joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800406b0
Capabilities:
Read file on windows

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r14, r8
xor eax, eax
mov r13, rcx
movzx r12d, r9b
mov r15, rdx
mov r8b, 1
mov ecx, dword [r14 + 0x34]
mov qword [r14 + 0x28], rax
mov dword [r14 + 0x30], eax
test rdx, rdx
je 0x1800408d7
test ecx, ecx
je 0x1800408d7
cmp ecx, 0x64
ja 0x18004073b
mov dword [r14 + 0x30], ecx
test r9b, r9b
je 0x18004072b
call fcn.18004a4dc
mov edx, dword [r14 + 0x30]
mov r8, rax
mov rcx, r15
mov qword [r14 + 0x28], rax
call fcn.180044760
jmp 0x1800408db
mov r8, r14
mov rcx, r13
call fcn.180040f00
jmp 0x1800408db
mov qword [rsp + 0xd0], rbp
mov eax, 0x51eb851f
mul ecx
mov qword [rsp + 0xc8], rsi
mov ebp, ecx
shr edx, 5
mov esi, 0x64
imul eax, edx, 0x64
mov qword [rsp + 0xc0], rdi
mov rdi, rcx
sub ebp, eax
cmove ebp, esi
mov eax, ebp
sub rdi, rax
add rdi, r15
cmp rdi, r15
jb 0x180040884
mov qword [rsp + 0x118], rbx
nop dword [rax + rax]
mov r8d, ebp
lea rcx, [rsp + 0x40]
xor edx, edx
mov ebx, ebp
call fcn.18004c900
test r12b, r12b
je 0x1800407c3
lea r8, [rsp + 0x40]
mov edx, ebx
mov rcx, rdi
call fcn.180044760
movzx r8d, al
test al, al
je 0x18004087c
jmp 0x180040826
mov rsi, qword [r13 + 0x78]
mov dword [rsp + 0x30], 0
cmp rsi, 0xffffffffffffffff
je 0x180040879
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 0xffffffff
jne 0x1800407fb
test eax, eax
jne 0x180040879
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, ebp
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180040879
mov r8b, 1
mov esi, 0x64
lea ecx, [rbp - 1]
movsxd rax, ecx
test ecx, ecx
js 0x180040846
cmp byte [rsp + rax + 0x40], 0
jne 0x180040841
dec ecx
sub rax, 1
jns 0x180040830
jmp 0x180040846
add ecx, 1
jne 0x180040857
sub rdi, 0x64
mov ebp, esi
cmp rdi, r15
jae 0x180040790
jmp 0x18004087c
mov eax, ecx
add rdi, rax
cmp r15, rdi
jae 0x18004087c
mov ecx, dword [r14 + 0x34]
sub edi, r15d
lea eax, [rdi + 4]
mov dword [r14 + 0x30], eax
cmp ecx, eax
jae 0x18004087c
mov dword [r14 + 0x30], ecx
jmp 0x18004087c
xor r8b, r8b
mov rbx, qword [rsp + 0x118]
mov eax, dword [r14 + 0x30]
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
test eax, eax
je 0x1800408d7
test r12b, r12b
je 0x1800408c5
mov ecx, eax
call fcn.18004a4dc
mov edx, dword [r14 + 0x30]
mov r8, rax
mov rcx, r15
mov qword [r14 + 0x28], rax
call fcn.180044760
jmp 0x1800408d3
mov r8, r14
mov edx, r15d
mov rcx, r13
call fcn.180040f00
movzx r8d, al
movzx eax, r8b
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x180040f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x40], 0
mov ecx, dword [r8 + 0x30]
mov rsi, r8
mov ebx, edx
call fcn.18004a4dc
mov qword [rsi + 0x28], rax
xor r9d, r9d
mov rcx, qword [rdi + 0x78]
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov r8d, dword [rsi + 0x30]
lea r9, [rsp + 0x40]
mov rdx, qword [rsi + 0x28]
mov rcx, qword [rdi + 0x78]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x48]
test eax, eax
mov rsi, qword [rsp + 0x50]
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x180040f80
Capabilities:
Parse pe header

Disassembly:
push rbp
push rdi
sub rsp, 0x68
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ebp, r8d
mov rdi, rcx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180040fa3
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], eax
cmp r8, 8
ja 0x1800410ff
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x180041003
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x180041003
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x180041003
cmp dword [rax], 0x4550
jne 0x180041003
mov ecx, 0x10b
cmp word [rax + 0x18], cx
je 0x180041007
mov rax, qword [rdi + 0x38]
mov ebx, dword [rax + 0x38]
mov esi, dword [rax + 0x3c]
test r8, r8
je 0x180041033
test rdx, rdx
je 0x180041023
lea rcx, [rsp + 0x20]
call fcn.18004c130
jmp 0x180041033
call fcn.180052338
mov dword [rax], 0x16
call fcn.1800503dc
lea ecx, [rbp - 1]
mov dword [rsp + 0x30], ebp
add ecx, ebx
xor edx, edx
mov eax, ecx
div ebx
sub ecx, edx
mov dword [rsp + 0x28], ecx
mov rcx, rdi
call fcn.180040560
xor edx, edx
lea ecx, [rax - 1]
add ecx, esi
mov eax, ecx
div esi
sub ecx, edx
mov dword [rsp + 0x34], ecx
mov rcx, rdi
call fcn.1800405d0
xor edx, edx
mov dword [rsp + 0x44], 0xe0000060
mov dword [rsp + 0x54], ebp
mov dword [rsp + 0x50], ebp
lea ecx, [rax - 1]
add ecx, ebx
mov eax, ecx
div ebx
sub ecx, edx
mov dword [rsp + 0x2c], ecx
mov rcx, rbp
call fcn.18004a4dc
mov r8, rbp
mov qword [rsp + 0x48], rax
xor edx, edx
mov rcx, rax
call fcn.18004c900
mov rdx, qword [rdi + 0x48]
lea rcx, [rdi + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x98]
cmp rdx, qword [rcx + 0x10]
je 0x1800410eb
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rdx + 0x10], xmm1
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rdx + 0x20], xmm0
movsd qword [rdx + 0x30], xmm1
add qword [rcx + 8], 0x38
jmp 0x1800410f5
lea r8, [rsp + 0x20]
call fcn.180041b30
mov rax, qword [rdi + 0x30]
inc word [rax + 6]
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x68
pop rdi
pop rbp
ret
Function at 0x1800441e0
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp qword [0x180084c48], 0
jne 0x18004437d
lea rcx, str.ntdll.dll
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x180044378
lea rdx, str.NtCreateThreadEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtDuplicateObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenThread
mov rcx, rbx
mov qword [0x180084c58], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationFile
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryInformationThread
mov rcx, rbx
mov qword [0x180084c38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySystemInformation
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQueryVirtualMemory
mov rcx, rbx
mov qword [0x180084c40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeProcess
mov rcx, rbx
mov qword [0x180084c50], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSetInformationThread
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtSuspendProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtTerminateProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtOpenSymbolicLinkObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtQuerySymbolicLinkObject
mov rcx, rbx
mov qword [0x180084c30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.RtlNtStatusToDosError
mov rcx, rbx
mov qword [0x180084c28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtClose
mov rcx, rbx
mov qword [0x180084c48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180084c20], rax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x180044390
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x180080920]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x118
call fcn.18004c900
xorps xmm0, xmm0
mov dword [rsp + 0x50], 0x11c
lea rcx, [rsp + 0x50]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180044620
cmp dword [rsp + 0x54], 5
jb 0x180044620
jne 0x180044400
cmp dword [rsp + 0x58], 0
je 0x180044620
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rsp + 0x20]
test rax, rax
je 0x18004442b
call rax
jmp 0x180044431
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
mov ecx, dword [rsp + 0x58]
cmp ax, 9
mov edx, dword [rsp + 0x54]
sete r9b
test ax, ax
sete r8b
cmp ax, 9
jne 0x180044482
cmp edx, 5
jne 0x180044482
cmp ecx, 2
jne 0x180044482
test ecx, ecx
mov dword [0x180084c60], ecx
mov eax, ecx
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r8b, r8b
je 0x1800444b6
cmp edx, 5
jne 0x1800444b6
cmp ecx, 1
jne 0x1800444b6
test ecx, ecx
mov dword [0x180084c60], ecx
mov eax, ecx
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r9b, r9b
je 0x1800444ec
cmp edx, 6
jne 0x1800444ec
test ecx, ecx
jne 0x1800444ec
mov eax, 4
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r8b, r8b
je 0x180044522
cmp edx, 6
jne 0x180044522
test ecx, ecx
jne 0x180044522
mov eax, 3
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r9b, r9b
je 0x180044556
cmp edx, 6
jne 0x180044556
cmp ecx, 1
jne 0x180044556
test edx, edx
mov dword [0x180084c60], edx
mov eax, edx
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r8b, r8b
je 0x18004458d
cmp edx, 6
jne 0x18004458d
cmp ecx, 1
jne 0x18004458d
mov eax, 5
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r9b, r9b
je 0x1800445c4
cmp edx, 6
jne 0x1800445c4
cmp ecx, 2
jne 0x1800445c4
mov eax, 8
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
test r8b, r8b
je 0x1800445fb
cmp edx, 6
jne 0x1800445fb
cmp ecx, 2
jne 0x1800445fb
mov eax, 7
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
xor eax, eax
test eax, eax
mov dword [0x180084c60], eax
setne al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180049ad0
add rsp, 0x188
ret
Function at 0x180044a40
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180044ac3
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
test rdi, rdi
je 0x180044aa4
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rbx, qword [rsp + 0x58]
test eax, eax
cmove rbx, rsi
jmp 0x180044aa7
mov rbx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rax, rsi
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x180044ae0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor esi, esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov edx, 0x80000000
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
lea r8d, [rsi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180044b80
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], esi
mov r8d, 0x1000002
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x180044b80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x180044b80
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
lea edx, [rsi + 4]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov rcx, rbx
test rax, rax
jne 0x180044b92
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180046280
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov r14, rdx
mov rax, qword [rdx + 0x208]
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
xor ebx, ebx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x2f], rbx
mov qword [rbp + 0x37], rbx
mov ecx, ebx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
mov dword [rbp - 0x11], ebx
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 0x1f], rbx
mov dword [rbp + 0x27], ebx
mov qword [rbp - 0x39], rbx
mov dword [rbp + 0x47], ebx
mov qword [rbp - 0x29], rbx
mov qword [rbp + 0x3f], 0xffffffffffffffff
mov qword [rbp - 0x31], rax
test rax, rax
je 0x180046305
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.18003fcf0
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180046394
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180046394
mov rax, qword [rbp - 9]
test rax, rax
je 0x180046394
cmp dword [rax], 0x4550
jne 0x180046394
mov rdi, qword [rbp - 1]
movzx ecx, word [rax + 0x18]
mov edx, 0x10b
cmp cx, dx
jne 0x180046341
cmp dword [rax + 0x78], 0
jmp 0x180046352
mov eax, 0x20b
cmp cx, ax
jne 0x180046394
cmp dword [rdi + 0x88], 0
setne al
test al, al
je 0x180046394
mov r8, rdi
mov rdx, r14
call fcn.180046200
mov rsi, rax
test rax, rax
je 0x180046394
mov ecx, dword [rdi + 0x88]
mov rdx, rax
sub rdx, rcx
mov qword [rsp + 0x20], rdx
mov r9, rax
mov r8, rdi
mov rdx, r14
call fcn.180046480
mov rcx, rsi
call fcn.180049e70
nop
mov rcx, qword [rbp + 0x37]
test rcx, rcx
je 0x1800463a2
call fcn.180049e70
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x1800463b0
call fcn.180049e70
mov rdx, qword [rbp + 0xf]
mov rax, rdx
mov rcx, qword [rbp + 7]
sub rax, rcx
sar rax, 3
movabs rsi, 0x6db6db6db6db6db7
imul rax, rsi
test rax, rax
je 0x180046414
mov rdi, rbx
nop dword [rax + rax]
mov rax, qword [rdi + rcx + 0x28]
test rax, rax
je 0x1800463fa
mov rcx, rax
call fcn.180049e70
mov rdx, qword [rbp + 0xf]
mov rcx, qword [rbp + 7]
inc rbx
add rdi, 0x38
mov rax, rdx
sub rax, rcx
sar rax, 3
imul rax, rsi
cmp rbx, rax
jb 0x1800463e0
mov qword [rbp + 0xf], rcx
test rcx, rcx
je 0x180046456
mov rax, qword [rbp + 0x17]
sub rax, rcx
sar rax, 3
imul rax, rsi
imul rdx, rax, 0x38
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046451
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180046473
call fcn.180049e70
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1800503fc
int3
Function at 0x180046800
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
mov eax, dword [rdx + 0x210]
mov ecx, 0x7d0
cmp eax, ecx
movzx edi, r9w
mov rbp, r8
mov r13, rdx
cmovb ecx, eax
mov ebx, ecx
call fcn.18004a4dc
mov rcx, qword [r13 + 0x208]
mov r8, rax
mov edx, ebx
mov rsi, rax
call fcn.180044940
test al, al
je 0x180046973
movsxd rbx, dword [rsi + 0x3c]
add rbx, rsi
cmp dword [rbx], 0x4550
jne 0x180046973
cmp dword [rbx + 0x88], 0
je 0x180046973
cmp dword [rbx + 0x8c], 0
je 0x180046973
mov r8, rbx
mov rdx, r13
call fcn.180046200
mov r11, rax
test rax, rax
je 0x180046973
mov ecx, dword [rbx + 0x88]
xor r8d, r8d
mov r10d, dword [rax + 0x20]
mov rbx, rax
sub rbx, rcx
mov qword [rsp + 0x40], r14
mov r14d, dword [rax + 0x1c]
add r10, rbx
mov qword [rsp + 0x48], r15
add r14, rbx
mov r15d, dword [rax + 0x24]
add r15, rbx
test rbp, rbp
je 0x18004692a
mov edi, dword [rax + 0x18]
test edi, edi
je 0x180046961
mov eax, dword [r10]
mov r9, rbp
add rax, rbx
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1800468f3
inc rax
test ecx, ecx
jne 0x1800468e0
test edx, edx
je 0x180046905
inc r8d
add r10, 4
cmp r8d, edi
jb 0x1800468d1
jmp 0x180046961
movzx ecx, word [r15 + r8*2]
mov rax, qword [rsp + 0x68]
mov edx, dword [r14 + rcx*4]
mov rcx, qword [r13 + 0x208]
mov qword [rax], rdx
add rcx, rdx
mov rax, qword [rsp + 0x60]
mov qword [rax], rcx
jmp 0x180046961
mov ecx, dword [rax + 0x14]
test ecx, ecx
je 0x180046961
mov edx, dword [rax + 0x10]
lea eax, [rdx + r8]
cmp edi, eax
je 0x180046946
inc r8d
cmp r8d, ecx
jb 0x180046934
jmp 0x180046961
mov rax, qword [rsp + 0x68]
mov edx, dword [r14 + r8*4]
mov qword [rax], rdx
mov rax, qword [rsp + 0x60]
add rdx, qword [r13 + 0x208]
mov qword [rax], rdx
mov rcx, r11
call fcn.180049e70
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rcx, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
jmp fcn.180049e70
Function at 0x1800479b0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r9, rdx
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
mov rdx, qword [0x180096ea0]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
shl rdx, 4
add rdx, qword [0x180096e88]
mov rax, qword [rdx]
cmp rax, qword [0x180096e78]
jne 0x180047a43
xor eax, eax
ret
mov r9, qword [r9]
mov rdx, qword [rdx + 8]
cmp qword [rax + 0x10], r9
je 0x180047a5e
cmp rax, rdx
je 0x180047a40
mov rax, qword [rax]
cmp qword [rax + 0x10], r9
jne 0x180047a50
mov rcx, qword [rax]
mov r8d, 1
cmp rax, rdx
je 0x180047a84
nop dword [rax]
mov rax, rcx
cmp r9, qword [rcx + 0x10]
jne 0x180047a84
mov rcx, qword [rcx]
inc r8
cmp rax, rdx
jne 0x180047a70
mov rax, r8
ret

Function at 0x180047a90
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
movzx eax, byte [r8 + 1]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [0x180096ea0]
imul r9, rcx
xor r9, rax
imul r9, rcx
and r8, r9
mov r9, qword [0x180096e78]
shl r8, 4
add r8, qword [0x180096e88]
mov rax, qword [r8]
cmp rax, r9
jne 0x180047b31
mov qword [rdx], r9
mov rax, rdx
ret
mov rcx, qword [r10]
mov r8, qword [r8 + 8]
cmp qword [rax + 0x10], rcx
je 0x180047b4e
nop
cmp rax, r8
je 0x180047b2a
mov rax, qword [rax]
cmp qword [rax + 0x10], rcx
jne 0x180047b40
mov qword [rdx], rax
mov rax, rdx
ret
Function at 0x180048040
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
movabs rax, 0x7ffffffffffffff
cmp qword [0x180096e80], rax
je 0x1800482da
lea rax, [0x180096e78]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.18004a114
mov rsi, rax
mov qword [rsp + 0x28], rax
mov rdx, qword [rbx]
mov qword [rax + 0x10], rdx
mov rcx, qword [rbx + 8]
mov qword [rax + 0x18], rcx
movzx edi, dl
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs r8, 0x100000001b3
imul rdi, r8
mov rax, rdx
shr rax, 8
movzx ecx, al
xor rdi, rcx
imul rdi, r8
mov rax, rdx
shr rax, 0x10
movzx ecx, al
xor rdi, rcx
imul rdi, r8
mov rax, rdx
shr rax, 0x18
movzx ecx, al
xor rdi, rcx
imul rdi, r8
mov rax, rdx
shr rax, 0x20
movzx ecx, al
xor rdi, rcx
imul rdi, r8
mov rax, rdx
shr rax, 0x28
movzx ecx, al
xor rdi, rcx
imul rdi, r8
mov rax, rdx
shr rax, 0x30
movzx ecx, al
xor rdi, rcx
imul rdi, r8
shr rdx, 0x38
xor rdi, rdx
imul rdi, r8
mov r9, qword [0x180096e80]
lea rcx, [r9 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x180048151
cvtsi2ss xmm0, rcx
jmp 0x180048166
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [0x180096ea8]
xorps xmm2, xmm2
test rbx, rbx
js 0x18004817c
cvtsi2ss xmm2, rbx
jmp 0x180048194
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
movss xmm3, dword [0x180096e70]
comiss xmm1, xmm3
seta al
test al, al
je 0x18004821c
divss xmm0, xmm3
call fcn.18005f578
xor ecx, ecx
movss xmm1, dword [0x18006e228]
comiss xmm0, xmm1
jb 0x1800481db
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800481db
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18004820d
cmp rbx, 0x200
jae 0x18004820a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18004820d
mov rbx, rcx
mov rdx, rbx
call fcn.180048310
mov r9, qword [0x180096e80]
mov rdx, rdi
and rdx, qword [0x180096ea0]
add rdx, rdx
mov r8, qword [0x180096e88]
mov rax, qword [r8 + rdx*8 + 8]
mov rcx, qword [0x180096e78]
cmp rax, rcx
je 0x180048262
mov r8, qword [r8 + rdx*8]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rax + 0x10]
je 0x18004825f
nop
cmp rax, r8
je 0x1800482a2
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x180048250
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
inc r9
mov qword [0x180096e80], r9
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
mov qword [rdx], rsi
mov qword [rcx + 8], rsi
mov rax, qword [0x180096e88]
and rdi, qword [0x180096ea0]
add rdi, rdi
mov r8, qword [rax + rdi*8]
cmp r8, qword [0x180096e78]
jne 0x1800482a7
mov qword [rax + rdi*8], rsi
jmp 0x1800482b9
mov rcx, rax
jmp 0x180048262
cmp r8, rcx
jne 0x1800482b2
mov qword [rax + rdi*8], rsi
jmp 0x1800482be
cmp qword [rax + rdi*8 + 8], rdx
jne 0x1800482be
mov qword [rax + rdi*8 + 8], rsi
mov qword [r14], rsi
mov rax, r14
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
lea rcx, str.unordered_map_set_too_long
call fcn.180049a78
int3