joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400105a0
Capabilities:
Hash data using djb2

Disassembly:
movsx eax, byte [rcx]
test eax, eax
je 0x140010746
add eax, 0x2b5a5
movsx edx, byte [rcx + 1]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 2]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 3]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 4]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 5]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 6]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 7]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 8]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 9]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xa]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xb]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xc]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xd]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xe]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xf]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0x10]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0x11]
test edx, edx
je 0x140010745
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx ecx, byte [rcx + 0x12]
test ecx, ecx
je 0x140010745
add ecx, eax
shl eax, 5
add ecx, eax
mov eax, ecx
ret
mov eax, 0x1505
ret
Function at 0x140010ba0
Capabilities:
Hash data using djb2

Disassembly:
movsx eax, byte [rcx]
test eax, eax
je 0x140010c9e
add eax, 0x2b5a5
movsx edx, byte [rcx + 1]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 2]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 3]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 4]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 5]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 6]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 7]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 8]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 9]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xa]
test edx, edx
je 0x140010c9d
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx ecx, byte [rcx + 0xb]
test ecx, ecx
je 0x140010c9d
add ecx, eax
shl eax, 5
add ecx, eax
mov eax, ecx
ret
mov eax, 0x1505
ret

Function at 0x140011b10
Capabilities:
Hash data using djb2

Disassembly:
movsx eax, byte [rcx]
test eax, eax
je 0x140011c26
add eax, 0x2b5a5
movsx edx, byte [rcx + 1]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 2]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 3]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 4]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 5]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 6]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 7]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 8]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 9]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xa]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xb]
test edx, edx
je 0x140011c25
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx ecx, byte [rcx + 0xc]
test ecx, ecx
je 0x140011c25
add ecx, eax
shl eax, 5
add ecx, eax
mov eax, ecx
ret
mov eax, 0x1505
ret
Function at 0x140011c30
Capabilities:
Hash data using djb2

Disassembly:
movsx eax, byte [rcx]
test eax, eax
je 0x140011da6
add eax, 0x2b5a5
movsx edx, byte [rcx + 1]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 2]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 3]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 4]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 5]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 6]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 7]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 8]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 9]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xa]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xb]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xc]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xd]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xe]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xf]
test edx, edx
je 0x140011da5
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx ecx, byte [rcx + 0x10]
test ecx, ecx
je 0x140011da5
add ecx, eax
shl eax, 5
add ecx, eax
mov eax, ecx
ret
mov eax, 0x1505
ret
Function at 0x140011db0
Capabilities:
Hash data using djb2

Disassembly:
movsx eax, byte [rcx]
test eax, eax
je 0x140011ede
add eax, 0x2b5a5
movsx edx, byte [rcx + 1]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 2]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 3]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 4]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 5]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 6]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 7]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 8]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 9]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xa]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xb]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx edx, byte [rcx + 0xc]
test edx, edx
je 0x140011edd
mov r8d, eax
shl r8d, 5
add eax, edx
add eax, r8d
movsx ecx, byte [rcx + 0xd]
test ecx, ecx
je 0x140011edd
add ecx, eax
shl eax, 5
add ecx, eax
mov eax, ecx
ret
mov eax, 0x1505
ret
Function at 0x140014230
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400143df
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140013fc0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x1400143d2
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
jmp 0x1400142d1
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x1400143d2
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rax
imul r8, rcx
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rcx
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rcx
movzx r11d, byte [rdx + 0x13]
xor r11, r8
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x1400142c0
mov r14, qword [r9 + rbx*8]
mov ebp, dword [rdx + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x140014370
mov r10, qword [r14]
cmp r10, rdx
je 0x1400142c4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x1400142c4
cmp r11, r14
je 0x1400143a8
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x140014370
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400142c8
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x1400142c8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14016efe8
int3
Function at 0x140014d30
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx r14d, byte [r8 + 3]
xor r14, rcx
imul r14, rax
mov rcx, qword [rdi + 0x30]
and rcx, r14
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov r13, qword [rdx + rax + 8]
cmp r13, qword [rdi + 8]
je 0x140014de6
mov eax, dword [rbx]
cmp eax, dword [r13 + 0x10]
je 0x140014ddf
add rcx, rcx
mov r15, qword [rdx + rcx*8]
nop word cs:[rax + rax]
cmp r13, r15
je 0x140014de9
mov r13, qword [r13 + 8]
cmp eax, dword [r13 + 0x10]
jne 0x140014dd0
xor eax, eax
jmp 0x140014f82
mov r15, r13
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x140014f9c
mov ecx, 0x18
call fcn.14016e054
mov r13, rax
mov r12d, dword [rbx]
mov dword [rax + 0x10], r12d
mov dword [rax + 0x14], 0
mov rax, qword [rdi + 0x10]
inc rax
js 0x140014e28
cvtsi2ss xmm0, rax
jmp 0x140014e3d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [rdi]
mov rbx, qword [rdi + 0x38]
test rbx, rbx
js 0x140014e51
cvtsi2ss xmm2, rbx
jmp 0x140014e68
mov rax, rbx
shr rax, 1
mov ecx, ebx
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x140014f2d
divss xmm0, xmm1
call fcn.140355570
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x1403762d4]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdx, 9
mov eax, 8
cmovae rax, rdx
cmp rbx, rax
mov qword [rbp - 8], r13
jae 0x140014ed3
lea rcx, [rbx*8]
cmp rcx, rax
cmovb rcx, rax
cmp rbx, 0x200
cmovae rcx, rax
mov rbx, rcx
mov rcx, rdi
mov rdx, rbx
call fcn.140014230
mov rax, qword [rdi + 0x30]
and rax, r14
mov rcx, qword [rdi + 0x18]
mov rdx, rax
shl rdx, 4
mov r15, qword [rcx + rdx + 8]
cmp r15, qword [rdi + 8]
je 0x140014f24
cmp r12d, dword [r15 + 0x10]
mov r13, qword [rbp - 8]
je 0x140014f1f
add rax, rax
mov rax, qword [rcx + rax*8]
nop dword [rax]
cmp r15, rax
je 0x140014f2a
mov r15, qword [r15 + 8]
cmp r12d, dword [r15 + 0x10]
jne 0x140014f10
mov r15, qword [r15]
jmp 0x140014f2d
mov r13, qword [rbp - 8]
jmp 0x140014f2d
mov r15, rax
mov rcx, qword [r15 + 8]
inc qword [rdi + 0x10]
mov qword [r13], r15
mov qword [r13 + 8], rcx
mov qword [rcx], r13
mov qword [r15 + 8], r13
mov rax, qword [rdi + 0x18]
and r14, qword [rdi + 0x30]
shl r14, 4
lea rdx, [rax + r14]
lea r8, [rax + r14]
add r8, 8
mov rax, qword [rax + r14]
cmp rax, qword [rdi + 8]
je 0x140014f77
cmp rax, r15
je 0x140014f7d
mov al, 1
mov rdx, r8
cmp qword [r8], rcx
jne 0x140014f82
jmp 0x140014f7d
mov qword [rdx], r13
mov rdx, r8
mov qword [rdx], r13
mov al, 1
mov qword [rsi], r13
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14016efe8
int3
Function at 0x140023360
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1400233f6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400233fd
mov r15, rsi
jmp 0x1400233bb
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.14033b090
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x1400233ee
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400233d3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x140023390
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400233ee
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x1400233bb
sub rsi, r15
jmp 0x1400234ea
xor esi, esi
jmp 0x1400234ea
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140023450
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140023450
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.14033b090
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140023461
jmp 0x1400234e7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x1400234e7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140023490
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x1400234c3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.140356b08
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140023490
jmp 0x1400234e7
test r14, r14
je 0x1400234e4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.140356b08
sub r14, rax
jmp 0x1400234e7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400284e0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14002868f
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140013fc0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x140028682
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x140028581
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x140028682
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x13]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x140028570
mov r14, qword [r9 + rbx*8]
mov ebp, dword [rdx + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x140028620
mov r10, qword [r14]
cmp r10, rdx
je 0x140028574
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x140028574
cmp r11, r14
je 0x140028658
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x140028620
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x140028578
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x140028578
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14016efe8
int3
Function at 0x140029f10
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
call fcn.140070810
mov rsi, rax
mov rbx, qword [0x1406b53b8]
mov edx, dword [rbx + 0x48]
cmp edx, 0xffffffff
je 0x140029f79
cmp dword [rsi + 0x6b4], edx
je 0x140029f79
lea rdi, [0x1406b53c0]
mov rcx, rdi
call fcn.140035f70
mov eax, dword [rbx + 0x48]
mov dword [rsi + 0x6b4], eax
mov dword [rsi + 0x6b8], 0
lea rdx, [rsi + 0xd0]
lea rcx, [rsi + 0x3a0]
mov r8d, 0x2d0
call fcn.14033b090
mov rcx, rdi
call fcn.140036320
movss xmm0, dword [0x140375004]
ucomiss xmm0, dword [rsi + 0x6b8]
jbe 0x140029fdf
add rsi, 0x6b8
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x3c23d70a
mov dword [rsp + 0x20], 0x3f800000
movss xmm1, dword [0x140375004]
movss xmm2, dword [0x1403755c4]
xorps xmm3, xmm3
mov rcx, rsi
call fcn.14006fa00
lea rcx, [0x1406b53c0]
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
add rsp, 0x40
pop rbx
pop rdi
pop rsi
jmp fcn.140039830
nop
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140039830
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x300
mov edi, r9d
mov rsi, r8
mov ebx, edx
mov r14, rcx
mov rax, qword [0x14045eb18]
xor rax, rsp
mov qword [rsp + 0x2f8], rax
test r8, r8
je 0x140039998
cmp ebx, 0xffffffff
jne 0x14003986b
mov ebx, dword [r14]
mov rdx, qword [r14 + 8]
mov rax, qword [r14 + 0x10]
sub rax, rdx
shr rax, 4
imul eax, eax, 0x677d46cf
cmp ebx, eax
jge 0x140039896
movsxd rax, ebx
imul rax, rax, 0x2f0
add rdx, rax
jmp 0x140039927
mov eax, ebx
shr eax, 0x18
mov ecx, ebx
shr ecx, 0x10
movzx edx, bl
movabs r8, 0xcbf29ce484222325
xor r8, rdx
movabs rdx, 0x100000001b3
imul r8, rdx
movzx ebp, bh
xor rbp, r8
imul rbp, rdx
movzx ecx, cl
xor rcx, rbp
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and rcx, qword [r14 + 0x50]
mov rax, qword [r14 + 0x28]
mov r8, qword [r14 + 0x38]
mov rdx, rcx
shl rdx, 4
mov rdx, qword [r8 + rdx + 8]
cmp rdx, rax
je 0x140039979
cmp ebx, dword [rdx + 0x10]
je 0x14003991e
add rcx, rcx
mov rcx, qword [r8 + rcx*8]
nop word cs:[rax + rax]
cmp rdx, rcx
je 0x140039979
mov rdx, qword [rdx + 8]
cmp ebx, dword [rdx + 0x10]
jne 0x140039910
cmp rdx, rax
je 0x140039979
add rdx, 0x18
lea rcx, [rsp + 0x28]
mov r8d, 0x2d0
call fcn.14033b090
test dil, dil
je 0x1400399ae
add rsi, 0xf0
lea rax, [rsp + 0x48]
xor ecx, ecx
nop word [rax + rax]
movups xmm0, xmmword [rax + rcx - 0x20]
movups xmmword [rsi + rcx - 0x20], xmm0
movups xmm0, xmmword [rax + rcx - 0x10]
movups xmmword [rsi + rcx - 0x10], xmm0
movups xmm0, xmmword [rax + rcx]
movups xmmword [rsi + rcx], xmm0
add rcx, 0x30
cmp rcx, 0x2d0
jne 0x140039950
mov rcx, qword [rsp + 0x2f8]
xor rcx, rsp
call fcn.14016e210
nop
add rsp, 0x300
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.140070810
mov rsi, rax
cmp ebx, 0xffffffff
je 0x140039868
jmp 0x14003986b
xor eax, eax
movups xmm0, xmmword [rsp + rax + 0x28]
movups xmm1, xmmword [rsi + rax + 0x3a0]
subps xmm0, xmm1
movss xmm2, dword [rsi + 0x6b8]
shufps xmm2, xmm2, 0
mulps xmm2, xmm0
addps xmm2, xmm1
movups xmmword [rsi + rax + 0xd0], xmm2
cmp rax, 0x2c0
je 0x140039979
movups xmm0, xmmword [rsp + rax + 0x38]
movups xmm1, xmmword [rsi + rax + 0x3b0]
subps xmm0, xmm1
movss xmm2, dword [rsi + 0x6b8]
shufps xmm2, xmm2, 0
mulps xmm2, xmm0
addps xmm2, xmm1
movups xmmword [rsi + rax + 0xe0], xmm2
add rax, 0x20
jmp 0x1400399b0
Function at 0x140048010
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test rcx, rcx
je 0x14004808a
mov rdi, rcx
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x14004808a
movsxd rax, dword [rdi + 0x3c]
cmp rax, 0x400
jg 0x14004808a
cmp dword [rdi + rax], 0x4550
jne 0x14004808a
mov ecx, dword [rdi + rax + 0x90]
test rcx, rcx
je 0x14004808a
mov edx, dword [rdi + rax + 0x94]
mov al, 1
mov qword [rsp + 0x28], rdx
test rdx, rdx
je 0x14004808c
add rcx, rdi
xor edx, edx
movabs rbp, 0x8000000080000000
mov r12, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x20], rcx
jmp 0x1400480b9
xor eax, eax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [rsp + 0x30]
add rdx, 0x14
cmp rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
jae 0x14004814f
mov esi, dword [rcx + rdx]
mov r13d, dword [rcx + rdx + 0x10]
mov eax, r13d
or eax, esi
je 0x14004814f
mov qword [rsp + 0x30], rdx
mov ebx, dword [rdx + rcx + 0xc]
add rbx, rdi
test rsi, rsi
cmove rsi, r13
add r13, rdi
add rsi, rdi
jmp 0x1400480f8
add r13, 8
add rsi, 8
mov rax, qword [rsi]
test rax, rbp
je 0x140048120
movzx r14d, ax
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
test rax, rax
jne 0x14004812d
jmp 0x1400480a0
mov rax, qword [r13]
test rax, rax
je 0x1400480a0
cmp rax, qword [rsi]
jne 0x1400480f0
lea r14, [rax + rdi]
add r14, 2
mov rcx, rbx
call r12
mov rcx, rax
mov rdx, r14
call r15
mov qword [r13], rax
jmp 0x1400480f0
mov al, 1
jmp 0x14004808c
Function at 0x14005ba00
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov esi, edx
mov r8d, ecx
mov ecx, 1
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x14005ba3a
mov rdi, rax
mov rcx, rax
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x14005ba3c
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret