joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180024570
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x58]
sub rsp, 0x150
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x180176168]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rcx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.1800231d0
nop
lea rdx, [rbp - 0x70]
call fcn.1800241e0
nop
mov rax, qword [rbx + 8]
mov ecx, dword [rbx]
mov rdx, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], ecx
mov qword [rsp + 0x60], rdx
call fcn.1800a2c00
mov rsi, rax
movups xmm6, xmmword [rdi]
mov ebx, dword [rax + 0x40]
cmp ebx, 5
setle r14b
lea rcx, [rax + 0x88]
call fcn.1800a2e40
movzx edi, al
cmp ebx, 5
jle 0x18002460f
test al, al
je 0x180024689
lea rcx, [rsi + 8]
cmp qword [rsi + 0x20], 0x10
jb 0x18002461e
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x40], rcx
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x48], rax
movdqa xmmword [rsp + 0x30], xmm6
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x70], xmm1
movsd xmm0, qword [rsp + 0x60]
movsd qword [rbp - 0x80], xmm0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.1800a0240
movzx r9d, dil
movzx r8d, r14b
lea rdx, [rbp - 0x30]
mov rcx, rsi
call fcn.1800a7ab0
xor ebx, ebx
cmp qword [rbp - 0x60], rbx
jne 0x180024696
mov r8d, ebx
jmp 0x1800246a4
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r8, qword [rbp - 0x70]
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 8
cmovae rdx, qword [rbp - 0x50]
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180024714
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002470f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18002470f
call fcn.1800c5428
int3
call fcn.1800beb44
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], bx
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180024766
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180024761
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180024761
call fcn.1800c5428
int3
call fcn.1800beb44
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1800be760
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x180035760
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180176168]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rax, vtable.TRAITS::PotionTraits.0
mov qword [r11 + 0x18], r12
mov qword [rcx], rax
mov r12, rdx
mov byte [rcx + 9], 0
lea rax, [0x180120254]
mov byte [rcx + 0xb], 0
mov r14, rcx
mov rbp, qword [rdx + 0x10]
mov qword [r11 - 0x38], r13
mov r13d, 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r13
test rbp, rbp
je 0x180035817
cmp qword [rdx + 0x18], 0x10
mov r15, rdx
jb 0x1800357d1
mov r15, qword [rdx]
cmp rbp, 4
jne 0x18003592c
lea rsi, str.NONE
sub r15, rsi
nop word [rax + rax]
movzx ecx, byte [r15 + rsi]
movzx edi, byte [rsi]
call fcn.1800c57d0
mov ecx, edi
mov ebx, eax
call fcn.1800c57d0
cmp ebx, eax
jne 0x18003592c
inc rsi
sub rbp, 1
jne 0x1800357f0
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
xor r13d, r13d
mov edx, 2
movdqu xmmword [rsp + 0x48], xmm0
xor ebx, ebx
mov rax, qword [rcx + 0x10]
mov rdi, qword [rcx + 8]
mov r12, qword [rsp + 0xe0]
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], rax
mov qword [rcx + 0x10], 0
mov qword [rcx + 8], 0
mov qword [rcx], 0
mov qword [rsp + 0x70], rbx
test edx, edx
je 0x180035876
lea rcx, [rsp + 0x40]
call fcn.180013200
test r13d, r13d
mov r13, qword [rsp + 0x90]
je 0x18003588d
lea rcx, [rsp + 0x58]
call fcn.180013200
cmp rbx, rdi
je 0x18003599a
movabs rsi, 0x7d04007b4982b3a
movabs rbp, 0xaf63fb4c86022139
movabs r15, 0xcbf29ce484222325
movabs r9, 0x100000001b3
movabs r11, 0x7d02a07b49805d8
movabs r10, 0xaf640d4c86023fcf
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x1800358df
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rdx, r15
add r8, rcx
cmp rcx, r8
je 0x18003598d
movsx rax, byte [rcx]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, r8
jne 0x1800358f2
cmp rdx, r11
je 0x18003597c
cmp rdx, rsi
je 0x180035969
cmp rdx, rbp
je 0x180035956
cmp rdx, r10
jne 0x18003598d
mov word [rsp + 0x20], 0x101
movzx eax, word [rsp + 0x20]
mov word [r14 + 8], ax
jmp 0x18003598d
movaps xmm0, xmmword [rsp + 0x30]
lea r8, [rsp + 0x30]
mov rdx, r12
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x58]
call fcn.180041350
mov rcx, rax
xor edx, edx
mov rbx, qword [rax]
jmp 0x18003582f
mov word [rsp + 0x22], 0x101
movzx eax, word [rsp + 0x22]
mov word [r14 + 0xa], ax
jmp 0x18003598d
mov word [rsp + 0x24], 0x100
movzx eax, word [rsp + 0x24]
mov word [r14 + 0xa], ax
jmp 0x18003598d
mov word [rsp + 0x28], 0x100
movzx ecx, word [rsp + 0x28]
mov word [r14 + 8], cx
add rbx, 0x20
cmp rbx, rdi
jne 0x1800358d2
lea rcx, [rsp + 0x70]
call fcn.180013200
mov rax, r14
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800be760
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180038c50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov ecx, 0x10
mov rdi, rdx
call fcn.1800be780
mov r8, rax
mov qword [rsp + 0x28], rax
lea rax, vtable.TRAITS::IngredientTraits.0
mov rcx, rdi
mov qword [r8], rax
mov byte [r8 + 9], 0
cmp qword [rdi + 0x18], 0x10
jb 0x180038c93
mov rcx, qword [rdi]
mov r9, qword [rdi + 0x10]
movabs rdx, 0xcbf29ce484222325
add r9, rcx
cmp rcx, r9
je 0x180038d24
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movsx rax, byte [rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jne 0x180038cc0
movabs rax, 0x7d04007b4982b3a
cmp rdx, rax
je 0x180038d13
movabs rax, 0xaf63fb4c86022139
cmp rdx, rax
mov rax, rbx
jne 0x180038d27
mov word [rsp + 0x20], 0x101
movzx ecx, word [rsp + 0x20]
mov word [r8 + 8], cx
mov qword [rbx], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov word [rsp + 0x20], 0x100
movzx eax, word [rsp + 0x20]
mov word [r8 + 8], ax
mov rax, rbx
mov qword [rbx], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180039600
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1800ca6a4
test eax, eax
jne 0x180039880
mov rcx, rdi
call fcn.1800cac58
test eax, eax
js 0x180039880
jne 0x18003963e
xor eax, eax
add rsp, 0x78
pop rdi
pop rbx
ret
mov qword [rsp + 0x98], rsi
lea rdx, [0x18010ecd8]
mov qword [rsp + 0x68], r14
movsxd r14, eax
lea rcx, [r14 + 1]
call fcn.1800bee44
mov rsi, rax
test rax, rax
jne 0x18003967d
lea eax, [rsi - 2]
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x68]
add rsp, 0x78
pop rdi
pop rbx
ret
xor r8d, r8d
mov byte [r14 + rax], 0
xor edx, edx
mov rcx, rdi
call fcn.1800ca6a4
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1800caf50
mov rdi, rax
cmp rax, r14
je 0x1800396b9
mov rcx, rsi
call fcn.1800beb44
mov eax, 0xfffffffd
jmp 0x180039669
mov r14, rsi
cmp rdi, 3
jb 0x1800396e1
cmp word [rsi], 0xbbef
jne 0x1800396f5
cmp byte [rsi + 2], 0xbf
jne 0x1800396f5
add rdi, 0xfffffffffffffffd
lea r14, [rsi + 3]
cmp qword [rbx], 0
jne 0x1800396e1
mov byte [rbx + 0x40], 1
test rdi, rdi
jne 0x1800396f5
mov rcx, rsi
call fcn.1800beb44
mov eax, edi
jmp 0x180039669
cmp rdi, 0xffffffffffffffff
jne 0x18003970a
mov rcx, rsi
call fcn.1800beb44
mov eax, edi
jmp 0x180039669
mov qword [rsp + 0x90], rbp
lea rdx, [0x18010ecd8]
mov qword [rsp + 0x60], r15
lea r15, [rdi + 1]
mov rcx, r15
call fcn.1800bee44
mov rbp, rax
test rax, rax
jne 0x18003973a
lea edi, [rax - 2]
jmp 0x180039864
mov r8, r15
mov qword [rsp + 0x70], r12
xor edx, edx
mov rcx, rbp
call fcn.1800c10c0
mov r8, rdi
mov rdx, r14
mov rcx, rbp
call fcn.1800c0a20
mov r12, qword [rbx]
lea rax, [0x180120068]
xor edi, edi
mov qword [rsp + 0x50], rbp
test r12, r12
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x40], rdi
setne r14b
mov qword [rsp + 0xa8], rdi
movzx r8d, r14b
mov qword [rsp + 0xa0], rdi
mov rcx, rbx
call fcn.18003be90
test eax, eax
js 0x180039854
lea rax, [rsp + 0xa0]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0xa8]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call fcn.18003c040
test al, al
je 0x180039845
nop word [rax + rax]
mov rax, qword [rsp + 0xa0]
mov rcx, rbx
mov r9, qword [rsp + 0xa8]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov byte [rsp + 0x30], r14b
mov qword [rsp + 0x20], rax
call fcn.18003c720
test eax, eax
js 0x180039854
lea rax, [rsp + 0xa0]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0xa8]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
call fcn.18003c040
test al, al
jne 0x1800397e0
test r12, r12
je 0x180039858
mov rcx, rbp
call fcn.1800beb44
jmp 0x18003985f
mov edi, eax
jmp 0x18003985f
mov qword [rbx], rbp
mov qword [rbx + 8], r15
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x90]
mov rcx, rsi
mov r15, qword [rsp + 0x60]
call fcn.1800beb44
mov eax, edi
jmp 0x180039669
mov eax, 0xfffffffd
add rsp, 0x78
pop rdi
pop rbx
ret
Function at 0x18008d040
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008d20b
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18008a270
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18008d1d4
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18008d14d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18008d1c3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18008d18a
mov r10, qword [rdx]
cmp r10, rax
je 0x18008d184
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18008d1c3
cmp r9, rdx
je 0x18008d19f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18008d1e5
cmp r9, rdx
jne 0x18008d190
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18008d0d1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18008d1c3
lea rcx, str.invalid_hash_bucket_count
call fcn.1800bc098
int3
Function at 0x180094a50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x420
mov rax, qword [0x180176168]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov ebx, dword [rcx + 0xc]
mov r9, rdx
mov r11, rcx
cmp ebx, dword [rcx + 0x10]
jne 0x180094a91
mov rcx, qword [rcx + 0x28]
lea r8, [rbx + rbx*2]
lea rdx, [rcx + r8*8]
mov qword [r9], rdx
mov qword [r9 + 8], rdx
jmp 0x180094bf9
mov qword [rsp + 0x430], rbp
lea rax, [0x1801365f0]
xor ebp, ebp
mov qword [rsp + 0x440], rsi
mov qword [rsp + 0x448], rdi
mov rdi, qword [r8]
test rdi, rdi
lea edx, [rbp + 8]
lea r10, [rdi - 0x18]
cmove r10, rbp
test r10, r10
lea rcx, [r10 + 0x18]
cmove rcx, rbp
test rcx, rcx
cmovne rax, rcx
lea rcx, [0x18015eef0]
mov qword [rsp], rax
lea rax, [rsp + 0x10]
nop word [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180094af0
lea rsi, [rsp + 8]
mov edx, ebp
lea r8, [rsp]
cmp r8, rsi
je 0x180094b7b
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8]
mov ecx, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
inc r8
xor edx, dword [rsp + rax*4 + 0x10]
cmp r8, rsi
jne 0x180094b60
mov r8, qword [r11 + 0x28]
lea ecx, [rbx - 1]
mov rsi, qword [rsp + 0x440]
mov eax, edx
and rcx, rax
lea rax, [rcx + rcx*2]
cmp qword [r8 + rax*8 + 0x10], rbp
lea rax, [r8 + rax*8]
je 0x180094bda
nop
mov rdx, qword [rax]
cmp rdx, rdi
je 0x180094c15
test rdx, rdx
lea rcx, [rdx - 0x18]
cmove rcx, rbp
test rcx, rcx
je 0x180094bc1
test dword [rcx + 0x10], 0xffffff
jne 0x180094bd0
test r10, r10
je 0x180094c15
test dword [r10 + 0x10], 0xffffff
je 0x180094c15
mov rax, qword [rax + 0x10]
cmp rax, qword [r11 + 0x18]
jne 0x180094ba0
lea rcx, [rbx + rbx*2]
lea rax, [r8 + rcx*8]
mov qword [r9], rax
mov qword [r9 + 8], rax
mov rbp, qword [rsp + 0x430]
mov rdi, qword [rsp + 0x448]
mov rax, r9
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1800be760
add rsp, 0x420
pop rbx
ret
lea rdx, [rbx + rbx*2]
mov qword [r9], rax
lea rcx, [r8 + rdx*8]
mov qword [r9 + 8], rcx
test rcx, rcx
je 0x180094be9
cmp rax, rcx
je 0x180094be9
cmp qword [rax + 0x10], rbp
jne 0x180094be9
add rax, 0x18
mov qword [r9], rax
cmp rax, rcx
je 0x180094be9
cmp qword [rax + 0x10], rbp
je 0x180094c34
jmp 0x180094be9
Function at 0x180094d60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x440
mov rax, qword [0x180176168]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov edi, ecx
mov qword [rsp + 0x28], 0x7d92f
lea rcx, [rsp + 0x28]
call fcn.180033b20
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x28], 0x7d938
mov rbx, rax
call fcn.180033b20
mov r9, qword [rbx]
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
test r9, r9
je 0x180094f01
mov r10d, dword [r9 + 0xc]
xor r11d, r11d
cmp r10d, dword [r9 + 0x10]
jne 0x180094de3
mov rax, qword [r9 + 0x28]
lea rcx, [r10 + r10*2]
lea rdx, [rcx*8]
add rax, rdx
jmp 0x180094eef
mov dword [rsp + 0x20], edi
lea rax, [rsp + 0x30]
lea rcx, [0x18015eef0]
mov edx, 8
nop dword [rax + rax]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180094e00
lea rbx, [rsp + 0x24]
mov edx, r11d
lea r8, [rsp + 0x20]
cmp r8, rbx
je 0x180094e8b
nop word [rax + rax]
movzx ecx, byte [r8]
mov eax, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
inc r8
xor edx, dword [rsp + rax*4 + 0x30]
cmp r8, rbx
jne 0x180094e70
mov r8, qword [r9 + 0x28]
lea ecx, [r10 - 1]
mov eax, edx
and rcx, rax
lea rax, [rcx + rcx*2]
cmp qword [r8 + rax*8 + 0x10], r11
lea rax, [r8 + rax*8]
je 0x180094efc
cmp dword [rax], edi
je 0x180094eba
mov rax, qword [rax + 0x10]
cmp rax, qword [r9 + 0x18]
jne 0x180094ea7
mov rax, r11
jmp 0x180094f03
lea rdx, [r10 + r10*2]
lea rdx, [rdx*8]
lea rcx, [r8 + rdx]
test rcx, rcx
je 0x180094eef
cmp rax, rcx
je 0x180094eef
cmp qword [rax + 0x10], r11
jne 0x180094eef
nop word [rax + rax]
add rax, 0x18
cmp rax, rcx
je 0x180094eef
cmp qword [rax + 0x10], r11
je 0x180094ee0
add rdx, qword [r9 + 0x28]
cmp rax, rdx
je 0x180094efc
mov r11, qword [rax + 8]
mov rax, r11
jmp 0x180094f03
xor eax, eax
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.1800be760
mov rbx, qword [rsp + 0x450]
add rsp, 0x440
pop rdi
ret
Function at 0x1800a1de0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800a1f6f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1800a1c10
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800a1f34
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1800a1eb2
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800a1f23
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1800a1eeb
mov r10, qword [rdx]
cmp r10, rax
je 0x1800a1ee5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800a1f23
cmp r8, rdx
je 0x1800a1eff
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1800a1f49
cmp r8, rdx
jne 0x1800a1ef0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800a1e80
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800a1f23
lea rcx, str.invalid_hash_bucket_count
call fcn.1800bc098
int3
Function at 0x1800a2950
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
push r12
sub rsp, 0x178
mov rax, qword [0x180176168]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov rdi, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x1800a297d
mov rcx, qword [rcx]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x168], r14
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800a2b25
mov rsi, qword [rdi + 0x10]
test rsi, rsi
je 0x1800a2ba3
mov rbp, r12
lea r15, [0x1800ee86c]
nop dword [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], r12b
jne 0x1800a29d7
cmp qword [rdi + 0x18], 0xf
mov r14, rdi
jbe 0x1800a29ed
mov r14, qword [rdi]
test rbx, rbx
je 0x1800a2a5d
cmp rbp, rsi
jae 0x1800a2a5d
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.1800c10c0
lea rdx, [rbx + r15]
mov rcx, r15
cmp r15, rdx
je 0x1800a2a30
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x50], 1
cmp rcx, rdx
jne 0x1800a2a20
lea rcx, [rsi + r14]
lea rbx, [r14 + rbp]
cmp rbx, rcx
jae 0x1800a2a5d
nop dword [rax]
movzx eax, byte [rbx]
cmp byte [rsp + rax + 0x50], r12b
jne 0x1800a2a54
inc rbx
cmp rbx, rcx
jb 0x1800a2a40
jmp 0x1800a2a5d
sub rbx, r14
cmp rbx, 0xffffffffffffffff
jne 0x1800a2a61
mov rbx, qword [rdi + 0x10]
cmp qword [rdi + 0x10], rbx
mov r8, rbx
xorps xmm0, xmm0
mov qword [rsp + 0x38], r12
cmovb r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], r12
jbe 0x1800a2a8c
mov rdx, qword [rdi]
lea rcx, [rsp + 0x28]
call fcn.180013020
cmp qword [rsp + 0x38], r12
je 0x1800a2ad7
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1800a2ad7
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call fcn.1800d02f4
test eax, eax
jne 0x1800a2b6a
mov rdx, qword [rsp + 0x40]
lea rbp, [rbx + 1]
cmp rdx, 0xf
jbe 0x1800a2b18
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a2b13
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a2ba7
call fcn.1800beb44
mov rsi, qword [rdi + 0x10]
cmp rbp, rsi
jb 0x1800a29d0
mov al, 1
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x170]
mov rbp, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800be760
add rsp, 0x178
pop r12
pop rdi
ret
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1800a2ba3
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a2b9e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a2ba7
call fcn.1800beb44
xor al, al
jmp 0x1800a2b27
call fcn.1800c5428
int3
Function at 0x1800a2e50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 0xf
mov rsi, rcx
mov r9, rdx
jbe 0x1800a2e6f
mov r9, qword [rdx]
mov r10, qword [rdx + 0x10]
xor r8d, r8d
movabs rdi, 0xcbf29ce484222325
test r10, r10
je 0x1800a2ea4
movabs rcx, 0x100000001b3
nop
movzx eax, byte [r8 + r9]
inc r8
xor rdi, rax
imul rdi, rcx
cmp r8, r10
jb 0x1800a2e90
mov r8, rdx
mov r9, rdi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.18009b810
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1800a2f44
mov rdx, qword [rsi + 0x30]
and rdx, rdi
shl rdx, 4
add rdx, qword [rsi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800a2ef8
cmp rax, rbx
jne 0x1800a2eee
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1800a2f03
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1800a2f03
cmp rax, rbx
jne 0x1800a2f03
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rsi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.1800a12e0
mov edx, 0x40
mov rcx, rbx
call fcn.1800beb44
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret