joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051a20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 8]
mov r9, rdx
movzx ecx, byte [rdx + 4]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [r9 + 5]
mov r10, qword [r8 + 0x308]
xor rcx, rax
movzx eax, byte [r9 + 6]
mov rbx, qword [r8 + 0x2f0]
mov r11, qword [r8 + 0x2e0]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [r9 + 7]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r10, rcx
add r10, r10
mov rcx, qword [rbx + r10*8 + 8]
mov rax, rcx
cmp rcx, r11
je 0x140051ab5
mov edx, dword [r9 + 4]
mov r8, qword [rbx + r10*8]
cmp edx, dword [rcx + 0x10]
je 0x140051ab7
cmp rax, r8
je 0x140051ab5
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x140051aa5
jmp 0x140051ab7
xor eax, eax
test rax, rax
je 0x140051b07
cmp rax, r11
je 0x140051b07
cmp rcx, r11
je 0x140051b0d
mov eax, dword [r9 + 4]
mov rdx, qword [rbx + r10*8]
cmp eax, dword [rcx + 0x10]
je 0x140051ae1
cmp rcx, rdx
je 0x140051b0d
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140051ad3
test rcx, rcx
je 0x140051b0d
mov eax, dword [rcx + 0x58]
mov dword [rcx + 0x60], eax
mov eax, dword [rcx + 0x5c]
mov dword [rcx + 0x64], eax
mov eax, dword [r9 + 0x18]
mov dword [rcx + 0x58], eax
mov eax, dword [r9 + 0x1c]
mov dword [rcx + 0x5c], eax
mov eax, dword [r9 + 0xc]
mov dword [rcx + 0x7c], eax
add rsp, 0x20
pop rbx
ret
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
Function at 0x1400553c0
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14007a040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rdx
mov rsi, qword [rcx + 8]
lea rax, [rsp + 0x20]
mov qword [r11 - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor edi, edi
mov qword [r11 - 0x78], rdi
mov qword [r11 - 0x70], rdi
lea r8d, [rdi + 1]
lea rdx, [0x140064434]
lea rcx, [rsp + 0x20]
call fcn.14000e5a0
nop
lea rdx, [rbx + 0x68]
lea rcx, [rsp + 0x60]
call fcn.140009920
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140038940
nop
mov rbx, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, rbx
sar rcx, 5
cmp rcx, 1
jbe 0x1400555e8
add rbx, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov r14, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x14005546d
mov rbx, qword [rbx]
mov dword [rax], edi
mov r8d, 0xa
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov r8d, eax
mov ecx, eax
shr ecx, 0x18
mov r9d, eax
shr r9d, 0x10
shr eax, 8
cmp rbx, qword [rsp + 0x80]
jne 0x1400554b0
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [r14], 0x22
jne 0x1400554d0
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
movzx edx, r8b
movabs r10, 0xcbf29ce484222325
xor rdx, r10
movabs r10, 0x100000001b3
imul rdx, r10
movzx eax, al
xor rdx, rax
imul rdx, r10
movzx eax, r9b
xor rdx, rax
imul rdx, r10
mov eax, ecx
xor rdx, rax
imul rdx, r10
mov rcx, qword [rsi + 0x308]
and rcx, rdx
shl rcx, 4
mov rdx, qword [rsi + 0x2f0]
add rdx, rcx
mov rax, qword [rdx + 8]
cmp rax, qword [rsi + 0x2e0]
je 0x140055552
mov rcx, qword [rdx]
cmp r8d, dword [rax + 0x10]
je 0x14005554f
nop dword [rax + rax]
cmp rax, rcx
je 0x140055552
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x140055540
mov rdi, rax
test rdi, rdi
je 0x1400555ba
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14005557f
cmp rax, rdi
jne 0x140055575
mov rax, qword [rsi + 0x2e0]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14005558a
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x14005558a
cmp rax, rdi
jne 0x14005558a
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
dec qword [rsi + 0x2e8]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rcx, [rdi + 0x18]
call fcn.140006eb0
mov edx, 0xa8
mov rcx, rdi
call fcn.14005b0bc
nop
lea rcx, [rsp + 0x48]
call fcn.140023f90
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14005ac30
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop r14
pop rdi
pop rsi
ret
call fcn.14003a340
nop
int3
Function at 0x140057730
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov r8, qword [r8 + 0x10]
mov rbp, rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140057755
mov rdx, qword [rbx]
xor r14d, r14d
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
test r8, r8
je 0x140057793
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140057780
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x20]
call fcn.140014b80
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400577b1
mov rcx, qword [rbp + 0x28]
mov rax, qword [rbp + 0x28]
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp rcx, rax
je 0x1400577dd
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x1400577ce
lock inc dword [rax + 8]
mov rax, qword [rcx + 0x30]
mov qword [rdi], rax
mov rax, qword [rcx + 0x38]
mov qword [rdi + 8], rax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140057813
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14005780e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057830
mov rcx, r8
call fcn.14005b0bc
mov byte [rbx], r14b
mov rax, rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r14
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140057840
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov r8, qword [r8 + 0x10]
mov rbp, rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140057865
mov rdx, qword [rbx]
xor r14d, r14d
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
test r8, r8
je 0x1400578a3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140057890
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.140014b80
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400578c1
mov rcx, qword [rbp + 0x68]
mov rax, qword [rbp + 0x68]
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp rcx, rax
je 0x1400578ed
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x1400578de
lock inc dword [rax + 8]
mov rax, qword [rcx + 0x30]
mov qword [rdi], rax
mov rax, qword [rcx + 0x38]
mov qword [rdi + 8], rax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140057923
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14005791e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057940
mov rcx, r8
call fcn.14005b0bc
mov byte [rbx], r14b
mov rax, rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r14
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140057950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov rdi, rdx
mov r8, qword [r8 + 0x10]
mov rbp, rcx
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140057975
mov rdx, qword [rbx]
xor r14d, r14d
movabs r9, 0xcbf29ce484222325
mov ecx, r14d
test r8, r8
je 0x1400579b3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x1400579a0
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x100]
call fcn.140014b80
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400579d7
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x108]
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp rcx, rax
je 0x140057a06
mov rax, qword [rcx + 0x38]
test rax, rax
je 0x1400579f7
lock inc dword [rax + 8]
mov rax, qword [rcx + 0x30]
mov qword [rdi], rax
mov rax, qword [rcx + 0x38]
mov qword [rdi + 8], rax
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140057a3c
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140057a37
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140057a59
mov rcx, r8
call fcn.14005b0bc
mov byte [rbx], r14b
mov rax, rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], r14
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140057db0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r12, r9
mov qword [rsp + 0x20], r8
mov rsi, rdx
mov r14, rcx
movzx eax, byte [r8]
mov r13d, eax
movabs rcx, 0xcbf29ce484222325
xor r13, rcx
movabs rcx, 0x100000001b3
imul r13, rcx
mov rcx, qword [r14 + 0x30]
and rcx, r13
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rbx, qword [rdx + rcx*8 + 8]
lea r8, [r14 + 8]
mov r15, qword [r8]
cmp rbx, r15
jne 0x140057e18
mov rbx, r15
mov rbp, r15
jmp 0x140057e50
mov rcx, qword [rdx + rcx*8]
cmp al, byte [rbx + 0x10]
je 0x140057e2f
cmp rbx, rcx
je 0x140057e4a
mov rbx, qword [rbx + 8]
cmp al, byte [rbx + 0x10]
jne 0x140057e21
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x666666666666666
cmp qword [r14 + 0x10], rax
jne 0x140057e6e
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], 0
mov ecx, 0x28
call fcn.14005ad70
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x20]
movzx eax, byte [rax]
mov byte [rdi + 0x10], al
xor ecx, ecx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov rax, qword [r12]
mov qword [rdi + 0x18], rax
mov rax, qword [r12 + 8]
mov qword [rdi + 0x20], rax
mov qword [r12], rcx
mov qword [r12 + 8], rcx
mov rcx, qword [r14 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x140057ed1
cvtsi2ss xmm0, rcx
jmp 0x140057ee6
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r14 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x140057ef9
cvtsi2ss xmm1, rcx
jmp 0x140057f0e
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r14]
seta al
test al, al
je 0x140057f81
mov rcx, r14
call fcn.140059930
mov rcx, r13
and rcx, qword [r14 + 0x30]
add rcx, rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [r14 + 8]
cmp rax, rbx
jne 0x140057f4c
mov qword [rsp + 0x28], 0
jmp 0x140057f74
mov rdx, qword [rdx + rcx*8]
movzx ecx, byte [rdi + 0x10]
cmp cl, byte [rax + 0x10]
je 0x140057f71
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x140057fb5
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x140057f60
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [r14 + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x30]
and rax, r13
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r14 + 8]
jne 0x140057fc5
mov qword [rcx + rax*8], rdi
jmp 0x140057fd7
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x140057f79
cmp r8, rbp
jne 0x140057fd0
mov qword [rcx + rax*8], rdi
jmp 0x140057fdc
cmp qword [rcx + rax*8 + 8], rdx
jne 0x140057fdc
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
jmp 0x140057e36
Function at 0x1400599e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140059a05
cvtsi2ss xmm0, rdx
jmp 0x140059a1a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140066e88]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140059a48
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140059a48
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x140059a7a
cmp rbx, 0x200
jae 0x140059a77
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x140059a7a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140013330
Function at 0x140059d50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x140059955
cvtsi2ss xmm0, rdx
jmp 0x14005996a
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
movss xmm1, dword [0x140066e88]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x140059998
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x140059998
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400599ca
cmp rbx, 0x200
jae 0x1400599c7
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x1400599ca
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140059d50
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140059d85
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140009e40
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140059ea4
mov qword [rsp + 0x58], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
mov rcx, qword [rcx]
mov r11d, r9d
xor r11, rdi
imul r11, rbp
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x140059e1f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140059e93
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x140059e58
mov r10, qword [rdx]
cmp r10, rax
je 0x140059e52
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140059e93
cmp r8, rdx
je 0x140059e6f
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x140059eb5
cmp r8, rdx
jne 0x140059e60
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140059df0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140059e93
Function at 0x14005a5a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14005a5d5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140009e40
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14005a716
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14005a690
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14005a705
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14005a6cd
mov r10, qword [rdx]
cmp r10, rax
je 0x14005a6c7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14005a705
cmp r9, rdx
je 0x14005a6e1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14005a727
cmp r9, rdx
jne 0x14005a6d2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14005a640
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14005a705

Function at 0x14005b998
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005b9e2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005b9e2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005b9e2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005b9e2
cmp dword [rcx + 0x84], 0xe
jbe 0x14005b9e2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005b9e4
xor al, al
add rsp, 0x28
ret
Function at 0x14001f008
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14001f042
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14001f047
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14001f090
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14004d080]
cmp byte [rcx + rax], 0
je 0x14001f090
dec r8
sub rdx, 1
jne 0x14001f076
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400206a8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400206f2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400206f2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400206f2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400206f2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400206f2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400206f4
xor al, al
add rsp, 0x28
ret

Function at 0x140030fc4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140030dc0
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop rsi
wait
cmp esp, dword [rbx + 0x72]
stc
invalid
invalid
fstp xword [rdx + rbx*2]
pop rbp
add eax, 0xbf854763
jp 0x14003f6a2
out 0xd, eax
mov bh, 0xf2
jae 0x14003f5e9
pavgb mm7, qword [rdi + rcx*2 - 0x7415d609]
loope 0x14003f67b
scasd eax, dword [rdi]
push rbp
insb byte [rdi], dx
invalid
ja 0x14003f677
fmul st(7)
invalid
add al, 6
sub dword [rsi], eax
in al, dx
and dword [rcx - 0x5badc065], edi
push 0x7f1b44dd
xchg edx, eax
xchg edx, eax
xchg edx, eax
pop rbx
pop rsi
push rsi
ret
add al, 0xf9
invalid
adc dh, byte [rax + rbx*2 - 0x6f]
jo 0x14003f6ae
movsb byte [rdi], byte [rsi]
cmpsd dword [rsi], dword [rdi]
jp 0x14003f621
add edi, ebx
xchg edi, eax
invalid
add al, byte [rcx - 0x698067cb]
jg 0x14003f63e
outsb dx, byte [rsi]
push rax
push rcx
adc eax, 0x26dd559c
frstor dword [rsi]
jl 0x14003f6bd
cwde
leave
clc
shl edx, cl
cmc
fstp qword [rbx - 0x6a]
xchg esi, eax
and byte [rsi + 0x64], ah
and esp, dword [rdi]
invalid