joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180032030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x180032054
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180032097
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x180032097
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x1800321c8
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800320da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180032105
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800321cd
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18003217a
sub eax, 1
je 0x18003217a
cmp eax, 2
jne 0x1800321c8
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x1800321cd
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x1800321ab
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800321c8
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800321cd
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x1800321f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800322b9
cmp byte [rcx + 0x71], 0
je 0x1800322b9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800322ac
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180032268
sub eax, 1
je 0x18003226c
cmp eax, 2
jne 0x1800322ac
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x18003229a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1800322ac
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x180048450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
test rax, rax
je 0x180048599
mov rax, qword [rax + 0x18]
test rax, rax
je 0x180048599
lea rsi, [rax + 0x20]
mov rbx, qword [rsi]
cmp rsi, rbx
je 0x18004858a
nop word [rax + rax]
lea rdi, [rbx - 0x10]
test rdi, rdi
je 0x18004857e
cmp qword [rdi + 0x50], 0
je 0x18004857e
mov ecx, 0x58
call fcn.1800ffa74
mov qword [rsp + 0x60], rax
mov rdx, rdi
mov rcx, rax
call fcn.1800482a0
mov rdi, rax
lea rcx, [rax + 0x20]
cmp qword [rax + 0x38], 0xf
jbe 0x1800484e4
mov rcx, qword [rax + 0x20]
mov r11, qword [rax + 0x30]
mov r10d, ebp
add r11, rcx
cmp rcx, r11
je 0x18004853d
nop dword [rax]
nop word [rax + rax]
movsx r9d, byte [rcx]
mov r8d, r9d
sub r9b, 0x41
movzx eax, r8b
or al, 0x20
movzx edx, al
movzx eax, r8b
cmp r9b, 0x19
cmova edx, eax
movsx eax, dl
add eax, r10d
imul r10d, eax, 0x401
mov eax, r10d
shr eax, 6
xor r10d, eax
inc rcx
cmp rcx, r11
jne 0x180048500
lea ecx, [r10 + r10*8]
mov eax, ecx
shr eax, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [0x1801ade38]
call fcn.1800485b0
nop
lea rcx, [rsp + 0x28]
call fcn.18002fa20
nop
mov rbx, qword [rbx]
cmp rsi, rbx
jne 0x1800484a0
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
xor al, al
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800488f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180048928
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001e550
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180048a66
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800489e0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180048a55
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180048a1d
mov r10, qword [rdx]
cmp r10, rax
je 0x180048a17
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180048a55
cmp r9, rdx
je 0x180048a31
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180048a7b
cmp r9, rdx
jne 0x180048a22
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180048990
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180048a55
Function at 0x180063a10
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [0x1801d3bb8], 0
mov rdi, rcx
je 0x180063be0
movzx eax, byte [0x1801ad2a0]
nop
test al, al
je 0x180063be0
mov qword [rsp + 0x40], rbx
xor r8b, r8b
mov qword [rsp + 0x50], rbp
xor al, al
mov qword [rsp + 0x58], rsi
movabs rbp, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
mov byte [rsp + 0x48], r8b
nop dword [rax]
nop dword [rax + rax]
movzx edx, al
mov rax, qword [0x1801d3bb8]
lea rbx, [rax + rdx*8]
cmp qword [rbx + 0x180], 0
je 0x180063ae6
mov rax, qword [0x1801d39b8]
movzx ecx, r8b
mov rbx, qword [rbx + 0x180]
call rax
cmp rax, rbx
jne 0x180063ae0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x20]
test al, al
je 0x180063ae0
mov rax, qword [0x1801d39b8]
movzx ecx, byte [rsp + 0x48]
call rax
lea r8, [rsp + 0x48]
mov rcx, rdi
lea rdx, [rsp + 0x20]
mov rbx, rax
call fcn.180063bf0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
jmp 0x180063bb5
movzx r8d, byte [rsp + 0x48]
mov rcx, qword [rdi + 0x30]
lea rdx, [rdi + 0x30]
mov rax, qword [rdi + 0x18]
lea r10, [rdi + 0x18]
movzx r11d, r8b
lea r9, [rdi + 8]
xor r11, rsi
imul r11, rbp
and rcx, r11
shl rcx, 4
add rax, rcx
mov rcx, qword [rax + 8]
cmp rcx, qword [r9]
je 0x180063b4a
mov rax, qword [rax]
cmp r8b, byte [rcx + 0x10]
je 0x180063b4c
cmp rcx, rax
je 0x180063b3e
mov rcx, qword [rcx + 8]
cmp r8b, byte [rcx + 0x10]
jne 0x180063b21
lea r10, [rdi + 0x18]
lea rdx, [rdi + 0x30]
lea r9, [rdi + 8]
jmp 0x180063b4c
lea r10, [rdi + 0x18]
lea rdx, [rdi + 0x30]
lea r9, [rdi + 8]
xor ecx, ecx
test rcx, rcx
je 0x180063bbb
mov rax, qword [r10]
mov rdx, qword [rdx]
and rdx, r11
add rdx, rdx
lea r10, [rax + rdx*8]
lea r8, [rax + rdx*8]
mov rax, qword [rax + rdx*8]
cmp qword [r10 + 8], rcx
jne 0x180063b8a
cmp rax, rcx
jne 0x180063b80
mov rax, qword [r9]
mov qword [r8], rax
mov qword [r10 + 8], rax
jmp 0x180063b95
mov rax, qword [rcx + 8]
mov qword [r10 + 8], rax
jmp 0x180063b95
cmp rax, rcx
jne 0x180063b95
mov rax, qword [rcx]
mov qword [r8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1800ffa38
movzx r8d, byte [rsp + 0x48]
inc r8b
mov byte [rsp + 0x48], r8b
movzx eax, r8b
cmp r8b, 0x20
jb 0x180063a70
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180063ec0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x180063ef8
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001e550
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180064014
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x180063f92
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180064003
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x180063fcb
mov r10, qword [rdx]
cmp r10, rax
je 0x180063fc5
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180064003
cmp r8, rdx
je 0x180063fdf
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x180064029
cmp r8, rdx
jne 0x180063fd0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x180063f60
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180064003
Function at 0x1800a66d0
Capabilities:
Hash data using fnv

Disassembly:
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
and rdx, r8
xor r8d, r8d
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, qword [r9 + 8]
je 0x1800a6759
mov ecx, dword [r10]
mov rdx, qword [rdx]
cmp ecx, dword [rax + 0x10]
je 0x1800a675c
nop dword [rax]
cmp rax, rdx
je 0x1800a6759
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1800a6740
test rax, rax
setne r8b
mov rax, r8
ret
mov rax, r8
test rax, rax
setne r8b
mov rax, r8
ret
Function at 0x1800a6af0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x1800a6b28
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.18001e550
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1800a6c66
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x1800a6be0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800a6c55
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1800a6c1d
mov r10, qword [rdx]
cmp r10, rax
je 0x1800a6c17
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800a6c55
cmp r9, rdx
je 0x1800a6c31
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1800a6c7b
cmp r9, rdx
jne 0x1800a6c22
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1800a6b90
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800a6c55
Function at 0x1800b44d0
Capabilities:
Encode data using xor

Disassembly:
push rdi
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r10b
jne 0x1800b44e2
add rax, r11
cmp r11, rax
je 0x1800b453d
mov qword [rsp + 0x10], rbx
mov rbx, r11
nop dword [rax + rax]
movzx r9d, byte [rbx]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc rbx
movsx ecx, dl
add ecx, r10d
imul r10d, ecx, 0x401
mov ecx, r10d
shr ecx, 6
xor r10d, ecx
cmp rbx, rax
jne 0x1800b4500
mov rbx, qword [rsp + 0x10]
lea eax, [r10 + r10*8]
mov qword [rdi + 8], r11
mov ecx, eax
shr ecx, 0xb
xor ecx, eax
imul eax, ecx, 0x8001
mov dword [rdi], eax
mov rax, rdi
pop rdi
ret

Function at 0x1800b4560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, str.CSectorDataNode
mov r11, rcx
mov r10, rbx
lea rdi, [0x18016c827]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rdi
jne 0x1800b4580
mov rdi, qword [rsp + 0x10]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rbx
mov rbx, qword [rsp + 8]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800b45e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, str.CVehicleProximityMigrationDataNode
mov r11, rcx
mov r10, rbx
lea rdi, [0x18016cc4a]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rdi
jne 0x1800b4600
mov rdi, qword [rsp + 0x10]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rbx
mov rbx, qword [rsp + 8]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800b4660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, str.CPropSetUncommonGameStateDataNode
mov r11, rcx
mov r10, rbx
lea rdi, [0x18016d1e1]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rdi
jne 0x1800b4680
mov rdi, qword [rsp + 0x10]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rbx
mov rbx, qword [rsp + 8]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret
Function at 0x1800b46e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, str.CIncidentPointOfInterestFinderDataNode
mov r11, rcx
mov r10, rbx
lea rdi, [0x18016d69e]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rdi
jne 0x1800b4700
mov rdi, qword [rsp + 0x10]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rbx
mov rbx, qword [rsp + 8]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret

Function at 0x1800b4760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rbx, str.CGuardZonePointOfInterestFinderDataNode
mov r11, rcx
mov r10, rbx
lea rdi, [0x18016d587]
xor eax, eax
movzx r9d, byte [r10]
movzx edx, r9b
or dl, 0x20
movzx ecx, dl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova ecx, r9d
inc r10
movsx ecx, cl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, rdi
jne 0x1800b4780
mov rdi, qword [rsp + 0x10]
lea ecx, [rax + rax*8]
mov eax, ecx
mov qword [r11 + 8], rbx
mov rbx, qword [rsp + 8]
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov dword [r11], eax
mov rax, r11
ret
Function at 0x1800b4b20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1800b4b58
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.18001e550
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800b4cc4
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1800b4c3c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800b4cb3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x1800b4c79
mov r10, qword [rdx]
cmp r10, rax
je 0x1800b4c73
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800b4cb3
cmp r9, rdx
je 0x1800b4c8f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1800b4cd9
cmp r9, rdx
jne 0x1800b4c80
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800b4bc0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800b4cb3
Function at 0x1800b6100
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp ebx, 1
jne 0x1800b6150
lea rax, [0x1801ad294]
mov qword [0x1801d3788], rdi
mov qword [rsp + 0x28], rax
lea r8, [0x1800b5c90]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1801ad298], rax
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret

Function at 0x1800b6380
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rcx]
xor eax, eax
mov r11, qword [rcx + 8]
add r11, r10
cmp r10, r11
je 0x1800b63c5
movzx r9d, byte [r10]
movzx ecx, r9b
or cl, 0x20
movzx edx, cl
lea r8d, [r9 - 0x41]
cmp r8b, 0x19
cmova edx, r9d
inc r10
movsx ecx, dl
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp r10, r11
jne 0x1800b6391
lea ecx, [rax + rax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret