joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800aa600
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800aa631
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180248098]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1802480a8]
lea rdx, [rdi + rdi]
call fcn.18002f8d0
mov rcx, qword [0x180248098]
lea r9, [rdi - 1]
mov qword [0x1802480c0], r9
mov qword [0x1802480c8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800aa7d2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1802480a8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800aa71c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800aa793
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x1800aa759
mov r8, qword [rax]
cmp r8, rcx
je 0x1800aa753
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800aa793
cmp r9, rax
je 0x1800aa76f
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x1800aa7a7
cmp r9, rax
jne 0x1800aa760
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800aa7cd
mov r9, qword [0x1802480c0]
jmp 0x1800aa6a1
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800aa793
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800af830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
lea rsi, [r8 - 1]
mov rdi, r9
sar rsi, 1
mov r14, r8
mov r11, rdx
mov rbx, rcx
mov rbp, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1800af8bd
nop
add r10, r10
lea rcx, [rsp + 0x80]
lea rax, [r10 + 2]
lea rax, [rax + rax*2]
lea rdx, [rbx + rax*8]
lea r8, [rdx - 0x18]
call fcn.1800ad380
movzx ecx, al
xor rcx, 1
inc rcx
add r10, rcx
lea rax, [r10 + r10*2]
movsd xmm0, qword [rbx + rax*8]
lea rdx, [rbx + rax*8]
lea rax, [r11 + r11*2]
mov r11, r10
movsd qword [rbx + rax*8], xmm0
lea rcx, [rbx + rax*8]
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
cmp r10, rsi
jl 0x1800af860
mov r11, r10
cmp r10, rsi
jne 0x1800af8f7
test r14b, 1
jne 0x1800af8f7
lea rax, [r14 + r14*2]
movsd xmm0, qword [rbx + rax*8 - 0x18]
lea rdx, [rbx + rax*8]
lea rax, [r10 + r10*2]
lea rcx, [rbx + rax*8]
movsd qword [rcx], xmm0
lea r11, [r14 - 1]
mov eax, dword [rdx - 0x10]
mov dword [rcx + 8], eax
mov rax, qword [rdx - 8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
cmp rbp, r11
jge 0x1800af957
nop dword [rax]
lea r10, [r11 - 1]
mov r8, rdi
sar r10, 1
lea rcx, [rsp + 0x20]
lea rax, [r10 + r10*2]
lea rdx, [rbx + rax*8]
call fcn.1800ad380
test al, al
je 0x1800af957
movsd xmm0, qword [rdx]
lea rax, [r11 + r11*2]
movsd qword [rbx + rax*8], xmm0
lea rcx, [rbx + rax*8]
mov eax, dword [rdx + 8]
mov r11, r10
mov dword [rcx + 8], eax
mov rax, qword [rdx + 0x10]
mov qword [rcx + 0x10], rax
cmp rbp, r10
jl 0x1800af910
movsd xmm0, qword [rdi]
lea rax, [r11 + r11*2]
lea rcx, [rbx + rax*8]
mov rbx, qword [rsp + 0x78]
movsd qword [rcx], xmm0
mov eax, dword [rdi + 8]
mov dword [rcx + 8], eax
mov rax, qword [rdi + 0x10]
mov qword [rcx + 0x10], rax
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800bc720
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1802453c8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor esi, esi
mov rcx, rdx
mov edi, esi
mov rbx, r8
call fcn.180120f30
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
mov rcx, rbx
call fcn.180120f30
mov r8, qword [rsp + 0x30]
movabs rbx, 0x100000001b3
mov r9, qword [0x1802490d0]
movabs rbp, 0xcbf29ce484222325
mov r10, qword [0x1802490b8]
mov rdx, qword [rax]
movzx eax, byte [rsp + 0x31]
mov r11, qword [0x1802490a8]
movzx ecx, r8b
xor rcx, rbp
mov qword [rsp + 0x38], rdx
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x32]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x33]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x34]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x35]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x36]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x37]
imul rcx, rbx
xor rcx, rax
imul rcx, rbx
and rcx, r9
add rcx, rcx
mov rax, qword [r10 + rcx*8 + 8]
cmp rax, r11
je 0x1800bc85b
mov rcx, qword [r10 + rcx*8]
cmp r8, qword [rax + 0x10]
je 0x1800bc81f
nop dword [rax]
cmp rax, rcx
je 0x1800bc85b
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x1800bc810
test rax, rax
je 0x1800bc85b
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [0x1802490a0]
call fcn.1800725a0
mov rdx, qword [rsp + 0x38]
mov r9, qword [0x1802490d0]
mov r10, qword [0x1802490b8]
mov rcx, qword [rax]
mov r11, qword [0x1802490a8]
mov rsi, qword [rcx + 0x18]
movzx eax, byte [rsp + 0x39]
movzx ecx, dl
xor rcx, rbp
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3a]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3b]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3c]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3d]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3e]
imul rcx, rbx
xor rcx, rax
movzx eax, byte [rsp + 0x3f]
imul rcx, rbx
xor rcx, rax
imul rcx, rbx
and rcx, r9
add rcx, rcx
mov rax, qword [r10 + rcx*8 + 8]
cmp rax, r11
je 0x1800bc904
mov r8, qword [r10 + rcx*8]
cmp rdx, qword [rax + 0x10]
je 0x1800bc8e2
cmp rax, r8
je 0x1800bc904
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x1800bc8d3
test rax, rax
je 0x1800bc904
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
lea rcx, [0x1802490a0]
call fcn.1800725a0
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x18]
cmp rsi, rdi
setb al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180129de0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800d1350
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r10, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1800d13fd
mov rcx, qword [r10]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1800d13ff
cmp rax, rdx
je 0x1800d13fd
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800d13e7
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret

Function at 0x1800d1410
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x1802482b0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x180248298]
mov rax, qword [rdx + 8]
cmp rax, qword [0x180248288]
je 0x1800d14c6
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1800d14c8
nop dword [rax]
cmp rax, rdx
je 0x1800d14c6
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800d14b0
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret

Function at 0x1800d14d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x1802482f0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x1802482d8]
mov rax, qword [rdx + 8]
cmp rax, qword [0x1802482c8]
je 0x1800d1586
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1800d1588
nop dword [rax]
cmp rax, rdx
je 0x1800d1586
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1800d1570
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret
Function at 0x1800d1cf0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800d1d21
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180248288]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180248298]
lea rdx, [rdi + rdi]
call fcn.18002f8d0
mov rcx, qword [0x180248288]
lea r9, [rdi - 1]
mov qword [0x1802482b0], r9
mov qword [0x1802482b8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1800d1ec2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180248298]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800d1e0c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1800d1e83
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x1800d1e49
mov r8, qword [rax]
cmp r8, rcx
je 0x1800d1e43
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1800d1e83
cmp r9, rax
je 0x1800d1e5f
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x1800d1e97
cmp r9, rax
jne 0x1800d1e50
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x1800d1ebd
mov r9, qword [0x1802482b0]
jmp 0x1800d1d91
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1800d1e83
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800e4fc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802453c8]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, qword [rsp + 0xa0]
xor esi, esi
mov rbp, r9
mov r12, r8
mov r15, rdx
test r14, r14
je 0x1800e4ff7
mov qword [r14], rsi
test r15, r15
je 0x1800e50aa
test r12, r12
je 0x1800e50aa
mov qword [rsp + 0x80], rbx
mov rbx, rsi
test rbp, rbp
je 0x1800e5096
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov r13d, 0xffffffff
nop dword [rax]
mov rdi, rbp
mov qword [rsp + 0x20], rsi
sub rdi, rbx
lea rdx, [rbx + r12]
cmp rdi, r13
lea r9, [rsp + 0x30]
mov rcx, r15
cmovae edi, r13d
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x30]
cmp eax, 1
jne 0x1800e5064
test ecx, ecx
je 0x1800e5076
add rbx, rcx
cmp ecx, edi
jb 0x1800e508c
test eax, eax
je 0x1800e507d
cmp rbx, rbp
jb 0x1800e5030
jmp 0x1800e508c
mov esi, 0xffffffef
jmp 0x1800e508c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800d60d0
mov esi, eax
mov rdi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x1800e509e
mov qword [r14], rbx
mov rbx, qword [rsp + 0x80]
mov eax, esi
jmp 0x1800e50af
mov eax, 0xfffffffe
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180129de0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
Function at 0x1801143f0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x1802483b0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x180248398]
mov rax, qword [rdx + 8]
cmp rax, qword [0x180248388]
je 0x1801144a6
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x1801144a8
nop dword [rax]
cmp rax, rdx
je 0x1801144a6
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180114490
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret

Function at 0x1801144b0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x1802483f0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x1802483d8]
mov rax, qword [rdx + 8]
cmp rax, qword [0x1802483c8]
je 0x180114566
mov rcx, qword [r9]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x180114568
nop dword [rax]
cmp rax, rdx
je 0x180114566
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180114550
test rax, rax
setne al
ret
xor eax, eax
test rax, rax
setne al
ret
Function at 0x180114bb0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180114be1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1802483c8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1802483d8]
lea rdx, [rdi + rdi]
call fcn.18002f8d0
mov rcx, qword [0x1802483c8]
lea r9, [rdi - 1]
mov qword [0x1802483f0], r9
mov qword [0x1802483f8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180114d82
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1802483d8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180114ccc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180114d43
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x180114d09
mov r8, qword [rax]
cmp r8, rcx
je 0x180114d03
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180114d43
cmp r9, rax
je 0x180114d1f
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x180114d57
cmp r9, rax
jne 0x180114d10
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x180114d7d
mov r9, qword [0x1802483f0]
jmp 0x180114c51
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180114d43
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180114d90
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180114dc1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180248388]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180248398]
lea rdx, [rdi + rdi]
call fcn.18002f8d0
mov rcx, qword [0x180248388]
lea r9, [rdi - 1]
mov qword [0x1802483b0], r9
mov qword [0x1802483b8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180114f62
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x14]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x15]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x16]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x17]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180248398]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180114eac
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180114f23
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x180114ee9
mov r8, qword [rax]
cmp r8, rcx
je 0x180114ee3
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180114f23
cmp r9, rax
je 0x180114eff
nop
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x180114f37
cmp r9, rax
jne 0x180114ef0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x180114f5d
mov r9, qword [0x1802483b0]
jmp 0x180114e31
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x180114f23
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180119dd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1802453c8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor edi, edi
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x40], rdi
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x50], rdi
inc r8
cmp byte [rax + r8], dil
jne 0x180119e15
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.18002d3e0
mov rcx, qword [rsp + 0x50]
cmp rcx, 1
ja 0x180119e59
xor r8d, r8d
mov qword [rbx], rdi
lea rdx, [0x18013981a]
mov qword [rbx + 0x10], rdi
mov rcx, rbx
mov qword [rbx + 0x18], 0xf
call fcn.18002d3e0
jmp 0x180119eb1
mov rdx, qword [0x180245898]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, rdx
jb 0x180119ed9
cmp qword [rsp + 0x58], 0x10
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rdx
lea rax, [0x180245888]
cmovae r9, qword [rsp + 0x40]
cmp qword [0x1802458a0], 0x10
cmovae rax, qword [0x180245888]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, rbx
call fcn.18002cc80
lea rcx, [rsp + 0x40]
call fcn.18002d980
mov rax, rbx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180129de0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
call fcn.18002d3c0
int3

Function at 0x18011bc40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1802453c8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18011bd13
cmp byte [rcx + 0x71], 0
je 0x18011bd13
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18011bd0f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18011bcd4
sub eax, 1
je 0x18011bcd8
cmp eax, 2
jne 0x18011bd0f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180129de0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18011bd06
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18011bd0f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18011bcbc
xor al, al
jmp 0x18011bcbc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180129de0
add rsp, 0x60
pop rbx
ret