joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140058490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1400584c4
cmp ecx, r10d
jge 0x1400584b2
mov rcx, rbx
call fcn.140051cf0
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1400584fe
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1400584e0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x14005852d
mov edx, dword [0x1404161d0]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x14005855f
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
nop dword [rax]
cmp rax, r8
jb 0x140058549
xor dl, dl
jmp 0x140058552
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x140058540
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x140058502
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1400585d4
mov edx, dword [0x1404161d0]
mov rax, qword gs:[0x58]
mov ecx, 0x20
mov rax, qword [rax + rdx*8]
lea rdx, str.Corrupt_PNG
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1400585ee
mov rcx, rbx
call fcn.14005d660
test eax, eax
je 0x1400585c7
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.14024aa30
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140074730
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140075fb0
sub rsp, 0x28
test ecx, ecx
je 0x140076043
sub ecx, 1
je 0x140076021
sub ecx, 1
je 0x14007600c
sub ecx, 1
je 0x140075ff7
cmp ecx, 1
je 0x140075fe2
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
add ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret

Function at 0x140075f90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call fcn.140076070
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
jmp 0x140075f90

Function at 0x140075fb0
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140075fb0
sub rsp, 0x28
test ecx, ecx
je 0x140076043
sub ecx, 1
je 0x140076021
sub ecx, 1
je 0x14007600c
sub ecx, 1
je 0x140075ff7
cmp ecx, 1
je 0x140075fe2
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
add ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x140076070
Capabilities:
Parse pe header

Disassembly:
cmp ecx, 0x64
ja case.default.0x14007608d
movsxd rax, ecx
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x762f0]
add rcx, rdx
jmp rcx
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x4f
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x52
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x5a
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x1b
ret
mov eax, 0xa2
ret
mov eax, 0xa0
ret
mov eax, 0xa4
ret
mov eax, 0x5b
ret
mov eax, 0xa3
ret
mov eax, 0xa1
ret
mov eax, 0xa5
ret
mov eax, 0x5c
ret
mov eax, 0x5d
ret
mov eax, 0xdb
ret
mov eax, 0xdd
ret
mov eax, 0xba
ret
mov eax, 0xbc
ret
mov eax, 0xbe
ret
mov eax, 0xde
ret
mov eax, 0xbf
ret
mov eax, 0xdc
ret
mov eax, 0xc0
ret
mov eax, 0xbb
ret
mov eax, 0xbd
ret
mov eax, 0x20
ret
mov eax, 0xd
ret
mov eax, 8
ret
mov eax, 9
ret
mov eax, 0x21
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x24
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x6b
ret
mov eax, 0x6d
ret
mov eax, 0x6a
ret
mov eax, 0x6f
ret
mov eax, 0x25
ret
mov eax, 0x27
ret
mov eax, 0x26
ret
mov eax, 0x28
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x67
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x70
ret
mov eax, 0x71
ret
mov eax, 0x72
ret
mov eax, 0x73
ret
mov eax, 0x74
ret
mov eax, 0x75
ret
mov eax, 0x76
ret
mov eax, 0x77
ret
mov eax, 0x78
ret
mov eax, 0x79
ret
mov eax, 0x7a
ret
mov eax, 0x7b
ret
mov eax, 0x7c
ret
mov eax, 0x7d
ret
mov eax, 0x7e
ret
mov eax, 0x13
ret
xor eax, eax
ret
Function at 0x140092d50
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
call fcn.140092990
cmp qword [rax + 0x18], 8
jb 0x140092d79
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x140092dc2
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092dbd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092df6
call fcn.140249860
cmp ebx, 0xffffffff
je 0x140092de1
test bl, 0x10
je 0x140092de1
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
call fcn.140250d14
int3

Function at 0x140092e00
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
call fcn.140092990
cmp qword [rax + 0x18], 8
jb 0x140092e29
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdx, qword [rsp + 0x38]
mov ebx, eax
cmp rdx, 8
jb 0x140092e72
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092e6d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140092e8b
call fcn.140249860
cmp ebx, 0xffffffff
setne al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
call fcn.140250d14
int3
Function at 0x140092ea0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 2
mul rsi
mov rbp, rax
mov rax, 0xffffffffffffffff
cmovo rbp, rax
mov rcx, rbp
call fcn.140249868
mov rdi, rax
test rax, rax
je 0x140092f0d
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.14024b0d0
jmp 0x140092f10
mov rdi, r14
mov qword [rsp + 0x28], rdi
mov rdx, rdi
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
lea eax, [rcx + 1]
cmp eax, esi
jne 0x140092f52
mov r8d, ecx
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.140089590
nop
mov rdx, rax
mov rcx, rbx
call fcn.140091e10
nop
lea rcx, [rsp + 0x30]
call fcn.140011870
jmp 0x140092f87
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
movups xmmword [rbx + 0x18], xmm0
mov qword [rbx + 0x28], r14
mov qword [rbx + 0x30], 3
mov dword [rbx + 0x18], r14d
mov byte [rbx + 0x38], 0
test rdi, rdi
je 0x140092f94
mov rcx, rdi
call fcn.140249860
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402499e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400a50d0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400a52af
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400a4e00
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400a5274
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400a51ec
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400a5263
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1400a5229
mov r10, qword [rdx]
cmp r10, rax
je 0x1400a5223
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400a5263
cmp r9, rdx
je 0x1400a523f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1400a5289
cmp r9, rdx
jne 0x1400a5230
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400a5170
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400a5263
lea rcx, str.invalid_hash_bucket_count
call fcn.140247978
int3
Function at 0x1400a5810
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, r9
je 0x1400a58c1
mov rax, qword [r11]
mov r8, qword [rdx]
cmp rax, qword [rcx + 0x10]
je 0x1400a58c3
nop
cmp rcx, r8
je 0x1400a58c1
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x1400a58b0
jmp 0x1400a58c3
xor ecx, ecx
test rcx, rcx
je 0x1400a591e
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x1400a58e9
cmp rax, rcx
jne 0x1400a58df
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x1400a58f4
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x1400a58f4
cmp rax, rcx
jne 0x1400a58f4
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.140249860
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1400a5930
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r9, rdx
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov r11, qword [rdx + 8]
mov rbx, r11
cmp r11, r8
je 0x1400a59e4
mov rax, qword [r9]
mov rcx, qword [rdx]
cmp rax, qword [r11 + 0x10]
je 0x1400a59e6
cmp rbx, rcx
je 0x1400a59e4
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1400a59d3
jmp 0x1400a59e6
xor ebx, ebx
test rbx, rbx
je 0x1400a5a4d
mov rax, qword [rdx]
cmp r11, rbx
jne 0x1400a5a0b
cmp rax, rbx
jne 0x1400a5a01
mov qword [rdx], r8
mov qword [rdx + 8], r8
jmp 0x1400a5a16
mov r8, qword [rbx + 8]
mov qword [rdx + 8], r8
jmp 0x1400a5a16
cmp rax, rbx
jne 0x1400a5a16
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x18]
call fcn.14011f910
mov edx, 0xf8
mov rcx, rbx
call fcn.140249860
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a8940
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x10]
mov rdi, rdx
mov rbx, rcx
movzx edx, r8b
cmp byte [rdi], 0
je 0x1400a899c
mov rax, r9
lea r8, [rsp + 0x48]
bts rax, rdx
and r9, 0xffffffffffff0000
mov qword [rcx + 0x10], rax
add rcx, 0x20
lea rax, [r9 + rdx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
call fcn.1400a1b00
mov rcx, qword [rax]
mov eax, dword [rdi]
mov dword [rcx + 0x18], eax
movzx eax, byte [rdi + 4]
mov byte [rcx + 0x1c], al
jmp 0x1400a89d0
movzx ecx, r8b
mov eax, 1
shl eax, cl
lea rcx, [rbx + 0x20]
not eax
cdqe
and rax, r9
and r9, 0xffffffffffff0000
mov qword [rbx + 0x10], rax
lea rax, [r9 + rdx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.1400a5810
mov rcx, qword [rbx + 0x18]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140129750

Function at 0x1400a89f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x10]
mov rdi, rdx
mov rbx, rcx
movzx edx, r8b
cmp byte [rdi], 0
je 0x1400a8a47
mov rax, r9
lea r8, [rsp + 0x48]
bts rax, rdx
and r9, 0xffffffffffff0000
mov qword [rcx + 0x10], rax
add rcx, 0x20
lea rax, [r9 + rdx]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x48], rax
call fcn.1400a2040
mov rcx, qword [rax]
mov rax, qword [rdi]
mov qword [rcx + 0x18], rax
jmp 0x1400a8a7b
movzx ecx, r8b
mov eax, 1
shl eax, cl
lea rcx, [rbx + 0x20]
not eax
cdqe
and rax, r9
and r9, 0xffffffffffff0000
mov qword [rbx + 0x10], rax
lea rax, [r9 + rdx]
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x48], rax
call fcn.1400a5810
mov rcx, qword [rbx + 0x18]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140129750

Function at 0x1400a8a90
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov r14, rdx
mov qword [rsp + 0x60], rbx
mov rsi, rcx
mov qword [rsp + 0x70], r15
mov rcx, r14
movzx ebp, r8b
lea rdx, [rsp + 0x20]
call fcn.1401113c0
mov rbx, qword [rsp + 0x28]
mov r15, qword [rax]
test rbx, rbx
je 0x1400a8afd
mov qword [rsp + 0x68], rdi
mov edi, 0xffffffff
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a8af8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400a8af8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rsi + 0xe8]
test r15, r15
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
je 0x1400a8b58
mov rax, rdx
lea r8, [rsp + 0x78]
and rdx, 0xffffffffffff0000
bts rax, rbp
mov qword [rsi + 0xe8], rax
lea rcx, [rsi + 0xf8]
lea rax, [rdx + rbp]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x78], rax
call fcn.1400a22c0
mov rdx, r14
mov rcx, qword [rax]
add rcx, 0x18
call fcn.14011fd00
jmp 0x1400a8b92
movzx ecx, bpl
mov eax, 1
shl eax, cl
lea rcx, [rsi + 0xf8]
not eax
cdqe
and rax, rdx
and rdx, 0xffffffffffff0000
mov qword [rsi + 0xe8], rax
lea rax, [rdx + rbp]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rax
call fcn.1400a5930
mov rcx, qword [rsi + 0xf0]
add rsp, 0x40
pop r14
pop rsi
pop rbp
jmp fcn.140129750
Function at 0x1400a9140
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 0x10]
xor r13d, r13d
mov r15, r14
xor bl, bl
and r15, 0xffffffffffff0000
mov rsi, rcx
movzx edi, r13w
cmp r13w, r14w
jae 0x1400a92f1
mov qword [rsp + 0x58], rbp
movabs rcx, 0x100000001b3
mov qword [rsp + 0x60], r12
movabs r9, 0xcbf29ce484222325
movzx r12d, r14w
nop word [rax + rax]
movzx ebp, bl
bt r12d, ebp
jae 0x1400a92c5
movzx r8d, bl
add r8, r15
mov qword [rsp + 0x50], r8
movzx eax, byte [rsp + 0x51]
movzx edx, r8b
xor rdx, r9
mov r9, qword [rsi + 0x28]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and rdx, qword [rsi + 0x50]
shl rdx, 4
add rdx, qword [rsi + 0x38]
mov r10, qword [rdx + 8]
mov rcx, r10
cmp r10, r9
je 0x1400a9251
mov rax, qword [rdx]
cmp r8, qword [r10 + 0x10]
je 0x1400a9254
nop dword [rax]
cmp rcx, rax
je 0x1400a9251
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x1400a9240
jmp 0x1400a9254
mov rcx, r13
test rcx, rcx
je 0x1400a92a4
mov rax, qword [rdx]
cmp r10, rcx
jne 0x1400a9279
cmp rax, rcx
jne 0x1400a926f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x1400a9284
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x1400a9284
cmp rax, rcx
jne 0x1400a9284
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [rsi + 0x30]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.140249860
mov ecx, ebp
mov eax, 1
shl ax, cl
movabs r9, 0xcbf29ce484222325
add di, ax
movabs rcx, 0x100000001b3
inc bl
cmp di, r14w
jb 0x1400a91a0
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov qword [rsi + 0x10], r15
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x68]
mov qword [rcx + 0x10], r15
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1400a9310
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rcx + 0x48]
xor r13d, r13d
mov r15, r14
xor bl, bl
and r15, 0xffffffffffff0000
mov rsi, rcx
movzx edi, r13w
cmp r13w, r14w
jae 0x1400a94c1
mov qword [rsp + 0x58], rbp
movabs rcx, 0x100000001b3
mov qword [rsp + 0x60], r12
movabs r9, 0xcbf29ce484222325
movzx r12d, r14w
nop word [rax + rax]
movzx ebp, bl
bt r12d, ebp
jae 0x1400a9495
movzx r8d, bl
add r8, r15
mov qword [rsp + 0x50], r8
movzx eax, byte [rsp + 0x51]
movzx edx, r8b
xor rdx, r9
mov r9, qword [rsi + 0x60]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x52]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x53]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x54]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x55]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x56]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x57]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
and rdx, qword [rsi + 0x88]
shl rdx, 4
add rdx, qword [rsi + 0x70]
mov r10, qword [rdx + 8]
mov rcx, r10
cmp r10, r9
je 0x1400a9421
mov rax, qword [rdx]
cmp r8, qword [r10 + 0x10]
je 0x1400a9424
cmp rcx, rax
je 0x1400a9421
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x1400a9410
jmp 0x1400a9424
mov rcx, r13
test rcx, rcx
je 0x1400a9474
mov rax, qword [rdx]
cmp r10, rcx
jne 0x1400a9449
cmp rax, rcx
jne 0x1400a943f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x1400a9454
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x1400a9454
cmp rax, rcx
jne 0x1400a9454
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [rsi + 0x68]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x58
call fcn.140249860
mov ecx, ebp
mov eax, 1
shl ax, cl
movabs r9, 0xcbf29ce484222325
add di, ax
movabs rcx, 0x100000001b3
inc bl
cmp di, r14w
jb 0x1400a9370
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov qword [rsi + 0x48], r15
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
mov rbx, qword [rsp + 0x68]
mov qword [rcx + 0x48], r15
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret