joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004fc70
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
cmp qword [rdx], 0
jne 0x18004fcf1
cmp word [rdx + 8], 0
jne 0x18004fcf1
cmp word [rdx + 0xa], 0xffff
jne 0x18004fcf1
mov qword [rbp - 0x14], 0
mov word [rbp - 0x1c], 2
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov eax, dword [rdx + 0xc]
mov dword [rbp - 0x18], eax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18004fcc7
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
je 0x18004fd4c
xor eax, eax
jmp 0x18004fd4e
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], 0
mov word [rbp - 0x1c], reloc.WS2_32.dll_socket
movups xmm0, xmmword [rdx]
movups xmmword [rbp - 0x14], xmm0
movzx eax, word [rdx + 0x10]
mov word [rbp - 0x1a], ax
mov r8d, dword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x18004fd26
mov rdx, qword [rsi]
mov rcx, qword [rcx + 0x30]
lea rax, [rbp - 0x1c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x1c
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_sendto]
cdqe
cmp qword [rsi + 0x10], rax
jne 0x18004fced
mov al, 1
add rsp, 0x58
pop rsi
pop rbp
ret

Function at 0x180050c20
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x30]
lea rdx, [rsp + 0x27]
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
sete al
add rsp, 0x28
ret
Function at 0x180057cf0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
mov eax, dword [rcx]
cmp eax, 0x138
jne 0x180057d8e
movq xmm0, qword [rcx + 8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xfffffffffffffec8
movaps xmm0, xmmword [0x1800dbee0]
movaps xmm1, xmmword [0x1800dbef0]
movdqa xmm2, xmmword [0x1800dbf00]
nop dword [rax]
movups xmm4, xmmword [rcx + rax*8 + 0x9d0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0xea8]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x1388], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x180057d30
mov eax, 0x138
jmp 0x180057f1b
cmp eax, 0x270
jb 0x180057f1b
movq xmm0, qword [rcx + 0x9c8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xffffffffffffff64
movaps xmm0, xmmword [0x1800dbee0]
movaps xmm1, xmmword [0x1800dbef0]
movdqa xmm2, xmmword [0x1800dbf00]
nop word cs:[rax + rax]
movups xmm4, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
pshufd xmm3, xmm4, 0xa0
pslld xmm3, 0x1f
psrad xmm3, 0x1f
pand xmm3, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0x1388]
pxor xmm6, xmm3
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
movdqa xmm3, xmm4
add rax, 2
jne 0x180057dd0
movq xmm3, qword [rcx + 0xea8]
pshufd xmm3, xmm3, 0x44
xor eax, eax
nop word cs:[rax + rax]
movdqa xmm4, xmm3
movups xmm3, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm4, xmm3, 0x4e
andps xmm4, xmm0
movaps xmm5, xmm3
andps xmm5, xmm1
orps xmm5, xmm4
psrlq xmm5, 1
pshufd xmm4, xmm3, 0xa0
pslld xmm4, 0x1f
psrad xmm4, 0x1f
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
add rax, 2
cmp rax, 0x9a
jne 0x180057e40
pshufd xmm0, xmm3, 0xee
movq rax, xmm0
and rax, 0xffffffff80000000
mov rdx, qword [rcx + 0x1380]
mov r8d, edx
and r8d, 0x7ffffffe
or r8, rax
shr r8, 1
mov eax, edx
and eax, 1
neg rax
movabs r9, 0xb5026f5aa96619e9
and rax, r9
xor rax, qword [rcx + 0x4d8]
xor rax, r8
mov qword [rcx + 0x9b8], rax
and rdx, 0xffffffff80000000
mov rax, qword [rcx + 8]
mov r8d, eax
and r8d, 0x7ffffffe
or r8, rdx
and eax, 1
neg rax
and rax, r9
xor rax, qword [rcx + 0x4e0]
shr r8, 1
xor rax, r8
mov qword [rcx + 0x9c0], rax
xor eax, eax
lea edx, [rax + 1]
mov dword [rcx], edx
mov eax, eax
mov rax, qword [rcx + rax*8 + 8]
mov rdx, rax
shr rdx, 0x1d
and rdx, qword [rcx + 0x1388]
xor rdx, rax
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov edx, ecx
and edx, 0x7ffbf77
shl rdx, 0x25
xor rdx, rcx
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x18005f320
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx eax, byte [rdx]
movabs r8, 0xcbf29ce484222325
xor r8, rax
movabs rax, 0x100000001b3
imul r8, rax
movzx r9d, byte [rdx + 1]
xor r9, r8
imul r9, rax
movzx r10d, byte [rdx + 2]
xor r10, r9
imul r10, rax
movzx r8d, byte [rdx + 3]
xor r8, r10
imul r8, rax
and r8, qword [rcx + 0x30]
mov r9, qword [rcx + 0x18]
mov rax, r8
shl rax, 4
mov rax, qword [r9 + rax + 8]
cmp rax, qword [rcx + 8]
je 0x18005f3a7
mov ecx, dword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x18005f39e
add r8, r8
mov rdx, qword [r9 + r8*8]
nop
cmp rax, rdx
je 0x18005f3a7
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18005f390
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.1800ab8ec
int3
Function at 0x180060580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
pxor xmm0, xmm0
movdqu xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 3
mov rbx, qword [rdx]
mov r14, qword [rdx + 0x10]
test r14, r14
je 0x1800605e1
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
cmovae rax, rbx
cmp r14, 4
jae 0x1800605e9
xor ecx, ecx
xor edx, edx
jmp 0x18006067e
xor r14d, r14d
jmp 0x1800606ba
mov rcx, r14
and rcx, 0xfffffffffffffffc
xor edx, edx
movdqa xmm2, xmmword [0x1800dcc70]
movdqa xmm3, xmmword [0x1800dcc80]
movdqa xmm4, xmmword [reloc.WS2_32.dll_accept]
pxor xmm1, xmm1
nop
movzx r8d, word [rax + rdx]
movd xmm5, r8d
movzx r8d, word [rax + rdx + 2]
movd xmm6, r8d
pand xmm5, xmm2
pand xmm6, xmm2
pcmpgtb xmm5, xmm3
punpcklbw xmm5, xmm5
pshuflw xmm5, xmm5, 0xd4
pshufd xmm5, xmm5, 0xd4
pand xmm5, xmm4
paddq xmm0, xmm5
pcmpgtb xmm6, xmm3
punpcklbw xmm6, xmm6
pshuflw xmm5, xmm6, 0xd4
pshufd xmm5, xmm5, 0xd4
pand xmm5, xmm4
paddq xmm1, xmm5
add rdx, 4
cmp rcx, rdx
jne 0x180060610
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rdx, xmm0
jmp 0x180060698
movzx r8d, byte [rax + rcx]
and r8b, 0xc0
xor r9d, r9d
cmp r8b, 0x80
setne r9b
add rdx, r9
inc rcx
cmp r14, rcx
jne 0x18006067e
cmp rdx, 4
jb 0x1800606ba
mov rcx, rsi
call fcn.180061320
mov qword [rsi + 0x10], 0
mov rbx, qword [rdi]
mov r14, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
cmovb rbx, rdi
add r14, rbx
mov edi, 0xfffd
jmp 0x1800606dc
mov dword [rdx + rax*4], r9d
mov dword [rdx + rax*4 + 4], 0
cmp rbx, r14
je 0x1800607d2
movzx eax, byte [rbx]
inc rbx
movzx r9d, al
test r9b, r9b
jns 0x18006077c
mov ecx, r9d
and ecx, 0xffffffc0
cmp ecx, 0x80
je 0x1800607a6
not al
test al, al
je 0x18006071b
movzx eax, al
bsr edx, eax
xor edx, 0x1f
jmp 0x180060720
mov edx, 0x20
mov ecx, edx
not cl
mov eax, 0xffffffff
shl eax, cl
not eax
and eax, r9d
mov ecx, edx
add cl, 0xe7
sete cl
je 0x180060774
cmp rbx, r14
je 0x180060774
add dl, 0xe6
movzx ecx, byte [rbx]
mov r8d, ecx
and r8d, 0xffffffc0
cmp r8d, 0x80
jne 0x1800607a6
inc rbx
mov r8d, eax
shl r8d, 6
and ecx, 0x3f
mov eax, ecx
or eax, r8d
sub dl, 1
setb cl
jb 0x180060774
cmp rbx, r14
jne 0x180060742
test cl, cl
cmove eax, edi
mov r9d, eax
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
cmp rax, rcx
jae 0x1800607c0
lea rdx, [rax + 1]
mov qword [rsi + 0x10], rdx
mov rdx, rsi
cmp rcx, 4
jb 0x1800606d0
mov rdx, qword [rsi]
jmp 0x1800606d0
mov r9d, 0xfffd
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
cmp rax, rcx
jb 0x180060789
nop dword [rax]
mov edx, 1
mov rcx, rsi
call fcn.1800614c0
jmp 0x1800606dc
mov rax, rsi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1800619b0
Capabilities:
Generate random numbers via winapi

Disassembly:
jmp 0x1800987e0
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
lea rdx, [rbp - 0x10]
xor ecx, ecx
mov r8d, 8
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbp
ret

Function at 0x1800647e0
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x10]
test r8, r8
je 0x18006483f
cmp qword [rdi + 0x18], 0x10
mov rbx, rdi
jb 0x180064811
mov rbx, qword [rdi]
mov rcx, rbx
mov edx, 0x3a
call fcn.1800d84f0
test rax, rax
je 0x18006483f
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x18006483f
mov ecx, reloc.WS2_32.dll_socket
mov rdx, rbx
mov r8, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
jmp 0x18006486c
mov qword [rsi], 0
mov dword [rsi + 8], 0xffff0000
add rsi, 0xc
cmp qword [rdi + 0x18], 0x10
jb 0x18006485b
mov rdi, qword [rdi]
mov ecx, 2
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
sete al
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800688a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov r15, rcx
lea rcx, [rdx + 0x68]
lea r8, [0x180151320]
lea rbx, [rbp - 0x28]
mov rdx, rbx
call fcn.180069400
mov rdi, qword [rbp - 0x28]
mov r14, qword [rbp - 0x18]
mov r12, qword [rbp - 0x10]
cmp r12, 0x10
cmovae rbx, rdi
test r14, r14
je 0x180068917
mov eax, r14d
and eax, 3
movabs rcx, 0x100000001b3
cmp r14, 4
jae 0x180068926
movabs r8, 0xcbf29ce484222325
xor edx, edx
jmp 0x18006897c
movabs r9, 0xcbf29ce484222325
jmp 0x1800689a7
mov r9, r14
and r9, 0xfffffffffffffffc
movabs r8, 0xcbf29ce484222325
xor edx, edx
nop dword [rax]
movzx r10d, byte [rbx + rdx]
xor r10, r8
imul r10, rcx
movzx r8d, byte [rbx + rdx + 1]
xor r8, r10
imul r8, rcx
movzx r10d, byte [rbx + rdx + 2]
xor r10, r8
imul r10, rcx
movzx r8d, byte [rbx + rdx + 3]
xor r8, r10
imul r8, rcx
add rdx, 4
cmp r9, rdx
jne 0x180068940
mov r9, r8
test rax, rax
je 0x1800689a7
add rdx, rbx
xor r10d, r10d
nop word [rax + rax]
movzx r9d, byte [rdx + r10]
xor r9, r8
imul r9, rcx
inc r10
mov r8, r9
cmp rax, r10
jne 0x180068990
and r9, qword [r15 + 0x30]
mov r13, qword [r15 + 8]
mov rax, qword [r15 + 0x18]
mov rcx, r9
shl rcx, 4
mov r15, qword [rax + rcx + 8]
cmp r15, r13
je 0x180068a32
mov qword [rbp - 8], rsi
add r9, r9
mov rsi, qword [rax + r9*8]
cmp r14, qword [r15 + 0x20]
jne 0x180068a03
nop word cs:[rax + rax]
cmp qword [r15 + 0x28], 0x10
jb 0x1800689f0
mov rdx, qword [r15 + 0x10]
jmp 0x1800689f4
lea rdx, [r15 + 0x10]
mov rcx, rbx
mov r8, r14
call fcn.1800d8950
test eax, eax
je 0x180068a17
cmp r15, rsi
je 0x180068a14
mov r15, qword [r15 + 8]
cmp r14, qword [r15 + 0x20]
je 0x1800689e0
jmp 0x180068a03
xor r15d, r15d
mov rsi, qword [rbp - 8]
test r15, r15
cmove r15, r13
cmp r12, 0x10
jae 0x180068a42
cmp r15, r13
jne 0x180068a78
jmp 0x180068ac9
xor r15d, r15d
test r15, r15
cmove r15, r13
cmp r12, 0x10
jb 0x180068a28
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x180068a6b
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x180068adc
add r12, 0x28
mov rdx, r12
mov rdi, rax
mov rcx, rdi
call fcn.1800aa400
cmp r15, r13
je 0x180068ac9
cmp byte [r15 + 0xc9], 0
setne al
cmp byte [rsi + 0x99], 0
setne cl
xor cl, al
jne 0x180068ac9
lea rcx, [r15 + 0xd0]
lea rdx, [rsi + 0xa0]
call fcn.1800761d0
test al, al
je 0x180068ac9
add r15, 0xf0
add rsi, 0xc0
mov rcx, r15
mov rdx, rsi
call fcn.1800761d0
mov ecx, eax
mov al, 1
test cl, cl
jne 0x180068acb
xor eax, eax
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800b3cac
int3
Function at 0x180068b10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x180068b2c
mov rsi, qword [rsi]
test rdi, rdi
je 0x180068b55
mov eax, edi
and eax, 3
movabs rdx, 0x100000001b3
cmp rdi, 4
jae 0x180068b64
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
jmp 0x180068bbc
movabs r10, 0xcbf29ce484222325
jmp 0x180068be7
mov r10, rdi
and r10, 0xfffffffffffffffc
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
nop dword [rax + rax]
movzx r11d, byte [rsi + r8]
xor r11, r9
imul r11, rdx
movzx r9d, byte [rsi + r8 + 1]
xor r9, r11
imul r9, rdx
movzx r11d, byte [rsi + r8 + 2]
xor r11, r9
imul r11, rdx
movzx r9d, byte [rsi + r8 + 3]
xor r9, r11
imul r9, rdx
add r8, 4
cmp r10, r8
jne 0x180068b80
mov r10, r9
test rax, rax
je 0x180068be7
add r8, rsi
xor r11d, r11d
nop word [rax + rax]
movzx r10d, byte [r8 + r11]
xor r10, r9
imul r10, rdx
inc r11
mov r9, r10
cmp rax, r11
jne 0x180068bd0
and r10, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov rax, qword [rcx + 0x18]
mov rcx, r10
shl rcx, 4
mov r14, qword [rax + rcx + 8]
cmp r14, rbx
je 0x180068c54
add r10, r10
mov r15, qword [rax + r10*8]
cmp rdi, qword [r14 + 0x20]
jne 0x180068c43
nop word cs:[rax + rax]
cmp qword [r14 + 0x28], 0x10
jb 0x180068c30
mov rdx, qword [r14 + 0x10]
jmp 0x180068c34
lea rdx, [r14 + 0x10]
mov rcx, rsi
mov r8, rdi
call fcn.1800d8950
test eax, eax
je 0x180068c57
cmp r14, r15
je 0x180068c54
mov r14, qword [r14 + 8]
cmp rdi, qword [r14 + 0x20]
je 0x180068c20
jmp 0x180068c43
xor r14d, r14d
test r14, r14
cmove r14, rbx
lea rcx, [r14 + 0x30]
xor eax, eax
cmp r14, rbx
cmovne rax, rcx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x180069ec0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov r13, rcx
mov dword [rbp - 0x20], 0
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
lea r8, [rbp - 1]
call fcn.18006b4a0
mov rdi, qword [r13]
movabs r12, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
nop word cs:[rax + rax]
lea rbx, [rdi + 0x48]
lea r14, [rdi + 0xf8]
mov qword [rbp - 0x10], rbx
mov r15, qword [r13 + 8]
cmp rdi, r15
je 0x18006a058
movzx eax, byte [rdi + 0x48]
xor rax, r12
imul rax, rsi
movzx ecx, byte [rdi + 0x49]
xor rcx, rax
imul rcx, rsi
movzx eax, byte [rdi + 0x4a]
xor rax, rcx
imul rax, rsi
movzx ecx, byte [rdi + 0x4b]
xor rcx, rax
imul rcx, rsi
and rcx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x48]
mov rax, rcx
shl rax, 4
mov rax, qword [r8 + rax + 8]
cmp rax, qword [rbp - 0x58]
je 0x18006a040
mov edx, dword [rbx]
cmp edx, dword [rax + 0x10]
je 0x180069fb2
add rcx, rcx
mov rcx, qword [r8 + rcx*8]
nop word cs:[rax + rax]
cmp rax, rcx
je 0x18006a040
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x180069fa0
cmp r14, r15
je 0x18006a00d
mov rsi, r13
mov rbx, r14
mov r14, r12
mov r12, rdi
nop word cs:[rax + rax]
lea r13, [r12 + 0xf8]
mov rcx, r12
mov rdx, r13
call fcn.18006b0b0
add r12, 0x1f0
cmp r12, r15
mov r12, r13
jne 0x180069fd0
mov r13, rsi
mov r15, qword [rsi + 8]
mov r12, r14
mov r14, rbx
movabs rsi, 0x100000001b3
mov rbx, qword [rbp - 0x10]
add r15, 0xffffffffffffff08
mov rcx, r15
call fcn.180038ad0
add qword [r13 + 8], 0xffffffffffffff08
mov r15, qword [r13 + 8]
cmp rdi, r15
jne 0x180069f3c
jmp 0x18006a058
lea rcx, [rbp - 0x60]
lea rdx, [rbp - 0x20]
mov r8, rbx
call fcn.18006a670
mov rdi, r14
jmp 0x180069f20
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x18006a0a0
mov rdx, qword [rbp - 0x38]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x18006a089
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x18006a0fb
add rdx, 0x27
mov rcx, rax
call fcn.1800aa400
xorps xmm0, xmm0
lea rax, [rbp - 0x48]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax + 8]
mov qword [rcx], 0
mov rcx, qword [rax]
test rcx, rcx
je 0x18006a0d9
nop word [rax + rax]
mov rsi, qword [rcx]
mov edx, 0x18
call fcn.1800aa400
mov rcx, rsi
test rsi, rsi
jne 0x18006a0c0
mov rax, qword [rbp - 0x58]
mov edx, 0x18
mov rcx, rax
call fcn.1800aa400
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800b3cac
int3
Function at 0x18006b620
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x18006b7cf
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.18002b9a0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x18006b7c2
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
jmp 0x18006b6c1
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x18006b7c2
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rcx
imul r9, rdx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rdx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rdx
movzx r11d, byte [r8 + 0x13]
xor r11, r9
imul r11, rdx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x18006b6b0
mov r14, qword [r9 + rbx*8]
mov ebp, dword [r8 + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x18006b760
mov r10, qword [r14]
cmp r10, r8
je 0x18006b6b4
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x18006b6b4
cmp r11, r14
je 0x18006b798
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x18006b760
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x18006b6b8
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x18006b6b8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800ab8c8
int3
Function at 0x18006ead0
Capabilities:
Authenticate hmac

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xd8
mov rbx, r8
mov r14, rdx
mov rsi, rcx
call fcn.180090a50
lea rdi, [rsi + 0x70]
mov rcx, rdi
call fcn.180090a50
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, 0x40
ja 0x18006eb29
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rbx
call fcn.1800d7e70
jmp 0x18006eba2
lea r15, [rsp + 0x68]
mov rcx, r15
call fcn.180090a50
xor r12d, r12d
jmp 0x18006eb48
inc r12
cmp rbx, r12
je 0x18006eb88
movzx eax, byte [r14 + r12]
movzx ecx, byte [rsp + 0xc8]
lea edx, [rcx + 1]
mov byte [rsp + 0xc8], dl
mov byte [rsp + rcx + 0x68], al
add qword [rsp + 0xd0], 8
cmp byte [rsp + 0xc8], 0x40
jne 0x18006eb40
mov byte [rsp + 0xc8], 0
mov rcx, r15
call fcn.180090d20
jmp 0x18006eb40
lea rbx, [rsp + 0x68]
mov rcx, rbx
call fcn.180090a80
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.180091330
xor ebx, ebx
jmp 0x18006ebb9
inc rbx
cmp rbx, 0x40
je 0x18006ec26
movzx eax, byte [rsp + rbx + 0x20]
mov ecx, eax
xor cl, 0x36
movzx edx, byte [rsi + 0x60]
lea r8d, [rdx + 1]
mov byte [rsi + 0x60], r8b
mov byte [rsi + rdx], cl
add qword [rsi + 0x68], 8
cmp byte [rsi + 0x60], 0x40
jne 0x18006ebee
mov byte [rsi + 0x60], 0
mov rcx, rsi
call fcn.180090d20
movzx eax, byte [rsp + rbx + 0x20]
xor al, 0x5c
movzx ecx, byte [rsi + 0xd0]
lea edx, [rcx + 1]
mov byte [rsi + 0xd0], dl
mov byte [rsi + rcx + 0x70], al
add qword [rsi + 0xd8], 8
cmp byte [rsi + 0xd0], 0x40
jne 0x18006ebb0
mov byte [rsi + 0xd0], 0
mov rcx, rdi
call fcn.180090d20
jmp 0x18006ebb0
mov rax, rsi
add rsp, 0xd8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18006ec40
Capabilities:
Authenticate hmac

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x178
mov rbx, r8
mov r14, rdx
mov rsi, rcx
call fcn.18009d5f0
lea rdi, [rsi + 0xd0]
mov rcx, rdi
call fcn.18009d5f0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
cmp rbx, 0x80
ja 0x18006ecb9
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rbx
call fcn.1800d7e70
jmp 0x18006ed38
lea r15, [rsp + 0xa8]
mov rcx, r15
call fcn.18009d5f0
xor r12d, r12d
jmp 0x18006ecd8
inc r12
cmp rbx, r12
je 0x18006ed1b
movzx eax, byte [r14 + r12]
movzx ecx, byte [rsp + 0x168]
lea edx, [rcx + 1]
mov byte [rsp + 0x168], dl
mov byte [rsp + rcx + 0xa8], al
add qword [rsp + 0x170], 8
cmp byte [rsp + 0x168], 0x80
jne 0x18006ecd0
mov byte [rsp + 0x168], 0
mov rcx, r15
call fcn.18009dc90
jmp 0x18006ecd0
lea rbx, [rsp + 0xa8]
mov rcx, rbx
call fcn.18009db20
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18009d720
xor ebx, ebx
jmp 0x18006ed50
inc rbx
cmp rbx, 0x80
je 0x18006edd2
movzx eax, byte [rsp + rbx + 0x20]
mov ecx, eax
xor cl, 0x36
movzx edx, byte [rsi + 0xc0]
lea r8d, [rdx + 1]
mov byte [rsi + 0xc0], r8b
mov byte [rsi + rdx], cl
add qword [rsi + 0xc8], 8
cmp byte [rsi + 0xc0], 0x80
jne 0x18006ed94
mov byte [rsi + 0xc0], 0
mov rcx, rsi
call fcn.18009dc90
movzx eax, byte [rsp + rbx + 0x20]
xor al, 0x5c
movzx ecx, byte [rsi + 0x190]
lea edx, [rcx + 1]
mov byte [rsi + 0x190], dl
mov byte [rsi + rcx + 0xd0], al
add qword [rsi + 0x198], 8
cmp byte [rsi + 0x190], 0x80
jne 0x18006ed40
mov byte [rsi + 0x190], 0
mov rcx, rdi
call fcn.18009dc90
jmp 0x18006ed40
mov rax, rsi
add rsp, 0x178
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180072ed0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.180073c40
and byte [rsi], 0xf8
movzx eax, byte [rsi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [rsi + 0x1f], al
add rsp, 0x20
pop rsi
ret

Function at 0x180072f00
Capabilities:
Enumerate pe sections

Disassembly:
mov r8, rdx
lea rdx, [0x18010de70]
jmp fcn.180071f60

Function at 0x180072f10
Capabilities:
Encrypt data using curve25519

Disassembly:
sub rsp, 0x48
mov rax, r8
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
and byte [rsp + 0x20], 0xf8
movzx edx, byte [rsp + 0x3f]
and dl, 0x3f
or dl, 0x40
mov byte [rsp + 0x3f], dl
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.180071f60
nop
add rsp, 0x48
ret