joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018efa0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14018f162
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.140028b70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14018f120
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x14018f098
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x14018f114
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x14018f0d5
mov r8, qword [rax]
cmp r8, rcx
je 0x14018f0cf
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x14018f114
cmp qword [r11], rax
je 0x14018f0f0
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x14018f13c
cmp r8, rax
jne 0x14018f0e1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14018f040
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x14018f114
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14018f170
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14018f332
lea rax, [rdx - 1]
or rax, rdi
bsr rcx, rax
inc ecx
shl rdi, cl
mov rbx, qword [rsi + 8]
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
mov r8, rbx
call fcn.140028b70
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rdi
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14018f2f0
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdx]
movzx r8d, byte [rcx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rcx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rcx + 0x13]
xor r8, rax
imul r8, rbp
and r8, qword [rsi + 0x30]
mov r11, r8
shl r11, 4
add r11, qword [rsi + 0x18]
add r8, r8
mov rax, qword [rsi + 0x18]
lea rdi, [rax + r8*8]
cmp qword [r11], rbx
jne 0x14018f268
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x14018f2e4
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x14018f2a5
mov r8, qword [rax]
cmp r8, rcx
je 0x14018f29f
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x14018f2e4
cmp qword [r11], rax
je 0x14018f2c0
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x14018f30c
cmp r8, rax
jne 0x14018f2b1
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14018f210
mov qword [rsp + 0x48], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
jmp 0x14018f2e4
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140197e10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2b0
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov qword [rsp + 0x60], rdx
xor ebx, ebx
mov dword [rsp + 0x44], ebx
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 0x1c]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, 0x105
mov ecx, edx
lea rax, [rsp + 0x90]
mov r10d, ebx
cmp word [rax], bx
je 0x140197e8c
add rax, 2
sub rcx, 1
jne 0x140197e72
mov r10d, 0x80070057
mov rax, rbx
jmp 0x140197ea2
test rcx, rcx
jne 0x140197e9c
mov r10d, 0x80070057
mov rax, rbx
jmp 0x140197ea2
mov rax, rdx
sub rax, rcx
test r10d, r10d
js 0x140197f15
sub rdx, rax
lea rcx, [rsp + 0x90]
lea rcx, [rcx + rax*2]
mov r10d, ebx
je 0x140197f08
lea r8, [rax + 0x7ffffef9]
add r8, rdx
add rax, rax
lea r9, str.OriginWeb_Cache
sub r9, rax
lea rax, [rsp + 0x90]
sub r9, rax
nop dword [rax]
test r8, r8
je 0x140197f03
cmp word [r9 + rcx], bx
je 0x140197f03
movzx eax, word [r9 + rcx]
mov word [rcx], ax
add rcx, 2
dec r8
sub rdx, 1
jne 0x140197ee0
jmp 0x140197f08
test rdx, rdx
jne 0x140197f12
sub rcx, 2
mov r10d, 0x8007007a
mov word [rcx], bx
mov dword [rsp + 0x40], r10d
test r10d, r10d
je 0x140197ffc
lea r8, [rsp + 0x40]
lea rdx, str.The_call_to_the_function_StringCbCatW_failed__result:__ld
lea rcx, [rsp + 0x68]
call fcn.140013600
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140197f46
mov rcx, qword [rax]
mov qword [rsp + 0x50], rcx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140197f52
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, str.eax::services::NetworkAccessManagerFactory::cacheDirectory
mov qword [rsp + 0x20], rax
mov r9d, 0xd1
lea r8, [0x140437188]
lea rdx, str.concatResult____HRESULT_0L_
xor ecx, ecx
call fcn.14020efc0
movzx edi, al
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x140197fe0
inc rdx
mov rcx, qword [rsp + 0x68]
cmp rdx, 0x1000
jb 0x140197fdb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140198042
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
test dil, dil
je 0x140197ffc
int3
mov r8d, 0xffffffff
lea rdx, [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const____ptr64__int_]
or ebx, 1
mov dword [rsp + 0x44], ebx
mov rax, rsi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14019e0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x160
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x168], rsi
mov rax, qword [0x140601e40]
xor rax, rbp
mov qword [rbp + 0x120], rax
xor ebx, ebx
xor dil, dil
cmp qword [rcx + 0x18], 7
mov rsi, rdx
mov qword [rbp + 8], rbx
jbe 0x14019e126
mov rcx, qword [rcx]
lea rax, [rbp + 8]
mov rdx, rcx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14019e153
xor al, al
jmp 0x14019e2f7
mov rdx, qword [str.DumpFolder]
lea rax, [rbp]
mov rcx, qword [rbp + 8]
lea r9, [rbp + 4]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rbp + 4], 2
mov dword [rbp], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14019e2e9
mov r8d, dword [rbp]
cmp r8d, 2
jbe 0x14019e2e9
lea edx, [r8 + 1]
mov rcx, rbx
add rdx, rdx
lea rax, [rdx + 0x10]
cmp rax, rdx
cmova rcx, rax
test rcx, rcx
je 0x14019e22c
lea rax, [rdx + 0x10]
mov rcx, rbx
cmp rax, rdx
cmova rcx, rax
lea rax, [rdx + 0x10]
cmp rcx, 0x400
ja 0x14019e206
cmp rax, rdx
cmova rbx, rax
lea rax, [rbx + 0xf]
cmp rax, rbx
ja 0x14019e1e8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140284120
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x14019e22c
mov dword [rbx], 0xcccc
jmp 0x14019e224
cmp rax, rdx
cmova rbx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14019e228
mov dword [rax], 0xdddd
add rbx, 0x10
mov r8d, dword [rbp]
inc r8d
xor edx, edx
add r8, r8
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [str.DumpFolder]
lea rax, [rbp]
mov rcx, qword [rbp + 8]
lea r9, [rbp + 4]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14019e2d1
mov rdi, 0xffffffffffffffff
lea rcx, [rbp + 0x10]
mov r9, rdi
mov r8d, 0x104
mov rdx, rbx
call fcn.1402fa210
lea rax, [rbp + 0x10]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14019e286
cmp rdi, qword [rsi + 0x18]
ja 0x14019e2bc
cmp qword [rsi + 0x18], 0xf
mov r14, rsi
jbe 0x14019e2a2
mov r14, qword [rsi]
mov r8, rdi
mov qword [rsi + 0x10], rdi
lea rdx, [rbp + 0x10]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rdi], 0
jmp 0x14019e2ce
lea r9, [rbp + 0x10]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.1400130d0
mov dil, 1
test rbx, rbx
je 0x14019e2e9
cmp dword [rbx - 0x10], 0xdddd
lea rcx, [rbx - 0x10]
jne 0x14019e2e9
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.140284180
mov rbx, qword [rbp + 0x160]
mov rsi, qword [rbp + 0x168]
lea rsp, [rbp + 0x130]
pop r14
pop rdi
pop rbp
ret
Function at 0x1401c7150
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x24], 0
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x1401c718b
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x1401c71c4
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x1401c71b0
lea rcx, [rsp + 0x58]
call fcn.1400451d0
mov rbx, rax
lea r8, [0x14046bd74]
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.14007ef50
nop
mov r9, rbx
mov r8, rax
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.140170f50
mov eax, 4
mov dword [rsp + 0x24], eax
and eax, 0xfffffffb
mov dword [rsp + 0x24], eax
or eax, 1
mov dword [rsp + 0x24], eax
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1401c724d
inc rdx
mov rcx, qword [rsp + 0x38]
cmp rdx, 0x1000
jb 0x1401c7248
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401c72cf
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x1401c729d
inc rdx
mov rcx, qword [rsp + 0x58]
cmp rdx, 0x1000
jb 0x1401c7298
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401c72d6
mov rcx, r8
call fcn.140283db0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140284180
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1401d4de0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
xor ebx, ebx
nop word [rax + rax]
mov r9, qword [r11]
cmp dword [r9], 0x270
jne 0x1401d4e52
lea r8, [r9 + 8]
mov r10d, 0x270
nop word [rax + rax]
mov edx, dword [r8 - 4]
mov eax, dword [r8]
lea r8, [r8 + 4]
btr eax, 0x1f
and edx, 0x80000000
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1401d4e10
jmp 0x1401d4f3a
cmp dword [r9], 0x4e0
jb 0x1401d4f3a
lea r8, [r9 + 0x9c4]
mov r10d, 0xe3
nop dword [rax]
mov edx, dword [r8 + 4]
mov eax, dword [r8]
lea r8, [r8 + 4]
and eax, 0x80000000
btr edx, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x630]
xor ecx, edx
mov dword [r8 - 0x9c4], ecx
sub r10, 1
jne 0x1401d4e70
lea rax, [r9 + 0xd50]
mov r10d, 0x18c
nop dword [rax]
mov r8d, dword [rax + 4]
mov ecx, dword [rax]
lea rax, [rax + 4]
and ecx, 0x80000000
btr r8d, 0x1f
or r8d, ecx
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax - 0xd50]
xor edx, r8d
mov dword [rax - 0x9c4], edx
sub r10, 1
jne 0x1401d4ec0
mov edx, dword [r9 + 0x1380]
mov eax, dword [r9 + 4]
and edx, 0x80000000
btr eax, 0x1f
or edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov dword [r9], ebx
mov eax, dword [r9]
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
mov eax, dword [r9 + 0x1384]
inc dword [r9]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
cmp eax, 0xffffffff
ja 0x1401d4df0
mov rbx, qword [rsp + 8]
ret
Function at 0x1401d4fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x13f0
call fcn.140284120
sub rsp, rax
mov rax, qword [0x140601e40]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov ecx, dword [0x14062d9a0]
mov rax, qword gs:[0x58]
mov edx, 0x30
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x14062c2b8], eax
jg 0x1401d507a
mov eax, dword [0x14062c2b4]
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140284180
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
mov dword [0x14062c2b4], edi
lea rcx, [0x14062c2b8]
call fcn.1402842d8
jmp 0x1401d501d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14062c2b8]
call fcn.140284344
cmp dword [0x14062c2b8], 0xffffffff
jne 0x1401d501d
call fcn.140234990
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140027320
nop
mov eax, 0x1505
lea r8, [rsp + 0x28]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
cmp rsi, 0xf
cmova r8, rbx
lea rdx, [rsp + 0x28]
cmova rdx, rbx
mov r9, qword [rsp + 0x38]
add r9, rdx
cmp r8, r9
je 0x1401d50f1
nop dword [rax]
nop dword [rax + rax]
imul eax, eax, 0x21
movsx ecx, byte [r8]
add eax, ecx
inc r8
cmp r8, r9
jne 0x1401d50e0
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
mov edx, 1
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add rax, rdx
mov eax, eax
mov dword [rsp + rdx*4 + 0x54], eax
inc rdx
cmp rdx, 0x270
jb 0x1401d5110
mov dword [rsp + 0x50], 0x270
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.1401d4de0
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x5f
ja 0x1401d5175
nop dword [rax]
lea rcx, [rsp + 0x20]
call fcn.1401d4de0
mov ecx, eax
imul rax, rcx, 0x64
cmp eax, 0x60
jb 0x1401d5160
shr rax, 0x20
lea edi, [rax + 1]
cmp rsi, 0xf
jbe 0x1401d5048
lea rdx, [rsi + 1]
cmp rdx, 0x1000
jb 0x1401d51af
add rdx, 0x27
mov rcx, qword [rbx - 8]
sub rbx, rcx
lea rax, [rbx - 8]
cmp rax, 0x1f
ja 0x1401d5073
mov rbx, rcx
mov rcx, rbx
call fcn.140283db0
jmp 0x1401d5048
Function at 0x1401d5510
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov rdi, rdx
mov rbx, rcx
movzx esi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rsi, rax
movabs rcx, 0x100000001b3
imul rsi, rcx
movzx eax, byte [r8 + 1]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 2]
xor rsi, rax
imul rsi, rcx
movzx eax, byte [r8 + 3]
xor rsi, rax
imul rsi, rcx
mov r8, qword [rbx + 0x30]
and r8, rsi
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rbp, qword [rbx + 8]
cmp rdx, rbp
je 0x1401d55d5
add r8, r8
mov rcx, qword [rax + r8*8]
mov eax, dword [r15]
cmp eax, dword [rdx + 0x10]
je 0x1401d55ae
nop
cmp rdx, rcx
je 0x1401d55d2
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1401d55a0
mov qword [rdi], rdx
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov rbp, rdx
movabs rax, 0x492492492492492
cmp qword [rbx + 0x10], rax
je 0x1401d5719
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x38], r12
lea ecx, [r12 + 0x38]
call fcn.140283d70
mov r14, rax
mov qword [rsp + 0x38], rax
lea rdx, [rax + 0x10]
mov qword [rsp + 0x70], rdx
mov ecx, dword [r15]
mov dword [rdx], ecx
xorps xmm0, xmm0
movups xmmword [rdx + 8], xmm0
movups xmmword [rdx + 0x18], xmm0
lea rcx, [rdx + 8]
mov qword [rsp + 0x80], rcx
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
mov rcx, qword [rbx + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401d5656
cvtsi2ss xmm0, rcx
jmp 0x1401d566b
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbx + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401d567e
cvtsi2ss xmm1, rcx
jmp 0x1401d5693
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbx]
jbe 0x1401d56f0
mov rcx, rbx
call fcn.1401d6510
mov r8, qword [rbx + 0x30]
and r8, rsi
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rax, qword [rbx + 8]
cmp rdx, rax
je 0x1401d56e6
add r8, r8
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + r8*8]
mov eax, dword [r14 + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x1401d56e3
cmp rdx, rcx
je 0x1401d5712
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1401d56d5
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x20]
mov qword [rsp + 0x38], r12
mov r9, r14
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.140143890
mov qword [rdi], rax
mov byte [rdi + 8], 1
jmp 0x1401d55b5
mov qword [rsp + 0x20], rdx
jmp 0x1401d56eb
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1401d5730
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r8
mov rdi, rdx
mov rbx, rcx
movzx ebp, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rbp, rax
movabs rcx, 0x100000001b3
imul rbp, rcx
movzx eax, byte [r8 + 1]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 2]
xor rbp, rax
imul rbp, rcx
movzx eax, byte [r8 + 3]
xor rbp, rax
imul rbp, rcx
mov r8, qword [rbx + 0x30]
and r8, rbp
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov r14, qword [rbx + 8]
cmp rdx, r14
je 0x1401d5800
add r8, r8
mov rcx, qword [rax + r8*8]
mov eax, dword [r15]
cmp eax, dword [rdx + 0x10]
je 0x1401d57d4
cmp rdx, rcx
je 0x1401d57fd
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1401d57c6
mov qword [rdi], rdx
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov r14, rdx
movabs rax, 0x666666666666666
cmp qword [rbx + 0x10], rax
je 0x1401d5924
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x38], r12
lea ecx, [r12 + 0x28]
call fcn.140283d70
mov rsi, rax
mov qword [rsp + 0x38], rax
mov ecx, dword [r15]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [rbx + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401d585d
cvtsi2ss xmm0, rcx
jmp 0x1401d5872
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbx + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401d5885
cvtsi2ss xmm1, rcx
jmp 0x1401d589a
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbx]
jbe 0x1401d58fb
mov rcx, rbx
call fcn.1401d65d0
mov r8, qword [rbx + 0x30]
and r8, rbp
lea rcx, [r8 + r8]
mov rax, qword [rbx + 0x18]
mov rdx, qword [rax + rcx*8 + 8]
mov rax, qword [rbx + 8]
cmp rdx, rax
je 0x1401d58f1
add r8, r8
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + r8*8]
mov eax, dword [rsi + 0x10]
cmp eax, dword [rdx + 0x10]
je 0x1401d58ee
nop dword [rax + rax]
cmp rdx, rcx
je 0x1401d591d
mov rdx, qword [rdx + 8]
cmp eax, dword [rdx + 0x10]
jne 0x1401d58e0
mov rax, qword [rdx]
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0x20]
mov qword [rsp + 0x38], r12
mov r9, rsi
mov r8, r14
mov rdx, rbp
mov rcx, rbx
call fcn.140143890
mov qword [rdi], rax
mov byte [rdi + 8], 1
jmp 0x1401d57db
mov qword [rsp + 0x20], rdx
jmp 0x1401d58f6
lea rcx, str.unordered_map_set_too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3