joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051180
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x14005123e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x140051240
cmp rax, rdx
je 0x14005123e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140051221
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
Function at 0x140054b30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140054d13
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140054610
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140054cd8
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x140054c4c
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140054cc7
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x140054c89
mov r10, qword [rax]
cmp r10, rcx
je 0x140054c83
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140054cc7
mov r8, rax
cmp r10, rax
je 0x140054ca3
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x140054ced
cmp r10, rax
jne 0x140054c91
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140054bd0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140054cc7
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140059320
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x48], 0
mov rcx, rsi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14005946e
mov byte [rsp + 0x48], 1
cmp dword [rdi + 0x18], eax
jne 0x140059476
lea rcx, [rdi + 0xf8]
cmp rcx, rbx
je 0x14005938e
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140059386
mov rbx, qword [rbx]
mov rdx, rbx
call fcn.140011f30
mov dword [rdi + 0x18], 2
lea rcx, [rdi + 0x540]
call fcn.14005ecf0
lea rax, [0x140055c70]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov dword [rsp + 0x58], ebx
lea ecx, [rbx + 0x20]
call fcn.1401dcf70
test rax, rax
je 0x1400593d2
mov qword [rax], rbp
mov qword [rax + 8], rdi
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm0
jmp 0x1400593d5
mov rax, rbx
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14004e270]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005945f
cmp dword [rsp + 0x38], 0
je 0x1400594ae
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x140059457
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call fcn.1401dce01
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 2
lea rcx, [rsp + 0x60]
call fcn.140059e00
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140053080
lea rdx, [0x1402ca738]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x14005a910
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
movzx esi, r9b
movzx ebp, r8b
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x130], 0
je 0x14005a980
mov dword [rsp + 0x40], reloc.WS2_32.dll_ntohl
lea rax, str.xr_
mov qword [rsp + 0x48], rax
add rcx, 0x5e0
lea r8, [rsp + 0x40]
lea rdx, [fcn.140054380]
call fcn.140051400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdi, [rcx + 0x20]
mov qword [rsp + 0x40], rdi
mov byte [rsp + 0x48], 0
mov rcx, rdi
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x14005aa74
mov byte [rsp + 0x48], 1
cmp dword [rbx + 0x18], 1
jne 0x14005aa7c
mov dword [rbx + 0x18], 3
mov rcx, rdi
call fcn.1401dce01
lea rcx, [rbx + 0x540]
call fcn.14005ecf0
lea rax, [0x140056590]
mov qword [rsp + 0x40], rax
xor edi, edi
mov dword [rsp + 0x48], edi
lea ecx, [rdi + 0x28]
call fcn.1401dcf70
test rax, rax
je 0x14005aa01
mov byte [rax], sil
mov byte [rax + 1], bpl
mov qword [rax + 8], r14
mov qword [rax + 0x10], rbx
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + 0x18], xmm0
jmp 0x14005aa04
mov rax, rdi
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14004e2b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14005aa65
cmp dword [rsp + 0x38], 0
je 0x14005aab4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x14005aa5d
jmp 0x14005a968
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], edi
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov edx, 3
lea rcx, [rsp + 0x60]
call fcn.140059e00
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140053080
lea rdx, [0x1402ca738]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140064ea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x1400650b6
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140064f64
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140064f20
mov ecx, dword [r10]
jmp 0x140065047
cmp ecx, 0x4e0
jb 0x140065047
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140064f80
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140064fd0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x140064f00
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x140064ef0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x1400650da
cmp r8, r14
jne 0x140064ed0
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x1400657f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140065894
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140065850
mov ecx, dword [r10]
jmp 0x140065977
cmp ecx, 0x4e0
jb 0x140065977
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400658b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140065900
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x140065830
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x140065820
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140072940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
xor edx, edx
mov r8d, 0x400
movzx ebp, r9b
mov r14, rcx
call sub.VCRUNTIME140.dll_memset
lea r15d, [rbx - 1]
xor r12d, r12d
mov ecx, r15d
mov r13d, 1
mov edi, r13d
movzx r11d, r12w
shl rdi, cl
mov ecx, 0x20
sub ecx, ebx
mov ebx, 0xffffffff
shr ebx, cl
mov ecx, 0x80
nop dword [rax]
nop word [rax + rax]
mov edx, r12d
movzx r9d, r11w
movzx eax, r13w
nop dword [rax + rax]
movzx r10d, cx
or r10w, ax
movzx r8d, r10w
and r8w, r9w
cmp r8w, cx
je 0x1400729dc
cmp r8w, ax
jne 0x1400729e0
xor r9w, r10w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x1400729c0
mov r8d, 8
test r13b, r9b
mov eax, r12d
mov ecx, r12d
cmovne eax, edi
xor edx, eax
test edx, edi
cmovne ecx, esi
shr r9w, 1
lea eax, [rdx + rdx]
mov edx, ecx
xor edx, eax
sub r8d, r13d
jne 0x1400729f1
and edx, ebx
test bpl, bpl
je 0x140072a8d
mov ecx, r15d
mov eax, r13d
shl eax, cl
mov r8d, r13d
cmp eax, r13d
jbe 0x140072a51
nop dword [rax + rax]
mov r9d, eax
or r9d, r8d
mov ecx, r9d
and ecx, edx
cmp ecx, eax
je 0x140072a44
cmp ecx, r8d
jne 0x140072a47
xor edx, r9d
shr eax, 1
add r8d, r8d
cmp eax, r8d
ja 0x140072a30
movzx r10d, r11w
movzx eax, r13w
mov ecx, 0x80
nop
movzx r9d, cx
or r9w, ax
movzx r8d, r9w
and r8w, r10w
cmp r8w, cx
je 0x140072a7c
cmp r8w, ax
jne 0x140072a80
xor r10w, r9w
shr cx, 1
add ax, ax
cmp cx, ax
ja 0x140072a60
jmp 0x140072a91
movzx r10d, r11w
movzx eax, r10w
inc r11w
mov dword [r14 + rax*4], edx
mov eax, 0x100
lea ecx, [rax - 0x80]
cmp r11w, ax
jb 0x1400729b0
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ee0c0
Capabilities:
Create thread

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
lea rbx, [rcx + 0x30]
mov qword [rsp + 0xc0], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400ee26c
cmp dword [rsi + 0x2c], eax
je 0x1400ee131
mov dword [rsp + 0x30], 2
lea rax, [0x1402e6f48]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400ee256
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400ee23a
mov dword [rsi + 0x2c], 1
mov rcx, rsi
call fcn.1400ee800
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x48]
mov qword [rsp + 0xd0], rax
xor r14d, r14d
mov qword [rsp + 0x80], r14
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1400ee178
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
call qword [rax]
mov qword [rsp + 0x80], rax
mov ecx, 0x48
call fcn.1401dcf70
mov rdi, rax
mov qword [rsp + 0xd0], rax
test rax, rax
je 0x1400ee1c5
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
lea rbp, [rdi + 8]
mov qword [rsp + 0xd8], rbp
mov qword [rbp + 0x38], r14
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400ee1c3
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax]
mov qword [rbp + 0x38], rax
jmp 0x1400ee1c8
mov rdi, r14
mov qword [rsp + 0xd0], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rdi
lea r8, [0x1400dd010]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400ee25c
cmp dword [rsi + 0xd0], 0
jne 0x1400ee24f
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movups xmmword [rsi + 0xc8], xmm1
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1400ee23a
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov rcx, rbx
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.1401dce01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
int3
Function at 0x14012a960
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx edi, byte [r8]
mov r12, rdx
movabs rdx, 0x100000001b3
mov r9, rcx
mov rcx, qword [rcx + 0x50]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
dec rcx
movzx eax, byte [r8 + 1]
xor r13d, r13d
mov r15, qword [r9 + 0x38]
imul rdi, rdx
mov qword [rsp + 0x78], rcx
lea r14, [r13 - 1]
xor rdi, rax
movzx eax, byte [r8 + 2]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 3]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 4]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 5]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 6]
imul rdi, rdx
xor rdi, rax
movzx eax, byte [r8 + 7]
imul rdi, rdx
xor rdi, rax
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdi, rdx
and rdi, rcx
mul rdi
movzx r8d, di
mov rbx, rdx
mov edx, 1
shr rbx, 5
movzx eax, bx
mov rsi, rbx
add ax, ax
shl rsi, 4
lea ecx, [rax + rbx]
shl cx, 4
sub r8w, cx
movzx eax, r8w
mov ecx, r8d
shr rax, 3
and ecx, 7
add rax, r15
shl dx, cl
movzx eax, byte [rax + rsi + 0xa]
and dx, ax
je 0x14012ab58
movzx ebp, di
nop dword [rax + rax]
cmp qword [r9 + 0x30], 0
je 0x14012aab6
test dx, dx
je 0x14012aab6
lea rcx, [r15 + 0xa]
movzx edx, r8w
add rcx, rsi
call fcn.14012fa90
mov r9, qword [rsp + 0x60]
movzx ecx, ax
mov rax, qword [r15 + rsi]
shl rcx, 5
mov rcx, qword [rcx + rax]
cmp qword [r9 + 0x28], rcx
jne 0x14012aab6
cmp r14, 0xffffffffffffffff
mov rax, rdi
cmovne rax, r14
mov r14, rax
jmp 0x14012aaf3
movzx eax, bx
lea rcx, [r15 + 0xa]
add bx, bx
add rcx, rsi
add ax, bx
shl ax, 4
sub bp, ax
movzx edx, bp
call fcn.14012fa90
movzx ecx, ax
mov rax, qword [r15 + rsi]
shl rcx, 5
mov rcx, qword [rcx + rax]
mov rax, qword [rsp + 0x70]
cmp qword [rax], rcx
je 0x14012ab6d
mov r9, qword [rsp + 0x60]
inc r13
movabs rax, 0xaaaaaaaaaaaaaaab
add rdi, r13
and rdi, qword [rsp + 0x78]
mul rdi
movzx r8d, di
movzx ebp, di
mov rbx, rdx
mov edx, 1
shr rbx, 5
movzx eax, bx
mov rsi, rbx
add ax, ax
shl rsi, 4
lea ecx, [rax + rbx]
shl cx, 4
sub r8w, cx
movzx eax, r8w
mov ecx, r8d
shr rax, 3
and ecx, 7
add rax, r15
shl dx, cl
movzx eax, byte [rax + rsi + 0xa]
and dx, ax
jne 0x14012aa70
mov qword [r12], 0xffffffffffffffff
cmp r14, 0xffffffffffffffff
jne 0x14012ab7c
mov qword [r12 + 8], rdi
jmp 0x14012ab81
mov qword [r12], rdi
mov qword [r12 + 8], 0xffffffffffffffff
jmp 0x14012ab81
mov qword [r12 + 8], r14
mov rbx, qword [rsp + 0x68]
mov rax, r12
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140156970
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov qword [rdx], 0
movzx eax, word [r8 + 8]
mov word [rdx + 8], ax
test ax, ax
je 0x140156a21
movzx edi, word [r8 + 8]
mov ecx, edi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x1401569e3
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, edi
lea rdx, [0x140274670]
call fcn.14016b3f0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [r15], rax
mov rdi, qword [r14]
movzx esi, word [r14 + 8]
shl rsi, 5
add rsi, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
cmp rdi, rsi
je 0x140156a21
mov rdx, rdi
mov rcx, rbx
call fcn.14014f380
add rbx, 0x20
mov qword [rsp + 0x28], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x140156a04
mov eax, dword [r14 + 0xa]
mov dword [r15 + 0xa], eax
movzx eax, word [r14 + 0xe]
mov word [r15 + 0xe], ax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret

Function at 0x140156a50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov r14, r8
mov r15, rdx
mov qword [rdx], 0
movzx eax, word [r8 + 8]
mov word [rdx + 8], ax
test ax, ax
je 0x140156b01
movzx edi, word [r8 + 8]
mov ecx, edi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140156ac3
lea ecx, [rax + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov r8d, edi
lea rdx, [0x140274670]
call fcn.14016b3f0
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [r15], rax
mov rdi, qword [r14]
movzx esi, word [r14 + 8]
shl rsi, 5
add rsi, rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
cmp rdi, rsi
je 0x140156b01
mov rdx, rdi
mov rcx, rbx
call fcn.14014f450
add rbx, 0x20
mov qword [rsp + 0x28], rbx
add rdi, 0x20
cmp rdi, rsi
jne 0x140156ae4
mov eax, dword [r14 + 0xa]
mov dword [r15 + 0xa], eax
movzx eax, word [r14 + 0xe]
mov word [r15 + 0xe], ax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret