joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800174f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
lea ecx, [r15 + 0x20]
call fcn.180286234
test rax, rax
je 0x180017544
mov dword [rax], 1
mov dword [rax + 4], 2
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r15
mov dword [rax + 0x18], r15d
jmp 0x180017547
mov rax, r15
mov qword [rsi + 0x10], rax
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x180017557
lock inc dword [rbx]
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x30], 1
mov ecx, 0x10
call fcn.180286234
mov r9, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18001759d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x90], r15
mov qword [rax], rbx
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov rbx, r15
mov rbp, r15
jmp 0x1800175a3
mov r9, r15
mov rbp, rbx
mov qword [rsp + 0x98], r9
mov edi, 3
mov dword [rsp + 0x30], edi
lea r14, [rsi + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
lea r8, [0x18001ce90]
xor edx, edx
xor ecx, ecx
call fcn.18028e0d4
mov qword [rsi], rax
test rax, rax
je 0x18001762c
mov qword [rsp + 0x98], r15
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
test rbx, rbx
je 0x180017615
mov eax, 0xffffffff
lock xadd dword [rbp], eax
cmp eax, 1
jne 0x180017615
lea edx, [rax + 0x1f]
mov rcx, qword [rsp + 0x90]
call fcn.180286270
nop
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], r15d
mov ecx, 6
call fcn.1802835e0
int3
Function at 0x180017640
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
lea ecx, [r15 + 0x20]
call fcn.180286234
test rax, rax
je 0x180017694
mov dword [rax], 1
mov dword [rax + 4], 2
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r15
mov dword [rax + 0x18], r15d
jmp 0x180017697
mov rax, r15
mov qword [rsi + 0x10], rax
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x1800176a7
lock inc dword [rbx]
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x30], 1
mov ecx, 0x10
call fcn.180286234
mov r9, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800176ed
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x90], r15
mov qword [rax], rbx
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov rbx, r15
mov rbp, r15
jmp 0x1800176f3
mov r9, r15
mov rbp, rbx
mov qword [rsp + 0x98], r9
mov edi, 3
mov dword [rsp + 0x30], edi
lea r14, [rsi + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
lea r8, [0x18001cf50]
xor edx, edx
xor ecx, ecx
call fcn.18028e0d4
mov qword [rsi], rax
test rax, rax
je 0x18001777c
mov qword [rsp + 0x98], r15
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
test rbx, rbx
je 0x180017765
mov eax, 0xffffffff
lock xadd dword [rbp], eax
cmp eax, 1
jne 0x180017765
lea edx, [rax + 0x1f]
mov rcx, qword [rsp + 0x90]
call fcn.180286270
nop
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], r15d
mov ecx, 6
call fcn.1802835e0
int3
Function at 0x180027560
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
lea rax, vtable.UEVRSharedMemory.0
mov qword [rcx], rax
xor edi, edi
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
lea rcx, str.Shared_memory_constructor_
call fcn.180023fc0
lea rax, str.UnrealVRMod
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x215
xor r9d, r9d
xor edx, edx
lea rcx, [rdi - 1]
lea r8d, [rdi + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov qword [rbx + 8], rax
mov qword [rsp + 0x20], 0x215
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x1800276e8
call fcn.180210550
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1802107b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
cmp byte [rsp + 0x70], dil
je 0x18002763b
lea rcx, [rsp + 0x50]
call fcn.1800154a0
xor edx, edx
mov r8d, 0x208
mov rcx, qword [rbx + 0x10]
call fcn.1802bd010
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, qword [rbx + 0x10]
call fcn.18028de80
mov rcx, qword [rbx + 0x10]
mov rax, qword [rsp + 0x40]
mov word [rcx + rax*2], di
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [rbx + 0x10]
mov dword [rcx + 0x208], eax
lea rcx, str.Mapped_memory_
call fcn.180023fc0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x1800276d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800276ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180027715
call fcn.180286270
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
jmp 0x180027701
call fcn.180270610
lea r8, str.Failed_to_map_memory_
mov edx, 4
mov rcx, rax
call fcn.1800240e0
mov rax, rbx
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
call fcn.18028ddc0
int3
Function at 0x18002afb0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x10]
call fcn.1802bd010
xor r9d, r9d
lea r8d, [rsi + 0x1a]
lea rdx, [rbp - 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rax, [rbp - 0x10]
mov qword [rbp + 0x230], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x230]
call fcn.18002aca0
nop
lea rax, [rbp - 0x50]
mov qword [rbp + 0x238], rax
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.1800084f0
mov ebx, 2
mov dword [rsp + 0x20], ebx
and ebx, 0xfffffffd
mov dword [rsp + 0x20], ebx
lea rax, [rbp - 0x70]
mov qword [rbp - 0x80], rax
lea rax, str.UnrealVRMod
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xb
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.1800084f0
or ebx, 4
mov dword [rsp + 0x20], ebx
and ebx, 0xfffffffb
mov dword [rsp + 0x20], ebx
lea rax, [rsp + 0x40]
mov qword [rbp - 0x78], rax
lea rdx, [rbp - 0x10]
lea rax, [rbp - 0x10]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x18002b0c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x40]
call fcn.180017c20
or ebx, 0x10
mov dword [rsp + 0x20], ebx
and ebx, 0xffffffef
mov dword [rsp + 0x20], ebx
or ebx, 8
mov dword [rsp + 0x20], ebx
and ebx, 0xfffffff7
mov dword [rsp + 0x20], ebx
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x30]
call fcn.180029f30
nop
mov rdx, rax
mov rcx, rdi
call fcn.180012740
nop
or ebx, 0x40
mov dword [rsp + 0x20], ebx
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.180014ef0
and ebx, 0xffffffbf
mov dword [rsp + 0x20], ebx
or ebx, 1
mov dword [rsp + 0x20], ebx
lea rcx, [rbp - 0x30]
call fcn.1800154a0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 7
jbe 0x18002b18f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002b18a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002b21e
call fcn.180286270
movdqa xmm0, xmmword [0x1802f5610]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
lea rcx, [rbp - 0x70]
call fcn.1800154a0
nop
lea rcx, [rbp - 0x50]
call fcn.1800154a0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x18002b1ef
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002b1ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002b218
call fcn.180286270
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rax, rdi
mov rbx, qword [rsp + 0x320]
add rsp, 0x300
pop rdi
pop rsi
pop rbp
ret
call fcn.18028ddc0
nop
call fcn.18028ddc0
int3
Function at 0x18002c110
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18002c2c3
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18002b900
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18002c281
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r9d, byte [rcx + 0x10]
xor r9, rbp
imul r9, rdi
movzx eax, byte [rcx + 0x11]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x12]
xor r9, rax
imul r9, rdi
movzx eax, byte [rcx + 0x13]
xor r9, rax
imul r9, rdi
mov r11, qword [rsi + 0x30]
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18002c200
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18002c275
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x18002c23d
mov r8, qword [rax]
cmp r8, rcx
je 0x18002c237
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18002c275
cmp r9, rax
je 0x18002c251
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x18002c29d
cmp r9, rax
jne 0x18002c242
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x18002c1b0
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x18002c275
lea rcx, str.invalid_hash_bucket_count
call fcn.1802819e8
int3
Function at 0x180036810
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180036838
xor eax, eax
lea r8, [0x1800367a0]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180036de0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180036f91
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18002b900
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180036f4f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r11d, byte [rcx + 0x10]
xor r11, rbp
imul r11, rdi
movzx eax, byte [rcx + 0x11]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x12]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x13]
xor r11, rax
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180036ecd
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180036f43
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x180036f0a
mov r8, qword [rax]
cmp r8, rcx
je 0x180036f04
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180036f43
cmp r9, rax
je 0x180036f1f
nop
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x180036f6b
cmp r9, rax
jne 0x180036f10
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180036e80
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180036f43
lea rcx, str.invalid_hash_bucket_count
call fcn.1802819e8
int3
Function at 0x180038450
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
lea ecx, [r15 + 0x20]
call fcn.180286234
test rax, rax
je 0x1800384a4
mov dword [rax], 1
mov dword [rax + 4], 2
xor ecx, ecx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], r15
mov dword [rax + 0x18], r15d
jmp 0x1800384a7
mov rax, r15
mov qword [rsi + 0x10], rax
mov rbx, qword [rsi + 0x10]
test rbx, rbx
je 0x1800384b7
lock inc dword [rbx]
mov qword [rsp + 0x90], rbx
mov dword [rsp + 0x30], 1
mov ecx, 0x10
call fcn.180286234
mov r9, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800384fd
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x90], r15
mov qword [rax], rbx
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov rbx, r15
mov rbp, r15
jmp 0x180038503
mov r9, r15
mov rbp, rbx
mov qword [rsp + 0x98], r9
mov edi, 3
mov dword [rsp + 0x30], edi
lea r14, [rsi + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
lea r8, [0x1800385a0]
xor edx, edx
xor ecx, ecx
call fcn.18028e0d4
mov qword [rsi], rax
test rax, rax
je 0x18003858c
mov qword [rsp + 0x98], r15
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
test rbx, rbx
je 0x180038575
mov eax, 0xffffffff
lock xadd dword [rbp], eax
cmp eax, 1
jne 0x180038575
lea edx, [rax + 0x1f]
mov rcx, qword [rsp + 0x90]
call fcn.180286270
nop
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], r15d
mov ecx, 6
call fcn.1802835e0
int3
Function at 0x180038960
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x180038a1e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x180038a20
cmp rax, rdx
je 0x180038a1e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180038a01
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
Function at 0x1800391a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180039381
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [rsi + 0x18]
call fcn.18002b900
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18003933f
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r11d, byte [rcx + 0x10]
xor r11, rbp
imul r11, rdi
movzx eax, byte [rcx + 0x11]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x12]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x13]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x14]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x15]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x16]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x17]
xor r11, rax
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800392b9
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180039333
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x1800392f6
mov r8, qword [rax]
cmp r8, rcx
je 0x1800392f0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180039333
cmp r9, rax
je 0x18003930f
nop dword [rax + rax]
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x18003935b
cmp r9, rax
jne 0x180039300
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180039240
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180039333
lea rcx, str.invalid_hash_bucket_count
call fcn.1802819e8
int3
Function at 0x180039390
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rbp, r8
mov r15, rdx
mov rdx, rcx
cmp r15, r8
je 0x1800395dd
lea r14, [rcx + 8]
mov r13, qword [r14]
mov r8, qword [rcx + 0x18]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x30], r14
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov rsi, r15
mov qword [rsp + 0x40], r15
mov rax, qword [r15 + 8]
mov qword [rsp + 0xb8], rax
movzx ecx, byte [r15 + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r9, 0x100000001b3
imul rcx, r9
movzx eax, byte [r15 + 0x11]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x12]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x13]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x14]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x15]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x16]
xor rcx, rax
imul rcx, r9
movzx eax, byte [r15 + 0x17]
xor rcx, rax
imul rcx, r9
mov rax, qword [rdx + 0x30]
and rax, rcx
shl rax, 4
add rax, r8
mov qword [rsp + 0xa8], rax
mov rcx, qword [rax]
mov qword [rsp + 0xb0], rcx
mov r12, qword [rax + 8]
nop word [rax + rax]
cmp rsi, r12
sete bl
mov rcx, rsi
mov rdi, qword [rsi]
mov rsi, rdi
mov qword [rsp + 0x40], rdi
mov edx, 0x18
call fcn.180286270
dec qword [r14 + 8]
test bl, bl
jne 0x1800394d9
cmp rdi, rbp
jne 0x180039490
cmp qword [rsp + 0xb0], r15
jne 0x1800395d1
mov rax, qword [rsp + 0xa8]
mov qword [rax], rdi
jmp 0x1800395d1
mov rax, qword [rsp + 0xa8]
cmp qword [rsp + 0xb0], r15
jne 0x1800394f3
mov qword [rax], r13
mov rcx, r13
jmp 0x1800394fb
mov rcx, qword [rsp + 0xb8]
mov qword [rax + 8], rcx
cmp rdi, rbp
je 0x1800395d1
nop dword [rax + rax]
movzx ecx, byte [rsi + 0x10]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [rsi + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x12]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x13]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x14]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x15]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x16]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsi + 0x17]
xor rcx, rax
imul rcx, rdx
mov rax, qword [rsp + 0xa0]
mov r12, qword [rax + 0x30]
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x20]
mov r15, qword [r12 + 8]
nop dword [rax]
cmp rsi, r15
sete dil
mov rcx, rsi
mov rbx, qword [rsi]
mov rsi, rbx
mov qword [rsp + 0x40], rbx
mov edx, 0x18
call fcn.180286270
dec qword [r14 + 8]
test dil, dil
jne 0x1800395f1
cmp rbx, rbp
jne 0x1800395a0
mov qword [r12], rbx
mov rax, qword [rsp + 0x28]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov rax, rbp
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [r12], r13
mov qword [r12 + 8], r13
cmp rbx, rbp
jne 0x180039510
jmp 0x1800395d1
Function at 0x180039610
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1800396b8
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x180039653
mov rdx, qword [rdi + 8]
mov r8, rdx
mov rdx, qword [rdx]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180039390
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x180039685
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.180286270
mov rcx, rbx
test rbx, rbx
jne 0x180039670
mov rax, qword [rdi + 8]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.180023d40
nop
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret