joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140047c30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
test rdx, rdx
je 0x140047c99
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov qword [rsp + 0x38], rbx
mov rdi, rdx
mov qword [rsp + 0x40], rbp
mov rsi, rcx
mov ebp, 0xffffffff
mov rbx, rdx
nop word [rax + rax]
cmp rbx, rbp
mov rcx, rsi
cmova ebx, ebp
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x140047c75
int3
mov eax, ebx
sub rdi, rax
add rsi, rax
mov rbx, rdi
test rdi, rdi
jne 0x140047c60
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14004f120
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
sub rsp, 0x38
movsd xmm0, qword [0x14008ea38]
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
ucomisd xmm0, xmm6
jp 0x14004f261
jne 0x14004f261
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword gs:[0x58]
mov edx, dword [0x140091658]
mov ebp, 4
mov rbx, qword [rcx + rdx*8]
mov ecx, dword [rbx + rbp]
cmp dword [0x14008ea48], ecx
jg 0x14004f26b
mov eax, dword [rbx + rbp]
cmp dword [0x14008ea58], eax
mov rbp, qword [rsp + 0x58]
jg 0x14004f2a5
rdtsc
shl rdx, 0x20
lea rcx, [rsp + 0x40]
or rax, rdx
mov qword [rsp + 0x40], 0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rcx, qword [rsp + 0x40]
xorps xmm2, xmm2
sub rcx, qword [0x14008ea50]
movsd xmm3, qword [0x14007a510]
mov rdi, qword [rsp + 0x30]
cvtsi2sd xmm2, rcx
jns 0x14004f21f
addsd xmm2, xmm3
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsi2sd xmm1, qword [rsp + 0x48]
divsd xmm2, xmm1
movsd xmm1, qword [0x14007a508]
comisd xmm1, xmm2
ja 0x14004f25c
sub rbx, qword [0x14008ea40]
cvtsi2sd xmm0, rbx
jns 0x14004f250
addsd xmm0, xmm3
divsd xmm0, xmm2
movsd qword [0x14008ea38], xmm0
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
ret
lea rcx, [0x14008ea48]
call fcn.1400753bc
cmp dword [0x14008ea48], 0xffffffff
jne 0x14004f19f
rdtsc
shl rdx, 0x20
lea rcx, [0x14008ea48]
or rax, rdx
mov qword [0x14008ea40], rax
call fcn.14007535c
jmp 0x14004f19f
lea rcx, [0x14008ea58]
call fcn.1400753bc
cmp dword [0x14008ea58], 0xffffffff
jne 0x14004f1b3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
lea rcx, [0x14008ea58]
mov qword [0x14008ea50], rax
call fcn.14007535c
jmp 0x14004f1b3
Function at 0x14004f560
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.140075650
sub rsp, rax
mov rax, qword [0x14008e3a8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov rdi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14004f66b
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jne 0x14004f5fc
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004f5e0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14001d5a8
mov eax, ebx
jmp 0x14004f66b
cmp ecx, 2
jne 0x14004f666
mov r8d, 0x400
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x34], eax
dec eax
cmp eax, 0x3ff
ja 0x14004f65f
lea rax, [rsp + 0x840]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004f640
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14001d5a8
mov eax, ebx
jmp 0x14004f66b
mov eax, 0xea
jmp 0x14004f66b
mov eax, 0x3f4
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140075580
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret

Function at 0x14004f690
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 4
mov rbx, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004f6fe
mov ecx, dword [rsp + 0x50]
add ecx, 0xfffffffd
cmp ecx, 1
ja 0x14004f6f9
cmp dword [rsp + 0x68], 4
jne 0x14004f6f9
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret
mov eax, 0x3f4
add rsp, 0x40
pop rbx
ret
Function at 0x1400505c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x14005065e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14005065e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1400506b0
cmp rbx, rax
jne 0x140050650
mov rax, qword [rdi]
cmp rbx, rax
je 0x140050693
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x1400506ec
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x14005071b
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x10]
dec qword [rbp + 0x10]
call fcn.1400519e0
mov edx, 0x38
mov rcx, rdi
call fcn.140068220
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1400507cd
cmp rax, rbx
jne 0x1400506f7
mov qword [rdx + r8*8], rdi
jmp 0x14005071b
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x14005071b
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x14007a43c]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x14005073c
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x14005074d
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x1400507c5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x14005076f
lea rdx, [rdx*8]
jmp 0x140050781
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140050781
add rdx, rdx
mov rcx, rbp
call fcn.1400489e0
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x1400507c0
mov rsi, qword [rsi + 8]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.1400505c0
cmp rbx, rsi
jne 0x1400507a0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400507f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x14005088e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14005088e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1400508e0
cmp rbx, rax
jne 0x140050880
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400508c3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x1400508f8
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140050927
mov rdx, rdi
mov rcx, rbp
call fcn.140055050
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1400509dd
cmp rax, rbx
jne 0x140050903
mov qword [rdx + r8*8], rdi
jmp 0x140050927
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140050927
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x14007a43c]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140050948
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140050959
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x1400509d5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x14005097b
lea rdx, [rdx*8]
jmp 0x14005098d
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005098d
add rdx, rdx
mov rcx, rbp
call fcn.1400489e0
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x1400509d0
mov rsi, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.1400507f0
cmp rbx, rsi
jne 0x1400509b0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140050a00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140050a9e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140050a9e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140050af0
cmp rbx, rax
jne 0x140050a90
mov rax, qword [rdi]
cmp rbx, rax
je 0x140050ad3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x140050b08
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140050b37
mov rdx, rdi
mov rcx, rbp
call fcn.1400550b0
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x140050bed
cmp rax, rbx
jne 0x140050b13
mov qword [rdx + r8*8], rdi
jmp 0x140050b37
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140050b37
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x14007a43c]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140050b58
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140050b69
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140050be5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x140050b8b
lea rdx, [rdx*8]
jmp 0x140050b9d
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140050b9d
add rdx, rdx
mov rcx, rbp
call fcn.1400489e0
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x140050be0
mov rsi, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.140050a00
cmp rbx, rsi
jne 0x140050bc0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140050e70
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x38
mov qword [rcx + 0x10], rdx
lea rax, [0x14007a580]
mov qword [rcx], rax
xor r12d, r12d
lea rax, [0x14007a590]
mov rdi, rcx
mov qword [rcx + 8], rax
mov rbp, rdx
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x20], r12
mov rax, qword [rdx + 0x438]
mov dword [rcx + 0x28], eax
lea rcx, [rsp + 0x80]
call fcn.14005c9e0
mov rdx, rdi
mov rcx, rax
call fcn.14005c9d0
call fcn.14005ca50
lea esi, [r12 + 1]
mov rcx, qword [rax]
mov qword [rsp + 0x78], rcx
test rcx, rcx
je 0x140050ee7
mov eax, esi
lock xadd dword [rcx + 8], eax
call fcn.14005d520
mov rcx, rax
lea r9, [rsp + 0x78]
lea r8, str.ThreadLocalEventBuffer
lea rdx, [rdi + 8]
call fcn.14005d5b0
call sub.KERNEL32.dll_GetCurrentThreadId
lea rbx, [rbp + 8]
mov dword [rsp + 0x70], eax
mov rcx, rbx
call fcn.140044950
call fcn.14005ca50
mov r14, qword [rax]
test r14, r14
je 0x140050f2c
lock xadd dword [r14 + 8], esi
mov r9d, dword [rsp + 0x70]
movabs rcx, 0x100000001b3
add rbp, 0x3c8
movzx edx, r9b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x71]
imul rdx, rcx
mov r8, qword [rbp + 8]
xor rdx, rax
movzx eax, byte [rsp + 0x72]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x73]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rbp + 0x30]
and rcx, rdx
mov rdx, qword [rbp + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
nop
cmp r10, r8
jne 0x140050faa
mov rcx, r8
jmp 0x140050fb1
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140050fc1
cmp dword [rax + 0x10], r9d
je 0x140050fc4
mov rax, qword [rax]
jmp 0x140050fa0
mov rax, r8
mov rcx, r8
mov qword [rsp + 0x30], r15
cmp rax, rcx
jne 0x14005103b
mov rsi, qword [r8]
mov ecx, 0x20
mov r15, qword [rsi + 8]
call fcn.140075198
mov rdx, rax
mov qword [rax], rsi
mov qword [rax + 8], r15
mov ecx, dword [rsp + 0x70]
mov dword [rax + 0x10], ecx
movabs rcx, 0x7fffffffffffffe
mov qword [rax + 0x18], r12
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x140051089
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rsi + 8], rdx
mov qword [r15], rdx
lea rdx, [rsp + 0x20]
mov r9, qword [rbp + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.1400507f0
mov rax, qword [rsp + 0x20]
jmp 0x140051040
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x18]
mov qword [rax + 0x18], r14
test rcx, rcx
je 0x14005106b
lea rdx, [rcx + 8]
mov eax, 0xffffffff
lock xadd dword [rdx], eax
cmp eax, 1
jne 0x14005106b
test rdx, rdx
cmove rcx, r12
call fcn.140059750
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov r15, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x38
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400557a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r11, qword [rcx + 0x18]
movabs r12, 0x100000001b3
movzx eax, byte [rdx + 1]
movabs r13, 0xcbf29ce484222325
movzx r8d, byte [rdx]
mov r14, rcx
xor r8, r13
mov r9, rdx
imul r8, r12
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r12
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r12
xor r8, rax
mov rax, qword [rcx + 0x30]
mov rcx, qword [rcx + 8]
imul r8, r12
and rax, r8
mov rdi, rax
add rdi, rdi
add rax, rax
mov rbx, qword [r11 + rdi*8]
mov r8, qword [r11 + rax*8]
lea r10, [r11 + rax*8]
cmp r8, rcx
jne 0x140055830
mov rax, rcx
jmp 0x140055837
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140055876
mov edx, dword [r9]
cmp dword [rbx + 0x10], edx
je 0x140055849
mov rbx, qword [rbx]
jmp 0x140055826
mov rsi, rbx
nop dword [rax]
cmp r8, rcx
jne 0x14005585a
mov rax, rcx
jmp 0x140055862
mov rax, qword [r11 + rdi*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140055871
cmp edx, dword [rbx + 0x10]
jne 0x140055871
mov rbx, qword [rbx]
jmp 0x140055850
cmp rsi, rbx
jne 0x14005587c
mov rsi, rcx
mov rbx, rcx
xor ebp, ebp
mov rax, rsi
cmp rsi, rbx
je 0x14005589b
nop word [rax + rax]
mov rax, qword [rax]
inc rbp
cmp rax, rbx
jne 0x140055890
cmp rsi, qword [rcx]
jne 0x1400558c0
cmp rbx, rcx
jne 0x1400558c0
lea rcx, [r14 + 8]
call fcn.140055710
mov edx, 8
mov rcx, r14
call fcn.1400489e0
jmp 0x1400559a2
cmp rsi, rbx
je 0x1400559a2
nop dword [rax]
mov rdx, qword [r14 + 0x30]
mov rdi, rsi
mov rsi, qword [rsi]
movzx eax, byte [rdi + 0x11]
movzx ecx, byte [rdi + 0x10]
xor rcx, r13
imul rcx, r12
xor rcx, rax
movzx eax, byte [rdi + 0x12]
imul rcx, r12
xor rcx, rax
movzx eax, byte [rdi + 0x13]
imul rcx, r12
xor rcx, rax
imul rcx, r12
and rdx, rcx
mov rcx, qword [r14 + 0x18]
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x140055942
cmp rax, rdi
jne 0x140055938
mov rax, qword [r14 + 8]
mov qword [rcx], rax
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14005594a
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14005594a
cmp rax, rdi
jne 0x14005594a
mov qword [rcx], rsi
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14005598c
lea rdx, [r8 + 8]
mov eax, 0xffffffff
lock xadd dword [rdx], eax
cmp eax, 1
jne 0x14005598c
xor ecx, ecx
test rdx, rdx
cmovne rcx, r8
call fcn.140059750
mov edx, 0x20
mov rcx, rdi
call fcn.140068220
cmp rsi, rbx
jne 0x1400558d0
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140055b50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rbx, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
mov rax, qword [r10 + 0x30]
imul r9, rcx
and rax, r9
mov rcx, rax
add rcx, rcx
add rax, rax
mov rcx, qword [rdx + rcx*8]
mov r9, qword [rdx + rax*8]
lea r10, [rdx + rax*8]
cmp r9, r8
jne 0x140055bcf
mov rax, r8
jmp 0x140055bd6
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x140055bf3
mov eax, dword [rbx]
cmp dword [rcx + 0x10], eax
je 0x140055be7
mov rcx, qword [rcx]
jmp 0x140055bc5
mov qword [r11], rcx
mov rax, r11
mov rbx, qword [rsp + 8]
ret
mov qword [r11], r8
mov rax, r11
mov rbx, qword [rsp + 8]
ret

Function at 0x140055c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, qword [r8 + 0x18]
mov rsi, r8
mov r12, qword [r8 + 0x10]
mov rbp, rcx
mov r10, r8
cmp r13, 0x10
jb 0x140055c2a
mov r10, qword [r8]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test r12, r12
je 0x140055c64
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r9 + r10]
inc r9
xor r8, rax
imul r8, rcx
cmp r9, r12
jb 0x140055c50
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and rcx, r8
mov rax, rcx
mov qword [rsp + 0x28], rbx
add rax, rax
mov qword [rsp + 0x20], r14
mov rdi, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov rcx, qword [rdx + rax*8]
lea rax, [rax + 1]
lea rax, [rdx + rax*8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rax
cmp rcx, rbp
jne 0x140055cab
mov rax, rbp
jmp 0x140055cb1
mov rax, qword [rax]
mov rax, qword [rax]
cmp rdi, rax
je 0x140055d2e
lea rbx, [rdi + 0x10]
mov rdx, rsi
cmp r13, 0x10
jb 0x140055cc6
mov rdx, qword [rsi]
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x140055cd3
mov rcx, qword [rbx]
mov r14, qword [rbx + 0x10]
cmp r14, r12
jne 0x140055ce8
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140055cf7
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
jmp 0x140055ca1
cmp qword [rbx + 0x18], 0x10
jb 0x140055d01
mov rbx, qword [rbx]
cmp r13, 0x10
jb 0x140055d0a
mov rsi, qword [rsi]
cmp r12, r14
jne 0x140055d21
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140055d24
mov rdi, rbp
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
jmp 0x140055d39
mov r11, qword [rsp + 0x68]
mov rax, r11
mov qword [r11], rbp
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret