joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180072740
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18007290b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800718d0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800728d4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18007284d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800728c3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18007288a
mov r10, qword [rdx]
cmp r10, rax
je 0x180072884
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800728c3
cmp r9, rdx
je 0x18007289f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800728e5
cmp r9, rdx
jne 0x180072890
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800727d1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800728c3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x180072920
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180072afb
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1800718d0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x180072ac4
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x180072a3c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180072ab3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180072a79
mov r10, qword [rdx]
cmp r10, rax
je 0x180072a73
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180072ab3
cmp r9, rdx
je 0x180072a8f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180072ad5
cmp r9, rdx
jne 0x180072a80
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1800729c0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180072ab3
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x18007b900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x201], 0
je 0x18007b928
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x200
jb 0x18007b910
mov byte [rcx + 0x201], 0
mov rax, rcx
ret

Function at 0x18007ba70
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x18007bb15
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
mov byte [rcx + 0x27], 0
mov rax, rcx
ret

Function at 0x18007bb20
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x29], 0
je 0x18007bbcd
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
mov byte [rcx + 0x29], 0
mov rax, rcx
ret
Function at 0x18007bbe0
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x18007bc91
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x18007bca0
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x18007bd59
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
xor byte [rcx + 0x29], 0x60
xor byte [rcx + 0x2a], 0x61
mov byte [rcx + 0x2c], 0
mov rax, rcx
ret
Function at 0x18007bd60
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x18007be25
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
xor byte [rcx + 0x29], 0x60
xor byte [rcx + 0x2a], 0x61
xor byte [rcx + 0x2b], 0x62
xor byte [rcx + 0x2c], 0x63
xor byte [rcx + 0x2d], 0x64
mov byte [rcx + 0x2f], 0
mov rax, rcx
ret

Function at 0x18007be30
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x30], 0
je 0x18007bef9
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
xor byte [rcx + 0x29], 0x60
xor byte [rcx + 0x2a], 0x61
xor byte [rcx + 0x2b], 0x62
xor byte [rcx + 0x2c], 0x63
xor byte [rcx + 0x2d], 0x64
xor byte [rcx + 0x2e], 0x65
mov byte [rcx + 0x30], 0
mov rax, rcx
ret
Function at 0x18007bf00
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x31], 0
je 0x18007bfcd
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
xor byte [rcx + 0x29], 0x60
xor byte [rcx + 0x2a], 0x61
xor byte [rcx + 0x2b], 0x62
xor byte [rcx + 0x2c], 0x63
xor byte [rcx + 0x2d], 0x64
xor byte [rcx + 0x2e], 0x65
xor byte [rcx + 0x2f], 0x66
mov byte [rcx + 0x31], 0
mov rax, rcx
ret

Function at 0x18007bfe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x81], 0
mov r8, rcx
je 0x18007c07d
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop
lea edx, [rax + r9]
lea ecx, [rdx + 0x37]
xor byte [rax - 2], cl
lea rax, [rax + 0x10]
lea ecx, [rdx + 0x38]
xor byte [rax - 0x11], cl
lea ecx, [rdx + 0x39]
xor byte [rax - 0x10], cl
lea ecx, [rdx + 0x3a]
xor byte [rax - 0xf], cl
lea ecx, [rdx + 0x3b]
xor byte [rax - 0xe], cl
lea ecx, [rdx + 0x3c]
xor byte [rax - 0xd], cl
lea ecx, [rdx + 0x3d]
xor byte [rax - 0xc], cl
lea ecx, [rdx + 0x3e]
xor byte [rax - 0xb], cl
lea ecx, [rdx + 0x3f]
xor byte [rax - 0xa], cl
lea ecx, [rdx + 0x40]
xor byte [rax - 9], cl
lea ecx, [rdx + 0x41]
xor byte [rax - 8], cl
lea ecx, [rdx + 0x42]
xor byte [rax - 7], cl
lea ecx, [rdx + 0x43]
xor byte [rax - 6], cl
lea ecx, [rdx + 0x44]
xor byte [rax - 5], cl
lea ecx, [rdx + 0x45]
xor byte [rax - 4], cl
add dl, 0x46
xor byte [rax - 3], dl
lea rcx, [r9 + rax]
cmp rcx, 0x80
jb 0x18007c000
mov byte [r8 + 0x81], 0
mov rax, r8
ret
Function at 0x180081d50
Capabilities:
Parse pe header

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x180081e41
xor byte [rcx], 0x37
xor byte [rcx + 1], 0x38
xor byte [rcx + 2], 0x39
xor byte [rcx + 3], 0x3a
xor byte [rcx + 4], 0x3b
xor byte [rcx + 5], 0x3c
xor byte [rcx + 6], 0x3d
xor byte [rcx + 7], 0x3e
xor byte [rcx + 8], 0x3f
xor byte [rcx + 9], 0x40
xor byte [rcx + 0xa], 0x41
xor byte [rcx + 0xb], 0x42
xor byte [rcx + 0xc], 0x43
xor byte [rcx + 0xd], 0x44
xor byte [rcx + 0xe], 0x45
xor byte [rcx + 0xf], 0x46
xor byte [rcx + 0x10], 0x47
xor byte [rcx + 0x11], 0x48
xor byte [rcx + 0x12], 0x49
xor byte [rcx + 0x13], 0x4a
xor byte [rcx + 0x14], 0x4b
xor byte [rcx + 0x15], 0x4c
xor byte [rcx + 0x16], 0x4d
xor byte [rcx + 0x17], 0x4e
xor byte [rcx + 0x18], 0x4f
xor byte [rcx + 0x19], 0x50
xor byte [rcx + 0x1a], 0x51
xor byte [rcx + 0x1b], 0x52
xor byte [rcx + 0x1c], 0x53
xor byte [rcx + 0x1d], 0x54
xor byte [rcx + 0x1e], 0x55
xor byte [rcx + 0x1f], 0x56
xor byte [rcx + 0x20], 0x57
xor byte [rcx + 0x21], 0x58
xor byte [rcx + 0x22], 0x59
xor byte [rcx + 0x23], 0x5a
xor byte [rcx + 0x24], 0x5b
xor byte [rcx + 0x25], 0x5c
xor byte [rcx + 0x26], 0x5d
xor byte [rcx + 0x27], 0x5e
xor byte [rcx + 0x28], 0x5f
xor byte [rcx + 0x29], 0x60
xor byte [rcx + 0x2a], 0x61
xor byte [rcx + 0x2b], 0x62
xor byte [rcx + 0x2c], 0x63
xor byte [rcx + 0x2d], 0x64
xor byte [rcx + 0x2e], 0x65
xor byte [rcx + 0x2f], 0x66
xor byte [rcx + 0x30], 0x67
xor byte [rcx + 0x31], 0x68
xor byte [rcx + 0x32], 0x69
xor byte [rcx + 0x33], 0x6a
xor byte [rcx + 0x34], 0x6b
xor byte [rcx + 0x35], 0x6c
xor byte [rcx + 0x36], 0x6d
xor byte [rcx + 0x37], 0x6e
xor byte [rcx + 0x38], 0x6f
mov byte [rcx + 0x3a], 0
ret
Function at 0x1800ae6e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x180249a80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r11, rcx
mov qword [rsp + 0x38], rdx
mov rcx, rdx
mov rbx, rdx
mov rbp, rdx
shr rcx, 0x38
mov r14, rdx
shr rbx, 0x30
mov r15, rdx
shr rbp, 0x28
mov r12, rdx
shr r14, 0x20
mov rax, rdx
shr r15, 0x18
shr r12, 0x10
movzx r13d, r9b
shr rax, 8
mov r10, rdx
test rdx, rdx
je 0x1800ae905
test r8, r8
je 0x1800ae905
mov qword [rsp + 0x50], rdi
mov rdi, qword [rdx + 0xd0]
test rdi, rdi
je 0x1800ae900
mov qword [rsp + 0xa0], rsi
mov rsi, qword [r8 + 0xd0]
test rsi, rsi
je 0x1800ae8f8
cmp byte [rsp + 0xb0], 0
je 0x1800ae87b
movzx eax, al
movabs r8, 0xcbf29ce484222325
movzx edx, r10b
xor rdx, r8
movabs r8, 0x100000001b3
imul rdx, r8
xor rdx, rax
movzx eax, r12b
imul rdx, r8
xor rdx, rax
movzx eax, r15b
imul rdx, r8
xor rdx, rax
movzx eax, r14b
imul rdx, r8
xor rdx, rax
movzx eax, bpl
imul rdx, r8
xor rdx, rax
movzx eax, bl
imul rdx, r8
xor rdx, rax
imul rdx, r8
xor rdx, rcx
mov rcx, qword [r11 + 0x2580]
imul rdx, r8
and rcx, rdx
mov rdx, qword [r11 + 0x2558]
shl rcx, 4
add rcx, qword [r11 + 0x2568]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800ae831
mov rcx, qword [rcx]
cmp r10, qword [rax + 0x10]
je 0x1800ae833
nop
cmp rax, rcx
je 0x1800ae831
mov rax, qword [rax + 8]
cmp r10, qword [rax + 0x10]
jne 0x1800ae820
jmp 0x1800ae833
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1800ae8f8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x28]
lea rcx, [r11 + 0x2550]
call fcn.1800588f0
mov rcx, qword [rax]
movzx eax, byte [rcx + 0x18]
mov byte [rdi + 0x49], al
movzx eax, byte [rcx + 0x19]
mov byte [rdi + 0x4a], al
movzx eax, byte [rcx + 0x1a]
mov byte [rdi + 0x4b], al
movzx eax, word [rcx + 0x1c]
mov word [rdi + 0x4e], ax
jmp 0x1800ae8f8
movzx eax, byte [rdi + 0x49]
lea r8, [rsp + 0x38]
movzx ebx, word [rdi + 0x4e]
lea rdx, [rsp + 0x28]
mov byte [rsp + 0x20], al
lea rcx, [r11 + 0x2550]
movzx eax, byte [rdi + 0x4a]
mov byte [rsp + 0x21], al
movzx eax, byte [rdi + 0x4b]
mov byte [rsp + 0x22], al
call fcn.1800588f0
mov rcx, qword [rax]
mov eax, dword [rsp + 0x20]
mov dword [rcx + 0x18], eax
movzx eax, bx
mov word [rcx + 0x1c], bx
or bx, 1
mov ecx, 0xfffe
and ax, cx
mov ecx, 0xfff7
test r13b, r13b
cmovne bx, ax
movzx eax, bx
or bx, 8
and ax, cx
test r13b, r13b
cmove bx, ax
mov word [rdi + 0x4e], bx
movzx eax, byte [rsi + 0x49]
mov byte [rdi + 0x49], al
mov word [rdi + 0x4a], 0xff
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1801a9230
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x1800aeb90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.1801a9290
sub rsp, rax
mov rax, qword [0x180249a80]
xor rax, rsp
mov qword [rbp + 0x12e0], rax
xorps xmm0, xmm0
mov word [rsp + 0x25], 0x5b
xorps xmm1, xmm1
mov dword [rsp + 0x20], 0x3e3c2f5c
movups xmmword [rsp + 0x28], xmm0
mov rsi, rcx
mov byte [rsp + 0x24], 0x5d
movdqu xmmword [rsp + 0x38], xmm1
mov byte [rsp + 0x27], 0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800aec00
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180001450
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rsp + 0x54], eax
mov ecx, 1
mov dword [rbp + 0x12d4], 0xffffffff
nop dword [rax]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x1800aec40
mov eax, dword [rsp + 0x38]
lea rcx, [rsp + 0x50]
dec eax
mov dword [rsp + 0x50], 0x270
mov r14d, 0x80000000
xor eax, r14d
cmp eax, 0x7fffffff
jne 0x1800aec8b
call fcn.18006ae40
mov ecx, eax
jmp 0x1800aecc8
lea ebx, [rax - 0x7fffffff]
call fcn.18006ae40
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x1800aecc4
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x1800aecc4
lea rcx, [rsp + 0x50]
call fcn.18006ae40
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x1800aecb0
shr rcx, 0x20
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
add ecx, r14d
xor ecx, r14d
mov edx, 1
movsxd r8, ecx
cmp rdi, 0xf
mov rcx, rsi
cmova rax, rbx
movzx r8d, byte [r8 + rax]
call fcn.180063900
cmp rdi, 0xf
jbe 0x1800aed34
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1800aed2c
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800aed2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1801a8d40
mov rax, rsi
mov rcx, qword [rbp + 0x12e0]
xor rcx, rsp
call fcn.1801a9230
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1800b3880
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x48
mov r10d, edx
test r8b, r8b
je 0x1800b3926
cmp byte [0x18024b0de], 0
je 0x1800b3911
mov rax, qword [0x180249300]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rbx
mov edx, dword [rax + r9]
call fcn.1800ea8b0
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1800b38c4
mov rbx, qword [rax]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800b3904
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800b38ff
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800b38ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1801a8d40
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x48
ret
test r9, r9
je 0x1800b39cb
lea rax, [r9 + 0xfc]
add rsp, 0x48
ret
mov r8, qword [0x18024b1a0]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, r10b
xor rdx, rax
movzx eax, byte [rsp + 0x59]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x5a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x5b]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + 0x30]
and rcx, rdx
mov rdx, qword [r8 + 8]
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1800b39a6
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x1800b39a8
cmp rax, rcx
je 0x1800b39a6
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x1800b3995
jmp 0x1800b39a8
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1800b39cb
add rax, 0x18
cmp qword [rax + 0x18], 0xf
jbe 0x1800b390c
mov rax, qword [rax]
add rsp, 0x48
ret
lea rax, [0x1801c12b0]
add rsp, 0x48
ret