joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012758
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14001e650]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14000b964
xor ebx, ebx
cmp qword [0x141420dc8], rbx
mov rdi, rax
jne 0x14001286b
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140012942
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140012942
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x141420dc8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x141420dd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x141420dd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x141420de8], rax
test rax, rax
je 0x140012862
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x141420de0], rax
jmp 0x140012872
mov rax, qword [0x141420de0]
jmp 0x140012879
mov rax, qword [0x141420de0]
mov r11, qword [0x141420de8]
cmp rax, rdi
je 0x1400128e0
cmp r11, rdi
je 0x1400128e0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x141420de8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1400128e0
test rax, rax
je 0x1400128e0
call rsi
test rax, rax
je 0x1400128da
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1400128da
test byte [rsp + 0x40], 1
jne 0x1400128e0
bts ebp, 0x15
jmp 0x140012920
mov rcx, qword [0x141420dd0]
cmp rcx, rdi
je 0x140012920
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140012920
call rax
mov rbx, rax
test rax, rax
je 0x140012920
mov rcx, qword [0x141420dd8]
cmp rcx, rdi
je 0x140012920
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140012920
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x141420dc8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140012942
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140012944
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140004ca0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013120
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001128a
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014470
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014490
xor al, al
jmp 0x140014511
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400144a3
xor al, al
jmp 0x140014511
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400144cd
xor al, al
jmp 0x140014511
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400144e1
xor al, al
jmp 0x140014511
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400144f3
xor al, al
jmp 0x140014511
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001450f
xor al, al
jmp 0x140014511
mov al, 1
add rsp, 0x38
ret
Function at 0x14001acc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140032738], rbx
je 0x14001ad27
cmp rax, rbx
jne 0x14001ad1a
mov ebx, 1
mov esi, ebx
jmp 0x14001ad2c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14001acff
mov ebx, 1
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001ad44
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14001adb0
mov eax, dword [0x140032740]
test eax, eax
jne 0x14001ada5
mov dword [0x140032740], ebx
lea r15, [0x1400206d8]
lea rdi, [0x1400206c0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14001ad97
test eax, eax
jne 0x14001ad9b
cmp qword [rdi], r14
je 0x14001ad8c
mov rax, qword [rdi]
mov rcx, qword [0x140020620]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14001ad6e
test eax, eax
je 0x14001adab
mov eax, 0xff
jmp 0x14001af06
mov dword [0x140031ff0], ebx
mov edi, 0x1f
mov eax, dword [0x140032740]
cmp eax, ebx
jne 0x14001add7
lea rdx, [0x1400206b8]
lea rcx, [0x140020628]
call sub.msvcrt.dll__initterm
mov dword [0x140032740], 2
test esi, esi
jne 0x14001ade5
mov rax, r14
xchg qword [0x140032738], rax
cmp qword [0x140032758], r14
je 0x14001ae18
lea rcx, [0x140032758]
call fcn.14001b3b0
test eax, eax
je 0x14001ae18
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140032758]
mov r9, qword [0x140020620]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14001ae31
mov eax, 0xff
jmp 0x14001af06
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14001aeb7
test ax, ax
je 0x14001ae4c
test edx, edx
jne 0x14001aeb7
sub ax, bx
cmp ax, di
ja 0x14001ae62
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14001ae4c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140004034
mov dword [0x140031fec], eax
cmp dword [0x140032010], r14d
jne 0x14001aea0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140031ff0], r14d
jne 0x14001aeb5
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140031fec]
jmp 0x14001af06
cmp ax, 0x22
jne 0x14001aecb
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14001ae3a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140164000
add rsp, 0x28
jmp 0x14001acc0
Function at 0x14207b6e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x48]
lea r14, [rcx + 0x28]
mov r15, qword [rcx]
lea rbp, [rcx + 0x28]
add r14, rax
movabs rsi, 0x7a1435883d4d519d
movabs rax, 0x27d4eb2f165667c5
movabs r13, 0xc2b2ae3d27d4eb4f
movabs r12, 0x9e3779b185ebca87
cmp r15, 0x20
jb 0x14207b7f9
mov r11, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
mov r10, r11
mov rdi, qword [rcx + 0x18]
mov r8, rbx
mov rsi, qword [rcx + 0x20]
mov rdx, rdi
imul rbx, r13
imul r11, r13
imul rdi, r13
mov r9, rsi
mov ecx, 1
rol r10, cl
mov ecx, 7
rol r8, cl
mov ecx, 0xc
rol rdx, cl
mov ecx, 0x12
rol r9, cl
imul rsi, r13
add r9, rdx
lea edx, [rcx + 0xd]
mov ecx, edx
add r9, r8
rol rbx, cl
movabs r8, 0x7a1435883d4d519d
imul rbx, r12
rol r11, cl
add r9, r10
rol rdi, cl
imul r11, r12
imul rdi, r12
rol rsi, cl
xor r11, r9
imul rsi, r12
imul r11, r12
sub r11, r8
xor rbx, r11
imul rbx, r12
sub rbx, r8
xor rdi, rbx
movabs rbx, 0x85ebca77c2b2ae63
imul rdi, r12
sub rdi, r8
xor rsi, rdi
imul rsi, r12
add rbx, rsi
mov rsi, r8
add rbx, r15
jmp 0x14207b804
mov rcx, qword [rcx + 0x18]
lea rbx, [r15 + rax]
add rbx, rcx
lea rdi, [rbp + 8]
jmp 0x14207b84c
mov r8d, 8
lea rcx, [rsp + 0x70]
mov rdx, rbp
call fcn.1421364f0
mov rax, qword [rsp + 0x70]
mov ecx, 0x1f
imul rax, r13
add rbp, 8
rol rax, cl
mov ecx, 0x1b
imul rax, r12
xor rbx, rax
rol rbx, cl
imul rbx, r12
sub rbx, rsi
add rdi, 8
cmp rdi, r14
jbe 0x14207b80a
lea rdi, [rbp + 4]
movabs rsi, 0x165667b19e3779f9
cmp rdi, r14
ja 0x14207b894
mov r8d, 4
lea rcx, [rsp + 0x68]
mov rdx, rbp
call fcn.1421364f0
mov eax, dword [rsp + 0x68]
mov ecx, reloc.WS2_32.dll_socket
imul rax, r12
mov rbp, rdi
xor rbx, rax
rol rbx, cl
imul rbx, r13
add rbx, rsi
cmp rbp, r14
jae 0x14207b8c2
movabs rdx, 0x27d4eb2f165667c5
movzx eax, byte [rbp]
mov ecx, 0xb
imul rax, rdx
inc rbp
xor rbx, rax
rol rbx, cl
imul rbx, r12
cmp rbp, r14
jb 0x14207b8a3
mov rax, rbx
shr rax, 0x21
xor rax, rbx
mov rbx, qword [rsp + 0x60]
imul rax, r13
mov rcx, rax
shr rcx, 0x1d
xor rcx, rax
imul rcx, rsi
mov rax, rcx
shr rax, 0x20
xor rax, rcx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401cc530
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401cc53d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1401cc54d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401cc535
lea eax, [rcx + 1]
jmp 0x1401cc55b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1401cc56e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1401cc554
sub eax, 3
jb 0x1401cc58e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1401cc5dd
sar eax, 1
movsxd rbp, eax
jb 0x1401cc5c4
jmp 0x1401cc59c
add ebx, ebx
jne 0x1401cc59a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401cc5c4
inc ecx
add ebx, ebx
jne 0x1401cc5aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1401cc5c4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1401cc5bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1401cc5ac
add ecx, 2
jmp 0x1401cc5c9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401cc4f2
jmp 0x1401cc53d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x150600
mov dl, 0x19
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401cc62d
cmp rsi, rcx
jae 0x1401cc635
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401cc614
cmp al, 0x8f
ja 0x1401cc614
cmp byte [rsi - 2], 0xf
je 0x1401cc61a
sub al, 0xe8
cmp al, 1
ja 0x1401cc5fe
cmp rsi, rcx
jae 0x1401cc635
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401cc604
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401cc635
lodsb al, byte [rsi]
jmp 0x1401cc614
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1c9000]
mov eax, dword [rdi]
or eax, eax
je 0x1401cc692
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1cc444]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1401cc642
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1401cc68c
mov qword [rbx], rax
add rbx, 8
jmp 0x1401cc662
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1401cc6d6
cmp al, 0xef
ja 0x1401cc6be
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1401cc69e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1401cc6ad
mov eax, dword [rdi]
add rdi, 4
jmp 0x1401cc6ad
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401cc72a
sub rsp, 0xffffffffffffff80
jmp 0x140006f40
Function at 0x140d901b8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140d9033f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d901e9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d901cf
add dl, dl
jne 0x140d901f6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d90256
xor eax, eax
add dl, dl
jne 0x140d90205
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d9030d
add dl, dl
jne 0x140d90216
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d90223
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d90230
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d9023d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d9024a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d901de
mov eax, 1
add dl, dl
jne 0x140d90266
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d90273
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d9025b
sub eax, ebx
mov ebx, 1
jne 0x140d902ac
mov ecx, 1
add dl, dl
jne 0x140d9028e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d9029b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d90283
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d901de
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d902c8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d902d5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d902bd
cmp eax, 0x7d00
jae 0x140d902fb
cmp eax, 0x500
jb 0x140d902f6
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d901de
cmp eax, 0x7f
ja 0x140d902fe
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d901de
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d90332
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d901de
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140008b20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
movzx r15d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rcx, 0x100000001b3
imul r15, rcx
movzx eax, byte [r8 + 1]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 2]
xor r15, rax
imul r15, rcx
movzx eax, byte [r8 + 3]
xor r15, rax
imul r15, rcx
mov rcx, qword [0x140077fa0]
and rcx, r15
add rcx, rcx
mov rax, qword [0x140077f88]
mov rbx, qword [rax + rcx*8 + 8]
mov r14, qword [0x140077f78]
cmp rbx, r14
jne 0x140008bac
mov rbx, r14
mov rbp, r14
jmp 0x140008bed
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x140008bc6
cmp rbx, rcx
je 0x140008be7
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x140008bb8
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [0x140077f80], rax
jne 0x140008c0e
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [0x140077f78]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.14005d368
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rax, qword [r12]
mov qword [rdi + 0x10], rax
mov rdx, qword [0x140077f80]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x140008c57
cvtsi2ss xmm0, rcx
jmp 0x140008c6c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x140077fa8]
xorps xmm1, xmm1
test rcx, rcx
js 0x140008c82
cvtsi2ss xmm1, rcx
jmp 0x140008c97
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x140077f70]
seta al
test al, al
je 0x140008d18
call fcn.1400094d0
mov rcx, qword [0x140077fa0]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x140077f88]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x140077f78]
cmp rax, rbx
jne 0x140008cde
mov qword [rsp + 0x28], 0
jmp 0x140008d04
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x140008d01
nop word [rax + rax]
mov rbx, rax
cmp rax, rdx
je 0x140008d5b
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x140008cf0
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov rdx, qword [0x140077f80]
mov r8, qword [rbx + 8]
inc rdx
mov qword [0x140077f80], rdx
mov qword [rdi], r14
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [0x140077f88]
mov rax, qword [0x140077fa0]
and rax, r15
add rax, rax
mov rdx, qword [rcx + rax*8]
cmp rdx, qword [0x140077f78]
jne 0x140008d6b
mov qword [rcx + rax*8], rdi
jmp 0x140008d7d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x140008d09
cmp rdx, rbp
jne 0x140008d76
mov qword [rcx + rax*8], rdi
jmp 0x140008d82
cmp qword [rcx + rax*8 + 8], r8
jne 0x140008d82
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x140008bcd
Function at 0x140009420
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140077e70]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x140077e98]
js 0x140009444
cvtsi2ss xmm0, rcx
jmp 0x140009459
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x140077e60]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140069ea4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14000948b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14000948b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400094bd
cmp rbx, 0x200
jae 0x1400094ba
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400094bd
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x140009720
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140009751
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140077e68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140077e78]
lea rdx, [rdi + rdi]
call fcn.140006e10
mov rax, qword [0x140077e68]
lea r9, [rdi - 1]
mov qword [0x140077e90], r9
mov qword [0x140077e98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400098c4
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140077e78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140009810
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140009885
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14000984d
mov r10, qword [rdx]
cmp r10, rax
je 0x140009847
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140009885
cmp r9, rdx
je 0x140009861
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140009899
cmp r9, rdx
jne 0x140009852
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x1400098bf
mov r9, qword [0x140077e90]
jmp 0x1400097c1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140009885
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400094d0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x140077f80]
xorps xmm0, xmm0
add rcx, 1
mov rbx, qword [0x140077fa8]
js 0x1400094f4
cvtsi2ss xmm0, rcx
jmp 0x140009509
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x140077f70]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140069ea4]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14000953b
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14000953b
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x14000956d
cmp rbx, 0x200
jae 0x14000956a
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x14000956d
mov rbx, rcx
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400098d0
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140009901
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140077f78]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140077f88]
lea rdx, [rdi + rdi]
call fcn.140006e10
mov rax, qword [0x140077f78]
lea r9, [rdi - 1]
mov qword [0x140077fa0], r9
mov qword [0x140077fa8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140009a74
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140077f88]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400099c0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140009a35
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400099fd
mov r10, qword [rdx]
cmp r10, rax
je 0x1400099f7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140009a35
cmp r9, rdx
je 0x140009a11
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140009a49
cmp r9, rdx
jne 0x140009a02
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140009a6f
mov r9, qword [0x140077fa0]
jmp 0x140009971
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140009a35
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret