joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00405650]
xor edx, edx
mov dword [rax], 1
mov rax, qword [0x00405660]
mov dword [rax], 1
mov rax, qword [0x00405670]
mov dword [rax], 1
mov rax, qword [0x00405640]
mov dword [rax], 1
mov rax, qword [0x00405500]
cmp word [rax], 0x5a4d
je 0x4010d0
mov rax, qword [0x00405630]
mov dword [0x00408008], edx
mov eax, dword [rax]
test eax, eax
je 0x4010c2
mov ecx, 2
call sym.__set_app_type
mov rcx, 0xffffffffffffffff
call dbg._encode_pointer
mov rdx, qword [0x00405590]
mov qword [rdx], rax
mov rdx, qword [0x00405580]
mov qword [rdx], rax
mov rax, qword [0x004055f0]
mov edx, dword [rax]
mov rax, qword [sym.imp.msvcrt.dll__fmode]
mov rax, qword [rax]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004054b0]
cmp dword [rax], 1
je 0x401120
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401075
movsxd rcx, dword [rax + 0x3c]
add rax, rcx
cmp dword [rax], 0x4550
jne 0x401058
movzx ecx, word [rax + 0x18]
cmp cx, 0x10b
je 0x401133
cmp cx, 0x20b
jne 0x401058
cmp dword [rax + 0x84], 0xe
jbe 0x401058
mov ecx, dword [rax + 0xf8]
xor edx, edx
test ecx, ecx
setne dl
jmp 0x401058
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401058
mov r8d, dword [rax + 0xe8]
xor edx, edx
test r8d, r8d
setne dl
jmp 0x401058
Function at 0x401530
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0x110
lea rbp, [rsp + 0x80]
lea rcx, str.Digite_o_CPF_a_ser_cadastrado:
call sym.printf
lea rcx, str._s__cpf
call sym.scanf
lea rdx, [rbp + 0x30]
lea rax, [rbp + 0x60]
mov rcx, rax
call sym.strcpy
lea rax, [rbp + 0x60]
lea rdx, [0x00405028]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x30]
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rdx, rax
mov ecx, 0x2c
call sym.fputc
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rcx, str.digite_o_nome_a_ser_cadastrado:
call sym.printf
mov rax, rbp
mov rdx, rax
lea rcx, [0x00405051]
call sym.scanf
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
mov rdx, rbp
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rdx, rax
mov ecx, 0x2c
call sym.fputc
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rcx, str.Digite_o_sobrenome_a_ser_cadastrado:
call sym.printf
lea rax, [rbp - 0x30]
mov rdx, rax
lea rcx, [0x0040507e]
call sym.scanf
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
lea rdx, [rbp - 0x30]
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov rdx, rax
mov ecx, 0x2c
call sym.fputc
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rcx, str.Digite_o_cargo_a_ser_cadastrado:
call sym.printf
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, [0x0040507e]
call sym.scanf
lea rax, [rbp + 0x60]
lea rdx, [0x0040502a]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x88], rax
lea rdx, [rbp - 0x60]
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fprintf
mov rax, qword [rbp + 0x88]
mov rcx, rax
call sym.fclose
lea rcx, [0x004050aa]
call sym.system
add rsp, 0x110
pop rbp
ret

Function at 0x40177f
Capabilities:
Execute command

Disassembly:
push rbp
sub rsp, 0x120
lea rbp, [rsp + 0x80]
lea rdx, str.Portuguese
mov ecx, 0
call sym.setlocale
lea rcx, str.Digite_o_cpf_a_ser_consultado:
call sym.printf
lea rax, [rbp + 0x70]
mov rdx, rax
lea rcx, [0x0040507e]
call sym.scanf
lea rax, [rbp + 0x70]
lea rdx, [0x004050d8]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x4017ef
lea rcx, [0x004050e0]
call sym.puts
nop
mov rdx, qword [rbp + 0x98]
lea rax, [rbp - 0x60]
mov r8, rdx
mov edx, 0xc8
mov rcx, rax
call sym.fgets
test rax, rax
jne 0x4017f0
lea rcx, str._nEssas_s
call sym.printf
lea rax, [rbp - 0x60]
mov rdx, rax
lea rcx, [0x0040507e]
call sym.printf
lea rcx, [0x0040513f]
call sym.puts
lea rcx, str.pause
call sym.system
add rsp, 0x120
pop rbp
ret
Function at 0x401850
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rcx, [0x00405147]
call sym.puts
lea rcx, str.pause
call sym.system
add rsp, 0x20
pop rbp
ret

Function at 0x401876
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
call dbg.__main
mov dword [rbp - 8], 0
mov dword [rbp - 4], 1
mov dword [rbp - 4], 1
jmp 0x4018d2
cmp eax, 3
je 0x4018b2
cmp eax, 1
jne 0x4018b9
call sym.registro
jmp 0x4018d2
call sym.consultar
jmp 0x4018d2
call sym.deletar
jmp 0x4018d2
lea rcx, str.Essa_op
call sym.puts
lea rcx, str.pause
call sym.system
nop
mov dword [rbp - 4], 1
lea rcx, [0x00405164]
call sym.system
lea rdx, str.Portuguese
mov ecx, 0
call sym.setlocale
lea rcx, str._Cart
call sym.puts
lea rcx, str.Escolha_a_op
call sym.puts
lea rcx, str._t1___Registrar_nomes
call sym.puts
lea rcx, str._t2___Consultar_os_nomes
call sym.puts
lea rcx, str._t3___Deletar_nomes_n
call sym.puts
lea rcx, [0x004051ed]
call sym.printf
lea rax, [rbp - 8]
mov rdx, rax
lea rcx, [0x004051f5]
call sym.scanf
lea rcx, [0x00405164]
call sym.system
mov eax, dword [rbp - 8]
cmp eax, 2
je 0x4018ab
jmp 0x40189a

Function at 0x401b70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rbp, dword [0x00408054]
mov rbx, rcx
mov rsi, rdx
mov rdi, r8
test ebp, ebp
jle 0x401c8a
mov rax, qword [0x00408058]
xor r9d, r9d
add rax, 8
mov r10, qword [rax]
cmp rbx, r10
jb 0x401bbe
mov rdx, qword [rax + 8]
mov r11d, dword [rdx + 8]
add r10, r11
cmp rbx, r10
jb 0x401c70
add r9d, 1
add rax, 0x18
cmp r9d, ebp
jne 0x401ba2
mov rcx, rbx
call dbg.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x401cc2
lea rbp, [rbp + rbp*2]
shl rbp, 3
mov r13, rbp
add r13, qword [0x00408058]
mov qword [r13 + 0x10], rax
mov dword [r13], 0
call dbg._GetPEImageBase
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
lea rdx, [rsp + 0x20]
mov qword [r13 + 8], rax
mov rax, qword [0x00408058]
mov rcx, qword [rax + rbp + 8]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x401ca5
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x401c69
sub eax, 0x40
and eax, 0xffffffbf
je 0x401c69
mov r9, rbp
add r9, qword [0x00408058]
mov r8d, 0x40
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401c91
add dword [0x00408054], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.memcpy
xor ebp, ebp
jmp 0x401bcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
mov rax, qword [0x00408058]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbp + 8]
call dbg.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call dbg.__report_error
nop
nop word cs:[rax + rax]

Function at 0x4028a0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x4028b0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0
Function at 0x4028c0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402901
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x4028f8
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x402903
add rax, 0x28
cmp rax, r9
jne 0x4028e4
xor eax, eax
repz ret

Function at 0x4029b0
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [0x00405500]
cmp word [rbx], 0x5a4d
je 0x4029d0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, rcx
mov rcx, rbx
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4029c4
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp dbg._FindPESection

Function at 0x402c20
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004089c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004089a0]
test rbx, rbx
je 0x402c74
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402c6b
test rsi, rsi
je 0x402c6b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402c50
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x004089c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x18001aad4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r8d
mov r15, rcx
mov rcx, rbp
xor edi, edi
mov r14, rdx
call fcn.18008e72c
mov rsi, rax
mov r9, qword gs:[0x60]
mov rdx, qword [r9 + 0x18]
mov rdx, qword [rdx + 0x10]
mov r8, qword [rdx + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18001ab77
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x18001ab77
mov ebx, dword [r9 + 0x20]
dec r11d
lea rcx, [rbx + r11*4]
mov r10d, dword [rcx + r8]
mov ecx, 0x811c9dc5
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x18001ab72
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x18001ab55
cmp ecx, 0xece4502d
je 0x18001ab7c
test r11d, r11d
jne 0x18001ab38
mov rdx, qword [rdx]
jmp 0x18001ab13
mov eax, dword [r9 + 0x24]
mov ecx, dword [r9 + 0x1c]
add rax, r8
add rcx, r8
xor r9d, r9d
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
mov rdx, rsi
add rax, r8
mov rcx, r15
mov r8d, ebp
call rax
movsxd rbx, eax
test eax, eax
jle 0x18001abbf
mov r8, rbx
mov rdx, rsi
mov rcx, r14
call fcn.180007820
add edi, ebx
jmp 0x18001ab02
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x50]
cmp ebx, eax
mov rbx, qword [rsp + 0x40]
cmovne eax, edi
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18001ffa4
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18001ffc4
xor eax, eax
jmp 0x1800200aa
cmp qword [rcx + 0x68], 0
je 0x18001ffd5
call fcn.18001b984
jmp 0x1800200aa
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18001ffec
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001ffee
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180020020
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18012fad0
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1800200a4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180020057
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x180020080
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18010f3e4
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1800200a4
cmp rdi, rbx
ja 0x18002005e
test rdi, rdi
je 0x1800200a4
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call fcn.18010f3e4
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180026114
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x180026144
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x180026126
mov rax, r8
ret
Function at 0x18002bb84
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
not r8d
mov r9d, 4
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x180168b50]
xor r8d, dword [rax + rdx*4]
sub r9, 1
jne 0x18002bb8d
not r8d
mov eax, r8d
ret

Function at 0x18002bbb8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x18002bc12
mov r11b, 0x23
lea rbx, [0x180168b50]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x18002bbfc
cmp rdx, 2
jb 0x18002bbfc
cmp byte [r10], r11b
jne 0x18002bbfc
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x18002bbda
jmp 0x18002bc53
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x18002bc53
mov r11b, 0x23
lea rbx, [0x180168b50]
cmp dl, r11b
jne 0x18002bc37
cmp byte [r10], r11b
jne 0x18002bc37
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x18002bc25
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x18002bd88
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x18002bda8
and qword [r8], 0
lea rdx, [0x18016fc48]
call fcn.18002bc64
mov rbx, rax
test rax, rax
je 0x18002be8f
mov rcx, rax
call fcn.1801100e8
mov ebp, eax
cmp eax, 0xffffffff
je 0x18002be87
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18010f7c8
test eax, eax
jne 0x18002be87
mov rcx, rbx
call fcn.1801100e8
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18002be87
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call fcn.18010f7c8
test eax, eax
jne 0x18002be87
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x18002be87
mov rax, qword [0x1801963c0]
test rax, rax
je 0x18002be29
inc dword [rax + 0xec]
mov rcx, rbp
call fcn.180113040
mov rdi, rax
test rax, rax
je 0x18002be87
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call fcn.18010f3e4
mov rcx, rbx
cmp rax, rbp
je 0x18002be75
call fcn.18010e528
mov rax, qword [0x1801963c0]
test rax, rax
je 0x18002be6b
dec dword [rax + 0xec]
mov rcx, rdi
call fcn.18010d710
jmp 0x18002be8f
call fcn.18010e528
test rsi, rsi
je 0x18002be82
mov qword [rsi], rbp
mov rax, rdi
jmp 0x18002be91
mov rcx, rbx
call fcn.18010e528
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18006d21c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x18018f280]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rbp, [r8 - 1]
mov r13, r9
sar rbp, 1
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov r12, rdx
mov rdi, rdx
cmp rdx, rbp
jge 0x18006d2a2
lea rbx, [rdi + rdi]
lea rax, [rbx + 2]
imul rdx, rax, 0x58
lea rcx, [rsp + 0xa0]
add rdx, rsi
lea r8, [rdx - 0x58]
call fcn.18006b1f4
movzx edi, al
xor rdi, 1
inc rdi
add rdi, rbx
imul rdx, rdi, 0x58
imul rcx, r15, 0x58
add rdx, rsi
add rcx, rsi
call fcn.18006cd04
mov r15, rdi
cmp rdi, rbp
jl 0x18006d25a
mov rbx, rdi
cmp rdi, rbp
jne 0x18006d2cb
test r14b, 1
jne 0x18006d2cb
imul rdx, r14, 0x58
imul rcx, rdi, 0x58
add rdx, 0xffffffffffffffa8
add rdx, rsi
add rcx, rsi
call fcn.18006cd04
lea rbx, [r14 - 1]
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
cmp r12, rbx
jge 0x18006d316
lea rdi, [rbx - 1]
mov r8, r13
sar rdi, 1
lea rcx, [rsp + 0x20]
imul rbp, rdi, 0x58
add rbp, rsi
mov rdx, rbp
call fcn.18006b1f4
test al, al
je 0x18006d316
imul rcx, rbx, 0x58
mov rdx, rbp
add rcx, rsi
call fcn.18006cd04
mov rbx, rdi
cmp r12, rdi
jl 0x18006d2dd
imul rcx, rbx, 0x58
mov rdx, r13
add rcx, rsi
call fcn.18006cd04
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18008e310
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180072d0c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x250
mov rax, qword [0x18018f280]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rax, qword gs:[0x30]
mov r14, rcx
xor r8d, r8d
mov rcx, qword [rax + 0x60]
test r14, r14
jne 0x180072d5e
mov rax, qword [rcx + 0x10]
jmp 0x180072ea5
mov rcx, qword [rcx + 0x18]
lea r15, [rsp + 0x20]
mov r12d, r8d
mov r13, r8
lea rax, [rcx + 0x20]
mov qword [rsp + 0x28], rax
lea rsi, [rcx + 0x10]
lea rax, [rcx + 0x30]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rax
mov rdi, qword [rsi]
jmp 0x180072e7b
mov rbp, rdi
mov rdx, r14
sub rbp, r13
mov rcx, qword [rbp + 0x60]
call fcn.180113fd0
xor r8d, r8d
test eax, eax
je 0x180072e9d
mov rdx, qword [rbp + 0x50]
mov ebx, r8d
mov ecx, r8d
movzx eax, word [rdx]
test ax, ax
je 0x180072e78
inc ecx
cmp ax, 0x5c
jne 0x180072dcf
lea rbx, [rdx + rcx*2]
movzx eax, word [rdx + rcx*2]
test ax, ax
jne 0x180072dc3
test rbx, rbx
je 0x180072e78
mov rdx, r14
mov rcx, rbx
call fcn.180113fd0
xor r11d, r11d
test eax, eax
je 0x180072e9d
movzx eax, word [rbx]
mov r8d, r11d
mov edx, r11d
test ax, ax
je 0x180072e21
mov rcx, rbx
cmp ax, 0x2e
cmovne rcx, r8
inc edx
mov r8, rcx
lea rcx, [rbx + rdx*2]
movzx eax, word [rcx]
test ax, ax
jne 0x180072e08
lea rax, [rsp + 0x40]
mov r9, rbx
sub r9, rax
lea rdx, [rsp + 0x40]
mov ecx, r11d
movzx eax, word [r9 + rdx]
mov r10d, ecx
mov word [rdx], ax
lea rax, [rbx + r10*2]
cmp rax, r8
je 0x180072e58
inc ecx
add rdx, 2
cmp ecx, 0x100
jb 0x180072e34
jmp 0x180072e5e
mov word [rsp + r10*2 + 0x40], r11w
mov rdx, r14
mov word [rsp + 0x23e], r11w
lea rcx, [rsp + 0x40]
call fcn.180113fd0
test eax, eax
je 0x180072e9d
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180072d90
inc r12d
add r15, 8
add r13, 0x10
cmp r12d, 3
jge 0x180072ea3
mov rsi, qword [r15]
jmp 0x180072d88
mov rax, qword [rbp + 0x30]
jmp 0x180072ea5
xor eax, eax
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18008e310
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800733ec
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18018f280]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rcx, [rsp + 0x20]
call fcn.180009acc
nop
movabs r8, 0xcbf29ce484222325
lea rax, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rax, qword [rsp + 0x20]
lea rdx, [rsp + 0x20]
cmova rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rdx
jmp 0x18007346e
movabs rdx, 0x100000001b3
imul r8, rdx
movsx rdx, byte [rax]
xor r8, rdx
inc rax
cmp rax, rcx
jne 0x180073456
mov qword [rsi + 0x40], r8
xor ebp, ebp
mov byte [rsi + 0x68], bpl
lea r8, [rsi + 0x20]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.1800731bc
mov rax, qword [rsi + 0x30]
mov qword [rsi + 0x48], rax
mov rbx, qword [0x180196858]
mov rax, qword [rbx + 8]
mov rcx, rax
mov rdi, rbx
cmp byte [rax + 0x19], bpl
jne 0x1800734d7
mov rdx, qword [rsi + 0x40]
cmp qword [rcx + 0x20], rdx
jae 0x1800734bd
mov rcx, qword [rcx + 0x10]
jmp 0x1800734d1
cmp byte [rdi + 0x19], bpl
je 0x1800734cb
cmp rdx, qword [rcx + 0x20]
cmovb rdi, rcx
mov rbx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], bpl
je 0x1800734b1
cmp byte [rdi + 0x19], bpl
jne 0x1800734e0
mov rax, qword [rdi]
cmp byte [rax + 0x19], bpl
jne 0x180073502
mov rcx, qword [rsi + 0x40]
cmp rcx, qword [rax + 0x20]
jae 0x1800734f8
mov rdi, rax
mov rax, qword [rax]
jmp 0x1800734fc
mov rax, qword [rax + 0x10]
cmp byte [rax + 0x19], bpl
je 0x1800734ea
cmp rbx, rdi
je 0x180073570
mov rdx, qword [rbx + 0x28]
mov rcx, rsi
call fcn.1800735cc
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], bpl
je 0x18007353b
mov rax, qword [rbx + 8]
jmp 0x180073530
cmp rbx, qword [rax + 0x10]
jne 0x180073536
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], bpl
je 0x180073523
mov rbx, rax
jmp 0x180073556
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], bpl
jne 0x180073556
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], bpl
je 0x180073547
cmp rbx, rdi
jne 0x180073507
mov rax, qword [rsi + 0x58]
sub rax, qword [rsi + 0x50]
sar rax, 3
test rax, rax
je 0x180073570
mov byte [rsi + 0x68], 1
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1800735a9
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800735a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800735c6
call fcn.18008e330
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18008e310
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
call fcn.18010dd88
int3