joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c9b0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002c9bd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002c9cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002c9b5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002c9e5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002c9d2
sub eax, 3
jb 0x14002c9ff
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002ca36
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002ca26
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002ca24
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002ca13
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002c972
jmp 0x14002c9bd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x18600
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002ca86
cmp rsi, rcx
jae 0x14002ca8e
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002ca6d
cmp al, 0x8f
ja 0x14002ca6d
cmp byte [rsi - 2], 0xf
je 0x14002ca73
sub al, 0xe8
cmp al, 1
ja 0x14002ca57
cmp rsi, rcx
jae 0x14002ca8e
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002ca5d
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002ca8e
lodsb al, byte [rsi]
jmp 0x14002ca6d
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2a000]
mov eax, dword [rdi]
or eax, eax
je 0x14002caeb
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2c594]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002ca9b
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002cae5
mov qword [rbx], rax
add rbx, 8
jmp 0x14002cabb
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002cb25
cmp al, 0xef
ja 0x14002cb17
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002caf7
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002cb06
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x21f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002cb79
sub rsp, 0xffffffffffffff80
jmp 0x140014050
Function at 0x141aa2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141aa21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141aa2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141aa206f
add dl, dl
jne 0x141aa2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141aa20f6
xor eax, eax
add dl, dl
jne 0x141aa20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141aa21ad
add dl, dl
jne 0x141aa20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141aa20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141aa20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141aa20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141aa20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141aa207e
mov eax, 1
add dl, dl
jne 0x141aa2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141aa2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141aa20fb
sub eax, ebx
mov ebx, 1
jne 0x141aa214c
mov ecx, 1
add dl, dl
jne 0x141aa212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141aa213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141aa2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141aa207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141aa2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141aa2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141aa215d
cmp eax, 0x7d00
jae 0x141aa219b
cmp eax, 0x500
jb 0x141aa2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141aa207e
cmp eax, 0x7f
ja 0x141aa219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141aa207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141aa21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141aa207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x1400150f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012c40
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012c53
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012c7d
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012c91
xor al, al
jmp 0x140012cc1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012ca3
xor al, al
jmp 0x140012cc1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012cbf
xor al, al
jmp 0x140012cc1
mov al, 1
add rsp, 0x38
ret

Function at 0x140011a20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001137f
movzx eax, al
test eax, eax
jne 0x140011a40
mov ecx, 7
call fcn.1400112fd
nop
mov byte [rsp + 0x20], 0
call fcn.140011311
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011a64
mov ecx, 7
call fcn.1400112fd
nop
jmp 0x140011abc
cmp dword [0x14001c220], 0
jne 0x140011ab7
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.140011195
test eax, eax
je 0x140011a98
mov eax, 0xff
jmp 0x140011bc1
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.140011307
mov dword [0x14001c220], 2
jmp 0x140011abc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400112ee
call fcn.14001128a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011b19
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011b19
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140022020]
nop
call fcn.1400112bc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011b4d
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011b4d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001133e
nop
call fcn.140011c70
mov dword [rsp + 0x28], eax
call fcn.140011267
movzx eax, al
test eax, eax
jne 0x140011b6c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011b7b
call fcn.140011348
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x140011bc1
add rsp, 0x68
ret
Function at 0x140ca9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ca91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ca9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ca906f
add dl, dl
jne 0x140ca9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ca90f6
xor eax, eax
add dl, dl
jne 0x140ca90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ca91ad
add dl, dl
jne 0x140ca90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ca90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ca90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ca90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ca90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ca907e
mov eax, 1
add dl, dl
jne 0x140ca9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ca9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ca90fb
sub eax, ebx
mov ebx, 1
jne 0x140ca914c
mov ecx, 1
add dl, dl
jne 0x140ca912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ca913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ca9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ca907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ca9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ca9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ca915d
cmp eax, 0x7d00
jae 0x140ca919b
cmp eax, 0x500
jb 0x140ca9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ca907e
cmp eax, 0x7f
ja 0x140ca919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ca907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ca91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ca907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18001b030
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov esi, ecx
mov ecx, dword [0x1800b7e60]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
lea rbp, [0x1800b9030]
mov eax, dword [rdx + rax]
cmp dword [0x1800b9020], eax
jle 0x18001b0e7
lea rcx, [0x1800b9020]
call fcn.180058ae0
cmp dword [0x1800b9020], 0xffffffff
jne 0x18001b0e7
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [0x1800ba3b4], 0xffffffff
mov dword [0x1800b9034], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbp + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x18001b0b0
mov dword [0x1800b9030], 0x270
lea rcx, [0x1800b9020]
call fcn.180058a74
btc esi, 0x1f
btc ebx, 0x1f
sub ebx, esi
mov rcx, rbp
cmp ebx, 0xffffffff
jne 0x18001b102
call fcn.18001b460
mov ecx, eax
jmp 0x18001b139
inc ebx
call fcn.18001b460
mov edi, ebx
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jae 0x18001b135
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x18001b135
mov rcx, rbp
call fcn.18001b460
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x18001b123
shr rcx, 0x20
lea eax, [rcx + rsi]
xor eax, 0x80000000
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18001b460
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x18001b4c1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18001b480
mov ecx, dword [r9]
jmp 0x18001b5ab
cmp ecx, 0x4e0
jb 0x18001b5ab
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18001b4e0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x18001b530
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x18001d400
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movzx r8d, dl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rax, rdx
shr rax, 8
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x28
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x30
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdx
shr rax, 0x38
xor r8, rax
imul r8, r9
mov rcx, qword [rbx + 0x420]
and rcx, r8
shl rcx, 4
add rcx, qword [rbx + 0x408]
mov rax, qword [rcx + 8]
cmp rax, qword [rbx + 0x3f8]
je 0x18001d4cc
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x18001d4ce
cmp rax, rcx
jne 0x18001d509
xor eax, eax
test rax, rax
jne 0x18001d4da
mov rax, qword [rbx + 0x3f8]
cmp rax, qword [rbx + 0x3f8]
je 0x18001d503
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x18001d503
mov rcx, rbx
call rdx
mov rax, qword [0x1800b6f58]
mov rdx, qword [rax + 0x30]
mov rcx, rbx
call rdx
jmp 0x18001d503
add rsp, 0x20
pop rbx
ret
mov rax, qword [rax + 8]
jmp 0x18001d4c1
Function at 0x18001d9a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18001d9d5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001d510
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18001db44
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001dabc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001db33
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18001daf9
mov r10, qword [rdx]
cmp r10, rax
je 0x18001daf3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001db33
cmp r9, rdx
je 0x18001db0f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18001db55
cmp r9, rdx
jne 0x18001db00
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18001da40
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001db33
Function at 0x18001e6b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx + 8], 0
je 0x18001e721
mov rdi, qword [rcx + 0x60]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x18001e721
nop word [rax + rax]
movups xmm0, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [0x1800b6f58]
mov r8, qword [rax + 0x28]
mov rax, qword [0x1800b6f50]
movq rdx, xmm0
mov rcx, qword [rax + 0x30]
call r8
movups xmm0, xmmword [rsp + 0x20]
psrldq xmm0, 8
movq rcx, xmm0
mov qword [rcx], rax
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x18001e6e0
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x18001e86c
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rcx], rax
mov r8, qword [rsi + 8]
test r8, r8
je 0x18001e86c
mov rax, r8
shr rax, 8
movzx edx, al
movzx eax, r8b
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
xor rdx, rax
imul rdx, r9
mov rax, r8
shr rax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x18
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x20
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x28
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x30
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov rax, r8
shr rax, 0x38
xor rdx, rax
imul r9, rdx
and r9, qword [0x1800b7030]
shl r9, 4
add r9, qword [0x1800b7018]
mov r10, qword [r9 + 8]
mov rcx, r10
mov rdx, qword [0x1800b7008]
cmp r10, rdx
je 0x18001e817
mov rax, qword [r9]
cmp r8, qword [r10 + 0x10]
je 0x18001e819
cmp rcx, rax
je 0x18001e817
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x18001e806
jmp 0x18001e819
xor ecx, ecx
test rcx, rcx
je 0x18001e86c
mov rax, qword [r9]
cmp r10, rcx
jne 0x18001e83e
cmp rax, rcx
jne 0x18001e834
mov qword [r9], rdx
mov qword [r9 + 8], rdx
jmp 0x18001e849
mov rdx, qword [rcx + 8]
mov qword [r9 + 8], rdx
jmp 0x18001e849
cmp rax, rcx
jne 0x18001e849
mov rax, qword [rcx]
mov qword [r9], rax
mov rdx, qword [rcx]
dec qword [0x1800b7010]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1800589c8
lea rcx, [rsi + 0x58]
call fcn.18001e600
lea rcx, [rsi + 0x18]
call fcn.18001e600
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x18001e8a3
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18001e895
call fcn.1800589c8
mov edx, 0x20
mov rcx, rbx
call fcn.1800589c8
nop
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18001f540
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18001f571
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1800b7008]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800b7018]
lea rdx, [rdi + rdi]
call fcn.18001d510
mov rax, qword [0x1800b7008]
lea r9, [rdi - 1]
mov qword [0x1800b7030], r9
mov qword [0x1800b7038], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18001f712
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800b7018]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001f65c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001f6d3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18001f699
mov r10, qword [rdx]
cmp r10, rax
je 0x18001f693
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001f6d3
cmp r9, rdx
je 0x18001f6af
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18001f6e7
cmp r9, rdx
jne 0x18001f6a0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18001f70d
mov r9, qword [0x1800b7030]
jmp 0x18001f5e1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001f6d3
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret