joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008e450
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14008e519
cmp byte [rcx + 0x71], 0
je 0x14008e519
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14008e50c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14008e4c8
sub eax, 1
je 0x14008e4cc
cmp eax, 2
jne 0x14008e50c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x14008e4fa
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14008e50c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140092810
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, 8
call fcn.14011191c
lea rcx, [0x1400775c0]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400a4b60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140092876
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140092aa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.1401122e0
sub rsp, rax
mov ebx, edx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov r8d, eax
mov ecx, 1
mov qword [rsp + 0x38], r8
movabs rdx, 0x5851f42d4c957f2d
movabs rax, 0x5555555555555555
mov qword [rsp + 0x13b8], rax
mov rax, r8
shr rax, 0x3e
xor r8, rax
imul r8, rdx
add r8, rcx
mov qword [rsp + rcx*8 + 0x38], r8
inc rcx
cmp rcx, 0x138
jb 0x140092ae0
mov dword [rsp + 0x30], 0x138
cmp ebx, 0x80000000
jb 0x140092b2a
cmp ebx, 0xffffffff
jne 0x140092b2a
lea rcx, [rsp + 0x30]
call fcn.1400a4840
add rsp, 0x13c0
pop rbx
ret
lea rcx, [rsp + 0x30]
inc ebx
call fcn.1400a4840
mov rcx, rax
mov eax, ebx
mul rcx
mov r8, rdx
mov rcx, rax
cmp rax, rbx
jae 0x140092b86
xor edx, edx
mov qword [rsp + 0x13d0], rdi
mov eax, ebx
neg rax
div rbx
mov rdi, rdx
cmp rcx, rdx
jae 0x140092b7e
lea rcx, [rsp + 0x30]
call fcn.1400a4840
mov rcx, rax
mov rax, rbx
mul rcx
mov r8, rdx
cmp rax, rdi
jb 0x140092b63
mov rdi, qword [rsp + 0x13d0]
mov ecx, 0x40
mov rax, r8
and ecx, 0x3f
shr rax, cl
add rsp, 0x13c0
pop rbx
ret
Function at 0x140093fd0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx eax, byte [r8]
mov r15d, eax
movabs rcx, 0xcbf29ce484222325
xor r15, rcx
movabs rcx, 0x100000001b3
imul r15, rcx
mov rcx, qword [0x14022cae0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x14022cac8]
mov rbx, qword [rdx + rcx*8 + 8]
mov r14, qword [0x14022cab8]
cmp rbx, r14
jne 0x140094043
mov rbx, r14
mov rbp, r14
jmp 0x14009408d
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x14009405e
nop dword [rax]
cmp rbx, rcx
je 0x140094087
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x140094050
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [0x14022cac0], rax
jne 0x1400940ae
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14022cab8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.14011191c
mov rdi, rax
mov qword [rsp + 0x28], rax
movzx ecx, byte [r12]
mov byte [rax + 0x10], cl
xor eax, eax
mov dword [rdi + 0x11], eax
mov r8, qword [0x14022cac0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1400940fc
cvtsi2ss xmm0, rcx
jmp 0x140094111
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14022cae8]
xorps xmm1, xmm1
test rcx, rcx
js 0x140094127
cvtsi2ss xmm1, rcx
jmp 0x14009413c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14022cab0]
seta al
test al, al
je 0x1400941b8
call fcn.140096e50
mov rdx, qword [0x14022cae0]
and rdx, r15
add rdx, rdx
mov rcx, qword [0x14022cac8]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [0x14022cab8]
cmp rax, rbx
jne 0x140094183
mov qword [rsp + 0x28], 0
jmp 0x1400941a4
mov rdx, qword [rcx + rdx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x1400941a1
mov rbx, rax
cmp rax, rdx
je 0x1400941fb
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x140094190
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r8, qword [0x14022cac0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x14022cac0], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x14022cac8]
mov rax, qword [0x14022cae0]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x14022cab8]
jne 0x14009420b
mov qword [rcx + rax*8], rdi
jmp 0x14009421d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x1400941a9
cmp r8, rbp
jne 0x140094216
mov qword [rcx + rax*8], rdi
jmp 0x140094222
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140094222
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x140094065
Function at 0x140096e50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14022cac0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x14022cae8]
js 0x140096e74
cvtsi2ss xmm0, rcx
jmp 0x140096e89
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x14022cab0]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140175f38]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140096ebb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140096ebb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140096eed
cmp rbx, 0x200
jae 0x140096eea
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140096eed
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140097e50
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140097e81
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14022cab8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14022cac8]
lea rdx, [rdi + rdi]
call fcn.14008f520
mov rax, qword [0x14022cab8]
lea rdx, [rdi - 1]
mov qword [0x14022cae0], rdx
mov qword [0x14022cae8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140097fd2
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x14022cac8]
mov r8, qword [r11]
cmp r8, rbx
jne 0x140097f22
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140097f93
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x140097f5b
mov r10, qword [rdx]
cmp r10, rax
je 0x140097f55
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140097f93
cmp r8, rdx
je 0x140097f6f
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x140097fa7
cmp r8, rdx
jne 0x140097f60
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140097fcd
mov rdx, qword [0x14022cae0]
jmp 0x140097ef1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140097f93
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140097e50
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14022cac0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x14022cae8]
js 0x140096e74
cvtsi2ss xmm0, rcx
jmp 0x140096e89
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x14022cab0]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140175f38]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140096ebb
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140096ebb
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140096eed
cmp rbx, 0x200
jae 0x140096eea
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140096eed
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140097e50
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140097e81
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14022cab8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14022cac8]
lea rdx, [rdi + rdi]
call fcn.14008f520
mov rax, qword [0x14022cab8]
lea rdx, [rdi - 1]
mov qword [0x14022cae0], rdx
mov qword [0x14022cae8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140097fd2
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x14022cac8]
mov r8, qword [r11]
cmp r8, rbx
jne 0x140097f22
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140097f93
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x140097f5b
mov r10, qword [rdx]
cmp r10, rax
je 0x140097f55
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140097f93
cmp r8, rdx
je 0x140097f6f
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x140097fa7
cmp r8, rdx
jne 0x140097f60
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140097fcd
mov rdx, qword [0x14022cae0]
jmp 0x140097ef1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140097f93
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14009c350
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx eax, byte [r8]
mov r15d, eax
movabs rcx, 0xcbf29ce484222325
xor r15, rcx
movabs rcx, 0x100000001b3
imul r15, rcx
mov rcx, qword [0x14022cae0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x14022cac8]
mov rbx, qword [rdx + rcx*8 + 8]
mov r14, qword [0x14022cab8]
cmp rbx, r14
jne 0x14009c3c3
mov rbx, r14
mov rbp, r14
jmp 0x14009c40d
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x14009c3de
nop dword [rax]
cmp rbx, rcx
je 0x14009c407
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x14009c3d0
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [0x14022cac0], rax
jne 0x14009c42e
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x14022cab8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.14011191c
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r12]
mov dword [rax + 0x10], ecx
movzx ecx, byte [r12 + 4]
mov byte [rax + 0x14], cl
mov r8, qword [0x14022cac0]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14009c47f
cvtsi2ss xmm0, rcx
jmp 0x14009c494
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x14022cae8]
xorps xmm1, xmm1
test rcx, rcx
js 0x14009c4aa
cvtsi2ss xmm1, rcx
jmp 0x14009c4bf
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14022cab0]
seta al
test al, al
je 0x14009c53b
call fcn.140096e50
mov rdx, qword [0x14022cae0]
and rdx, r15
add rdx, rdx
mov rcx, qword [0x14022cac8]
mov rax, qword [rcx + rdx*8 + 8]
mov rbx, qword [0x14022cab8]
cmp rax, rbx
jne 0x14009c506
mov qword [rsp + 0x28], 0
jmp 0x14009c527
mov rdx, qword [rcx + rdx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x14009c524
mov rbx, rax
cmp rax, rdx
je 0x14009c57e
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x14009c513
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r8, qword [0x14022cac0]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x14022cac0], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x14022cac8]
mov rax, qword [0x14022cae0]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x14022cab8]
jne 0x14009c58e
mov qword [rcx + rax*8], rdi
jmp 0x14009c5a0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x14009c52c
cmp r8, rbp
jne 0x14009c599
mov qword [rcx + rax*8], rdi
jmp 0x14009c5a5
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14009c5a5
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x14009c3e5
Function at 0x1400a4520
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400a4551
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14022ca78]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14022ca88]
lea rdx, [rdi + rdi]
call fcn.14008f520
mov rax, qword [0x14022ca78]
lea rdx, [rdi - 1]
mov qword [0x14022caa0], rdx
mov qword [0x14022caa8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400a46a2
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x14022ca88]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400a45f2
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400a4663
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1400a462b
mov r10, qword [rdx]
cmp r10, rax
je 0x1400a4625
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400a4663
cmp r8, rdx
je 0x1400a463f
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1400a4677
cmp r8, rdx
jne 0x1400a4630
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1400a469d
mov rdx, qword [0x14022caa0]
jmp 0x1400a45c1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400a4663
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a46b0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1400a46e1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14022c748]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14022c758]
lea rdx, [rdi + rdi]
call fcn.14008f520
mov rax, qword [0x14022c748]
lea rdx, [rdi - 1]
mov qword [0x14022c770], rdx
mov qword [0x14022c778], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400a4832
mov qword [rsp + 0x38], rsi
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rsi
and r11, rdx
shl r11, 4
add r11, qword [0x14022c758]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400a4782
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400a47f3
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1400a47bb
mov r10, qword [rdx]
cmp r10, rax
je 0x1400a47b5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400a47f3
cmp r8, rdx
je 0x1400a47cf
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1400a4807
cmp r8, rdx
jne 0x1400a47c0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1400a482d
mov rdx, qword [0x14022c770]
jmp 0x1400a4751
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400a47f3
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a4840
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400a48a7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400a4862
mov ecx, dword [r10]
jmp 0x1400a49b6
cmp ecx, 0x270
jb 0x1400a49b6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1400a48e0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1400a4931
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret