joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140209d30
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x140297788]
mov ecx, dword [0x14028c168]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140209faf
mov rax, qword [0x140297780]
test rax, rax
je 0x140209e1b
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1402a8008]
test eax, eax
je 0x140209dc5
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x140209e22
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x140209e57
mov ecx, 2
call fcn.140158c90
test al, al
je 0x140209e1b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4c
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x40]
lea rdx, [0x1402600e4]
mov r8d, recvfrom
call fcn.1401ca740
mov rcx, rbx
call fcn.1401f52a0
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x14024afc0]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14020a000
test al, al
jne 0x140209ee1
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140209ea0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.140190b30
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21f
mov r9d, 2
call fcn.1400dada0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401ca740
mov rcx, rsi
call fcn.1400db3f0
jmp 0x140209e81
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
jne 0x140209efb
call fcn.14020a8c0
jmp 0x140209f00
call fcn.14020a240
test al, al
jne 0x140209f4a
mov ecx, 2
call fcn.140158c90
test al, al
je 0x140209e81
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x228
mov r9d, 2
call fcn.1400dada0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, reloc.WS2_32.dll_shutdown
jmp 0x140209ed2
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.140106d90
mov sil, 1
test al, al
jne 0x140209e83
mov ecx, 2
call fcn.140158c90
test al, al
je 0x140209e81
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22d
mov r9d, 2
call fcn.1400dada0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, shutdown
jmp 0x140209ed2
lea rcx, [0x140297788]
call fcn.14018f790
cmp dword [0x140297788], 0xffffffff
jne 0x140209d7b
lea rcx, [0x140253442]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.140108680
mov qword [0x140297780], rax
lea rcx, [0x140297788]
call fcn.14018f828
jmp 0x140209d7b
Function at 0x140215bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, edx
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140215bea
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215c09
mov edi, eax
bt eax, 0xa
jae 0x140215c01
test bl, bl
je 0x140215c17
and edi, 0x10
shr edi, 4
jmp 0x140215c19
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140215c36
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140190b30
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x80
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x38]
lea rdx, str.GetFileAttributes
mov r8d, shutdown
call fcn.1401ca740
mov rcx, rax
mov rdx, rsi
call fcn.1401f6040
mov rcx, rdi
call fcn.1401f52a0
jmp 0x140215c17

Function at 0x140215c90
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140215cbb
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
jne 0x140215cef
test bl, bl
je 0x140215cdf
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140215d61
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140215d0c
xor edi, edi
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140190b30
mov eax, edi
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x61
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x38]
lea rdx, str.CreateDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.1401ca740
mov rcx, rax
mov rdx, rsi
call fcn.1401f6040
mov rcx, rdi
call fcn.1401f52a0
jmp 0x140215ced
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.140215bc0
test al, al
jne 0x140215cef
mov ecx, 2
call fcn.140158c90
test al, al
je 0x140215ced
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x5c
mov r9d, 2
call fcn.1400dada0
lea rcx, [rsp + 0x38]
mov rdx, rsi
call fcn.1401f6040
lea rdx, str._not_a_directory
mov r8d, reloc.WS2_32.dll_recv
mov rcx, rax
call fcn.1401ca740
mov rcx, rdi
call fcn.1400db3f0
jmp 0x140215ced
Function at 0x140215de0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140215e07
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215e37
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140190b30
mov eax, esi
add rsp, 0x178
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140215e49
xor esi, esi
jmp 0x140215e1b
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, reloc.WS2_32.dll_WSAStartup
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x40]
lea rdx, str.GetFileAttributes
mov r8d, shutdown
call fcn.1401ca740
mov rcx, rax
mov rdx, rsi
call fcn.1401f6040
mov rcx, rdi
call fcn.1401f52a0
jmp 0x140215e45

Function at 0x140215ea0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x178
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x170], rax
cmp byte [rcx + 0x17], 0
jns 0x140215ec7
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140215ede
and eax, 0x410
cmp eax, 0x410
je 0x140215f23
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x140215eea
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x140215f07
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140215f44
xor edi, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140190b30
mov eax, edi
add rsp, 0x178
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140190b30
mov rcx, rsi
add rsp, 0x178
pop rdi
pop rsi
jmp fcn.140215fa0
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x93
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x40]
lea rdx, str.DeleteFile
mov r8d, recv
call fcn.1401ca740
mov rcx, rax
mov rdx, rsi
call fcn.1401f6040
mov rcx, rdi
call fcn.1401f52a0
jmp 0x140215f05
Function at 0x140215fa0
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x170
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x168], rax
cmp byte [rcx + 0x17], 0
jns 0x140215fc8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, eax
test eax, eax
jne 0x140215fe2
mov ecx, 2
call fcn.140158c90
test al, al
jne 0x140216004
test edi, edi
setne bl
mov rcx, qword [rsp + 0x168]
xor rcx, rsp
call fcn.140190b30
mov eax, ebx
add rsp, 0x170
pop rbx
pop rdi
pop rsi
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rbx, [rsp + 0x28]
mov rcx, rbx
mov r8d, 0x2f
mov r9d, 2
call fcn.1401f5220
lea rcx, [rsp + 0x38]
lea rdx, str.RemoveDirectory
mov r8d, reloc.WS2_32.dll_recv
call fcn.1401ca740
mov rcx, rax
mov rdx, rsi
call fcn.1401f6040
mov rcx, rbx
call fcn.1401f52a0
jmp 0x140215fe2
Function at 0x140229550
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x1402295b0
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140190b30
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140235d70
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14024afc0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401ca4d0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14023ac20
test al, al
je 0x140235ec5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140235e3d
mov rcx, r14
call fcn.1401ca4d0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14023ac20
test al, al
je 0x140235e86
cmp dword [rbx], 0x4550
jne 0x140235ef6
mov sil, 1
test rdi, rdi
je 0x140235ed5
mov qword [rdi], r14
jmp 0x140235ed5
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140235ed3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140235f6a
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140235ed3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140235f64
mov ecx, 1
call fcn.140158c90
test al, al
jne 0x140235f38
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140190b30
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140235ed3
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140235f6a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401ca740
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140235f7f
and r8d, 0x7f
jmp 0x140235f86
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401ca740
mov rcx, rdi
call fcn.1400db3f0
jmp 0x140235ed3
Function at 0x140235fa0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14027c038]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14024afc0]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401ca4d0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14023ac20
test al, al
je 0x1402360f5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14023606d
mov rcx, r14
call fcn.1401ca4d0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14023ac20
test al, al
je 0x1402360b6
cmp dword [rbx], 0x4550
jne 0x140236126
mov sil, 1
test rdi, rdi
je 0x140236105
mov qword [rdi], r14
jmp 0x140236105
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140236103
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14023619a
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140236103
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140236194
mov ecx, 1
call fcn.140158c90
test al, al
jne 0x140236168
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.140190b30
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.140158c90
test al, al
je 0x140236103
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14023619a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400dada0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401ca740
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x1402361af
and r8d, 0x7f
jmp 0x1402361b6
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401ca740
mov rcx, rdi
call fcn.1400db3f0
jmp 0x140236103
Function at 0x1400342c8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x14004c350], eax
call fcn.140034d70
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x14004c350], 0
jne case.default.0x14003431e
mov ecx, 1
call fcn.140034d70
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
sar dh, 0xcd
add byte [r9 - 0x6cfdee3c], dl
cmp eax, edx
js 0x140083ced
stosd dword [rdi], eax
sbb dword [rcx], edi
sbb al, 0x7d
sti
invalid
invalid
Function at 0x1337c0e57640
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0x7ffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1337c0e577f1
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1337c0e55c00
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1337c0e577b6
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1337c0e57730
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1337c0e577a5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1337c0e5776d
mov r10, qword [rdx]
cmp r10, rax
je 0x1337c0e57767
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1337c0e577a5
cmp r9, rdx
je 0x1337c0e57781
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1337c0e577cb
cmp r9, rdx
jne 0x1337c0e57772
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1337c0e576e0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1337c0e577a5
lea rcx, str.invalid_hash_bucket_count
call fcn.1337c0fcf0e4
int3
Function at 0x1337c0e7cb90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0x7ffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1337c0e7cd3f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1337c0e7c360
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1337c0e7cd04
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1337c0e7cc7d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1337c0e7ccf3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1337c0e7ccba
mov r10, qword [rdx]
cmp r10, rax
je 0x1337c0e7ccb4
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1337c0e7ccf3
cmp r9, rdx
je 0x1337c0e7cccf
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1337c0e7cd19
cmp r9, rdx
jne 0x1337c0e7ccc0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1337c0e7cc30
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1337c0e7ccf3
lea rcx, str.invalid_hash_bucket_count
call fcn.1337c0fcf0e4
int3
Function at 0x1337c0e87cb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0x7ffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1337c0e87e8f
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1337c0e55c00
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1337c0e87e54
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1337c0e87dcc
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1337c0e87e43
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1337c0e87e09
mov r10, qword [rdx]
cmp r10, rax
je 0x1337c0e87e03
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1337c0e87e43
cmp r9, rdx
je 0x1337c0e87e1f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1337c0e87e69
cmp r9, rdx
jne 0x1337c0e87e10
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1337c0e87d50
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1337c0e87e43
lea rcx, str.invalid_hash_bucket_count
call fcn.1337c0fcf0e4
int3