joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d1f50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [0x180109030]
mov rdi, rax
test rax, rax
jne 0x1800d1f92
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1800d1fd9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1800d2032
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
sub rbp, 1
jne 0x1800d1ff0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1800d2073
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1800e8872]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1800e8873]
mov r8d, 1
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1800d2040
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1800d33d8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800d345c
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1800d345c
dec r8
sub rdx, 1
jne 0x1800d3442
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x18001de10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
mov rdi, r9
mov rsi, r8
mov rbx, rdx
mov r15, rcx
lea rax, vtable.YimMenu::Command.0
mov qword [rcx], rax
add rcx, 8
call fcn.18001d6d0
nop
lea rcx, [r15 + 0x28]
mov rdx, rsi
call fcn.18001d6d0
nop
lea rcx, [r15 + 0x48]
mov rdx, rdi
call fcn.18001d6d0
nop
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18001de77
mov r9, qword [rbx]
mov r11, qword [rbx + 0x10]
xor r10d, r10d
add r11, r9
lea r14, [rbx + 0x18]
cmp r9, r11
je 0x18001deca
nop word [rax + rax]
movzx r8d, byte [r9]
lea edx, [r8 - 0x41]
movzx eax, r8b
or al, 0x20
movzx ecx, al
cmp dl, 0x19
cmova ecx, r8d
movsx eax, cl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
inc r9
cmp r9, r11
jne 0x18001de90
lea r14, [rbx + 0x18]
lea ecx, [r10 + r10*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [r15 + 0x68], eax
mov eax, dword [rsp + 0xa0]
mov dword [r15 + 0x6c], eax
mov ecx, dword [0x1801ebe5c]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1801ec528], eax
jg 0x18001e03c
mov eax, dword [r15 + 0x68]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], r15
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [0x1801ec4d0]
call fcn.18001f090
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18001df73
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18001df6a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001e027
mov rcx, r8
call fcn.180111228
lea r14, [rbx + 0x18]
mov qword [rbx + 0x10], 0
mov qword [r14], 0xf
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18001dfbb
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18001dfb6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001e02e
mov rcx, r8
call fcn.180111228
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18001e004
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x18001dfff
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001e035
mov rcx, r8
call fcn.180111228
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rax, r15
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x1801ec528]
call fcn.1801111b0
cmp dword [0x1801ec528], 0xffffffff
jne 0x18001df11
call fcn.18001e140
lea rcx, [0x18012ae20]
call fcn.1801110f0
nop
lea rcx, [0x1801ec528]
call fcn.180111144
jmp 0x18001df11
Function at 0x18001f090
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x18001f11f
mov rbx, r15
mov rbp, r15
jmp 0x18001f16c
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x18001f13e
nop dword [rax + rax]
cmp rbx, rcx
je 0x18001f166
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18001f130
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [rsi + 0x10], rax
jne 0x18001f18a
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.180111264
mov rdi, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r13]
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18001f1c7
cvtsi2ss xmm0, rcx
jmp 0x18001f1dc
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18001f1ef
cvtsi2ss xmm1, rcx
jmp 0x18001f204
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x18001f269
mov rcx, rsi
call fcn.18001f5a0
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x18001f23c
mov qword [rsp + 0x28], 0
jmp 0x18001f25c
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x18001f259
mov rbx, rax
cmp rax, rdx
je 0x18001f29d
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18001f248
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x18001f2ad
mov qword [rcx + rax*8], rdi
jmp 0x18001f2bf
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x18001f261
cmp r8, rbp
jne 0x18001f2b8
mov qword [rcx + rax*8], rdi
jmp 0x18001f2c4
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18001f2c4
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x18001f146
Function at 0x18001f650
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18001f688
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001ef40
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18001f7c4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18001f73d
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18001f7b3
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x18001f77a
mov r10, qword [rdx]
cmp r10, rax
je 0x18001f774
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18001f7b3
cmp r9, rdx
je 0x18001f78f
nop
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x18001f7d9
cmp r9, rdx
jne 0x18001f780
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x18001f6f0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18001f7b3
Function at 0x180020f50
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov ecx, dword [0x1801ebe5c]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1801fbfb8], eax
jg 0x180021090
xor ebp, ebp
mov ebx, ebp
nop word [rax + rax]
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x180021020
cmp ebx, 1
je 0x180021020
mov rax, qword [0x1801fbfc0]
mov rcx, qword [0x1801fbfc8]
cmp rax, rcx
je 0x180020fd2
cmp dword [rax], ebx
je 0x180021020
add rax, 4
cmp rax, rcx
jne 0x180020fc5
mov dword [rsi], ebx
mov rcx, qword [rdi]
test rcx, rcx
je 0x18002101c
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x18002100c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180021089
mov rcx, r8
call fcn.180111228
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
mov al, 1
jmp 0x180021074
inc ebx
cmp ebx, 0xfe
jl 0x180020fa0
mov rcx, qword [rdi]
test rcx, rcx
je 0x180021072
mov rdx, qword [rdi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x180021062
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180021089
mov rcx, r8
call fcn.180111228
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x1801fbfb8]
call fcn.1801111b0
cmp dword [0x1801fbfb8], 0xffffffff
jne 0x180020f96
mov rdx, rdi
lea rcx, [0x1801fbfc0]
call fcn.1800210e0
lea rcx, [0x18012aeb0]
call fcn.1801110f0
nop
lea rcx, [0x1801fbfb8]
call fcn.180111144
jmp 0x180020f96
Function at 0x1800223b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov edx, dword [0x1801ebe5c]
mov rax, qword gs:[0x58]
mov ecx, 0x10
mov rax, qword [rax + rdx*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801ec528], eax
jg 0x180022489
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
mov eax, ebx
shr eax, 8
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov eax, ebx
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r8
mov rax, rbx
shr rax, 0x18
xor rdx, rax
imul rdx, r8
mov rcx, qword [0x1801ec500]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1801ec4e8]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1801ec4d8]
cmp rax, rdx
je 0x180022466
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x180022468
cmp rax, rcx
je 0x180022466
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x180022456
jmp 0x180022468
xor eax, eax
mov rcx, rdx
test rax, rax
cmovne rcx, rax
cmp rcx, rdx
je 0x180022481
mov rax, qword [rcx + 0x18]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1801ec528]
call fcn.1801111b0
cmp dword [0x1801ec528], 0xffffffff
jne 0x1800223df
call fcn.18001e140
lea rcx, [0x18012ae20]
call fcn.1801110f0
nop
lea rcx, [0x1801ec528]
call fcn.180111144
jmp 0x1800223df
Function at 0x1800287c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push r13
sub rsp, 0x20
mov qword [rsp + 0x40], rsi
mov r13, rcx
mov rsi, qword [rdx + 0x10]
mov qword [rsp + 0x48], rdi
mov rdi, rdx
mov qword [rsp + 0x58], r15
mov r15, qword [rdx + 0x18]
cmp r15, 0xf
jbe 0x1800287ef
mov rdx, qword [rdx]
xor ecx, ecx
movabs rbp, 0xcbf29ce484222325
test rsi, rsi
je 0x180028823
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor rbp, rax
imul rbp, r8
cmp rcx, rsi
jb 0x180028810
mov rcx, qword [r13 + 0x30]
mov rax, qword [r13 + 0x18]
and rcx, rbp
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r13 + 8]
jne 0x180028840
xor ebx, ebx
jmp 0x180028891
mov qword [rsp + 0x50], r14
mov r14, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0xf
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x180028862
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0xf
jbe 0x18002886e
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x18002887f
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x18002888c
cmp rbx, r14
je 0x18002888a
mov rbx, qword [rbx + 8]
jmp 0x180028850
xor ebx, ebx
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test rbx, rbx
je 0x18002897c
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rbp
add rax, rax
lea r8, [rcx + rax*8]
lea rdx, [rcx + rax*8]
mov rax, qword [rcx + rax*8]
cmp qword [r8 + 8], rbx
jne 0x1800288e5
cmp rax, rbx
jne 0x1800288db
mov rax, qword [r13 + 8]
mov qword [rdx], rax
mov qword [r8 + 8], rax
jmp 0x1800288f0
mov rax, qword [rbx + 8]
mov qword [r8 + 8], rax
jmp 0x1800288f0
cmp rax, rbx
jne 0x1800288f0
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r13 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x30]
call fcn.180026a00
mov rdx, qword [rbx + 0x28]
cmp rdx, 0xf
jbe 0x180028946
mov rcx, qword [rbx + 0x10]
inc rdx
cmp rdx, 0x1000
jb 0x180028941
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180028975
mov rcx, r8
call fcn.180111228
mov edx, 0xf0
mov qword [rbx + 0x20], 0
mov rcx, rbx
mov qword [rbx + 0x28], 0xf
mov byte [rbx + 0x10], 0
call fcn.180111228
mov eax, 1
add rsp, 0x20
pop r13
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xor eax, eax
add rsp, 0x20
pop r13
pop rbp
pop rbx
ret
Function at 0x180031810
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov ebx, 1
bsr rcx, rax
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x180031841
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x1801fbff8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
inc ecx
shl rbx, cl
lea rcx, [0x1801fc008]
lea rdx, [rbx + rbx]
call fcn.18001ef40
mov rcx, qword [0x1801fbff8]
lea r9, [rbx - 1]
mov qword [0x1801fc020], r9
mov qword [0x1801fc028], rbx
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1800319e2
mov qword [rsp + 0x30], rsi
mov rax, rcx
movabs rsi, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, r9
shl r11, 4
add r11, qword [0x1801fc008]
mov r9, qword [r11]
cmp r9, rdi
jne 0x18003192c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800319a3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180031969
mov r10, qword [rdx]
cmp r10, rax
je 0x180031963
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800319a3
cmp r9, rdx
je 0x18003197f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800319b7
cmp r9, rdx
jne 0x180031970
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
je 0x1800319dd
mov r9, qword [0x1801fc020]
jmp 0x1800318b1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800319a3
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180031c00
Capabilities:
Set console window title

Disassembly:
mov byte [rsp + 0x20], r9b
push rdi
sub rsp, 0x70
movaps xmm0, xmmword [rdx]
mov r9, r8
mov qword [rsp + 0x60], rsi
mov rdi, rcx
lea rsi, [rcx + 0x130]
movups xmmword [rcx + 8], xmm0
cmp rsi, r8
je 0x180031c8b
cmp qword [r8 + 0x18], 7
mov rdx, qword [r8 + 0x10]
jbe 0x180031c36
mov r9, qword [r8]
mov rax, qword [rsi + 0x18]
cmp rdx, rax
ja 0x180031c83
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x68], rbp
mov rbp, rsi
cmp rax, 7
jbe 0x180031c58
mov rbp, qword [rsi]
lea rbx, [rdx + rdx]
mov qword [rsi + 0x10], rdx
mov r8, rbx
mov rdx, r9
mov rcx, rbp
call sub.VCRUNTIME140.dll_memmove
xor eax, eax
mov word [rbx + rbp], ax
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
jmp 0x180031c8b
mov rcx, rsi
call fcn.1800259f0
mov byte [rdi], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
setne cl
mov byte [rdi + 1], cl
test eax, eax
jne 0x180031cae
call qword [sym.imp.KERNEL32.dll_AllocConsole]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x180031d0a
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rcx, qword [rdi + 0x20]
lea rdx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rdi + 0x20]
mov dword [rdi + 0x18], edx
and edx, 0xffffffbf
or edx, 0xc
mov dword [rsp + 0x98], edx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
cmp byte [rdi], 0
je 0x180031d18
lea rcx, [rdi + 0x28]
call fcn.180031ec0
cmp qword [rsi + 0x18], 7
jbe 0x180031d22
mov rsi, qword [rsi]
lea rcx, [rdi + 0x158]
mov r8d, 0x12
mov rdx, rsi
call fcn.180032040
mov rcx, qword [rdi + 0x150]
xor r8d, r8d
mov rsi, qword [rsp + 0x60]
movsxd rdx, dword [rcx + 4]
lea rcx, [rdi + 0x150]
add rcx, rdx
test rax, rax
je 0x180031d63
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
jmp 0x180031d6e
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
call fcn.18010dc20
lea rax, [0x180150760]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
call fcn.18010d630
lea rax, [0x180150728]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x20]
mov qword [rsp + 0x58], rax
call fcn.18010d630
mov al, 1
add rsp, 0x70
pop rdi
ret