joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000cf30
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r12, r9
mov rsi, r8
mov r15, rdx
mov rdi, rcx
cmp r8, rbx
jne 0x14000cf78
lea rdx, str.RegistryEx.cpp
lea rcx, str.pszValue___pszDefaultValue
mov r8d, 0x126
call fcn.140007000
xor ebp, ebp
mov r13d, ebp
test r15, r15
je 0x14000d110
test rsi, rsi
je 0x14000d110
test r12, r12
je 0x14000d110
mov rcx, qword [rdi + 0x10]
or rdi, 0xffffffffffffffff
mov qword [rsp + 0x60], r14
test rcx, rcx
je 0x14000d0c5
mov r14, qword [rsp + 0x88]
mov r13d, dword [r12]
mov qword [rsp + 0x68], rcx
test r14, r14
je 0x14000cfed
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d0c5
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x80]
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
test r14, r14
je 0x14000d01e
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x80]
cmp ecx, 2
jne 0x14000d090
mov eax, 2
mul r13
cmovo rax, rdi
mov rcx, rax
call fcn.14000dd54
mov r14, rax
test rax, rax
je 0x14000d089
mov r8d, r13d
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, rsi
mov rcx, r14
sub rdx, r14
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx + rcx - 2], ax
test ax, ax
jne 0x14000d060
mov rax, rdi
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000d074
mov rcx, r14
mov dword [r12], eax
call fcn.14000dd5c
mov ecx, dword [rsp + 0x80]
test r15d, r15d
jne 0x14000d0c5
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14000d0a2
cmp ecx, 7
jne 0x14000d0a7
mov ebp, 1
mov eax, ebp
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14000d10c
nop word [rax + rax]
cmp word [rbx + rdi*2 + 2], bp
lea rdi, [rdi + 1]
jne 0x14000d0d0
lea ecx, [rdi*2 + 2]
cmp ecx, r13d
ja 0x14000d10c
sub rsi, rbx
nop word [rax + rax]
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rsi + rbx - 2], ax
test ax, ax
jne 0x14000d0f0
mov dword [r12], ecx
mov eax, 1
jmp 0x14000d0a9
xor eax, eax
jmp 0x14000d0a9
xor eax, eax
jmp 0x14000d0ae
Function at 0x14000d320
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push r14
sub rsp, 0x60
mov rcx, qword [rcx + 0x10]
mov rsi, r9
mov r14d, r8d
mov rbp, rdx
test rcx, rcx
je 0x14000d403
test rdx, rdx
je 0x14000d403
test r9, r9
je 0x14000d403
mov qword [r11 + 0x10], rbx
xor ebx, ebx
mov qword [r11 - 0x18], rcx
cmp qword [rsp + 0x98], rbx
je 0x14000d3c4
mov rdx, qword [rsp + 0x98]
lea rax, [r11 + 8]
xor r9d, r9d
mov qword [r11 - 0x28], rax
lea rax, [r11 - 0x18]
xor r8d, r8d
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x38], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000d3bf
xor eax, eax
mov rbx, qword [rsp + 0x78]
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [rsp + 0x50]
mov eax, dword [rsp + 0x90]
mov r9d, r14d
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
cmp qword [rsp + 0x98], rbx
je 0x14000d3fa
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov eax, ebx
jmp 0x14000d3a7
lea r11, [rsp + 0x60]
xor eax, eax
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400043a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400043fd
lea rbx, [0x140064e30]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400043e4
cmp r10, 2
jb 0x1400043e4
cmp byte [r9], r8b
jne 0x1400043e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400043c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000443f
lea rbx, [0x140064e30]
cmp r8b, 0x23
jne 0x140004423
cmp byte [r9], r8b
jne 0x140004423
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140004410
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140004580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000459a
mov qword [r8], 0
lea rdx, [0x1400a9bd0]
call fcn.140004450
mov rbx, rax
test rax, rax
jne 0x1400045ba
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140004691
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004691
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140004691
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140004691
cmp rdi, 0xffffffffffffffff
je 0x140004691
mov rax, qword [0x1400b6cb0]
test rax, rax
je 0x14000462e
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140004691
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000467e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400b6cb0]
test rax, rax
je 0x140004673
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000469a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000468c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000469c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400125e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400b6cb0]
lea rdx, [0x140064e30]
mov r8d, ecx
mov rbx, qword [rax + 0x1b90]
add rbx, 0x108
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x140012697
lea ecx, [r9 + 1]
test r8d, r8d
je 0x140012683
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140012688
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140023f60
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400135a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b6040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400b6cb0]
mov edi, edx
cmp byte [rbx + 0x1ef5], 0
jne 0x140013600
cmp byte [rbx + 0x1ef6], 0
jne 0x140013600
mov r9d, dword [rbx + 0x2f38]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004320
test dil, 1
je 0x140013729
jmp 0x14001368f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x2f38]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400ab12c]
mulss xmm1, dword [0x1400ab11c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1c5c], rax
mov dword [rbx + 0x1c44], 1
movss dword [rbx + 0x1c54], xmm0
mov byte [rbx + 0x1c7c], 1
movss dword [rbx + 0x1c58], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400ab084]
or dword [rbx + 0x1c40], 0x41
movss dword [rbx + 0x1ca0], xmm0
call fcn.140004320
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400136e0
lea r11, [0x140064e30]
nop
cmp r9b, 0x23
jne 0x1400136c3
cmp byte [r8], r9b
jne 0x1400136c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400136b0
not ecx
call fcn.14000bf20
test rax, rax
je 0x140013729
cmp byte [rax + 0xbf], 0
je 0x140013729
mov byte [rax + 0xc6], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0xdc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2f38]
mov edx, 0x10
mov r9d, dword [rbx + 0x2f38]
call fcn.140004320
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000eac0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140061160
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140018220
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1400b6cb0]
cmp byte [rbx + 0x3000], 0
je 0x14001830c
cmp qword [rbx + 0x3008], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3010]
je 0x1400182f4
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001829b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140023e30
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140004d90
mov eax, dword [rdi]
lea rcx, [0x1400b6ca8]
mov r9, qword [rbx + 0x3008]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x3018]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140004d90
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret

Function at 0x140018680
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400186d2
lea r11, [0x140064e30]
cmp r9b, 0x23
jne 0x1400186b5
cmp byte [r8], r9b
jne 0x1400186b5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400186a2
mov r11, qword [0x1400b6cb0]
mov r10, qword [r11 + 0x2fe8]
test r10, r10
je 0x140018719
lea r9, [r10 + 4]
test r9, r9
je 0x140018719
not eax
cmp dword [r9], eax
je 0x140018722
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x2fe0]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x1400186f0
mov rcx, rbx
pop rbx
jmp fcn.140018590
mov rax, r9
pop rbx
ret
Function at 0x14001bdb0
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001bfeb
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400b6040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x140064e30]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x14001bfb3
mov rcx, rbp
call fcn.14001b3a0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x14001be81
movsxd rdx, dword [rbp + 0x2f80]
mov r8, qword [rbp + 0x2f88]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x14001be71
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x14001be69
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x14001be6c
mov rdx, rcx
test rdx, rdx
jne 0x14001be40
cmp r8, r10
je 0x14001be81
cmp dword [r8], r9d
jne 0x14001be81
mov rcx, qword [r8 + 8]
jmp 0x14001be83
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb0]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb0], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x14001bf17
cmp qword [rcx + 0x18], 0
jne 0x14001bf0c
mov qword [rcx + 0x18], rbx
jmp 0x14001bf17
cmp qword [rcx + 0x20], 0
jne 0x14001bf17
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xa8], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14001bf4c
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x14001bf40
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140004320
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x14001bfa8
cmp r9b, 0x23
jne 0x14001bf8b
cmp byte [r8], r9b
jne 0x14001bf8b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x14001bf78
not ecx
call fcn.14000bf20
mov qword [rbx + 0x78], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001be00
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140061160
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140056200
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400562ac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14005623a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400564c0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14005627a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1400611bc
mov rcx, rbx
test rbx, rbx
jne 0x140056260
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400587e0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400565c4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400611bc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400565d0
cmp rbx, rbp
jne 0x140056570
cmp qword [rsp + 0x20], r14
jne 0x14005659d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400565df
mov qword [r15], r12
mov rax, r12
jmp 0x1400565e2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14005659d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400611bc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140056676
cmp rbx, rbp
jne 0x140056650
jmp 0x14005659a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400565f0
jmp 0x14005659d
Function at 0x140056310
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x140056345
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1400560c0
mov rcx, qword [rsi + 8]
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x140056484
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1400563fd
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140056473
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14005643a
mov r10, qword [rdx]
cmp r10, rax
je 0x140056434
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140056473
cmp r9, rdx
je 0x14005644f
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140056495
cmp r9, rdx
jne 0x140056440
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1400563b0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140056473
Function at 0x1400564c0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400562ac
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14005623a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x1400564c0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14005627a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.1400611bc
mov rcx, rbx
test rbx, rbx
jne 0x140056260
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.1400587e0
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400565c4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400611bc
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x1400565d0
cmp rbx, rbp
jne 0x140056570
cmp qword [rsp + 0x20], r14
jne 0x14005659d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x1400565df
mov qword [r15], r12
mov rax, r12
jmp 0x1400565e2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14005659d
nop dword [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1400611bc
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140056676
cmp rbx, rbp
jne 0x140056650
jmp 0x14005659a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x1400565f0
jmp 0x14005659d