joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039d50
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, r8d
mov r14, rdx
mov rdx, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov qword [rsp + 0x20], r14
xor ebp, ebp
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
xor r8d, r8d
mov r9d, 3
call fcn.14005c850
lea rdi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
call fcn.14005c9e0
cmp qword [rsp + 0x290], 0
je 0x140039ef4
lea rsi, [rsp + 0x2a0]
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.14005c950
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x140039e28
test r15b, r15b
jne 0x140039e09
mov rcx, rbx
call fcn.14005c570
test al, al
jne 0x140039e28
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039e22
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.14005c570
test al, al
je 0x140039e80
xor ebp, ebp
test r15b, r15b
je 0x140039eb5
mov rcx, rdi
mov rdx, r14
mov r8b, 1
call fcn.140039d50
mov ebp, eax
test eax, eax
jne 0x140039eb5
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039e65
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140039eb5
jmp 0x140039e9f
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140039e96
mov rcx, qword [rsp + 0x280]
call r12
xor ebp, ebp
test eax, eax
jne 0x140039eb5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.140012100
mov rcx, rsi
mov rdx, rbx
call fcn.14005c9e0
mov rcx, rdi
mov rdx, rbx
call fcn.140032540
mov rcx, rbx
call fcn.140032460
cmp qword [rsp + 0x290], 0
mov r13d, ebp
jne 0x140039de0
lea rcx, [rsp + 0x280]
call fcn.140032460
lea rcx, [rsp + 0x2a0]
call fcn.14005c880
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.14014b5e0
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14003a480
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x68]
xor edx, edx
call fcn.14004f370
test esi, esi
js 0x14003a528
lea rcx, [rsp + 0x58]
call fcn.14004ebc0
call fcn.14008b5f0
test al, al
je 0x14003a4e4
movsxd r9, esi
lea rdx, str.File::Read
lea rcx, [rsp + 0x58]
mov r8, rbx
call fcn.14008b690
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14003a52f
mov esi, dword [rsp + 0x2c]
jmp 0x14003a540
mov esi, 0xffffffff
jmp 0x14003a54a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg esi
lea rcx, [rsp + 0x58]
call fcn.14008b660
lea rcx, [rsp + 0x68]
call fcn.14004f470
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003a580
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x60]
xor esi, esi
xor edx, edx
call fcn.14004f370
lea rcx, [rsp + 0x50]
call fcn.14004ebc0
call fcn.14008b5f0
test al, al
je 0x14003a5e0
movsxd r9, ebp
lea rdx, str.File::Write
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.14008b690
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.14008b660
lea rcx, [rsp + 0x60]
call fcn.14004f470
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14014b5e0
mov eax, esi
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14003a660
Capabilities:
Get file size

Disassembly:
push rsi
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14004f370
lea rcx, [rsp + 0x30]
call fcn.14004ebc0
call fcn.14008b5f0
test al, al
je 0x14003a6ad
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
xor r9d, r9d
call fcn.14008b690
mov rcx, qword [rsi]
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor esi, esi
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.14008b660
lea rcx, [rsp + 0x40]
call fcn.14004f470
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14014b5e0
mov rax, rsi
add rsp, 0x60
pop rsi
ret
Function at 0x14003a700
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14004f370
lea rcx, [rsp + 0x30]
call fcn.14004ebc0
call fcn.14008b5f0
test al, al
je 0x14003a752
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x30]
mov r8, rsi
mov r9, rdi
call fcn.14008b690
mov rcx, qword [rsi]
xor ebx, ebx
lea r8, [rsp + 0x28]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003a7b0
mov rcx, qword [rsi]
xor ebx, ebx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003a7b0
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14003a7ae
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x14003a7b0
xor ebx, ebx
lea rcx, [rsp + 0x30]
call fcn.14008b660
lea rcx, [rsp + 0x40]
call fcn.14004f470
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14014b5e0
mov eax, ebx
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003b780
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r14, rcx
mov rax, qword [0x1401e3a38]
xor rax, rbp
mov qword [rbp], rax
call fcn.14002bde0
mov rdi, rax
lea rbx, [0x1401a9001]
mov rcx, rax
mov rdx, rbx
call fcn.14002c2f0
test al, al
jne 0x14003b7dd
lea rdx, str.vmodule
mov rcx, rdi
call fcn.14002c2f0
test al, al
je 0x14003b8ea
cmp qword [0x1401e6440], 0
jne 0x14003b9ed
mov rax, qword [0x1401e6448]
mov qword [0x1401e6440], rax
mov ecx, 0x20
call fcn.14014b1a0
mov rsi, rax
lea rcx, str.vmodule
mov qword [rbp - 0x50], rcx
call fcn.140186380
mov qword [rbp - 0x48], rax
lea r15, [rbp - 0x20]
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.14002c360
mov qword [rbp - 0x60], rbx
mov rcx, rbx
call fcn.140186380
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov rcx, rdi
mov rdx, rbx
call fcn.14002c360
lea r9, [0x1401e6450]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.14008bbc0
mov qword [0x1401e6448], rsi
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x14003b8ab
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003b8a6
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003b9f4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14014b210
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x14003b8ea
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14003b8e5
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x14003b9f4
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.14014b210
mov eax, dword [r14]
mov dword [0x1401e2280], eax
mov bl, 1
test al, 1
je 0x14003b9cf
mov rcx, qword [0x1401e64a0]
test rcx, rcx
je 0x14003b91a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1401e64a0], 0
mov rdi, qword [0x1401e6458]
test rdi, rdi
jne 0x14003b953
mov ecx, 0x20
call fcn.14014b1a0
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x1401e6458], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.140186640
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x14003b982
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.140006110
cmp dword [r14 + 0x14], 0
jne 0x14003b9c8
jmp 0x14003b9b1
mov r15, rdi
cmp rax, 8
jb 0x14003b98e
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.14016f270
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x14003b9c8
mov rcx, qword [0x1401e6458]
cmp qword [rcx + 0x18], 7
jbe 0x14003b9c2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.14003ba00
mov ebx, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.14014b5e0
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
int3
call fcn.140179190
ud2
Function at 0x14003d360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x14003d3e1
xor r11d, r11d
lea r10, [0x14019e3f0]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x14003d390
jmp 0x14003d3e4
mov edx, r9d
cmp edx, dword [rcx + 0x18]
sete al
pop rsi
ret

Function at 0x14003d3f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
sub rax, r8
mov r9, rax
sar r9, 2
test rax, rax
je 0x14003d471
xor r11d, r11d
lea r10, [0x14019e3f0]
mov edx, r9d
nop word cs:[rax + rax]
nop
mov eax, dword [r8 + r11*4]
mov esi, eax
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 8
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
mov esi, eax
shr esi, 0x10
xor esi, edx
movzx esi, sil
shr edx, 8
xor edx, dword [r10 + rsi*4]
movzx esi, dl
shr eax, 0x18
xor eax, esi
shr edx, 8
xor edx, dword [r10 + rax*4]
add r11, 1
cmp r11, r9
jb 0x14003d420
jmp 0x14003d474
mov edx, r9d
mov dword [rcx + 0x18], edx
pop rsi
ret
Function at 0x140043f00
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r15, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov r8, qword [r15 + 0x18]
lea rdi, [rdx + rdx]
add rdi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x140043f83
mov rdx, qword [rdx]
mov rsi, rcx
cmp rcx, rax
je 0x140043f92
mov rsi, qword [r8 + rdi*8]
mov rsi, qword [rsi]
cmp rsi, rdx
je 0x140043fab
cmp dword [rdx + 0x10], ebx
jne 0x140043f80
cmp rdx, rax
je 0x140043fab
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x140044020
mov rdi, qword [rax]
mov r12, qword [rdi + 8]
mov ecx, 0x38
call fcn.14014b1a0
mov rsi, rax
test rdi, rdi
mov rax, r12
cmove rax, rsi
mov rcx, rdi
cmove rcx, rsi
mov qword [rsi], rcx
mov qword [rsi + 8], rax
mov eax, dword [r13]
mov dword [rsi + 0x10], eax
lea rcx, [rsi + 0x18]
call fcn.140032280
mov rax, qword [r15 + 0x10]
movabs rcx, 0x492492492492491
cmp rax, rcx
je 0x140044033
add rax, 1
mov qword [r15 + 0x10], rax
mov qword [rdi + 8], rsi
mov qword [r12], rsi
mov rax, qword [r15 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r15
mov rdx, r14
call fcn.140044050
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.14014ccf0
ud2
Function at 0x140045560
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14004558f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140045592
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x1400455b3
test bl, bl
je 0x1400455fc
cmp byte [rdi + 8], 0
je 0x1400455ee
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400455f1
cmp byte [rdi + 8], 0
je 0x1400455c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x1400455c7
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400455dd
xor edi, edi
jmp 0x140045678
cmp byte [rdi + 8], 0
je 0x140045630
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140045633
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rdi + 8], 0
je 0x14004560d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x140045610
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x1401ea778]
mov dil, 1
test rcx, rcx
je 0x140045678
mov edx, eax
mov r8d, esi
call fcn.14008e5c0
jmp 0x140045678
mov rcx, qword [rdi]
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140045646
mov esi, dword [rsp + 0x24]
cmp byte [rdi + 8], 0
je 0x140045657
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14004565a
mov rcx, qword [rdi]
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x1401ea778]
test rcx, rcx
je 0x140045675
mov edx, eax
mov r8d, esi
call fcn.14008e5c0
mov dil, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014b5e0
mov eax, edi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140045b90
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x28]
call fcn.1401750d0
mov dword [rsi + 0x28], eax
mov ecx, dword [rsi + 0x2c]
call fcn.1401750d0
mov dword [rsi + 0x2c], eax
mov ecx, dword [rsi + 0x30]
call fcn.1401750d0
mov dword [rsi + 0x30], eax
mov ecx, dword [rsi + 0x34]
call fcn.1401750d0
mov dword [rsi + 0x34], eax
mov ecx, dword [rsi + 0x38]
call fcn.1401750d0
mov dword [rsi + 0x38], eax
mov ecx, dword [rsi + 0x3c]
call fcn.1401750d0
mov dword [rsi + 0x3c], eax
mov ecx, dword [rsi + 0x40]
call fcn.1401750d0
mov dword [rsi + 0x40], eax
mov ecx, dword [rsi + 0x44]
call fcn.1401750d0
mov dword [rsi + 0x44], eax
mov ecx, dword [rsi + 0x48]
call fcn.1401750d0
mov dword [rsi + 0x48], eax
mov ecx, dword [rsi + 0x4c]
call fcn.1401750d0
mov dword [rsi + 0x4c], eax
mov ecx, dword [rsi + 0x50]
call fcn.1401750d0
mov dword [rsi + 0x50], eax
mov ecx, dword [rsi + 0x54]
call fcn.1401750d0
mov dword [rsi + 0x54], eax
mov ecx, dword [rsi + 0x58]
call fcn.1401750d0
mov dword [rsi + 0x58], eax
mov ecx, dword [rsi + 0x5c]
call fcn.1401750d0
mov dword [rsi + 0x5c], eax
mov ecx, dword [rsi + 0x60]
call fcn.1401750d0
mov dword [rsi + 0x60], eax
mov ecx, dword [rsi + 0x64]
call fcn.1401750d0
mov dword [rsi + 0x64], eax
xor eax, eax
nop
mov ecx, dword [rsi + rax*4 + 0x48]
xor ecx, dword [rsi + rax*4 + 0x5c]
xor ecx, dword [rsi + rax*4 + 0x30]
xor ecx, dword [rsi + rax*4 + 0x28]
rol ecx, 1
mov dword [rsi + rax*4 + 0x68], ecx
add rax, 1
cmp rax, 0x40
jne 0x140045c50
movdqu xmm0, xmmword [rsi + 0x14]
movdqu xmmword [rsi], xmm0
mov r8d, dword [rsi + 0x24]
mov dword [rsi + 0x10], r8d
movd edi, xmm0
pshufd xmm1, xmm0, 0xe5
movd ebp, xmm1
pshufd xmm1, xmm0, 0x4e
movd ecx, xmm1
pshufd xmm1, xmm0, 0xe7
movd r10d, xmm1
xor eax, eax
mov r11d, 0x8f1bbcdc
mov ebx, r8d
nop dword [rax]
mov r14d, edi
mov r9d, r10d
mov r10d, ecx
mov ecx, ebp
mov ebp, edi
rol ebp, 5
cmp rax, 0x14
jae 0x140045cf0
mov edx, ecx
and edx, r10d
mov edi, ecx
not edi
and edi, r9d
or edi, edx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x5a827999
jmp 0x140045d45
cmp rax, 0x28
jae 0x140045d10
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
mov ebx, 0x6ed9eba1
jmp 0x140045d45
cmp rax, 0x3b
ja 0x140045d28
mov edx, r10d
or edx, r9d
and edx, ecx
mov edi, r10d
and edi, r9d
or edi, edx
jmp 0x140045d30
mov edi, r10d
xor edi, r9d
xor edi, ecx
add edi, ebp
add edi, ebx
add edi, dword [rsi + rax*4 + 0x28]
cmp rax, 0x3c
mov ebx, 0xca62c1d6
cmovb ebx, r11d
add edi, ebx
rol ecx, 0x1e
add rax, 1
mov ebx, r9d
mov ebp, r14d
cmp rax, 0x50
jne 0x140045cb0
mov dword [rsi + 0x10], r9d
mov dword [rsi + 0xc], r10d
mov dword [rsi + 8], ecx
mov dword [rsi + 4], r14d
mov dword [rsi], edi
movd xmm1, r10d
movd xmm2, ecx
punpckldq xmm2, xmm1
movd xmm1, r14d
movd xmm3, edi
punpckldq xmm3, xmm1
punpcklqdq xmm3, xmm2
paddd xmm3, xmm0
movdqu xmmword [rsi + 0x14], xmm3
add r8d, r9d
mov dword [rsi + 0x24], r8d
mov dword [rsi + 0x168], 0
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14004f880
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401e22b8]
cmp ecx, 0xffffffff
je 0x14004f89e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
jmp 0x14004f8a0
xor eax, eax
add rsp, 0x28
ret

Function at 0x14004f8b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1401e22b8]
cmp ecx, 0xffffffff
je 0x14004f8dd
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004f8e2
call fcn.14004fa10
mov eax, dword [0x1401e7d28]
mov ecx, dword [0x1401ea448]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x18]
jg 0x14004f9ab
mov rbx, qword [0x1401e7d20]
mov rcx, rbx
call fcn.14004ebd0
mov rcx, qword [0x1401e6518]
add rcx, 1
xor edx, edx
lea rax, [0x1401e6520]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14004f961
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x14004f961
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x14004f930
jmp 0x14004f986
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401e6518], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x14004f9f3
cmp eax, 0x100
jge 0x14004f9fa
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1401e7d28]
call fcn.14014b390
mov eax, dword [0x1401e7d28]
cmp eax, 0xffffffff
jne 0x14004f907
mov ecx, 8
call fcn.14014b1a0
mov rbx, rax
mov rcx, rax
call fcn.14004ebc0
mov qword [0x1401e7d20], rbx
lea rcx, [0x1401e7d28]
call fcn.14014b400
jmp 0x14004f907
int3
int3
Function at 0x14004fa10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.14014b570
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x1401e3a38]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x1401e22b8]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x14004faa8
lea rcx, [rbp - 0x54]
call fcn.1400a2cf0
test al, al
je 0x14004fb1f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x14004fa88
lea rcx, [rbp - 0x54]
call fcn.1400a2cf0
test al, al
je 0x14004fb26
cmp dword [rbp - 0x54], 0xffffffff
je 0x14004fb26
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x1401e22b8], ecx
mov ecx, dword [rbp - 0x54]
je 0x14004faa8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1401e22b8]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fb18
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.14016f6e0
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14014b220
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.14016f270
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.14014b5e0
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3

Function at 0x14004fc00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1401e22b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004fc2f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14004fc2f
mov rax, qword [rax + rcx]
jmp 0x14004fc31
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14004fc40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1401e22b8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fc62
call fcn.14004fa10
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140050230
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rcx
mov rax, qword [0x1401e3a38]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, byte [rdx]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx ebx, byte [rdx + 1]
xor rbx, rcx
imul rbx, rax
movzx ecx, byte [rdx + 2]
xor rcx, rbx
imul rcx, rax
movzx ebx, byte [rdx + 3]
xor rbx, rcx
imul rbx, rax
and rbx, qword [r14 + 0x30]
mov r9, qword [r14 + 8]
mov r10, qword [r14 + 0x18]
lea r11, [rbx + rbx]
add r11, 1
shl rbx, 4
mov rax, qword [r10 + rbx]
mov edx, dword [rdx]
xor edi, edi
mov r8, rax
jmp 0x1400502c3
mov r8, qword [r8]
mov rbx, rax
cmp rax, r9
je 0x1400502d2
mov rcx, qword [r10 + r11*8]
mov rbx, qword [rcx]
mov cl, 1
cmp rbx, r8
je 0x140050342
cmp dword [r8 + 0x10], edx
jne 0x1400502c0
mov rsi, r8
jmp 0x1400502f3
mov rsi, qword [rsi]
mov rdi, rax
cmp rax, r9
je 0x140050302
mov rdi, qword [r10 + r11*8]
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x14005030c
cmp edx, dword [rsi + 0x10]
je 0x1400502f0
xor edi, edi
cmp r8, rsi
je 0x140050342
mov rax, r8
nop word cs:[rax + rax]
add rdi, 1
mov rax, qword [rax]
cmp rsi, rax
jne 0x140050320
xor ecx, ecx
cmp qword [r9], r8
jne 0x14005034d
cmp rsi, r9
jne 0x14005034d
mov rcx, r14
call fcn.140052350
jmp 0x140050376
mov r8, r9
mov rsi, r9
cmp qword [r9], r8
je 0x140050333
test cl, cl
jne 0x140050376
lea r15, [rsp + 0x20]
nop word cs:[rax + rax]
mov rbx, qword [r8]
mov rcx, r14
mov rdx, r15
call fcn.140054710
mov r8, rbx
cmp rsi, rbx
jne 0x140050360
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14014b5e0
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret