joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180007fec
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x14
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180007ff9
mov byte [rcx + 0x18], r10b
ret

Function at 0x180008030
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0x10
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x18000803d
mov byte [rcx + 0x14], r10b
ret

Function at 0x180008074
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x10
jb 0x18000807b
mov byte [rcx + 0x14], 0
ret

Function at 0x18000809c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xa
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800080a9
mov byte [rcx + 0xe], r10b
ret

Function at 0x1800080fc
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x18
jb 0x180008103
mov byte [rcx + 0x1c], 0
ret

Function at 0x1800081e8
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xc
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x1800081f5
mov byte [rcx + 0x10], r10b
ret

Function at 0x180008210
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xb
jb 0x180008217
mov byte [rcx + 0xf], 0
ret

Function at 0x180008254
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 7
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180008261
mov byte [rcx + 0xb], r10b
ret

Function at 0x18000827c
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rcx + 4]
mov r10d, 0xb
mov r9, rax
mov dl, byte [r9]
mov r8d, dword [rcx]
xor r8b, dl
mov byte [r9], r8b
inc r9
sub r10, 1
jne 0x180008289
mov byte [rcx + 0xf], r10b
ret

Function at 0x1800082f8
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 9
jb 0x1800082ff
mov byte [rcx + 0xd], 0
ret

Function at 0x180008358
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 7
jb 0x18000835f
mov byte [rcx + 0xb], 0
ret

Function at 0x180008380
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 2
jb 0x180008387
mov byte [rcx + 6], 0
ret
Function at 0x1800083e0
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
lea rax, [rcx + 4]
mov dl, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8b, dl
mov byte [rax + r9], r8b
inc r9
cmp r9, 4
jb 0x1800083e7
mov byte [rcx + 8], 0
ret

Function at 0x180008424
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
lea rax, [rcx + 4]
mov r10d, ebx
mov r11, rax
movzx r9d, word [r11]
mov edx, dword [rcx]
add dl, r10b
inc r10
movsx r8d, dl
xor r8w, r9w
mov word [r11], r8w
lea r11, [r11 + 2]
cmp r10, 0x15
jb 0x180008435
mov word [rcx + 0x2e], bx
mov rbx, qword [rsp + 8]
ret
Function at 0x18000a340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov r14, rdx
mov r15, rcx
movabs rdi, 0xcbf29ce484222325
xor ecx, ecx
movzx eax, byte [rcx + r8]
xor rdi, rax
movabs rdx, 0x100000001b3
imul rdi, rdx
inc rcx
cmp rcx, 4
jb 0x18000a371
mov rax, qword [r15 + 0x30]
and rax, rdi
add rax, rax
mov rcx, qword [r15 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r15 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x18000a419
mov rbx, rbp
movabs rax, 0x492492492492492
cmp qword [r15 + 0x10], rax
je 0x18000a564
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x38
call fcn.180091200
mov rsi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x18], xmm0
xor r12d, r12d
mov qword [rax + 0x28], r12
mov qword [rax + 0x30], 0xf
mov byte [rax + 0x18], r12b
mov rcx, qword [r15 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18000a456
cvtsi2ss xmm0, rcx
jmp 0x18000a46b
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x18000a42b
cmp rbx, rdx
je 0x18000a44f
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18000a422
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18000a3b3
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x18000a544
mov rbp, rbx
xor eax, eax
jmp 0x18000a439
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r15 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18000a47e
cvtsi2ss xmm1, rcx
jmp 0x18000a493
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r15]
seta al
test al, al
je 0x18000a4ed
mov rcx, r15
call fcn.18000af24
mov rcx, rdi
and rcx, qword [r15 + 0x30]
add rcx, rcx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x18000a4e3
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rsi + 0x10]
jmp 0x18000a4db
mov rbx, rax
cmp rax, r8
je 0x18000a51e
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18000a4cf
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [r15 + 0x10]
mov qword [rsi], rbp
mov qword [rsi + 8], rcx
mov qword [rcx], rsi
mov qword [rbx + 8], rsi
mov rax, qword [r15 + 0x18]
and rdi, qword [r15 + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r13]
jne 0x18000a525
mov qword [rax + rdi*8], rsi
jmp 0x18000a537
mov qword [rsp + 0x20], rax
jmp 0x18000a4e8
cmp rdx, rbp
jne 0x18000a530
mov qword [rax + rdi*8], rsi
jmp 0x18000a53c
cmp qword [rax + rdi*8 + 8], rcx
jne 0x18000a53c
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18008f2f8
int3
Function at 0x18000ac5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18000ac8c
cvtsi2ss xmm0, rdx
jmp 0x18000aca1
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call qword [sym.imp.msvcrt.dll_ceilf]
movss xmm1, dword [0x1800cf9e0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000acd0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000acd0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000acfe
cmp rbx, 0x200
jae 0x18000acfb
shl rbx, 3
cmp rbx, rcx
jae 0x18000acfe
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18000ae68
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000933c
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000ae2c
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [r8 + rax + 0x10]
movabs r9, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r9
cmp r8, 4
jb 0x18000ad76
and r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18000adb2
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18000ae20
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18000adf5
mov r10, qword [r10]
cmp r10, rax
je 0x18000adab
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000adab
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18000ae42
cmp qword [rdi + r11*8], r10
jne 0x18000adeb
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18000ad66
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000ae20
lea rcx, str.invalid_hash_bucket_count
call fcn.18008f2f8
int3
Function at 0x18000af24
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rsi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18000af54
cvtsi2ss xmm0, rdx
jmp 0x18000af69
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call qword [sym.imp.msvcrt.dll_ceilf]
movss xmm1, dword [0x1800cf9e0]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000af98
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000af98
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000afc6
cmp rbx, 0x200
jae 0x18000afc3
shl rbx, 3
cmp rbx, rcx
jae 0x18000afc6
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18000b133
lea rax, [rbx - 1]
mov edi, 1
mov rbx, qword [rsi + 8]
or rax, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18000933c
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000b0f7
mov rcx, qword [rcx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx edx, byte [r9 + rax + 0x10]
movabs r10, 0x100000001b3
xor r8, rdx
inc r9
imul r8, r10
cmp r9, 4
jb 0x18000b03e
mov r11, qword [rsi + 0x30]
mov rdi, qword [rsi + 0x18]
and r11, r8
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x18000b07d
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x18000b0eb
mov r10, qword [rdi + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18000b0c0
mov r10, qword [r10]
cmp r10, rax
je 0x18000b076
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000b076
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18000b10d
cmp qword [rdi + r11*8], r10
jne 0x18000b0b6
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18000b02e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000b0eb
lea rcx, str.invalid_hash_bucket_count
call fcn.18008f2f8
int3
Function at 0x1800128b8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
cmp qword [0x18010f9e0], 0
jne 0x1800129be
mov dword [rbp - 0x20], 0x7e
xor eax, eax
mov byte [rbp - 0x1c], 0x1a
xor edx, edx
mov byte [rbp - 0x1b], 0x4d
mov byte [rbp - 0x1a], 0x1a
mov byte [rbp - 0x19], 0x1d
mov byte [rbp - 0x18], 0x11
mov byte [rbp - 0x17], 0x13
mov byte [rbp - 0x16], 0xe
mov byte [rbp - 0x15], 0x17
mov byte [rbp - 0x14], 0x12
mov byte [rbp - 0x13], 0x1b
mov byte [rbp - 0x12], 0xc
mov byte [rbp - 0x11], 0x21
mov byte [rbp - 0x10], 0x4a
mov byte [rbp - 0xf], 0x49
mov byte [rbp - 0xe], 0x50
mov byte [rbp - 0xd], 0x1a
mov byte [rbp - 0xc], 0x12
mov byte [rbp - 0xb], 0x12
mov byte [rbp - 0xa], al
mov al, byte [rbp - 0x1c]
mov al, byte [rbp + rdx - 0x1c]
mov ecx, dword [rbp - 0x20]
xor cl, al
mov byte [rbp + rdx - 0x1c], cl
inc rdx
cmp rdx, 0x12
jb 0x180012928
lea rcx, [rbp - 0x1c]
mov byte [rbp - 0xa], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18010f9e8], rax
xor eax, eax
mov dword [rbp - 0x30], 0x2d
xor edx, edx
mov byte [rbp - 0x2c], 0x69
mov byte [rbp - 0x2b], 0x1e
mov byte [rbp - 0x2a], 0x69
mov byte [rbp - 0x29], WSASetLastError
mov byte [rbp - 0x28], 0x42
mov byte [rbp - 0x27], 0x40
mov byte [rbp - 0x26], 0x5d
mov byte [rbp - 0x25], 0x44
mov byte [rbp - 0x24], 0x41
mov byte [rbp - 0x23], 0x48
mov byte [rbp - 0x22], al
mov al, byte [rbp - 0x2c]
mov al, byte [rbp + rdx - 0x2c]
mov ecx, dword [rbp - 0x30]
xor cl, al
mov byte [rbp + rdx - 0x2c], cl
inc rdx
cmp rdx, 0xa
jb 0x18001298c
mov rcx, qword [0x18010f9e8]
lea rdx, [rbp - 0x2c]
mov byte [rbp - 0x22], 0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18010f9e0], rax
add rsp, 0x50
pop rbp
ret
Function at 0x18001b958
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18001b9b2
mov r11b, 0x23
lea rdi, [0x1800bc9a0]
movzx ebx, byte [r10]
dec rdx
inc r10
cmp bl, r11b
jne 0x18001b99c
cmp rdx, 2
jb 0x18001b99c
cmp byte [r10], r11b
jne 0x18001b99c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rbx
shr r9d, 8
xor r9d, dword [rdi + rcx*4]
test rdx, rdx
jne 0x18001b97a
jmp 0x18001b9f3
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18001b9f3
mov r11b, 0x23
lea rdi, [0x1800bc9a0]
cmp dl, r11b
jne 0x18001b9d7
cmp byte [r10], r11b
jne 0x18001b9d7
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rdi + rcx*4]
test dl, dl
jne 0x18001b9c5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18001bb28
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x18001bb48
and qword [r8], 0
lea rdx, [0x1800c1ab4]
call fcn.18001ba04
mov rbx, rax
test rax, rax
je 0x18001bc39
mov rcx, rax
call qword [sym.imp.msvcrt.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18001bc30
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x18001bc30
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18001bc30
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fseek]
test eax, eax
jne 0x18001bc30
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x18001bc30
mov rax, qword [0x18010fbd0]
test rax, rax
je 0x18001bbcd
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18001bc30
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x18001bc1d
call qword [sym.imp.msvcrt.dll_fclose]
mov rax, qword [0x18010fbd0]
test rax, rax
je 0x18001bc12
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
jmp 0x18001bc39
call qword [sym.imp.msvcrt.dll_fclose]
test rsi, rsi
je 0x18001bc2b
mov qword [rsi], rbp
mov rax, rdi
jmp 0x18001bc3b
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18001dedc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0xf8]
lea r9, [rsp + 0x10]
mov dword [rsp + 0x10], edx
mov r10d, 4
movsxd rdx, dword [rcx + 0xf0]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx ecx, byte [r9]
lea rax, [0x1800bc9a0]
movzx edx, r8b
inc r9
xor rdx, rcx
shr r8d, 8
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x18001df01
not r8d
mov eax, r8d
ret
Function at 0x18003e29c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rbp, r8
mov r10d, ebx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rsp + r10 + 0x38]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x18003e2c8
mov rcx, qword [r11 + 0x38]
mov r8, qword [r11 + 0x20]
and rcx, r9
add rcx, rcx
mov rax, qword [r8 + rcx*8 + 8]
cmp rax, qword [r11 + 0x10]
je 0x18003e317
mov r8, qword [r8 + rcx*8]
jmp 0x18003e310
cmp rax, r8
je 0x18003e317
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18003e307
jmp 0x18003e31a
mov rax, rbx
test rax, rax
cmove rax, qword [r11 + 0x10]
cmp rax, qword [r11 + 0x10]
je 0x18003e34d
mov rsi, qword [rax + 0x20]
mov rdi, qword [rax + 0x18]
cmp rdi, rsi
je 0x18003e34d
mov bl, 1
mov rcx, qword [rdi]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8 + 8]
add rdi, 8
cmp rdi, rsi
jne 0x18003e337
mov rbp, qword [rsp + 0x40]
mov al, bl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18003e86c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov rsi, rdx
movabs r8, 0xcbf29ce484222325
mov r10, rcx
xor r9d, r9d
movzx eax, byte [rbx + r9 + 0x10]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 4
jb 0x18003e891
mov rcx, qword [r10 + 0x30]
mov rdx, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
cmp qword [rdx + rcx*8 + 8], rbx
jne 0x18003e8e1
cmp qword [rdx + rcx*8], rbx
jne 0x18003e8d6
mov rax, qword [r10 + 8]
mov qword [rdx + rcx*8], rax
jmp 0x18003e8da
mov rax, qword [rbx + 8]
mov qword [rdx + rcx*8 + 8], rax
jmp 0x18003e8ee
cmp qword [rdx + rcx*8], rbx
jne 0x18003e8ee
mov rax, qword [rbx]
mov qword [rdx + rcx*8], rax
mov rdi, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x18003e94d
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x18003e939
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18003e970
mov rcx, r8
call fcn.18009168c
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov edx, 0x30
mov rcx, rbx
call fcn.18009168c
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.180095520
int3
Function at 0x18003eb78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
mov r14, rcx
xor edx, edx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rdx + r8]
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
inc rdx
cmp rdx, 4
jb 0x18003eba9
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [r14 + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea r13, [r14 + 8]
mov rbp, qword [r13]
cmp rbx, rbp
jne 0x18003ec46
mov rbx, rbp
movabs rax, 0x555555555555555
cmp qword [r14 + 0x10], rax
je 0x18003ed8e
mov qword [rsp + 0x20], r13
and qword [rsp + 0x28], 0
mov ecx, 0x30
call fcn.180091200
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
xor r12d, r12d
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r12
mov qword [rax + 0x28], r12
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18003ec7e
cvtsi2ss xmm0, rcx
jmp 0x18003ec93
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x18003ec58
cmp rbx, rdx
je 0x18003ec77
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18003ec4f
mov rbp, qword [rbx]
mov rax, rbx
mov rbx, rbp
test rax, rax
je 0x18003ebeb
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18003ed6e
mov rbp, rbx
xor eax, eax
jmp 0x18003ec66
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18003eca6
cvtsi2ss xmm1, rcx
jmp 0x18003ecbb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x18003ed15
mov rcx, r14
call fcn.18000af24
mov rcx, qword [r14 + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r13]
cmp rax, rbx
je 0x18003ed0b
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x18003ed03
mov rbx, rax
cmp rax, r8
je 0x18003ed49
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18003ecf7
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], rbp
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x18003ed50
mov qword [rcx + rax*8], rdi
jmp 0x18003ed62
mov qword [rsp + 0x20], rax
jmp 0x18003ed10
cmp r8, rbp
jne 0x18003ed5b
mov qword [rcx + rax*8], rdi
jmp 0x18003ed67
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18003ed67
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18008f2f8
int3