joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d2400
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d34e0
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d2e02
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f5108]
test eax, eax
je 0x2fc4d2e9a
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f5110]
mov qword [rbp - 8], rax
jmp 0x2fc4d2e7e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d2e72
cmp qword [rbp - 0x10], 0
je 0x2fc4d2e72
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d2e38
lea rax, [0x2fc4f50e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d2e9b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d2fa0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d2fc8
mov eax, 0
jmp 0x2fc4d3016
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d2ff1
mov eax, 0
jmp 0x2fc4d3016
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d3011
mov eax, 0
jmp 0x2fc4d3016
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d301c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d309a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d3091
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d3091
mov rax, qword [rbp - 8]
jmp 0x2fc4d30af
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d3064
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x180004030
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18011ff11], 0
mov rbx, rcx
je 0x18000405b
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0x64
call fcn.1800048b0
add rsp, 0x20
pop rbx
ret
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180004074
lea rcx, [rbx + 0x40]
call fcn.180004090
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0xa
call fcn.1800048b0
add rsp, 0x20
pop rbx
ret
Function at 0x180005330
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d490]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d4b8]
js 0x180005354
cvtsi2ss xmm0, rcx
jmp 0x180005369
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d480]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000539b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000539b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800053cd
cmp rbx, 0x200
jae 0x1800053ca
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800053cd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180005540
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180005571
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d488]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d498]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d488]
lea r9, [rdi - 1]
mov qword [0x18011d4b0], r9
mov qword [0x18011d4b8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800056e4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d498]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180005630
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800056a5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000566d
mov r10, qword [rdx]
cmp r10, rax
je 0x180005667
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800056a5
cmp r9, rdx
je 0x180005681
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800056b9
cmp r9, rdx
jne 0x180005672
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800056df
mov r9, qword [0x18011d4b0]
jmp 0x1800055e1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800056a5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800053e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d450]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d478]
js 0x180005404
cvtsi2ss xmm0, rcx
jmp 0x180005419
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d440]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000544b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000544b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000547d
cmp rbx, 0x200
jae 0x18000547a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000547d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800056f0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180005721
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d448]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d458]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d448]
lea r9, [rdi - 1]
mov qword [0x18011d470], r9
mov qword [0x18011d478], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180005894
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d458]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800057e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180005855
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000581d
mov r10, qword [rdx]
cmp r10, rax
je 0x180005817
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180005855
cmp r9, rdx
je 0x180005831
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180005869
cmp r9, rdx
jne 0x180005822
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000588f
mov r9, qword [0x18011d470]
jmp 0x180005791
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180005855
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180005490
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d410]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d438]
js 0x1800054b4
cvtsi2ss xmm0, rcx
jmp 0x1800054c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d400]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800054fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800054fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000552d
cmp rbx, 0x200
jae 0x18000552a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000552d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800058a0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800058d1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d408]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d418]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d408]
lea r9, [rdi - 1]
mov qword [0x18011d430], r9
mov qword [0x18011d438], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180005a44
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d418]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180005990
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180005a05
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800059cd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800059c7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180005a05
cmp r9, rdx
je 0x1800059e1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180005a19
cmp r9, rdx
jne 0x1800059d2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180005a3f
mov r9, qword [0x18011d430]
jmp 0x180005941
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180005a05
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180005540
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d490]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d4b8]
js 0x180005354
cvtsi2ss xmm0, rcx
jmp 0x180005369
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d480]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000539b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000539b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1800053cd
cmp rbx, 0x200
jae 0x1800053ca
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1800053cd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x180005540
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180005571
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d488]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d498]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d488]
lea r9, [rdi - 1]
mov qword [0x18011d4b0], r9
mov qword [0x18011d4b8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800056e4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d498]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180005630
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800056a5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000566d
mov r10, qword [rdx]
cmp r10, rax
je 0x180005667
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800056a5
cmp r9, rdx
je 0x180005681
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800056b9
cmp r9, rdx
jne 0x180005672
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800056df
mov r9, qword [0x18011d4b0]
jmp 0x1800055e1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800056a5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800056f0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d450]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d478]
js 0x180005404
cvtsi2ss xmm0, rcx
jmp 0x180005419
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d440]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000544b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000544b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000547d
cmp rbx, 0x200
jae 0x18000547a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000547d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800056f0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180005721
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d448]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d458]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d448]
lea r9, [rdi - 1]
mov qword [0x18011d470], r9
mov qword [0x18011d478], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180005894
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d458]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800057e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180005855
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18000581d
mov r10, qword [rdx]
cmp r10, rax
je 0x180005817
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180005855
cmp r9, rdx
je 0x180005831
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180005869
cmp r9, rdx
jne 0x180005822
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000588f
mov r9, qword [0x18011d470]
jmp 0x180005791
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180005855
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800058a0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x18011d410]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x18011d438]
js 0x1800054b4
cvtsi2ss xmm0, rcx
jmp 0x1800054c9
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x18011d400]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x180107460]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800054fb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800054fb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000552d
cmp rbx, 0x200
jae 0x18000552a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000552d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800058a0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800058d1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18011d408]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18011d418]
lea rdx, [rdi + rdi]
call fcn.1800046d0
mov rax, qword [0x18011d408]
lea r9, [rdi - 1]
mov qword [0x18011d430], r9
mov qword [0x18011d438], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180005a44
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18011d418]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180005990
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180005a05
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800059cd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800059c7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180005a05
cmp r9, rdx
je 0x1800059e1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180005a19
cmp r9, rdx
jne 0x1800059d2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180005a3f
mov r9, qword [0x18011d430]
jmp 0x180005941
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180005a05
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180005a50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180005ab1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180005a70
mov ecx, dword [r9]
jmp 0x180005b9b
cmp ecx, 0x4e0
jb 0x180005b9b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180005ad0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180005b20
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret