joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800063b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r10, qword [0x18010ead0]
movabs rcx, 0xcbf29ce484222325
mov dword [rsp + 0x10], edx
xor r8d, r8d
mov r9, qword [r10 + 0x178]
movzx eax, byte [rsp + r8 + 0x10]
movabs r11, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r11
cmp r8, 4
jb 0x1800063d7
mov r8, qword [r10 + 0x1a0]
and r8, rcx
mov rcx, qword [r10 + 0x188]
add r8, r8
mov rax, qword [rcx + r8*8 + 8]
cmp rax, r9
je 0x18000642b
mov rcx, qword [rcx + r8*8]
jmp 0x180006424
cmp rax, rcx
je 0x18000642b
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18000641b
jmp 0x18000642d
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
setne al
ret

Function at 0x18000643c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov dword [rbp + 0x7f], 0x79
mov r8, rdx
mov eax, dword [rbp + 0x7f]
mov rsi, rcx
xor al, 0x44
mov byte [rbp + 0x83], al
mov eax, dword [rbp + 0x7f]
inc al
xor al, 0x4c
mov byte [rbp + 0x84], al
mov eax, dword [rbp + 0x7f]
add al, 2
xor al, 0x43
mov byte [rbp + 0x85], al
xor eax, eax
mov byte [rbp + 0x86], al
xor edx, edx
mov al, byte [rbp + 0x83]
mov al, byte [rbp + rdx + 0x83]
mov ecx, dword [rbp + 0x7f]
add cl, dl
xor cl, al
mov byte [rbp + rdx + 0x83], cl
inc rdx
cmp rdx, 3
jb 0x180006498
lea rdx, [rbp + 0x83]
mov byte [rbp + 0x86], 0
mov rcx, r8
call fcn.1800664d4
mov rdi, rax
test rax, rax
je 0x18000654e
xor edx, edx
mov rcx, rax
call fcn.1800663b8
mov r14d, 1
jmp 0x180006546
mov r9d, 0x80
lea r8, [rbp - 0x39]
mov rdx, rbx
mov rcx, rdi
call fcn.180002e48
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_atoi]
lea r8, [rbp + 0x77]
mov dword [rbp + 0x77], eax
lea rdx, [rbp - 0x49]
lea rcx, [rsi + 0x170]
call fcn.180009f78
lea rcx, [rbp - 0x39]
mov rbx, qword [rax]
call qword [sym.imp.msvcrt.dll_strlen]
mov r8, rax
lea rdx, [rbp - 0x39]
lea rcx, [rbx + 0x18]
call fcn.180009098
mov edx, r14d
mov rcx, rdi
call fcn.1800663b8
inc r14d
mov rbx, rax
test rax, rax
jne 0x1800064e6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180006568
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov rdi, rdx
mov rbx, rcx
mov rdx, r9
mov rcx, r8
call fcn.1800664d4
lea rdx, [rbx + 0x10]
mov rcx, rax
mov ebx, 0x100
lea r8, [rsp + 0x30]
mov r9d, ebx
mov rsi, rax
call fcn.180002e48
cmp byte [rsp + 0x30], 0
jne 0x180006656
mov dword [rsp + 0x20], 0x3d
mov ecx, dword [rsp + 0x20]
xor cl, 0x65
mov byte [rsp + 0x24], cl
mov ecx, dword [rsp + 0x20]
inc cl
xor cl, 0x6e
mov byte [rsp + 0x25], cl
mov eax, dword [rsp + 0x20]
add al, 2
xor al, 0x67
mov byte [rsp + 0x26], al
mov eax, dword [rsp + 0x20]
add al, 3
xor al, 0x6c
mov byte [rsp + 0x27], al
mov eax, dword [rsp + 0x20]
add al, 4
xor al, 0x69
mov byte [rsp + 0x28], al
mov eax, dword [rsp + 0x20]
add al, 5
xor al, 0x73
mov byte [rsp + 0x29], al
mov eax, dword [rsp + 0x20]
add al, 6
xor al, 0x68
mov byte [rsp + 0x2a], al
xor eax, eax
mov byte [rsp + 0x2b], al
xor edx, edx
mov al, byte [rsp + 0x24]
mov al, byte [rsp + rdx + 0x24]
mov ecx, dword [rsp + 0x20]
add cl, dl
xor cl, al
mov byte [rsp + rdx + 0x24], cl
inc rdx
cmp rdx, 7
jb 0x180006623
mov r9, rbx
mov byte [rsp + 0x2b], 0
lea r8, [rsp + 0x30]
mov rcx, rsi
lea rdx, [rsp + 0x24]
call fcn.180002e48
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rdi], xmm0
and qword [rdi + 0x10], 0
and qword [rdi + 0x18], 0
call qword [sym.imp.msvcrt.dll_strlen]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8, rax
call fcn.18000a2b4
lea r11, [rsp + 0x130]
mov rax, rdi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x180007d84
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x14
jb 0x180007d8b
mov byte [rcx + 0x18], 0
ret

Function at 0x180007de4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xf
jb 0x180007deb
mov byte [rcx + 0x13], 0
ret

Function at 0x180007e0c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xc
jb 0x180007e13
mov byte [rcx + 0x10], 0
ret

Function at 0x180007e50
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xa
jb 0x180007e57
mov byte [rcx + 0xe], 0
ret

Function at 0x180007e78
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xe
jb 0x180007e7f
mov byte [rcx + 0x12], 0
ret

Function at 0x180007ebc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007ec9
mov byte [rcx + 0xe], r10b
ret

Function at 0x180007f00
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 8
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007f0d
mov byte [rcx + 0xc], r10b
ret

Function at 0x180007f28
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x10
jb 0x180007f2f
mov byte [rcx + 0x14], 0
ret

Function at 0x180007f50
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x12
jb 0x180007f57
mov byte [rcx + 0x16], 0
ret

Function at 0x180007f78
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xf
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007f85
mov byte [rcx + 0x13], r10b
ret

Function at 0x180007fa0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x17
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007fad
mov byte [rcx + 0x1b], r10b
ret

Function at 0x180007fc8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x10
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007fd5
mov byte [rcx + 0x14], r10b
ret
Function at 0x180007ff0
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x18
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007ffd
mov byte [rcx + 0x1c], r10b
ret

Function at 0x180008018
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xe
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180008025
mov byte [rcx + 0x12], r10b
ret

Function at 0x180008094
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800080a1
mov byte [rcx + 0xf], r10b
ret

Function at 0x1800080bc
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 9
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800080c9
mov byte [rcx + 0xd], r10b
ret

Function at 0x1800080e4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xb
jb 0x1800080eb
mov byte [rcx + 0xf], 0
ret

Function at 0x180008144
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xd
jb 0x18000814b
mov byte [rcx + 0x11], 0
ret

Function at 0x18000816c
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 9
jb 0x180008173
mov byte [rcx + 0xd], 0
ret

Function at 0x180008194
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800081a1
mov byte [rcx + 0xb], r10b
ret

Function at 0x1800081d8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 7
jb 0x1800081df
mov byte [rcx + 0xb], 0
ret

Function at 0x18000821c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 6
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180008229
mov byte [rcx + 0xa], r10b
ret
Function at 0x180009f78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
mov r15, rcx
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
xor rdi, rax
movabs rdx, 0x100000001b3
imul rdi, rdx
inc rcx
cmp rcx, 4
jb 0x180009fa9
mov rax, qword [r15 + 0x30]
and rax, rdi
add rax, rax
mov rcx, qword [r15 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r15 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x18000a051
mov rbx, rbp
movabs rax, 0x492492492492492
cmp qword [r15 + 0x10], rax
je 0x18000a19c
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.1800903f0
mov rsi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x18], xmm0
xor r12d, r12d
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], 0xf
mov byte [rax + 0x18], r12b
mov rcx, qword [r15 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18000a08e
cvtsi2ss xmm0, rcx
jmp 0x18000a0a3
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x18000a063
cmp rbx, rdx
je 0x18000a087
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18000a05a
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x180009feb
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x18000a17c
mov rbp, rbx
xor eax, eax
jmp 0x18000a071
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r15 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18000a0b6
cvtsi2ss xmm1, rcx
jmp 0x18000a0cb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r15]
seta al
test al, al
je 0x18000a125
mov rcx, r15
call fcn.18000ab5c
mov rcx, rdi
and rcx, qword [r15 + 0x30]
add rcx, rcx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x18000a11b
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rsi + 0x10]
jmp 0x18000a113
mov rbx, rax
cmp rax, r8
je 0x18000a156
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18000a107
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [r15 + 0x10]
mov qword [rsi], rbp
mov qword [rsi + 8], rcx
mov qword [rcx], rsi
mov qword [rbx + 8], rsi
mov rax, qword [r15 + 0x18]
and rdi, qword [r15 + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r13]
jne 0x18000a15d
mov qword [rax + rdi*8], rsi
jmp 0x18000a16f
mov qword [rsp + 0x20], rax
jmp 0x18000a120
cmp rdx, rbp
jne 0x18000a168
mov qword [rax + rdi*8], rsi
jmp 0x18000a174
cmp qword [rax + rdi*8 + 8], rcx
jne 0x18000a174
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18008e4e8
int3
Function at 0x18000a894
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18000a8c4
cvtsi2ss xmm0, rdx
jmp 0x18000a8d9
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call qword [sym.imp.msvcrt.dll_ceilf]
movss xmm1, dword [0x1800ce950]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000a908
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000a908
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000a936
cmp rbx, 0x200
jae 0x18000a933
shl rbx, 3
cmp rbx, rcx
jae 0x18000a936
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18000aaa0
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180008f74
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000aa64
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r9, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r9
cmp r8, 4
jb 0x18000a9ae
and r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18000a9ea
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18000aa58
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18000aa2d
mov r10, qword [r10]
cmp r10, rax
je 0x18000a9e3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000a9e3
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18000aa7a
cmp qword [rdi + r11*8], r10
jne 0x18000aa23
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18000a99e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000aa58
lea rcx, str.invalid_hash_bucket_count
call fcn.18008e4e8
int3
Function at 0x18000ab5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18000ab8c
cvtsi2ss xmm0, rdx
jmp 0x18000aba1
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call qword [sym.imp.msvcrt.dll_ceilf]
movss xmm1, dword [0x1800ce950]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000abd0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000abd0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000abfe
cmp rbx, 0x200
jae 0x18000abfb
shl rbx, 3
cmp rbx, rcx
jae 0x18000abfe
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18000ad6b
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180008f74
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000ad2f
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x18000ac76
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18000acb5
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18000ad23
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18000acf8
mov r10, qword [r10]
cmp r10, rax
je 0x18000acae
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000acae
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18000ad45
cmp qword [rdi + r11*8], r10
jne 0x18000acee
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18000ac66
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000ad23
lea rcx, str.invalid_hash_bucket_count
call fcn.18008e4e8
int3
Function at 0x18000cba4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, qword [0x18010ead8]
xor eax, eax
mov dword [rbp - 0x30], 0x1f
xor edx, edx
mov byte [rbp - 0x2c], 0x5c
mov byte [rbp - 0x2b], WSASetLastError
mov byte [rbp - 0x2a], 0x7a
mov byte [rbp - 0x29], 0x7e
mov byte [rbp - 0x28], 0x6b
mov byte [rbp - 0x27], 0x7a
mov byte [rbp - 0x26], 0x4f
mov byte [rbp - 0x25], WSASetLastError
mov byte [rbp - 0x24], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x23], 0x7c
mov byte [rbp - 0x22], 0x7a
mov byte [rbp - 0x21], 0x6c
mov byte [rbp - 0x20], 0x6c
mov byte [rbp - 0x1f], 0x5e
mov byte [rbp - 0x1e], al
mov al, byte [rbp - 0x2c]
mov al, byte [rbp + rdx - 0x2c]
mov ecx, dword [rbp - 0x30]
xor cl, al
mov byte [rbp + rdx - 0x2c], cl
inc rdx
cmp rdx, 0xe
jb 0x18000cc04
mov byte [rbp - 0x1e], 0
xor eax, eax
mov dword [rbp - 0x50], 0x3a
xor edx, edx
mov byte [rbp - 0x4c], 0x51
mov byte [rbp - 0x4b], 0x5f
mov byte [rbp - 0x4a], 0x48
mov byte [rbp - 0x49], 0x54
mov byte [rbp - 0x48], 0x5f
mov byte [rbp - 0x47], 0x56
mov byte [rbp - 0x46], 9
mov byte [rbp - 0x45], 8
mov byte [rbp - 0x44], al
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 8
jb 0x18000cc4f
lea r8, [rbp - 0x2c]
mov byte [rbp - 0x44], 0
lea rdx, [rbp - 0x4c]
mov rcx, rbx
call fcn.18007a380
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 0xa
lea r8, [0x18000c930]
mov rcx, rbx
call fcn.180073a20
mov dword [rbp - 0x1c], 0x5a
xor eax, eax
mov byte [rbp - 0x18], 0x19
xor edx, edx
mov byte [rbp - 0x17], 0x28
mov byte [rbp - 0x16], 0x3f
mov byte [rbp - 0x15], 0x3b
mov byte [rbp - 0x14], 0x2e
mov byte [rbp - 0x13], 0x3f
mov byte [rbp - 0x12], 0xa
mov byte [rbp - 0x11], 0x28
mov byte [rbp - 0x10], 0x35
mov byte [rbp - 0xf], 0x39
mov byte [rbp - 0xe], 0x3f
mov byte [rbp - 0xd], 0x29
mov byte [rbp - 0xc], 0x29
mov byte [rbp - 0xb], 0xd
mov byte [rbp - 0xa], al
mov al, byte [rbp - 0x18]
mov al, byte [rbp + rdx - 0x18]
mov ecx, dword [rbp - 0x1c]
xor cl, al
mov byte [rbp + rdx - 0x18], cl
inc rdx
cmp rdx, 0xe
jb 0x18000ccdf
mov byte [rbp - 0xa], 0
xor eax, eax
mov dword [rbp - 0x40], 0x3e
xor edx, edx
mov byte [rbp - 0x3c], 0x55
mov byte [rbp - 0x3b], 0x5b
mov byte [rbp - 0x3a], 0x4c
mov byte [rbp - 0x39], 0x50
mov byte [rbp - 0x38], 0x5b
mov byte [rbp - 0x37], 0x52
mov byte [rbp - 0x36], 0xd
mov byte [rbp - 0x35], 0xc
mov byte [rbp - 0x34], al
mov al, byte [rbp - 0x3c]
mov al, byte [rbp + rdx - 0x3c]
mov ecx, dword [rbp - 0x40]
xor cl, al
mov byte [rbp + rdx - 0x3c], cl
inc rdx
cmp rdx, 8
jb 0x18000cd2a
lea r8, [rbp - 0x18]
mov byte [rbp - 0x34], 0
lea rdx, [rbp - 0x3c]
mov rcx, rbx
call fcn.18007a380
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 0xa
lea r8, [0x18000c9d4]
mov rcx, rbx
call fcn.180073a20
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x18000cd84
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rbx, qword [0x18010ead8]
mov dword [rbp - 0x10], 0x34
mov eax, dword [rbp - 0x10]
xor al, 0x74
mov byte [rbp - 0xc], al
mov eax, dword [rbp - 0x10]
inc al
xor al, 0x65
mov byte [rbp - 0xb], al
mov eax, dword [rbp - 0x10]
add al, 2
xor al, 0x6e
mov byte [rbp - 0xa], al
mov eax, dword [rbp - 0x10]
add al, 3
xor al, 0x6f
mov byte [rbp - 9], al
mov eax, dword [rbp - 0x10]
add al, 4
xor al, 0x6b
mov byte [rbp - 8], al
mov eax, dword [rbp - 0x10]
add al, 5
xor al, 0x65
mov byte [rbp - 7], al
mov eax, dword [rbp - 0x10]
add al, 6
xor al, 0x2e
mov byte [rbp - 6], al
mov eax, dword [rbp - 0x10]
add al, 7
xor al, 0x64
mov byte [rbp - 5], al
mov eax, dword [rbp - 0x10]
add al, 8
xor al, 0x6c
mov byte [rbp - 4], al
mov eax, dword [rbp - 0x10]
add al, 9
xor al, 0x6c
mov byte [rbp - 3], al
xor eax, eax
mov byte [rbp - 2], al
xor edx, edx
mov al, byte [rbp - 0xc]
mov al, byte [rbp + rdx - 0xc]
mov ecx, dword [rbp - 0x10]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0xc], cl
inc rdx
cmp rdx, 0xa
jb 0x18000ce0b
lea rcx, [rbp - 0xc]
mov byte [rbp - 2], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0xa8], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rbp
ret