joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019c980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov r15, qword [rdx + 0x18]
mov rdi, rdx
mov rsi, qword [rdx + 0x10]
mov r10, rcx
mov r9, rdx
cmp r15, 0x10
jb 0x14019c9ac
mov r9, qword [rdx]
xor ebp, ebp
movabs r8, 0xcbf29ce484222325
mov edx, ebp
test rsi, rsi
je 0x14019c9e4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, rsi
jb 0x14019c9d0
mov rcx, qword [r10 + 0x30]
mov rax, qword [r10 + 0x18]
and rcx, r8
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, qword [r10 + 8]
jne 0x14019ca02
mov rbx, rbp
jmp 0x14019ca52
mov qword [rsp + 0x40], r14
mov r14, qword [rax + rcx*8]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x14019ca22
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x14019ca2e
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x14019ca3f
mov r8, rsi
call fcn.14039baa0
test eax, eax
je 0x14019ca4d
cmp rbx, r14
je 0x14019ca4a
mov rbx, qword [rbx + 8]
jmp 0x14019ca10
mov rbx, rbp
mov r14, qword [rsp + 0x40]
test rbx, rbx
mov rbx, qword [rsp + 0x48]
setne bpl
mov rax, rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret

Function at 0x14019d520
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, qword [r8 + 0x18]
mov r14, rdx
mov rsi, qword [r8 + 0x10]
mov rdi, r8
mov rdx, rcx
mov r10, r8
cmp r15, 0x10
jb 0x14019d556
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rsi, rsi
je 0x14019d594
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rsi
jb 0x14019d580
mov rcx, qword [rdx + 0x30]
mov rax, qword [rdx + 0x18]
and rcx, r9
mov r12, qword [rdx + 8]
add rcx, rcx
mov qword [rsp + 0x40], rbp
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, r12
je 0x14019d604
mov rbp, qword [rax + rcx*8]
nop dword [rax]
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x14019d5d2
mov rdx, qword [rdx]
mov rcx, rdi
cmp r15, 0x10
jb 0x14019d5de
mov rcx, qword [rdi]
cmp rsi, rax
jne 0x14019d5ef
mov r8, rsi
call fcn.14039baa0
test eax, eax
je 0x14019d5fa
cmp rbx, rbp
je 0x14019d604
mov rbx, qword [rbx + 8]
jmp 0x14019d5c0
test rbx, rbx
je 0x14019d604
mov qword [r14], rbx
jmp 0x14019d607
mov qword [r14], r12
mov rbp, qword [rsp + 0x40]
mov rax, r14
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14019f530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14019f773
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r12, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r12
call fcn.1401460c0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x28], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x14019f752
movabs rax, 0xcbf29ce484222325
movabs r10, 0x100000001b3
nop dword [rax]
mov rsi, qword [rsi]
mov r15, qword [rdi + 0x20]
lea r8, [rdi + 0x10]
mov r9, qword [rdi + 0x28]
cmp r9, 0x10
jb 0x14019f5e9
mov r8, qword [rdi + 0x10]
mov rdx, rax
xor ecx, ecx
test r15, r15
je 0x14019f614
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r10
inc rcx
cmp rcx, r15
jb 0x14019f600
mov r13, qword [r13 + 0x30]
and r13, rdx
shl r13, 4
add r13, qword [r12]
mov r12, qword [r13]
cmp r12, rbp
jne 0x14019f639
mov qword [r13], rdi
mov qword [r13 + 8], rdi
jmp 0x14019f733
mov rbx, qword [r13 + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14019f64f
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x14019f65d
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x14019f6a4
mov r8, r15
call fcn.14039baa0
test eax, eax
jne 0x14019f6a0
mov rax, qword [rbx]
cmp rax, rdi
je 0x14019f697
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r13 + 8], rdi
jmp 0x14019f729
mov r9, qword [rdi + 0x28]
cmp r12, rbx
je 0x14019f704
mov rbx, qword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14019f6bf
mov rdx, qword [rdx]
lea rcx, [rdi + 0x10]
cmp r9, 0x10
jb 0x14019f6cd
mov rcx, qword [rdi + 0x10]
cmp r15, rax
jne 0x14019f6a4
mov r8, r15
call fcn.14039baa0
test eax, eax
jne 0x14019f6a0
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x14019f729
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r13], rdi
movabs r10, 0x100000001b3
mov rdi, rsi
cmp rsi, rbp
mov r13, qword [rsp + 0x20]
lea r12, [r13 + 0x18]
movabs rax, 0xcbf29ce484222325
jne 0x14019f5d0
mov qword [rsp + 0x28], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140373cac
int3
Function at 0x14019f780
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r13, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14019f9c9
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea rdi, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, rdi
call fcn.1401460c0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0xc8], r13
mov rbx, qword [r13 + 8]
mov rbx, qword [rbx]
mov rsi, rbx
cmp rbx, rbp
je 0x14019f9a5
nop word [rax + rax]
mov rsi, qword [rsi]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xb8]
call fcn.14017e570
movsxd rcx, dword [rax + 8]
imul r15, rcx, 0x1000193
imul rax, qword [rax], 0x100011b
xor r15, rax
and r15, qword [r13 + 0x30]
add r15, r15
mov r14, qword [rdi]
cmp qword [r14 + r15*8], rbp
jne 0x14019f864
mov qword [r14 + r15*8], rbx
mov qword [r14 + r15*8 + 8], rbx
jmp 0x14019f999
mov rdi, qword [r14 + r15*8 + 8]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0xb8], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xb8]
call fcn.14017e570
mov r12, rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.14017e570
mov rcx, qword [r12]
cmp qword [rax], rcx
jne 0x14019f8ee
mov ecx, dword [r12 + 8]
cmp dword [rax + 8], ecx
jne 0x14019f8ee
mov rax, qword [rdi]
cmp rax, rbx
je 0x14019f8e4
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
mov qword [r14 + r15*8 + 8], rbx
jmp 0x14019f995
cmp qword [r14 + r15*8], rdi
je 0x14019f970
mov rdi, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0xb8], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xb8]
call fcn.14017e570
mov r12, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0xc0]
call fcn.14017e570
mov rcx, qword [r12]
cmp qword [rax], rcx
jne 0x14019f8ee
mov ecx, dword [r12 + 8]
cmp dword [rax + 8], ecx
jne 0x14019f8ee
mov rax, qword [rdi]
mov r8, qword [rbx + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rbx + 8], rcx
jmp 0x14019f995
mov rdx, qword [rbx + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov qword [rdi + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r14 + r15*8], rbx
lea rdi, [r13 + 0x18]
mov rbx, rsi
cmp rsi, rbp
jne 0x14019f810
mov qword [rsp + 0xc8], 0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140373cac
int3
Function at 0x14019f9e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r13, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14019fbc7
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea rdx, [rbx + rbx]
mov r8, rbp
lea rcx, [r13 + 0x18]
call fcn.1401460c0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x90], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x14019fb7d
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rsi]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x88]
call fcn.14017e1f0
xor ecx, ecx
mov r8, qword [rax + 8]
mov r9, qword [rax + 0x10]
add r9, r8
cmp r8, r9
jae 0x14019fac3
nop dword [rax]
nop word [rax + rax]
lea rcx, [rcx + rcx*4]
movzx edx, byte [r8]
add rcx, rdx
inc r8
cmp r8, r9
jb 0x14019fab0
imul r14, qword [rax], 0x1000193
xor r14, rcx
and r14, qword [r13 + 0x30]
shl r14, 4
add r14, qword [r13 + 0x18]
cmp qword [r14], rbp
jne 0x14019faea
mov qword [r14], rdi
mov qword [r14 + 8], rdi
jmp 0x14019fb71
mov rbx, qword [r14 + 8]
lea r8, [rbx + 0x10]
lea rdx, [rdi + 0x10]
call fcn.1401a31c0
test al, al
jne 0x14019fb2e
mov rax, qword [rbx]
cmp rax, rdi
je 0x14019fb28
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r14 + 8], rdi
jmp 0x14019fb71
cmp qword [r14], rbx
je 0x14019fb4d
mov rbx, qword [rbx + 8]
lea r8, [rbx + 0x10]
lea rdx, [rdi + 0x10]
call fcn.1401a31c0
test al, al
je 0x14019fba1
cmp qword [r14], rbx
jne 0x14019fb33
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r14], rdi
mov rdi, rsi
cmp rsi, rbp
jne 0x14019fa70
mov qword [rsp + 0x90], 0
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x14019fb71
lea rcx, str.invalid_hash_bucket_count
call fcn.140373cac
int3
Function at 0x1401a3960
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, rcx
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1401a3ba5
lea rax, [rdx - 1]
or rax, rbx
bsr rcx, rax
inc ecx
shl rbx, cl
mov rbp, qword [r13 + 8]
lea r14, [r13 + 0x18]
lea rdx, [rbx + rbx]
mov r8, rbp
mov rcx, r14
call fcn.1401460c0
lea rax, [rbx - 1]
mov qword [r13 + 0x30], rax
mov qword [r13 + 0x38], rbx
mov qword [rsp + 0x20], r13
mov rdi, qword [r13 + 8]
mov rdi, qword [rdi]
mov rsi, rdi
cmp rdi, rbp
je 0x1401a3b84
nop dword [rax]
nop word [rax + rax]
mov rsi, qword [rsi]
xor eax, eax
mov rdx, qword [rdi + 0x18]
mov r8, qword [rdi + 0x20]
add r8, rdx
cmp rdx, r8
jae 0x1401a3a22
nop word [rax + rax]
lea rax, [rax + rax*4]
movzx ecx, byte [rdx]
add rax, rcx
inc rdx
cmp rdx, r8
jb 0x1401a3a10
mov r12, qword [rdi + 0x10]
imul r15, r12, 0x1000193
xor r15, rax
and r15, qword [r13 + 0x30]
shl r15, 4
add r15, qword [r14]
mov r14, qword [r15]
cmp r14, rbp
jne 0x1401a3a4f
mov qword [r15], rdi
mov qword [r15 + 8], rdi
jmp 0x1401a3b74
mov rbx, qword [r15 + 8]
cmp r12, qword [rbx + 0x10]
jne 0x1401a3ad3
movups xmm1, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rdi + 0x18]
movaps xmmword [rsp + 0x30], xmm0
psrldq xmm0, 8
movq r8, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp r8, rax
jne 0x1401a3ad3
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
cmp rcx, rdx
je 0x1401a3aa1
test r8, r8
je 0x1401a3aa1
call fcn.14039baa0
test eax, eax
jne 0x1401a3ad3
mov rax, qword [rbx]
cmp rax, rdi
je 0x1401a3aca
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
mov qword [r15 + 8], rdi
jmp 0x1401a3b74
cmp r14, rbx
je 0x1401a3b50
mov rbx, qword [rbx + 8]
cmp r12, qword [rbx + 0x10]
jne 0x1401a3ad3
movups xmm1, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rdi + 0x18]
movaps xmmword [rsp + 0x40], xmm0
psrldq xmm0, 8
movq r8, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp r8, rax
jne 0x1401a3ad3
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
cmp rcx, rdx
je 0x1401a3b2a
test r8, r8
je 0x1401a3b2a
call fcn.14039baa0
test eax, eax
jne 0x1401a3ad3
mov rax, qword [rbx]
mov r8, qword [rdi + 8]
mov qword [r8], rsi
mov rdx, qword [rsi + 8]
mov qword [rdx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov qword [rax + 8], rdx
mov qword [rsi + 8], r8
mov qword [rdi + 8], rcx
jmp 0x1401a3b74
mov rdx, qword [rdi + 8]
mov qword [rdx], rsi
mov rcx, qword [rsi + 8]
mov qword [rcx], rbx
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rbx + 8], rcx
mov qword [rsi + 8], rdx
mov qword [rdi + 8], rax
mov qword [r15], rdi
mov rdi, rsi
cmp rsi, rbp
lea r14, [r13 + 0x18]
jne 0x1401a39f0
mov qword [rsp + 0x20], 0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.140373cac
int3
Function at 0x1401a9010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbp, rcx
mov r12, qword [rcx + 8]
mov rcx, qword [rcx + 0x28]
cmp r12, 1
jne 0x1401a908e
mov qword [rbp + 0x18], 8
mov qword [rbp + 8], 8
test rcx, rcx
jne 0x1401a905e
lea ecx, [r12 + 0x3f]
call fcn.1403982c8
jmp 0x1401a9068
mov edx, 0x40
call fcn.140174f30
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
mov qword [rbp + 0x20], rax
mov rax, rbp
shr rax, 4
mov qword [rbp + 0x10], rax
jmp 0x1401a9217
mov r15, qword [rbp + 0x20]
mov qword [rbp + 8], rdx
lea rbx, [rdx*8]
test rcx, rcx
jne 0x1401a90ad
mov rcx, rbx
call fcn.1403982c8
jmp 0x1401a90ba
lea rdx, [rbx + 7]
and rdx, 0xfffffffffffffff8
call fcn.140174f30
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14039b120
mov qword [rbp + 0x20], rdi
mov r14, qword [rbp + 0x18]
mov rax, qword [rbp + 8]
mov qword [rbp + 0x18], rax
cmp r14, r12
jae 0x1401a9200
movabs r13, 0x9e3779b97f4a7c15
nop dword [rax]
mov rsi, qword [r15 + r14*8]
mov rax, r14
xor rax, 1
test rsi, rsi
je 0x1401a91f4
cmp rsi, qword [r15 + rax*8]
je 0x1401a914f
nop word [rax + rax]
mov rbx, qword [rsi + 0x38]
mov rdx, rsi
call fcn.1401a4570
xor rax, qword [rbp + 0x10]
imul rax, r13
shr rax, 0x20
mov r8, qword [rbp + 8]
dec r8
and r8, rax
mov r9, rsi
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.1401a8e00
mov rsi, rbx
test rbx, rbx
jne 0x1401a9110
jmp 0x1401a91f4
inc r14
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
nop dword [rax]
mov rdi, qword [rbx + 0x28]
mov rdx, qword [rbx + 0x20]
call fcn.1401a4570
xor rax, qword [rbp + 0x10]
imul rax, r13
shr rax, 0x20
mov r8, qword [rbp + 8]
dec r8
and r8, rax
mov r9, rdi
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.1401a8e00
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x1401a91bf
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401a91ba
cmp rbx, qword [rax + 0x10]
jne 0x1401a91ba
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401a91a7
mov rbx, rax
jmp 0x1401a91df
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x1401a91df
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x1401a91d0
cmp rbx, qword [rsi + 8]
jne 0x1401a9160
mov rdx, rsi
mov rcx, rbp
call fcn.1401a8680
inc r14
cmp r14, r12
jb 0x1401a90f0
cmp qword [rbp + 0x28], 0
jne 0x1401a9217
lea rdx, [r12*8]
mov rcx, r15
call fcn.140398020
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401ac500
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
mov rsi, qword [0x1405b2b40]
mov rdi, r8
mov r11d, edx
test rsi, rsi
je 0x1401ac663
mov rbx, qword [rcx + 8]
xorps xmm0, xmm0
mov dword [rax - 0x30], edx
movabs rcx, 0xcbf29ce484222325
movups xmmword [rax - 0x28], xmm0
mov qword [rax - 0x38], rbx
movabs rdx, 0x100000001b3
mov word [rax - 0x2c], 0
mov byte [rax - 0x2a], 0
mov qword [rax - 0x18], 0
mov rax, rbx
shr rax, 8
movzx r10d, al
movzx eax, bl
xor rax, rcx
imul rax, rdx
xor r10, rax
mov rax, rbx
imul r10, rdx
shr rax, 0x10
movzx ecx, al
mov rax, rbx
xor r10, rcx
shr rax, 0x18
imul r10, rdx
movzx ecx, al
mov rax, rbx
xor r10, rcx
shr rax, 0x20
imul r10, rdx
movzx ecx, al
mov rax, rbx
xor r10, rcx
shr rax, 0x28
imul r10, rdx
movzx ecx, al
mov rax, rbx
xor r10, rcx
shr rax, 0x30
imul r10, rdx
movzx ecx, al
mov rax, rbx
xor r10, rcx
shr rax, 0x38
imul r10, rdx
lea rcx, [rsp + 0x28]
xor r10, rax
imul r10, rdx
call fcn.1400ed1b8
mov rcx, qword [rsi + 0x18]
xor rax, r10
and rax, qword [rsi + 0x30]
mov rdx, qword [rsi + 8]
shl rax, 4
add rcx, rax
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1401ac663
mov rcx, qword [rcx]
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401ac61c
cmp r11d, dword [rax + 0x18]
je 0x1401ac627
cmp rax, rcx
je 0x1401ac663
mov rax, qword [rax + 8]
jmp 0x1401ac610
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1401ac663
add rax, 0x10
je 0x1401ac663
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [rax + 0x20]
mov al, 1
movsd qword [rdi + 0x20], xmm0
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
xor al, al
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1401f0540
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rbp
push rsi
mov rbp, rsp
sub rsp, 0x68
mov rsi, rcx
call fcn.1401f0420
xor r8d, r8d
mov dword [rbp - 0x48], eax
mov edx, eax
mov rcx, rsi
call fcn.140139930
mov dword [rbp - 0x48], eax
test al, 1
je 0x1401f07b2
mov rax, qword [0x1405b84d0]
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x58], r14
test rax, rax
je 0x1401f059e
mov rax, qword [0x1405b84d0]
test rax, rax
je 0x1401f059e
call rax
jmp 0x1401f05a7
rdtsc
shl rdx, 0x20
or rax, rdx
mov ecx, dword [rbp - 0x48]
xor ebx, ebx
mov r14, rax
mov edi, ebx
sar r14, 1
test cl, 1
je 0x1401f079d
mov qword [rsp + 0x98], r12
lea edx, [rbx + 0x20]
mov qword [rsp + 0x60], r13
lea r12d, [rbx + 0x10]
mov qword [rsp + 0x50], r15
movabs r13, 0x5deece66d
mov r15d, 0x1fffffff
test ecx, 0xfffffff8
jne 0x1401f066b
or ecx, 8
mov dword [rbp - 0x38], ecx
lea rcx, [rbp - 0x48]
call fcn.1400db5e0
lea rcx, [rbp - 0x38]
mov r8d, eax
call fcn.1400db5e0
mov rcx, rsi
mov edx, eax
call fcn.140075d10
mov rcx, rax
mov eax, r8d
lock cmpxchg dword [rcx], edx
mov dword [rbp - 0x30], eax
jne 0x1401f0628
or dword [rbp - 0x48], 8
jmp 0x1401f0666
mov r8d, 4
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x48]
call fcn.14039b2e0
mov ecx, dword [rbp - 0x48]
test cl, 1
jne 0x1401f065a
mov edx, ecx
mov r8d, ebx
mov rcx, rsi
call fcn.140139930
mov ecx, eax
mov dword [rbp - 0x48], eax
jmp 0x1401f077d
test ecx, 0xfffffff8
je 0x1401f077d
mov edx, 0x20
add edi, 1
je 0x1401f06c7
cmp edi, 1
jne 0x1401f0679
xor ecx, ecx
jmp 0x1401f06c1
mov r8, qword [0x1405b5c30]
mov eax, edi
imul r8, r13
add r8, 0xb
cmp edi, 0x20
mov qword [0x1405b5c30], r8
cmova eax, edx
cdq
and edx, 7
lea ecx, [rdx + rax]
mov eax, 0x20000
sar ecx, 3
shl eax, cl
lea ecx, [rax - 1]
and ecx, r8d
or ecx, eax
mov eax, 0x431bde83
imul ecx
sar edx, 0x12
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
call fcn.1401f0420
mov dword [rbp - 0x48], eax
mov rax, qword [0x1405b84d0]
test rax, rax
je 0x1401f06ee
mov rax, qword [0x1405b84d0]
test rax, rax
je 0x1401f06ee
call rax
jmp 0x1401f06f7
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbx, rax
sar rbx, 1
sub rbx, r14
sar rbx, 7
cmp rbx, r15
cmovg rbx, r15
shl rbx, 3
test ebx, ebx
jne 0x1401f071a
mov ebx, 8
jmp 0x1401f0721
cmp ebx, 8
cmove ebx, r12d
mov ecx, dword [rbp - 0x48]
mov dword [rbp - 0x40], ecx
test cl, 1
jne 0x1401f077a
mov eax, ebx
or eax, ecx
lea rcx, [rbp - 0x40]
or eax, 1
mov dword [rbp - 0x28], eax
call fcn.1400db5e0
lea rcx, [rbp - 0x28]
mov r8d, eax
call fcn.1400db5e0
mov rcx, rsi
mov edx, eax
call fcn.140075d10
mov rcx, rax
mov eax, r8d
lock cmpxchg dword [rcx], edx
mov dword [rbp - 0x20], eax
je 0x1401f0777
mov r8d, 4
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.14039b2e0
mov ecx, dword [rbp - 0x40]
mov dword [rbp - 0x48], ecx
mov edx, 0x20
test cl, 1
jne 0x1401f05e6
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov r14, qword [rsp + 0x58]
add rsp, 0x68
pop rsi
pop rbp
ret
Function at 0x1401f0e20
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
mov edx, 1
lea rcx, [0x1405b84d8]
call fcn.1401f0ea0
xor edx, edx
lea rcx, [0x1405b8628]
add rsp, 0x28
jmp fcn.1401f0ea0

Function at 0x1401f0ea0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov dword [rcx + 0x124], edx
mov dword [rcx], edi
mov rbx, rcx
mov dword [rcx + 0x120], edi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
cmp edx, dword [rsp + 0x48]
cmovb edx, dword [rsp + 0x48]
mov eax, edx
mov qword [rbx + 0x128], rax
mov eax, reloc.WS2_32.dll_recv
add rax, rax
cmp rax, 0x20
jb 0x1401f0ee3
mov qword [rbx + 0x130], rax
lea rcx, [rbx + 0x30]
add rax, rax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x138], rax
xor edx, edx
lea rax, [rbx + 8]
mov dword [rbx + 0x140], edi
xor rax, 0xffffffffb37cc16a
mov qword [rbx + 0x18], rbx
mov r8d, 0xf0
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x28], edi
call fcn.14039b120
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x1401f2990
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140398e10
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1401fb6b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.140398e10
sub rsp, rax
lea rcx, [0x14059f5c8]
add rsp, 0x28
jmp fcn.1401f27f0

Function at 0x140242a50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.140398e10
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140242a79
lea rax, [0x1402410b0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140239800
lea rax, [0x140240260]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.140239540