joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1ef0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
movzx edi, dl
mov rsi, rcx
mov byte [rcx], 0
add rcx, 8
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
lea rcx, [rsi + 0x58]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
lea r14, [rsi + 0xa0]
xor ebp, ebp
mov qword [r14], rbp
lea rbx, [rsi + 0xa8]
mov qword [rsp + 0x70], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
lea ecx, [rbp + 0x10]
call fcn.140101b00
mov qword [rax + 8], rbp
mov qword [rbx], rax
mov qword [rax], rbx
test dil, dil
je 0x1400a2016
movzx eax, byte [rsi]
nop
test al, al
jne 0x1400a2016
cmp qword [r14], rbp
jne 0x1400a2016
lea ecx, [rbp + 0x10]
call fcn.140101b00
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400a1fd6
lea ecx, [rbp + 8]
call fcn.140101b00
test rax, rax
je 0x1400a1fa3
mov qword [rax], rsi
jmp 0x1400a1fa6
mov rax, rbp
mov qword [rsp + 0x78], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400a1ec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x1400a2024
jmp 0x1400a1fd9
mov rbx, rbp
lea rax, [rsp + 0x60]
cmp r14, rax
je 0x1400a1ff6
mov rcx, qword [r14]
mov qword [r14], rbx
test rcx, rcx
je 0x1400a2016
cmp dword [rcx + 8], 0
jne 0x1400a2001
jmp 0x1400a200b
test rbx, rbx
je 0x1400a2016
cmp dword [rbx + 8], 0
je 0x1400a2008
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
mov rcx, rbx
mov edx, SafeArrayGetLBound
call fcn.140101b3c
nop
mov rax, rsi
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rdi], ebp
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400a3a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea rax, vtable.SscronetExecutor.0
mov qword [rcx], rax
add rcx, 8
mov edx, 2
call sub.MSVCP140.dll__Mtx_init_in_situ
nop
lea rbx, [rdi + 0x58]
mov qword [rsp + 0x48], rbx
xor esi, esi
mov qword [rbx], rsi
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
mov qword [rbx + 0x20], rsi
lea ecx, [rsi + 0x10]
call fcn.140101b00
mov qword [rax + 8], rsi
mov qword [rbx], rax
mov qword [rax], rbx
lea rcx, [rdi + 0x80]
call sub.MSVCP140.dll__Cnd_init_in_situ
nop
mov byte [rdi + 0xc8], sil
lea ecx, [rsi + 0x10]
call fcn.140101b00
test rax, rax
je 0x1400a3ae1
mov qword [rax], rdi
lea rcx, [0x1400a4360]
mov qword [rax + 8], rcx
jmp 0x1400a3ae4
mov rax, rsi
mov qword [rsp + 0x48], rax
lea rbx, [rdi + 0xd8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1400a0af0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi + 0xd0], rax
test rax, rax
je 0x1400a3b4b
lea rcx, [0x1400a3f50]
call sub.sscronet.dll_Cronet_Executor_CreateWith
mov qword [rdi + 0xe0], rax
mov rdx, rdi
mov rcx, rax
call sub.sscronet.dll_Cronet_Executor_SetClientContext
nop
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], esi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1400a48d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 0x10
mov rbx, rdx
mov r11, qword [r8 + 0x10]
mov rdx, r8
mov rdi, rcx
jb 0x1400a48f1
mov rdx, qword [r8]
xor r10d, r10d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1400a4924
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r10 + rdx]
inc r10
xor r9, rax
imul r9, rcx
cmp r10, r11
jb 0x1400a4910
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14009a990
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400a494b
mov qword [rbx], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi + 8]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b5280
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x14026eff8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r15d, r15d
mov rsi, rdx
mov rbp, rcx
mov rbx, 0xffffffffffffffff
mov r14d, 0x104
test rcx, rcx
je 0x1400b532c
mov rdx, rcx
mov r8d, r14d
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rsp + 0x20]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400b52d5
test rax, rax
je 0x1400b530f
movzx ecx, word [rsp + rax*2 + 0x1e]
cmp cx, 0x2f
je 0x1400b52f5
cmp cx, 0x5c
jne 0x1400b530f
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x1400b5454
mov word [rsp + rax + 0x20], r15w
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b532c
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rsi]
test ax, ax
je 0x1400b542f
mov rdx, rsi
mov rcx, rsi
nop
cmp ax, 0x2f
je 0x1400b534c
cmp ax, 0x5c
jne 0x1400b534f
mov rdx, rcx
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x1400b5340
mov qword [rsp + 0x490], rdi
cmp rdx, rsi
je 0x1400b53a3
sub rdx, rsi
lea rcx, [rsp + 0x20]
sar rdx, 1
lea rdi, [rdx + rdx]
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
cmp rdi, 0x208
jae 0x1400b544e
lea rdx, [rsp + 0x20]
mov word [rsp + rdi + 0x20], r15w
mov rcx, rbp
call fcn.1400b5280
mov word [rsp + 0x230], r15w
test rbp, rbp
je 0x1400b53c5
mov r8, r14
lea rcx, [rsp + 0x230]
mov rdx, rbp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov word [rsp + 0x436], r15w
lea rax, [rsp + 0x230]
inc rbx
cmp word [rax + rbx*2], r15w
jne 0x1400b53d6
sub r14, rbx
lea rcx, [rsp + 0x230]
lea rcx, [rcx + rbx*2]
mov r8, r14
mov rdx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rsp + 0x230]
mov word [rsp + 0x436], r15w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400b5427
xor edx, edx
lea rcx, [rsp + 0x230]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdi, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.140102140
add rsp, 0x450
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
call fcn.140102428
int3
call fcn.140102428
int3
Function at 0x1400b5be0
Capabilities:
Get common file path

Disassembly:
mov dword [rsp + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x50
cmp qword [rcx], 0
mov ebp, r9d
mov r13, rdx
mov r14, rcx
jne 0x1400b5dd1
cmp dword [rcx + 8], 0xffffffff
jne 0x1400b5dd1
lea rdx, [rcx + 0x250]
mov qword [rsp + 0x70], rbx
mov ecx, 0x103
mov qword [rsp + 0x88], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rax, 0xffffffffffffffff
nop dword [rax]
nop word [rax + rax]
cmp word [r14 + rax*2 + 0x252], 0
lea rax, [rax + 1]
jne 0x1400b5c40
movzx ecx, word [r14 + rax*2 + 0x24e]
xor edi, edi
cmp cx, 0x5c
je 0x1400b5c73
cmp cx, 0x2f
je 0x1400b5c73
mov dword [r14 + rax*2 + 0x250], 0x2f
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r15
cmp ebp, 1
jne 0x1400b5cc8
mov r9d, ebp
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1400b5cd9
mov eax, 0x2000000
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
lea eax, [rbp - 2]
cmp eax, 1
jbe 0x1400b5cd9
mov ecx, 0x10000
mov eax, ecx
jmp 0x1400b5ca2
xor r12b, r12b
xor r15b, r15b
mov rsi, rdi
cmp ebp, 1
je 0x1400b5d30
cmp ebp, 2
jne 0x1400b5d4e
mov qword [rsp + 0x30], rdi
lea r8d, [rbp - 1]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b5d2b
mov ecx, 0x200
mov eax, ecx
jmp 0x1400b5ca2
mov r15b, 1
jmp 0x1400b5d33
mov rsi, r13
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
setne r12b
mov ecx, 0x30
call fcn.140101b00
lea ecx, [rbp - 1]
mov rbx, rax
cmp ecx, 1
jbe 0x1400b5d82
mov word [rax], 0x100
mov byte [rax + 0x18], dil
mov qword [rax + 0x20], r13
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x2c], edi
mov dword [rbx + 0x14], edi
jmp 0x1400b5db4
mov byte [rax], 1
mov byte [rax + 0x18], r15b
mov byte [rax + 1], r12b
mov qword [rax + 8], rsi
mov byte [rax + 0x10], dil
mov dword [rax + 0x14], edi
test r12b, r12b
je 0x1400b5db4
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rbx + 0x14], eax
mov rcx, rbx
call fcn.1400b90a0
test rax, rax
mov qword [r14], rax
mov ecx, 0x200
cmove edi, ecx
mov eax, edi
jmp 0x1400b5ca2
mov eax, 0x1000000
add rsp, 0x50
pop r14
pop r13
pop rbp
ret
Function at 0x1400b8b50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov r10, r8
mov rdi, r9
imul r10d, edx
mov rsi, rdx
cmp byte [r9], 0
mov r11, rcx
je 0x1400b8baa
mov rdx, rcx
mov qword [rsp + 0x20], 0
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, r10d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400b8b96
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
sub ecx, edx
mov qword [rsp + 0x40], rbx
lea eax, [rdx + r10]
cmp eax, dword [r9 + 0x28]
cmovbe ecx, r10d
add rdx, qword [r9 + 0x20]
mov ebx, ecx
mov r8d, ecx
mov rcx, r11
call sub.VCRUNTIME140.dll_memcpy
add dword [rdi + 0x2c], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
xor edx, edx
div rsi
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b8c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400b8c5b
xor eax, eax
ret
lea r11, [0x14021c900]
not ecx
cmp r8d, 8
jb 0x1400b8d31
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400b8c80
test r8d, r8d
je 0x1400b8d5d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x1400b8d40
not ecx
mov eax, ecx
ret
Function at 0x1400b8e80
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
je 0x1400b9087
cmp dword [rcx + 0x1c], 0
je 0x1400b9087
cmp qword [rcx + 0x80], 0
je 0x1400b8eaf
call fcn.1400b8d70
lea r9, [rsp + 0x50]
mov rcx, rdi
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call fcn.1400b9740
test eax, eax
je 0x1400b8ed6
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1400b8efd
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov dword [rbx + 0x6c], ecx
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
test rax, rax
jne 0x1400b8f45
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, dword [rdi + 0x40]
mov ecx, dword [rdi + 0x38]
mov dword [rbx + 0x78], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x94], eax
mov dword [rbx + 0x64], ebp
mov dword [rbx + 0x74], ebp
mov dword [rbx + 0x90], ecx
mov dword [rbx + 0x24], ebp
test ecx, ecx
je 0x1400b8f94
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.1400b70f0
test eax, eax
jne 0x1400b8f94
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
movzx ecx, byte [rdi + 0x34]
mov dword [rbx + 0x7c], eax
and cl, 1
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
mov eax, dword [rdi + 0x34]
shr eax, 3
mov byte [rbx + 0x98], cl
test al, 1
je 0x1400b8fc0
movzx eax, byte [rdi + 0x3d]
jmp 0x1400b8fc4
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
neg cl
mov dword [rbx + 0x9c], 0x12345678
sbb eax, eax
mov dword [rbx + 0xa0], 0x23456789
and eax, 0xc
mov dword [rbx + 0xa4], 0x34567890
mov dword [rbx + 0xa8], eax
test rsi, rsi
je 0x1400b905b
lea r8, [0x14021c900]
movzx eax, byte [rsi]
test al, al
je 0x1400b905b
mov edx, dword [rbx + 0x9c]
xor rax, rdx
movzx ecx, al
shr edx, 8
xor edx, dword [r8 + rcx*4]
mov ecx, dword [rbx + 0xa4]
movzx eax, dl
add eax, dword [rbx + 0xa0]
mov dword [rbx + 0x9c], edx
imul edx, eax, 0x8088405
movzx eax, cl
shr ecx, 8
inc edx
mov dword [rbx + 0xa0], edx
shr rdx, 0x18
xor rax, rdx
xor ecx, dword [r8 + rax*4]
mov dword [rbx + 0xa4], ecx
add rsi, 1
jne 0x1400b9001
mov eax, dword [rsp + 0x58]
mov ecx, dword [rdi + 0x7c]
add eax, 0x1e
add ecx, eax
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400ba150
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
sub rsp, 0x38
cmp byte [rcx], 0
mov r14, rdx
mov qword [rsp + 0x58], rbp
mov rbx, rcx
mov qword [rsp + 0x30], rdi
mov edi, 1
je 0x1400ba1a0
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
mov r8d, edi
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400ba19a
mov byte [rbx + 0x10], dil
mov ebp, dword [rsp + 0x60]
jmp 0x1400ba1d7
mov qword [rsp + 0x68], rsi
mov esi, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rsi + 1]
cmp eax, ecx
jbe 0x1400ba1b6
mov edi, ecx
sub edi, esi
mov rdx, rsi
mov r8d, edi
add rdx, qword [rbx + 0x20]
lea rcx, [rsp + 0x50]
mov ebp, edi
call sub.VCRUNTIME140.dll_memcpy
lea eax, [rsi + rdi]
mov rsi, qword [rsp + 0x68]
mov dword [rbx + 0x2c], eax
mov rdi, qword [rsp + 0x30]
cmp ebp, 1
mov rbp, qword [rsp + 0x58]
jne 0x1400ba1f8
movzx eax, byte [rsp + 0x50]
mov dword [r14], eax
xor eax, eax
add rsp, 0x38
pop r14
pop rbx
ret
cmp byte [rbx], 0
je 0x1400ba1ee
cmp byte [rbx + 0x10], 0
je 0x1400ba1ee
mov eax, 0xffffffff
add rsp, 0x38
pop r14
pop rbx
ret
Function at 0x1400be280
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, qword [r8]
mov r10, rcx
movabs rbx, 0x100000001b3
movzx r9d, r11b
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, r11
imul r9, rbx
shr rax, 8
movzx r8d, al
mov rax, r11
xor r9, r8
shr rax, 0x10
mov r8, qword [r10 + 8]
imul r9, rbx
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x18
imul r9, rbx
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x20
imul r9, rbx
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x28
imul r9, rbx
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x30
imul r9, rbx
movzx ecx, al
mov rax, r11
xor r9, rcx
shr rax, 0x38
mov rcx, qword [r10 + 0x30]
imul r9, rbx
xor r9, rax
imul r9, rbx
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, r8
je 0x1400be366
mov rcx, qword [rcx]
cmp r11, qword [rax + 0x10]
je 0x1400be368
cmp rax, rcx
je 0x1400be366
mov rax, qword [rax + 8]
cmp r11, qword [rax + 0x10]
jne 0x1400be344
test rax, rax
cmove rax, r8
mov qword [rdx], rax
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
xor eax, eax
mov rbx, qword [rsp + 8]
test rax, rax
cmove rax, r8
mov qword [rdx], rax
mov rax, rdx
ret
Function at 0x1400c1760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400c1972
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14009afc0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400c1937
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rcx + 0x10]
mov r11, qword [rsi + 0x30]
mov rax, r10
mov rdx, qword [rdx]
shr rax, 8
movzx r9d, al
movzx eax, r10b
xor rax, rbp
imul rax, rdi
xor r9, rax
mov rax, r10
imul r9, rdi
shr rax, 0x10
movzx r8d, al
mov rax, r10
xor r9, r8
shr rax, 0x18
imul r9, rdi
movzx r8d, al
mov rax, r10
xor r9, r8
shr rax, 0x20
imul r9, rdi
movzx r8d, al
mov rax, r10
xor r9, r8
shr rax, 0x28
imul r9, rdi
movzx r8d, al
mov rax, r10
xor r9, r8
shr rax, 0x30
imul r9, rdi
movzx r8d, al
mov rax, r10
xor r9, r8
shr rax, 0x38
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400c18ac
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x1400c1926
mov rax, qword [r11 + 8]
cmp r10, qword [rax + 0x10]
jne 0x1400c18e5
mov r10, qword [rax]
cmp r10, rcx
je 0x1400c18df
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x1400c1926
mov r8, rax
cmp r9, rax
je 0x1400c1902
nop dword [rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r10, qword [rax + 0x10]
je 0x1400c194c
cmp r9, rax
jne 0x1400c18f0
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400c1800
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x1400c1926
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400dd330
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
lea r15, [rcx + 8]
mov qword [rsp + 0x20], r15
mov byte [rsp + 0x28], 0
mov rcx, r15
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400dd44b
mov byte [rsp + 0x28], 1
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400dd385
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x1400dd3b3
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400dd3a0
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rsi + 0x58]
call fcn.14009a990
mov rdi, qword [rax + 8]
test rdi, rdi
jne 0x1400dd3d1
mov rdi, qword [rsi + 0x60]
cmp rdi, qword [rsi + 0x60]
je 0x1400dd42b
mov rax, qword [rdi + 0x30]
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400dd42b
mov rdx, rbp
lea rcx, [rbx + 0x10]
call sub.base.dll_protected:_bool___cdecl_base::internal::CallbackBase::EqualsInternal_class_base::internal::CallbackBase_const____ptr64_const___ptr64
test al, al
jne 0x1400dd3fb
cmp rbx, qword [rdi + 0x30]
jne 0x1400dd3e3
jmp 0x1400dd42b
mov rdx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
dec qword [rdi + 0x38]
lea rcx, [rbx + 0x10]
call sub.base.dll_protected:_void___cdecl_base::internal::CallbackBase::destructor_void____ptr64
mov edx, 0x20
mov rcx, rbx
call fcn.140101b3c
nop
mov rcx, r15
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
jmp sub.MSVCP140.dll__Mtx_unlock
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x1400e3970
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x14026eff8]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov r15, r8
mov r13, rdx
mov qword [rsp + 0x20], rcx
movabs rbx, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
xor edi, edi
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], SafeArrayPutElement
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x1400e39e0
mov rdx, r15
lea rcx, [rsp + 0x118]
call fcn.14000baa0
lea r8, [rsp + 0x118]
mov rsi, qword [rsp + 0x118]
mov r14, qword [rsp + 0x130]
cmp r14, 0x10
cmovae r8, rsi
mov rdx, rbp
mov rcx, rdi
mov rdi, qword [rsp + 0x128]
test rdi, rdi
je 0x1400e3a44
nop dword [rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rbx
inc rcx
cmp rcx, rdi
jb 0x1400e3a30
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r13 + 8]
cmp rbx, r12
je 0x1400e3ab3
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400e3a82
mov rdx, qword [rdx]
lea rcx, [rsp + 0x118]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, rax
jne 0x1400e3aa3
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400e3aae
cmp rbx, rbp
je 0x1400e3ab3
mov rbx, qword [rbx + 8]
jmp 0x1400e3a70
test rbx, rbx
jne 0x1400e3ab6
mov rbx, r12
cmp r14, 0x10
jb 0x1400e3aed
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400e3ae5
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e3b70
mov rcx, rsi
call fcn.140101b3c
cmp rbx, qword [r13 + 8]
je 0x1400e3afd
mov rax, qword [rbx + 0x30]
cmp rax, qword [rbx + 0x38]
jne 0x1400e3b77
mov rdx, qword [0x14026ef08]
test rdx, rdx
je 0x1400e3b51
lea rcx, [rsp + 0x28]
call fcn.1400e8ba0
nop
mov rcx, rax
call fcn.140021da0
mov rcx, rax
lea rdx, str.Couldnt_translate:
call fcn.140064050
mov rcx, rax
mov rdx, r15
call fcn.140064050
lea rdx, [0x1400a0c00]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x28]
call fcn.1400e8c60
mov rax, qword [rsp + 0x20]
cmp byte [rax + 0xb0], 0
je 0x1400e3b83
mov r13, qword [rax + 0xb8]
mov qword [rsp + 0x20], r13
jmp 0x1400e39a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp qword [rax + 0x18], 0x10
jb 0x1400e3b86
mov rax, qword [rax]
jmp 0x1400e3b86
mov rax, r15
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.140102140
mov rbx, qword [rsp + 0x188]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, rdx
mov rdx, rcx
jmp 0x1400e3970