joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Connect socket
Get session user name
Initialize winsock library
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x6c0]
sub rsp, 0x7c0
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rbp + 0x6b0], rax
movsd xmm0, qword [str.127.0.0.1]
lea rcx, [rbp + 0x13a]
movzx eax, word [0x1400032e0]
xor edx, edx
movsd qword [rbp + 0x130], xmm0
mov word [rbp + 0x138], ax
lea r8d, [rdx + 0x5a]
call sub.VCRUNTIME140.dll_memset
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, 1
mov ebx, 2
mov ecx, ebx
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
lea rcx, [rbp + 0x130]
mov word [rsp + 0x38], bx
mov qword [0x140005648], rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0x7e7
mov dword [rsp + 0x3c], eax
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
nop dword [rax]
mov rcx, qword [0x140005648]
lea rdx, [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x1400010b0
xor eax, eax
lea rcx, [rbp + 0x1a0]
xor edx, edx
mov qword [rbp + 0x120], rax
mov r8d, 0x104
mov word [rbp + 0x128], ax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x104
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
lea r8, [rbp + 0xf0]
mov rcx, rax
xor edx, edx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov ecx, dword [rbp + 0x118]
lea rdx, [rbp + 0x120]
mov r8d, 0xa
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa]
movups xmm0, xmmword [str._n____Started_By__]
movzx eax, word [0x1400032f8]
lea rcx, [rbp + 0x2c2]
xor edx, edx
mov word [rbp + 0x2c0], ax
mov r8d, 0x3ee
movaps xmmword [rbp + 0x2b0], xmm0
call sub.VCRUNTIME140.dll_memset
mov r8d, dword [rsp + 0x30]
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, send
lea rdx, str.__With_Parent
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
or rbx, 0xffffffffffffffff
lea rax, [rbp + 0x2b0]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400011c5
mov rcx, qword [0x140005648]
lea rdx, [rbp + 0x2b0]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
lea rax, [rbp + 0x120]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400011f0
mov rcx, qword [0x140005648]
lea rdx, [rbp + 0x120]
mov r8, rbx
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rbp + 0x6b0]
xor rcx, rsp
call fcn.140001620
mov rbx, qword [rsp + 0x7d0]
add rsp, 0x7c0
pop rbp
ret
Function at 0x140001680
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r12, rdx
mov r14, qword [rdx + 0x10]
lea rax, [r14 + 2]
movabs rdx, 0xaaaaaaaaaaaaaaab
mul rdx
mov rdi, rdx
mov r15, rcx
add rdi, rdx
and rdi, 0xfffffffffffffffc
mov qword [rcx], 0
movaps xmm0, xmmword [0x1400ba070]
movups xmmword [rcx + 0x10], xmm0
mov byte [rcx], 0
cmp rdi, 0xf
jbe 0x1400016dd
mov rcx, r15
mov rdx, rdi
xor r9d, r9d
call fcn.140006bb0
jmp 0x1400016f3
mov qword [r15 + 0x10], rdi
mov rcx, r15
xor edx, edx
mov r8, rdi
call fcn.14008d500
mov byte [r15 + rdi], 0
cmp qword [r15 + 0x18], 0xf
mov rax, r15
jbe 0x140001700
mov rax, qword [r15]
xor ecx, ecx
cmp r14, 3
jb 0x1400017dc
mov r8, r14
add r8, 0xfffffffffffffffe
je 0x1400017dc
xor ecx, ecx
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_4
jmp 0x140001750
movzx ebx, byte [rbx + rcx + 2]
and ebx, 0x3f
movzx ebx, byte [rbx + rdx]
mov byte [rax + 3], bl
add rax, 4
add rcx, 3
cmp rcx, r8
jae 0x1400017dc
cmp qword [r12 + 0x18], 0xf
mov rsi, r12
jbe 0x14000175f
mov rsi, qword [r12]
movzx ebx, byte [rsi + rcx]
shr rbx, 2
movzx ebx, byte [rbx + rdx]
mov byte [rax], bl
cmp qword [r12 + 0x18], 0xf
mov rdi, r12
jbe 0x14000177c
mov rdi, qword [r12]
movzx ebx, byte [rdi + rcx]
shl ebx, 4
and ebx, 0x30
movzx edi, byte [rdi + rcx + 1]
shr rdi, 4
or rdi, rbx
movzx ebx, byte [rdx + rdi]
mov byte [rax + 1], bl
cmp qword [r12 + 0x18], 0xf
mov rbx, r12
jbe 0x1400017a8
mov rbx, qword [r12]
movzx edi, byte [rbx + rcx + 1]
and edi, 0xf
movzx ebx, byte [rbx + rcx + 2]
shr rbx, 6
lea rbx, [rbx + rdi*4]
movzx ebx, byte [rdx + rbx]
mov byte [rax + 2], bl
cmp qword [r12 + 0x18], 0xf
mov rbx, r12
jbe 0x140001730
mov rbx, qword [r12]
jmp 0x140001730
cmp rcx, r14
jae 0x14000186c
cmp qword [r12 + 0x18], 0xf
mov rdx, r12
jbe 0x1400017f4
mov rdx, qword [r12]
movzx edx, byte [rdx + rcx]
shr rdx, 2
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_4
mov dl, byte [rdx + r8]
mov byte [rax], dl
add r14, 0xffffffffffffffff
cmp qword [r12 + 0x18], 0xf
mov rdi, r12
jbe 0x14000181c
mov rdi, qword [r12]
movzx edx, byte [rdi + rcx]
shl edx, 4
and edx, 0x30
cmp rcx, r14
jne 0x140001836
mov cl, byte [rdx + r8]
mov byte [rax + 1], cl
mov cl, 0x3d
jmp 0x140001865
movzx ebx, byte [rdi + rcx + 1]
shr rbx, 4
movzx edx, dl
or rdx, rbx
mov dl, byte [rdx + r8]
mov byte [rax + 1], dl
cmp qword [r12 + 0x18], 0xf
jbe 0x140001858
mov r12, qword [r12]
movzx ecx, byte [r12 + rcx + 1]
and ecx, 0xf
mov cl, byte [r8 + rcx*4]
mov byte [rax + 2], cl
mov byte [rax + 3], 0x3d
mov rax, r15
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140015890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
mov rsi, r8
sub rsi, rdx
je 0x1400158c8
movabs r11, 0xcbf29ce484222325
movabs r9, 0x100000001b3
mov rcx, rdx
not rcx
add rcx, r8
mov r8d, esi
and r8d, 3
cmp rcx, 3
jae 0x1400158cf
xor r10d, r10d
jmp 0x14001591c
mov eax, 0x84222325
jmp 0x140015947
and rsi, 0xfffffffffffffffc
xor r10d, r10d
nop word cs:[rax + rax]
movzx ecx, byte [rdx + r10]
xor rcx, r11
imul rcx, r9
movzx eax, byte [rdx + r10 + 1]
xor rax, rcx
imul rax, r9
movzx ecx, byte [rdx + r10 + 2]
xor rcx, rax
imul rcx, r9
movzx r11d, byte [rdx + r10 + 3]
xor r11, rcx
imul r11, r9
add r10, 4
cmp rsi, r10
jne 0x1400158e0
mov rax, r11
test r8, r8
je 0x140015947
add rdx, r10
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor rax, r11
imul rax, r9
add rcx, 1
mov r11, rax
cmp r8, rcx
jne 0x140015930
pop rsi
ret

Function at 0x14001ba70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rdx
mov r12, rcx
mov r13, qword [rcx]
mov r15b, byte [r13]
test byte [rcx + 0xb9], 1
je 0x14001bab2
mov rax, qword [r12 + 0xd0]
mov rcx, qword [rax + 8]
mov rax, qword [rcx]
mov edx, r15d
call qword [rax + 0x20]
mov r15d, eax
mov r13, qword [r12]
mov r9, qword [r14 + 0x20]
test r9, r9
je 0x14001bb55
mov r8, qword [r12 + 0xa0]
jmp 0x14001bad9
mov r9, qword [r9 + 0x18]
test r9, r9
je 0x14001bb55
mov edx, dword [r9 + 0xc]
test edx, edx
je 0x14001bad0
mov ebx, dword [r9]
xor ebp, ebp
nop word cs:[rax + rax]
mov ebp, ebp
mov rsi, r13
test ebx, ebx
je 0x14001bb2a
mov rax, qword [r9 + 0x10]
add rax, rbp
xor edi, edi
nop word cs:[rax + rax]
nop dword [rax]
lea rsi, [rdi + 1]
cmp rsi, rbx
jae 0x14001bb27
movzx ecx, byte [rax + rdi]
cmp byte [r13 + rdi], cl
mov rdi, rsi
je 0x14001bb10
add rsi, r13
cmp rsi, r8
je 0x14001bb37
add ebp, ebx
cmp ebp, edx
jb 0x14001baf0
jmp 0x14001bad0
cmp r8, r13
je 0x14001bb55
test byte [r14 + 0xc], 1
mov r13, r8
jne 0x14001bbde
mov qword [r12], r13
mov al, 1
jmp 0x14001bbe0
add r13, 1
mov rbx, qword [r14 + 0x38]
test rbx, rbx
je 0x14001bbab
test byte [r12 + 0xb9], 8
mov eax, r15d
je 0x14001bb80
mov rcx, qword [r12 + 0xd0]
mov edx, r15d
call fcn.140018a10
mov ecx, dword [rbx + 4]
test ecx, ecx
je 0x14001bbab
mov rdx, qword [rbx + 8]
xor ebp, ebp
jmp 0x14001bb97
add ebp, 2
cmp ebp, ecx
jae 0x14001bbab
mov ebx, ebp
cmp byte [rdx + rbx], al
ja 0x14001bb90
lea ebx, [rbp + 1]
cmp byte [rdx + rbx], al
jb 0x14001bb90
mov r8, r13
jmp 0x14001bb3c
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x14001bbf1
movzx ecx, r15b
shr rcx, 3
movzx eax, byte [rax + rcx]
and r15b, 7
movzx ecx, r15b
bt eax, ecx
setb al
test byte [r14 + 0xc], 1
sete cl
xor cl, al
je 0x14001bb4a
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
test byte [r14 + 0xc], 1
je 0x14001bbde
jmp 0x14001bb4a
Function at 0x1400279f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov r8, qword [0x1400f3fd8]
test r8, r8
jne 0x140027c67
mov rax, qword gs:[0x60]
mov r13, qword [rax + 0x18]
add r13, 0x10
mov r10d, 0x2baa4ae
xor r9d, r9d
jmp 0x140027a40
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r13, qword [rax + 0x10]
nop dword [rax]
mov r13, qword [r13]
test r9d, r9d
je 0x140027b06
mov edx, dword [r13 + 0x58]
add edx, 0xfffffff8
mov esi, 0x23e3fa1c
cmp dx, 2
jb 0x140027afd
mov rax, qword [r13 + 0x60]
and edx, 0xfffe
add rdx, 0xfffffffffffffffe
mov r11, rdx
shr r11, 1
add r11, 1
test rdx, rdx
je 0x140027c4c
mov rdx, r11
and rdx, 0xfffffffffffffffe
neg rdx
mov esi, 0x23e3fa1c
nop word cs:[rax + rax]
nop dword [rax]
movsx ebp, byte [rax]
lea edi, [rbp - 0x41]
mov ebx, ebp
or ebx, 0x20
cmp dil, 0x1a
cmovae ebx, ebp
xor ebx, esi
imul esi, ebx, 0x1000193
movsx edi, byte [rax + 2]
lea ebx, [rdi - 0x41]
mov ebp, edi
or ebp, 0x20
cmp bl, 0x1a
cmovae ebp, edi
xor ebp, esi
imul esi, ebp, 0x1000193
add rax, 4
add rdx, 2
jne 0x140027aa0
test r11b, 1
je 0x140027afd
movsx eax, byte [rax]
lea edx, [rax - 0x41]
mov ebp, eax
or ebp, 0x20
cmp dl, 0x1a
cmovae ebp, eax
xor ebp, esi
imul esi, ebp, 0x1000193
cmp esi, r9d
jne 0x140027a40
mov r8, qword [r13 + 0x30]
movsxd rsi, dword [r8 + 0x3c]
mov r11d, dword [r8 + rsi + 0x88]
lea r12, [r8 + r11]
test r11, r11
je 0x140027a40
mov r14d, dword [r8 + rsi + 0x8c]
mov edi, dword [r12 + 0x18]
lea r15, [r8 + 1]
jmp 0x140027b4a
mov ebp, 0x23e3fa1c
cmp ebp, r10d
je 0x140027ba0
sub rdi, 1
jb 0x140027a40
mov esi, dword [r12 + 0x20]
add rsi, r8
mov esi, dword [rsi + rdi*4]
mov bl, byte [r8 + rsi]
test bl, bl
je 0x140027b40
add rsi, r15
mov ebp, 0x23e3fa1c
nop
movsx ebx, bl
lea eax, [rbx - 0x41]
mov edx, ebx
or edx, 0x20
cmp al, 0x1a
cmovae edx, ebx
xor edx, ebp
imul ebp, edx, 0x1000193
movzx ebx, byte [rsi]
add rsi, 1
test bl, bl
jne 0x140027b70
jmp 0x140027b45
mov eax, edi
mov edx, dword [r12 + 0x1c]
mov ebp, dword [r12 + 0x24]
add rdx, r8
add rbp, r8
movzx eax, word [rbp + rax*2]
mov eax, dword [rdx + rax*4]
add r8, rax
cmp r11d, eax
jae 0x140027c60
add r12, r14
cmp r12, r8
jbe 0x140027c60
mov al, byte [r8]
mov r10d, 0x23e3fa1c
mov r9d, 0x23e3fa1c
cmp al, 0x2e
je 0x140027c0a
nop word cs:[rax + rax]
nop
movsx eax, al
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [r8 + 1]
add r8, 1
cmp al, 0x2e
jne 0x140027bf0
mov al, byte [r8 + 1]
test al, al
je 0x140027a28
add r8, 2
mov r10d, 0x23e3fa1c
movsx eax, al
lea edx, [rax - 0x41]
mov ebp, eax
or ebp, 0x20
cmp dl, 0x1a
cmovae ebp, eax
xor ebp, r10d
imul r10d, ebp, 0x1000193
movzx eax, byte [r8]
add r8, 1
test al, al
jne 0x140027c20
jmp 0x140027a28
mov esi, 0x23e3fa1c
test r11b, 1
jne 0x140027ae4
jmp 0x140027afd
mov qword [0x1400f3fd8], r8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp r8
Function at 0x140027c80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
push rax
mov r9, qword [0x1400f3fe0]
test r9, r9
jne 0x140027f0c
mov qword [rsp], rdx
mov rax, qword gs:[0x60]
mov r12, qword [rax + 0x18]
add r12, 0x10
mov r10d, 0xb8077d7b
xor r8d, r8d
jmp 0x140027cd0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r12, qword [rax + 0x10]
nop
mov r12, qword [r12]
test r8d, r8d
je 0x140027d9e
mov ebx, dword [r12 + 0x58]
add ebx, 0xfffffff8
mov r11d, 0xba627b4f
cmp bx, 2
jb 0x140027d95
mov rax, qword [r12 + 0x60]
and ebx, 0xfffe
add rbx, 0xfffffffffffffffe
mov r9, rbx
shr r9, 1
add r9, 1
test rbx, rbx
je 0x140027eec
mov rdi, r9
and rdi, 0xfffffffffffffffe
neg rdi
mov r11d, 0xba627b4f
nop word [rax + rax]
movsx ebx, byte [rax]
lea ebp, [rbx - 0x41]
mov esi, ebx
or esi, 0x20
cmp bpl, 0x1a
cmovae esi, ebx
xor esi, r11d
imul r11d, esi, 0x1000193
movsx ebx, byte [rax + 2]
lea esi, [rbx - 0x41]
mov ebp, ebx
or ebp, 0x20
cmp sil, 0x1a
cmovae ebp, ebx
xor ebp, r11d
imul r11d, ebp, 0x1000193
add rax, 4
add rdi, 2
jne 0x140027d30
test r9b, 1
je 0x140027d95
movsx eax, byte [rax]
lea ebp, [rax - 0x41]
mov ebx, eax
or ebx, 0x20
cmp bpl, 0x1a
cmovae ebx, eax
xor ebx, r11d
imul r11d, ebx, 0x1000193
cmp r11d, r8d
jne 0x140027cd0
mov r9, qword [r12 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r15d, dword [r9 + rax + 0x88]
lea r11, [r9 + r15]
test r15, r15
je 0x140027cd0
mov edx, dword [r9 + rax + 0x8c]
mov ebx, dword [r11 + 0x18]
lea r13, [r9 + 1]
jmp 0x140027dda
mov ebp, 0xba627b4f
cmp ebp, r10d
je 0x140027e30
sub rbx, 1
jb 0x140027cd0
mov eax, dword [r11 + 0x20]
add rax, r9
mov esi, dword [rax + rbx*4]
mov al, byte [r9 + rsi]
test al, al
je 0x140027dd0
add rsi, r13
mov ebp, 0xba627b4f
nop
movsx eax, al
lea edi, [rax - 0x41]
mov r14d, eax
or r14d, 0x20
cmp dil, 0x1a
cmovae r14d, eax
xor r14d, ebp
imul ebp, r14d, 0x1000193
movzx eax, byte [rsi]
add rsi, 1
test al, al
jne 0x140027e00
jmp 0x140027dd5
mov eax, ebx
mov ebp, dword [r11 + 0x1c]
mov ebx, dword [r11 + 0x24]
add rbp, r9
add rbx, r9
movzx eax, word [rbx + rax*2]
mov eax, dword [rbp + rax*4]
add r9, rax
cmp r15d, eax
jae 0x140027f01
add r11, rdx
cmp r11, r9
jbe 0x140027f01
mov bl, byte [r9]
mov r10d, 0xba627b4f
mov r8d, 0xba627b4f
cmp bl, 0x2e
je 0x140027e9b
nop word cs:[rax + rax]
nop
movsx eax, bl
xor eax, r8d
imul r8d, eax, 0x1000193
movzx ebx, byte [r9 + 1]
add r9, 1
cmp bl, 0x2e
jne 0x140027e80
mov bl, byte [r9 + 1]
test bl, bl
je 0x140027cbd
add r9, 2
mov r10d, 0xba627b4f
nop word cs:[rax + rax]
nop dword [rax + rax]
movsx eax, bl
lea edx, [rax - 0x41]
mov ebp, eax
or ebp, 0x20
cmp dl, 0x1a
cmovae ebp, eax
xor ebp, r10d
imul r10d, ebp, 0x1000193
movzx ebx, byte [r9]
add r9, 1
test bl, bl
jne 0x140027ec0
jmp 0x140027cbd
mov r11d, 0xba627b4f
test r9b, 1
jne 0x140027d79
jmp 0x140027d95
mov qword [0x1400f3fe0], r9
mov rdx, qword [rsp]
add rsp, 8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp r9
Function at 0x1400284a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov rdx, qword [0x1400f3ff8]
test rdx, rdx
jne 0x140028716
mov rax, qword gs:[0x60]
mov r8, qword [rax + 0x18]
add r8, 0x10
mov r14d, 0xa01962a1
xor r9d, r9d
jmp 0x1400284f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [r8]
test r9d, r9d
je 0x1400285b7
mov eax, dword [r8 + 0x58]
add eax, 0xfffffff8
mov edx, 0x550dc8f1
cmp ax, 2
jb 0x1400285ae
mov rcx, qword [r8 + 0x60]
and eax, 0xfffe
add rax, 0xfffffffffffffffe
mov r10, rax
shr r10, 1
add r10, 1
test rax, rax
je 0x1400286fb
mov rdi, r10
and rdi, 0xfffffffffffffffe
neg rdi
mov edx, 0x550dc8f1
nop word cs:[rax + rax]
nop dword [rax + rax]
movsx eax, byte [rcx]
lea ebp, [rax - 0x41]
mov ebx, eax
or ebx, 0x20
cmp bpl, 0x1a
cmovae ebx, eax
xor ebx, edx
imul eax, ebx, 0x1000193
movsx edx, byte [rcx + 2]
lea ebp, [rdx - 0x41]
mov ebx, edx
or ebx, 0x20
cmp bpl, 0x1a
cmovae ebx, edx
xor ebx, eax
imul edx, ebx, 0x1000193
add rcx, 4
add rdi, 2
jne 0x140028550
test r10b, 1
je 0x1400285ae
movsx eax, byte [rcx]
lea ecx, [rax - 0x41]
mov ebp, eax
or ebp, 0x20
cmp cl, 0x1a
cmovae ebp, eax
xor ebp, edx
imul edx, ebp, 0x1000193
cmp edx, r9d
jne 0x1400284f0
mov rdx, qword [r8 + 0x30]
movsxd rax, dword [rdx + 0x3c]
mov r10d, dword [rdx + rax + 0x88]
lea r12, [rdx + r10]
test r10, r10
je 0x1400284f0
mov r11d, dword [rdx + rax + 0x8c]
mov esi, dword [r12 + 0x18]
lea r15, [rdx + 1]
jmp 0x1400285fa
mov ebp, 0x550dc8f1
cmp ebp, r14d
je 0x140028650
sub rsi, 1
jb 0x1400284f0
mov eax, dword [r12 + 0x20]
add rax, rdx
mov ebx, dword [rax + rsi*4]
mov al, byte [rdx + rbx]
test al, al
je 0x1400285f0
add rbx, r15
mov ebp, 0x550dc8f1
nop
movsx eax, al
lea edi, [rax - 0x41]
mov ecx, eax
or ecx, 0x20
cmp dil, 0x1a
cmovae ecx, eax
xor ecx, ebp
imul ebp, ecx, 0x1000193
movzx eax, byte [rbx]
add rbx, 1
test al, al
jne 0x140028620
jmp 0x1400285f5
mov eax, esi
mov ecx, dword [r12 + 0x1c]
mov ebp, dword [r12 + 0x24]
add rcx, rdx
add rbp, rdx
movzx eax, word [rbp + rax*2]
mov eax, dword [rcx + rax*4]
add rdx, rax
cmp r10d, eax
jae 0x14002870f
add r12, r11
cmp r12, rdx
jbe 0x14002870f
mov cl, byte [rdx]
mov r14d, 0x550dc8f1
mov r9d, 0x550dc8f1
cmp cl, 0x2e
je 0x1400286ba
nop word cs:[rax + rax]
nop
movsx eax, cl
xor eax, r9d
imul r9d, eax, 0x1000193
movzx ecx, byte [rdx + 1]
add rdx, 1
cmp cl, 0x2e
jne 0x1400286a0
mov cl, byte [rdx + 1]
test cl, cl
je 0x1400284d6
add rdx, 2
mov r14d, 0x550dc8f1
nop
movsx eax, cl
lea ecx, [rax - 0x41]
mov ebp, eax
or ebp, 0x20
cmp cl, 0x1a
cmovae ebp, eax
xor ebp, r14d
imul r14d, ebp, 0x1000193
movzx ecx, byte [rdx]
add rdx, 1
test cl, cl
jne 0x1400286d0
jmp 0x1400284d6
mov edx, 0x550dc8f1
test r10b, 1
jne 0x140028595
jmp 0x1400285ae
mov qword [0x1400f3ff8], rdx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rdx
Function at 0x14002b0e0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14002b289
mov r15, rcx
add rdx, 0xffffffffffffffff
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea r14, [r15 + 0x18]
mov r12, qword [r15 + 8]
lea rdx, [rsi + rsi]
mov rcx, r14
mov r8, r12
call fcn.14002aa50
lea rdi, [rsi - 1]
mov qword [r15 + 0x30], rdi
mov qword [r15 + 0x38], rsi
mov rax, qword [r15 + 8]
mov rdx, qword [rax]
cmp rdx, r12
je 0x14002b27b
movabs r8, 0xcbf29ce484222325
movabs r9, 0x100000001b3
jmp 0x14002b188
mov qword [rdi + r10*8], rdx
mov qword [rdi + rcx*8], rdx
cmp r11, r12
je 0x14002b27b
mov rdi, qword [r15 + 0x30]
mov rdx, r11
mov r11, qword [rdx]
movzx eax, byte [rdx + 0x10]
xor rax, r8
imul rax, r9
movzx ecx, byte [rdx + 0x11]
xor rcx, rax
imul rcx, r9
movzx eax, byte [rdx + 0x12]
xor rax, rcx
imul rax, r9
movzx esi, byte [rdx + 0x13]
xor rsi, rax
imul rsi, r9
and rsi, rdi
mov rdi, qword [r14]
lea r10, [rsi + rsi]
lea rcx, [rsi + rsi]
add rcx, 1
shl rsi, 4
mov rbx, qword [rdi + rsi]
cmp rbx, r12
je 0x14002b170
mov rsi, qword [rdi + rcx*8]
mov eax, dword [rdx + 0x10]
cmp eax, dword [rsi + 0x10]
jne 0x14002b210
mov rax, qword [rsi]
cmp rax, rdx
je 0x14002b174
mov r10, qword [rdx + 8]
mov qword [r10], r11
mov rsi, qword [r11 + 8]
mov qword [rsi], rax
mov rbx, qword [rax + 8]
mov qword [rbx], rdx
mov qword [rax + 8], rsi
mov qword [r11 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x14002b174
cmp rbx, rsi
je 0x14002b24d
mov rsi, qword [rsi + 8]
cmp eax, dword [rsi + 0x10]
jne 0x14002b210
mov rax, qword [rsi]
mov rcx, qword [rdx + 8]
mov qword [rcx], r11
mov rbx, qword [r11 + 8]
mov qword [rbx], rax
mov rdi, qword [rax + 8]
mov qword [rdi], rdx
mov qword [rax + 8], rbx
mov qword [r11 + 8], rcx
mov qword [rdx + 8], rdi
cmp r11, r12
jne 0x14002b181
jmp 0x14002b27b
mov rax, qword [rdx + 8]
mov qword [rax], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rbx
mov rsi, qword [rbx + 8]
mov qword [rsi], rdx
mov qword [rbx + 8], rcx
mov qword [r11 + 8], rax
mov qword [rdx + 8], rsi
mov qword [rdi + r10*8], rdx
cmp r11, r12
jne 0x14002b181
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140049130
int3
Function at 0x14002b2a0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov r15, r8
mov r14, rdx
mov rdi, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs r12, 0x100000001b3
imul r12, rcx
mov rsi, qword [rdi + 0x30]
and rsi, r12
mov rdx, qword [rdi + 0x18]
mov rcx, rsi
shl rcx, 4
mov rbx, qword [rdx + rcx + 8]
cmp rbx, qword [rdi + 8]
je 0x14002b32b
cmp al, byte [rbx + 0x10]
je 0x14002b31e
add rsi, rsi
mov rcx, qword [rdx + rsi*8]
nop
cmp rbx, rcx
je 0x14002b328
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x14002b310
mov qword [r14], rbx
xor eax, eax
jmp 0x14002b4e2
mov rbx, rcx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rdi + 0x10], rax
je 0x14002b4fa
mov ecx, 0x18
call fcn.14004801c
mov r13, rax
mov al, byte [r15]
mov byte [r13 + 0x10], al
mov dword [r13 + 0x14], 0
mov rax, qword [rdi + 0x10]
add rax, 1
js 0x14002b36c
cvtsi2ss xmm0, rax
jmp 0x14002b381
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
movss xmm1, dword [rdi]
mov r15, qword [rdi + 0x38]
test r15, r15
js 0x14002b395
cvtsi2ss xmm2, r15
jmp 0x14002b3ad
mov rax, r15
shr rax, 1
mov ecx, r15d
and ecx, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm3, xmm0
divss xmm3, xmm2
ucomiss xmm3, xmm1
jbe 0x14002b48c
divss xmm0, xmm1
call fcn.14009fd60
movss xmm1, dword [0x1400bddbc]
movaps xmm2, xmm0
subss xmm2, xmm1
cvttss2si rax, xmm2
movabs rcx, 0x8000000000000000
xor rcx, rax
cvttss2si rdx, xmm0
ucomiss xmm0, xmm1
cmovae rdx, rcx
cmp rdx, 8
mov eax, 8
cmova rax, rdx
cmp r15, rax
mov qword [rbp - 8], r13
jae 0x14002b426
lea rcx, [r15*8]
cmp rcx, rax
cmovb rcx, rax
cmp r15, 0x1ff
cmova rcx, rax
mov r15, rcx
mov rcx, rdi
mov rdx, r15
call fcn.14002b550
mov rcx, qword [rdi + 0x30]
and rcx, r12
mov rdx, qword [rdi + 0x18]
mov rax, rcx
shl rax, 4
mov rbx, qword [rdx + rax + 8]
cmp rbx, qword [rdi + 8]
je 0x14002b483
mov r13, qword [rbp - 8]
mov al, byte [r13 + 0x10]
cmp al, byte [rbx + 0x10]
je 0x14002b47e
add rcx, rcx
mov rcx, qword [rdx + rcx*8]
nop word cs:[rax + rax]
nop dword [rax]
cmp rbx, rcx
je 0x14002b489
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x14002b470
mov rbx, qword [rbx]
jmp 0x14002b48c
mov r13, qword [rbp - 8]
jmp 0x14002b48c
mov rbx, rcx
mov rcx, qword [rbx + 8]
add qword [rdi + 0x10], 1
mov qword [r13], rbx
mov qword [r13 + 8], rcx
mov qword [rcx], r13
mov qword [rbx + 8], r13
mov rsi, qword [rdi + 0x18]
and r12, qword [rdi + 0x30]
shl r12, 4
lea rax, [rsi + r12]
add rax, 8
lea rdx, [rsi + r12]
mov rsi, qword [rsi + r12]
cmp rsi, qword [rdi + 8]
je 0x14002b4d2
cmp rsi, rbx
je 0x14002b4d7
cmp qword [rax], rcx
jne 0x14002b4dd
jmp 0x14002b4da
mov qword [rdx], r13
jmp 0x14002b4da
mov rax, rdx
mov qword [rax], r13
mov qword [r14], r13
mov al, 1
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.140049130
int3