joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140086910
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rdi
sub rsp, 0x28
lea rcx, str.Dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x1400869f4
mov rsi, rax
lea rdx, str.MiniDumpWriteDump
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov qword [0x1402b9888], rax
lea rdx, str.StackWalk64
mov rcx, rsi
call rdi
mov qword [0x1402b9890], rax
lea rdx, str.SymGetModuleBase64
mov rcx, rsi
call rdi
mov qword [0x1402b9898], rax
lea rdx, str.SymGetSymFromAddr64
mov rcx, rsi
call rdi
mov qword [0x1402b98a0], rax
lea rdx, str.SymGetLineFromAddr64
mov rcx, rsi
call rdi
mov qword [0x1402b98a8], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, rsi
call rdi
mov qword [0x1402b98b0], rax
lea rdx, str.SymFunctionTableAccess64
mov rcx, rsi
call rdi
mov qword [0x1402b98b8], rax
lea rdx, str.SymSetOptions
mov rcx, rsi
call rdi
mov qword [0x1402b98c0], rax
lea rdx, str.SymInitialize
mov rcx, rsi
call rdi
mov qword [0x1402b98c8], rax
lea rdx, str.EnumerateLoadedModules64
mov rcx, rsi
call rdi
mov qword [0x1402b9870], rax
movq xmm0, qword [0x1402b9890]
movq xmm1, qword [0x1402b98c8]
punpcklqdq xmm1, xmm0
movq xmm0, qword [0x1402b9888]
movq xmm2, qword [0x1402b98c0]
punpcklqdq xmm2, xmm0
pxor xmm0, xmm0
pcmpeqd xmm2, xmm0
pshufd xmm3, xmm2, 0xb1
pand xmm3, xmm2
pcmpeqd xmm1, xmm0
pshufd xmm0, xmm1, 0xb1
pand xmm0, xmm1
packssdw xmm0, xmm3
movmskps eax, xmm0
test eax, eax
je 0x140086a4c
add rsp, 0x28
pop rdi
pop rsi
ret
cmp byte [0x1402b9878], 1
jne 0x140086a69
lea rcx, [0x1402b9768]
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [0x1402ba0d8], 0
jne 0x140086a86
lea rcx, [0x1402b9768]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [0x1402ba0d8], 1
lea rcx, [0x1402b9768]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x1402b9878], 1
lea rcx, [0x140087530]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [0x1402b9880], rax
lea rcx, [0x140088310]
mov edx, 1
add rsp, 0x28
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
Function at 0x140088530
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
mov rax, qword [0x14027c048]
xor rax, rsp
mov qword [rsp + 0x490], rax
test rcx, rcx
je 0x1400885f2
mov rsi, rdx
mov r14, rcx
mov dword [rsp + 0x4c], 0
lea r15, [rsp + 0x4c]
mov qword [rsp + 0x30], r15
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea r8, str.DumpFolder
xor ebx, ebx
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140088660
mov ebx, dword [rsp + 0x4c]
lea rdi, [rsp + 0x288]
mov qword [rsp + 0x270], rdi
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x280], 0x104
cmp rbx, 0x105
jb 0x1400885f6
lea rcx, [rsp + 0x270]
mov r9d, 2
mov rdx, rdi
mov r8, rbx
call fcn.1400218c0
mov rcx, qword [rsp + 0x270]
jmp 0x140088601
xor ebx, ebx
jmp 0x140088660
mov rcx, rdi
mov rax, rdi
test rbx, rbx
je 0x140088614
lea r8, [rbx + rbx]
xor edx, edx
call fcn.1401a77d0
mov rax, qword [rsp + 0x270]
mov qword [rsp + 0x278], rbx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r8, str.DumpFolder
xor ebx, ebx
mov rcx, r14
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140088683
mov rcx, qword [rsp + 0x270]
cmp rcx, rdi
je 0x140088660
call qword [0x140276c98]
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401a5de0
mov eax, ebx
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x270]
xor ebx, ebx
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14008864d
mov r15d, eax
mov r12d, eax
lea r14, [rsp + 0x68]
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0x104
mov rcx, r14
cmp eax, 0x105
jb 0x1400886e3
lea rcx, [rsp + 0x50]
mov r9d, 2
mov rdx, r14
mov r8, r12
call fcn.1400218c0
mov rcx, qword [rsp + 0x50]
lea r8, [r12 + r12]
xor ebx, ebx
xor edx, edx
call fcn.1401a77d0
mov qword [rsp + 0x58], r12
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x270]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp r15d, eax
jne 0x140088730
dec r15d
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
mov r8, r15
mov r9, rsi
call fcn.14007cad0
cmp dword [rsp + 0x38], 0
sete bl
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x14008864d
call qword [0x140276c98]
jmp 0x14008864d
Function at 0x140097250
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov edx, dword [rcx + 8]
cmp rdx, 0x40
ja 0x140097283
mov r8, qword [rax]
not r8
mov ecx, edx
neg cl
mov r9, 0xffffffffffffffff
shr r9, cl
test rdx, rdx
je 0x1400972ed
and r9, r8
mov qword [rax], r9
inc qword [rax]
jmp 0x14009737f
mov r9d, edx
add rdx, 0x3f
mov rcx, rdx
shr rcx, 6
mov r8, qword [rax]
cmp r9d, 0xc1
jae 0x1400972a2
xor r9d, r9d
jmp 0x1400972f2
mov r9d, ecx
and r9d, 0xfffffffc
shr rdx, 3
and edx, 0xffffffe0
xor r10d, r10d
pcmpeqd xmm0, xmm0
nop word [rax + rax]
movdqu xmm1, xmmword [r8 + r10]
movdqu xmm2, xmmword [r8 + r10 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [r8 + r10], xmm1
movdqu xmmword [r8 + r10 + 0x10], xmm2
add r10, 0x20
cmp rdx, r10
jne 0x1400972c0
jmp 0x1400972f9
xor r9d, r9d
jmp 0x140097275
not qword [r8 + r9*8]
inc r9
cmp rcx, r9
jne 0x1400972f2
mov edx, dword [rax + 8]
mov ecx, edx
neg cl
mov r8, 0xffffffffffffffff
shr r8, cl
test rdx, rdx
je 0x1400973c1
cmp edx, 0x41
jae 0x140097322
mov rdx, rax
jmp 0x140097338
add rdx, 0x3f
shr rdx, 6
mov ecx, 0xffffffff
add edx, ecx
shl rdx, 3
add rdx, qword [rax]
and qword [rdx], r8
mov ecx, dword [rax + 8]
cmp rcx, 0x40
ja 0x140097349
inc qword [rax]
jmp 0x14009737f
mov rdx, qword [rax]
inc qword [rdx]
jne 0x14009737f
inc qword [rdx + 8]
jne 0x14009737f
add rcx, 0x3f
shr rcx, 6
mov r8d, 2
nop word cs:[rax + rax]
cmp rcx, r8
je 0x14009737f
inc qword [rdx + r8*8]
lea r8, [r8 + 1]
je 0x140097370
mov r8d, dword [rax + 8]
mov ecx, r8d
neg cl
mov rdx, 0xffffffffffffffff
shr rdx, cl
test r8, r8
je 0x1400973bb
cmp r8d, 0x41
jb 0x1400973b7
add r8, 0x3f
shr r8, 6
mov ecx, 0xffffffff
add r8d, ecx
shl r8, 3
add r8, qword [rax]
mov rax, r8
and qword [rax], rdx
ret
xor edx, edx
and qword [rax], rdx
ret
xor r8d, r8d
mov rdx, rax
jmp 0x140097338
Function at 0x1400cfb70
Capabilities:
Encrypt data using speck

Disassembly:
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x1a0]
test rax, rax
je 0x1400cfbe7
cmp word [rax + 0x10], 0x15
jne 0x1400cfbe7
mov rsi, rcx
call fcn.1400ca880
mov rax, qword [rsi + 0x1a0]
test rax, rax
je 0x1400cfba3
cmp word [rax + 0x10], 0x2e
je 0x1400cfbb4
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400ca880
mov byte [rax + 0x44], 0x2c
mov rcx, rsi
call fcn.1400ca880
mov rax, qword [rsi + 0x1a0]
test rax, rax
je 0x1400cfba3
cmp word [rax + 0x10], 4
je 0x1400cfbb4
cmp qword [rax + 0x20], 2
jb 0x1400cfbb0
mov rcx, qword [rax + 0x18]
movzx ecx, word [rcx]
cmp ecx, 0x2f2f
jne 0x1400cfbb0
jmp 0x1400cfbb4
add rsp, 0x20
pop rsi
ret

Function at 0x1400d15b0
Capabilities:
Encrypt data using speck
Parse credit card information

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
nop dword [rax + rax]
mov rax, qword [rsi + 0x1a0]
test rax, rax
je 0x1400d15df
cmp word [rax + 0x10], 0x3d
je 0x1400d15e5
mov rcx, rsi
call fcn.1400ccc20
test al, al
jne 0x1400d15c0
add rsp, 0x20
pop rsi
ret
mov byte [rax + 0x44], 0xd
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1400ca880
Function at 0x1400df220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rdx
mov rdx, qword [rsp + 0x80]
mov rax, qword [0x14027c048]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rax, [rsi + 0x30]
mov qword [rsi + 0x20], rax
movabs rax, 0x100000000
mov qword [rsi + 0x28], rax
mov dword [rsi + 0x6c], r8d
test r9d, r9d
je 0x1400df267
mov rax, qword [rdx]
cmp dword [rax + 0x4c], 0
je 0x1400df26a
mov r9d, r8d
mov dword [rsi], r9d
cmp byte [rcx + 0x145], 1
jne 0x1400df289
mov eax, dword [rdx + 0x20]
cmp eax, 6
je 0x1400df283
cmp eax, 1
jne 0x1400df289
mov dword [rsi], 0
movzx eax, byte [rsp + 0x88]
mov qword [rsi + 0x70], rdx
mov rdx, qword [rdx]
mov qword [rsi + 8], rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
movzx edx, byte [rcx + 0x174]
mov qword [rsi + 0x30], 0
mov dword [rsi + 0x38], r8d
mov dword [rsi + 0x3c], r8d
mov dword [rsi + 0x40], r8d
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x44], xmm0
movups xmmword [rsi + 0x54], xmm1
mov word [rsi + 0x64], 0x480
mov byte [rsi + 0x66], 0
mov dword [rsi + 0x28], 1
mov byte [rsi + 0x10], 0
mov dword [rsi + 0x1c], 0
mov qword [rsi + 0x14], 0
mov byte [rsi + 0x68], 0
cmp dl, 9
jne 0x1400df30b
or byte [rsi + 0x64], 0x18
and byte [rsi + 0x65], 0xfb
mov rdx, rsi
mov r8d, eax
xor r9d, r9d
call fcn.1400df330
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401a5de0
mov rax, rsi
add rsp, 0x50
pop rsi
ret
Function at 0x1400f18e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rax, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rcx, qword [0x14027c048]
xor rcx, rsp
mov qword [rsp + 0x40], rcx
movzx edx, byte [r8 - 1]
lea rcx, [0x14023dc90]
movzx r8d, word [rcx + rdx*2]
and r8d, 2
mov ebp, r8d
shr ebp, 1
movzx r10d, byte [rdi]
mov rdx, qword [rsi + 0xa8]
test r8d, r8d
je 0x1400f1942
lea r9, [rdi - 1]
test rdx, rdx
jne 0x1400f1945
mov qword [rsi + 0xa8], r9
mov rdx, r9
jmp 0x1400f1945
xor r9d, r9d
movzx r8d, byte [rsi + 0x18]
movzx r10d, r10b
jmp 0x1400f1958
movzx r10d, byte [rdi + 1]
inc rdi
movzx r10d, word [rcx + r10*2]
test r10b, 5
jne 0x1400f1950
test r10b, 2
je 0x1400f199d
test r8b, r8b
jne 0x1400f1ae6
cmp byte [rdi], 0xa
jne 0x1400f198c
mov r9, rdi
test rdx, rdx
jne 0x1400f198c
mov qword [rsi + 0xa8], rdi
mov rdx, rdi
mov r9, rdi
movzx r10d, byte [rdi + 1]
inc rdi
mov bpl, 1
movzx r10d, r10b
jmp 0x1400f1958
cmp byte [rsi + 0x92], 2
jb 0x1400f19d6
mov ecx, dword [rsi + 0x98]
mov eax, edi
sub eax, ecx
mov dword [rbx + 4], eax
mov r8d, dword [rsi + 0x80]
mov r9d, dword [rsi + 0x98]
sub r9d, dword [rsi + 0x70]
test r8d, r8d
js 0x1400f1a65
add r8d, r9d
jmp 0x1400f1a7c
movzx edx, byte [rdi - 1]
movzx edx, word [rcx + rdx*2]
and edx, 2
movzx ecx, word [rbx + 0x12]
and ecx, 0xfffffffd
or ecx, edx
xor ecx, 2
mov word [rbx + 0x12], cx
test bpl, 1
je 0x1400f1ae6
or ecx, 1
mov word [rbx + 0x12], cx
mov byte [rax], 1
mov rax, qword [rsi + 0xa8]
test rax, rax
je 0x1400f1ae6
test r9, r9
je 0x1400f1ae6
cmp rax, r9
je 0x1400f1ae6
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1400f1ae6
mov rbx, qword [rdx + 0x2e8]
test rbx, rbx
je 0x1400f1ae6
mov rcx, qword [rsi + 0x70]
sub r9d, ecx
mov r8d, dword [rsi + 0x80]
test r8d, r8d
js 0x1400f1aa0
add r9d, r8d
mov dword [rsp + 0x30], r9d
sub eax, ecx
inc eax
jmp 0x1400f1ac9
mov rdx, qword [rsi + 8]
mov dword [rsp + 0x20], eax
lea rcx, [rsp + 0x38]
call fcn.1400ec080
mov r8d, dword [rsp + 0x38]
mov dword [rbx], r8d
mov word [rbx + 0x10], 0
mov qword [rsi + 0x98], rdi
mov dil, 1
test bpl, 1
je 0x1400f1aef
mov word [rsi + 0xa0], 0x101
jmp 0x1400f1aef
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x30]
call fcn.1400ec080
mov r8d, dword [rsi + 0x80]
mov eax, dword [rsi + 0xa8]
sub eax, dword [rsi + 0x70]
inc eax
test r8d, r8d
js 0x1400f1b07
add eax, r8d
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x30]
shl rcx, 0x20
mov edx, eax
or rdx, rcx
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov qword [rsi + 0x98], rdi
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401a5de0
mov eax, edi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov rdx, qword [rsi + 8]
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x28]
mov r9d, eax
call fcn.1400ec080
mov eax, dword [rsp + 0x28]
jmp 0x1400f1ad0
Function at 0x140118530
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 4]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 5]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 6]
xor rcx, rdx
imul rcx, rax
movzx r15d, byte [r8 + 7]
xor r15, rcx
imul r15, rax
mov rcx, qword [rdi + 0x30]
and rcx, r15
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov rbx, qword [rdx + rax + 8]
cmp rbx, qword [rdi + 8]
je 0x140118606
mov rax, qword [r14]
cmp rax, qword [rbx + 0x10]
je 0x1401185ff
add rcx, rcx
mov r12, qword [rdx + rcx*8]
nop dword [rax + rax]
cmp rbx, r12
je 0x140118609
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1401185f0
xor eax, eax
jmp 0x140118790
mov r12, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x1401187a9
mov ecx, 0x18
call fcn.1401a5a84
mov rbx, rax
mov r13, qword [r14]
mov qword [rax + 0x10], r13
mov rax, qword [rdi + 0x10]
inc rax
js 0x140118641
cvtsi2ss xmm0, rax
jmp 0x140118656
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [rdi]
mov r14, qword [rdi + 0x38]
test r14, r14
js 0x14011866a
cvtsi2ss xmm2, r14
jmp 0x140118682
mov rax, r14
shr rax, 1
mov ecx, r14d
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x14011873a
divss xmm0, xmm1
call fcn.1401a79a0
cvttss2si rax, xmm0
mov rcx, rax
subss xmm0, dword [0x140241fc0]
cvttss2si rdx, xmm0
sar rcx, 0x3f
and rdx, rcx
or rdx, rax
cmp rdx, 9
mov eax, 8
cmovae rax, rdx
cmp r14, rax
jae 0x1401186e9
lea rcx, [r14*8]
cmp rcx, rax
cmovb rcx, rax
cmp r14, 0x200
cmovae rcx, rax
mov r14, rcx
mov rcx, rdi
mov rdx, r14
call fcn.1401187c0
mov rax, qword [rdi + 0x30]
and rax, r15
mov rcx, qword [rdi + 0x18]
mov rdx, rax
shl rdx, 4
mov r12, qword [rcx + rdx + 8]
cmp r12, qword [rdi + 8]
je 0x14011873a
cmp r13, qword [r12 + 0x10]
je 0x140118731
add rax, rax
mov rax, qword [rcx + rax*8]
nop
cmp r12, rax
je 0x140118737
mov r12, qword [r12 + 8]
cmp r13, qword [r12 + 0x10]
jne 0x140118720
mov r12, qword [r12]
jmp 0x14011873a
mov r12, rax
mov rcx, qword [r12 + 8]
inc qword [rdi + 0x10]
mov qword [rbx], r12
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [r12 + 8], rbx
mov rax, qword [rdi + 0x18]
and r15, qword [rdi + 0x30]
shl r15, 4
lea rdx, [rax + r15]
lea r8, [rax + r15]
add r8, 8
mov rax, qword [rax + r15]
cmp rax, qword [rdi + 8]
je 0x140118785
cmp rax, r12
je 0x14011878b
mov al, 1
mov rdx, r8
cmp qword [r8], rcx
jne 0x140118790
jmp 0x14011878b
mov qword [rdx], rbx
mov rdx, r8
mov qword [rdx], rbx
mov al, 1
mov qword [rsi], rbx
mov byte [rsi + 8], al
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1401a7640
int3
Function at 0x1401187c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1401189a8
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140118370
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x14011899c
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x140118861
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x14011899c
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x17]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x140118850
mov r14, qword [r9 + rbx*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [r14 + 0x10]
je 0x140118940
nop dword [rax]
cmp r11, r14
je 0x140118972
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140118900
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x140118858
mov r10, qword [r14]
cmp r10, rdx
je 0x140118854
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x140118854
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x140118858
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1401a7640
int3
Function at 0x1401189c0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rbx, rdx
cmp rdx, r8
je 0x140118add
mov rsi, r8
mov rdi, rcx
movabs rcx, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], rax
mov r8, qword [rdi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbx + 0x10]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x12]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x13]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x14]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x15]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbx + 0x16]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbx + 0x17]
xor rcx, rax
imul rcx, rdx
and rcx, qword [rdi + 0x30]
lea rax, [rcx + rcx]
lea rdx, [rcx + rcx]
inc rdx
mov qword [rsp + 0x40], rdx
shl rcx, 4
lea r15, [r8 + rcx]
mov r12, qword [r8 + rcx]
mov qword [rsp + 0x28], r8
mov r13, qword [r8 + rax*8 + 8]
mov rbp, rbx
jmp 0x140118aa5
cmp rbp, rsi
je 0x140118acf
mov r14, rbp
mov rbp, qword [rbp]
mov edx, 0x18
mov rcx, r14
call fcn.1401a5ac8
dec qword [rdi + 0x10]
cmp r14, r13
je 0x140118af4
cmp rbp, rsi
jne 0x140118aa0
cmp r12, rbx
jne 0x140118aa0
mov qword [r15], rsi
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
mov qword [rsi + 8], rax
jmp 0x140118ae0
mov rsi, rbx
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x38]
cmp r12, rbx
jne 0x140118b06
mov rax, qword [rsp + 0x30]
mov qword [r15], rax
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rdx*8], rax
cmp rbp, rsi
je 0x140118acf
movzx eax, byte [rbp + 0x10]
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rdx, 0x100000001b3
imul rax, rdx
movzx ecx, byte [rbp + 0x11]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbp + 0x12]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbp + 0x13]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbp + 0x14]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rbp + 0x15]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbp + 0x16]
xor rax, rcx
imul rax, rdx
movzx r15d, byte [rbp + 0x17]
xor r15, rax
imul r15, rdx
and r15, qword [rdi + 0x30]
lea rax, [r15 + r15]
lea r14, [r15 + r15]
inc r14
shl r15, 4
mov rcx, qword [rsp + 0x28]
add r15, rcx
mov r12, qword [rcx + rax*8 + 8]
nop word cs:[rax + rax]
mov rbx, rbp
mov rbp, qword [rbp]
mov edx, 0x18
mov rcx, rbx
call fcn.1401a5ac8
dec qword [rdi + 0x10]
cmp rbx, r12
je 0x140118bd7
cmp rbp, rsi
jne 0x140118bb0
jmp 0x140118acc
mov rax, qword [rsp + 0x30]
mov qword [r15], rax
mov rcx, qword [rsp + 0x28]
mov qword [rcx + r14*8], rax
cmp rbp, rsi
jne 0x140118b19
jmp 0x140118acf
Function at 0x140118d80
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rdx
movzx edx, byte [r8]
movabs r9, 0xcbf29ce484222325
xor r9, rdx
movabs rdx, 0x100000001b3
imul r9, rdx
movzx r10d, byte [r8 + 1]
xor r10, r9
imul r10, rdx
movzx r9d, byte [r8 + 2]
xor r9, r10
imul r9, rdx
movzx r10d, byte [r8 + 3]
xor r10, r9
imul r10, rdx
movzx r9d, byte [r8 + 4]
xor r9, r10
imul r9, rdx
movzx r10d, byte [r8 + 5]
xor r10, r9
imul r10, rdx
movzx r11d, byte [r8 + 6]
xor r11, r10
imul r11, rdx
movzx r9d, byte [r8 + 7]
xor r9, r11
imul r9, rdx
and r9, qword [rcx + 0x30]
mov rdx, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov rcx, r9
shl rcx, 4
mov rcx, qword [r10 + rcx + 8]
cmp rcx, rdx
je 0x140118e41
mov r8, qword [r8]
cmp r8, qword [rcx + 0x10]
je 0x140118e43
add r9, r9
mov r9, qword [r10 + r9*8]
nop word cs:[rax + rax]
cmp rcx, r9
je 0x140118e41
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x140118e30
jmp 0x140118e43
xor ecx, ecx
test rcx, rcx
cmovne rdx, rcx
mov qword [rax], rdx
ret

Function at 0x14011e3f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov edx, dword [rcx + 0x3a8]
test rdx, rdx
je 0x14011e553
mov rcx, qword [rcx + 0x3a0]
shl rdx, 4
add rdx, rcx
movabs r8, 0xcbf29ce484222325
movabs r9, 0x100000001b3
mov r10d, 0x9e3779b9
xor eax, eax
nop word cs:[rax + rax]
movsxd rbx, dword [rcx]
mov r14d, ebx
movzx ebp, bh
mov r11d, ebx
shr r11d, 0x10
movzx r15d, r11b
shr r14, 0x18
mov rdi, rbx
shr rdi, 0x28
mov rsi, rbx
shr rsi, 0x30
mov r11, rbx
shr r11, 0x38
movzx r12d, bl
xor r12, r8
imul r12, r9
xor r12, rbp
imul r12, r9
xor r12, r15
imul r12, r9
xor r12, r14
imul r12, r9
sar rbx, 0x3f
movzx ebx, bl
xor rbx, r12
imul rbx, r9
movzx edi, dil
xor rdi, rbx
imul rdi, r9
movzx esi, sil
xor rsi, rdi
imul rsi, r9
xor rsi, r11
imul rsi, r9
mov r11, rax
shl r11, 6
mov rdi, rax
shr rdi, 2
add r11, r10
add r11, rdi
add r11, rsi
xor r11, rax
movzx eax, byte [rcx + 8]
xor rax, r8
imul rax, r9
movzx esi, byte [rcx + 9]
xor rsi, rax
imul rsi, r9
movzx eax, byte [rcx + 0xa]
xor rax, rsi
imul rax, r9
movzx esi, byte [rcx + 0xb]
xor rsi, rax
imul rsi, r9
movzx eax, byte [rcx + 0xc]
xor rax, rsi
imul rax, r9
movzx esi, byte [rcx + 0xd]
xor rsi, rax
imul rsi, r9
movzx edi, byte [rcx + 0xe]
xor rdi, rsi
imul rdi, r9
movzx eax, byte [rcx + 0xf]
xor rax, rdi
imul rax, r9
mov rsi, r11
shl rsi, 6
mov rdi, r11
shr rdi, 2
add rax, r10
add rax, rsi
add rax, rdi
xor rax, r11
add rcx, 0x10
cmp rcx, rdx
jne 0x14011e440
jmp 0x14011e555
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14013ced0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0xaf8]
cmp qword [rcx + 0xaf0], rax
je 0x14013cf02
mov rax, qword [rax - 0x10]
cmp rax, qword [rdi + 0x450]
jne 0x14013cf02
mov rcx, rdi
call fcn.14015ab10
mov ecx, dword [rdi + 0x91c]
lea rax, [rdi + 0x450]
cmp rcx, 8
jne 0x14013cf26
mov rbx, qword [rax]
mov qword [rax], 0
test rbx, rbx
jne 0x14013cf54
jmp 0x14013cf64
lea edx, [rcx + 1]
mov dword [rdi + 0x91c], edx
lea rcx, [rdi + rcx*8]
add rcx, 0x920
cmp rcx, rax
je 0x14013cf64
mov rdx, qword [rax]
mov qword [rax], 0
mov rbx, qword [rcx]
mov qword [rcx], rdx
test rbx, rbx
je 0x14013cf64
mov rcx, rbx
call fcn.140161a60
mov rcx, rbx
call fcn.1401a5ac0
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.14013b080