joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18008d880
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008da40
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1801516e8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801516f8]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x1801516e8]
lea r9, [rdi - 1]
mov qword [0x180151710], r9
mov qword [0x180151718], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008da35
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1801516f8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008d972
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008d9f6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008d9af
mov r10, qword [rax]
cmp r10, rcx
je 0x18008d9a9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008d9f6
mov r8, rax
cmp r10, rax
je 0x18008d9d2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008da0a
cmp r10, rax
jne 0x18008d9c0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008da30
mov r9, qword [0x180151710]
jmp 0x18008d920
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008d9f6
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008da50
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008dc10
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151818]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151828]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x180151818]
lea r9, [rdi - 1]
mov qword [0x180151840], r9
mov qword [0x180151848], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008dc05
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151828]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008db42
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008dbc6
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008db7f
mov r10, qword [rax]
cmp r10, rcx
je 0x18008db79
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008dbc6
mov r8, rax
cmp r10, rax
je 0x18008dba2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008dbda
cmp r10, rax
jne 0x18008db90
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008dc00
mov r9, qword [0x180151840]
jmp 0x18008daf0
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008dbc6
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008dc20
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008dde0
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151728]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151738]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x180151728]
lea r9, [rdi - 1]
mov qword [0x180151750], r9
mov qword [0x180151758], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008ddd5
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151738]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008dd12
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008dd96
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008dd4f
mov r10, qword [rax]
cmp r10, rcx
je 0x18008dd49
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008dd96
mov r8, rax
cmp r10, rax
je 0x18008dd72
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008ddaa
cmp r10, rax
jne 0x18008dd60
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008ddd0
mov r9, qword [0x180151750]
jmp 0x18008dcc0
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008dd96
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008ddf0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008dfb0
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151618]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151628]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x180151618]
lea r9, [rdi - 1]
mov qword [0x180151640], r9
mov qword [0x180151648], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008dfa5
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151628]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008dee2
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008df66
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008df1f
mov r10, qword [rax]
cmp r10, rcx
je 0x18008df19
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008df66
mov r8, rax
cmp r10, rax
je 0x18008df42
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008df7a
cmp r10, rax
jne 0x18008df30
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008dfa0
mov r9, qword [0x180151640]
jmp 0x18008de90
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008df66
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008dfc0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008e180
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1801515d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1801515e8]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x1801515d8]
lea r9, [rdi - 1]
mov qword [0x180151600], r9
mov qword [0x180151608], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008e175
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1801515e8]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008e0b2
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008e136
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008e0ef
mov r10, qword [rax]
cmp r10, rcx
je 0x18008e0e9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008e136
mov r8, rax
cmp r10, rax
je 0x18008e112
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008e14a
cmp r10, rax
jne 0x18008e100
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008e170
mov r9, qword [0x180151600]
jmp 0x18008e060
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008e136
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008e190
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x18008e350
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180151778]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180151788]
lea rdx, [rdi + rdi]
call fcn.1800875c0
mov rcx, qword [0x180151778]
lea r9, [rdi - 1]
mov qword [0x1801517a0], r9
mov qword [0x1801517a8], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x18008e345
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180151788]
mov r10, qword [r11]
cmp r10, rbx
jne 0x18008e282
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x18008e306
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x18008e2bf
mov r10, qword [rax]
cmp r10, rcx
je 0x18008e2b9
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x18008e306
mov r8, rax
cmp r10, rax
je 0x18008e2e2
nop word [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x18008e31a
cmp r10, rax
jne 0x18008e2d0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x18008e340
mov r9, qword [0x1801517a0]
jmp 0x18008e230
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x18008e306
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800943cc
int3
Function at 0x18008f0e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
movzx ebp, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rbp, rax
movabs rcx, 0x100000001b3
imul rbp, rcx
movzx eax, byte [r8 + 1]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 2]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 3]
xor rbp, rax
imul rbp, rcx
mov rdx, qword [0x1801517f0]
and rdx, rbp
add rdx, rdx
mov rcx, qword [0x1801517d8]
mov rax, qword [rcx + rdx*8 + 8]
mov rsi, qword [0x1801517c8]
cmp rax, rsi
je 0x18008f19e
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x18008f17e
nop dword [rax]
cmp rax, rdx
je 0x18008f19b
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18008f170
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rsi, rax
movabs rax, 0x7ffffffffffffff
cmp qword [0x1801517d0], rax
je 0x18008f349
lea rax, [0x1801517c8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18009354c
mov rbx, rax
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [r14]
movups xmmword [rax + 0x10], xmm0
mov rdx, qword [0x1801517d0]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x18008f1fe
cvtsi2ss xmm0, rcx
jmp 0x18008f213
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x1801517f8]
xorps xmm1, xmm1
test rcx, rcx
js 0x18008f229
cvtsi2ss xmm1, rcx
jmp 0x18008f23e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x1801517c0]
seta al
test al, al
je 0x18008f2d3
lea rcx, [0x1801517c0]
call fcn.18008cf70
mov rax, qword [0x1801517f0]
and rax, rbp
add rax, rax
mov r8, qword [0x1801517d8]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [0x1801517c8]
cmp rcx, rdx
jne 0x18008f295
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
jmp 0x18008f2bc
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x18008f2af
cmp rcx, rdx
je 0x18008f316
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x18008f2a1
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rsi, qword [rsp + 0x20]
mov rdx, qword [0x1801517d0]
mov r8, qword [rsi + 8]
inc rdx
mov qword [0x1801517d0], rdx
mov qword [rbx], rsi
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rsi + 8], rbx
mov rcx, qword [0x1801517d8]
mov rax, qword [0x1801517f0]
and rax, rbp
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x1801517c8]
jne 0x18008f326
mov qword [rcx + rax*8], rbx
jmp 0x18008f338
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
jmp 0x18008f2bc
cmp rdx, rsi
jne 0x18008f331
mov qword [rcx + rax*8], rbx
jmp 0x18008f33d
cmp qword [rcx + rax*8 + 8], r8
jne 0x18008f33d
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
jmp 0x18008f185
lea rcx, str.unordered_map_set_too_long
call fcn.1800943cc
int3
Function at 0x1800a627c
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800a6153
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800a6153
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800a6153
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800a6153
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800a6153
cmp dword [rcx + 0x84], 0xe
jbe 0x1800a6153
cmp dword [rcx + 0xf8], 0
je 0x1800a6153
mov ecx, ebx
call fcn.1800a61f4
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1800a5fe4
cmp dword [rbp + 0x20], 0
je 0x1800a61a0
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1800a61a8
int3
xor r8d, r8d
xor edx, edx
jmp 0x1800a60ec

Function at 0x1800b2e0c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1800b2e2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1800a994c
or eax, 0xffffffff
jmp 0x1800b2e2e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001e6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001eb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001eb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001eb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001eb6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001eb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001eb8
xor al, al
add rsp, 0x28
ret
Function at 0x1400047e4
Capabilities:
Identify system language via api

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1400128b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, str.en_US
mov rsi, rcx
mov qword [rcx], r14
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov word [rsp + 0x30], ax
mov ebx, 0x10
mov r9d, ebx
lea rdx, [0x140008110]
lea rax, [0x140004df0]
mov r8d, 0x1b3
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call sub.api_ms_win_crt_private_l1_1_0.dll__o_bsearch
xor ebp, ebp
test rax, rax
jne 0x14000485f
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400048e5
cmp dword [rax + 0xc], 0x7c
jne 0x14000486c
cmp word [rax + 8], 0x7f
jne 0x14000484f
mov r8, qword [rax]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [r8 + rcx*2], bp
jne 0x140004873
inc rcx
cmp rcx, 0x7ffffffe
jbe 0x140004890
mov word [rsp + 0x38], bp
jmp 0x1400048d7
lea rax, [rsp + 0x38]
mov r9d, ebp
sub r8, rax
lea rdx, [rsp + 0x38]
lea rax, [rbx - 0x10]
add rax, rcx
je 0x1400048c0
movzx eax, word [r8 + rdx]
test ax, ax
je 0x1400048c0
mov word [rdx], ax
add rdx, 2
sub rbx, 1
jne 0x1400048a0
test rbx, rbx
jne 0x1400048cf
sub rdx, 2
mov r9d, 0x8007007a
mov word [rdx], bp
test r9d, r9d
jns 0x1400048e1
mov ecx, 0x7a
jmp 0x140004854
test ecx, ecx
jne 0x1400048f1
mov rcx, qword [rsp + 0x78]
call fcn.14000494c
jmp 0x14000492a
mov rbx, rbp
mov rdi, rbp
mov rdx, qword [rdi + r14]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
test eax, eax
je 0x14000491c
inc rbx
add rdi, 0x30
cmp rdi, 0x750
jb 0x1400048f7
jmp 0x14000492a
lea rax, [rbx + rbx*2]
shl rax, 4
add rax, r14
mov qword [rsi], rax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400050e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
sub byte [rbp - 2], bl
invalid
Function at 0x414d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414f0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432300
xorps xmm15, xmm15
mov r14, qword [0x006c8888]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414de5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414df4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414e13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414e23
cmp rbx, 0x1000
jae 0x414deb
jmp 0x414e8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414e35
xor edx, edx
jmp 0x414e84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432300
xorps xmm15, xmm15
mov r14, qword [0x006c8888]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414e19
jmp 0x414e08
call fcn.00462660
xorps xmm15, xmm15
mov r14, qword [0x006c8888]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436700
lea rax, [0x004cfe04]
mov ebx, 0x18
nop dword [rax]
call fcn.00436f80
mov rax, qword [rsp + 0x38]
call fcn.00436cc0
lea rax, [0x004d03f3]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436f80
mov rax, qword [rsp + 0x30]
call fcn.00436cc0
call fcn.00436940
call fcn.00436760
lea rax, [0x004d2c2a]
mov ebx, 0x21
call fcn.00434d60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045efa0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414d80