joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800083cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1800083ec
and qword [r8], 0
lea rdx, [0x1801103f8]
call fcn.1800082a8
mov rbx, rax
test rax, rax
je 0x1800084dd
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1800084d4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800084d4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1800084d4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1800084d4
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x1800084d4
mov rax, qword [0x18011dcc0]
test rax, rax
je 0x180008471
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1800084d4
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x1800084c1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18011dcc0]
test rax, rax
je 0x1800084b6
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1800084dd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1800084cf
mov qword [rsi], rbp
mov rax, rdi
jmp 0x1800084df
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18000ad6c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0xf8]
mov r8, rdx
mov qword [rsp + 0x20], rdx
mov r9, rcx
movsxd rdx, dword [rcx + 0xf0]
mov r10d, 8
mov ebx, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x20]
not ebx
movzx eax, byte [rdx]
inc rdx
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1800a7290]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000adab
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1210], ebx
jne 0x18000ade2
lea edx, [r10 + 0xc]
mov ecx, ebx
call fcn.18001b36c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009d0f0
add rsp, 0x30
pop rbx
ret
Function at 0x18000adf8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsxd r8, dword [rcx + 0xf0]
mov r11d, 4
mov rax, qword [rcx + 0xf8]
mov r9, rcx
mov dword [rsp + 0x20], edx
mov r10d, r11d
mov ebx, dword [rax + r8*4 - 4]
lea r8, [rsp + 0x20]
not ebx
movzx eax, byte [r8]
inc r8
movzx ecx, bl
xor rcx, rax
shr ebx, 8
lea rax, [0x1800a7290]
xor ebx, dword [rax + rcx*4]
sub r10, 1
jne 0x18000ae37
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x1210], ebx
jne 0x18000ae71
movsxd r8, edx
mov ecx, ebx
mov edx, r11d
call fcn.18001b36c
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009d0f0
add rsp, 0x30
pop rbx
ret

Function at 0x18000ae88
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x10], rax
movss xmm2, dword [rcx + 0x110]
lea r9, [rsp]
movss xmm3, dword [rcx + 0x114]
mov r10d, 0x10
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
mov rax, qword [rcx + 0xf8]
subss xmm1, xmm3
movsxd rcx, dword [rcx + 0xf0]
movss dword [rsp], xmm0
movss xmm0, dword [rdx + 8]
mov r8d, dword [rax + rcx*4 - 4]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
not r8d
movss xmm1, dword [rdx + 0xc]
subss xmm1, xmm3
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
movzx ecx, byte [r9]
lea rax, [0x1800a7290]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18000af05
not r8d
mov eax, r8d
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.18009d0f0
add rsp, 0x28
ret
Function at 0x18001a064
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x2f40], 0
lea rbx, [rcx + 0x2f48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x18001a0fd
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x18001a0b5
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001c294
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.180008d9c
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x2f40]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x18011dcb8]
movsxd r8, eax
mov rax, qword [rdi + 0x2f50]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x18001a105
mov rcx, rbx
call fcn.180008d9c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001a7c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18011dcc0]
mov rbx, rcx
and dword [rax + 0x2ea4], 0
test rcx, rcx
je 0x18001a829
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18001a834
lea rdx, [0x1801103fc]
mov rcx, rbx
mov rdi, rax
call fcn.1800082a8
mov rbx, rax
test rax, rax
je 0x18001a829
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18003619c
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x1800361da
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
and qword [rsp + 0x28], 0
lea r8, [0x180035df8]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800361e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1800361e8
test edx, edx
jne 0x1800361e8
test r8, r8
jne 0x1800361e8
call fcn.180035f8c
mov eax, 1
add rsp, 0x38
ret

Function at 0x1800367f8
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x1800368a2
mov rax, qword [rcx]
test rax, rax
je 0x180036841
mov rdx, qword [rax + 0x480]
test rdx, rdx
je 0x180036841
call rdx
test al, al
je 0x180036841
lea eax, [rbx + 1]
jmp 0x1800368e9
mov rax, qword [rdi]
test rax, rax
jne 0x180036853
mov rax, rbx
mov qword [rsp + 0x20], rbx
jmp 0x18003687c
mov rdx, qword [rax + 0x4b0]
test rdx, rdx
je 0x180036849
mov rcx, rdi
call rdx
test al, al
je 0x18003686f
mov eax, 2
jmp 0x1800368e9
mov qword [rsp + 0x20], rbx
mov rax, rbx
test rdi, rdi
je 0x1800368aa
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800368aa
mov r8, qword [rcx + 0x110]
test r8, r8
je 0x1800368aa
lea rdx, [rsp + 0x20]
mov rcx, rdi
call r8
mov rax, qword [rsp + 0x20]
jmp 0x1800368aa
mov rax, rbx
mov qword [rsp + 0x20], rbx
test rax, rax
je 0x1800368e7
mov r8, qword [rax + 8]
test r8, r8
je 0x1800368e7
cmp byte [r8], bl
je 0x1800368e7
movsx ecx, byte [r8]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea rcx, [r8 + 1]
call fcn.18003e03c
cmp eax, 0x94f0c692
mov ecx, 3
cmove ebx, ecx
mov eax, ebx
jmp 0x1800368e9
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18009d0f0
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18003e03c
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x18003e05a
movsx eax, byte [rcx]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
call fcn.18003e03c
mov edx, eax
mov eax, edx
add rsp, 0x28
ret

Function at 0x18003ebd4
Capabilities:
Hash data using fnv

Disassembly:
test rcx, rcx
je 0x18003ee29
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x40
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov rax, qword [rcx]
test rax, rax
je 0x18003ee0d
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x18003ee0d
call rdx
test rax, rax
je 0x18003ee0d
cmp byte [rax], 0
je 0x18003ee0d
movsx ecx, byte [rax]
xor ecx, 0x811c9dc5
imul edx, ecx, 0x1000193
lea rcx, [rax + 1]
call fcn.18003e03c
cmp eax, 0xa6abe875
jne 0x18003ee0d
and qword [rsp + 0x20], 0
lea rax, str.attacker
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
test rax, rax
je 0x18003ec84
mov r8, qword [rax + 0x80]
test r8, r8
je 0x18003ec84
lea rdx, [rsp + 0x20]
mov rcx, rbx
call r8
mov rdi, rax
jmp 0x18003ec86
xor edi, edi
and qword [rsp + 0x20], 0
lea rax, str.userid
mov qword [rsp + 0x28], rax
mov rax, qword [rbx]
test rax, rax
je 0x18003ecb9
mov r8, qword [rax + 0x80]
test r8, r8
je 0x18003ecb9
lea rdx, [rsp + 0x20]
mov rcx, rbx
call r8
jmp 0x18003ecbb
xor eax, eax
cmp rdi, rax
je 0x18003ee0d
mov rax, qword [0x18011def0]
test rax, rax
je 0x18003ee0d
or ecx, 0xffffffff
call rax
test rax, rax
je 0x18003ee0d
cmp rdi, rax
jne 0x18003ee0d
mov rcx, rax
call fcn.180036414
mov rcx, rax
call fcn.180040d7c
mov rbx, rax
test rax, rax
je 0x18003ee0d
mov edx, dword [0x18011dc8c]
mov rcx, qword gs:[0x58]
mov ebp, 4
mov rdi, qword [rcx + rdx*8]
mov ecx, dword [rdi + rbp]
cmp dword [0x18011df04], ecx
jle 0x18003ed69
lea rcx, [0x18011df04]
call fcn.18009d59c
cmp dword [0x18011df04], 0xffffffff
jne 0x18003ed69
mov edx, 0x4ab1b579
mov r9d, 0x51b23a93
lea rcx, str.C_BasePlayerPawn
call fcn.1800417cc
mov word [0x18011df34], ax
lea rcx, [0x18011df04]
call fcn.18009d530
movsx rax, word [0x18011df34]
mov rbx, qword [rax + rbx]
test rbx, rbx
je 0x18003ee0d
mov eax, dword [rdi + rbp]
cmp dword [0x18011def8], eax
jle 0x18003edc8
lea rcx, [0x18011def8]
call fcn.18009d59c
cmp dword [0x18011def8], 0xffffffff
jne 0x18003edc8
mov edx, 0x634d2280
mov r9d, 0x940131c5
lea rcx, str.CPlayer_WeaponServices
call fcn.1800417cc
mov word [0x18011df84], ax
lea rcx, [0x18011def8]
call fcn.18009d530
movsx rcx, word [0x18011df84]
add rcx, rbx
call fcn.180040d7c
test rax, rax
je 0x18003ee0d
mov rcx, rax
call fcn.18003650c
test rax, rax
je 0x18003ee0d
mov rcx, rax
call fcn.180036490
test rax, rax
je 0x18003ee0d
mov rcx, qword [rax]
test rcx, rcx
je 0x18003ee0d
mov rdx, qword [rcx + 0x68]
test rdx, rdx
je 0x18003ee0d
mov rcx, rax
call rdx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009d0f0
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18003fb04
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [rcx]
lea r9, [rbp - 0x29]
and qword [rbp - 0x29], 0
lea r8, [0x180111348]
xor edx, edx
mov rbx, rcx
call qword [rax + 0x48]
cmp qword [rbp - 0x29], 0
je 0x18003f28a
mov rax, qword [rbx]
lea rdx, [rbp - 9]
mov rcx, rbx
call qword [rax + 0x60]
and qword [rbp - 0x19], 0
lea rbx, [0x18011ddf0]
and dword [rbp - 0x11], 0
lea r8, [rbp - 0x21]
cmp dword [rbp + 7], 0x1d
mov eax, 0x1c
mov rcx, qword [0x18011de30]
mov r9, rbx
cmovne eax, dword [rbp + 7]
mov rdx, qword [rbp - 0x29]
mov dword [rbp - 0x21], eax
mov dword [rbp - 0x1d], 6
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x18003f280
mov rcx, qword [0x18011de30]
lea r8, [rbp - 0x21]
mov rdx, qword [rbp - 0x29]
mov r9, rbx
mov dword [rbp - 0x1d], 4
mov rax, qword [rcx]
call qword [rax + 0x48]
test eax, eax
jns 0x18003f280
mov rcx, qword [0x18011de30]
mov r9, rbx
mov rdx, qword [rbp - 0x29]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x29]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18009d0f0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rbp
ret
push rbx
sub rsp, 0x30
mov rax, qword [0x18011dcc0]
mov rbx, rcx
test rax, rax
je 0x18003fc46
cmp byte [0x18011e060], 0
jne 0x18003fc46
cmp qword [rax + 0xa0], 0
jne 0x18003fb74
mov rax, qword [rcx]
lea r8, [0x18011de30]
lea rdx, [0x180111338]
call qword [rax + 0x38]
test eax, eax
js 0x18003fb6d
mov rcx, qword [0x18011de30]
lea rdx, [0x18011de40]
mov rax, qword [rcx]
call qword [rax + 0x140]
call fcn.180026b4c
call fcn.18003a048
mov rax, qword [0x18011dcc0]
cmp qword [0x18011ddf0], 0
jne 0x18003fb8b
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp 0x18003f1b0
test rax, rax
je 0x18003fb99
mov rcx, qword [rax + 0xa0]
jmp 0x18003fb9b
xor ecx, ecx
cmp qword [rcx + 0x48], 0
jne 0x18003fba7
call fcn.18002667c
call fcn.180027380
call fcn.18000bb8c
xor r8d, r8d
xor edx, edx
mov ecx, 0x208
call fcn.180013a98
test al, al
je 0x18003fbf5
and qword [rsp + 0x28], 0
lea r9, [0x180000000]
and dword [rsp + 0x20], 0
lea r8, [0x180035cdc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18003fbf5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180036588
call fcn.18003a3cc
call fcn.18000da4c
mov rcx, qword [0x18011de40]
lea r8, [0x18011ddf0]
xor r9d, r9d
mov rax, qword [rcx]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rax, qword [0x18011dcc0]
mov rcx, qword [rax + 0x1ba0]
mov rdx, qword [rcx]
add rdx, 0x48
mov al, byte [rdx]
neg al
sbb rcx, rcx
and rcx, rdx
call fcn.180025a8c
add rsp, 0x30
pop rbx
ret
Function at 0x180040cbc
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r9, rcx
xor r8d, r8d
mov rcx, qword [rcx + 0x80]
mov r10b, dl
cmp byte [rcx], r8b
je 0x180040d12
movsx eax, byte [rcx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
inc rcx
call fcn.18003e03c
cmp eax, 0xf102793d
jne 0x180040d12
test r10b, r10b
je 0x180040d07
mov eax, 0x1f4
cmp word [r9 + 0x10], ax
setae r8b
jmp 0x180040d0d
mov r8d, 1
mov al, r8b
jmp 0x180040d14
xor al, al
add rsp, 0x28
ret

Function at 0x180040d1c
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov r9b, dl
mov rcx, qword [rcx + 0x80]
cmp byte [rcx], 0
je 0x180040d72
movsx eax, byte [rcx]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
inc rcx
call fcn.18003e03c
cmp eax, 0x1c826fb7
jne 0x180040d72
movzx ecx, word [r8 + 0x10]
mov eax, 0x13a4
sub cx, ax
mov eax, 1
cmp cx, ax
seta cl
test r9b, r9b
movzx edx, cl
cmovne eax, edx
jmp 0x180040d74
xor al, al
add rsp, 0x28
ret
Function at 0x1800414c0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rbx, rdx
mov dword [rbp + 0x17], r8d
mov rcx, qword [0x18011e068]
test rcx, rcx
je 0x1800415cc
mov rax, qword [rcx]
test rax, rax
je 0x1800415cc
mov r9, qword [rax + 0x68]
test r9, r9
je 0x1800415cc
xor r8d, r8d
lea rdx, str.client.dll
call r9
test rax, rax
je 0x1800415cc
xor ecx, ecx
mov qword [rbp + 7], rcx
mov rdx, qword [rax]
test rdx, rdx
je 0x180041559
mov r9, qword [rdx + 0x10]
test r9, r9
je 0x180041559
mov r8, rbx
lea rdx, [rbp + 7]
mov rcx, rax
call r9
mov rcx, qword [rbp + 7]
test rcx, rcx
jne 0x1800415f6
and qword [rbp - 0x49], rcx
mov ecx, 0x18
call fcn.18009d994
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp - 0x51], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x41], xmm0
and qword [rbp - 0x31], 0
mov qword [rbp - 0x29], 7
mov qword [rbp - 0x21], 8
mov dword [rbp - 0x59], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rbp - 0x41]
call fcn.180041bc4
nop
lea r9, [rbp - 0x59]
lea r8, [rbp + 0x17]
lea rdx, [rbp + 7]
call fcn.1800420c4
nop
lea rcx, [rbp - 0x59]
call fcn.18004172c
xor al, al
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18009d0f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
movsx rbx, word [rcx + 0x1c]
mov r14, qword [rcx + 0x28]
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x19]
call fcn.180042590
mov rdi, qword [rax]
xorps xmm0, xmm0
test rbx, rbx
js 0x18004161e
cvtsi2ss xmm0, rbx
jmp 0x180041636
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
divss xmm0, dword [rdi + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor eax, eax
movabs r12, 0x8000000000000000
movss xmm6, dword [0x1801131fc]
comiss xmm0, xmm6
jb 0x180041665
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x180041665
mov rax, r12
cvttss2si rsi, xmm0
add rsi, rax
mov rcx, qword [rdi + 0x28]
xorps xmm0, xmm0
test rcx, rcx
js 0x180041680
cvtsi2ss xmm0, rcx
jmp 0x180041695
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rdi + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor eax, eax
comiss xmm0, xmm6
jb 0x1800416b2
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x1800416b2
mov rax, r12
cvttss2si rdx, xmm0
add rdx, rax
cmp rdx, rsi
cmovb rdx, rsi
cmp rdx, qword [rdi + 0x50]
jbe 0x1800416d0
lea rcx, [rdi + 0x18]
call fcn.180041cf8
test rbx, rbx
jle 0x18004171b
mov esi, 0x811c9dc5
mov rcx, qword [r14]
cmp byte [rcx], 0
jne 0x1800416e6
mov eax, esi
jmp 0x1800416f9
movsx eax, byte [rcx]
xor eax, esi
imul edx, eax, 0x1000193
inc rcx
call fcn.18003e03c
mov dword [rbp + 7], eax
lea r9, [r14 + 0x10]
lea r8, [rbp + 7]
lea rdx, [rbp - 9]
lea rcx, [rdi + 0x18]
call fcn.180042310
add r14, 0x20
sub rbx, 1
jne 0x1800416da
mov al, 1
jmp 0x1800415ce
Function at 0x1800417cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18011a010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, r9d
mov esi, edx
mov rbp, rcx
mov r8d, dword [0x18011dc8c]
mov rax, qword gs:[0x58]
mov r13d, 4
mov r14, qword [rax + r8*8]
xor r15d, r15d
movabs rbx, 0xcbf29ce484222325
movabs r12, 0x100000001b3
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], edi
mov eax, dword [r14 + r13]
cmp dword [0x18011e374], eax
jle 0x1800418f8
lea rcx, [0x18011e374]
call fcn.18009d59c
cmp dword [0x18011e374], 0xffffffff
jne 0x1800418f8
xor edx, edx
lea r8d, [rdx + 0x40]
lea rcx, [0x18011e380]
call sub.VCRUNTIME140.dll_memset
and dword [0x18011e380], 0
mov qword [0x18011e388], r15
mov qword [0x18011e390], r15
mov ecx, 0x58
call fcn.18009d994
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18011e388], rax
mov qword [0x18011e398], r15
xorps xmm0, xmm0
movdqa xmmword [0x18011e3a0], xmm0
mov qword [0x18011e3b0], 7
mov qword [0x18011e3b8], 8
mov dword [0x18011e380], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [0x18011e398]
call fcn.180041bc4
nop
lea rcx, [0x18009f360]
call fcn.18009d97c
nop
lea rcx, [0x18011e374]
call fcn.18009d530
mov rcx, rbx
mov rdx, r15
movzx eax, byte [rsp + rdx + 0x28]
xor rcx, rax
imul rcx, r12
inc rdx
cmp rdx, 4
jb 0x1800418fe
and rcx, qword [0x18011e3b0]
add rcx, rcx
mov rdx, qword [0x18011e398]
mov rax, qword [rdx + rcx*8 + 8]
mov r9, qword [0x18011e388]
cmp rax, r9
je 0x18004194b
mov r8, qword [rdx + rcx*8]
jmp 0x180041944
cmp rax, r8
je 0x18004194b
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x18004193b
jmp 0x18004194e
mov rax, r15
mov r8, r9
test rax, rax
cmovne r8, rax
cmp r8, r9
jne 0x180041971
mov r8d, esi
mov rdx, rbp
call fcn.1800414c0
test al, al
je 0x1800419cd
jmp 0x180041828
mov rcx, rbx
mov rdx, r15
movzx eax, byte [rsp + rdx + 0x20]
xor rcx, rax
imul rcx, r12
inc rdx
cmp rdx, 4
jb 0x180041977
mov r10, qword [r8 + 0x48]
and rcx, r10
mov rdx, qword [r8 + 0x30]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
mov r9, qword [r8 + 0x20]
cmp rax, r9
je 0x1800419be
mov r8, qword [rdx + rcx*8]
jmp 0x1800419b7
cmp rax, r8
je 0x1800419be
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x1800419ae
jmp 0x1800419c1
mov rax, r15
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x1800419f6
movzx eax, r15w
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18009d0f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, r15
movzx eax, byte [rsp + rcx + 0x20]
xor rbx, rax
imul rbx, r12
inc rcx
cmp rcx, 4
jb 0x1800419f9
and rbx, r10
add rbx, rbx
mov rax, qword [rdx + rbx*8 + 8]
cmp rax, r9
je 0x180041a3d
mov rcx, qword [rdx + rbx*8]
jmp 0x180041a2d
cmp rax, rcx
je 0x180041a3d
mov rax, qword [rax + 8]
cmp edi, dword [rax + 0x10]
jne 0x180041a24
test rax, rax
je 0x180041a3d
movzx eax, word [rax + 0x14]
jmp 0x1800419d1
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
Function at 0x180041cf8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x180041d31
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180041bc4
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180041e43
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x180041d8a
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180041dc9
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180041e37
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x180041e0c
mov r10, qword [r10]
cmp r10, rax
je 0x180041dc2
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180041dc2
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x180041e61
cmp qword [rdi + r11*8], r10
jne 0x180041e02
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180041d7a
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.180041e88
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180041e37