joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4691e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x46921f
jb 0x469234
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret

Function at 0x4692a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4692df
jb 0x4692f4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x469360
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x469430
jb 0x46948f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.00469180
aeskeygenassist xmm1, xmm0, 1
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 2
call fcn.00469180
aeskeygenassist xmm1, xmm0, 2
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 4
call fcn.00469180
aeskeygenassist xmm1, xmm0, 4
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 8
call fcn.00469180
aeskeygenassist xmm1, xmm0, 8
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00469180
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00469180
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004691a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00469180
jmp 0x4694fd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004690e0
aeskeygenassist xmm1, xmm2, 2
call fcn.00469140
aeskeygenassist xmm1, xmm2, 4
call fcn.004690e0
aeskeygenassist xmm1, xmm2, 8
call fcn.00469140
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004690e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.00469140
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004690e0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.00469140
jmp 0x4694fd
aeskeygenassist xmm1, xmm0, 1
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004690a0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004690a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x46950a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x14000f400
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp rdx, r8
je 0x14000f653
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rdi, r8
mov rbx, rdx
mov r13, rcx
lea r12, [rcx + 8]
movabs r15, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
mov rsi, qword [rbx + 0x20]
lea rcx, [rbx + 0x10]
call fcn.140003d90
xor edx, edx
add rsi, rsi
je 0x14000f473
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor rbp, rcx
imul rbp, r15
inc rdx
cmp rdx, rsi
jb 0x14000f460
mov rax, qword [r13 + 0x30]
and rax, rbp
add rax, rax
mov rcx, qword [r13 + 0x18]
mov rsi, qword [rcx + rax*8 + 8]
mov r15, qword [r12]
cmp rsi, r15
je 0x14000f4ca
mov r15, qword [rcx + rax*8]
lea rdx, [rsi + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14000ff10
test al, al
jne 0x14000f62a
cmp rsi, r15
je 0x14000f4c7
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
lea rcx, [rbx + 0x10]
call fcn.14000ff10
test al, al
je 0x14000f4a8
jmp 0x14000f62a
mov r15, rsi
mov rsi, qword [r13 + 0x10]
movabs rax, 0x38e38e38e38e38e
mov qword [rsp + 0x20], rax
call fcn.140001780
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140003610
cmp rsi, qword [rax]
je 0x14000f664
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0
mov ecx, 0x48
call fcn.140005c30
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rax
lea r12, [rax + 0x10]
mov rdx, r12
mov ecx, 0x38
call fcn.1400011d0
lea rdx, [rbx + 0x10]
mov rcx, rax
call fcn.14000ff80
nop
mov rcx, qword [r13 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14000f553
cvtsi2ss xmm0, rcx
jmp 0x14000f568
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r13 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000f57b
cvtsi2ss xmm1, rcx
jmp 0x14000f590
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r13]
seta al
test al, al
je 0x14000f609
mov rcx, r13
call fcn.14000f930
mov r14, qword [r13 + 0x30]
and r14, rbp
add r14, r14
mov rcx, qword [r13 + 0x18]
mov rsi, qword [rcx + r14*8 + 8]
mov rax, qword [r13 + 8]
cmp rsi, rax
jne 0x14000f5cf
mov qword [rsp + 0x38], 0
jmp 0x14000f5ff
mov r14, qword [rcx + r14*8]
lea rdx, [rsi + 0x10]
mov rcx, r12
call fcn.14000ff10
test al, al
jne 0x14000f5fc
cmp rsi, r14
je 0x14000f654
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
mov rcx, r12
call fcn.14000ff10
test al, al
je 0x14000f5e3
mov rax, qword [rsi]
mov qword [rsp + 0x30], rax
mov r15, qword [rsp + 0x30]
mov qword [rsp + 0x50], 0
mov r9, qword [rsp + 0x20]
mov r8, r15
mov rdx, rbp
mov rcx, r13
call fcn.14000f9f0
nop
lea r12, [r13 + 8]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000f432
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], 0
jmp 0x14000f604
lea rcx, str.unordered_map_set_too_long
call fcn.14003c7d8
int3
Function at 0x14000fb30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x50
movabs rax, 0x1fffffffffffffff
mov rdi, rdx
mov qword [rsp + 0x20], rax
mov r12, rcx
call fcn.140001780
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140003610
mov ebx, 1
mov rdx, qword [rax]
mov eax, ebx
or rdx, 2
shr rdx, 1
bsr rcx, rdx
shl rax, cl
cmp rdi, rax
ja 0x14000fd57
mov qword [rsp + 0x80], rbp
lea rax, [rdi - 1]
mov rbp, qword [r12 + 8]
or rax, rbx
bsr rcx, rax
mov qword [rsp + 0x48], rsi
mov r8, rbp
inc ecx
mov qword [rsp + 0x38], r14
shl rbx, cl
lea r14, [r12 + 0x18]
mov rcx, r14
lea rdx, [rbx + rbx]
call fcn.14000ef30
mov qword [r12 + 0x38], rbx
lea rax, [rbx - 1]
mov qword [r12 + 0x30], rax
mov rdi, qword [r12 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x14000fd16
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x30], r15
movabs r15, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi + 0x20]
call fcn.140003d90
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
add rbx, rbx
je 0x14000fc34
movzx edx, byte [rax + rcx]
inc rcx
xor r8, rdx
imul r8, r15
cmp rcx, rbx
jb 0x14000fc21
mov rcx, qword [r12 + 0x30]
mov r14, qword [r14]
and rcx, r8
shl rcx, 4
add r14, rcx
cmp qword [r14], rbp
jne 0x14000fc57
mov qword [r14], rdi
mov qword [r14 + 8], rdi
jmp 0x14000fcfb
mov rbx, qword [r14 + 8]
lea rcx, [rdi + 0x10]
lea rdx, [rbx + 0x10]
call fcn.14000ff10
test al, al
je 0x14000fc9b
mov r8, qword [rbx]
cmp r8, rdi
je 0x14000fc95
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r14 + 8], rdi
jmp 0x14000fcfb
mov r15, rbx
cmp qword [r14], rbx
je 0x14000fccd
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbx + 8]
lea rcx, [rdi + 0x10]
mov r15, rbx
lea rdx, [rbx + 0x10]
call fcn.14000ff10
test al, al
jne 0x14000fd31
cmp qword [r14], rbx
jne 0x14000fcb0
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r15
mov rax, qword [r15 + 8]
mov qword [rax], rdi
mov qword [r15 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r14], rdi
movabs r15, 0x100000001b3
lea r14, [r12 + 0x18]
mov rdi, rsi
cmp rsi, rbp
jne 0x14000fc00
mov r15, qword [rsp + 0x30]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
mov r14, qword [rsp + 0x38]
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov r8, qword [rbx]
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
jmp 0x14000fcf1
lea rcx, str.invalid_hash_bucket_count
call fcn.14003c7d8
int3
Function at 0x1400132b0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14008d030]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.140041270
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x14001339e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14001339e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x14001339e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x14001339e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14001339e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x1400133a0
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14003ecb0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret

Function at 0x140013cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, qword [rdx + 0x10]
mov rdi, rcx
mov rcx, rdx
mov rsi, rdx
call fcn.140003d90
xor r14d, r14d
movabs r9, 0xcbf29ce484222325
mov r8d, r14d
add rbx, rbx
je 0x140013d54
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rax + r8]
inc r8
xor r9, rcx
imul r9, rdx
cmp r8, rbx
jb 0x140013d40
movsxd rcx, dword [rsi + 0x20]
mov rax, qword [rdi + 0x18]
xor rcx, r9
and rcx, qword [rdi + 0x30]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [rdi + 8]
jne 0x140013d76
mov rbx, r14
jmp 0x140013dab
mov qword [rsp + 0x30], rbp
mov rbp, qword [rax + rcx*8]
nop
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.14000ff10
test al, al
je 0x140013d98
mov eax, dword [rbx + 0x30]
cmp dword [rsi + 0x20], eax
je 0x140013da6
cmp rbx, rbp
je 0x140013da3
mov rbx, qword [rbx + 8]
jmp 0x140013d80
mov rbx, r14
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
setne r14b
mov rax, r14
add rsp, 0x20
pop r14
ret
Function at 0x140013dd0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r12
push r15
sub rsp, 0x20
mov rbx, qword [rdx + 0x10]
mov r15, rcx
mov rcx, rdx
mov qword [rsp + 0x40], rbp
mov rbp, rdx
call fcn.140003d90
xor edi, edi
movabs r9, 0xcbf29ce484222325
mov r8d, edi
add rbx, rbx
je 0x140013e34
movabs rdx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rax + r8]
inc r8
xor r9, rcx
imul r9, rdx
cmp r8, rbx
jb 0x140013e20
movsxd r12, dword [rbp + 0x20]
mov rcx, qword [r15 + 0x30]
xor r12, r9
mov rax, qword [r15 + 0x18]
and rcx, r12
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r15 + 8]
je 0x140013e92
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
mov r14, qword [rax + rcx*8]
lea rdx, [rbx + 0x10]
mov rcx, rbp
call fcn.14000ff10
test al, al
je 0x140013e7a
mov eax, dword [rbx + 0x30]
cmp dword [rbp + 0x20], eax
je 0x140013e85
cmp rbx, r14
je 0x140013e88
mov rbx, qword [rbx + 8]
jmp 0x140013e62
mov rdi, rbx
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
test rdi, rdi
je 0x140013f28
mov rdx, qword [r15 + 0x30]
and rdx, r12
shl rdx, 4
add rdx, qword [r15 + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x140013ed4
cmp rax, rdi
jne 0x140013eca
mov rax, qword [r15 + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140013edf
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x140013edf
cmp rax, rdi
jne 0x140013edf
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
lea rcx, [rdi + 0x38]
dec qword [r15 + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
call fcn.140006320
lea rcx, [rdi + 0x10]
call fcn.140003de0
mov edx, 0x48
mov rcx, rdi
call fcn.140005ea0
mov eax, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
mov rbx, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x140014480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov r15, rcx
mov rbx, qword [r8 + 0x10]
mov rcx, r8
call fcn.140003d90
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
add rbx, rbx
je 0x1400144e4
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [rax + r10]
xor r9, rcx
imul r9, rdx
inc r10
cmp r10, rbx
jb 0x1400144d0
movsxd r12, dword [rsi + 0x20]
xor r12, r9
mov rax, qword [r15 + 0x30]
and rax, r12
add rax, rax
mov rbp, qword [r15 + 0x18]
mov rbx, qword [rbp + rax*8 + 8]
lea r13, [r15 + 8]
mov rdi, qword [r13]
cmp rbx, rdi
je 0x140014543
mov rbp, qword [rbp + rax*8]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.14000ff10
test al, al
je 0x140014528
mov eax, dword [rbx + 0x30]
cmp dword [rsi + 0x20], eax
je 0x140014533
cmp rbx, rbp
je 0x140014540
mov rbx, qword [rbx + 8]
jmp 0x140014510
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1400146bb
mov rdi, rbx
mov rbx, qword [r15 + 0x10]
movabs rax, 0x38e38e38e38e38e
mov qword [rsp + 0x70], rax
call fcn.140001780
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x80]
call fcn.140003610
cmp rbx, qword [rax]
je 0x1400146d3
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], 0
mov ecx, 0x48
call fcn.140005c30
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], rax
lea rbp, [rax + 0x10]
mov rdx, rbp
mov ecx, 0x38
call fcn.1400011d0
mov rbx, rax
mov rdx, rsi
mov rcx, rax
call fcn.14000e470
mov ecx, dword [rsi + 0x20]
mov dword [rbx + 0x20], ecx
xor eax, eax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov rcx, qword [r15 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400145e3
cvtsi2ss xmm0, rcx
jmp 0x1400145f8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r15 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14001460b
cvtsi2ss xmm1, rcx
jmp 0x140014620
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r15]
seta al
test al, al
je 0x1400146a0
mov rcx, r15
call fcn.140014730
mov rax, r12
and rax, qword [r15 + 0x30]
add rax, rax
mov rsi, qword [r15 + 0x18]
mov rbx, qword [rsi + rax*8 + 8]
mov rcx, qword [r13]
cmp rbx, rcx
jne 0x14001465a
mov qword [rsp + 0x20], rcx
jmp 0x140014692
mov rsi, qword [rsi + rax*8]
nop
lea rdx, [rbx + 0x10]
mov rcx, rbp
call fcn.14000ff10
test al, al
je 0x140014678
mov eax, dword [rbx + 0x30]
cmp dword [rbp + 0x20], eax
je 0x140014683
cmp rbx, rsi
je 0x14001468d
mov rbx, qword [rbx + 8]
jmp 0x140014660
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
jmp 0x14001469b
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
mov rdi, qword [rsp + 0x20]
mov r9, qword [rsp + 0x70]
mov r8, rdi
mov rdx, r12
mov rcx, r15
call fcn.14000f9f0
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14003c7d8
int3
Function at 0x1400147f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x60
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], rax
mov rdi, rdx
mov r14, rcx
call fcn.140001780
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.140003610
mov ebx, 1
mov rdx, qword [rax]
mov eax, ebx
or rdx, 2
shr rdx, 1
bsr rcx, rdx
shl rax, cl
cmp rdi, rax
ja 0x140014a26
mov qword [rsp + 0x90], rbp
lea rax, [rdi - 1]
mov rbp, qword [r14 + 8]
or rax, rbx
bsr rcx, rax
mov qword [rsp + 0x58], rsi
mov r8, rbp
inc ecx
mov qword [rsp + 0x40], r15
shl rbx, cl
lea r15, [r14 + 0x18]
mov rcx, r15
mov qword [rsp + 0x20], r15
lea rdx, [rbx + rbx]
call fcn.14000ef30
mov qword [r14 + 0x38], rbx
lea rax, [rbx - 1]
mov qword [r14 + 0x30], rax
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x1400149e5
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
nop
mov rsi, qword [rsi]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi + 0x20]
call fcn.140003d90
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
add rbx, rbx
je 0x1400148f4
movzx edx, byte [rax + rcx]
inc rcx
xor r8, rdx
imul r8, r12
cmp rcx, rbx
jb 0x1400148e1
movsxd rcx, dword [rdi + 0x30]
xor rcx, r8
and rcx, qword [r14 + 0x30]
mov r14, qword [r15]
shl rcx, 4
add r14, rcx
cmp qword [r14], rbp
jne 0x14001491a
mov qword [r14], rdi
mov qword [r14 + 8], rdi
jmp 0x1400149ca
mov rbx, qword [r14 + 8]
lea rcx, [rdi + 0x10]
lea rdx, [rbx + 0x10]
call fcn.14000ff10
test al, al
je 0x140014966
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x140014966
mov r8, qword [rbx]
cmp r8, rdi
je 0x140014960
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r14 + 8], rdi
jmp 0x1400149c5
mov r12, rbx
cmp qword [r14], rbx
je 0x140014995
nop
mov rbx, qword [rbx + 8]
lea rcx, [rdi + 0x10]
mov r12, rbx
lea rdx, [rbx + 0x10]
call fcn.14000ff10
test al, al
je 0x140014990
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
je 0x140014a00
cmp qword [r14], rbx
jne 0x140014970
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r12
mov rax, qword [r12 + 8]
mov qword [rax], rdi
mov qword [r12 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r14], rdi
movabs r12, 0x100000001b3
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x30]
mov rdi, rsi
cmp rsi, rbp
jne 0x1400148c0
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
add rsp, 0x60
pop r14
pop rdi
pop rbx
ret
mov r8, qword [rbx]
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rdi
mov qword [r8 + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
jmp 0x1400149bb
lea rcx, str.invalid_hash_bucket_count
call fcn.14003c7d8
int3
Function at 0x140016430
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx ebx, dl
test rcx, rcx
je 0x14001645c
jle 0x140016458
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rdi + 0x10], rsi
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140016471
jle 0x14001646d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 8], rsi
mov rcx, qword [rdi]
test rcx, rcx
je 0x140016484
jle 0x140016481
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rsi
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140016499
jle 0x140016495
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x20], rsi
mov qword [rdi + 0x28], rsi
test bl, bl
jne 0x14001650f
lea rcx, [rdi + 0xf8]
mov word [rsp + 0x38], si
call fcn.140004700
lea rdx, [rsp + 0x38]
mov qword [rdi + 0x108], rsi
mov rcx, rax
call fcn.140004ea0
cmp byte [rdi + 0x1c], sil
je 0x1400164ea
add rdi, 0x118
mov rcx, rdi
call fcn.140003d90
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400164f1
add rdi, 0x118
mov rcx, rdi
mov word [rsp + 0x38], si
call fcn.140004700
lea rdx, [rsp + 0x38]
mov qword [rdi + 0x10], rsi
mov rcx, rax
call fcn.140004ea0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret