joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140029bc0
Capabilities:
Log keystrokes
Log keystrokes via input method manager

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov rsi, rcx
mov dword [rcx + 0x190], ebp
call fcn.14003a5e0
mov qword [rsp + 0x30], rbp
lea r9d, [rbp + 2]
mov qword [rsp + 0x28], rbp
lea r8d, [rbp + 0x2e]
mov rdx, rsi
mov dword [rsp + 0x20], 1
mov rcx, rax
call fcn.14003b230
mov rdi, qword [rsi + 8]
lea edx, [rbp + 4]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_GetWindow]
mov rbx, rax
test rax, rax
je 0x140029c37
call qword [sym.imp.USER32.dll_GetDesktopWindow]
cmp rbx, rax
je 0x140029c37
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_EnableWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x140029c59
mov rcx, qword [rdi]
lea edx, [rax + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov byte [rdi + 0x18], 1
call fcn.14003a5e0
mov rdx, qword [rdi + 0x10]
mov r9d, 2
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x2e]
call fcn.14003b230
mov rax, qword [rdi + 0x10]
mov rbx, qword [rax + 0x18]
mov rbx, qword [rbx]
cmp byte [rdi + 0x18], bpl
je 0x140029d3a
nop
call qword [sym.imp.USER32.dll_WaitMessage]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140029d30
cmp byte [rdi + 0x18], bpl
je 0x140029d3a
cmp byte [rbx + 0x20], bpl
je 0x140029cfb
cmp dword [rsp + 0x48], 0x100
jne 0x140029cfb
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.IMM32.dll_ImmGetVirtualKey]
mov eax, eax
mov edx, 2
mov ecx, eax
mov qword [rbx + 0x48], rax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov byte [rbx + 0x50], al
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rsp + 0x40]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x140029cc5
cmp byte [rdi + 0x18], bpl
jne 0x140029ca0
call fcn.14003a5e0
mov r9d, 2
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x2d]
call fcn.14003b230
mov eax, dword [rsi + 0x190]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002bad0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
mov r11, rdx
movzx edi, sil
mov r10, rdx
shr r11, 0x38
mov r9, rdx
shr r10, 0x30
mov r8, rdx
shr r9, 0x28
shr rdx, 0x18
movabs rbx, 0xcbf29ce484222325
xor rdi, rbx
shr r8, 0x20
movabs rbx, 0x100000001b3
mov rax, rsi
imul rdi, rbx
shr rax, 8
mov rcx, rsi
movzx eax, al
xor rdi, rax
shr rcx, 0x10
imul rdi, rbx
movzx eax, cl
mov rcx, qword [rbp + 0x68]
xor rdi, rax
imul rdi, rbx
movzx eax, dl
xor rdi, rax
movzx eax, r8b
mov r8, qword [rbp + 0x78]
imul rdi, rbx
xor rdi, rax
movzx eax, r9b
imul rdi, rbx
xor rdi, rax
movzx eax, r10b
imul rdi, rbx
xor rdi, rax
imul rdi, rbx
xor rdi, r11
imul rdi, rbx
and rdi, qword [rbp + 0x90]
mov rdx, rdi
add rdx, rdx
mov r9, qword [r8 + rdx*8 + 8]
mov rbx, r9
cmp r9, rcx
je 0x14002bc14
mov rax, qword [r8 + rdx*8]
cmp rsi, qword [r9 + 0x10]
je 0x14002bbb0
cmp rbx, rax
je 0x14002bc14
mov rbx, qword [rbx + 8]
cmp rsi, qword [rbx + 0x10]
jne 0x14002bba1
test rbx, rbx
je 0x14002bc14
add rdi, rdi
mov rax, qword [r8 + rdi*8]
cmp r9, rbx
jne 0x14002bbdc
cmp rax, rbx
jne 0x14002bbd1
mov qword [r8 + rdi*8], rcx
mov qword [r8 + rdx*8 + 8], rcx
jmp 0x14002bbe8
mov rcx, qword [rbx + 8]
mov qword [r8 + rdx*8 + 8], rcx
jmp 0x14002bbe8
cmp rax, rbx
jne 0x14002bbe8
mov rax, qword [rbx]
mov qword [r8 + rdi*8], rax
mov rcx, qword [rbx]
dec qword [rbp + 0x70]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
lea rcx, [rbx + 0x18]
call fcn.14002d740
mov edx, 0x30
mov rcx, rbx
call fcn.14004f3ac
cmp qword [rbp + 0x70], 0
jne 0x14002bc2d
mov rcx, qword [rbp + 8]
mov edx, 0xffffffff
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_KillTimer]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002bc40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x38
mov r10, rcx
movzx r9d, dl
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, rdx
imul r9, r11
shr rax, 8
movzx r8d, al
mov rax, rdx
xor r9, r8
shr rax, 0x10
mov r8, qword [r10 + 0xa8]
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x38
mov rcx, qword [r10 + 0xd0]
imul r9, r11
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0xb8]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x14002bd48
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14002bd1f
nop
cmp rax, rcx
je 0x14002bd48
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14002bd10
test rax, rax
cmove rax, r8
cmp rax, r8
je 0x14002bd48
lea rcx, [r10 + 0xa0]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x20]
call fcn.14002ca90
mov rcx, qword [rax]
mov byte [rcx + 0x18], 0
add rsp, 0x38
ret
Function at 0x14002d4a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14002d67f
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14001bba0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14002d648
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14002d5bc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14002d637
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x14002d5f9
mov r10, qword [rax]
cmp r10, rcx
je 0x14002d5f3
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14002d637
mov r8, rax
cmp r10, rax
je 0x14002d613
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x14002d659
cmp r10, rax
jne 0x14002d601
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14002d540
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14002d637
lea rcx, str.invalid_hash_bucket_count
call fcn.14004d948
int3
Function at 0x1400314c0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov qword [rcx + 0x10], 0
mov r10, rcx
movabs r11, 0x100000001b3
mov qword [rsp], rdx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 8], 0x1f
mov qword [rcx], rax
mov r9, rdx
movups xmm0, xmmword [rsp]
movups xmmword [rcx + 8], xmm0
movsx r8, byte [rdx]
xor r8, rax
imul r8, r11
mov qword [rcx], r8
movsx rax, byte [rdx + 1]
xor rax, r8
imul rax, r11
mov qword [rcx], rax
movsx rcx, byte [rdx + 2]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 3]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 4]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 5]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 6]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 7]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 8]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 9]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0xa]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0xb]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0xc]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0xd]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0xe]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0xf]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x10]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x11]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x12]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x13]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x14]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x15]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x16]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x17]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x18]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x19]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x1a]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rax, byte [rdx + 0x1b]
xor rax, rcx
imul rax, r11
mov qword [r10], rax
movsx rcx, byte [rdx + 0x1c]
xor rcx, rax
imul rcx, r11
mov qword [r10], rcx
movsx rdx, byte [rdx + 0x1d]
xor rdx, rcx
imul rdx, r11
mov qword [r10], rdx
movsx rax, byte [r9 + 0x1e]
xor rax, rdx
imul rax, r11
mov qword [r10], rax
mov rax, r10
add rsp, 0x18
ret
Function at 0x140032550
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov qword [rcx + 0x10], 0
mov r9, rcx
movabs r10, 0x100000001b3
mov qword [rsp], rdx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 8], 0x22
mov qword [rcx], rax
movups xmm0, xmmword [rsp]
movups xmmword [rcx + 8], xmm0
movsx r8, byte [rdx]
xor r8, rax
imul r8, r10
mov qword [rcx], r8
movsx rax, byte [rdx + 1]
xor rax, r8
imul rax, r10
mov qword [rcx], rax
movsx rcx, byte [rdx + 2]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 3]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 4]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 5]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 6]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 7]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 8]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 9]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xa]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xb]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xc]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xd]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xe]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xf]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x10]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x11]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x12]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x13]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x14]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x15]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x16]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x17]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x18]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x19]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1a]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1b]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1c]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1d]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1e]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1f]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x20]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x21]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
mov rax, r9
add rsp, 0x18
ret
Function at 0x140032790
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x18
mov qword [rcx + 0x10], 0
mov r9, rcx
movabs r10, 0x100000001b3
mov qword [rsp], rdx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 8], 0x24
mov qword [rcx], rax
movups xmm0, xmmword [rsp]
movups xmmword [rcx + 8], xmm0
movsx r8, byte [rdx]
xor r8, rax
imul r8, r10
mov qword [rcx], r8
movsx rax, byte [rdx + 1]
xor rax, r8
imul rax, r10
mov qword [rcx], rax
movsx rcx, byte [rdx + 2]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 3]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 4]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 5]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 6]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 7]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 8]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 9]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xa]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xb]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xc]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xd]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0xe]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0xf]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x10]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x11]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x12]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x13]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x14]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x15]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x16]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x17]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x18]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x19]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1a]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1b]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1c]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1d]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x1e]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x1f]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x20]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x21]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
movsx rcx, byte [rdx + 0x22]
xor rcx, rax
imul rcx, r10
mov qword [r9], rcx
movsx rax, byte [rdx + 0x23]
xor rax, rcx
imul rax, r10
mov qword [r9], rax
mov rax, r9
add rsp, 0x18
ret
Function at 0x1400366a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, rdx
mov rbp, rcx
mov rdx, qword [rcx + 0xf0]
mov rcx, qword [rcx + 0xe8]
cmp rcx, rdx
je 0x140036708
cmp qword [rcx], rbx
je 0x1400366de
add rcx, 8
cmp rcx, rdx
jne 0x1400366d0
cmp rcx, rdx
je 0x140036708
lea rax, [rcx + 8]
cmp rax, rdx
je 0x140036708
nop dword [rax]
mov r8, qword [rax]
cmp r8, rbx
je 0x1400366ff
mov qword [rcx], r8
add rcx, 8
add rax, 8
cmp rax, rdx
jne 0x1400366f0
mov r8, qword [rbp + 0xf0]
lea rdx, [rcx + 8]
sub r8, rdx
call fcn.1400517c0
add qword [rbp + 0xf0], 0xfffffffffffffff8
xor r14d, r14d
mov qword [rbx + 0xd8], r14
mov byte [rbx + 0x125], 1
mov r8, qword [rbx + 0xf0]
mov rax, qword [rbx + 0xe8]
cmp rax, r8
je 0x14003676b
nop word [rax + rax]
cmp byte [rbx + 0x124], r14b
mov rcx, qword [rax]
setne dl
call fcn.140037030
add rax, 8
cmp rax, r8
jne 0x140036750
mov byte [rbx + 0x121], 1
mov rsi, qword [rbx + 0xf0]
mov rdi, qword [rbx + 0xe8]
cmp rdi, rsi
je 0x1400367ab
nop word [rax + rax]
cmp byte [rbx + 0x120], r14b
mov rcx, qword [rdi]
setne dl
call fcn.1400371e0
add rdi, 8
cmp rdi, rsi
jne 0x140036790
call fcn.14003a5e0
mov r9d, 2
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov rdx, rbx
mov rcx, rax
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x2a]
call fcn.14003b230
call fcn.14003a5e0
mov r9d, 2
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rbx
mov rdx, rbp
mov rcx, rax
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 0x1b]
call fcn.14003b230
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x69]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6b]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6c]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6d]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6e]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x6f]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rbp + 0xc8]
and rcx, rdx
mov rdx, qword [rbp + 0xa0]
shl rcx, 4
add rcx, qword [rbp + 0xb0]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400368fb
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1400368b2
cmp rax, rcx
je 0x1400368fb
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400368a3
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400368fb
mov rsi, qword [rax + 0x20]
mov rdi, qword [rax + 0x18]
cmp rdi, rsi
je 0x1400368ea
nop dword [rax + rax]
mov ebx, dword [rdi]
call fcn.14003a5e0
mov edx, ebx
mov rcx, rax
call fcn.14003ad30
add rdi, 4
cmp rdi, rsi
jne 0x1400368d0
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x98]
call fcn.140037410
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140037410
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov r11, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [r10 + 8]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r9, r8
shl r9, 4
add r9, rdi
mov rbx, qword [r9 + 8]
cmp rbx, rdx
je 0x140037589
mov rax, qword [r11]
mov rcx, qword [r9]
cmp rax, qword [rbx + 0x10]
je 0x1400374d3
nop dword [rax + rax]
cmp rbx, rcx
je 0x140037589
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1400374c0
test rbx, rbx
je 0x140037589
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r9 + 8], rbx
jne 0x140037502
cmp rax, rbx
jne 0x1400374f8
mov qword [rdi + r8*8], rdx
mov qword [r9 + 8], rdx
jmp 0x14003750e
mov rdx, qword [rbx + 8]
mov qword [r9 + 8], rdx
jmp 0x14003750e
cmp rax, rbx
jne 0x14003750e
mov rax, qword [rbx]
mov qword [rdi + r8*8], rax
mov rcx, qword [rbx]
dec qword [r10 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003756c
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
cmp rdx, 0x1000
jb 0x140037559
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140037596
mov rcx, r8
call fcn.14004f3ac
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov edx, 0x30
mov rcx, rbx
call fcn.14004f3ac
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
call fcn.140055d18
int3
Function at 0x14003b0a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rsi, rdx
mov qword [rsp + 0x50], rdx
mov rdi, rcx
lea rdx, [rsp + 0x20]
sub rcx, 0xffffffffffffff80
lea r8, [rsp + 0x50]
call fcn.14003bd00
mov r8, qword [rax]
mov rbp, qword [r8 + 0x20]
mov rbx, qword [r8 + 0x18]
cmp rbx, rbp
je 0x14003b0f8
mov edx, dword [rbx]
mov rcx, rdi
call fcn.14003ad30
add rbx, 4
cmp rbx, rbp
jne 0x14003b0e5
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x50], rsi
lea rcx, [rdi + 0x80]
call fcn.140037410
mov r10, qword [rdi + 0x18]
movabs rdx, 0x100000001b3
mov r8, qword [rdi + 8]
movabs rax, 0xcbf29ce484222325
movzx ecx, sil
xor rcx, rax
movzx eax, byte [rsp + 0x59]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5a]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5b]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5c]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5d]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5e]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x5f]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and rcx, qword [rdi + 0x30]
mov r9, rcx
add r9, r9
mov r11, qword [r10 + r9*8 + 8]
mov rdx, r11
cmp r11, r8
je 0x14003b212
mov rax, qword [r10 + r9*8]
cmp rsi, qword [r11 + 0x10]
je 0x14003b1bf
nop word [rax + rax]
cmp rdx, rax
je 0x14003b212
mov rdx, qword [rdx + 8]
cmp rsi, qword [rdx + 0x10]
jne 0x14003b1b0
test rdx, rdx
je 0x14003b212
add rcx, rcx
mov rax, qword [r10 + rcx*8]
cmp r11, rdx
jne 0x14003b1eb
cmp rax, rdx
jne 0x14003b1e0
mov qword [r10 + rcx*8], r8
mov qword [r10 + r9*8 + 8], r8
jmp 0x14003b1f7
mov r8, qword [rdx + 8]
mov qword [r10 + r9*8 + 8], r8
jmp 0x14003b1f7
cmp rax, rdx
jne 0x14003b1f7
mov rax, qword [rdx]
mov qword [r10 + rcx*8], rax
mov rcx, qword [rdx]
dec qword [rdi + 0x10]
mov rax, qword [rdx + 8]
mov qword [rax], rcx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
call fcn.14003c420
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret