joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010ae0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
mov r15, r8
mov rsi, rdx
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
call fcn.18000adf0
mov dword [rsi], eax
lea edi, [rax + 0x1f]
shr rdi, 5
mov eax, 4
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
lea r14, [rsi + 8]
mov qword [r14], rax
mov r8d, dword [rsi]
add r8d, 0x1f
shr r8, 5
shl r8, 2
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov r9d, 1
mov dword [rsp + 0x20], r9d
mov ecx, dword [r15]
and ecx, 0xfffffff
je 0x180010c6c
sub ecx, r9d
je 0x180010c4f
sub ecx, r9d
je 0x180010c32
cmp ecx, r9d
jne 0x180010ce0
mov r8d, dword [r15 + 8]
movzx edi, r8b
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs rdx, 0x100000001b3
imul rdi, rdx
mov eax, r8d
shr eax, 8
movzx ecx, al
xor rdi, rcx
imul rdi, rdx
mov eax, r8d
shr eax, 0x10
movzx eax, al
xor rax, rdi
imul rax, rdx
mov ecx, r8d
shr rcx, 0x18
xor rax, rcx
imul rax, rdx
movsxd rcx, dword [rbp + 0x248]
xor edx, edx
div rcx
movsxd rcx, edx
mov rax, qword [rbp + 0x250]
mov rax, qword [rax + rcx*8]
test rax, rax
je 0x180010c11
cmp dword [rax + 8], r8d
je 0x180010c2d
mov rax, qword [rax]
test rax, rax
jne 0x180010c03
mov ecx, dword [rsp + 0x58]
mov edx, ecx
shr rdx, 5
mov rax, qword [r14]
and ecx, 0x1f
shl r9d, cl
or dword [rax + rdx*4], r9d
jmp 0x180010ce0
mov ecx, dword [rax + 0xc]
jmp 0x180010c15
mov ecx, dword [r15 + 8]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + rcx*8]
add rdx, 0x10
mov rcx, rsi
call fcn.18000f050
jmp 0x180010ce0
mov ecx, dword [r15 + 8]
shl rcx, 5
mov rdx, qword [rbp + 0x28]
add rdx, 0x10
add rdx, rcx
mov rcx, rsi
call fcn.18000f050
jmp 0x180010ce0
mov edx, dword [rsi]
add edx, 0x1f
shr edx, 5
test edx, edx
je 0x180010ce0
mov r8d, 0xffffffff
cmp edx, 4
jb 0x180010cbb
mov rdi, qword [r14]
lea eax, [rdx - 1]
lea rax, [rdi + rax*4]
cmp rdi, r14
ja 0x180010c97
cmp rax, r14
jae 0x180010cbb
mov eax, edx
and eax, 0xfffffffc
nop dword [rax]
add ebx, 4
cmp ebx, eax
jb 0x180010ca0
lea ecx, [rax + 3]
shr rcx, 2
shl rcx, 4
shr rcx, 2
mov rax, r8
rep stosd dword [rdi], eax
cmp ebx, edx
jae 0x180010ce0
lea rcx, [rbx*4]
sub edx, ebx
nop dword [rax]
mov rax, qword [r14]
mov dword [rcx + rax], r8d
lea rcx, [rcx + 4]
sub rdx, r9
jne 0x180010cd0
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x180011a90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r9d, byte [rdx]
mov rdi, rdx
movabs rdx, 0x100000001b3
mov rbx, rcx
movabs rax, 0xcbf29ce484222325
mov r14, r8
xor r9, rax
movzx ecx, byte [rdi + 2]
movzx eax, byte [rdi + 1]
imul r9, rdx
xor rax, r9
imul rax, rdx
xor rax, rcx
movzx ecx, byte [rdi + 3]
imul rax, rdx
xor rax, rcx
movsxd rcx, dword [rbx]
imul rax, rdx
xor edx, edx
div rcx
movsxd rax, edx
lea rsi, [rax*8]
mov rax, qword [rbx + 8]
mov rax, qword [rsi + rax]
test rax, rax
je 0x180011b1d
mov ecx, dword [rdi]
cmp dword [rax + 8], ecx
je 0x180011b4a
mov rax, qword [rax]
test rax, rax
jne 0x180011b10
mov ecx, 0x10
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x30], rax
mov r8, rax
test rax, rax
je 0x180011b4e
mov qword [rax], 0
mov eax, dword [rdi]
mov dword [r8 + 8], eax
mov eax, dword [r14]
mov dword [r8 + 0xc], eax
jmp 0x180011b51
xor eax, eax
jmp 0x180011b6a
xor r8d, r8d
mov rcx, qword [rbx + 8]
mov rax, r8
mov rdx, qword [rsi + rcx]
mov qword [r8], rdx
mov rcx, qword [rbx + 8]
mov qword [rsi + rcx], r8
inc dword [rbx + 4]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180011ca0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov eax, dword [r9 + 0x27c]
mov rbx, r9
mov rdi, rcx
bt eax, 0x1d
jae 0x180011ccd
mov rcx, r8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rdx
mov qword [rcx], rdx
mov qword [rcx + 8], r8
lea rcx, [r9 + 0x218]
mov qword [rsp + 0x30], rsi
call fcn.180008300
mov eax, 1
lock xadd dword [rbx + 0x228], eax
inc eax
lea ecx, [rax + 1]
test ecx, 0xfffffffe
je 0x180011ce5
mov qword [rdi + 0x18], 0
lea rdx, [rdi + 0x18]
mov dword [rdi + 0x10], eax
lea rcx, [rbx + 0x218]
mov rax, qword [rbx + 0x210]
mov qword [rax], rdi
mov qword [rbx + 0x210], rdx
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180008440
Function at 0x180012500
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x180012542
cmp byte [rax + 0x88], 0
jne 0x180012542
mov rcx, rax
call fcn.180016870
cmp rax, rbx
jne 0x180012542
xor sil, sil
jmp 0x18001254c
mov sil, 1
lock inc dword [rbx + 0x270]
lea rax, [rsp + 0x20]
xor ebp, ebp
lea rcx, [rbx + 0x218]
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x28], rax
call fcn.180008300
lea r8, [rbx + 0x208]
mov rcx, qword [r8]
test rcx, rcx
je 0x1800125a5
mov rax, qword [rcx + 0x18]
mov qword [r8], rax
test rax, rax
jne 0x180012588
mov qword [r8 + 8], r8
mov qword [rcx + 0x18], rbp
lea rdx, [rcx + 0x18]
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
mov rcx, qword [r8]
mov qword [rsp + 0x28], rdx
test rcx, rcx
jne 0x180012578
lea rcx, [rbx + 0x218]
call fcn.180008440
mov rdx, qword [rsp + 0x20]
test rdx, rdx
je 0x1800125e7
mov rax, qword [rdx + 0x18]
lea rcx, [rsp + 0x20]
test rax, rax
mov qword [rsp + 0x20], rax
cmovne rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rdx + 8]
call qword [rdx]
mov rdx, qword [rsp + 0x20]
test rdx, rdx
jne 0x1800125bb
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa8]
mov eax, dword [rbx + 0x27c]
nop dword [rax]
mov ecx, eax
mov r8d, eax
btr ecx, 0x1e
bts ecx, 0x1d
lock cmpxchg dword [rbx + 0x27c], ecx
cmp eax, r8d
jne 0x180012600
and eax, 0x1fffffff
jbe 0x180012633
mov rcx, qword [rbx + 0x260]
xor r8d, r8d
mov edx, eax
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xa0]
test sil, sil
je 0x18001265e
mov eax, 0xffffffff
lock xadd dword [rbx + 0x270], eax
cmp eax, 1
jne 0x18001265e
mov rcx, rbx
call fcn.180010440
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x180012680
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbp, rcx
mov rsi, r8
mov ecx, dword [0x1800e2468]
mov rdi, rdx
xor bl, bl
call sub.KERNEL32.dll_TlsGetValue
xor r14d, r14d
mov r9, rax
test rdi, rdi
lea rax, [rdi + 0x10]
cmove rax, r14
cmp r9, rax
je 0x180012715
call fcn.180016ef0
mov eax, dword [rsi]
lea r9d, [r14 + 5]
mov dword [rsp + 0x30], eax
lea r8, [rsp + 0x30]
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov rcx, rbp
mov eax, dword [rsi + 4]
mov dword [rsp + 0x34], eax
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], r14d
call fcn.180010670
test al, al
je 0x180012710
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.18001dc60
mov bl, 1
call fcn.180016ef0
mov rbp, qword [rsp + 0x80]
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180012750
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x50
mov edi, 1
mov rbx, rcx
mov esi, edi
lock xadd dword [rcx + 0x268], esi
inc esi
cmp esi, edi
jne 0x1800128d3
mov eax, dword [rcx + 0x274]
test eax, eax
jle 0x1800128cd
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x1800128e5
cmp byte [rax + 0x88], 0
jne 0x1800128e5
mov rcx, rax
call fcn.180016870
cmp rax, rbx
jne 0x1800128e5
mov eax, dword [rbx + 0x27c]
test eax, eax
js 0x180012898
mov qword [rsp + 0x70], r14
lea r8, [0x180008450]
xor r14d, r14d
mov qword [rsp + 0x78], r15
mov edx, r14d
mov qword [rbp - 0x20], r8
mov dword [rbp - 0x28], edx
lea r15d, [rdi + 2]
nop dword [rax + rax]
mov ecx, edx
test edx, edx
je 0x180012850
sub ecx, edi
je 0x180012839
sub ecx, edi
je 0x180012829
sub ecx, edi
je 0x180012808
cmp ecx, edi
je 0x180012834
jmp 0x180012878
mov dword [rbp - 0x28], r14d
call fcn.180007350
test eax, eax
jne 0x18001281e
mov dword [rbp - 0x28], 4
jmp 0x180012878
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], edi
mov dword [rbp - 0x28], edi
jmp 0x180012878
add dword [rbp - 0x2c], 0xffffffff
cmove edx, r15d
mov dword [rbp - 0x28], edx
call r8
jmp 0x180012878
pause
add dword [rbp - 0x30], 0xffffffff
jne 0x180012878
mov eax, dword [rbp - 0x2c]
neg eax
sbb ecx, ecx
add ecx, r15d
mov dword [rbp - 0x28], ecx
jmp 0x180012878
mov dword [rbp - 0x28], r14d
call fcn.180007350
test eax, eax
jne 0x180012866
mov dword [rbp - 0x28], 4
jmp 0x18001286f
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], edi
mov dword [rbp - 0x28], edi
lea rcx, [rbp - 0x30]
call fcn.180007150
mov eax, dword [rbx + 0x27c]
test eax, eax
js 0x18001288e
mov r8, qword [rbp - 0x20]
mov edx, dword [rbp - 0x28]
jmp 0x1800127f0
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x78]
mov ecx, eax
btr ecx, 0x1f
lock cmpxchg dword [rbx + 0x27c], ecx
je 0x1800128c4
nop dword [rax + rax]
mov ecx, eax
mov edx, eax
btr ecx, 0x1f
lock cmpxchg dword [rbx + 0x27c], ecx
cmp eax, edx
jne 0x1800128b0
lock inc dword [rbx + 0x270]
jmp 0x1800128d3
xchg dword [rcx + 0x274], edi
mov rbx, qword [rsp + 0x80]
mov eax, esi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rbp - 0x18]
call fcn.180008590
lea rdx, [0x18003cc18]
lea rcx, [rbp - 0x18]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x1800131b0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov rsi, r9
mov ecx, dword [0x1800e2468]
mov rbp, r8
mov r14, rdx
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
je 0x180013200
mov rcx, rax
call fcn.180016870
cmp rax, rdi
jne 0x180013200
mov rcx, rbx
call fcn.180016820
jmp 0x180013207
mov rax, qword [rdi + 0x130]
mov r9, rsi
mov r8, rbp
mov rdx, r14
mov rcx, rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x180024500
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, r8
mov rdi, rdx
mov r8b, 1
mov rdx, r9
call qword [rax + 0x28]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180024580
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rax - 0x58], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov rdi, rcx
test rdx, rdx
je 0x1800246f0
mov rax, qword [rcx + 0x1a8]
mov rsi, qword [rax + 8]
mov rcx, rsi
call fcn.180010fc0
mov rbp, rax
mov rcx, qword [rdi + 0x1a8]
test byte [rcx + 0x50], 4
jne 0x1800245ce
lock inc dword [rcx + 0x28]
lea rcx, [rdi + 0x58]
call fcn.180008300
lea rdx, [rbp + 0x20]
xor r14d, r14d
mov qword [rdx], r14
mov rax, qword [rdi + 0x50]
mov qword [rax], rbp
mov qword [rdi + 0x50], rdx
lea rcx, [rdi + 0x58]
call fcn.180008440
nop
call fcn.180010430
mov rbx, rax
test rax, rax
je 0x18002462d
mov rcx, rax
call fcn.180016870
cmp rax, rsi
jne 0x18002462d
cmp byte [rbx + 0x88], r14b
mov rax, qword [rbx + 0xf8]
je 0x180024625
inc dword [rax + 0x20]
jmp 0x180024686
inc dword [rax + 0xa0]
jmp 0x180024686
mov ecx, dword [rsi + 0x20]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
jne 0x180024683
lea ecx, [rax + 0x40]
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rbx, rax
mov qword [rsp + 0x88], rax
test rax, rax
je 0x180024666
mov qword [rax + 0x20], r14
mov qword [rax + 0x28], r14
mov dword [rax + 0x30], 1
jmp 0x180024669
mov rbx, r14
lea rcx, [rsi + 0x150]
mov rdx, rbx
call fcn.180022c70
mov rdx, rbx
mov ecx, dword [rsi + 0x20]
call fcn.180007f00
inc dword [rbx + 0x20]
test dword [rdi + 0x18], 0xfffffff
je 0x180024698
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + VariantCopy]
mov eax, dword [rsi + 0x2a8]
mov ecx, dword [rsi + 0x2a4]
sub ecx, eax
test ecx, ecx
jle 0x1800246db
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x28], eax
mov rax, qword [rdi + 0x20]
mov qword [rsp + 0x30], rax
mov eax, dword [rdi + 0x1c]
mov dword [rsp + 0x2c], eax
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x38], rax
mov rax, qword [rsi]
lea r8, [rsp + 0x28]
mov rdx, rdi
mov rcx, rsi
call qword [rax + 0x70]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rdx, str.proc
lea rcx, [rsp + 0x40]
call fcn.180004c40
lea rdx, [0x18003c888]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__CxxThrowException
int3
Function at 0x180013af0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
add rcx, 0x218
call fcn.180008300
mov eax, dword [rdi + 0x228]
cmp dword [rbx], eax
je 0x180013b33
mov eax, 1
lock xadd dword [rdi + 0x228], eax
inc eax
inc eax
test eax, 0xfffffffe
je 0x180013b1b
lea rcx, [rdi + 0x218]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180008440

Function at 0x180013d90
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx ebx, dl
mov rdi, rcx
call fcn.180016ef0
test bl, bl
je 0x180013ddb
mov eax, 0xffffffff
lock xadd dword [rdi + 0x27c], eax
dec eax
and eax, 0x9fffffff
cmp eax, 0x80000000
jne 0x180013e05
mov rcx, rdi
call fcn.18000f940
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180016ef0
mov eax, 1
lock xadd dword [rdi + 0x27c], eax
inc eax
bt eax, 0x1e
jae 0x180013e05
mov rcx, qword [rdi + 0x260]
xor r8d, r8d
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180016ef0

Function at 0x180016390
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1800e2468]
xor edx, edx
jmp fcn.180007f00

Function at 0x180016ea0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1800e2468]
jmp fcn.180007f00
Function at 0x180016f00
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0x30
movsxd rax, dword [rcx + 0xd0]
xor edi, edi
xor edx, edx
mov rbp, rcx
test eax, eax
jle 0x180016f47
mov r14, qword [rcx + 0xd8]
mov r8, rax
mov rax, r14
xor ecx, ecx
nop word [rax + rax]
cmp qword [rax], rdi
jne 0x180017089
inc edx
inc rcx
add rax, 8
cmp rcx, r8
jl 0x180016f30
xor r14d, r14d
test r14, r14
je 0x1800170fc
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
movsxd rsi, edi
nop
mov rbx, qword [r14]
test rbx, rbx
jne 0x180016fca
movsxd rcx, dword [rbp + 0xd0]
inc edi
inc rsi
mov edx, edi
mov rax, rsi
cmp edi, ecx
jge 0x180016fc8
mov rbx, qword [rbp + 0xd8]
mov r8, rcx
lea rcx, [rbx + rsi*8]
nop dword [rax + rax]
cmp qword [rcx], 0
jne 0x180017097
inc edx
inc rax
add rcx, 8
cmp rax, r8
jl 0x180016fb0
xor ebx, ebx
mov rcx, qword [r14 + 0x10]
call fcn.180018990
test al, al
je 0x1800170dc
mov r14, qword [r14 + 0x10]
mov rcx, r14
call fcn.1800189a0
mov qword [rsp + 0x50], rax
mov r9, rax
movzx ecx, byte [rsp + 0x51]
xor edx, edx
movzx r8d, al
movzx eax, byte [rsp + 0x52]
xor r8, r12
imul r8, r15
xor r8, rcx
movzx ecx, byte [rsp + 0x56]
imul r8, r15
xor r8, rax
movzx eax, byte [rsp + 0x53]
imul r8, r15
xor r8, rax
movzx eax, byte [rsp + 0x54]
imul r8, r15
xor r8, rax
movzx eax, byte [rsp + 0x55]
imul r8, r15
xor rax, r8
imul rax, r15
xor rax, rcx
movzx ecx, byte [rsp + 0x57]
imul rax, r15
xor rax, rcx
movsxd rcx, dword [rbp + 0xd0]
imul rax, r15
div rcx
mov rax, qword [rbp + 0xd8]
movsxd rcx, edx
xor edx, edx
lea r8, [rax + rcx*8]
mov rcx, qword [rax + rcx*8]
test rcx, rcx
je 0x1800170c2
mov rax, qword [rcx]
cmp qword [rcx + 8], r9
je 0x1800170a5
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x180017073
jmp 0x1800170c2
movsxd rax, edx
mov edi, edx
mov r14, qword [r14 + rax*8]
jmp 0x180016f4a
mov rbx, qword [rbx + rax*8]
mov edi, edx
mov rsi, rax
jmp 0x180016fca
test rdx, rdx
jne 0x1800170af
mov qword [r8], rax
jmp 0x1800170b2
mov qword [rdx], rax
dec dword [rbp + 0xd4]
mov edx, 0x18
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
test r14, r14
je 0x1800170dc
mov rcx, r14
call fcn.180017620
mov edx, 0xe8
mov rcx, r14
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov r14, rbx
test rbx, rbx
jne 0x180016f80
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x1800173d0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
movzx ebp, r8b
mov rsi, rdx
mov rbx, rcx
or dword [rcx + 8], 0xfffffff
xor r14d, r14d
mov qword [rcx + 0x10], r14
mov dword [rcx + 0x20], r14d
mov dword [rcx + 0x24], 0x80000000
mov qword [rcx + 0x28], r14
mov dword [rcx + 0x58], r14d
add rcx, 0x60
call fcn.180013f50
nop
mov rax, qword [rsi + 0xa8]
mov qword [rbx + 0xa8], rax
mov qword [rbx + 0xb8], r14
mov dword [rbx + 0xc8], r14d
mov dword [rbx + 0xd4], r14d
mov qword [rbx + 0xd8], r14
test dword [0x18003f038], 0x80000000
je 0x18001746b
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
jne 0x180017470
call fcn.180010090
mov qword [rbx + 0x18], rax
mov rax, qword [rax + 0x60]
mov qword [rbx], rax
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x10], rax
test rax, 0xfffffffffffffffd
je 0x18001748f
lock inc dword [rax + 8]
mov dword [rbx + 0x50], r14d
mov dword [rbx + 0x54], r14d
mov dword [rbx + 0xcc], r14d
mov qword [rbx + 0x30], r14
lea rcx, [rbx + 0x38]
call fcn.180006980
lea rcx, [rbx + 0x60]
call fcn.180014b50
test bpl, bpl
je 0x180017501
mov rcx, qword [rbx + 0xa8]
mov rax, qword [rcx + 0xb0]
mov qword [rbx + 0xb0], rax
lock cmpxchg qword [rcx + 0xb0], rbx
je 0x180017517
nop dword [rax]
mov rdx, rax
mov qword [rbx + 0xb0], rax
mov rcx, qword [rbx + 0xa8]
lock cmpxchg qword [rcx + 0xb0], rbx
cmp rax, rdx
jne 0x1800174e0
jmp 0x180017517
mov eax, dword [rbx + 0xc8]
or eax, 1
mov dword [rbx + 0xc8], eax
mov qword [rbx + 0xb0], r14
call fcn.180010430
mov rdi, rax
mov rax, qword [rax + 0x40]
test rax, rax
jne 0x180017534
mov rcx, rdi
call fcn.1800163a0
mov rax, qword [rdi + 0x40]
mov eax, dword [rax + 0xa0]
mov dword [rbx + 0xd0], eax
and dword [rbx + 8], 0xfffffff
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180017940
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
movzx eax, byte [rsp + 0x39]
movabs r11, 0x100000001b3
movzx r8d, dl
mov r10, rcx
movzx ecx, byte [rsp + 0x3e]
movabs rdi, 0xcbf29ce484222325
xor r8, rdi
mov r9, rdx
imul r8, r11
xor edx, edx
xor r8, rax
movzx eax, byte [rsp + 0x3a]
imul r8, r11
xor r8, rax
movzx eax, byte [rsp + 0x3b]
imul r8, r11
xor r8, rax
movzx eax, byte [rsp + 0x3c]
imul r8, r11
xor r8, rax
movzx eax, byte [rsp + 0x3d]
imul r8, r11
xor rax, r8
imul rax, r11
xor rax, rcx
movzx ecx, byte [rsp + 0x3f]
imul rax, r11
xor rax, rcx
movsxd rcx, dword [r10 + 0xd0]
imul rax, r11
div rcx
mov rax, qword [r10 + 0xd8]
movsxd rcx, edx
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1800179f0
cmp qword [rdx + 8], r9
je 0x1800179f8
mov rdx, qword [rdx]
test rdx, rdx
jne 0x1800179e2
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x180017b1b
mov eax, dword [rbx + 0xc8]
shr eax, 1
test al, 1
je 0x180017b1b
mov r9, qword [rbx + 0xa8]
xor edx, edx
movzx r8d, r9b
mov rax, r9
shr rax, 8
xor r8, rdi
movzx ecx, al
mov rax, r9
shr rax, 0x10
imul r8, r11
xor r8, rcx
movzx ecx, al
imul r8, r11
mov rax, r9
xor r8, rcx
shr rax, 0x18
movzx ecx, al
mov rax, r9
shr rax, 0x20
imul r8, r11
xor r8, rcx
movzx ecx, al
imul r8, r11
mov rax, r9
xor r8, rcx
shr rax, 0x28
movzx ecx, al
mov rax, r9
shr rax, 0x30
movzx eax, al
imul r8, r11
xor r8, rcx
mov rcx, r9
shr rcx, 0x38
imul r8, r11
xor rax, r8
imul rax, r11
xor rax, rcx
movsxd rcx, dword [r10 + 0xd0]
imul rax, r11
div rcx
mov rax, qword [r10 + 0xd8]
movsxd rcx, edx
xor edx, edx
lea r8, [rax + rcx*8]
mov rcx, qword [rax + rcx*8]
test rcx, rcx
je 0x180017af9
mov rax, qword [rcx]
cmp qword [rcx + 8], r9
je 0x180017adb
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x180017ac5
jmp 0x180017af9
test rdx, rdx
jne 0x180017ae5
mov qword [r8], rax
jmp 0x180017ae8
mov qword [rdx], rax
dec dword [r10 + 0xd4]
mov edx, 0x18
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rcx, rbx
call fcn.180017620
mov edx, 0xe8
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180017dd0
Capabilities:
Get thread local storage value
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
test dword [0x18003f038], 0x80000000
je 0x180017e0d
mov ecx, dword [0x1800e2468]
call sub.KERNEL32.dll_TlsGetValue
mov rbx, rax
test rax, rax
jne 0x180017e15
call fcn.180010090
mov rbx, rax
mov rax, qword [rbx + 0x40]
test rax, rax
jne 0x180017e2a
mov rcx, rbx
call fcn.1800163a0
mov rax, qword [rbx + 0x40]
mov ecx, dword [rax + 0xa0]
cmp rbx, qword [rdi + 0x18]
jne 0x180017e4f
cmp ecx, dword [rdi + 0xd0]
jne 0x180017e4f
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, rbx
call fcn.180016810
test rax, rax
je 0x180017e69
cmp qword [rax + 0xa8], rdi
je 0x180017fa2
mov rdx, rdi
mov rcx, rbx
call fcn.180017940
test rax, rax
jne 0x180017fa2
mov ecx, 0xe8
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov qword [rsp + 0x58], rax
test rax, rax
je 0x180017ea4
mov r8b, 1
mov rdx, rdi
mov rcx, rax
call fcn.1800173d0
mov rsi, rax
jmp 0x180017ea6
xor esi, esi
mov rcx, rbx
call fcn.180016f00
movzx r8d, dil
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rdx, 0x100000001b3
imul r8, rdx
movzx eax, byte [rsp + 0x51]
xor r8, rax
imul r8, rdx
movzx eax, byte [rsp + 0x52]
xor r8, rax
imul r8, rdx
movzx eax, byte [rsp + 0x53]
xor r8, rax
imul r8, rdx
movzx eax, byte [rsp + 0x54]
xor r8, rax
imul r8, rdx
movzx eax, byte [rsp + 0x55]
xor rax, r8
imul rax, rdx
movzx ecx, byte [rsp + 0x56]
xor rax, rcx
imul rax, rdx
movzx ecx, byte [rsp + 0x57]
xor rax, rcx
imul rax, rdx
movsxd rcx, dword [rbx + 0xd0]
xor edx, edx
div rcx
movsxd rax, edx
lea r14, [rax*8]
mov rax, qword [rbx + 0xd8]
mov rax, qword [r14 + rax]
test rax, rax
je 0x180017f56
cmp qword [rax + 8], rdi
je 0x180017f9f
mov rax, qword [rax]
test rax, rax
jne 0x180017f48
mov ecx, 0x18
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
mov rdx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180017f7e
mov qword [rax], 0
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
jmp 0x180017f80
xor edx, edx
mov rax, qword [rbx + 0xd8]
mov rcx, qword [r14 + rax]
mov qword [rdx], rcx
mov rax, qword [rbx + 0xd8]
mov qword [r14 + rax], rdx
inc dword [rbx + 0xd4]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret