmm7, xmmword [rsp + 0x50]
cmovae rax, rcx
movss xmm0, dword [rax]
movss dword [rdx], xmm0
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1801aa5f4]
call fcn.1800660ac
cmp dword [0x1801aa5f4], 0xffffffff
jne 0x1800044f8
mov ecx, 0x20
call fcn.180065fc8
xorps xmm0, xmm0
lea rcx, [0x1801aa588]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801aa588], 0
mov qword [0x1801aa578], rax
movdqa xmmword [0x1801aa590], xmm0
mov qword [0x1801aa5a0], 7
mov qword [0x1801aa5a8], 8
mov dword [0x1801aa570], 0x3f800000
call fcn.180004774
lea rcx, [0x1800d2140]
call fcn.18006647c
lea rcx, [0x1801aa5f4]
call fcn.180066040
jmp 0x1800044f8
Function at 0x1800048b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x1800048e3
mov rax, qword [0x1801aa5a0]
mov rcx, qword [0x1801aa588]
and rax, r15
mov r14, qword [0x1801aa578]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x18000494e
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801aa580], rax
jne 0x18000498d
lea rcx, [0x1801538e0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x180004960
cmp rbx, rdx
je 0x180004983
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180004957
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x18000492d
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x180004ad4
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x180004972
mov ecx, 0x20
call fcn.180065fc8
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x1801aa580]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x1800049be
cvtsi2ss xmm1, rcx
jmp 0x1800049d3
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801aa5a8]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800049e9
cvtsi2ss xmm0, rcx
jmp 0x1800049fe
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801aa570]
comiss xmm0, xmm1
jae 0x180004a6c
call fcn.180004d3c
mov rcx, qword [0x1801aa5a0]
mov rdx, qword [0x1801aa588]
and rcx, r15
mov rbx, qword [0x1801aa578]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x180004a58
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x180004a4f
mov rbx, rax
cmp rax, r8
je 0x180004aaf
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180004a43
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x1801aa580]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801aa580], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1801aa5a0]
mov rcx, qword [0x1801aa588]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801aa578]
jne 0x180004ab6
mov qword [rcx + rax*8], rdi
jmp 0x180004ac8
mov qword [rsp + 0x20], rax
jmp 0x180004a5d
cmp r8, rbp
jne 0x180004ac1
mov qword [rcx + rax*8], rdi
jmp 0x180004acd
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180004acd
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180004af8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
movabs rdx, 0x100000001b3
xor r15, rax
inc rcx
imul r15, rdx
cmp rcx, 8
jb 0x180004b27
mov rax, qword [0x1801aa5e0]
mov rcx, qword [0x1801aa5c8]
and rax, r15
mov r14, qword [0x1801aa5b8]
add rax, rax
mov rbx, qword [rcx + rax*8 + 8]
cmp rbx, r14
jne 0x180004b92
mov rbx, r14
mov rbp, r14
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801aa5c0], rax
jne 0x180004bd1
lea rcx, [0x1801538e0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x180004ba4
cmp rbx, rdx
je 0x180004bc7
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x180004b9b
mov r14, qword [rbx]
mov rax, rbx
mov rbp, r14
mov rbx, r14
test rax, rax
je 0x180004b71
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x180004d18
mov r14, rbx
xor eax, eax
mov rbp, rbx
jmp 0x180004bb6
mov ecx, 0x20
call fcn.180065fc8
movups xmm0, xmmword [r12]
mov rdi, rax
xorps xmm1, xmm1
movdqu xmmword [rax + 0x10], xmm0
mov r8, qword [0x1801aa5c0]
lea rcx, [r8 + 1]
test rcx, rcx
js 0x180004c02
cvtsi2ss xmm1, rcx
jmp 0x180004c17
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x1801aa5e8]
xorps xmm0, xmm0
test rcx, rcx
js 0x180004c2d
cvtsi2ss xmm0, rcx
jmp 0x180004c42
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x1801aa5b0]
comiss xmm0, xmm1
jae 0x180004cb0
call fcn.180004f8c
mov rcx, qword [0x1801aa5e0]
mov rdx, qword [0x1801aa5c8]
and rcx, r15
mov rbx, qword [0x1801aa5b8]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, rbx
je 0x180004c9c
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x180004c93
mov rbx, rax
cmp rax, r8
je 0x180004cf3
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180004c87
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, qword [rsp + 0x20]
mov rbp, rbx
mov r8, qword [0x1801aa5c0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x1801aa5c0], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x1801aa5e0]
mov rcx, qword [0x1801aa5c8]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x1801aa5b8]
jne 0x180004cfa
mov qword [rcx + rax*8], rdi
jmp 0x180004d0c
mov qword [rsp + 0x20], rax
jmp 0x180004ca1
cmp r8, rbp
jne 0x180004d05
mov qword [rcx + rax*8], rdi
jmp 0x180004d11
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180004d11
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180004d3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, qword [0x1801aa580]
mov esi, 1
add rcx, rsi
xorps xmm1, xmm1
js 0x180004d66
cvtsi2ss xmm1, rcx
jmp 0x180004d7b
mov rax, rcx
and rcx, rsi
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x1801aa570]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x180004dae
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x180004dae
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, esi
xor eax, esi
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1801586e4]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180004dd3
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180004dd3
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x1801aa5a8]
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x180004e08
cmp rdx, 0x200
jae 0x180004e05
shl rdx, 3
cmp rdx, rcx
jae 0x180004e08
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov rax, rsi
shl rax, cl
cmp rdx, rax
jbe 0x180004e2f
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1801aa578]
lea rax, [rdx - 1]
or rax, rsi
mov rdi, rsi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801aa588]
lea rdx, [rdi + rdi]
call fcn.180004774
mov rax, qword [0x1801aa578]
lea r9, [rdi - 1]
mov qword [0x1801aa5a0], r9
mov qword [0x1801aa5a8], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x180004f7b
mov rdx, qword [rdx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
movabs r10, 0x100000001b3
xor r11, rcx
add r8, rsi
imul r11, r10
cmp r8, 8
jb 0x180004e94
mov rdi, qword [0x1801aa588]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180004ed2
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180004f41
mov rcx, qword [rdi + r11*8 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rcx + 0x10]
jne 0x180004f16
mov r8, qword [rcx]
cmp r8, rax
je 0x180004ecb
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rcx, qword [r8 + 8]
mov qword [rcx], rax
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], rcx
jmp 0x180004ecb
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
je 0x180004f55
cmp qword [rdi + r11*8], rcx
jne 0x180004f0c
mov r10, qword [rax + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], rax
mov qword [rcx + 8], r9
mov qword [rdx + 8], r10
mov qword [rax + 8], r8
mov qword [rdi + r11*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x180004f7b
mov r9, qword [0x1801aa5a0]
jmp 0x180004e84
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x180004f41
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret