joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180092610
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x18009269f
mov rbx, r15
mov rbp, r15
jmp 0x1800926ec
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1800926be
nop dword [rax + rax]
cmp rbx, rcx
je 0x1800926e6
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1800926b0
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [rsi + 0x10], rax
je 0x180092838
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x58
call fcn.18027f030
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xor r13d, r13d
mov qword [rax + 0x50], r13
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x180092742
cvtsi2ss xmm0, rcx
jmp 0x180092757
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18009276a
cvtsi2ss xmm1, rcx
jmp 0x18009277f
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x1800927d9
mov rcx, rsi
call fcn.180093020
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x1800927cc
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1800927c9
mov rbx, rax
cmp rax, rdx
je 0x18009280d
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800927b8
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x180092814
mov qword [rcx + rax*8], rdi
jmp 0x180092826
mov qword [rsp + 0x20], rax
jmp 0x1800927d1
cmp r8, rbp
jne 0x18009281f
mov qword [rcx + rax*8], rdi
jmp 0x18009282b
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18009282b
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x1800926c6
lea rcx, str.unordered_map_set_too_long
call fcn.18025cbc4
int3
Function at 0x18009e2a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x18009e2c3
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x18009e2f3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x18009e2e0
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [0x180723880]
call fcn.18009fdf0
cmp qword [rax + 8], 0
jne 0x18009e39f
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x10], 7
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov rax, qword [str.unknown]
mov dword [rdi], eax
movzx eax, word [0x18030e18c]
mov word [rdi + 4], ax
movzx eax, byte [0x18030e18e]
mov byte [rdi + 6], al
mov byte [rdi + 7], 0
movups xmmword [rdi + 0x20], xmm0
mov qword [rdi + 0x30], 7
mov qword [rdi + 0x38], reloc.WS2_32.dll_ntohs
mov rax, qword [str.unknown]
mov dword [rdi + 0x20], eax
movzx eax, word [0x18030e18c]
mov word [rdi + 0x24], ax
movzx eax, byte [0x18030e18e]
mov byte [rdi + 0x26], al
mov byte [rdi + 0x27], 0
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov r8, rbx
lea rdx, [rsp + 0x28]
call fcn.18009f1e0
mov rbx, qword [rax]
lea rdx, [rbx + 0x30]
mov rcx, rdi
call fcn.18004ae70
nop
lea rcx, [rdi + 0x20]
lea rdx, [rbx + 0x50]
call fcn.18004ae70
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x18009eeb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push r12
push r13
push r15
sub rsp, 0x60
mov r15, r8
mov r12, rdx
mov r13, rcx
cmp rdx, r8
je 0x18009f0f3
cmp qword [rdx + 0x28], 0xf
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rax + 8], rbx
mov rbx, rdx
mov qword [rax - 0x20], rbp
mov qword [rax - 0x28], rsi
mov qword [rax - 0x30], rdi
mov qword [rax - 0x38], r14
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x38], r10
jbe 0x18009ef1a
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x18009ef54
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x18009ef40
mov rax, qword [r13 + 0x30]
and rax, rdx
shl rax, 4
add rax, r10
mov qword [rsp + 0x98], rax
mov rcx, qword [rax]
mov rax, qword [rax + 8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rcx
nop dword [rax + rax]
mov rbp, rbx
mov r14, rbx
mov rbx, qword [rbx]
lea rcx, [rbp + 0x50]
call fcn.18003cb40
lea rcx, [rbp + 0x30]
call fcn.18003cb40
lea rcx, [rbp + 0x10]
call fcn.18003cb40
mov edx, reloc.WS2_32.dll_WSASetLastError
mov rcx, rbp
call fcn.18027f3e4
dec qword [r13 + 0x10]
cmp rbp, qword [rsp + 0x30]
je 0x18009efdc
cmp rbx, r15
jne 0x18009ef80
cmp qword [rsp + 0x20], r12
jne 0x18009f0c8
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rbx
jmp 0x18009f0c8
mov rcx, qword [rsp + 0x98]
cmp qword [rsp + 0x20], r12
jne 0x18009eff5
mov rax, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x18009effd
mov rax, qword [rsp + 0x88]
mov qword [rcx + 8], rax
cmp rbx, r15
je 0x18009f0c8
nop word [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
jbe 0x18009f022
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x18009f05c
movabs r15, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r15
cmp rdx, r9
jb 0x18009f040
mov r15, qword [rsp + 0x90]
mov r12, qword [r13 + 0x30]
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x38]
mov rax, qword [r12 + 8]
mov qword [rsp + 0x98], rax
nop dword [rax]
mov rbp, rbx
mov r14, rbx
mov rbx, qword [rbx]
lea rcx, [rbp + 0x50]
call fcn.18003cb40
lea rcx, [rbp + 0x30]
call fcn.18003cb40
lea rcx, [rbp + 0x10]
call fcn.18003cb40
mov edx, reloc.WS2_32.dll_WSASetLastError
mov rcx, rbp
call fcn.18027f3e4
dec qword [r13 + 0x10]
cmp rbp, qword [rsp + 0x98]
je 0x18009f101
cmp rbx, r15
jne 0x18009f080
mov qword [r12], rbx
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov r14, qword [rsp + 0x40]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x80]
mov rax, r15
add rsp, 0x60
pop r15
pop r13
pop r12
ret
mov rdx, qword [rsp + 0x28]
mov qword [r12], rdx
mov qword [r12 + 8], rdx
cmp rbx, r15
jne 0x18009f010
jmp 0x18009f0c8
Function at 0x1800c6f00
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800c70dd
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1807239a8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1807239b8]
lea rdx, [rdi + rdi]
call fcn.18003d020
mov rax, qword [0x1807239a8]
lea r9, [rdi - 1]
mov qword [0x1807239d0], r9
mov qword [0x1807239d8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800c70d2
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1807239b8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800c701b
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800c7093
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1800c7058
mov r10, qword [rdx]
cmp r10, rax
je 0x1800c7052
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800c7093
cmp r9, rdx
je 0x1800c706f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800c70a7
cmp r9, rdx
jne 0x1800c7060
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1800c70cd
mov r9, qword [0x1807239d0]
jmp 0x1800c6fa0
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800c7093
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18025cbc4
int3
Function at 0x1800da070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
mov eax, 0x13c0
call fcn.1802800f0
sub rsp, rax
mov rax, qword [0x180717100]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov ebx, edx
mov esi, ecx
call fcn.18025eaa8
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, eax
shr r8d, 0x1e
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1800da0b3
btc esi, 0x1f
mov dword [rsp + 0x20], 0x270
btc ebx, 0x1f
lea rcx, [rsp + 0x20]
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x1800da0fd
call fcn.18008b8a0
mov ecx, eax
jmp 0x1800da146
mov qword [rsp + 0x13d0], rdi
inc ebx
call fcn.18008b8a0
mov ecx, eax
mov edi, ebx
imul rcx, rdi
cmp ecx, ebx
jae 0x1800da13a
mov eax, ebx
xor edx, edx
neg eax
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x1800da13a
lea rcx, [rsp + 0x20]
call fcn.18008b8a0
mov ecx, eax
imul rcx, rdi
cmp ecx, ebx
jb 0x1800da126
mov rdi, qword [rsp + 0x13d0]
shr rcx, 0x20
lea eax, [rsi + rcx]
xor eax, 0x80000000
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.18027f010
mov rbx, qword [rsp + 0x13d8]
add rsp, 0x13c0
pop rsi
ret
Function at 0x1800de300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800de334
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800de320
ret
Function at 0x1800e1400
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1800e14c5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1800e14c5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1800e14de
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x1800e14b5
cmp byte [rcx], 0x5c
jne 0x1800e14ae
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x1800e14ae
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1800e149c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x1800e14ab
test r8b, 0x10
jne 0x1800e14ae
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x1800e14ae
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.1800de7e0
test edi, edi
jne 0x1800e1420
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.1800de7d0
int3
Function at 0x1800fd5f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rbx, qword [rsp + 0x80]
mov r15, rcx
mov rcx, rdx
mov qword [rsp + 0x78], r13
mov rdi, rdx
mov qword [rsp + 0x60], rdx
mov rbp, rdx
mov r12, r9
lea rdx, [r8 - 1]
mov rax, r8
mov r13, rdx
mov qword [rsp + 0x68], rdx
sar r13, 1
cmp rcx, r13
jge 0x1800fd697
mov qword [rsp + 0x20], r14
nop
lea rbp, [rcx + rcx]
mov rcx, rbx
lea r14, [r15 + 0x10]
mov rdx, qword [r14 + rbp*8]
lea r14, [r14 + rbp*8]
mov r8, qword [r14 - 8]
lea rsi, [r14 - 8]
call fcn.1800fb290
movzx eax, al
test al, al
cmovne r14, rsi
xor rax, 1
lea rcx, [rax + 1]
mov rax, qword [r14]
add rcx, rbp
mov qword [r15 + rdi*8], rax
mov rdi, rcx
cmp rcx, r13
jl 0x1800fd640
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
cmp rcx, r13
mov r13, qword [rsp + 0x78]
jne 0x1800fd6b1
test al, 1
jne 0x1800fd6b1
mov rax, qword [r15 + rax*8 - 8]
mov qword [r15 + rdi*8], rax
mov rdi, rdx
cmp rbp, rdi
jge 0x1800fd700
nop word [rax + rax]
mov r8, qword [r12]
lea rsi, [rdi - 1]
sar rsi, 1
mov rcx, rbx
mov rdx, qword [r15 + rsi*8]
call fcn.1800fb290
test al, al
je 0x1800fd700
mov rax, qword [r15 + rsi*8]
mov qword [r15 + rdi*8], rax
mov rdi, rsi
cmp rbp, rsi
jl 0x1800fd6c0
mov rax, qword [r12]
mov qword [r15 + rsi*8], rax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rax, qword [r12]
mov qword [r15 + rdi*8], rax
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180103c10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180103def
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18003d020
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180103db4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180103d2c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180103da3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180103d69
mov r10, qword [rdx]
cmp r10, rax
je 0x180103d63
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180103da3
cmp r9, rdx
je 0x180103d7f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180103dc9
cmp r9, rdx
jne 0x180103d70
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180103cb0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180103da3
lea rcx, str.invalid_hash_bucket_count
call fcn.18025cbc4
int3
Function at 0x180120f30
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
mov r8d, edx
test rcx, rcx
je 0x180120f56
movsd xmm0, qword [rcx + 0x18]
movups xmm1, xmmword [rcx + 8]
movsd qword [rsp + 0x10], xmm0
mov rdx, qword [rsp + 0x10]
jmp 0x180120f5b
xorps xmm1, xmm1
xor edx, edx
psrldq xmm1, 8
mov r11d, 0xb6b29444
movq r10, xmm1
mov rcx, qword [r10 + 0x48]
mov rax, qword [r10 + 0x50]
mov r9, qword [r10 + 0x68]
sub rax, rcx
sar rax, 3
dec rax
and rax, r11
mov rax, qword [rcx + rax*8]
cmp rax, 0xffffffffffffffff
je 0x180120fa6
nop
shl rax, 5
add rax, r9
cmp dword [rax + 8], r11d
je 0x180120faa
mov rax, qword [rax]
cmp rax, 0xffffffffffffffff
jne 0x180120f90
mov rax, qword [r10 + 0x70]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
cmp rax, qword [r10 + 0x70]
je 0x180121046
mov r10, qword [rax + 0x10]
test r10, r10
je 0x180121046
mov rbx, qword [r10 + 8]
mov rcx, rdx
mov rax, qword [r10 + 0x10]
and ecx, 0x3ffff
sub rax, rbx
mov r11d, ecx
shr r11, 0xb
sar rax, 3
cmp r11, rax
jae 0x180121046
lea rdi, [r11*8]
mov r11, qword [rdi + rbx]
test r11, r11
je 0x180121046
mov eax, ecx
and eax, 0x7ff
lea rax, [r11 + rax*4]
test rax, rax
je 0x180121046
and edx, 0x1ffc0000
xor edx, dword [rax]
cmp edx, 0x3ffff
jae 0x180121046
mov rax, qword [r10 + 0x50]
and ecx, 0x7ff
mov edx, dword [r11 + rcx*4]
and edx, 0x3ffff
mov ecx, edx
and edx, 0x7f
imul r10, rdx, 0x58
shr rcx, 7
add r10, qword [rax + rcx*8]
jmp 0x180121049
mov r10, r9
mov rdi, qword [rsp + 0x20]
movabs rcx, 0x100000001b3
mov rbx, qword [rsp + 0x30]
movabs rax, 0xcbf29ce484222325
movzx edx, r8b
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3b]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r10 + 0x30]
and rcx, rdx
mov rdx, qword [r10 + 8]
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1801210d1
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x1801210d4
nop dword [rax + rax]
cmp rax, rcx
je 0x1801210d1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1801210c0
jmp 0x1801210d4
mov rax, r9
test rax, rax
cmove rax, rdx
cmp rax, rdx
lea rcx, [rax + 0x18]
cmovne r9, rcx
mov rax, r9
add rsp, 0x28
ret
Function at 0x18012e9c0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [0x180722dec], 0
mov rbx, rdx
mov rdi, qword [rcx + 0xc8]
jne 0x18012e9e2
call fcn.1801e0900
cmp byte [0x180722ded], 0
mov rdx, rbx
mov rcx, rdi
je 0x18012ea09
xor r9d, r9d
mov r8d, 0x40
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801e0b40
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801d3540
Function at 0x180141cd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov r15, r9
mov r14d, r8d
xor r12d, r12d
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ebx, r12d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180141d29
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180141e6e
movzx eax, ax
or eax, 0x80070000
add rsp, 0x40
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
mov qword [rsp + 0x78], rbp
mov ebp, r12d
mov qword [rsp + 0x80], rdi
mov edi, r12d
nop dword [rax]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov r8d, 4
lea rdx, [rsp + 0x34]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180141d77
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180141d77
movzx ebx, ax
or ebx, 0x80070000
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], r12
mov r8d, 4
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180141dae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180141dae
movzx ebx, ax
or ebx, 0x80070000
cmp dword [rsp + 0x34], 0x46464952
mov rcx, rsi
je 0x180141deb
mov edx, dword [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x180141e2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x180141e61
movzx eax, ax
or eax, 0x80070000
jmp 0x180141e61
mov ebp, dword [rsp + 0x70]
lea r9, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0x70], 4
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x180141e2b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test eax, eax
jle 0x180141e2b
movzx ebx, ax
or ebx, 0x80070000
add edi, 8
cmp dword [rsp + 0x34], r14d
je 0x180141e4e
add edi, dword [rsp + 0x70]
test ebp, ebp
je 0x180141e47
test ebx, ebx
je 0x180141d40
jmp 0x180141e5f
mov eax, 1
jmp 0x180141e61
mov eax, dword [rsp + 0x70]
mov dword [r15], eax
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret