joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012410
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113ca
movzx eax, al
test eax, eax
jne 0x140012430
mov ecx, 7
call fcn.14001133e
nop
mov byte [rsp + 0x20], 0
call fcn.140011352
mov byte [rsp + 0x21], al
cmp dword [0x14001d878], 1
jne 0x140012454
mov ecx, 7
call fcn.14001133e
nop
jmp 0x1400124ac
cmp dword [0x14001d878], 0
jne 0x1400124a7
mov dword [0x14001d878], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b8
test eax, eax
je 0x140012488
mov eax, 0xff
jmp 0x1400125b1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011348
mov dword [0x14001d878], 2
jmp 0x1400124ac
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132a
call fcn.1400112c1
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012509
mov rcx, qword [rsp + 0x30]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x140012509
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112f3
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001253d
mov rcx, qword [rsp + 0x38]
call fcn.14001115e
movzx eax, al
test eax, eax
je 0x14001253d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011389
nop
call fcn.140012660
mov dword [rsp + 0x28], eax
call fcn.14001129e
movzx eax, al
test eax, eax
jne 0x14001255c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001256b
call fcn.140011393
nop
xor edx, edx
mov cl, 1
call fcn.14001114a
mov eax, dword [rsp + 0x28]
jmp 0x1400125b1
add rsp, 0x68
ret
Function at 0x496950
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
cmp word [0x00400000], 0x5a4d
je 0x49698d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x496a1b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x4969b1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x496a1b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x4969f8
cmp ecx, 0x20b
je 0x4969d0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x496a1b
cmp dword [rax + 0x84], 0xe
ja 0x4969e4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x496a1b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x496a1b
cmp dword [rax + 0x74], 0xe
ja 0x496a09
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x496a1b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x004d0400], 0xffffffffffffffff
mov qword [0x004d0408], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x004cfe8c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x004cfe88]
mov dword [rcx], eax
call 0x57a000
cmp dword [0x004cf0e8], 0
jne 0x496a75
lea rcx, [0x00496c00]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x004989e0]
lea rcx, [0x004989d8]
call sub.msvcrt.dll__initterm
mov r11d, dword [0x004cfe84]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x004cfe80]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x004989d0]
lea rcx, [0x00498928]
call sub.msvcrt.dll__initterm
mov r11, qword [sym.imp.msvcrt.dll__acmdln]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x496b16
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x496b06
cmp al, 0x22
je 0x496b06
jmp 0x496af0
cmp byte [r8], 0x22
jne 0x496b26
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496b26
cmp byte [r8], 0x20
jbe 0x496b26
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496b16
movzx eax, byte [r8]
test al, al
je 0x496b3c
cmp al, 0x20
ja 0x496b3c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x496b26
test byte [rsp + 0x8c], 1
je 0x496b51
movzx r9d, word [rsp + 0x90]
jmp 0x496b57
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.004570d4
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x496b73
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x496b97
mov eax, edi
jmp 0x496ba0
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
invalid
invalid
invalid
xchg edi, eax
popfq
mov dh, 0xff
lodsd eax, dword [rsi]
mov cl, 0xc5
dec esi
rcr esp, 1
invalid
sar bh, 1
movabs eax, dword [0xb4ff89aba1ff9faa]
ret
cmp edi, 0xffffffbd
retf
invalid
cmpsd dword [rsi], dword [rdi]
mov dl, 0xd4
jmp [rax - 0x4d00214b]
mov ebp, 0xc3ffefca
sal ebx, 1
dec ecx
xlatb
clc
dec esi
invalid
Function at 0x180003120
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18000314e
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180003000]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret

Function at 0x180004c60
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180004e80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x180004d67
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180004cc4
mov rax, qword [0x18000e008]
cmp qword [rsp + 0x20], rax
ja 0x180004cc4
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180004c86
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180004cf3
jmp 0x180004d67
cmp dword [rsp + 0x50], 0x10000
jne 0x180004d4a
cmp qword [rsp + 0x48], 0x10000
jb 0x180004d4a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004d38
mov rax, qword [rsp + 0x28]
jmp 0x180004d69
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004d62
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180004e80
mov qword [rsp + 0x20], rax
jmp 0x180004c86
xor eax, eax
add rsp, 0x68
ret

Function at 0x180004d70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180004ec0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180004e73
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180004dcb
mov rax, qword [0x18000e008]
cmp qword [rsp + 0x20], rax
ja 0x180004dcb
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180004d8d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180004dfa
jmp 0x180004e73
cmp dword [rsp + 0x50], 0x10000
jne 0x180004e51
cmp qword [rsp + 0x48], 0x10000
jb 0x180004e51
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004e3f
mov rax, qword [rsp + 0x28]
jmp 0x180004e75
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x180004e6e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180004ec0
mov qword [rsp + 0x20], rax
jmp 0x180004d8d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180004f10
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800054a0
mov qword [rsp + 0x28], 0
cmp qword [0x18000e3d8], 0
jne 0x180004f58
cmp qword [0x18000e3d0], 0
je 0x180004f58
mov rax, qword [0x18000e3d0]
mov qword [0x18000e3d8], rax
cmp qword [0x18000e3d8], 0
je 0x180004ffe
mov rax, qword [0x18000e3d8]
cmp qword [rax + 0x10], 0
je 0x180004ffe
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180004ffe
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180004ffe
mov rax, qword [0x18000e3d8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180004fc4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180004fcb
xor eax, eax
jmp 0x180005179
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x180005179
mov rax, qword [0x18000e3d0]
mov qword [0x18000e3d8], rax
jmp 0x180005020
mov rax, qword [0x18000e3d8]
mov rax, qword [rax + 8]
mov qword [0x18000e3d8], rax
cmp qword [0x18000e3d8], 0
je 0x18000506d
cmp qword [0x18000e3d8], 0
je 0x18000506b
mov rax, qword [0x18000e3d8]
cmp qword [rax + 0x10], 0
je 0x18000506b
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000506b
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000506b
jmp 0x180004f9c
jmp 0x18000500e
mov rcx, qword [rsp + 0x60]
call fcn.1800070d0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180005180
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180005177
mov rax, qword [rsp + 0x48]
mov qword [0x18000e3d8], rax
mov rax, qword [0x18000e3d8]
mov dword [rax], 0x52727464
mov rax, qword [0x18000e3d8]
mov qword [rax + 0x10], 0
mov rax, qword [0x18000e3d8]
mov rcx, qword [0x18000e3d0]
mov qword [rax + 8], rcx
mov rax, qword [0x18000e3d8]
mov qword [0x18000e3d0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18000e3d8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180005128
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180005162
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18000511e
mov rax, qword [0x18000e3d8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180004f9c
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400d1610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.1401bb070
sub rsp, rax
mov rax, qword [0x1403a0028]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov dword [rsp + 0x2c], 0xaaaaaaaa
mov ecx, dword [0x1403b1580]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
je 0x1400d16c4
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x1400d1702
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1401bd200
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1401b9d1c
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1401bcb50
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1401bb0d0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x2c]
call fcn.1400fe0b0
test al, al
je 0x1400d1705
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
je 0x1400d1708
mov eax, 0xffffffff
lock cmpxchg dword [0x1403b1580], ecx
je 0x1400d1648
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1403b1580]
mov dword [rsp + 0x2c], ecx
jmp 0x1400d1648
int3
int3
lea rcx, [rsp + 0x2c]
call fcn.1400fe0b0
test al, al
je 0x1400d172d
cmp dword [rsp + 0x2c], 0xffffffff
je 0x1400d172d
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
jmp 0x1400d16db
int3

Function at 0x1400fe0b0
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x1400fe0c5
mov dword [rsi], eax
cmp eax, 0xffffffff
setne al
add rsp, 0x20
pop rsi
ret

Function at 0x140180520
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1403b1580]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140180554
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x140180554
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14018054e
Function at 0x14000446f
Capabilities:
Encode data using xor

Disassembly:
pop rax
mov rbx, rax
mov ecx, 0x455
xor byte [rbx], 0x88
inc rbx
loop 0x140004478
jmp rax
Function at 0x180016b30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov r10, qword [rcx + 0x10]
mov r8, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x180016b56
mov r8, qword [rcx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x180016b85
movabs rdx, 0x100000001b3
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x180016b71
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.180018ad0
cmp qword [rax + 8], 0
je 0x180016bb0
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018240
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
jne 0x180016be1
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180016bbd
mov rdx, qword [rdi]
mov rcx, qword [0x18032e2d8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018240
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018240
mov rcx, qword [rax]
cmp qword [rcx + 0x30], 0
je 0x180016c13
mov r8, rdi
lea rdx, [rsp + 0x30]
call fcn.180018240
mov rcx, qword [rax]
mov rax, qword [rcx + 0x30]
mov rcx, rsi
call rax
jmp 0x180016c15
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180017c50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov r8d, 1
shlx rax, r8, rcx
cmp rdx, rax
ja 0x180017e3f
lea rax, [rdx - 1]
or rax, r8
bsr rcx, rax
inc ecx
shlx rdi, r8, rcx
mov rbx, qword [0x18032e628]
lea rdx, [rdi + rdi]
mov r8, rbx
lea rcx, [0x18032e638]
call fcn.1800053e0
lea rax, [rdi - 1]
mov qword [0x18032e650], rax
mov qword [0x18032e658], rdi
lea rax, [0x18032e620]
mov qword [rsp + 0x30], rax
mov rcx, qword [0x18032e628]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x180017e00
movabs rsi, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r11d, byte [rcx + 0x10]
xor r11, rsi
imul r11, rdi
movzx eax, byte [rcx + 0x11]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x12]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x13]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x14]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x15]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x16]
xor r11, rax
imul r11, rdi
movzx eax, byte [rcx + 0x17]
xor r11, rax
imul r11, rdi
and r11, qword [0x18032e650]
shl r11, 4
add r11, qword [0x18032e638]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180017d7f
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x180017df4
mov rax, qword [r11 + 8]
mov r8, qword [rcx + 0x10]
cmp r8, qword [rax + 0x10]
jne 0x180017dbc
mov r8, qword [rax]
cmp r8, rcx
je 0x180017db6
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x180017df4
cmp r9, rax
je 0x180017dd0
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
je 0x180017e19
cmp r9, rax
jne 0x180017dc1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x180017d00
mov qword [rsp + 0x30], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x180017df4
lea rcx, str.invalid_hash_bucket_count
call fcn.18006d50c
int3
Function at 0x180018240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push r12
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rsi, rdx
mov r8, qword [r8 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180018275
mov rdx, qword [r14]
movabs rbx, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x1800182b3
movabs r9, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor rbx, rax
imul rbx, r9
inc rcx
cmp rcx, r8
jb 0x1800182a0
mov r9, rbx
mov r8, r14
lea rdx, [rsp + 0x30]
call fcn.180018ad0
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1800182d9
mov qword [rsi], rax
mov byte [rsi + 8], r12b
jmp 0x18001849e
movabs rax, 0x492492492492492
cmp qword [0x18032e690], rax
je 0x1800184bb
lea rax, [0x18032e688]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x28], r12
mov ecx, 0x38
call fcn.18006ee24
mov rdi, rax
mov qword [rsp + 0x28], rax
lea r15, [rax + 0x10]
mov qword [rsp + 0x60], r15
mov rdx, r14
mov rcx, r15
call fcn.1800165f0
nop
mov qword [r15 + 0x20], r12
mov r9, qword [0x18032e690]
lea rcx, [r9 + 1]
vxorps xmm1, xmm1, xmm1
test rcx, rcx
js 0x18001834c
vcvtsi2ss xmm1, xmm1, rcx
jmp 0x180018361
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
vcvtsi2ss xmm1, xmm1, rax
vaddss xmm1, xmm1, xmm1
mov rdx, qword [0x18032e6b8]
vxorps xmm0, xmm0, xmm0
test rdx, rdx
js 0x180018378
vcvtsi2ss xmm0, xmm0, rdx
jmp 0x180018390
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
vcvtsi2ss xmm0, xmm0, rcx
vaddss xmm0, xmm0, xmm0
vdivss xmm0, xmm1, xmm0
vmovss xmm2, dword [0x18032e680]
vcomiss xmm0, xmm2
jbe 0x180018433
vdivss xmm0, xmm1, xmm2
vxorps xmm1, xmm1, xmm1
vroundss xmm1, xmm1, xmm0, 2
xor ecx, ecx
vmovss xmm0, dword [0x1800d8544]
vcomiss xmm1, xmm0
jb 0x1800183db
vsubss xmm1, xmm1, xmm0
vcomiss xmm1, xmm0
jae 0x1800183db
movabs rax, 0x8000000000000000
mov rcx, rax
vcvttss2si rax, xmm1
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x18001840d
cmp rdx, 0x200
jae 0x18001840a
lea rdx, [rdx*8]
cmp rdx, rcx
jae 0x18001840d
mov rdx, rcx
call fcn.1800185b0
mov r9, rbx
mov r8, r15
lea rdx, [rsp + 0x30]
call fcn.180018ad0
vmovups xmm0, xmmword [rax]
vmovups xmmword [rsp + 0x30], xmm0
mov r9, qword [0x18032e690]
mov qword [rsp + 0x28], r12
mov rdx, qword [rsp + 0x30]
mov r8, qword [rdx + 8]
inc r9
mov qword [0x18032e690], r9
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [0x18032e698]
mov rax, qword [0x18032e6b0]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x18032e688]
jne 0x180018480
mov qword [rcx + rax*8], rdi
jmp 0x180018492
cmp r9, rdx
jne 0x18001848b
mov qword [rcx + rax*8], rdi
jmp 0x180018497
cmp qword [rcx + rax*8 + 8], r8
jne 0x180018497
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
lea rcx, str.unordered_map_set_too_long
call fcn.18006d50c
int3