joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ace0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44ae57
movzx edx, byte [rax]
test edx, edx
jne 0x44ad14
nop dword [rax]
test r8b, r8b
jne 0x44ad14
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44ad27
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44ae17
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44ae05
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44adf7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44ad7d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44adc0
mov eax, 1
cmp rax, rbx
ja 0x44adab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44adef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44adb3
mov rcx, r11
mov eax, r12d
jmp 0x44ad82
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44ae4d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44ae10
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44ad2d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3

Function at 0x4509e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x450a95
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call sym.runtime._traceMap_.put
nop
test bl, bl
je 0x450a8f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [sym.runtime._traceStringTable_.put.func1]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00563568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.runtime._traceStringTable_.put
Function at 0x453a00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x453aaf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00563568]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x45bba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00563388], 0
je 0x45bbae
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x45bbc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00563388], 0
je 0x45bbd5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x45bbe0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00563388], 0
je 0x45bc15
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00563900]
aesenc xmm0, xmmword [0x00563910]
aesenc xmm0, xmmword [0x00563920]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback
Function at 0x45d260
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x00563568]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x45d2fb
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x45d520
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x00563568]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x45d5b7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x45d980
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45d9b4
mov rcx, 0x28
jmp 0x45d9bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x00563568], rcx
pop rbp
ret
Function at 0x14001123a
Capabilities:
Terminate process

Disassembly:
jmp 0x140013910
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112d5
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014c60
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014c80
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014c93
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014cbd
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014cd1
xor al, al
jmp 0x140014d01
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ce3
xor al, al
jmp 0x140014d01
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014cff
xor al, al
jmp 0x140014d01
mov al, 1
add rsp, 0x38
ret
Function at 0x140004340
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400043b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400043b8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400043a5
nop
cmp rbx, rcx
jae 0x1400043b8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140004390
cmp rbx, rcx
jae 0x1400043b8
cmp word [rbx], 0
je 0x1400043b8
lfence
mov rax, rbx
jmp 0x1400043ba
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140004500
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
lea rax, vtable.CSHA1.0
mov dword [rcx + 8], 0x67452301
mov qword [rcx], rax
mov rbx, rcx
xor eax, eax
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
mov qword [rcx + 0x1c], rax
test dl, 1
je 0x14000454b
mov edx, 0xc0
call fcn.14007e2a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140008080
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rcx, qword [rcx]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rbx, r9
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x28], rax
mov r9d, 0x10
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400080e7
mov dword [rsp + 0x40], eax
lea rax, [0x1401b9210]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov rcx, qword [rbx + 8]
jmp 0x1400080f8
lea rcx, [0x1401b91d8]
mov dword [rbx], 0
mov qword [rbx + 8], rcx
mov rax, qword [0x1401b91e0]
cmp qword [rcx + 8], rax
jne 0x140008114
cmp dword [rbx], 0
jne 0x140008114
mov eax, dword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret

Function at 0x140008c80
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401c1660]
test rax, rax
jne 0x140008d0b
lea rcx, str.sciter.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140008cf0
lea rdx, str.SciterAPI
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140008ce7
call qword [case.0x140077645.0]
mov qword [0x1401c1660], rax
mov rax, qword [rax + 0x4d8]
call qword [case.0x140077645.0]
test rax, rax
je 0x140008cf0
mov qword [0x1401c1668], rax
jmp 0x140008cf0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rax, qword [0x1401c1660]
mov rbx, qword [rsp + 0x20]
test rax, rax
jne 0x140008d0b
lea ecx, [rax - 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x28
ret
Function at 0x140009110
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x1400096b0
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000975c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1400096ea
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1400099f0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000972a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14007e2a0
mov rcx, rbx
test rbx, rbx
jne 0x140009710
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140009c60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140009aee
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007e2a0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x140009afa
cmp rbx, rbp
jne 0x140009aa0
cmp qword [rsp + 0x68], r14
jne 0x140009acd
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x140009b09
mov qword [r15], r12
mov rax, r12
jmp 0x140009b0c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140009acd
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007e2a0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140009ba6
cmp rbx, rbp
jne 0x140009b80
jmp 0x140009aca
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140009b20
jmp 0x140009acd
Function at 0x1400091c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rcx, qword [rdx + 0x10]
mov rdi, rdx
movabs rdx, 0x100000001b3
movzx r8d, byte [rcx + 0x10]
xor r8, rax
movzx eax, byte [rcx + 0x11]
imul r8, rdx
xor r8, rax
movzx eax, byte [rcx + 0x12]
imul r8, rdx
xor r8, rax
movzx eax, byte [rcx + 0x13]
imul r8, rdx
xor r8, rax
imul r8, rdx
and r8, qword [r9 + 0x38]
shl r8, 4
add r8, qword [r9 + 0x20]
mov rax, qword [r8]
cmp qword [r8 + 8], rcx
jne 0x140009246
cmp rax, rcx
jne 0x14000923c
mov rax, qword [r9 + 0x10]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x140009251
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
jmp 0x140009251
cmp rax, rcx
jne 0x140009251
mov rax, qword [rcx]
mov qword [r8], rax
mov rbx, qword [rcx]
mov edx, 0x18
dec qword [r9 + 0x18]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
call fcn.14007e2a0
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009280
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r11, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
xor ebp, ebp
movzx eax, byte [rdx + 1]
mov rbx, rdx
mov rdi, qword [r11 + 0x20]
mov r9, qword [r11 + 0x10]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r11 + 0x38]
mov r10, r8
shl r10, 4
add r10, rdi
mov rcx, qword [r10 + 8]
cmp rcx, r9
je 0x14000936c
mov eax, dword [rbx]
mov rdx, qword [r10]
cmp eax, dword [rcx + 0x10]
je 0x14000930e
cmp rcx, rdx
je 0x14000936c
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140009300
test rcx, rcx
je 0x14000936c
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r10 + 8], rcx
jne 0x140009339
cmp rax, rcx
jne 0x14000932f
mov qword [rdi + r8*8], r9
mov qword [r10 + 8], r9
jmp 0x140009345
mov r9, qword [rcx + 8]
mov qword [r10 + 8], r9
jmp 0x140009345
cmp rax, rcx
jne 0x140009345
mov rax, qword [rcx]
mov qword [rdi + r8*8], rax
mov rdx, qword [rcx]
dec qword [r11 + 0x18]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.14007e2a0
mov ecx, 1
jmp 0x14000936f
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
test rcx, rcx
mov eax, 0x490
cmovne eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009390
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x38]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
mov r8, qword [r9 + 0x10]
shl rdx, 4
add rdx, qword [r9 + 0x20]
xor r9d, r9d
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x140009410
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x140009413
cmp rax, rdx
je 0x140009410
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140009400
jmp 0x140009413
mov rax, r9
test rax, rax
cmove rax, r8
cmp r8, rax
lea rcx, [rax + 0x14]
cmove rcx, r9
mov rax, rcx
ret

Function at 0x140009430
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, r8
movzx eax, byte [rdx + 1]
mov r8, qword [r10 + 0x38]
imul r9, rcx
xor r9, rax
movzx eax, byte [rdx + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [rdx + 3]
imul r9, rcx
xor r9, rax
mov rax, qword [r10 + 0x20]
imul r9, rcx
and r8, r9
mov r9, qword [r10 + 0x10]
add r8, r8
mov rcx, qword [rax + r8*8 + 8]
cmp rcx, r9
je 0x1400094c3
mov edx, dword [rdx]
mov r8, qword [rax + r8*8]
cmp edx, dword [rcx + 0x10]
je 0x1400094ae
nop dword [rax]
cmp rcx, r8
je 0x1400094c3
mov rcx, qword [rcx + 8]
cmp edx, dword [rcx + 0x10]
jne 0x1400094a0
test rcx, rcx
cmove rcx, r9
cmp r9, rcx
je 0x1400094c3
mov edx, dword [rcx + 0x14]
xor eax, eax
mov dword [r11], edx
ret
mov eax, 0x490
ret
Function at 0x1400096b0
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x1400096b0
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14000975c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x1400096ea
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1400099f0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14000972a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14007e2a0
mov rcx, rbx
test rbx, rbx
jne 0x140009710
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140009c60
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x140009aee
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007e2a0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x140009afa
cmp rbx, rbp
jne 0x140009aa0
cmp qword [rsp + 0x68], r14
jne 0x140009acd
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x140009b09
mov qword [r15], r12
mov rax, r12
jmp 0x140009b0c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140009acd
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.14007e2a0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140009ba6
cmp rbx, rbp
jne 0x140009b80
jmp 0x140009aca
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140009b20
jmp 0x140009acd