joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c4a0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x14000c76e
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140033aa0]
xor rax, rsp
mov qword [rsp + 0xcc0], rax
mov rsi, rcx
xor r15d, r15d
mov word [r11 - 0xa68], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0xa66]
call fcn.1400132a0
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
test ecx, ecx
je 0x14000c742
cmp ecx, 0x104
jge 0x14000c742
mov r9, r14
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x290]
call fcn.140010c28
movsxd rax, ebx
test ebx, ebx
js 0x14000c564
nop dword [rax]
cmp word [rsp + rax*2 + 0x290], 0x5c
je 0x14000c562
dec ebx
dec rax
jns 0x14000c550
test ebx, ebx
jle 0x14000c742
lea eax, [rbx + 1]
movsxd rcx, eax
lea r13, [rsp + rcx*2 + 0x290]
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jle 0x14000c742
lea eax, [rcx + 1]
movsxd r12, eax
mov eax, 2
mul r12
cmovo rax, r14
lea rdx, [0x1400354c2]
mov rcx, rax
call fcn.140010150
mov rsi, rax
test rax, rax
je 0x14000c742
lea r8, [r12 + r12]
xor edx, edx
mov rcx, rax
call fcn.1400132a0
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rsi
call fcn.140010c28
movsxd rdx, ebx
mov word [rsp + rdx*2 + 0x292], r15w
nop dword [rax]
test edi, edi
js 0x14000c602
movsxd rax, edi
cmp word [rsi + rax*2], 0x5f
je 0x14000c602
dec edi
jmp 0x14000c5f0
lea eax, [rdi + 1]
movsxd rcx, eax
lea rdi, [rsi + rcx*2]
mov word [rsp + 0x4a0], r15w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x4a2]
call fcn.1400132a0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x290]
lea r8, str._s_s
mov edx, 0x207
lea rcx, [rsp + 0x4a0]
call fcn.140010cf8
lea rdx, [rsp + 0x4a0]
lea rcx, str.will_to_delete_file__s
call fcn.14000bd20
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x40]
call fcn.1400132a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c69f
mov rcx, rsi
call fcn.14000fa80
jmp 0x14000c742
mov ebx, 1
test ebx, ebx
je 0x14000c730
mov word [rsp + 0x8b0], r15w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x8b2]
call fcn.1400132a0
lea r11, [rsp + 0x6c]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x4a0]
lea r8, [0x14002b2c8]
mov edx, 0x208
lea rcx, [rsp + 0x8b0]
call fcn.140010cf8
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, eax
lea rdx, [rsp + 0x8b0]
lea rcx, str.delete_file__s__d
call fcn.14000bd20
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000c6a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call fcn.14000fa80
nop
mov rcx, qword [rsp + 0xcc0]
xor rcx, rsp
call fcn.14000f670
lea r11, [rsp + 0xcd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
repz ret
Function at 0x14000c4a9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
test rcx, rcx
je 0x14000c76e
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xcd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x140033aa0]
xor rax, rsp
mov qword [rsp + 0xcc0], rax
mov rsi, rcx
xor r15d, r15d
mov word [r11 - 0xa68], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [r11 - 0xa66]
call fcn.1400132a0
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rbx, rcx
test ecx, ecx
je 0x14000c742
cmp ecx, 0x104
jge 0x14000c742
mov r9, r14
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x290]
call fcn.140010c28
movsxd rax, ebx
test ebx, ebx
js 0x14000c564
nop dword [rax]
cmp word [rsp + rax*2 + 0x290], 0x5c
je 0x14000c562
dec ebx
dec rax
jns 0x14000c550
test ebx, ebx
jle 0x14000c742
lea eax, [rbx + 1]
movsxd rcx, eax
lea r13, [rsp + rcx*2 + 0x290]
xor eax, eax
mov rcx, r14
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jle 0x14000c742
lea eax, [rcx + 1]
movsxd r12, eax
mov eax, 2
mul r12
cmovo rax, r14
lea rdx, [0x1400354c2]
mov rcx, rax
call fcn.140010150
mov rsi, rax
test rax, rax
je 0x14000c742
lea r8, [r12 + r12]
xor edx, edx
mov rcx, rax
call fcn.1400132a0
mov r9, r14
mov r8, r13
mov rdx, r12
mov rcx, rsi
call fcn.140010c28
movsxd rdx, ebx
mov word [rsp + rdx*2 + 0x292], r15w
nop dword [rax]
test edi, edi
js 0x14000c602
movsxd rax, edi
cmp word [rsi + rax*2], 0x5f
je 0x14000c602
dec edi
jmp 0x14000c5f0
lea eax, [rdi + 1]
movsxd rcx, eax
lea rdi, [rsi + rcx*2]
mov word [rsp + 0x4a0], r15w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x4a2]
call fcn.1400132a0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x290]
lea r8, str._s_s
mov edx, 0x207
lea rcx, [rsp + 0x4a0]
call fcn.140010cf8
lea rdx, [rsp + 0x4a0]
lea rcx, str.will_to_delete_file__s
call fcn.14000bd20
xor edx, edx
mov r8d, 0x250
lea rcx, [rsp + 0x40]
call fcn.1400132a0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c69f
mov rcx, rsi
call fcn.14000fa80
jmp 0x14000c742
mov ebx, 1
test ebx, ebx
je 0x14000c730
mov word [rsp + 0x8b0], r15w
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x8b2]
call fcn.1400132a0
lea r11, [rsp + 0x6c]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x4a0]
lea r8, [0x14002b2c8]
mov edx, 0x208
lea rcx, [rsp + 0x8b0]
call fcn.140010cf8
lea rcx, [rsp + 0x8b0]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8d, eax
lea rdx, [rsp + 0x8b0]
lea rcx, str.delete_file__s__d
call fcn.14000bd20
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000c6a4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rsi
call fcn.14000fa80
nop
mov rcx, qword [rsp + 0xcc0]
xor rcx, rsp
call fcn.14000f670
lea r11, [rsp + 0xcd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
repz ret
Function at 0x14000c9f0
Capabilities:
Get file version info

Disassembly:
push rsi
push rdi
sub rsp, 0x28
xor edx, edx
mov rsi, rcx
call qword [0x140027370]
mov edi, eax
test eax, eax
jne 0x14000ca11
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
inc eax
lea rdx, [0x1400354c2]
mov qword [rsp + 0x40], rbx
mov ecx, eax
mov qword [rsp + 0x20], rbp
mov ebp, eax
call fcn.140010150
mov rbx, rax
test rax, rax
je 0x14000ca5f
mov r8d, ebp
xor edx, edx
mov rcx, rax
call fcn.1400132a0
mov r9, rbx
mov r8d, edi
xor edx, edx
mov rcx, rsi
call qword [0x140027378]
mov rcx, rbx
test eax, eax
jne 0x14000ca72
call fcn.14000fa80
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x20]
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
xor edi, edi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.StringFileInfo040904B0FileVersion
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
call qword [0x140027380]
test eax, eax
je 0x14000caa2
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x14000cac1
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x50]
lea rdx, str.StringFileInfo080404b0FileVersion
mov rcx, rbx
call qword [0x140027380]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000cb25
test rcx, rcx
je 0x14000cb25
mov ecx, dword [rsp + 0x48]
mov eax, 2
mov rsi, 0xffffffffffffffff
inc ecx
mul rcx
lea rdx, [0x1400354c2]
cmovo rax, rsi
mov rcx, rax
call fcn.140010150
mov rdi, rax
test rax, rax
je 0x14000cb25
mov r8d, dword [rsp + 0x48]
xor edx, edx
mov rcx, rax
inc r8d
add r8, r8
call fcn.1400132a0
mov edx, dword [rsp + 0x48]
mov r8, qword [rsp + 0x50]
inc edx
mov r9, rsi
mov rcx, rdi
call fcn.140010c28
mov rcx, rbx
call fcn.14000fa80
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x20]
mov rax, rdi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400157ef
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140033aa0]
jne 0x14000f68a
rol rcx, 0x10
test cx, 0xffff
jne 0x14000f686
repz ret
ror rcx, 0x10
jmp 0x140015748
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140035850]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140035948]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400157cd
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140035850]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1400157ef
mov rax, qword [rsp + 0x88]
mov qword [0x140035948], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400358e8], rax
mov rax, qword [0x140035948]
mov qword [0x1400357c0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400358d0], rax
mov dword [0x1400357b0], 0xc0000409
mov dword [0x1400357b4], 1
mov rax, qword [0x140033aa0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140033aa8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140035848], eax
mov ecx, 1
call fcn.14001e4d4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400286a0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140035848], 0
jne 0x140015876
mov ecx, 1
call fcn.14001e4d4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140018148
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140017fb8
Function at 0x140020528
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140033aa0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400178cc
xor ebx, ebx
cmp qword [0x1400368f8], rbx
mov rdi, rax
jne 0x14002063b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140020712
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140020712
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400368f8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x140036900], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x140036908], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x140036918], rax
test rax, rax
je 0x140020632
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x140036910], rax
jmp 0x140020642
mov rax, qword [0x140036910]
jmp 0x140020649
mov rax, qword [0x140036910]
mov r11, qword [0x140036918]
cmp rax, rdi
je 0x1400206b0
cmp r11, rdi
je 0x1400206b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x140036918]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400206b0
test rax, rax
je 0x1400206b0
call rsi
test rax, rax
je 0x1400206aa
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400206aa
test byte [rsp + 0x40], 1
jne 0x1400206b0
bts ebp, 0x15
jmp 0x1400206f0
mov rcx, qword [0x140036900]
cmp rcx, rdi
je 0x1400206f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400206f0
call rax
mov rbx, rax
test rax, rax
je 0x1400206f0
mov rcx, qword [0x140036908]
cmp rcx, rdi
je 0x1400206f0
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1400206f0
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400368f8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140020712
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140020714
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000f670
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001170
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rbp, rcx
je 0x14000118b
mov eax, 1
add rsp, 0x40
pop rbp
ret
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140001336
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x140001336
movsxd rcx, dword [rsi + 0x3c]
add rcx, rsi
cmp dword [rcx], 0x4550
jne 0x140001336
mov eax, 0x2000
test word [rcx + 0x16], ax
je 0x140001336
mov eax, dword [rcx + 0x88]
test eax, eax
je 0x140001336
cmp dword [rcx + 0x8c], 0
je 0x140001336
mov r12d, dword [rsi + rax + 0x20]
lea r15, [rsi + rax]
mov eax, dword [rsi + rax + 0x1c]
add r12, rsi
mov ecx, dword [r15 + 0x24]
xor edi, edi
add rcx, rsi
mov qword [rsp + 0x50], rcx
lea r13, [rsi + rax]
test eax, eax
je 0x140001336
nop dword [rax]
mov ebx, dword [r12 + rdi*4]
add rbx, rsi
jne 0x140001250
xor ecx, ecx
jmp 0x140001325
mov edx, 0x1000
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov r9, rax
test rax, rax
jne 0x14000126d
xor ecx, ecx
jmp 0x140001325
mov r8d, r9d
xor eax, eax
and r8d, 3
shr r9, 2
test r9, r9
je 0x1400012a6
nop
movzx ecx, word [rbx]
movzx edx, word [rbx + 2]
add eax, ecx
mov ecx, eax
shl edx, 0xb
shl ecx, 0x10
add rbx, 4
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
sub r9, 1
jne 0x140001280
sub r8d, 1
je 0x1400012e7
sub r8d, 1
je 0x1400012d4
cmp r8d, 1
jne 0x1400012f9
movzx ecx, word [rbx]
movzx edx, byte [rbx + 2]
add eax, ecx
mov ecx, eax
shl edx, 0x12
shl ecx, 0x10
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
jmp 0x1400012f7
movzx ecx, word [rbx]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x1400012f7
movzx ecx, byte [rbx]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [rax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
shr ecx, 6
add ecx, eax
cmp ecx, dword [rbp]
je 0x140001361
inc edi
cmp edi, dword [r15 + 0x1c]
jb 0x140001240
xor eax, eax
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
add rsp, 0x40
pop rbp
ret
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + rdi*2]
mov ecx, dword [r13 + rax*4]
mov eax, 1
add rcx, rsi
mov qword [rbp + 0x10], rcx
jmp 0x140001338
Function at 0x18000adf0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, rdx
mov rdx, qword [0x18014e980]
xor r9, rax
movzx eax, byte [r8 + 1]
mov r11, r8
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [0x18014e958]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
shl rdx, 4
add rdx, qword [0x18014e968]
mov rax, qword [rdx + 8]
cmp rax, r8
je 0x18000aebd
mov rcx, qword [r11]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x18000aebf
nop word [rax + rax]
cmp rax, rdx
je 0x18000aebd
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18000aea0
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
xor eax, eax
test rax, rax
cmovne r8, rax
mov rax, r10
mov qword [r10], r8
ret
Function at 0x18000b450
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x18000b481
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x18014e958]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x18014e968]
lea rdx, [rdi + rdi]
call fcn.18000a180
mov rax, qword [0x18014e958]
lea r9, [rdi - 1]
mov qword [0x18014e980], r9
mov qword [0x18014e988], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x18000b622
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x18014e968]
mov r9, qword [r11]
cmp r9, rbx
jne 0x18000b56c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x18000b5e3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x18000b5a9
mov r10, qword [rdx]
cmp r10, rax
je 0x18000b5a3
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x18000b5e3
cmp r9, rdx
je 0x18000b5bf
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x18000b5f7
cmp r9, rdx
jne 0x18000b5b0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x18000b61d
mov r9, qword [0x18014e980]
jmp 0x18000b4f1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18000b5e3
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18000d180
Capabilities:
Hash data using fnv
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
movzx r10d, byte [rcx]
lea r9, [rcx + 1]
movaps xmmword [rsp + 0x40], xmm6
not edx
movaps xmmword [rsp + 0x30], xmm7
movaps xmm6, xmm3
movzx r12d, r8b
mov ebx, edx
test r10b, r10b
je 0x18000d1ef
lea r8, [0x180124b90]
nop
cmp r10b, 0x23
jne 0x18000d1d2
cmp byte [r9], r10b
jne 0x18000d1d2
cmp byte [r9 + 1], r10b
cmove ebx, edx
movzx ecx, bl
movzx eax, r10b
movzx r10d, byte [r9]
xor rcx, rax
shr ebx, 8
inc r9
xor ebx, dword [r8 + rcx*4]
test r10b, r10b
jne 0x18000d1c0
mov ecx, dword [0x18014e100]
not ebx
mov rax, qword gs:[0x58]
mov ebp, ebx
movss xmm7, dword [0x18012d6ac]
mov r14d, ebx
mov edx, 4
mov r15d, ebx
shr ebp, 0x18
xor edi, edi
mov rax, qword [rax + rcx*8]
shr r14d, 0x10
shr r15d, 8
mov eax, dword [rdx + rax]
cmp dword [0x18014e9b0], eax
jg 0x18000d38a
mov r8, qword [0x18014e9d8]
movabs rcx, 0x100000001b3
mov rdx, qword [0x18014e9c8]
movabs rax, 0xcbf29ce484222325
movzx esi, bl
xor rsi, rax
movzx eax, r15b
imul rsi, rcx
xor rsi, rax
movzx eax, r14b
imul rsi, rcx
xor rsi, rax
mov eax, ebp
imul rsi, rcx
xor rsi, rax
imul rsi, rcx
mov rax, rsi
and rax, qword [0x18014e9f0]
add rax, rax
mov rcx, qword [r8 + rax*8 + 8]
cmp rcx, rdx
je 0x18000d2b0
mov rax, qword [r8 + rax*8]
cmp ebx, dword [rcx + 0x10]
je 0x18000d2b3
cmp rcx, rax
je 0x18000d2b0
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x18000d2a0
jmp 0x18000d2b3
mov rcx, rdi
test rcx, rcx
mov rax, rdx
cmovne rax, rcx
cmp rax, rdx
jne 0x18000d32e
lea r8, [rsp + 0x80]
movss dword [rsp + 0x84], xmm6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x80], ebx
lea rcx, [0x18014e9c0]
call fcn.18000d650
and rsi, qword [0x18014e9f0]
mov rdx, qword [0x18014e9d8]
add rsi, rsi
mov rax, qword [0x18014e9c8]
mov rcx, qword [rdx + rsi*8 + 8]
cmp rcx, rax
je 0x18000d327
mov rdx, qword [rdx + rsi*8]
cmp ebx, dword [rcx + 0x10]
je 0x18000d324
cmp rcx, rdx
je 0x18000d327
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x18000d316
mov rdi, rcx
test rdi, rdi
cmovne rax, rdi
mov rcx, qword [0x18014e418]
subss xmm7, dword [rcx + 0x18]
mulss xmm7, dword [rsp + 0xa8]
test r12b, r12b
je 0x18000d351
movss xmm6, dword [rsp + 0xa0]
subss xmm6, dword [rax + 0x14]
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mulss xmm6, xmm7
movaps xmm7, xmmword [rsp + 0x30]
addss xmm6, dword [rax + 0x14]
movss dword [rax + 0x14], xmm6
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, [0x18014e9b0]
call fcn.1800ea128
cmp dword [0x18014e9b0], 0xffffffff
jne 0x18000d235
mov ecx, 0x18
call fcn.1800ea1a0
xorps xmm0, xmm0
lea rcx, [0x18014e9d8]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18014e9c8], rax
mov qword [0x18014e9d8], rdi
movdqa xmmword [0x18014e9e0], xmm0
mov qword [0x18014e9f0], 7
mov qword [0x18014e9f8], 8
mov dword [0x18014e9c0], 0x3f800000
call fcn.18000a180
lea rcx, [0x1800ecad0]
call fcn.1800ea534
lea rcx, [0x18014e9b0]
call fcn.1800ea0bc
jmp 0x18000d235