joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180095a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.180091a90
cmp qword [rdi + 0x18], 0x10
jb 0x180095a8a
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x180095a97
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180095ab3
sub rsi, rbx
nop
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180095aa0
mov r8, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180095ac4
mov rcx, qword [rdi]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180095af3
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rdx
cmp rdx, r8
jb 0x180095ae0
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18009a100
cmp qword [rax + 8], 0
setne bl
mov rcx, rdi
call fcn.18007ab20
movzx eax, bl
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180114c00
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x180095b40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x38], r8
xor r12d, r12d
mov rcx, r8
call fcn.180091a90
cmp qword [rdi + 0x18], 0x10
jb 0x180095b92
mov r14, qword [rdi]
mov rbp, r14
add rbp, qword [rdi + 0x10]
mov rbx, r14
jmp 0x180095b9f
mov r14, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180095bbb
sub r14, rbx
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [r14 + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180095ba7
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180095bcc
mov rdx, qword [rdi]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
test r8, r8
je 0x180095c03
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180095bf0
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.18009a100
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x180095c3c
cmp rdx, qword [r15 + 8]
je 0x180095c3c
mov rdx, qword [rdx + 0x30]
shl rdx, 6
add rdx, 0x20
add rdx, qword [r15 + 0x40]
mov rcx, rsi
call fcn.18007a6b0
jmp 0x180095c51
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, rdi
call fcn.18007ab20
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180114c00
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180095c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], rdx
mov rcx, rdx
call fcn.180091a90
cmp qword [rdi + 0x18], 0x10
jb 0x180095ccf
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x180095cdc
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180095cf7
sub rsi, rbx
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180095ce4
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180095d08
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180095d43
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180095d30
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.18009a100
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x180095d6f
cmp rbx, qword [r14 + 8]
je 0x180095d6f
mov rbx, qword [rbx + 0x30]
lea rsi, [r14 + 0x40]
jmp 0x180095e3f
lea rsi, [r14 + 0x40]
mov rbx, qword [rsi + 8]
sub rbx, qword [rsi]
sar rbx, 6
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.180099830
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movdqa xmm6, xmmword [0x180266e80]
movdqu xmmword [rsp + 0x38], xmm6
mov byte [rsp + 0x28], 0
mov rbp, qword [rsi + 8]
cmp rbp, qword [rsi + 0x10]
je 0x180095df3
mov rdx, rdi
mov rcx, rbp
call fcn.18007a6b0
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x38], 0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm6
mov edx, 0xf
mov byte [rsp + 0x28], 0
add qword [rsi + 8], 0x40
jmp 0x180095e0b
lea r9, [rsp + 0x28]
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.18009ae40
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180095e3f
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180095e3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180095e79
call fcn.180114c20
shl rbx, 6
add rbx, qword [rsi]
mov rcx, rdi
call fcn.18007ab20
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180114c00
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18011d534
nop
int3
Function at 0x180095f20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rdx
mov qword [rsp + 0x28], rdx
mov r12, rcx
mov qword [rsp + 0x40], rdx
mov rcx, rdx
call fcn.180091a90
cmp qword [r14 + 0x18], 0x10
jb 0x180095f71
mov rdi, qword [r14]
mov rsi, rdi
mov rbx, rdi
add rsi, qword [r14 + 0x10]
jmp 0x180095f7e
mov rbx, r14
mov rsi, qword [r14 + 0x10]
add rsi, r14
mov rdi, r14
cmp rbx, rsi
je 0x180095f99
sub rdi, rbx
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x180095f86
mov r8, qword [r14 + 0x10]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180095faa
mov rdx, qword [r14]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180095fe3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180095fd0
mov r8, r14
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.18009a100
mov r13, qword [rax + 8]
test r13, r13
je 0x18009612d
cmp r13, qword [r12 + 8]
je 0x18009612d
mov rsi, qword [r13 + 0x30]
mov qword [rsp + 0x30], rsi
imul r15, rsi, 0x78
add r15, qword [r12 + 0x40]
mov rax, qword [r12 + 0x48]
lea rbp, [r15 + 0x78]
cmp rbp, rax
je 0x1800960c3
lea rsi, [r15 + 0x20]
lea rbx, [rbp + 0x60]
mov r14, rax
nop word [rax + rax]
mov rdx, rbp
mov rcx, r15
call fcn.1800812a0
lea rax, [rbx - 0x40]
lea rdi, [rsi + 0x40]
cmp rsi, rax
je 0x180096089
mov qword [rsp + 0x20], rsi
mov eax, dword [rax]
mov dword [rsi], eax
mov r8, qword [rbx - 0x38]
mov rdx, qword [r8]
lea rcx, [rdi - 0x38]
call fcn.18009bc20
mov rdx, qword [rdi - 0x30]
mov rcx, rsi
call fcn.180099f60
mov rdx, rax
mov rcx, rsi
call fcn.180099ce0
nop
cmp rdi, rbx
je 0x1800960a4
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
sar r8, 6
mov rcx, rdi
call fcn.18009b930
add r15, 0x78
add rsi, 0x78
add rbp, 0x78
add rbx, 0x78
cmp rbp, r14
jne 0x180096040
mov r14, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [r12 + 0x48]
lea rcx, [rdi - 0x18]
call fcn.180095e80
lea rcx, [rdi - 0x58]
call fcn.1800943b0
lea rcx, [rdi - 0x78]
call fcn.18007ab20
add qword [r12 + 0x48], 0xffffffffffffff88
mov r8, r13
lea rdx, [rsp + 0x40]
mov rcx, r12
call fcn.180099250
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
cmp rax, rcx
je 0x180096121
mov rdx, qword [rax + 0x30]
cmp rdx, rsi
jbe 0x180096116
dec rdx
mov qword [rax + 0x30], rdx
mov rdx, qword [rax]
mov rax, rdx
cmp rdx, rcx
jne 0x180096106
mov rcx, r14
call fcn.18007ab20
mov al, 1
jmp 0x180096137
mov rcx, r14
call fcn.18007ab20
xor al, al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180114c00
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180096160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, r8
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x38], r8
xor r12d, r12d
mov rcx, r8
call fcn.180091a90
cmp qword [rdi + 0x18], 0x10
jb 0x1800961b2
mov r14, qword [rdi]
mov rbp, r14
add rbp, qword [rdi + 0x10]
mov rbx, r14
jmp 0x1800961bf
mov r14, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x1800961db
sub r14, rbx
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [r14 + rbx], al
inc rbx
cmp rbx, rbp
jne 0x1800961c7
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800961ec
mov rdx, qword [rdi]
movabs r9, 0xcbf29ce484222325
mov rcx, r12
test r8, r8
je 0x180096223
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180096210
mov r8, rdi
lea rdx, [rsp + 0x28]
mov rcx, r15
call fcn.18009a100
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180096259
cmp rcx, qword [r15 + 8]
je 0x180096259
imul rdx, qword [rcx + 0x30], 0x78
add rdx, 0x20
add rdx, qword [r15 + 0x40]
mov rcx, rsi
call fcn.180097c30
jmp 0x18009626d
mov rcx, rsi
call fcn.180098400
mov qword [rsi + 0x40], r12
mov qword [rsi + 0x48], r12
mov qword [rsi + 0x50], r12
mov rcx, rdi
call fcn.18007ab20
mov rax, rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180114c00
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800962a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x30], rdx
mov rcx, rdx
call fcn.180091a90
cmp qword [rdi + 0x18], 0x10
jb 0x1800962ea
mov rsi, qword [rdi]
mov rbp, rsi
add rbp, qword [rdi + 0x10]
mov rbx, rsi
jmp 0x1800962f7
mov rsi, rdi
mov rbp, qword [rdi + 0x10]
add rbp, rdi
mov rbx, rdi
cmp rbx, rbp
je 0x180096313
sub rsi, rbx
nop
movsx ecx, byte [rbx]
call fcn.18011bda4
mov byte [rsi + rbx], al
inc rbx
cmp rbx, rbp
jne 0x180096300
mov r8, qword [rdi + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180096324
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x180096353
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x180096340
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18009a100
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180096378
cmp rcx, qword [r14 + 8]
je 0x180096378
mov rax, qword [rcx + 0x30]
jmp 0x180096383
mov rdx, rdi
mov rcx, r14
call fcn.180097eb0
imul rbx, rax, 0x78
add rbx, qword [r14 + 0x40]
mov rcx, rdi
call fcn.18007ab20
lea rax, [rbx + 0x20]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180114c00
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x180096910
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180096941
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x1800969bb
mov rdi, r14
mov rcx, rbx
call fcn.18007aa70
test rax, rax
jle 0x180096993
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.180117360
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1800969ab
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1800969b3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180096955
sub r14, rdi
jmp 0x180096a9f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1800969d2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800969d4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180096a06
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180117360
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180096a9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180096a41
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x180096a7d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.180126300
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x180096a9c
cmp rbp, rax
ja 0x180096a50
test rbp, rbp
je 0x180096a9c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.180126300
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180099250
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rbx, r8
mov r14, rdx
mov rbp, rcx
jb 0x180099286
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1800992c4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x1800992b0
mov rdx, qword [rbp + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [rbp + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1800992f8
cmp rax, rbx
jne 0x1800992ee
mov rax, qword [rbp + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x180099303
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x180099303
cmp rax, rbx
jne 0x180099303
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rbp + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.18007ab20
mov edx, 0x38
mov rcx, rbx
call fcn.180114c20
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18009c7e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r13
push r14
sub rsp, 0x178
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r13d, r13d
mov r14, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x18009c80d
mov rcx, qword [rcx]
mov qword [rsp + 0x198], rbx
mov qword [rsp + 0x1a0], rbp
mov qword [rsp + 0x1a8], rsi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x168], r12
mov qword [rsp + 0x160], r15
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18009c9c9
mov rdi, qword [r14 + 0x10]
test rdi, rdi
je 0x18009ca58
mov rbp, r13
lea r12, [0x1801dd450]
nop dword [rax]
nop word [rax + rax]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r12 + rbx], r13b
jne 0x18009c877
mov r15, qword [r14 + 0x18]
mov rsi, r14
cmp r15, 0x10
jb 0x18009c890
mov rsi, qword [r14]
test rbx, rbx
je 0x18009c8f6
cmp rbp, rdi
jae 0x18009c8f6
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.180117b80
lea rdx, [rbx + r12]
mov rcx, r12
cmp r12, rdx
je 0x18009c8d0
nop dword [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [rsp + rax + 0x50], 1
cmp rcx, rdx
jne 0x18009c8c0
lea rdx, [rdi + rsi]
lea rax, [rsi + rbp]
cmp rax, rdx
jae 0x18009c8f6
nop dword [rax]
movzx ecx, byte [rax]
cmp byte [rsp + rcx + 0x50], r13b
jne 0x18009ca17
inc rax
cmp rax, rdx
jb 0x18009c8e0
mov rax, 0xffffffffffffffff
cmp rax, 0xffffffffffffffff
mov qword [rsp + 0x38], r13
mov rbx, rdi
mov qword [rsp + 0x40], r13
cmovne rbx, rax
xorps xmm0, xmm0
cmp rdi, rbx
mov r8, rbx
movups xmmword [rsp + 0x28], xmm0
cmovb r8, rdi
mov rdx, r14
cmp r15, 0x10
jb 0x18009c930
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
call fcn.18007b490
cmp qword [rsp + 0x38], r13
je 0x18009c97b
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x18009c97b
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call fcn.1801271a8
test eax, eax
jne 0x18009ca1f
mov rdx, qword [rsp + 0x40]
lea rbp, [rbx + 1]
cmp rdx, 0x10
jb 0x18009c9bc
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009c9b7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009ca5f
call fcn.180114c20
mov rdi, qword [r14 + 0x10]
cmp rbp, rdi
jb 0x18009c870
mov al, 1
mov r15, qword [rsp + 0x160]
mov r12, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
mov rsi, qword [rsp + 0x1a8]
mov rbp, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180114c00
add rsp, 0x178
pop r14
pop r13
ret
sub rax, rsi
jmp 0x18009c8fd
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18009ca58
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009ca53
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18009ca5f
call fcn.180114c20
xor al, al
jmp 0x18009c9cb
call fcn.18011d534
int3
Function at 0x1800a2240
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1802ad098]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800a2424
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.180113a08
test eax, eax
jne 0x1800a2451
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x1800a245c
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v9::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x1800a23b8
mov r8, qword [rsi + 0x28]
cmp qword [rsi + 0x30], r8
jbe 0x1800a23b8
test r8, r8
je 0x1800a2318
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x1800a2339
lea ebp, [rax + 7]
jmp 0x1800a2354
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x28]
cmp r8, rcx
jbe 0x1800a237e
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsp + 0x60]
cmp r8, rcx
jbe 0x1800a23dc
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x1800a23dc
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x1800a241c
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800a2416
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800a244b
call fcn.180114c20
nop
mov rcx, rbx
call fcn.180113a10
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180114c00
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.18011d534
nop
mov ecx, 5
call fcn.1801137b0
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.1801137b0
int3
Function at 0x1800a73c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1800a754f
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.180098de0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1800a7514
mov qword [rsp + 0x38], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rbp
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1800a748f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1800a7503
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x1800a74c8
mov r10, qword [rdx]
cmp r10, rax
je 0x1800a74c2
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1800a7503
cmp r8, rdx
je 0x1800a74df
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x1800a7529
cmp r8, rdx
jne 0x1800a74d0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1800a7460
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1800a7503
lea rcx, str.invalid_hash_bucket_count
call fcn.1801120c4
int3
Function at 0x1800c08f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800c0924
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800c0910
ret