joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a530
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [0x14009b4c0]
cmp byte [rbx + 0x3031], 0
jne 0x14001a68b
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a684
lea rdx, [0x14006153c]
mov qword [rsp + 0x38], rdi
call fcn.14000d300
mov rdi, rax
test rax, rax
je 0x14001a67f
mov qword [rsp + 0x40], r14
mov rcx, rax
mov qword [rsp + 0x30], rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov r14d, eax
cmp eax, 0xffffffff
je 0x14001a66c
xor edx, edx
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001a66c
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbp, eax
cmp ebp, 0xffffffff
je 0x14001a66c
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14001a66c
mov r14, rbp
cmp rbp, 0xffffffffffffffff
je 0x14001a66c
mov rax, qword [0x14009b4c0]
test rax, rax
je 0x14001a5fb
inc dword [rax + 0x3b4]
mov rdx, qword [0x14009b4d0]
mov rcx, r14
call qword [0x140073010]
mov rbp, rax
test rax, rax
je 0x14001a66c
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rdi
cmp rax, r14
je 0x14001a637
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x14001a648
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdx, r14
mov rcx, rbp
call fcn.14000f280
mov rax, qword [0x14009b4c0]
test rax, rax
je 0x14001a65a
dec dword [rax + 0x3b4]
mov rdx, qword [0x14009b4d0]
mov rcx, rbp
call qword [0x140073018]
jmp 0x14001a675
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov byte [rbx + 0x3031], 1
movss xmm0, dword [rbx + 0x3034]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14001a6ce
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x3034], xmm0
jb 0x14001a6ce
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14001a6bd
call fcn.140017f40
jmp 0x14001a6c4
mov byte [rbx + 0x39c], 1
mov dword [rbx + 0x3034], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x14002dbc0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14009a140]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14000ca20
mov rcx, qword [0x14009b538]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov rdi, rax
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x14009b540]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14009b548]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x14009b540], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rdi + 0x138], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rdi + 0x139], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x13b], 0
mov byte [rdi + 0x13a], al
call fcn.14000ca20
mov rbx, rax
cmp byte [rax + 0x393], 0
je 0x14002dd03
cvttss2si ecx, dword [rax + 0x120]
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x38], ecx
cvttss2si ecx, dword [rax + 0x124]
mov dword [rsp + 0x3c], ecx
mov rcx, qword [0x14009b538]
call qword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x14002dd03
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx + 0x120], 0xff7fffff
mov dword [rbx + 0x124], 0xff7fffff
call qword [sym.imp.USER32.dll_GetActiveWindow]
cmp rax, qword [0x14009b538]
jne 0x14002dd6d
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x14002dd6d
mov rcx, qword [0x14009b538]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14002dd6d
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx + 0x120], xmm0
movss dword [rbx + 0x124], xmm1
cmp byte [rdi + 0xc0], 0
je 0x14002dd7d
mov eax, 0xffffffff
jmp 0x14002dd82
call fcn.14000caf0
cmp dword [0x1400731d0], eax
je 0x14002dd95
mov dword [0x1400731d0], eax
call fcn.14002e120
call fcn.14002de20
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005d330
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x140030710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x190]
mov r10, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x4000
movss xmm0, dword [rbx + 0x34]
je 0x14003074c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0xd8]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0xf0], xmm0
subss xmm0, dword [r9 + 0x10]
movss dword [r9 + 0xdc], xmm1
subss xmm0, dword [r9 + 0x118]
movss dword [r9 + 0x11c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x110], eax
movsx eax, byte [rbx + 0x61]
mov dword [r9 + 0x14c], eax
movss dword [r9 + 0x234], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x238], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1c4], eax
cmp byte [rbx + 0x5a], 0
jne 0x1400307e7
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0xdc], xmm1
movzx eax, byte [rbx + 0x5f]
mov byte [r9 + 0x93], al
cmp byte [rbx + 0x5f], 0
je 0x140030801
xor eax, eax
mov qword [r9 + 0x124], rax
test dword [rcx + 4], 0x100000
je 0x140030812
mov r8d, 2
jmp 0x140030888
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2b0]
movss xmm1, dword [rbx + 0x20]
movss xmm2, dword [rbx + 0x24]
movss xmm3, dword [rbx + 0x28]
movss xmm4, dword [rbx + 0x2c]
movups xmmword [r9 + 0x250], xmm0
movss dword [rax + 0x88], xmm1
movss dword [rax + 0x8c], xmm2
movss dword [rax + 0x90], xmm3
movss dword [rax + 0x94], xmm4
mov rax, qword [r9 + 0x2b0]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movss dword [rcx + rdx*8 - 0x10], xmm1
movss dword [rcx + rdx*8 - 0xc], xmm2
movss dword [rcx + rdx*8 - 8], xmm3
movss dword [rcx + rdx*8 - 4], xmm4
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x2b0]
mov rcx, qword [r10 + 0x1a8]
call fcn.1400245e0
mov rdi, qword [0x14009b4c0]
cmp byte [rdi + 0x308c], 0
je 0x1400308cd
cmp byte [rbx + 0x5f], 0
jne 0x1400308cd
xor r8d, r8d
lea rdx, [0x140065660]
mov rcx, rsi
call fcn.14000f5e0
mov dword [rdi + 0x30c0], 0x7f7fffff
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140033240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14009b4c0]
mov rcx, qword [rax + 0x1ff0]
mov r10, qword [rax + 0x1c10]
movsxd rax, dword [rcx + 0x7c]
movups xmm0, xmmword [rcx + 0x174]
movss xmm4, dword [rcx + 0x174]
movss xmm3, dword [rcx + 0x178]
movss xmm2, dword [rcx + 0x17c]
movss xmm1, dword [rcx + 0x180]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x2b0]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x250], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2b0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x2b0]
mov rcx, qword [rcx + 0x1a8]
add rsp, 0x38
jmp fcn.1400245e0

Function at 0x140033310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14009b4c0]
mov rcx, qword [rax + 0x1ff0]
mov r9, qword [rax + 0x1c10]
movups xmm0, xmmword [r9 + 0x250]
movups xmmword [rcx + 0x174], xmm0
mov rax, qword [r9 + 0x2b0]
movups xmm0, xmmword [rcx + 0x154]
movss xmm4, dword [rcx + 0x154]
movss xmm3, dword [rcx + 0x158]
movss xmm2, dword [rcx + 0x15c]
movss xmm1, dword [rcx + 0x160]
movups xmmword [r9 + 0x250], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2b0]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x1d7]
mov rcx, qword [rcx + 0x1a8]
mov rdx, qword [r9 + 0x2b0]
add rsp, 0x38
jmp fcn.1400245e0
Function at 0x140037be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14009a140]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140037c20
cmp al, 0x25
jne 0x140037c14
cmp byte [r8 + 1], al
jne 0x140037c20
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140037c07
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140037d7e
cmp byte [r8 + 1], dl
je 0x140037d7e
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140037c5d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140037c85
sub dl, 0x61
cmp dl, 0x19
ja 0x140037c77
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140037c85
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140037c40
jmp 0x140037c88
inc r9
cmp r8, r9
jae 0x140037cbf
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140037cb4
bt rdx, rax
jb 0x140037cba
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140037ca0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.14000d450
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140037cf8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140037cf0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140037d6c
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x140037d18
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x140037d5a
movss xmm2, dword [0x140061658]
cmp al, 0x39
ja 0x140037d5a
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140037d34
cmp r8b, 0x2d
jne 0x140037d79
xorps xmm1, xmmword [0x1400616d0]
movaps xmm0, xmm1
jmp 0x140037d81
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140037d81
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005d330
add rsp, 0x90
pop rbx
ret
Function at 0x140037da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14009a140]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140037de0
cmp al, 0x25
jne 0x140037dd4
cmp byte [r8 + 1], al
jne 0x140037de0
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140037dc7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140037f38
cmp byte [r8 + 1], dl
je 0x140037f38
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140037e1d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140037e45
sub dl, 0x61
cmp dl, 0x19
ja 0x140037e37
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140037e45
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140037e00
jmp 0x140037e48
inc r9
cmp r8, r9
jae 0x140037e7f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140037e74
bt rdx, rax
jb 0x140037e7a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140037e60
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.14000d450
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140037eb8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140037eb0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140037f2a
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x140037ed8
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x140037f18
movsd xmm2, qword [0x140065d70]
cmp al, 0x39
ja 0x140037f18
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140037ef4
cmp r8b, 0x2d
jne 0x140037f33
xorps xmm1, xmmword [0x140065e00]
movaps xmm0, xmm1
jmp 0x140037f3b
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140037f3b
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005d330
add rsp, 0x90
pop rbx
ret
Function at 0x14004c1a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14004c34d
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14004c060
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14004c316
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14004c290
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14004c305
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14004c2cd
mov r10, qword [rdx]
cmp r10, rax
je 0x14004c2c7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14004c305
cmp r9, rdx
je 0x14004c2e1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14004c327
cmp r9, rdx
jne 0x14004c2d2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14004c240
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14004c305
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14004f0a0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
test rdi, rdi
je 0x14004f14c
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14004f14c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14004f0e3
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x14004f500
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14004f11a
mov qword [rsp + 0x48], rbx
nop
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.14005ceb0
mov rcx, rbx
test rbx, rbx
jne 0x14004f100
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.14004ba20
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14004f604
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005ceb0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x14004f610
cmp rbx, rbp
jne 0x14004f5b0
cmp qword [rsp + 0x20], r14
jne 0x14004f5dd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14004f61f
mov qword [r15], r12
mov rax, r12
jmp 0x14004f622
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14004f5dd
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005ceb0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14004f6a8
cmp rbx, rbp
jne 0x14004f682
jmp 0x14004f5da
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14004f630
jmp 0x14004f5dd
Function at 0x14004f500
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, qword [rcx]
test rdi, rdi
je 0x14004f14c
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14004f14c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14004f0e3
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x30
pop rdi
jmp 0x14004f500
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14004f11a
mov qword [rsp + 0x48], rbx
nop
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.14005ceb0
mov rcx, rbx
test rbx, rbx
jne 0x14004f100
mov rbx, qword [rsp + 0x48]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x20]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x20], rax
call fcn.14004ba20
add rsp, 0x30
pop rdi
ret
mov rax, rsp
push rbp
push rsi
push r14
sub rsp, 0x50
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14004f604
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rax + 0x10], rbx
mov rbx, r14
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
mov qword [rax - 0x20], r13
mov r13, qword [r14 + 8]
mov qword [rax - 0x28], r15
movabs rax, 0xcbf29ce484222325
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x11]
imul rcx, r8
mov qword [rsp + 0x30], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x20], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x28], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005ceb0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x28]
je 0x14004f610
cmp rbx, rbp
jne 0x14004f5b0
cmp qword [rsp + 0x20], r14
jne 0x14004f5dd
mov qword [r15], rbx
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x78]
mov rax, rbp
add rsp, 0x50
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x20], r14
jne 0x14004f61f
mov qword [r15], r12
mov rax, r12
jmp 0x14004f622
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14004f5dd
nop dword [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x30]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x20
call fcn.14005ceb0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14004f6a8
cmp rbx, rbp
jne 0x14004f682
jmp 0x14004f5da
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14004f630
jmp 0x14004f5dd
Function at 0x140050d80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
movzx eax, byte [rdx]
mov byte [rcx], al
mov eax, dword [rdx + 4]
mov dword [rcx + 4], eax
movsd xmm0, qword [rdx + 8]
movsd qword [rcx + 8], xmm0
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x10], eax
movups xmm0, xmmword [rdx + 0x14]
movups xmmword [rcx + 0x14], xmm0
movups xmm1, xmmword [rdx + 0x24]
movups xmmword [rcx + 0x24], xmm1
mov eax, dword [rdx + 0x34]
mov dword [rcx + 0x34], eax
mov eax, dword [rdx + 0x38]
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x3c]
mov dword [rcx + 0x3c], eax
movzx eax, byte [rdx + 0x40]
mov byte [rcx + 0x40], al
movzx eax, byte [rdx + 0x41]
mov byte [rcx + 0x41], al
movsd xmm0, qword [rdx + 0x44]
movsd qword [rcx + 0x44], xmm0
mov eax, dword [rdx + 0x4c]
mov dword [rcx + 0x4c], eax
movsd xmm0, qword [rdx + 0x50]
movsd qword [rcx + 0x50], xmm0
movsd xmm0, qword [rdx + 0x58]
movsd qword [rcx + 0x58], xmm0
mov eax, dword [rdx + 0x60]
mov dword [rcx + 0x60], eax
lea rbx, [rcx + 0x68]
mov qword [rsp + 0x48], rbx
mov eax, dword [rdx + 0x68]
mov dword [rbx], eax
xor ebp, ebp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
mov ecx, 0x20
call fcn.14005ce74
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov rax, qword [rdi + 0x98]
mov qword [rbx + 0x30], rax
mov rax, qword [rdi + 0xa0]
mov qword [rbx + 0x38], rax
mov rdx, qword [rdi + 0x88]
sub rdx, qword [rdi + 0x80]
sar rdx, 3
mov r8, qword [rbx + 8]
call fcn.14004c060
mov r8, qword [rdi + 0x70]
mov rdx, qword [r8]
mov rcx, rbx
call fcn.14004b200
nop
movups xmm0, xmmword [rdi + 0xa8]
movups xmmword [rsi + 0xa8], xmm0
movsd xmm1, qword [rdi + 0xb8]
movsd qword [rsi + 0xb8], xmm1
mov eax, dword [rdi + 0xc0]
mov dword [rsi + 0xc0], eax
movzx eax, byte [rdi + 0xc4]
mov byte [rsi + 0xc4], al
mov rax, rsi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret