joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dab0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140022010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000db3e
nop dword [rax]
test rbx, rbx
je 0x14000db06
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000daf0
test eax, eax
jns 0x14000db5f
test rbx, rbx
je 0x14000db64
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14000dc56
test rbx, rbx
jne 0x14000db6b
xor eax, eax
jmp 0x14000dc56
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000dc36
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14000dbb4
lea rcx, [rsp + 0x28]
call fcn.140005e20
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14000dbd4
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000dc6c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000dc2c
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dc27
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dcbd
call fcn.14000e670
inc edi
cmp edi, dword [rbx]
jb 0x14000db82
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000e650
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000dcc9
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dcc4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000dcc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000e670
mov rax, rdi
jmp 0x14000dc49
Function at 0x140027110
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rsi, rdx
xor ecx, ecx
mov rax, rdx
mov qword [rdx + 0x10], rcx
cmp qword [rdx + 0x18], 8
jb 0x140027139
mov rax, qword [rdx]
mov word [rax], cx
xor r8d, r8d
mov rcx, rbp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r14d, eax
test eax, eax
jne 0x140027195
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140027182
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140027170
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14001ea20
xor al, al
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov eax, 2
mul r14
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
cmovo rax, rbx
mov rcx, rax
call fcn.14002b59c
mov r8d, r14d
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140027200
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1400271e2
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
mov rdx, rbp
call fcn.14001ea20
xor al, al
jmp 0x140027222
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140027200
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.14001d1f0
mov rcx, rdi
call fcn.14002b2d0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180038be0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180038c1a
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov qword [0x18029e868], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x1801323a0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180059560
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rdi, [0x1802a01a0]
mov dword [rsp + 0x28], 0x400
mov rcx, rdi
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
je 0x1800595d3
xorps xmm0, xmm0
mov r8, 0xffffffffffffffff
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
inc r8
cmp byte [rdi + r8], 0
jne 0x1800595b0
mov rdx, rdi
mov rcx, rbx
call fcn.18004dc30
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
movabs rax, 0x1795beedbbf2c198
mov cl, 1
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x8aa997caee6b1447
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x655713d5b58ea38f
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xf9ca8fc54cb3f5f4
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x51b5849fd480b3dd
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xe5ddb7ae8b077d26
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0x2c005bf5c1ebc4af
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movabs rax, 0xf9ca8fec7e9bd5b0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
call fcn.180039670
int3
Function at 0x18005bc90
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1802993c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
jne 0x18005bda5
mov qword [rsp + 0x70], rbx
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 1
call fcn.1801ca0b0
mov r9, rax
lea r8, [0x180216a78]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x40]
call fcn.1801c9f78
movabs rax, 0x38d9c7bfb3f5db89
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0xe5ddb7ae8b731343
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0x51b5849fd480b3dd
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xe5ddb7ae8b077d26
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x38], rax
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x28]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x28]
mov rcx, rbx
and edx, 0xffffffbf
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801b2e60
add rsp, 0x78
ret
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1801b2e60
add rsp, 0x78
ret
Function at 0x18005d630
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18005d654
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x18005d6e2
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18005d6b0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18005d6b0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1801f1620
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18005d6cd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18005d6d5
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18005d671
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x18005d7c0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18005d6f9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18005d6fb
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18005d72d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1801f1620
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18005d7bd
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18005d768
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18005d79e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1801cb2b0
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18005d7bd
cmp rsi, rax
ja 0x18005d771
test rsi, rsi
je 0x18005d7bd
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1801cb2b0
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x180065760
Capabilities:
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x1800659be
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, r8
mov r14, rdx
movabs r8, 0x666666666666666
lea r9, [0x18029a498]
xor r13d, r13d
movabs rdx, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r14]
mov r15d, eax
xor r15, rcx
imul r15, rdx
mov rcx, qword [0x18029a4c0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x18029a4a8]
mov rbx, qword [rdx + rcx*8 + 8]
mov rbp, qword [0x18029a498]
cmp rbx, rbp
jne 0x1800657ee
mov rbx, rbp
mov rsi, rbp
jmp 0x180065819
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x180065992
nop dword [rax + rax]
cmp rbx, rcx
je 0x180065813
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x180065800
jmp 0x180065992
mov rbp, rbx
mov rsi, rbx
cmp qword [0x18029a4a0], r8
je 0x1800659bf
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r13
mov ecx, 0x28
call fcn.1801b2e90
mov rdi, rax
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
mov ecx, dword [r14 + 0x10]
mov dword [rax + 0x20], ecx
mov r8, qword [0x18029a4a0]
lea rcx, [r8 + 1]
xorps xmm1, xmm1
test rcx, rcx
js 0x18006586b
cvtsi2ss xmm1, rcx
jmp 0x180065880
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
mov rcx, qword [0x18029a4c8]
xorps xmm0, xmm0
test rcx, rcx
js 0x180065896
cvtsi2ss xmm0, rcx
jmp 0x1800658ab
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x18029a490]
comiss xmm0, xmm1
jae 0x18006591b
call fcn.180065e00
mov rcx, qword [0x18029a4c0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x18029a4a8]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x18029a498]
cmp rax, rbx
je 0x180065907
mov rdx, qword [rdx + rcx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x180065904
mov rbx, rax
cmp rax, rdx
je 0x180065963
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x1800658f3
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rsi, rbx
mov rbp, qword [rsp + 0x20]
mov r8, qword [0x18029a4a0]
mov qword [rsp + 0x38], r13
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x18029a4a0], r8
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x18029a4a8]
mov rax, qword [0x18029a4c0]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x18029a498]
jne 0x18006596a
mov qword [rcx + rax*8], rdi
jmp 0x18006597c
mov qword [rsp + 0x20], rax
jmp 0x18006590c
cmp r8, rsi
jne 0x180065975
mov qword [rcx + rax*8], rdi
jmp 0x180065981
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180065981
mov qword [rcx + rax*8 + 8], rdi
movabs r8, 0x666666666666666
lea r9, [0x18029a498]
add r14, 0x14
cmp r14, r12
jne 0x18006579f
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1801af514
int3
Function at 0x180065e00
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [0x18029a4a0]
xorps xmm1, xmm1
add rcx, 1
mov rdx, qword [0x18029a4c8]
js 0x180065e1e
cvtsi2ss xmm1, rcx
jmp 0x180065e33
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x18029a490]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x180065e68
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x180065e68
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, 1
xor eax, 1
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1802350bc]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180065e8d
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180065e8d
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x180065ebf
cmp rdx, 0x200
jae 0x180065ebc
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x180065ebf
mov rdx, rcx
jmp 0x180065ef0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18006607d
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18029a498]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18029a4a8]
lea rdx, [rdi + rdi]
call fcn.180065370
mov rax, qword [0x18029a498]
lea rdx, [rdi - 1]
mov qword [0x18029a4c0], rdx
mov qword [0x18029a4c8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066072
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
nop word [rax + rax]
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x18029a4a8]
mov r8, qword [r11]
cmp r8, rbx
jne 0x180065fc1
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066033
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x180065ffa
mov r10, qword [rdx]
cmp r10, rax
je 0x180065ff4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066033
cmp r8, rdx
je 0x18006600f
nop
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x180066047
cmp r8, rdx
jne 0x180066000
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18006606d
mov rdx, qword [0x18029a4c0]
jmp 0x180065f90
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066033
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801af514
int3
Function at 0x180065ef0
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [0x18029a4a0]
xorps xmm1, xmm1
add rcx, 1
mov rdx, qword [0x18029a4c8]
js 0x180065e1e
cvtsi2ss xmm1, rcx
jmp 0x180065e33
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm1, dword [0x18029a490]
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x180065e68
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x180065e68
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, 1
xor eax, 1
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm0, dword [0x1802350bc]
xor ecx, ecx
comiss xmm1, xmm0
jb 0x180065e8d
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x180065e8d
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x180065ebf
cmp rdx, 0x200
jae 0x180065ebc
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x180065ebf
mov rdx, rcx
jmp 0x180065ef0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18006607d
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18029a498]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18029a4a8]
lea rdx, [rdi + rdi]
call fcn.180065370
mov rax, qword [0x18029a498]
lea rdx, [rdi - 1]
mov qword [0x18029a4c0], rdx
mov qword [0x18029a4c8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180066072
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
nop word [rax + rax]
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x18029a4a8]
mov r8, qword [r11]
cmp r8, rbx
jne 0x180065fc1
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180066033
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x180065ffa
mov r10, qword [rdx]
cmp r10, rax
je 0x180065ff4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180066033
cmp r8, rdx
je 0x18006600f
nop
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x180066047
cmp r8, rdx
jne 0x180066000
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18006606d
mov rdx, qword [0x18029a4c0]
jmp 0x180065f90
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180066033
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801af514
int3
Function at 0x1800d0490
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800d066d
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1802a13b8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1802a13c8]
lea rdx, [rdi + rdi]
call fcn.180065370
mov rax, qword [0x1802a13b8]
lea r9, [rdi - 1]
mov qword [0x1802a13e0], r9
mov qword [0x1802a13e8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800d0662
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1802a13c8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800d05ab
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800d0623
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1800d05e8
mov r10, qword [rdx]
cmp r10, rax
je 0x1800d05e2
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800d0623
cmp r9, rdx
je 0x1800d05ff
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800d0637
cmp r9, rdx
jne 0x1800d05f0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800d065d
mov r9, qword [0x1802a13e0]
jmp 0x1800d0530
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800d0623
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1801af514
int3