joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019e60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c20], 0
lea rbx, [rcx + 0x5c28]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140019f07
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140019eba
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001bde0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400062f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c20]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c30]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140129c58]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140019f0f
mov rcx, rbx
call fcn.1400062f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a350
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140129c60]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14001a3b3
mov qword [rsp], rbx
lea rbx, [0x1400b6c60]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001a393
cmp byte [r8], r9b
jne 0x14001a393
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14001a380
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b98]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14001a3e7
mov r10, qword [r10 + 0x5ba0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001a3ee
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14001a3d4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14002ed60
Capabilities:
Hash data using fnv
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r8d, 0xfffffff9
mov ebx, r8d
lea rdx, [0x1400bb545]
mov r9b, 0x23
lea r10, [0x1400b6c60]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x14002edb3
cmp byte [rdx], r9b
jne 0x14002edb3
cmp byte [rdx + 1], r9b
cmove ebx, r8d
movzx ecx, bl
movzx eax, r9b
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x14002eda0
not ebx
mov ebp, ebx
shr ebp, 0x18
mov r14d, ebx
shr r14d, 0x10
mov r15d, ebx
shr r15d, 8
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor edi, edi
mov eax, dword [rcx + rax]
cmp dword [0x140129e20], eax
jle 0x14002eec7
lea rcx, [0x140129e20]
call fcn.1400349e8
cmp dword [0x140129e20], 0xffffffff
jne 0x14002eec7
xorps xmm0, xmm0
movups xmmword [0x140129e30], xmm0
movups xmmword [0x140129e40], xmm0
movups xmmword [0x140129e50], xmm0
movups xmmword [0x140129e60], xmm0
mov dword [0x140129e30], edi
mov qword [0x140129e38], rdi
mov qword [0x140129e40], rdi
lea ecx, [rdi + 0x28]
call fcn.140034bdc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x140129e38], rax
mov qword [0x140129e48], rdi
xorps xmm0, xmm0
movdqa xmmword [0x140129e50], xmm0
mov qword [0x140129e60], 7
mov qword [0x140129e68], 8
mov dword [0x140129e30], 0x3f800000
mov r8, rax
lea edx, [rdi + 0x10]
lea rcx, [0x140129e48]
call fcn.14002f4f0
nop
lea rcx, [0x140098680]
call fcn.140034f10
nop
lea rcx, [0x140129e20]
call fcn.14003497c
movzx esi, bl
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, r15b
xor rsi, rax
imul rsi, rcx
movzx eax, r14b
xor rsi, rax
imul rsi, rcx
mov eax, ebp
xor rsi, rax
imul rsi, rcx
mov rax, rsi
and rax, qword [0x140129e60]
add rax, rax
mov r8, qword [0x140129e48]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x140129e38]
cmp rcx, rdx
je 0x14002ef42
mov rax, qword [r8 + rax*8]
cmp ebx, dword [rcx + 0x10]
je 0x14002ef45
cmp rcx, rax
je 0x14002ef42
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x14002ef32
jmp 0x14002ef45
mov rcx, rdi
mov rax, rdx
test rcx, rcx
cmovne rax, rcx
cmp rax, rdx
jne 0x14002efbc
mov dword [rsp + 0x30], ebx
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x34], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0x44], eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.14002f920
and rsi, qword [0x140129e60]
add rsi, rsi
mov rdx, qword [0x140129e48]
mov rcx, qword [rdx + rsi*8 + 8]
mov rax, qword [0x140129e38]
cmp rcx, rax
je 0x14002efb5
mov rdx, qword [rdx + rsi*8]
cmp ebx, dword [rcx + 0x10]
je 0x14002efb2
cmp rcx, rdx
je 0x14002efb5
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x14002efa4
mov rdi, rcx
test rdi, rdi
cmovne rax, rdi
add rax, 0x14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x14002efe0
Capabilities:
Hash data using fnv
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r8d, 0xffffffff
mov ebx, r8d
movzx r9d, byte [rcx]
lea rdx, [rcx + 1]
test r9b, r9b
je 0x14002f050
lea r10, [0x1400b6c60]
nop
cmp r9b, 0x23
jne 0x14002f033
cmp byte [rdx], r9b
jne 0x14002f033
cmp byte [rdx + 1], r9b
cmove ebx, r8d
movzx ecx, bl
movzx eax, r9b
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x14002f020
not ebx
mov ebp, ebx
shr ebp, 0x18
mov r14d, ebx
shr r14d, 0x10
mov r15d, ebx
shr r15d, 8
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor edi, edi
mov eax, dword [rcx + rax]
cmp dword [0x140129e24], eax
jle 0x14002f147
lea rcx, [0x140129e24]
call fcn.1400349e8
cmp dword [0x140129e24], 0xffffffff
jne 0x14002f147
xorps xmm0, xmm0
movups xmmword [0x140129de0], xmm0
movups xmmword [0x140129df0], xmm0
movups xmmword [0x140129e00], xmm0
movups xmmword [0x140129e10], xmm0
mov dword [0x140129de0], edi
mov qword [0x140129de8], rdi
mov qword [0x140129df0], rdi
lea ecx, [rdi + 0x30]
call fcn.140034bdc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x140129de8], rax
mov qword [0x140129df8], rdi
xorps xmm0, xmm0
movdqa xmmword [0x140129e00], xmm0
mov qword [0x140129e10], 7
mov qword [0x140129e18], 8
mov dword [0x140129de0], 0x3f800000
mov r8, rax
lea edx, [rdi + 0x10]
lea rcx, [0x140129df8]
call fcn.14002f4f0
nop
lea rcx, [0x140098670]
call fcn.140034f10
nop
lea rcx, [0x140129e24]
call fcn.14003497c
movzx esi, bl
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, r15b
xor rsi, rax
imul rsi, rcx
movzx eax, r14b
xor rsi, rax
imul rsi, rcx
mov eax, ebp
xor rsi, rax
imul rsi, rcx
mov rax, rsi
and rax, qword [0x140129e10]
add rax, rax
mov r8, qword [0x140129df8]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x140129de8]
cmp rcx, rdx
je 0x14002f1c2
mov rax, qword [r8 + rax*8]
cmp ebx, dword [rcx + 0x10]
je 0x14002f1c5
cmp rcx, rax
je 0x14002f1c2
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x14002f1b2
jmp 0x14002f1c5
mov rcx, rdi
mov rax, rdx
test rcx, rcx
cmovne rax, rcx
cmp rax, rdx
jne 0x14002f248
mov dword [rsp + 0x30], ebx
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x34], xmm0
movsd xmm1, qword [r13 + 0x10]
movsd qword [rsp + 0x44], xmm1
mov eax, dword [r13 + 0x18]
mov dword [rsp + 0x4c], eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.14002f630
and rsi, qword [0x140129e10]
add rsi, rsi
mov rdx, qword [0x140129df8]
mov rcx, qword [rdx + rsi*8 + 8]
mov rax, qword [0x140129de8]
cmp rcx, rax
je 0x14002f241
mov rdx, qword [rdx + rsi*8]
cmp ebx, dword [rcx + 0x10]
je 0x14002f23e
cmp rcx, rdx
je 0x14002f241
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x14002f230
mov rdi, rcx
test rdi, rdi
cmovne rax, rdi
add rax, 0x14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x14002fc30
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14002fc61
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140129de8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140129df8]
lea rdx, [rdi + rdi]
call fcn.14002f4f0
mov rax, qword [0x140129de8]
lea r9, [rdi - 1]
mov qword [0x140129e10], r9
mov qword [0x140129e18], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002fdd4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140129df8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002fd20
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002fd95
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14002fd5d
mov r10, qword [rdx]
cmp r10, rax
je 0x14002fd57
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002fd95
cmp r9, rdx
je 0x14002fd71
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14002fda9
cmp r9, rdx
jne 0x14002fd62
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14002fdcf
mov r9, qword [0x140129e10]
jmp 0x14002fcd1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002fd95
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002fde0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14002fe11
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140129e38]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140129e48]
lea rdx, [rdi + rdi]
call fcn.14002f4f0
mov rax, qword [0x140129e38]
lea r9, [rdi - 1]
mov qword [0x140129e60], r9
mov qword [0x140129e68], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14002ff84
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140129e48]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14002fed0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002ff45
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14002ff0d
mov r10, qword [rdx]
cmp r10, rax
je 0x14002ff07
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14002ff45
cmp r9, rdx
je 0x14002ff21
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14002ff59
cmp r9, rdx
jne 0x14002ff12
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14002ff7f
mov r9, qword [0x140129e60]
jmp 0x14002fe81
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002ff45
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140030710
Capabilities:
Hash data using fnv
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x50
mov r13, r8
mov r8d, 0xfffffffb
mov ebx, r8d
movzx r9d, byte [rcx]
lea rdx, [rcx + 1]
test r9b, r9b
je 0x140030780
lea r10, [0x1400b6c60]
nop
cmp r9b, 0x23
jne 0x140030763
cmp byte [rdx], r9b
jne 0x140030763
cmp byte [rdx + 1], r9b
cmove ebx, r8d
movzx ecx, bl
movzx eax, r9b
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
movzx r9d, byte [rdx]
inc rdx
test r9b, r9b
jne 0x140030750
not ebx
mov ebp, ebx
shr ebp, 0x18
mov r14d, ebx
shr r14d, 0x10
mov r15d, ebx
shr r15d, 8
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
xor edi, edi
mov eax, dword [rcx + rax]
cmp dword [0x140129eb0], eax
jle 0x140030877
lea rcx, [0x140129eb0]
call fcn.1400349e8
cmp dword [0x140129eb0], 0xffffffff
jne 0x140030877
xorps xmm0, xmm0
movups xmmword [0x140129e70], xmm0
movups xmmword [0x140129e80], xmm0
movups xmmword [0x140129e90], xmm0
movups xmmword [0x140129ea0], xmm0
mov dword [0x140129e70], edi
mov qword [0x140129e78], rdi
mov qword [0x140129e80], rdi
lea ecx, [rdi + 0x28]
call fcn.140034bdc
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x140129e78], rax
mov qword [0x140129e88], rdi
xorps xmm0, xmm0
movdqa xmmword [0x140129e90], xmm0
mov qword [0x140129ea0], 7
mov qword [0x140129ea8], 8
mov dword [0x140129e70], 0x3f800000
mov r8, rax
lea edx, [rdi + 0x10]
lea rcx, [0x140129e88]
call fcn.14002f4f0
nop
lea rcx, [0x140098690]
call fcn.140034f10
nop
lea rcx, [0x140129eb0]
call fcn.14003497c
movzx esi, bl
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, r15b
xor rsi, rax
imul rsi, rcx
movzx eax, r14b
xor rsi, rax
imul rsi, rcx
mov eax, ebp
xor rsi, rax
imul rsi, rcx
mov rax, rsi
and rax, qword [0x140129ea0]
add rax, rax
mov r8, qword [0x140129e88]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x140129e78]
cmp rcx, rdx
je 0x1400308f2
mov rax, qword [r8 + rax*8]
cmp ebx, dword [rcx + 0x10]
je 0x1400308f5
cmp rcx, rax
je 0x1400308f2
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x1400308e2
jmp 0x1400308f5
mov rcx, rdi
mov rax, rdx
test rcx, rcx
cmovne rax, rcx
cmp rax, rdx
jne 0x14003096c
mov dword [rsp + 0x30], ebx
movups xmm0, xmmword [r13]
movups xmmword [rsp + 0x34], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rsp + 0x44], eax
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.140030ba0
and rsi, qword [0x140129ea0]
add rsi, rsi
mov rdx, qword [0x140129e88]
mov rcx, qword [rdx + rsi*8 + 8]
mov rax, qword [0x140129e78]
cmp rcx, rax
je 0x140030965
mov rdx, qword [rdx + rsi*8]
cmp ebx, dword [rcx + 0x10]
je 0x140030962
cmp rcx, rdx
je 0x140030965
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x140030954
mov rdi, rcx
test rdi, rdi
cmovne rax, rdi
add rax, 0x14
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x140030990
Capabilities:
Hash data using fnv

Disassembly:
movss xmm1, dword [rdx]
xorps xmm0, xmm0
ucomiss xmm1, xmm0
mov qword [rsp + 8], rcx
jp 0x1400309ad
jne 0x1400309ad
mov dword [rsp + 8], 0
jmp 0x1400309c0
movss dword [rsp + 8], xmm1
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + 0xa]
movabs r8, 0x100000001b3
movzx edx, byte [rsp + 8]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 9]
imul rdx, r8
xor rax, rdx
imul rax, r8
xor rax, rcx
movzx ecx, byte [rsp + 0xb]
imul rax, r8
xor rax, rcx
imul rax, r8
ret
Function at 0x140030eb0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140030ee1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140129e78]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140129e88]
lea rdx, [rdi + rdi]
call fcn.14002f4f0
mov rax, qword [0x140129e78]
lea r9, [rdi - 1]
mov qword [0x140129ea0], r9
mov qword [0x140129ea8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140031054
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140129e88]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140030fa0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140031015
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140030fdd
mov r10, qword [rdx]
cmp r10, rax
je 0x140030fd7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140031015
cmp r9, rdx
je 0x140030ff1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140031029
cmp r9, rdx
jne 0x140030fe2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14003104f
mov r9, qword [0x140129ea0]
jmp 0x140030f51
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140031015
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400355e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003562e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003562e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003562e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003562e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003562e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140035630
xor al, al
add rsp, 0x28
ret
Function at 0x140047560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2d8]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.1400363a0
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x1400475b6
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x14004760d
mov ebp, 0x4b0000
jmp 0x14004761b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.140038980
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140047631
mov eax, r12d
jmp 0x14004763a
mov edx, edi
mov ecx, ebp
call fcn.140038980
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140047656
shl esi, 0x10
mov ecx, esi
jmp 0x140047745
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x1400476b4
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.1400363a0
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x1400476a4
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140038770
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.1400363a0
add ebx, eax
jmp 0x14004774e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x1400476c1
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140047700
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.1400363a0
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140047705
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140038770
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.1400363a0
add ebx, eax
jmp 0x14004774e
cmp eax, r12d
jge 0x14004773e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.1400363a0
sub ebp, eax
sub r15d, esi
je 0x14004773e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140038770
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.1400363a0
add ebx, eax
jmp 0x14004774e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.1400363a0
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
call fcn.1400363a0
mov r15, qword [rsp + 0x30]
add eax, 0x8000
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
shr eax, 0x10
cwde
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret