joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400149d0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x1400beb60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400beb40]
test rbx, rbx
je 0x140014a2c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140014a23
test rsi, rsi
je 0x140014a23
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140014a08
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140014c40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014c50
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014c60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call qword [rax]
nop
nop
sub rsp, 0x28
mov rax, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
call qword [rax]
nop
nop
nop
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140014c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140014c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140014d80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400b8fc0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140014da0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140014da8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140014da0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140014dfd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x140014df4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140014da0
add rax, 0x28
cmp rax, r9
jne 0x140014de0
xor eax, eax
ret

Function at 0x140014e00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b8fc0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140014e1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140014e28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140014e1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140014ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400b8fc0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140014edf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140014ee8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x14001b020
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
mov qword [rsp + 0x20], rax
movabs rax, 0x7520676e696e6165
mov qword [rsp + 0x28], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x30], rax
movabs rax, 0x20726f6620737965
mov qword [rsp + 0x38], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov dword [rsp + 0x87], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x14001b12a
lea rcx, [rsp + 0x20]
mov eax, 0x28
jmp 0x14001b102
add rax, 1
cmp rax, 0x6b
je 0x14001b11f
cmp byte [rcx + rax], 0
jne 0x14001b0f8
cmp eax, 0x6a
movsxd rdx, eax
je 0x14001b11f
add eax, 1
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
lea rcx, [rsp + 0x20]
mov eax, 0x28
mov edx, 0x27
jmp 0x14001b113

Function at 0x14001b4a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x1400bf650], 1
je 0x14001b518
lea rdi, [0x1400bf650]
mov rcx, rdi
call fcn.14001ada0
lea rbp, [rax + 8]
mov rbx, rax
mov rcx, rbp
call fcn.14001a720
mov esi, dword [0x1400bf650]
test esi, esi
jne 0x14001b528
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x140020678], eax
je 0x14001fef6
mov dword [0x1400bf650], 1
mov rcx, rbp
call fcn.14001aa10
test rbx, rbx
je 0x14001b518
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14001b140
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp esi, 1
je 0x14001b4f8
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, esi
mov r8, rdi
lea rdx, str._once__p_is__d_n
mov rcx, rax
call fcn.14001a1f0
jmp 0x14001b4f8
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop
Function at 0x1800141e0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rax, qword [0x180163140]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov ecx, dword [0x180168b3c]
mov rax, qword gs:[0x58]
mov rbx, qword [rax + rcx*8]
mov r15d, 0x14
cmp byte [r15 + rbx], 0
jne 0x180014232
call fcn.1800a46f8
mov r12d, 0x138
mov rdi, qword [r12 + rbx + 8]
call fcn.180060bbc
sub rdi, rax
cmp byte [r15 + rbx], 0
jne 0x180014251
call fcn.1800a46f8
mov rsi, qword [r12 + rbx + 8]
cmp byte [r15 + rbx], 0
jne 0x180014262
call fcn.1800a46f8
mov r9, rdi
mov r8, rsi
mov edx, dword [r12 + rbx]
lea rcx, str.Fatal_error__0x_08X__at_0x_p__0x_p_._nA_minidump_has_been_written._n
call fcn.18006624c
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18001428b
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.180013f64
nop
lea rax, vtable.std::_Func_impl_no_alloc_class__void___cdecl_utilities::thread::suspend_other_threads_void_::_2::_lambda_1___void__void____ptr64_.0
mov qword [rbp - 9], rax
lea rax, [rbp - 9]
mov qword [rbp + 0x2f], rax
lea rcx, [rbp - 9]
call fcn.18006cbf8
nop
mov rcx, qword [rbp + 0x2f]
test rcx, rcx
je 0x1800142d8
mov rax, qword [rcx]
lea rdx, [rbp - 9]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov ecx, 1
call qword [sym.imp.USER32.dll_ShowCursor]
test eax, eax
js 0x1800142d8
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 0xf
cmova rdx, qword [rbp - 0x29]
mov r9d, 0x10
lea r8, str.Project_BO4_ERROR
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp byte [r15 + rbx], 0
jne 0x180014316
call fcn.1800a46f8
mov ebx, dword [r12 + rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x180014363
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001435e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001438c
call fcn.1800a40c0
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1800a40a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r12
pop rbp
ret
call fcn.1800aa574
int3
Function at 0x18002282c
Capabilities:
Hash data using fnv

Disassembly:
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test rdx, rdx
je 0x18002285c
movzx eax, byte [rcx + r9]
movabs r10, 0x100000001b3
xor r8, rax
inc r9
imul r8, r10
cmp r9, rdx
jb 0x18002283e
mov rax, r8
ret

Function at 0x180023150
Capabilities:
Convert ip address from string

Disassembly:
push rbx
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov rbx, rcx
cmp qword [rcx + 0x18], 0xf
mov rdx, rcx
jbe 0x18002316b
mov rdx, qword [rcx]
lea r8, [rsp + 0x30]
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x18002318c
mov eax, dword [rsp + 0x30]
mov dword [0x180169860], eax
jmp 0x1800231b4
mov dword [0x180169860], 0x100007f
cmp qword [rbx + 0x18], 0xf
jbe 0x1800231a0
mov rbx, qword [rbx]
mov r8, rbx
lea rdx, str.__network__:_wrong_dw_server_address_specified:__s
mov ecx, 3
call fcn.18003d450
add rsp, 0x20
pop rbx
ret
Function at 0x180023688
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r12, r8
mov rsi, rdx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [r8 + rcx]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 8
jb 0x1800236b7
mov rax, qword [0x180177270]
and rax, r15
add rax, rax
mov rcx, qword [0x180177258]
mov rbx, qword [rcx + rax*8 + 8]
mov r14, qword [0x180177248]
cmp rbx, r14
jne 0x180023703
mov rbx, r14
mov rbp, r14
jmp 0x18002374a
mov rdx, qword [rcx + rax*8]
mov rax, qword [r8]
jmp 0x180023715
cmp rbx, rdx
je 0x180023744
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x18002370c
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov r14, rbx
mov rbp, rbx
movabs rax, 0x7ffffffffffffff
cmp qword [0x180177250], rax
je 0x1800238c3
lea rax, [0x180177248]
mov qword [rsp + 0x20], rax
and qword [rsp + 0x28], 0
mov ecx, 0x20
call fcn.1800a4584
mov rdi, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [r12]
mov qword [rax + 0x10], rcx
and qword [rax + 0x18], 0
mov r8, qword [0x180177250]
lea rcx, [r8 + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x1800237ac
cvtsi2ss xmm0, rcx
jmp 0x1800237c1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [0x180177278]
xorps xmm1, xmm1
test rcx, rcx
js 0x1800237d7
cvtsi2ss xmm1, rcx
jmp 0x1800237ec
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x180177240]
jbe 0x180023856
call fcn.1800238ec
mov rcx, qword [0x180177270]
and rcx, r15
add rcx, rcx
mov rdx, qword [0x180177258]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [0x180177248]
cmp rax, rbx
je 0x180023842
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rdi + 0x10]
jmp 0x180023839
mov rbx, rax
cmp rax, r8
je 0x180023899
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x18002382d
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r14, qword [rsp + 0x20]
mov r8, qword [0x180177250]
mov rdx, qword [rbx + 8]
inc r8
mov qword [0x180177250], r8
mov qword [rdi], r14
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rax, qword [0x180177270]
and rax, r15
add rax, rax
mov rcx, qword [0x180177258]
mov r8, qword [rcx + rax*8]
cmp r8, qword [0x180177248]
jne 0x1800238a0
mov qword [rcx + rax*8], rdi
jmp 0x1800238b2
mov qword [rsp + 0x20], rax
jmp 0x180023847
cmp r8, rbp
jne 0x1800238ab
mov qword [rcx + rax*8], rdi
jmp 0x1800238b7
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1800238b7
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x180023722
lea rcx, str.unordered_map_set_too_long
call fcn.1800a10e8
int3
Function at 0x1800238ec
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x180177250]
xorps xmm0, xmm0
add rcx, 1
js 0x18002390d
cvtsi2ss xmm0, rcx
jmp 0x180023922
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [0x180177240]
call fcn.1800cde64
movss xmm1, dword [0x18014ef50]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x180023954
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x180023954
movabs rax, 0x8000000000000000
mov rcx, rax
mov rdx, qword [0x180177278]
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdx, rcx
jae 0x180023989
cmp rdx, 0x200
jae 0x180023986
shl rdx, 3
cmp rdx, rcx
jae 0x180023989
mov rdx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x180023b02
mov rbx, qword [0x180177248]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180177258]
lea rdx, [rdi + rdi]
call fcn.180015dd4
mov rax, qword [0x180177248]
lea r9, [rdi - 1]
mov qword [0x180177270], r9
mov qword [0x180177278], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180023af7
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [rax + r8 + 0x10]
movabs r10, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r10
cmp r8, 8
jb 0x180023a10
mov rdi, qword [0x180177258]
and r11, r9
add r11, r11
cmp qword [rdi + r11*8], rbx
jne 0x180023a4e
mov qword [rdi + r11*8], rax
mov qword [rdi + r11*8 + 8], rax
jmp 0x180023abd
mov r10, qword [rdi + r11*8 + 8]
mov rdx, qword [rax + 0x10]
cmp rdx, qword [r10 + 0x10]
jne 0x180023a92
mov r10, qword [r10]
cmp r10, rax
je 0x180023a47
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180023a47
mov r10, qword [r10 + 8]
cmp rdx, qword [r10 + 0x10]
je 0x180023ad1
cmp qword [rdi + r11*8], r10
jne 0x180023a88
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rdi + r11*8], rax
mov rax, rcx
cmp rcx, rbx
je 0x180023af7
mov r9, qword [0x180177270]
jmp 0x180023a00
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180023abd
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1800a10e8
int3
Function at 0x18002abac
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x28
mov rbp, r8
mov r13, rdx
cmp rdx, r8
je 0x18002ac7c
mov rax, qword [rcx + 8]
mov rsi, rdx
mov r14, qword [rdx + 8]
movabs r15, 0xcbf29ce484222325
mov r12, qword [rcx + 0x18]
xor edx, edx
mov qword [rsp + 0x78], rax
movabs r8, 0x100000001b3
movzx eax, byte [rdx + r13 + 0x10]
inc rdx
xor r15, rax
imul r15, r8
cmp rdx, 4
jb 0x18002abfa
and r15, qword [rcx + 0x30]
add r15, r15
mov rax, qword [r12 + r15*8]
mov qword [rsp + 0x80], rax
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x88], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.18002b9f4
mov edx, 0x58
mov rcx, rbx
call fcn.1800a40c0
mov rdx, qword [rsp + 0x70]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x88]
je 0x18002ac90
cmp rsi, rbp
jne 0x18002ac30
cmp qword [rsp + 0x80], r13
jne 0x18002ac75
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
mov rax, rbp
add rsp, 0x28
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp qword [rsp + 0x80], r13
jne 0x18002aca8
mov r13, qword [rsp + 0x78]
mov qword [r12 + r15*8], r13
mov rax, r13
jmp 0x18002acab
mov rax, r14
mov qword [r12 + r15*8 + 8], rax
jmp 0x18002ad43
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movabs r13, 0x100000001b3
movzx eax, byte [rsi + r8 + 0x10]
inc r8
xor rcx, rax
imul rcx, r13
cmp r8, 4
jb 0x18002accc
mov r15, qword [rdx + 0x30]
mov r13, qword [rsp + 0x78]
and r15, rcx
add r15, r15
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x80], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x18]
call fcn.18002b9f4
mov edx, 0x58
mov rcx, rbx
call fcn.1800a40c0
mov rdx, qword [rsp + 0x70]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x80]
je 0x18002ad3a
cmp rsi, rbp
jne 0x18002acfe
jmp 0x18002ac71
mov qword [r12 + r15*8], r13
mov qword [r12 + r15*8 + 8], r13
cmp rsi, rbp
jne 0x18002acb5
jmp 0x18002ac75
Function at 0x18002ad54
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov rsi, rdx
mov rbp, rcx
xor ecx, ecx
movabs r15, 0xcbf29ce484222325
movzx eax, byte [rcx + r8]
xor r15, rax
movabs rdx, 0x100000001b3
imul r15, rdx
inc rcx
cmp rcx, 4
jb 0x18002ad85
mov rax, qword [rbp + 0x30]
and rax, r15
add rax, rax
mov rcx, qword [rbp + 0x18]
mov rbx, qword [rcx + rax*8 + 8]
lea rdx, [rbp + 8]
mov r12, qword [rdx]
cmp rbx, r12
jne 0x18002adcb
mov rbx, r12
mov r14, r12
jmp 0x18002ae13
mov rdx, qword [rcx + rax*8]
mov eax, dword [r8]
jmp 0x18002addd
cmp rbx, rdx
je 0x18002ae09
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x18002add4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r12, rbx
mov r14, rbx
lea rdx, [rbp + 8]
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rbp + 0x10], rax
je 0x18002af52
mov qword [rsp + 0x20], rdx
and qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.1800a4584
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18002ae5f
cvtsi2ss xmm0, rcx
jmp 0x18002ae74
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rbp + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x18002ae87
cvtsi2ss xmm1, rcx
jmp 0x18002ae9c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x18002aef4
mov rcx, rbp
call fcn.18002b21c
mov rcx, qword [rbp + 0x30]
and rcx, r15
add rcx, rcx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rbp + 8]
cmp rax, rbx
je 0x18002aee7
mov r8, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
jmp 0x18002aedf
mov rbx, rax
cmp rax, r8
je 0x18002af28
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x18002aed3
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov r14, rbx
mov r12, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], r12
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rbp + 8]
jne 0x18002af2f
mov qword [rcx + rax*8], rdi
jmp 0x18002af41
mov qword [rsp + 0x20], rax
jmp 0x18002aeec
cmp r8, r14
jne 0x18002af3a
mov qword [rcx + rax*8], rdi
jmp 0x18002af46
cmp qword [rcx + rax*8 + 8], rdx
jne 0x18002af46
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x18002ade9
lea rcx, str.unordered_map_set_too_long
call fcn.1800a10e8
int3
Function at 0x18002b21c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x18002b24c
cvtsi2ss xmm0, rdx
jmp 0x18002b261
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1800cde64
movss xmm1, dword [0x18014ef50]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x18002b28f
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18002b28f
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18002b2bd
cmp rbx, 0x200
jae 0x18002b2ba
shl rbx, 3
cmp rbx, rcx
jae 0x18002b2bd
mov rbx, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rbx, rax
ja 0x18002b427
mov rsi, qword [rdi + 8]
lea rax, [rbx - 1]
or rax, 1
mov ebx, 1
bsr rcx, rax
mov r8, rsi
inc ecx
shl rbx, cl
lea rcx, [rdi + 0x18]
lea rdx, [rbx + rbx]
call fcn.180015dd4
mov qword [rdi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rdi + 0x30], rax
mov rcx, qword [rdi + 8]
mov rcx, qword [rcx]
cmp rcx, rsi
je 0x18002b3eb
mov rax, rcx
mov rcx, qword [rcx]
movabs r11, 0xcbf29ce484222325
xor r8d, r8d
movzx edx, byte [rax + r8 + 0x10]
movabs r9, 0x100000001b3
xor r11, rdx
inc r8
imul r11, r9
cmp r8, 4
jb 0x18002b335
and r11, qword [rdi + 0x30]
mov rbx, qword [rdi + 0x18]
add r11, r11
cmp qword [rbx + r11*8], rsi
jne 0x18002b371
mov qword [rbx + r11*8], rax
mov qword [rbx + r11*8 + 8], rax
jmp 0x18002b3df
mov r10, qword [rbx + r11*8 + 8]
mov edx, dword [rax + 0x10]
cmp edx, dword [r10 + 0x10]
jne 0x18002b3b4
mov r10, qword [r10]
cmp r10, rax
je 0x18002b36a
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18002b36a
mov r10, qword [r10 + 8]
cmp edx, dword [r10 + 0x10]
je 0x18002b401
cmp qword [rbx + r11*8], r10
jne 0x18002b3aa
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [rbx + r11*8], rax
mov rax, rcx
cmp rcx, rsi
jne 0x18002b325
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov r10, qword [r10]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x18002b3df
lea rcx, str.invalid_hash_bucket_count
call fcn.1800a10e8
int3