joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180087350
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rbx, rcx
call fcn.1800d1ee0
mov rbp, qword [rbx]
mov edi, dword [rsi + 4]
cmp rbp, 0xffffffffffffffff
jne 0x18008738c
mov dword [rsp + 0x30], 0x2719
jmp 0x1800873e8
cmp edi, 0x80
jne 0x180087398
or byte [rbx + 8], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, rsi
mov r8d, edi
mov edx, 0xffff
mov rcx, rbp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov edi, eax
call fcn.1800d1ee0
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
test edi, edi
jne 0x1800873fd
mov dword [rsp + 0x30], edi
call fcn.1800d1ee0
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
cmp dword [rsp + 0x30], 0
jne 0x180087421
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1800ae4d0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.set_option
lea rcx, [rsp + 0x30]
call fcn.180081740
int3
Function at 0x1800b2508
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1800b2370
Function at 0x1800d38c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800d3aa0
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x180002d20]
cmp ecx, 0xffffffff
jne 0x1800d3acd
xor r14d, r14d
jmp 0x1800d3ad6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x1800d3c08
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x1800d3afa
test rdi, rdi
je 0x1800d3be1
jmp 0x1800d3b00
test rdi, rdi
je 0x1800d3b54
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800d3b37
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x1800d3b00
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1800d3ae4
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x1800d3bae
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800d3b8e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800d3bae
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800d3b80
jmp 0x1800d3bae
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800d3bab
cmp rbx, qword [rax + 0x10]
jne 0x1800d3bab
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800d3b98
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1800d3bc6
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1800d3bc6
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.1800d33a0
cmp rbx, rsi
jne 0x1800d3b60
jmp 0x1800d3ae4
lea rdx, [0x1800d3360]
lea rcx, [0x1800ed638]
call fcn.1800d2f80
mov ecx, dword [0x180002d20]
cmp ecx, 0xffffffff
je 0x1800d3c08
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x1800d3c32
lock dec dword [r14 + 8]
jne 0x1800d3c32
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800d3aa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800d3aa0
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov ecx, dword [0x180002d20]
cmp ecx, 0xffffffff
jne 0x1800d3acd
xor r14d, r14d
jmp 0x1800d3ad6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov qword [rsp + 0x50], r14
test r14, r14
je 0x1800d3c08
mov rdi, qword [r14 + 0x18]
cmp qword [r14 + 0x28], 0
jne 0x1800d3afa
test rdi, rdi
je 0x1800d3be1
jmp 0x1800d3b00
test rdi, rdi
je 0x1800d3b54
nop
mov rax, qword [rdi + 8]
mov qword [r14 + 0x18], rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800d3b37
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rdi]
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jne 0x1800d3b00
mov rsi, qword [r14 + 0x20]
mov rbx, qword [rsi]
cmp rbx, rsi
je 0x1800d3ae4
mov rdi, rbx
cmp byte [rbx + 0x19], 0
jne 0x1800d3bae
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800d3b8e
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1800d3bae
nop
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800d3b80
jmp 0x1800d3bae
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800d3bab
cmp rbx, qword [rax + 0x10]
jne 0x1800d3bab
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1800d3b98
mov rbx, rax
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1800d3bc6
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1800d3bc6
mov rax, qword [rcx]
call qword [rax + 8]
mov r8, rdi
lea rdx, [rsp + 0x58]
lea rcx, [r14 + 0x20]
call fcn.1800d33a0
cmp rbx, rsi
jne 0x1800d3b60
jmp 0x1800d3ae4
lea rdx, [0x1800d3360]
lea rcx, [0x1800ed638]
call fcn.1800d2f80
mov ecx, dword [0x180002d20]
cmp ecx, 0xffffffff
je 0x1800d3c08
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
test r14, r14
je 0x1800d3c32
lock dec dword [r14 + 8]
jne 0x1800d3c32
mov rax, qword [r14]
xor edx, edx
mov rcx, r14
call qword [rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180001500
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x130
mov rax, qword [0x180057040]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdi, rcx
lea rcx, str.jvm.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.JNI_GetCreatedJavaVMs
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, 1
lea rcx, [rdi + 0x10]
mov edx, esi
xor r8d, r8d
call rax
test eax, eax
jne 0x180001701
mov rcx, qword [rdi + 0x10]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rcx]
mov r9, qword [rax + 0x20]
call r9
test eax, eax
jne 0x180001701
mov rcx, qword [rdi + 0x10]
lea rdx, [rdi + 8]
mov r8d, 0x30010100
mov rax, qword [rcx]
call qword [rax + 0x30]
cmp qword [rdi + 8], 0
je 0x180001701
xor edx, edx
lea rcx, str.LWJGL
call qword [sym.imp.USER32.dll_FindWindowW]
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rdx, str.1.8.9
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
mov rcx, rdi
setne al
mov byte [rdi + 0x60], al
call fcn.180001730
xor edi, edi
mov ebx, edi
xor eax, eax
lock cmpxchg dword [0x180057d20], esi
je 0x180001611
nop dword [rax]
cmp rbx, 0x20
jae 0x1800015fa
xor ecx, ecx
jmp 0x1800015fc
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x180057d20], esi
jne 0x1800015f0
cmp qword [0x180057d28], rdi
jne 0x18000162e
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x180057d28], rax
xchg dword [0x180057d20], edi
lea rcx, str.Gdi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SwapBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea r8, [0x180057c80]
lea rdx, [0x180006e90]
call fcn.180044c60
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WSASend
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea r8, [0x180057d38]
lea rdx, [0x180045400]
call fcn.180044c60
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.WSARecv
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
lea r8, [0x180057d30]
lea rdx, [0x180045480]
call fcn.180044c60
mov edx, esi
call fcn.180044f50
xor edx, edx
lea rcx, str.LWJGL
call qword [sym.imp.USER32.dll_FindWindowW]
lea r8, [0x180008020]
mov edx, 0xfffffffc
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov qword [0x180057c78], rax
jmp 0x180001703
xor al, al
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180045bf0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x180004d00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmm6, xmm1
movaps xmm7, xmm0
mov ecx, dword [0x180057c0c]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
lea rbx, [0x180057df0]
mov eax, dword [rdx + rax]
cmp dword [0x180059178], eax
jle 0x180004db7
lea rcx, [0x180059178]
call fcn.180045cb8
cmp dword [0x180059178], 0xffffffff
jne 0x180004db7
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [0x180059174], 0xffffffff
mov dword [0x180057df4], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [rbx + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x180004d80
mov dword [0x180057df0], 0x270
lea rcx, [0x180059178]
call fcn.180045c4c
mov rcx, rbx
call fcn.180004e80
mov eax, eax
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
xorps xmm1, xmm1
subss xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, dword [0x18004ed90]
subss xmm6, xmm7
mulss xmm0, xmm6
addss xmm0, xmm7
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop rbx
ret

Function at 0x180004e80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x180004ee1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x180004ea0
mov ecx, dword [r9]
jmp 0x180004fcb
cmp ecx, 0x4e0
jb 0x180004fcb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180004f00
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180004f50
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x180006800
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1800591a0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1800591c8]
js 0x180006824
cvtsi2ss xmm0, rcx
jmp 0x180006839
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180059190]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x18004ef44]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000686b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000686b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000689d
cmp rbx, 0x200
jae 0x18000689a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000689d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800068b0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800068e1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180059198]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800591a8]
lea rdx, [rdi + rdi]
call fcn.1800024f0
mov rax, qword [0x180059198]
lea r9, [rdi - 1]
mov qword [0x1800591c0], r9
mov qword [0x1800591c8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180006a54
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800591a8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800069a0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180006a15
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800069dd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800069d7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180006a15
cmp r9, rdx
je 0x1800069f1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180006a29
cmp r9, rdx
jne 0x1800069e2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180006a4f
mov r9, qword [0x1800591c0]
jmp 0x180006951
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006a15
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800068b0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x1800591a0]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x1800591c8]
js 0x180006824
cvtsi2ss xmm0, rcx
jmp 0x180006839
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180059190]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x18004ef44]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18000686b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18000686b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18000689d
cmp rbx, 0x200
jae 0x18000689a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18000689d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800068b0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800068e1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180059198]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1800591a8]
lea rdx, [rdi + rdi]
call fcn.1800024f0
mov rax, qword [0x180059198]
lea r9, [rdi - 1]
mov qword [0x1800591c0], r9
mov qword [0x1800591c8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180006a54
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1800591a8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800069a0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180006a15
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800069dd
mov r10, qword [rdx]
cmp r10, rax
je 0x1800069d7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180006a15
cmp r9, rdx
je 0x1800069f1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180006a29
cmp r9, rdx
jne 0x1800069e2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180006a4f
mov r9, qword [0x1800591c0]
jmp 0x180006951
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006a15
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180008300
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
je 0x180008310
xor eax, eax
add rsp, 0x38
ret
xor eax, eax
lea r8, [0x180008290]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18000c1e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x18000c23d
lea rbx, [0x18004a010]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x18000c224
cmp r10, 2
jb 0x18000c224
cmp byte [r9], r8b
jne 0x18000c224
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x18000c200
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x18000c27f
lea rbx, [0x18004a010]
cmp r8b, 0x23
jne 0x18000c263
cmp byte [r9], r8b
jne 0x18000c263
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x18000c250
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x18000c380
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rsi, r8
test r8, r8
je 0x18000c39e
mov qword [r8], r14
lea rdx, [0x180049b50]
call fcn.18000c290
mov rbx, rax
test rax, rax
jne 0x18000c3c3
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x18000c4ef
xor edx, edx
mov r8d, 2
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000c4ef
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x18000c4ef
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x18000c4ef
cmp rdi, 0xffffffffffffffff
je 0x18000c4ef
mov rcx, rdi
call fcn.18000ff60
mov rbp, rax
test rax, rax
je 0x18000c4ef
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x18000c4dc
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov r8, qword [0x180057d18]
test r8, r8
je 0x18000c4d1
movsx rdx, word [r8 + 0x60a8]
lea rcx, [r8 + 0x60ac]
mov r9d, dword [r8 + 0x3f60]
lea rcx, [rcx + rdx*8]
cmp dword [rcx], r9d
je 0x18000c4c6
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60a8], cx
movsx rax, cx
lea rcx, [r8 + 0x60ac]
lea rcx, [rcx + rax*8]
mov dword [rcx], r9d
mov dword [rcx + 4], r14d
inc word [rcx + 6]
inc dword [r8 + 0x60a4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18000c4f8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x18000c4ea
mov qword [rsi], rdi
mov rax, rbp
jmp 0x18000c4fa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret