joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180023b70
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push r13
sub rsp, 0x38
mov r13, qword [0x18007f7d8]
mov qword [rsp + 0x50], rbx
mov rbx, rdx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rdi
mov rdi, rcx
mov qword [rsp + 0x30], r12
test rdx, rdx
jne 0x180023bae
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rcx + rbx], 0
jne 0x180023ba5
test r13, r13
je 0x180023bba
inc dword [r13 + 0x3bc]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
mov rdx, rdi
mov rcx, rax
mov qword [rsp + 0x58], rax
mov rsi, rax
lea r12, [rax + rbx]
call sub.VCRUNTIME140.dll_memcpy
xor ebp, ebp
mov byte [r12], 0
xor edi, edi
mov rcx, rsi
cmp rsi, r12
jae 0x180023d83
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0xa
je 0x180023dc7
cmp al, 0xd
je 0x180023dc7
mov rbx, rcx
cmp rcx, r12
jae 0x180023c33
nop dword [rax + rax]
movzx eax, byte [rbx]
cmp al, 0xa
je 0x180023c33
cmp al, 0xd
je 0x180023c33
inc rbx
cmp rbx, r12
jb 0x180023c20
mov byte [rbx], 0
movzx eax, byte [rcx]
cmp al, 0x3b
je 0x180023d67
cmp al, 0x5b
jne 0x180023d4e
cmp rbx, rcx
jbe 0x180023d4e
cmp byte [rbx - 1], 0x5d
lea rsi, [rbx - 1]
jne 0x180023d4e
lea r14, [rcx + 1]
mov byte [rsi], 0
mov r8, rsi
mov rcx, r14
sub r8, r14
mov edx, 0x5d
call sub.VCRUNTIME140.dll_memchr
mov r15, rax
test rax, rax
je 0x180023d67
lea rcx, [rax + 1]
mov edx, 0x5b
sub rsi, rcx
mov r8, rsi
call sub.VCRUNTIME140.dll_memchr
mov r11, rax
test rax, rax
je 0x180023d67
mov r10, qword [0x18007f7d8]
lea r8, [r14 + 1]
mov byte [r15], 0
mov esi, 0xffffffff
movzx r9d, byte [r14]
mov ecx, esi
test r9b, r9b
je 0x180023cfa
cmp r9b, 0x23
jne 0x180023cd7
cmp byte [r8], r9b
jne 0x180023cd7
cmp byte [r8 + 1], r9b
cmove ecx, esi
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
lea rax, [0x1800661b0]
inc r8
xor ecx, dword [rax + rdx*4]
test r9b, r9b
jne 0x180023cc5
mov r8d, dword [r10 + 0x2f10]
xor eax, eax
not ecx
test r8d, r8d
jle 0x180023d24
mov r9, qword [r10 + 0x2f18]
lea rdx, [r9 + 8]
cmp dword [rdx], ecx
je 0x180023d2a
inc eax
add rdx, 0x30
cmp eax, r8d
jl 0x180023d15
xor edi, edi
xor ebp, ebp
jmp 0x180023d67
cdqe
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, r9
je 0x180023d26
mov rax, qword [rdi + 0x10]
lea r8, [r11 + 1]
mov rdx, rdi
mov rcx, r13
call rax
mov rbp, rax
jmp 0x180023d67
test rdi, rdi
je 0x180023d67
test rbp, rbp
je 0x180023d67
mov r9, rcx
mov r8, rbp
mov rcx, r13
mov rdx, rdi
call qword [rdi + 0x18]
lea rcx, [rbx + 1]
cmp rcx, r12
jb 0x180023c00
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
test rsi, rsi
je 0x180023dae
mov rax, qword [0x18007f7d8]
test rax, rax
je 0x180023dae
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [r13 + 0x2ef4], 1
add rsp, 0x38
pop r13
pop rsi
ret
inc rcx
jmp 0x180023c00
Function at 0x180023dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x18007f7d8]
xor r15d, r15d
mov r14, rcx
mov dword [rbx + 0x2ef8], r15d
test rcx, rcx
je 0x180023efb
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
lea rdi, [rbx + 0x2f00]
mov dword [rbx + 0x2ef8], r15d
mov ecx, dword [rdi + 4]
test ecx, ecx
jns 0x180023e34
mov eax, ecx
cdq
sub eax, edx
mov edx, r15d
sar eax, 1
add eax, ecx
mov rcx, rdi
test eax, eax
cmovg edx, eax
call fcn.180025100
mov dword [rdi], r15d
cmp dword [rdi + 4], r15d
jne 0x180023e4a
mov edx, 8
mov rcx, rdi
call fcn.180025100
movsxd rcx, dword [rdi]
mov ebp, r15d
mov rax, qword [rdi + 8]
mov byte [rcx + rax], r15b
inc dword [rdi]
cmp dword [rbx + 0x2f10], r15d
jle 0x180023e95
mov rsi, r15
nop word [rax + rax]
mov r9, qword [rbx + 0x2f18]
mov r8, rdi
add r9, rsi
mov rcx, rbx
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add rsi, 0x30
cmp ebp, dword [rbx + 0x2f10]
jl 0x180023e70
mov eax, dword [rdi]
lea rdx, [0x18006b754]
test eax, eax
lea rdi, [0x18007f721]
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f08]
cmove ecx, r15d
test rax, rax
movsxd rsi, ecx
mov rcx, r14
cmovne rdi, rax
call fcn.180012e70
mov rbp, qword [rsp + 0x40]
mov rbx, rax
test rax, rax
je 0x180023ef1
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x18002ea10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x18002eba1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x18002ea80
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.18002e470
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.18002e040
mov dword [rbx + 0x80], 0
jmp 0x18002eb8d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.18002dac0
movzx edx, word [rbx + 0x4c]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x4c], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x180053d20
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x180079010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
cmp rdi, 0x40000000
jbe 0x180053d6f
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x18007fea0]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x180053dad
cmp rsi, r14
jb 0x180053da5
cmp rsi, r15
jae 0x180053da5
cmp qword [rsi + 8], 0
jne 0x180053f77
mov rsi, qword [rsi]
test rsi, rsi
jne 0x180053d90
mov qword [rsp + 0xc8], rbx
mov rbx, rdi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0x90], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x180053e42
nop dword [rax]
nop word [rax + rax]
mov ebp, dword [rsp + 0x78]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x180053e39
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180053e39
cmp dword [rsp + 0x40], 0x10000
je 0x180053ebb
mov rbx, qword [rsp + 0x28]
cmp rbx, rbp
jb 0x180053e39
sub rbx, rbp
cmp rbx, r14
jae 0x180053e00
test rsi, rsi
jne 0x180053f20
cmp rdi, r15
ja 0x180053f5f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x78]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x180053f5f
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180053f5f
cmp dword [rsp + 0x40], 0x10000
je 0x180053ef1
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x38]
add rdi, qword [rsp + 0x20]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x180053e72
jmp 0x180053f5f
test rbx, rbx
je 0x180053e39
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180053f20
cmp rbx, r14
jae 0x180053de0
jmp 0x180053e42
test rdi, rdi
je 0x180053f5f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x180053f20
cmp rdi, r15
jbe 0x180053e50
jmp 0x180053f5f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x180053f30
mov rax, qword [0x18007fea0]
mov qword [rsi], rax
mov qword [0x18007fea0], rsi
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc8]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180061a00
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
ret
Function at 0x180054990
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180079010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180054adf
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x180054ad6
mov esi, 1
mov qword [rsp + 0x68], rbx
cmp dword [rsp + 0x20], 0x10
jb 0x180054a8c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180054a8c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180054a8c
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180054a4d
mov rcx, qword [0x18007f7e0]
mov r8d, 0x200
mov dword [rdi + 8], 0x80
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x180054ab5
lea rbx, [rdi + 0xc]
jmp 0x180054a81
mov eax, dword [rdi + 8]
lea rbx, [rdi + 0xc]
cmp dword [rbx], eax
jb 0x180054a81
mov rcx, qword [0x18007f7e0]
add eax, eax
mov r9d, eax
mov r8, rdx
shl r9, 2
xor edx, edx
mov dword [rdi + 8], eax
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x180054ab5
mov qword [rdi], rax
mov ecx, dword [rbx]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rbx]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1800549f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x180054ad1
mov r8, qword [rdi]
xor esi, esi
test r8, r8
je 0x180054ad1
mov rcx, qword [0x18007f7e0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rsi
mov rbx, qword [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180061a00
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x180054b00
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebp, r8d
mov qword [rcx], 0
mov r14d, edx
mov qword [rcx + 8], 0
mov rdi, rcx
call fcn.180054990
test eax, eax
jne 0x180054b47
mov eax, 9
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rdi], 0
je 0x180054bbe
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x180054ba6
mov qword [rsp + 0x38], rsi
nop
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180054b9a
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1800547e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x180054b60
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbp, qword [rsp + 0x40]
xor eax, eax
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180054be0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180079010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x18007fe90]
mov rdx, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [rdx - 5]
cmove rdi, rdx
lea rsi, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180054c49
mov eax, 0xa
jmp 0x180054c96
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180054c65
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180061a00
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180054cc0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x30
mov edx, dword [0x18007fe9c]
xor ebx, ebx
test edx, edx
je 0x180054cef
mov rcx, qword [0x18007fe90]
add rcx, 0x20
nop dword [rax]
test byte [rcx], 2
je 0x180054cf7
inc ebx
add rcx, 0x38
cmp ebx, edx
jb 0x180054ce0
xor eax, eax
add rsp, 0x30
pop rbx
ret
cmp ebx, 0xffffffff
je 0x180054cef
mov edx, 0xffffffff
mov qword [rsp + 0x50], rdi
mov r8d, 1
lea rcx, [rsp + 0x20]
call fcn.180054b00
mov edi, eax
test eax, eax
jne 0x180054dd2
mov eax, dword [0x18007fe9c]
cmp ebx, eax
jae 0x180054d5d
nop word [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x18007fe90]
test byte [rdx + rcx + 0x20], 2
jne 0x180054d57
mov ecx, ebx
call fcn.180054be0
mov edi, eax
test eax, eax
jne 0x180054d5d
mov eax, dword [0x18007fe9c]
inc ebx
cmp ebx, eax
jb 0x180054d30
cmp qword [rsp + 0x20], 0
je 0x180054dd0
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180054dbc
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180054da8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180054d80
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18007f7e0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbx
ret
Function at 0x1800550d0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov ebx, r15d
xor eax, eax
mov esi, 1
lock cmpxchg dword [0x18007f748], esi
je 0x180055121
nop
cmp rbx, 0x20
jae 0x18005510a
xor ecx, ecx
jmp 0x18005510c
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x18007f748], esi
jne 0x180055100
cmp qword [0x18007f7e0], r15
je 0x180055214
test rdi, rdi
jne 0x18005513f
call fcn.180054cc0
mov esi, eax
jmp 0x180055219
mov ecx, dword [0x18007fe9c]
mov ebx, r15d
test ecx, ecx
je 0x180055165
mov r8, qword [0x18007fe90]
mov rax, r8
cmp rdi, qword [rax]
je 0x18005516f
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180055156
mov esi, 4
jmp 0x180055219
cmp ebx, 0xffffffff
je 0x180055165
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x18005520d
mov r8d, esi
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.180054b00
mov esi, eax
test eax, eax
jne 0x180055219
mov ecx, ebx
call fcn.180054be0
mov esi, eax
cmp qword [rsp + 0x20], r15
je 0x180055219
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1800551f7
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rdi, rax
test rax, rax
je 0x1800551e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800551c0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x18007f7e0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180055219
mov esi, 5
jmp 0x180055219
mov esi, 2
xchg dword [0x18007f748], r15d
mov rbx, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x180055e10
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
movaps xmmword [r11 - 0x28], xmm6
mov rax, qword [0x180079010]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, rdx
mov dword [r11 - 0x38], r8d
mov rcx, qword [0x18007f940]
mov rax, qword [rcx]
mov r9, qword [rax + 0x68]
xor r8d, r8d
lea rdx, str.client.dll
call r9
mov rcx, rax
test rax, rax
je 0x180055f0d
mov rax, qword [rax]
mov r9, qword [rax + 0x10]
mov r8, rbx
lea rdx, [rsp + 0x80]
call r9
mov rax, qword [rsp + 0x80]
mov rdi, qword [rax]
test rdi, rdi
jne 0x180055f14
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea ecx, [rdi + 0x18]
call fcn.180061ef4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x58], 8
mov dword [rsp + 0x20], 0x3f800000
mov r8, rax
lea edx, [rdi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.180056610
nop
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x80]
call fcn.180056900
nop
lea rcx, [rsp + 0x20]
call fcn.180056090
xor al, al
jmp 0x180056051
movsx rbx, word [rdi + 0x1c]
mov rdi, qword [rdi + 0x28]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x60]
call fcn.180056ef0
mov rsi, qword [rax]
xorps xmm0, xmm0
test rbx, rbx
js 0x180055f41
cvtsi2ss xmm0, rbx
jmp 0x180055f59
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor eax, eax
movabs r14, 0x8000000000000000
movss xmm6, dword [0x18006d2b0]
comiss xmm0, xmm6
jb 0x180055f88
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x180055f88
mov rax, r14
cvttss2si rbp, xmm0
add rbp, rax
mov rcx, qword [rsi + 0x28]
xorps xmm0, xmm0
test rcx, rcx
js 0x180055fa3
cvtsi2ss xmm0, rcx
jmp 0x180055fb8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rsi + 0x18]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor eax, eax
comiss xmm0, xmm6
jb 0x180055fd5
subss xmm0, xmm6
comiss xmm0, xmm6
jae 0x180055fd5
mov rax, r14
cvttss2si rdx, xmm0
add rdx, rax
cmp rdx, rbp
cmovb rdx, rbp
cmp rdx, qword [rsi + 0x50]
jbe 0x180055ff3
lea rcx, [rsi + 0x18]
call fcn.180056750
test rbx, rbx
jle 0x18005604f
nop dword [rax + rax]
mov rcx, qword [rdi]
movsx eax, byte [rcx]
test al, al
jne 0x180056011
mov eax, 0x811c9dc5
jmp 0x180056024
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
inc rcx
call fcn.180002260
mov dword [rsp + 0x80], eax
lea r9, [rdi + 0x10]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x18]
call fcn.180056c30
add rdi, 0x20
sub rbx, 1
jne 0x180056000
mov al, 1
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180061a00
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180056140
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov dword [rsp + 0x20], r9d
mov ebx, edx
mov rbp, rcx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x30], r9d
mov r8d, dword [0x18007f5e8]
mov rax, qword gs:[0x58]
mov r14, qword [rax + r8*8]
xor edi, edi
movabs rsi, 0x100000001b3
movzx r15d, byte [rsp + 0x2b]
movzx r12d, byte [rsp + 0x2a]
movzx r13d, byte [rsp + 0x29]
mov ecx, 4
mov eax, dword [r14 + rcx]
cmp dword [0x18007fe60], eax
jle 0x180056280
lea rcx, [0x18007fe60]
call fcn.180061ac8
cmp dword [0x18007fe60], 0xffffffff
jne 0x180056280
xorps xmm0, xmm0
movups xmmword [0x18007fe20], xmm0
movups xmmword [0x18007fe30], xmm0
movups xmmword [0x18007fe40], xmm0
movups xmmword [0x18007fe50], xmm0
mov dword [0x18007fe20], 0
mov qword [0x18007fe28], rdi
mov qword [0x18007fe30], rdi
mov ecx, 0x58
call fcn.180061ef4
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [0x18007fe28], rax
mov qword [0x18007fe38], rdi
xorps xmm0, xmm0
movdqa xmmword [0x18007fe40], xmm0
mov qword [0x18007fe50], 7
mov qword [0x18007fe58], 8
mov dword [0x18007fe20], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [0x18007fe38]
call fcn.180056610
nop
lea rcx, [0x180064640]
call fcn.180061ea8
nop
lea rcx, [0x18007fe60]
call fcn.180061a5c
nop word [rax + rax]
movzx ecx, bl
movabs r9, 0xcbf29ce484222325
xor rcx, r9
imul rcx, rsi
xor rcx, r13
imul rcx, rsi
xor rcx, r12
imul rcx, rsi
xor rcx, r15
imul rcx, rsi
and rcx, qword [0x18007fe50]
add rcx, rcx
mov rdx, qword [0x18007fe38]
mov rax, qword [rdx + rcx*8 + 8]
mov r8, qword [0x18007fe28]
cmp rax, r8
je 0x1800562e4
mov rcx, qword [rdx + rcx*8]
cmp ebx, dword [rax + 0x10]
je 0x1800562e7
cmp rax, rcx
je 0x1800562e4
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x1800562d4
jmp 0x1800562e7
mov rax, rdi
mov rdx, r8
test rax, rax
cmovne rdx, rax
cmp rdx, r8
jne 0x180056310
mov r8d, ebx
mov rdx, rbp
call fcn.180055e10
jmp 0x180056199
mov esi, dword [rsp + 0x20]
movzx ecx, sil
xor rcx, r9
movabs r8, 0x100000001b3
imul rcx, r8
movzx eax, byte [rsp + 0x31]
xor rcx, rax
imul rcx, r8
movzx eax, byte [rsp + 0x32]
xor rcx, rax
imul rcx, r8
movzx eax, byte [rsp + 0x33]
xor rcx, rax
imul rcx, r8
mov r8, qword [rdx + 0x48]
and r8, rcx
add r8, r8
mov r10, qword [rdx + 0x30]
mov rax, qword [r10 + r8*8 + 8]
mov rcx, rax
mov r9, qword [rdx + 0x20]
cmp rax, r9
je 0x180056386
mov rdx, qword [r10 + r8*8]
cmp esi, dword [rax + 0x10]
je 0x180056383
cmp rcx, rdx
je 0x180056386
mov rcx, qword [rcx + 8]
cmp esi, dword [rcx + 0x10]
jne 0x180056375
mov rdi, rcx
test rdi, rdi
cmove rdi, r9
cmp rdi, r9
jne 0x1800563b0
xor eax, eax
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp rax, r9
je 0x1800563d5
mov rcx, qword [r10 + r8*8]
cmp esi, dword [rax + 0x10]
je 0x1800563ce
nop
cmp rax, rcx
je 0x1800563d5
mov rax, qword [rax + 8]
cmp esi, dword [rax + 0x10]
jne 0x1800563c0
movsx rax, word [rax + 0x14]
jmp 0x180056394
lea rcx, str.invalid_unordered_map_K__T__key
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3