joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141156058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1411561df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141156089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14115606f
add dl, dl
jne 0x141156096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411560f6
xor eax, eax
add dl, dl
jne 0x1411560a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1411561ad
add dl, dl
jne 0x1411560b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411560c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411560d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1411560dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1411560ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14115607e
mov eax, 1
add dl, dl
jne 0x141156106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141156113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1411560fb
sub eax, ebx
mov ebx, 1
jne 0x14115614c
mov ecx, 1
add dl, dl
jne 0x14115612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14115613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141156123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14115607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141156168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141156175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14115615d
cmp eax, 0x7d00
jae 0x14115619b
cmp eax, 0x500
jb 0x141156196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14115607e
cmp eax, 0x7f
ja 0x14115619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14115607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1411561d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14115607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400113a7
Capabilities:
Terminate process

Disassembly:
jmp 0x140019b20
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400114a1
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001ae70
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001ae90
xor al, al
jmp 0x14001af11
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001aea3
xor al, al
jmp 0x14001af11
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001aecd
xor al, al
jmp 0x14001af11
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001aee1
xor al, al
jmp 0x14001af11
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001aef3
xor al, al
jmp 0x14001af11
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001af0f
xor al, al
jmp 0x14001af11
mov al, 1
add rsp, 0x38
ret
Function at 0x18000ce50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r9, qword [rdx + 0x10]
mov r8, rdx
mov r10, rcx
jb 0x18000ce64
mov r8, qword [rdx]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x18000ce94
movabs r11, 0x100000001b3
nop
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r11
cmp rdx, r9
jb 0x18000ce80
mov rdx, qword [r10 + 0x28]
mov rax, rcx
shr rax, 0x20
xor rax, rcx
and rax, rdx
cmp qword [r10 + 0x30], rax
ja 0x18000ceb8
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
ret
Function at 0x1800197a8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 2
jae 0x180019811
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x1800197e1
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
mov r8, rcx
and r8, r9
cmp qword [r10 + 0x30], r8
ja 0x18001983d
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov qword [rsp + 0x48], r8
mov rbx, qword [r10]
add r8, r8
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r8*8], rbx
je 0x18001985a
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r8*8]
je 0x1800198c5
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
movzx eax, word [rbx + 0x10]
cmp word [r11], ax
je 0x18001987f
jmp 0x180019864
movzx eax, word [r11]
cmp word [rbx + 0x10], ax
je 0x180019893
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x1800198c5
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x18001995c
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x1800198ff
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x18001991b
mov qword [rdx + r8*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8*8 + 8], rdi
jmp 0x18001994a
cmp rax, rbx
jne 0x180019926
mov qword [rdx + r8*8], rdi
jmp 0x18001994a
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x18001994a
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.180037de4
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180019970
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 4
jae 0x1800199d9
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x1800199a9
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
mov r8, rcx
and r8, r9
cmp qword [r10 + 0x30], r8
ja 0x180019a05
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov qword [rsp + 0x48], r8
mov rbx, qword [r10]
add r8, r8
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r8*8], rbx
je 0x180019a22
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r8*8]
je 0x180019a89
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
mov eax, dword [rbx + 0x10]
cmp dword [r11], eax
je 0x180019a45
jmp 0x180019a2c
mov eax, dword [r11]
cmp dword [rbx + 0x10], eax
je 0x180019a57
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x180019a89
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180019b20
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x180019ac3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x180019adf
mov qword [rdx + r8*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8*8 + 8], rdi
jmp 0x180019b0e
cmp rax, rbx
jne 0x180019aea
mov qword [rdx + r8*8], rdi
jmp 0x180019b0e
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x180019b0e
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.180037ecc
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180019b34
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 8
jae 0x180019b9d
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x180019b6d
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
mov r8, rcx
and r8, r9
cmp qword [r10 + 0x30], r8
ja 0x180019bc9
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov qword [rsp + 0x48], r8
mov rbx, qword [r10]
add r8, r8
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r8*8], rbx
je 0x180019be6
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r8*8]
je 0x180019c4f
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r11], rax
je 0x180019c0a
jmp 0x180019bf0
mov rax, qword [r11]
cmp qword [rbx + 0x10], rax
je 0x180019c1d
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x180019c4f
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180019ce6
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x180019c89
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x180019ca5
mov qword [rdx + r8*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8*8 + 8], rdi
jmp 0x180019cd4
cmp rax, rbx
jne 0x180019cb0
mov qword [rdx + r8*8], rdi
jmp 0x180019cd4
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x180019cd4
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.18003809c
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180019cf8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 1
jae 0x180019d5e
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x180019d2e
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
and r9, rcx
cmp qword [r10 + 0x30], r9
ja 0x180019d87
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r9, rax
mov qword [rsp + 0x40], r9
mov rbx, qword [r10]
add r9, r9
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r9*8], rbx
je 0x180019da9
mov rbx, qword [rcx + r9*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r9*8]
je 0x180019e19
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
mov al, byte [rbx + 0x10]
cmp byte [r8], al
je 0x180019dc7
jmp 0x180019dae
mov al, byte [r8]
cmp byte [rbx + 0x10], al
je 0x180019dd9
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x180019e19
mov rdi, qword [rsp + 0x78]
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rdx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
lea rcx, [rdi + 0x10]
xor edx, edx
call fcn.180032ee0
mov rcx, rdi
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180019eb0
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x180019e53
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r9*8]
cmp rax, qword [r10]
jne 0x180019e6f
mov qword [rdx + r9*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r9*8 + 8], rdi
jmp 0x180019e9e
cmp rax, rbx
jne 0x180019e7a
mov qword [rdx + r9*8], rdi
jmp 0x180019e9e
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r9*8 + 8], rcx
cmp rcx, rdi
je 0x180019e9e
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r9*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r9*8 + 8], rcx
mov rcx, r10
call fcn.180037b2c
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18001a2c4
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov byte [rax + 0x20], r9b
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov r15, rdx
mov r14, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x48], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 2
jae 0x18001a32a
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x18001a2fa
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r14 + 0x28]
mov rsi, rcx
and rsi, r9
cmp qword [r14 + 0x30], rsi
ja 0x18001a356
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rsi, rax
mov qword [rsp + 0x48], rsi
mov rbx, qword [r14]
add rsi, rsi
mov rcx, qword [r14 + 0x10]
cmp qword [rcx + rsi*8], rbx
je 0x18001a373
mov rbx, qword [rcx + rsi*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + rsi*8]
je 0x18001a3bb
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
movzx eax, word [rbx + 0x10]
cmp word [r8], ax
je 0x18001a398
jmp 0x18001a37d
movzx eax, word [r8]
cmp word [rbx + 0x10], ax
je 0x18001a3ac
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x18001a3bb
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rdx
jmp 0x18001a468
mov r9b, byte [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.1800172ec
mov rdi, qword [rsp + 0x38]
mov rax, qword [rdi]
cmp rbx, rax
je 0x18001a40a
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r14]
jne 0x18001a426
mov qword [rdx + rsi*8], rdi
mov rax, qword [r14 + 0x10]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x18001a455
cmp rax, rbx
jne 0x18001a431
mov qword [rdx + rsi*8], rdi
jmp 0x18001a455
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x18001a455
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r14
call fcn.180037de4
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop r15
pop r14
pop rdi
ret
Function at 0x18001a480
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 2
jae 0x18001a4e9
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x18001a4b9
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
mov r8, rcx
and r8, r9
cmp qword [r10 + 0x30], r8
ja 0x18001a515
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov qword [rsp + 0x48], r8
mov rbx, qword [r10]
add r8, r8
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r8*8], rbx
je 0x18001a532
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r8*8]
je 0x18001a59d
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
movzx eax, word [rbx + 0x10]
cmp word [r11], ax
je 0x18001a557
jmp 0x18001a53c
movzx eax, word [r11]
cmp word [rbx + 0x10], ax
je 0x18001a56b
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x18001a59d
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x18001a634
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x18001a5d7
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x18001a5f3
mov qword [rdx + r8*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8*8 + 8], rdi
jmp 0x18001a622
cmp rax, rbx
jne 0x18001a5fe
mov qword [rdx + r8*8], rdi
jmp 0x18001a622
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x18001a622
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.180037de4
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18001a6a8
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rax - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov r11, r8
mov rsi, rdx
mov r10, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rax - 0x38], r9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
cmp rcx, 4
jae 0x18001a711
movzx eax, byte [rcx + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
movabs rax, 0x100000001b3
imul r9, rax
mov qword [rsp + 0x20], r9
inc rcx
jmp 0x18001a6e1
mov rax, r9
shr rax, 0x20
xor r9, rax
mov qword [rsp + 0x20], r9
mov rcx, qword [r10 + 0x28]
mov r8, rcx
and r8, r9
cmp qword [r10 + 0x30], r8
ja 0x18001a73d
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add r8, rax
mov qword [rsp + 0x48], r8
mov rbx, qword [r10]
add r8, r8
mov rcx, qword [r10 + 0x10]
cmp qword [rcx + r8*8], rbx
je 0x18001a75a
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x28], rbx
cmp rbx, qword [rcx + r8*8]
je 0x18001a7c1
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x28], rbx
mov eax, dword [rbx + 0x10]
cmp dword [r11], eax
je 0x18001a77d
jmp 0x18001a764
mov eax, dword [r11]
cmp dword [rbx + 0x10], eax
je 0x18001a78f
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rbx
jmp 0x18001a7c1
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r10 + 8]
call fcn.180069aa4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x18001a858
mov rdi, qword [rsp + 0x78]
mov rax, qword [rdi]
cmp rbx, rax
je 0x18001a7fb
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r10]
jne 0x18001a817
mov qword [rdx + r8*8], rdi
mov rax, qword [r10 + 0x10]
mov qword [rax + r8*8 + 8], rdi
jmp 0x18001a846
cmp rax, rbx
jne 0x18001a822
mov qword [rdx + r8*8], rdi
jmp 0x18001a846
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x18001a846
mov rdx, qword [r10 + 0x10]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rcx, r10
call fcn.180037ecc
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret