joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004fc60
Capabilities:
Create thread
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [rcx + 0x12c]
mov rbx, rcx
cmp eax, 0xffffffce
jne 0x18004fc82
lea edx, [rax + 0x39]
call fcn.180051700
mov eax, dword [rbx + 0x12c]
cmp eax, 2
jne 0x18004fc96
xor edx, edx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.180051700
mov qword [rsp + 0x28], 0
lea r8, [0x180050450]
mov r9, rbx
mov dword [rsp + 0x20], 4
xor edx, edx
mov dword [rbx + 0x12c], 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x1b8], rax
test rax, rax
jne 0x18004fce1
lea edx, [rax + 0xa]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.180051700
mov edx, dword [rbx + 0x1e4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x1b8]
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_ResumeThread]
Function at 0x180058020
Capabilities:
Enumerate files on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x190
mov rax, qword [0x18013d010]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rsi, r8
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rsp + 0x20], 1
lea r8d, [rbp + 2]
lea rdx, [0x180109c40]
mov rcx, r14
call fcn.180054420
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x40]
call fcn.1800a0c80
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x1800580a9
mov rcx, qword [r14]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18005816e
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x180058164
test byte [rsp + 0x40], 0x10
jne 0x18005814e
xor edx, edx
mov rcx, rsi
call fcn.180053c50
mov rdx, rax
lea rcx, [rsp + 0x6c]
call fcn.1800a066c
test rax, rax
je 0x18005814e
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x18005813e
mov qword [rax], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], 0xf
lea rcx, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x180058120
lea rdx, [rsp + 0x6c]
mov rcx, rax
call fcn.1800542c0
add qword [rbx + 8], 0x20
jmp 0x18005814e
lea r8, [rsp + 0x6c]
mov rdx, rax
mov rcx, rbx
call fcn.18008f8c0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1800580d7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rcx, r14
call fcn.1800540d0
nop
mov rcx, rsi
call fcn.1800540d0
mov rax, rbx
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.180099cf0
add rsp, 0x190
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180058d70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov esi, ecx
mov dword [rsp + 0x38], esi
mov ecx, dword [0x18016a524]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180171d88], ecx
jle 0x180058e7b
lea rcx, [0x180171d88]
call fcn.18009a27c
cmp dword [0x180171d88], 0xffffffff
jne 0x180058e7b
xorps xmm0, xmm0
movups xmmword [0x180171a00], xmm0
movups xmmword [0x180171a10], xmm0
movups xmmword [0x180171a20], xmm0
movups xmmword [0x180171a30], xmm0
movss dword [0x180171a00], xmm0
xor ebx, ebx
mov qword [0x180171a08], rbx
mov qword [0x180171a10], rbx
lea ecx, [rbx + 0x20]
call fcn.18009a38c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x180171a08], rax
mov qword [0x180171a18], rbx
xorps xmm0, xmm0
movdqa xmmword [0x180171a20], xmm0
mov qword [0x180171a30], 7
mov qword [0x180171a38], 8
movss xmm0, dword [0x180125ae8]
movss dword [0x180171a00], xmm0
mov r8, rax
lea edx, [rbx + 0x10]
lea rcx, [0x180171a18]
call fcn.18008f2d0
nop
lea rcx, [0x1800d50b0]
call fcn.18009a75c
nop
lea rcx, [0x180171d88]
call fcn.18009a21c
cmp qword [0x180171a10], 0
jne 0x180058edd
lea rdi, [0x18013de70]
lea rbp, [0x18014f938]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rdi]
mov rax, qword [0x180171608]
add rax, 0x18b720
mov edx, 0xffffffff
mov rcx, rbx
call rax
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.1800924f0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
add rdi, 8
cmp rdi, rbp
jne 0x180058ea0
movzx ecx, sil
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [rsp + 0x39]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x3a]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x3b]
xor rcx, rax
imul rcx, rdx
and rcx, qword [0x180171a30]
add rcx, rcx
mov rdx, qword [0x180171a18]
mov rax, qword [rdx + rcx*8 + 8]
mov r8, qword [0x180171a08]
cmp rax, r8
je 0x180058f6e
mov rcx, qword [rdx + rcx*8]
cmp esi, dword [rax + 0x10]
je 0x180058f5e
nop dword [rax + rax]
cmp rax, rcx
je 0x180058f6e
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x180058f50
test rax, rax
je 0x180058f6e
cmp rax, r8
je 0x180058f6e
mov rax, qword [rax + 0x18]
jmp 0x180058f90
mov r9d, esi
lea r8, str.0x_08X
mov edx, 0xc
lea rcx, [0x180171c88]
call fcn.1800553d0
lea rax, [0x180171c88]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1800803c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov r9d, edx
and r10d, 7
je 0x18008044d
cmp edx, r10d
jge 0x18008043e
mov r9d, dword [rcx + 0x14]
mov eax, 1
mov ecx, edx
mov r8d, edx
shl eax, cl
cmp r9d, eax
jae 0x180080437
mov r11, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r11
jb 0x180080402
xor cl, cl
jmp 0x18008040b
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
lea edx, [r8 + 8]
mov ecx, r8d
mov dword [rbx + 0x10], edx
shl eax, cl
or r9d, eax
mov dword [rbx + 0x14], r9d
cmp edx, 0x18
jg 0x18008043e
mov ecx, edx
mov eax, 1
shl eax, cl
mov r8d, edx
cmp r9d, eax
jb 0x1800803f6
mov rax, qword [rbx + 8]
mov qword [rbx], rax
mov ecx, r10d
shr dword [rbx + 0x14], cl
sub edx, r10d
mov dword [rbx + 0x10], edx
mov r9d, edx
xor r10d, r10d
test edx, edx
jle 0x180080482
mov ecx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop dword [rax]
movzx eax, byte [rbx + 0x14]
lea edx, [r9 - 8]
shr ecx, 8
inc r10d
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], ecx
mov r9d, edx
test edx, edx
jg 0x180080460
mov dword [rbx + 0x10], edx
jns 0x1800804af
mov edx, dword [0x18016a524]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r10d
cmp rcx, 4
jge 0x1800804df
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop
cmp rax, r8
jb 0x1800804c9
xor dl, dl
jmp 0x1800804d2
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800804c0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180080484
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180080554
mov edx, dword [0x18016a524]
mov rax, qword gs:[0x58]
mov ecx, 0x28
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18008056e
mov rcx, rbx
call fcn.18007f820
test eax, eax
je 0x180080547
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.1800a0f40
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x18008bbe0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18013d010]
xor rax, rsp
mov qword [rsp + 0x28], rax
call fcn.18009e798
mov rcx, qword [0x180171608]
lea r8, [0x180171180]
add rcx, 0x6a08a0
lea rdx, [0x18008b7b0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711c8]
add rcx, 0x6a2770
lea rdx, [0x18008ba30]
call fcn.18009e5dc
mov rax, qword [0x180171608]
lea rcx, [0x180059010]
add rax, 0x1d2bd2
mov dword [rsp + 0x20], 0
mov qword [0x180169310], rax
lea r9, [rsp + 0x20]
mov rax, qword [0x180169328]
mov r8d, 0x40
mov qword [rax + 2], rcx
mov rdx, qword [0x180169318]
mov rcx, qword [0x180169310]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18008bce3
mov r8, qword [0x180169318]
mov rdx, qword [0x180169310]
mov rcx, qword [0x180169320]
call fcn.1800a0f40
mov r8, qword [0x180169318]
mov rdx, qword [0x180169328]
mov rcx, qword [0x180169310]
call fcn.1800a0f40
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, qword [0x180169318]
mov rcx, qword [0x180169310]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdi, qword [0x1801715f8]
mov rbx, qword [0x1801715f0]
cmp rbx, rdi
je 0x18008bd19
nop word [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.18009e5dc
add rbx, 0x18
cmp rbx, rdi
jne 0x18008bd00
mov rdi, qword [0x1801715b0]
mov rbx, qword [0x1801715a8]
cmp rbx, rdi
je 0x18008bd49
nop dword [rax]
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.18009e5dc
add rbx, 0x18
cmp rbx, rdi
jne 0x18008bd30
mov rcx, qword [0x180171608]
lea r8, [0x180171198]
add rcx, 0xa36b90
lea rdx, [0x18005b160]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711b0]
add rcx, 0xba6e0
lea rdx, [0x18005b180]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x180171188]
add rcx, 0x364da0
lea rdx, [0x18005b1c0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x180171160]
add rcx, 0x476dc0
lea rdx, [0x18005b1e0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x180171190]
add rcx, 0x55e8c0
lea rdx, [0x18005b210]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711b8]
add rcx, 0x414b60
lea rdx, [0x1800642d0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711d0]
add rcx, 0x412240
lea rdx, [0x1800642b0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x180171178]
add rcx, 0x307ec0
lea rdx, [0x18008bb60]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x180171168]
add rcx, 0x547560
lea rdx, [0x1800643c0]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711a0]
add rcx, 0x4e22d0
lea rdx, [0x180064460]
call fcn.18009e5dc
mov rcx, qword [0x180171608]
lea r8, [0x1801711c0]
add rcx, 0x49e860
lea rdx, [0x180064490]
call fcn.18009e5dc
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180099cf0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18008e340
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18008e3ec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x18008e37a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x18008ec20
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x18008e3ba
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.18009a07c
mov rcx, rbx
test rbx, rbx
jne 0x18008e3a0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180092180
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x18008ed24
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x18008ed30
cmp rbx, rbp
jne 0x18008ecd0
cmp qword [rsp + 0x20], r14
jne 0x18008ecfd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x18008ed3f
mov qword [r15], r12
mov rax, r12
jmp 0x18008ed42
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x18008ecfd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x18008edd6
cmp rbx, rbp
jne 0x18008edb0
jmp 0x18008ecfa
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x18008ed50
jmp 0x18008ecfd
Function at 0x18008e460
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18008e50c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x18008e49a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x18008edf0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x18008e4da
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.18009a07c
mov rcx, rbx
test rbx, rbx
jne 0x18008e4c0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180092180
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x18008eef4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x18008ef00
cmp rbx, rbp
jne 0x18008eea0
cmp qword [rsp + 0x20], r14
jne 0x18008eecd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x18008ef0f
mov qword [r15], r12
mov rax, r12
jmp 0x18008ef12
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x18008eecd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x18008efa6
cmp rbx, rbp
jne 0x18008ef80
jmp 0x18008eeca
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x18008ef20
jmp 0x18008eecd
Function at 0x18008ec20
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18008e3ec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x18008e37a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x18008ec20
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x18008e3ba
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.18009a07c
mov rcx, rbx
test rbx, rbx
jne 0x18008e3a0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180092180
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x18008ed24
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x18008ed30
cmp rbx, rbp
jne 0x18008ecd0
cmp qword [rsp + 0x20], r14
jne 0x18008ecfd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x18008ed3f
mov qword [r15], r12
mov rax, r12
jmp 0x18008ed42
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x18008ecfd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x18008edd6
cmp rbx, rbp
jne 0x18008edb0
jmp 0x18008ecfa
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x18008ed50
jmp 0x18008ecfd
Function at 0x18008edf0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x18008e50c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x18008e49a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x18008edf0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x18008e4da
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.18009a07c
mov rcx, rbx
test rbx, rbx
jne 0x18008e4c0
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.180092180
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x18008eef4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x18008ef00
cmp rbx, rbp
jne 0x18008eea0
cmp qword [rsp + 0x20], r14
jne 0x18008eecd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x18008ef0f
mov qword [r15], r12
mov rax, r12
jmp 0x18008ef12
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x18008eecd
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.18009a07c
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x18008efa6
cmp rbx, rbp
jne 0x18008ef80
jmp 0x18008eeca
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x18008ef20
jmp 0x18008eecd