joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140082676
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x14008bbc0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400a53d0]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x14008bbb0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14008278b
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x14008bbc0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x140082759
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x14008bbc0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14008279a
lea rax, [0x14008bbc0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400827d6
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x140082844
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x14008bbb0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14008288e
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14008288e
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x14008bbc0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x140082880
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get system information on windows

Disassembly:
sub rsp, 0x68
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x40], 6
jae 0x1400010b8
lea rcx, str.Not_enough_processors._Exiting..._n
call fcn.140001010
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001220
add rsp, 0x68
ret
movdqa xmm2, xmmword [str.DDDDDDDDDDDDDDDD_]
lea rax, [0x140003090]
mov qword [rsp + 0x60], rbx
xor ecx, ecx
nop
movdqu xmm0, xmmword [rax - 0x10]
add ecx, 0x40
lea rax, [rax + 0x40]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm1, xmmword [rax - 0x40]
xorps xmm1, xmm2
movdqu xmmword [rax - 0x40], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
cmp ecx, 0x140
jb 0x1400010d0
movsxd rax, ecx
lea rbx, [0x140003080]
cmp rax, 0x140
jae 0x140001141
add rax, rbx
nop dword [rax]
xor byte [rax], 0x44
lea rax, [rax + 1]
inc ecx
cmp ecx, 0x140
jb 0x140001130
lea rcx, str.testing_n_n
call fcn.140001010
xor ecx, ecx
mov edx, 0x141
mov r8d, 0x1000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
mov rcx, rax
mov edx, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rbx]
lea rbx, [rbx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rbx - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rbx - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rbx - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rbx - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rbx - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rbx - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rbx - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140001170
movups xmm0, xmmword [rbx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movzx eax, byte [rbx + 0x40]
mov byte [rcx + 0x40], al
call r8
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140001220
add rsp, 0x68
ret

Function at 0x140001ae0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b2c
xor al, al
add rsp, 0x28
ret
Function at 0x180005d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
ror byte [rax - 0x75], 1
adc byte [r8 + 1], r9b
ror byte [rax - 0x77], 1
call 0x16845e908
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x180005e7e
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x28]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x40], rax
mov rax, qword [rbp - 0x40]
mov rcx, rax
call fcn.180005d4f
cmp eax, dword [rbp + 0x18]
jne 0x180005e7a
mov eax, dword [rbp - 4]
lea rdx, [rax + rax]
mov rax, qword [rbp - 0x38]
add rax, rdx
movzx eax, word [rax]
movzx eax, ax
lea rdx, [rax*4]
mov rax, qword [rbp - 0x30]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
jmp 0x180005e8f
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x18]
cmp eax, dword [rbp - 4]
ja 0x180005e18
mov eax, 0
add rsp, 0x60
pop rbp
ret

Function at 0x180005ea0
Capabilities:
Access peb ldr_data

Disassembly:
xor rax, rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax + 0x20]
ret
Function at 0x18000d470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r11, rcx
test rdx, rdx
jne 0x18000d48e
mov rcx, qword [rcx]
mov dl, 0x30
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax]
mov qword [rsp + 0x38], rbx
lea r9, [rcx + 0x10]
mov qword [rsp + 0x20], rdi
test rdx, rdx
jns 0x18000d5ad
mov rax, rdx
mov byte [rcx + 0x10], 0x2d
cqo
mov ecx, 1
mov r8, rax
xor r8, rdx
sub r8, rdx
mov rdx, r8
cmp r8, 0xa
jb 0x18000d507
movabs r10, 0x346dc5d63886594b
nop
cmp rdx, 0x64
jb 0x18000d5a6
cmp rdx, 0x3e8
jb 0x18000d59e
cmp rdx, 0x2710
jb 0x18000d596
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x18000d4d0
inc ecx
mov r10d, ecx
lea rdi, str.000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798998
add r9, r10
cmp r8, 0x64
jb 0x18000d572
mov qword [rsp + 0x40], rsi
movabs rsi, 0x47ae147ae147ae15
nop dword [rax + rax]
mov rcx, r8
mov rax, rsi
mul r8
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub rcx, rax
mov eax, ecx
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
add r9, 0xfffffffffffffffe
movzx eax, byte [rcx + rdi]
mov byte [r9], al
cmp r8, 0x64
jae 0x18000d530
mov rsi, qword [rsp + 0x40]
cmp r8, 0xa
jb 0x18000d60a
mov eax, r8d
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
movzx eax, byte [rcx + rdi]
mov byte [r9 - 2], al
jmp 0x18000d612
add ecx, 3
jmp 0x18000d507
add ecx, 2
jmp 0x18000d507
inc ecx
jmp 0x18000d507
mov ecx, 1
cmp rdx, 0xa
jb 0x18000d509
movabs r10, 0x346dc5d63886594b
cmp rdx, 0x64
jb 0x18000d507
cmp rdx, 0x3e8
jb 0x18000d602
cmp rdx, 0x2710
jb 0x18000d5fa
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x18000d5c6
jmp 0x18000d509
add ecx, 3
jmp 0x18000d509
add ecx, 2
jmp 0x18000d509
add r8b, 0x30
mov byte [r9 - 1], r8b
mov rcx, qword [r11]
lea rdx, [r11 + 0x10]
mov r8, r10
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
add rsp, 0x28
jmp qword [rax + 8]
Function at 0x18001b990
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r10, rcx
mov rdx, qword [rdx + 0x10]
mov r8d, 0x1505
mov r9, qword [rdx + 0x10]
movzx eax, byte [r9]
test al, al
je 0x18001b9d7
nop dword [rax]
nop word [rax + rax]
imul r8, r8, 0x21
movsx rax, al
lea r9, [r9 + 1]
add r8, rax
movzx eax, byte [r9]
test al, al
jne 0x18001b9c0
mov rcx, qword [rcx + 0x38]
and rcx, r8
mov r8, qword [r10 + 0x20]
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x18001ba30
cmp rax, rdx
jne 0x18001ba15
mov rax, qword [r10 + 0x10]
lea rcx, [r10 + 0x10]
mov qword [r8], rax
mov qword [r8 + 8], rax
call fcn.18001dea0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rdx + 8]
lea rcx, [r10 + 0x10]
mov qword [r8 + 8], rax
call fcn.18001dea0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
cmp rax, rdx
jne 0x18001ba3b
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [r10 + 0x10]
call fcn.18001dea0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x18001ba50
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov ebx, 0x1505
mov rcx, qword [rdx]
movzx eax, byte [rcx]
test al, al
je 0x18001ba96
nop dword [rax]
nop word [rax + rax]
imul rbx, rbx, 0x21
movsx rax, al
lea rcx, [rcx + 1]
add rbx, rax
movzx eax, byte [rcx]
test al, al
jne 0x18001ba80
mov r8, rdx
mov r9, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800222f0
xor esi, esi
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18001bb22
mov rcx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
and rcx, rbx
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x18001bb07
cmp rax, rdx
jne 0x18001baef
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.18001dea0
mov ecx, 1
jmp 0x18001bb25
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.18001dea0
mov ecx, 1
jmp 0x18001bb25
cmp rax, rdx
jne 0x18001bb12
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [rdi + 8]
call fcn.18001dea0
mov ecx, 1
jmp 0x18001bb25
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
test rcx, rcx
mov eax, 0x490
cmovne eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18001bb40
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov r8, rdx
mov rdi, rcx
mov rdx, qword [rdx]
mov r9d, 0x1505
movzx eax, byte [rdx]
test al, al
je 0x18001bb76
imul r9, r9, 0x21
movsx rax, al
lea rdx, [rdx + 1]
add r9, rax
movzx eax, byte [rdx]
test al, al
jne 0x18001bb60
lea rdx, [rsp + 0x20]
add rcx, 8
call fcn.1800222f0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x18001bb91
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x50]
lea rax, [rcx + 0x18]
xor edx, edx
cmp qword [rdi + 0x10], rcx
cmove rax, rdx
add rsp, 0x30
pop rdi
ret
Function at 0x18001bbb0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, rcx
mov r8, rdx
mov r9d, 0x1505
mov rdx, qword [rdx]
movzx eax, byte [rdx]
test al, al
je 0x18001bbe7
imul r9, r9, 0x21
movsx rax, al
lea rdx, [rdx + 1]
add r9, rax
movzx eax, byte [rdx]
test al, al
jne 0x18001bbd1
lea rdx, [rsp + 0x20]
add rcx, 8
call fcn.1800222f0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x18001bc02
mov rcx, qword [rdi + 0x10]
cmp qword [rdi + 0x10], rcx
jne 0x18001bc15
mov eax, 0x490
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
movzx ecx, word [rcx + 0x18]
xor eax, eax
mov word [rsi], cx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x180028710
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push r13
sub rsp, 0x48
movabs rax, 0xfffffffffffffff
mov r13, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180028901
lea rax, [rdx - 1]
mov qword [rsp + 0x70], rbp
mov rbp, qword [r13 + 8]
or rax, rbx
bsr rcx, rax
mov qword [rsp + 0x40], rsi
mov r8, rbp
inc ecx
mov qword [rsp + 0x30], r12
shl rbx, cl
lea rcx, [r13 + 0x18]
lea rdx, [rbx + rbx]
call fcn.18000ae20
lea rax, [rbx - 1]
mov qword [r13 + 0x38], rbx
mov qword [r13 + 0x30], rax
mov rbx, qword [r13 + 8]
mov rbx, qword [rbx]
mov rsi, rbx
cmp rbx, rbp
je 0x1800288c4
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
mov r8, qword [rbx + 0x10]
mov eax, 0x1505
mov rsi, qword [rsi]
mov rdx, r8
movzx ecx, byte [r8]
test cl, cl
je 0x1800287d6
nop word [rax + rax]
imul rax, rax, 0x21
movsx rcx, cl
lea rdx, [rdx + 1]
add rax, rcx
movzx ecx, byte [rdx]
test cl, cl
jne 0x1800287c0
mov r14, qword [r13 + 0x30]
and r14, rax
shl r14, 4
add r14, qword [r13 + 0x18]
cmp qword [r14], rbp
jne 0x1800287f6
mov qword [r14], rbx
mov qword [r14 + 8], rbx
jmp 0x1800288a9
mov rdi, qword [r14 + 8]
lea rdx, [0x180079a43]
mov rcx, r8
mov rax, qword [rdi + 0x10]
test rax, rax
cmovne rdx, rax
call fcn.18004d1bc
test eax, eax
jne 0x180028847
mov r8, qword [rdi]
cmp r8, rbx
je 0x180028841
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r14 + 8], rbx
jmp 0x1800288a9
mov r15, rdi
cmp qword [r14], rdi
je 0x180028885
nop
mov rdi, qword [rdi + 8]
lea rcx, [0x180079a43]
mov rdx, rcx
mov r15, rdi
mov rax, qword [rdi + 0x10]
test rax, rax
cmovne rdx, rax
mov rax, qword [rbx + 0x10]
test rax, rax
cmovne rcx, rax
call fcn.18004d1bc
test eax, eax
je 0x1800288db
cmp qword [r14], rdi
jne 0x180028850
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r15
mov rax, qword [r15 + 8]
mov qword [rax], rbx
mov qword [r15 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r14], rbx
mov rbx, rsi
cmp rsi, rbp
jne 0x1800287a0
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x30]
add rsp, 0x48
pop r13
pop rbx
ret
mov r8, qword [rdi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1800288a9
lea rcx, str.invalid_hash_bucket_count
call fcn.18003d2a0
int3
Function at 0x18002bb40
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 0xa8
jmp 0x180035050
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
shr rax, 8
mov rsi, rdx
mov rbp, rdx
mov qword [rsp + 0x20], rax
mov r14, rdx
shr rsi, 0x38
mov r15, rdx
shr rbp, 0x30
mov r12, rdx
shr r14, 0x28
mov r13, rdx
shr r15, 0x20
add rcx, 0x40
shr r12, 0x18
mov rbx, rdx
shr r13, 0x10
call fcn.18003d798
test eax, eax
jne 0x1800351c9
mov r10, qword [rdi + 0x18]
movabs rcx, 0x100000001b3
mov r8, qword [rdi + 8]
movabs rax, 0xcbf29ce484222325
movzx edx, bl
xor rdx, rax
movzx eax, byte [rsp + 0x20]
imul rdx, rcx
xor rdx, rax
movzx eax, r13b
imul rdx, rcx
xor rdx, rax
movzx eax, r12b
imul rdx, rcx
xor rdx, rax
movzx eax, r15b
imul rdx, rcx
xor rdx, rax
movzx eax, r14b
imul rdx, rcx
xor rdx, rax
movzx eax, bpl
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
xor rdx, rsi
imul rdx, rcx
and rdx, qword [rdi + 0x30]
mov r9, rdx
add r9, r9
mov r11, qword [r10 + r9*8 + 8]
mov rcx, r11
cmp r11, r8
je 0x1800351a9
mov rax, qword [r10 + r9*8]
cmp rbx, qword [r11 + 0x10]
je 0x180035151
cmp rcx, rax
je 0x1800351a9
mov rcx, qword [rcx + 8]
cmp rbx, qword [rcx + 0x10]
jne 0x180035142
test rcx, rcx
je 0x1800351a9
add rdx, rdx
mov rax, qword [r10 + rdx*8]
cmp r11, rcx
jne 0x18003517d
cmp rax, rcx
jne 0x180035172
mov qword [r10 + rdx*8], r8
mov qword [r10 + r9*8 + 8], r8
jmp 0x180035189
mov r8, qword [rcx + 8]
mov qword [r10 + r9*8 + 8], r8
jmp 0x180035189
cmp rax, rcx
jne 0x180035189
mov rax, qword [rcx]
mov qword [r10 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.18003eec0
lea rcx, [rdi + 0x40]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.18003d7a0
mov ecx, eax
call fcn.18003e4cc
int3
Function at 0x18002dc00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, rdx
mov rsi, qword [r8 + 0x10]
mov rdi, r8
mov rdx, rcx
mov r10, r8
cmp r15, 0x10
jb 0x18002dc36
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rsi, rsi
je 0x18002dc74
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rsi
jb 0x18002dc60
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
and rcx, r9
mov r12, qword [rdx + 8]
add rcx, rcx
mov qword [rsp + 0x40], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x18002dce4
mov rbp, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x18002dcb2
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x18002dcbe
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x18002dccf
mov r8, rsi
call fcn.180041b30
test eax, eax
je 0x18002dcda
cmp rbx, rbp
je 0x18002dce4
mov rbx, qword [rbx + 8]
jmp 0x18002dca0
test rbx, rbx
je 0x18002dce4
mov qword [r14], rbx
jmp 0x18002dce7
mov qword [r14], r12
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180032c40
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x180035050
Function at 0x180035050
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 0xa8
jmp 0x180035050
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
shr rax, 8
mov rsi, rdx
mov rbp, rdx
mov qword [rsp + 0x20], rax
mov r14, rdx
shr rsi, 0x38
mov r15, rdx
shr rbp, 0x30
mov r12, rdx
shr r14, 0x28
mov r13, rdx
shr r15, 0x20
add rcx, 0x40
shr r12, 0x18
mov rbx, rdx
shr r13, 0x10
call fcn.18003d798
test eax, eax
jne 0x1800351c9
mov r10, qword [rdi + 0x18]
movabs rcx, 0x100000001b3
mov r8, qword [rdi + 8]
movabs rax, 0xcbf29ce484222325
movzx edx, bl
xor rdx, rax
movzx eax, byte [rsp + 0x20]
imul rdx, rcx
xor rdx, rax
movzx eax, r13b
imul rdx, rcx
xor rdx, rax
movzx eax, r12b
imul rdx, rcx
xor rdx, rax
movzx eax, r15b
imul rdx, rcx
xor rdx, rax
movzx eax, r14b
imul rdx, rcx
xor rdx, rax
movzx eax, bpl
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
xor rdx, rsi
imul rdx, rcx
and rdx, qword [rdi + 0x30]
mov r9, rdx
add r9, r9
mov r11, qword [r10 + r9*8 + 8]
mov rcx, r11
cmp r11, r8
je 0x1800351a9
mov rax, qword [r10 + r9*8]
cmp rbx, qword [r11 + 0x10]
je 0x180035151
cmp rcx, rax
je 0x1800351a9
mov rcx, qword [rcx + 8]
cmp rbx, qword [rcx + 0x10]
jne 0x180035142
test rcx, rcx
je 0x1800351a9
add rdx, rdx
mov rax, qword [r10 + rdx*8]
cmp r11, rcx
jne 0x18003517d
cmp rax, rcx
jne 0x180035172
mov qword [r10 + rdx*8], r8
mov qword [r10 + r9*8 + 8], r8
jmp 0x180035189
mov r8, qword [rcx + 8]
mov qword [r10 + r9*8 + 8], r8
jmp 0x180035189
cmp rax, rcx
jne 0x180035189
mov rax, qword [rcx]
mov qword [r10 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.18003eec0
lea rcx, [rdi + 0x40]
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.18003d7a0
mov ecx, eax
call fcn.18003e4cc
int3