joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6862fd70
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x58
lea rcx, str.LC_ALL
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6862fd90
cmp byte [rax], 0
jne 0x6862fe42
lea rcx, str.LC_MESSAGES
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6862fdaa
cmp byte [rax], 0
jne 0x6862fe42
lea rcx, str.LANG
call sub.msvcrt.dll_getenv
test rax, rax
je 0x6862fdc4
cmp byte [rax], 0
jne 0x6862fe42
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov r9d, 0xa
mov ebx, eax
lea r8, [rsp + 0x30]
mov edx, 0x59
mov ecx, eax
mov rsi, qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
call rsi
test eax, eax
je 0x6862fe51
mov r9d, 0xa
lea r8, [rsp + 0x40]
mov edx, 0x5a
mov ecx, ebx
call rsi
test eax, eax
je 0x6862fe51
mov eax, ebx
and ebx, 0x3ff
shr ax, 0xa
cmp ebx, 0x2c
je 0x6862fe64
cmp ebx, 0x43
je 0x6862fe64
cmp ebx, 0x1a
je 0x6862fe85
xor r9d, r9d
lea r8, [rsp + 0x40]
lea rdx, [0x686ba166]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call sym.libglib_2.0_0.dll_g_strconcat
jmp 0x6862fe4a
mov rcx, rax
call sym.libglib_2.0_0.dll_g_strdup
add rsp, 0x58
pop rbx
pop rsi
ret
lea rcx, [0x686ba164]
call sym.libglib_2.0_0.dll_g_strdup
add rsp, 0x58
pop rbx
pop rsi
ret
cmp ax, 1
lea r9, str._Latn
je 0x6862fe21
xor r9d, r9d
cmp ax, 2
lea rax, str._Cyrl
cmove r9, rax
jmp 0x6862fe21
cmp ax, 2
je 0x6862fe91
cmp ax, 6
jne 0x6862fe1e
lea r9, str._Latn
jmp 0x6862fe21

Function at 0x68631a60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov r9, r8
mov r8, rdx
lea rdx, [rsp + 0x28]
mov rsi, rcx
xor ecx, ecx
call fcn.68630e10
test rax, rax
mov rbx, rax
je 0x68631ab0
mov r8, qword [rsp + 0x28]
mov r9, rsi
mov edx, 1
mov rcx, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sym.libglib_2.0_0.dll_g_free
mov eax, dword [rsp + 0x28]
add rsp, 0x38
pop rbx
pop rsi
ret
mov eax, 0xffffffff
jmp 0x68631aa4

Function at 0x68631ac0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rax + 0x30]
mov r8, rsi
mov rdx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.68631a60
Function at 0x686568d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x686cd890]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x68656ab0
mov rax, qword [0x686cd888]
xor ebx, ebx
nop
mov r9, qword [rax + 8]
cmp rsi, r9
jb 0x6865691c
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 8]
add r9, rdx
cmp rsi, r9
jb 0x686569f0
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x68656900
mov rcx, rsi
call fcn.68657840
test rax, rax
mov r12, rax
je 0x68656ad4
movsxd rbx, ebx
lea r13, [rsp + 0x30]
lea r14, [rbx + rbx*2]
mov rbx, qword [0x686cd888]
shl r14, 3
add rbx, r14
mov qword [rbx + 0x10], rax
mov dword [rbx], 0
call fcn.68657920
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r13
mov qword [rbx + 8], rax
mov rax, qword [0x686cd888]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r14 + 8]
call rbx
test rax, rax
je 0x68656ab7
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x68656a65
add dword [0x686cd890], 1
mov r8d, 0x30
mov rdx, r13
mov rcx, rsi
call rbx
test rax, rax
je 0x68656ae3
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x68656a00
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r13, [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x686569ab
cmp eax, 0x40
je 0x686569cb
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x68656a56
cmp eax, 4
je 0x68656a56
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbx
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0x40
je 0x686569a4
mov r9, qword [0x686cd888]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add r9, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x686569a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.68656870
nop word [rax + rax]
xor ebx, ebx
jmp 0x68656927
mov rax, qword [0x686cd888]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r14 + 8]
call fcn.68656870
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.68656870
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.68656870
nop
nop dword [rax + rax]
Function at 0x68657500
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x686ce100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x686ce128]
test rbx, rbx
je 0x68657554
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6865754b
test rsi, rsi
je 0x6865754b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x68657530
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x686ce100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax

Function at 0x68657730
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
je 0x68657740
repz ret
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x68657739
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x68657760
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x686577a0
lea ecx, [rcx - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x68657797
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x686577a2
add rax, 0x28
cmp rax, r9
jne 0x68657784
xor eax, eax
repz ret

Function at 0x68657840
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x685c0000]
call fcn.68657730
test eax, eax
je 0x68657870
lea rcx, [0x685c0000]
mov rdx, rbx
sub rdx, rcx
add rsp, 0x20
pop rbx
jmp fcn.68657760
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x68657b80
Capabilities:
Get file attributes

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x250
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x68657d92
cmp word [rbx], 0
je 0x68657d50
mov rax, qword [sym.imp.msvcrt.dll__osver]
mov eax, dword [rax]
test ah, 0x80
jne 0x68657cc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x68657d70
test al, 0x10
je 0x68657d50
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8d, 0x104
call sub.msvcrt.dll__wfullpath
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll_wcslen
lea rcx, [0x686beb70]
mov rsi, rax
call sub.msvcrt.dll_wcslen
lea rcx, [0x686beb74]
mov rbx, rax
call sub.msvcrt.dll_wcslen
lea rcx, [rsi + rbx + 0x229]
add rcx, rax
add rcx, rcx
call sub.msvcrt.dll_malloc
test rax, rax
mov rbx, rax
je 0x68657d82
lea rsi, [rax + 0x44c]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
cmp word [rbx + 0x44c], 0
jne 0x68657d05
lea rdx, [0x686beb74]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
lea rdx, [rbx + 0x238]
mov ecx, 0x20
xor eax, eax
mov qword [rbx + 0x440], 0xffffffffffffffff
mov dword [rbx + 0x448], 0
mov rdi, rdx
mov dword [rbx + 0x230], 0
mov word [rbx + 0x234], 0
rep stosq qword [rdi], rax
mov word [rbx + 0x236], 0
mov dword [rdi], 0
mov rax, rbx
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
lea rsi, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x104
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rsi
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x68657bc6
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 + 0x44a], 0x2f
je 0x68657c53
mov rcx, rsi
call sub.msvcrt.dll_wcslen
cmp word [rbx + rax*2 + 0x44a], 0x5c
je 0x68657c53
lea rdx, [0x686beb70]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
jmp 0x68657c53
xor ebx, ebx
call sub.msvcrt.dll__errno
mov dword [rax], 0x14
mov rax, rbx
add rsp, 0x250
pop rbx
pop rsi
pop rdi
ret
call sub.msvcrt.dll__errno
xor ebx, ebx
mov dword [rax], 2
jmp 0x68657cad
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x68657cad
call sub.msvcrt.dll__errno
mov dword [rax], 0xe
jmp 0x68657cad
Function at 0x686608b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [sym.imp.msvcrt.dll___iob_func]
mov rdi, rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r9
call rbx
lea rcx, str._nMEMORY_ERROR:
lea r9, [rax + 0x60]
mov r8d, 0x15
mov edx, 1
call sub.msvcrt.dll_fwrite
call sym.libglib_2.0_0.dll_g_get_prgname
mov rsi, rax
call sub.msvcrt.dll__getpid
mov ebp, eax
lea rax, [0x68673520]
test rsi, rsi
cmove rsi, rax
call rbx
mov r8, rsi
lea rcx, [rax + 0x60]
lea rdx, str._s__ld_:_GSlice:
lea rsi, [rsp + 0x68]
mov r9d, ebp
call sub.msvcrt.dll_fprintf
mov qword [rsp + 0x28], rsi
call rbx
lea rcx, [rax + 0x60]
mov r8, rsi
mov rdx, rdi
call sub.msvcrt.dll_vfprintf
call rbx
lea rdx, [rax + 0x60]
mov ecx, 0xa
call sub.msvcrt.dll_fputc
call sub.msvcrt.dll_abort
nop
Function at 0x68660990
Capabilities:
Get system information on windows
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea rcx, [0x686cd480]
call sym.libglib_2.0_0.dll_g_mutex_lock
cmp qword [0x686cd3e0], 0
je 0x68660b86
jmp 0x68660b2c
lea rdx, str.always_malloc
mov r8d, 2
mov rcx, rax
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x48], 2
mov qword [rsp + 0x30], rdx
lea rdx, str.debug_blocks
mov qword [rsp + 0x40], rdx
lea rdx, [rsp + 0x30]
call sym.libglib_2.0_0.dll_g_parse_debug_string
test al, 1
je 0x686609ff
mov dword [0x686cd410], 1
test al, 2
je 0x68660a0d
mov dword [0x686cd418], 1
cmp dword [0x686cd410], 0
mov rcx, qword [0x686cd3e0]
mov qword [0x686cd400], rcx
mov qword [0x686cd408], rcx
je 0x68660a4e
mov qword [0x686cd448], 0
mov qword [0x686cd440], 0
mov qword [0x686cd468], 0
jmp 0x68660aa7
sub rcx, 0x30
mov edx, 4
shr rcx, 7
call sym.libglib_2.0_0.dll_g_malloc0_n
mov rcx, qword [0x686cd408]
mov edx, 8
mov qword [0x686cd448], rax
sub rcx, 0x30
shr rcx, 7
call sym.libglib_2.0_0.dll_g_malloc0_n
mov rcx, qword [0x686cd408]
mov edx, 8
mov qword [0x686cd440], rax
sub rcx, 0x30
shr rcx, 7
call sym.libglib_2.0_0.dll_g_malloc0_n
mov qword [0x686cd468], rax
lea rcx, [0x686cd438]
call sym.libglib_2.0_0.dll_g_mutex_init
lea rcx, [0x686cd460]
mov dword [0x686cd450], 0
mov dword [0x686cd454], 7
mov dword [0x686cd458], 0
call sym.libglib_2.0_0.dll_g_mutex_init
mov eax, dword [0x686cd454]
mov dword [0x686cd470], 0
cmp eax, 6
jbe 0x68660af9
call fcn.686082e0
jmp 0x68660b01
inc eax
mov dword [0x686cd454], eax
mov rax, qword [0x686cd408]
sub rax, 0x30
shr rax, 3
cmp qword [0x686cd410], 0
mov qword [0x686cd430], rax
je 0x68660b2c
mov qword [0x686cd430], 0
lea rcx, [0x686cd480]
call sym.libglib_2.0_0.dll_g_mutex_unlock
mov rax, qword [0x686cd408]
sub rax, 0x30
shr rax, 7
mov ebx, eax
mov rcx, rbx
shl rbx, 4
shl rcx, 5
add rcx, 0x10
call sym.libglib_2.0_0.dll_g_malloc0
lea rdx, [rax + 0x10]
lea rcx, [0x68663f20]
mov qword [rax], rdx
add rdx, rbx
mov qword [rax + 8], rdx
mov rdx, rax
mov qword [rsp + 0x28], rax
call sym.libglib_2.0_0.dll_g_private_set
mov rax, qword [rsp + 0x28]
jmp 0x68660c02
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x54]
cmp rax, 0x1ff
mov qword [0x686cd3e0], rax
ja 0x68660bb7
lea rdx, str.sys_page_size___2__LARGEALIGNMENT
lea rcx, str.assertion_failed:__s
call fcn.686608b0
lea rdx, [rax - 1]
test rdx, rax
je 0x68660bd3
lea rdx, str._sys_page_size___sys_page_size___1____0
lea rcx, str.assertion_failed:__s
call fcn.686608b0
lea rdi, [0x686cd410]
lea rsi, [0x68663f00]
mov ecx, 8
rep movsd dword [rdi], dword [rsi]
lea rcx, str.G_SLICE
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x686609b6
jmp 0x68660a0d
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
Function at 0x14001a530
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x140285040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
cmp byte [0x1402908f4], 0
jne 0x14001a72b
movabs rsi, 0x7fffffffffffffff
mov r14d, 0xff
mov edi, dword [rsp + 0x48]
movsd xmm6, qword [rsp + 0x40]
nop
mov eax, dword [0x140290904]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x50]
call fcn.140001580
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x14001a5e5
js 0x14001a5e5
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x14001a5e0
mov ecx, 1
cmovl ecx, r14d
test cl, cl
jns 0x14001a5e0
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x14001a5e5
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.140004240
cmp byte [0x140290800], 0
je 0x14001a71e
cmp qword [0x140291d90], 0
je 0x14001a71e
lea rcx, [rbp + 0x20]
call fcn.14001a760
mov qword [rbp + 0xb8], 0
movd xmm1, dword [0x140290814]
cvtdq2ps xmm1, xmm1
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x140290808]
mov r8d, dword [0x140290810]
call fcn.140029610
test al, al
je 0x14001a715
mov ecx, dword [0x140290804]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001a715
cmp byte [rbp + 0x60], 0
jne 0x14001a715
cmp byte [0x140290809], 0
je 0x14001a683
cmp byte [rbp + 0xb4], 0
je 0x14001a715
mov ecx, dword [0x14029080c]
test ecx, ecx
je 0x14001a6cb
sub ecx, 1
je 0x14001a6b1
cmp ecx, 1
jne 0x14001a6f2
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.14001a810
mov r9d, 0x60f2
lea rdx, [rsp + 0x58]
jmp 0x14001a6e3
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.14001a810
mov r9d, 0x9995
lea rdx, [rsp + 0x64]
jmp 0x14001a6e3
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.14001a810
mov r9d, 0x796e
lea rdx, [rsp + 0x70]
mov r8, rax
call fcn.140028d90
movsd xmm6, qword [rax]
mov edi, dword [rax + 8]
movsd qword [rsp + 0x40], xmm6
mov dword [rsp + 0x48], edi
mov r9d, dword [0x14029081c]
mov r8d, dword [0x140290818]
lea rdx, [rsp + 0x40]
call fcn.140029a40
nop
lea rcx, [rbp + 0x20]
call fcn.140004830
cmp byte [0x1402908f4], 0
je 0x14001a590
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.14007cfa0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret
Function at 0x14001a950
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rbp, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov rcx, rsi
and rcx, qword [rbp + 0x30]
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x14001a9d7
mov rbx, r12
mov r15, r12
jmp 0x14001aa1a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x14001a9f1
cmp rbx, rcx
je 0x14001aa14
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14001a9e3
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r12, rbx
mov r15, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
jne 0x14001aa38
lea rcx, [0x1400848a0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.14007cfc0
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [r13]
mov qword [rdi + 0x10], rax
mov rdx, qword [rbp + 0x10]
add rdx, 1
xorps xmm0, xmm0
js 0x14001aa74
cvtsi2ss xmm0, rdx
jmp 0x14001aa8c
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14001aa9f
cvtsi2ss xmm1, rcx
jmp 0x14001aab4
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x14001ab25
mov rcx, rbp
call fcn.14001ad40
mov rdx, rax
mov rcx, rbp
call fcn.14001ab90
mov rdx, rsi
and rdx, qword [rbp + 0x30]
add rdx, rdx
mov rcx, qword [rbp + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
jne 0x14001aaf8
mov qword [rsp + 0x28], 0
jmp 0x14001ab18
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x14001ab15
mov rbx, rax
cmp rax, rdx
je 0x14001ab56
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14001ab04
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r15, rbx
mov r12, qword [rsp + 0x20]
mov rcx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rcx
mov qword [rcx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [rbp + 0x18]
and rsi, qword [rbp + 0x30]
add rsi, rsi
mov rdx, qword [rax + rsi*8]
cmp rdx, qword [rbp + 8]
jne 0x14001ab66
mov qword [rax + rsi*8], rdi
jmp 0x14001ab78
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x14001ab1d
cmp rdx, r15
jne 0x14001ab71
mov qword [rax + rsi*8], rdi
jmp 0x14001ab7d
cmp qword [rax + rsi*8 + 8], rcx
jne 0x14001ab7d
mov qword [rax + rsi*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x14001a9f9
Function at 0x14001ab90
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14001abc5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140002cc0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14001ad06
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14001ac80
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14001acf5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14001acbd
mov r10, qword [rdx]
cmp r10, rax
je 0x14001acb7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14001acf5
cmp r9, rdx
je 0x14001acd1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14001ad17
cmp r9, rdx
jne 0x14001acc2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14001ac30
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14001acf5

Function at 0x14001ade0
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [rcx]
test rcx, rcx
jne fcn.14001adf0
ret
Function at 0x14001adf0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14001ae9c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14001ae2a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x14001aeb0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14001ae6a
mov qword [rsp + 0x48], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14007d244
mov rcx, rbx
test rbx, rbx
jne 0x14001ae50
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.140003c90
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14001afb4
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007d244
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x14001afc0
cmp rbx, rbp
jne 0x14001af60
cmp qword [rsp + 0x20], r14
jne 0x14001af8d
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14001afcf
mov qword [r15], r12
mov rax, r12
jmp 0x14001afd2
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14001af8d
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007d244
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14001b058
cmp rbx, rbp
jne 0x14001b032
jmp 0x14001af8a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14001afe0
jmp 0x14001af8d