joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f850
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x14007f8d7
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x14007f8ce
nop
cmp rax, rdx
je 0x14007f8d7
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14007f8c0
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.140113d5c
int3
Function at 0x140080af0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov ebx, r8d
mov rdi, rdx
mov r10, rcx
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rdx, 0x100000001b3
imul r9, rdx
mov eax, r8d
shr eax, 8
movzx r8d, al
xor r9, r8
imul r9, rdx
mov eax, ebx
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, rdx
mov eax, ebx
shr rax, 0x18
xor r9, rax
imul r9, rdx
mov rcx, qword [r10 + 0x30]
and rcx, r9
shl rcx, 4
mov rax, qword [r10 + 0x18]
add rax, rcx
mov rdx, qword [rax + 8]
mov rcx, qword [r10 + 8]
cmp rdx, rcx
je 0x140080ba8
mov rax, qword [rax]
cmp ebx, dword [rdx + 0x10]
je 0x140080b8e
nop dword [rax]
cmp rdx, rax
je 0x140080ba8
mov rdx, qword [rdx + 8]
cmp ebx, dword [rdx + 0x10]
jne 0x140080b80
test rdx, rdx
cmove rdx, rcx
cmp rdx, rcx
je 0x140080ba8
add rdx, 0x18
mov rcx, rdi
call fcn.140006120
jmp 0x140080bdc
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140076f40
nop
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140070880
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.140084310
nop
lea rcx, [rsp + 0x20]
call fcn.140077550
mov rax, rdi
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret
Function at 0x1400987e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rbx, rcx
movzx eax, word [rdx + 0x3a]
cmp ax, 0x36
jne 0x140098a1d
mov eax, dword [rdx + 0x44]
mov dword [rcx + 0x18], eax
lea rsi, [rcx + 0x40]
mov rcx, rsi
call fcn.1400ae260
mov edx, dword [rbx + 0x18]
mov rcx, qword [rbx]
call fcn.140109950
mov qword [rbx + 0x38], rax
mov r13, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0xb8], rax
cmp r13, rax
je 0x140098a39
xor ebp, ebp
movabs rdi, 0x7ffffffffffffff
movabs r10, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r8d, dword [r13]
mov r9, qword [rbx]
movzx edx, r8b
xor rdx, rax
imul rdx, r10
mov eax, r8d
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r10
mov eax, r8d
shr rax, 0x18
xor rdx, rax
imul rdx, r10
mov rcx, qword [r9 + 0x4f0]
and rcx, rdx
shl rcx, 4
add rcx, qword [r9 + 0x4d8]
mov rax, qword [rcx + 8]
mov rdx, qword [r9 + 0x4c8]
cmp rax, rdx
je 0x1400988e2
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400988e5
cmp rax, rcx
je 0x1400988e2
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400988d1
jmp 0x1400988e5
mov rax, rbp
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x140098a0a
add rax, 0x18
je 0x140098a0a
mov r15, qword [rax]
mov rbx, qword [r15]
mov r12, qword [rsi]
cmp rbx, r15
je 0x140098a02
lea r9, [rbx + 0x1c]
mov r8, r12
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140093900
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x50], xmm0
cmp byte [rsp + 0x50], 0
jne 0x1400989a1
cmp qword [rsi + 8], rdi
je 0x140098a51
mov rdi, qword [rsi]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rbp
mov ecx, 0x20
call fcn.140116d14
nop
mov ecx, dword [rbx + 0x1c]
mov dword [rax + 0x1c], ecx
mov qword [rax], rdi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], 0
mov qword [rsp + 0x28], rbp
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14005ac10
movabs rdi, 0x7ffffffffffffff
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1400989cd
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1400989c8
cmp rbx, qword [rax + 0x10]
jne 0x1400989c8
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1400989b5
mov rbx, rax
jmp 0x1400989ef
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1400989ef
nop dword [rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1400989e0
cmp rbx, r15
jne 0x140098911
movabs r10, 0x100000001b3
mov rbx, qword [rsp + 0xb0]
add r13, 4
cmp r13, qword [rsp + 0xb8]
je 0x140098a39
jmp 0x140098859
cmp ax, 0x38
jne 0x140098a39
xor ebp, ebp
mov dword [rcx + 0x18], ebp
lea rax, [rcx + 0x20]
mov qword [rcx + 0x38], rax
add rcx, 0x40
call fcn.1400ae260
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14005b720
int3
Function at 0x1400c4d80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x190
mov rdi, rcx
cmp dword [r8 + 0x20], 0xffffffff
jne 0x1400c4fd7
movzx eax, word [rdx + 0x3a]
mov r8d, dword [rdx + 0x40]
cmp ax, 0x3b
je 0x1400c4dfb
cmp ax, 0x37
je 0x1400c4e38
mov r9, rdx
mov r8d, 0xfffffff6
lea rdx, [rsp + 0x20]
call fcn.140110560
mov rbx, rax
lea rdx, str.Target_of_NonWritable_decoration_must_be_a_memory_object_declaration__a_variable_or_a_function_parameter_
mov rcx, rax
call fcn.14003e540
mov ebx, dword [rbx + 0x160]
lea rcx, [rsp + 0x20]
call fcn.140076780
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
mov rcx, qword [rdx + 0x18]
mov rax, qword [rdx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 2
jbe 0x1400c4fea
movzx ecx, word [rcx + 0x20]
mov rax, qword [rdx]
mov r9d, dword [rax + rcx*4]
cmp r9d, 7
je 0x1400c4e2b
cmp r9d, 6
jne 0x1400c4e38
cmp byte [rdi + 0x47c], 0
jne 0x1400c4fd7
movzx r9d, r8b
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs r10, 0x100000001b3
imul r9, r10
mov eax, r8d
shr eax, 8
movzx ecx, al
xor r9, rcx
imul r9, r10
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor r9, rcx
imul r9, r10
mov rax, r8
shr rax, 0x18
xor r9, rax
imul r9, r10
mov rcx, qword [rdi + 0x5c8]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x5b0]
mov rax, qword [rcx + 8]
mov r10, qword [rdi + 0x5a0]
cmp rax, r10
je 0x1400c4ed2
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400c4ec2
cmp rax, rcx
je 0x1400c4ed2
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400c4eb3
test rax, rax
cmove rax, r10
cmp rax, r10
jne 0x1400c4fd7
mov rcx, qword [rdi + 0x648]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x630]
mov rax, qword [rcx + 8]
mov r10, qword [rdi + 0x620]
cmp rax, r10
je 0x1400c4f1f
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400c4f0f
cmp rax, rcx
je 0x1400c4f1f
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400c4f00
test rax, rax
cmove rax, r10
cmp rax, r10
jne 0x1400c4fd7
mov rcx, qword [rdi + 0x6c8]
and rcx, r9
shl rcx, 4
add rcx, qword [rdi + 0x6b0]
mov rax, qword [rcx + 8]
mov r9, qword [rdi + 0x6a0]
cmp rax, r9
je 0x1400c4f6b
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1400c4f5f
nop dword [rax]
cmp rax, rcx
je 0x1400c4f6b
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1400c4f50
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x1400c4fd7
mov r9, rdx
mov r8d, 0xfffffff6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140110560
mov rbx, rax
lea rdx, str.Target_of_NonWritable_decoration_is_invalid:_must_point_to_a_storage_image__uniform_block_
mov rcx, rax
call fcn.14003e540
lea rax, str.storage_buffer__or_variable_in_Private_or_Function_storage_class
lea rdx, str.or_storage_buffer
cmp byte [rdi + 0x47c], 0
cmovne rdx, rax
mov rcx, rbx
call fcn.14003e540
mov ebx, dword [rbx + 0x160]
lea rcx, [rsp + 0x20]
call fcn.140076780
mov eax, ebx
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
call fcn.140076180
int3
Function at 0x1400de6b0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x4c8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x4f0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x4d8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400de74f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400de73e
nop dword [rax + rax]
cmp rax, rcx
je 0x1400de74f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400de730
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400de74f
add rax, 0x18
ret
xor eax, eax
ret

Function at 0x1400de760
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x508]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x530]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x518]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400de7ff
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1400de7ee
nop dword [rax + rax]
cmp rax, rcx
je 0x1400de7ff
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1400de7e0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1400de7ff
add rax, 0x18
ret
xor eax, eax
ret

Function at 0x1400df3a0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x128]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
imul r9, r11
shr rax, 0x18
xor r9, rax
mov rax, qword [r10 + 0x100]
imul r9, r11
and r8, r9
shl r8, 4
add r8, qword [r10 + 0x110]
mov rcx, qword [r8 + 8]
cmp rcx, rax
je 0x1400df43c
mov r8, qword [r8]
cmp edx, dword [rcx + 0x10]
je 0x1400df43e
nop dword [rax + rax]
cmp rcx, r8
je 0x1400df43c
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x1400df420
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
xor ecx, ecx
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
setne al
ret
Function at 0x140108b70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movzx r14d, r9b
mov rbp, r8
mov edi, edx
mov rsi, rcx
call fcn.140109870
mov rbx, rax
test rax, rax
je case.0x140108c18.26
lea r15, [0x140000000]
movabs r13, 0xcbf29ce484222325
movabs r12, 0x100000001b3
mov rcx, qword [rbp + 0x38]
mov qword [rsp + 0x20], rbx
test rcx, rcx
je 0x140108daa
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
test al, al
jne 0x140108d9d
movzx edx, word [rbx + 0x3a]
mov eax, edx
cmp edx, 0x1168
ja 0x140108cbe
je case.0x140108c18.23
add eax, 0xffffffe9
cmp eax, 0xa
ja case.0x140108c18.26
mov ecx, dword [r15 + rax*4 + 0x108db0]
add rcx, r15
jmp rcx
mov eax, edi
movzx edx, dil
xor rdx, r13
shr eax, 8
imul rdx, r12
movzx ecx, al
mov eax, edi
xor rdx, rcx
shr eax, 0x10
imul rdx, r12
movzx ecx, al
xor rdx, rcx
mov eax, edi
mov rcx, qword [rsi + 0xa8]
imul rdx, r12
shr rax, 0x18
xor rdx, rax
imul rdx, r12
and rcx, rdx
mov rdx, qword [rsi + 0x80]
shl rcx, 4
add rcx, qword [rsi + 0x90]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x140108c9a
mov rcx, qword [rcx]
cmp edi, dword [rax + 0x10]
je 0x140108c8e
nop dword [rax]
cmp rax, rcx
je 0x140108c9a
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x140108c80
test rax, rax
cmove rax, rdx
cmp rax, rdx
jne case.0x140108c18.26
test r14b, r14b
je case.0x140108c18.26
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 2
jbe 0x140108da4
movzx ecx, word [rcx + 0x20]
jmp 0x140108ce2
cmp eax, 0x14ee
jne case.0x140108c18.26
mov rcx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x20]
sub rax, rcx
sar rax, 4
cmp rax, 1
jbe 0x140108da4
movzx ecx, word [rcx + 0x10]
mov rax, qword [rbx]
mov edi, dword [rax + rcx*4]
mov edx, edi
mov rcx, rsi
call fcn.140109870
mov rbx, rax
test rax, rax
jne 0x140108bc4
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp edx, 0x21
jne 0x140108d27
test r14b, r14b
je case.0x140108c18.26
mov rcx, qword [rbx + 0x20]
mov edi, 1
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
sar rax, 4
cmp rax, rdi
jbe case.0x140108c18.26
mov edx, edi
nop word [rax + rax]
sub rcx, r8
sar rcx, 4
cmp rcx, rdx
jbe 0x140108da4
mov rax, qword [rbx]
add rdx, rdx
movzx r9d, r14b
movzx ecx, word [r8 + rdx*8]
mov r8, rbp
mov edx, dword [rax + rcx*4]
mov rcx, rsi
call fcn.140108b70
test al, al
jne 0x140108d9d
mov rcx, qword [rbx + 0x20]
inc edi
mov r8, qword [rbx + 0x18]
mov rax, rcx
sub rax, r8
mov edx, edi
sar rax, 4
cmp rdx, rax
jb 0x140108d50
jmp case.0x140108c18.26
mov al, 1
jmp 0x140108d00
call fcn.140076180
int3
call fcn.140113cf4
int3
Function at 0x140109870
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x1f8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x220]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x208]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010990f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1401098fe
nop dword [rax + rax]
cmp rax, rcx
je 0x14010990f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1401098f0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14010990f
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret

Function at 0x140109950
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x548]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x570]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x558]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1401099ef
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x1401099de
nop dword [rax + rax]
cmp rax, rcx
je 0x1401099ef
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x1401099d0
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x1401099ef
add rax, 0x18
ret
lea rax, [r10 + 0x580]
ret

Function at 0x14010a5d0
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x1f8]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x220]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x208]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010a66c
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14010a66e
nop dword [rax + rax]
cmp rax, rcx
je 0x14010a66c
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x14010a650
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
Function at 0x14010a860
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x80]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0xa8]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x90]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14010a8fc
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14010a8fe
nop dword [rax + rax]
cmp rax, rcx
je 0x14010a8fc
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x14010a8e0
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret
xor eax, eax
test rax, rax
cmove rax, r8
cmp rax, r8
setne al
ret

Function at 0x14010c310
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs r11, 0x100000001b3
movzx r9d, dl
mov r10, rcx
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
mov rbx, qword [r10 + 0x50]
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x40]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and r9, qword [r10 + 0x68]
mov r11, r9
shl r11, 4
add r11, rbx
mov rcx, qword [r11 + 8]
cmp rcx, r8
je 0x14010c3f5
mov rax, qword [r11]
cmp edx, dword [rcx + 0x10]
je 0x14010c39e
nop dword [rax + rax]
cmp rcx, rax
je 0x14010c3f5
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x14010c390
test rcx, rcx
je 0x14010c3f5
add r9, r9
mov rax, qword [rbx + r9*8]
cmp qword [r11 + 8], rcx
jne 0x14010c3c9
cmp rax, rcx
jne 0x14010c3bf
mov qword [rbx + r9*8], r8
mov qword [r11 + 8], r8
jmp 0x14010c3d5
mov r8, qword [rcx + 8]
mov qword [r11 + 8], r8
jmp 0x14010c3d5
cmp rax, rcx
jne 0x14010c3d5
mov rax, qword [rcx]
mov qword [rbx + r9*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x48]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140116d50
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140110800
Capabilities:
Hash data using fnv

Disassembly:
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov eax, edx
imul r9, r11
shr eax, 8
movzx r8d, al
mov eax, edx
xor r9, r8
shr eax, 0x10
mov r8, qword [r10 + 0x488]
imul r9, r11
movzx ecx, al
xor r9, rcx
mov eax, edx
mov rcx, qword [r10 + 0x4b0]
imul r9, r11
shr rax, 0x18
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x498]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14011089f
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x14011088e
nop dword [rax + rax]
cmp rax, rcx
je 0x14011089f
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x140110880
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14011089f
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x140110a90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov r10d, r8d
mov rbx, rdx
mov r9, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
movzx r8d, r8b
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
mov eax, r10d
shr eax, 8
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr eax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, rdx
mov eax, r10d
shr rax, 0x18
xor r8, rax
imul r8, rdx
mov rcx, qword [r9 + 0xe8]
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0xd0]
mov rax, qword [rcx + 8]
mov rdx, qword [r9 + 0xc0]
cmp rax, rdx
je 0x140110ba1
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x140110b55
cmp rax, rcx
je 0x140110ba1
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x140110b46
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x140110ba1
add rax, 0x18
cmp rbx, rax
je 0x140110ba1
mov rdi, qword [rax + 8]
mov rbp, qword [rax]
sub rdi, rbp
mov rdx, rdi
sar rdx, 3
test rdx, rdx
je 0x140110b8b
mov rcx, rbx
call fcn.140058d20
mov rsi, qword [rbx]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.140118d20
lea rax, [rdi + rsi]
mov qword [rbx + 8], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14011d804
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14011d697
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011d697
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011d697
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011d697
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011d697
cmp dword [rcx + 0x84], 0xe
jbe 0x14011d697
cmp dword [rcx + 0xf8], 0
je 0x14011d697
mov ecx, ebx
call fcn.14011d738
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14011d528
cmp dword [rbp + 0x20], 0
je 0x14011d6e4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011d6ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011d630

Function at 0x140139874
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140139894
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14011d45c
or eax, 0xffffffff
jmp 0x140139896
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400011c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov qword [rcx + 8], rax
mov rbx, rdx
mov qword [rcx + 0x10], rax
mov edi, r8d
mov dword [rcx + 0x18], eax
mov r10, rdx
mov word [rcx + 0x1c], ax
mov r9, rcx
neg rbx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x37
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 0xf], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 0xf
jb 0x1400011fb
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x140001264
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor eax, eax
mov r11, rcx
mov qword [rcx], rax
sub r11, rdx
mov rbx, rdx
mov qword [rcx + 8], rax
mov dword [rcx + 0x10], eax
neg rbx
mov edi, r8d
mov r10, rdx
mov r9, rcx
lea ecx, [r10 + rbx]
or cl, dil
movsx eax, cl
mov r8b, cl
not r8b
not cl
xor r8d, eax
movsx eax, cl
and r8d, 0x37
xor r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xff
sub r8d, eax
mov byte [r11 + r10 + 0xa], r8b
mov al, byte [r10]
xor al, r8b
mov byte [r11 + r10], al
inc r10
lea rax, [rbx + r10]
cmp rax, 0xa
jb 0x14000128f
mov rbx, qword [rsp + 8]
mov rax, r9
mov rdi, qword [rsp + 0x10]
ret

Function at 0x1400012f8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xf]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xf
jb 0x1400012fe
mov rax, rcx
ret

Function at 0x140001314
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xa]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xa
jb 0x14000131a
mov rax, rcx
ret