joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002a800
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov r14, r9
mov r15, r8
mov rdi, rdx
mov rsi, rcx
movzx ecx, byte [r8]
mov r12d, ecx
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rax, 0x100000001b3
imul r12, rax
mov rdx, qword [rsi + 0x30]
and rdx, r12
add rdx, rdx
mov r8, qword [rsi + 0x18]
mov rax, qword [r8 + rdx*8 + 8]
lea r13, [rsi + 8]
mov rbp, qword [r13]
cmp rax, rbp
je 0x14002a894
mov rdx, qword [r8 + rdx*8]
cmp cl, byte [rax + 0x10]
je 0x14002a876
cmp rax, rdx
je 0x14002a891
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x14002a868
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, rax
movabs rax, 0x666666666666666
cmp qword [rsi + 0x10], rax
je 0x14002aa2e
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x28], 0
mov ecx, 0x28
call fcn.1400ab6e8
mov rbx, rax
mov qword [rsp + 0x28], rax
movzx eax, byte [r15]
mov byte [rbx + 0x10], al
xor r15d, r15d
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov rax, qword [r14]
mov qword [rbx + 0x18], rax
mov rax, qword [r14 + 8]
mov qword [rbx + 0x20], rax
mov qword [r14], r15
mov qword [r14 + 8], r15
mov r8, qword [rsi + 0x10]
lea rdx, [r8 + 1]
xorps xmm0, xmm0
test rdx, rdx
js 0x14002a907
cvtsi2ss xmm0, rdx
jmp 0x14002a91f
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14002a932
cvtsi2ss xmm1, rcx
jmp 0x14002a947
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14002a9c7
mov rcx, rsi
call fcn.140029b70
mov rdx, rax
mov rcx, rsi
call fcn.1400299d0
mov rdx, qword [rsi + 0x30]
and rdx, r12
add rdx, rdx
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rdx*8 + 8]
mov rax, qword [r13]
cmp rcx, rax
jne 0x14002a98b
mov qword [rsp + 0x28], r15
jmp 0x14002a9ae
mov rdx, qword [r8 + rdx*8]
movzx eax, byte [rbx + 0x10]
cmp al, byte [rcx + 0x10]
je 0x14002a9a6
cmp rcx, rdx
je 0x14002a9ff
mov rcx, qword [rcx + 8]
cmp al, byte [rcx + 0x10]
jne 0x14002a998
mov rax, qword [rcx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbp + 8]
lea rax, [r8 + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rbp + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r13]
jne 0x14002aa0b
mov qword [rcx + rax*8], rbx
jmp 0x14002aa1d
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r15
jmp 0x14002a9b3
cmp r8, rbp
jne 0x14002aa16
mov qword [rcx + rax*8], rbx
jmp 0x14002aa22
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14002aa22
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
jmp 0x14002a87d
lea rcx, str.unordered_map_set_too_long
call fcn.1400a8824
int3
Function at 0x14002add0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, r8
mov rdi, rdx
mov rsi, rcx
movzx ecx, byte [r8]
mov r15d, ecx
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rax, 0x100000001b3
imul r15, rax
mov rdx, qword [rsi + 0x30]
and rdx, r15
add rdx, rdx
mov r8, qword [rsi + 0x18]
mov rax, qword [r8 + rdx*8 + 8]
lea r12, [rsi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x14002ae6b
mov rdx, qword [r8 + rdx*8]
cmp cl, byte [rax + 0x10]
je 0x14002ae46
cmp rax, rdx
je 0x14002ae68
mov rax, qword [rax + 8]
cmp cl, byte [rax + 0x10]
jne 0x14002ae38
mov qword [rdi], rax
mov byte [rdi + 8], 0
mov rax, rdi
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rbp, rax
movabs rax, 0x666666666666666
cmp qword [rsi + 0x10], rax
je 0x14002afea
mov qword [rsp + 0x20], r12
xor r13d, r13d
mov qword [rsp + 0x28], r13
lea ecx, [r13 + 0x28]
call fcn.1400ab6e8
mov rbx, rax
mov qword [rsp + 0x28], rax
movzx eax, byte [r14]
mov byte [rbx + 0x10], al
mov qword [rbx + 0x18], r13
mov qword [rbx + 0x20], r13
mov r8, qword [rsi + 0x10]
lea rdx, [r8 + 1]
xorps xmm0, xmm0
test rdx, rdx
js 0x14002aec3
cvtsi2ss xmm0, rdx
jmp 0x14002aedb
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14002aeee
cvtsi2ss xmm1, rcx
jmp 0x14002af03
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14002af83
mov rcx, rsi
call fcn.140029b70
mov rdx, rax
mov rcx, rsi
call fcn.1400299d0
mov rdx, qword [rsi + 0x30]
and rdx, r15
add rdx, rdx
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rdx*8 + 8]
mov rax, qword [r12]
cmp rcx, rax
jne 0x14002af47
mov qword [rsp + 0x28], r13
jmp 0x14002af6a
mov rdx, qword [r8 + rdx*8]
movzx eax, byte [rbx + 0x10]
cmp al, byte [rcx + 0x10]
je 0x14002af62
cmp rcx, rdx
je 0x14002afbb
mov rcx, qword [rcx + 8]
cmp al, byte [rcx + 0x10]
jne 0x14002af54
mov rax, qword [rcx]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x20]
mov rdx, qword [rbp + 8]
lea rax, [r8 + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rdx
mov qword [rdx], rbx
mov qword [rbp + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r15
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [r12]
jne 0x14002afc7
mov qword [rcx + rax*8], rbx
jmp 0x14002afd9
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r13
jmp 0x14002af6f
cmp r8, rbp
jne 0x14002afd2
mov qword [rcx + rax*8], rbx
jmp 0x14002afde
cmp qword [rcx + rax*8 + 8], rdx
jne 0x14002afde
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
jmp 0x14002ae4d
lea rcx, str.unordered_map_set_too_long
call fcn.1400a8824
int3
Function at 0x14002b090
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rsi, rcx
movzx edi, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rdi, rax
movabs rcx, 0x100000001b3
imul rdi, rcx
movzx eax, byte [r8 + 1]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 2]
xor rdi, rax
imul rdi, rcx
movzx eax, byte [r8 + 3]
xor rdi, rax
imul rdi, rcx
mov rdx, rdi
and rdx, qword [rsi + 0x30]
add rdx, rdx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
lea r12, [rsi + 8]
mov rbp, qword [r12]
cmp rax, rbp
je 0x14002b142
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [r8]
cmp ecx, dword [rax + 0x10]
je 0x14002b125
cmp rax, rdx
je 0x14002b13f
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x14002b117
mov qword [r14], rax
mov byte [r14 + 8], 0
mov rax, r14
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbp, rax
movabs rax, 0x2e8ba2e8ba2e8ba
cmp qword [rsi + 0x10], rax
je 0x14002b2c0
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], 0
mov ecx, 0x58
call fcn.1400ab6e8
mov rbx, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r15]
mov dword [rbx + 0x10], eax
lea rcx, [rbx + 0x18]
call fcn.140028810
nop
mov rdx, qword [rsi + 0x10]
lea rcx, [rdx + 1]
xorps xmm0, xmm0
test rcx, rcx
js 0x14002b19d
cvtsi2ss xmm0, rcx
jmp 0x14002b1b2
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14002b1c5
cvtsi2ss xmm1, rcx
jmp 0x14002b1da
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x14002b257
mov rcx, rsi
call fcn.14002b9b0
mov rax, rdi
and rax, qword [rsi + 0x30]
add rax, rax
mov r8, qword [rsi + 0x18]
mov rcx, qword [r8 + rax*8 + 8]
mov rdx, qword [r12]
cmp rcx, rdx
jne 0x14002b21c
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
jmp 0x14002b243
mov rdx, qword [r8 + rax*8]
mov eax, dword [rbx + 0x10]
cmp eax, dword [rcx + 0x10]
je 0x14002b236
cmp rcx, rdx
je 0x14002b28c
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x14002b228
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsi + 0x10]
mov rbp, qword [rsp + 0x20]
mov rcx, qword [rbp + 8]
lea rax, [rdx + 1]
mov qword [rsi + 0x10], rax
mov qword [rbx], rbp
mov qword [rbx + 8], rcx
mov qword [rcx], rbx
mov qword [rbp + 8], rbx
mov rax, qword [rsi + 0x18]
and rdi, qword [rsi + 0x30]
add rdi, rdi
mov rdx, qword [rax + rdi*8]
cmp rdx, qword [r12]
jne 0x14002b29c
mov qword [rax + rdi*8], rbx
jmp 0x14002b2ae
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
jmp 0x14002b243
cmp rdx, rbp
jne 0x14002b2a7
mov qword [rax + rdi*8], rbx
jmp 0x14002b2b3
cmp qword [rax + rdi*8 + 8], rcx
jne 0x14002b2b3
mov qword [rax + rdi*8 + 8], rbx
mov qword [r14], rbx
mov byte [r14 + 8], 1
jmp 0x14002b12d
lea rcx, str.unordered_map_set_too_long
call fcn.1400a8824
int3
Function at 0x14002bde0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
call fcn.14002d460
nop
xorps xmm0, xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rbx]
mov qword [rsp + 0xa0], rax
mov rax, qword [rdi]
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], rax
mov ecx, 0x10
call fcn.1400ab6e8
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14002dd00]
xor edx, edx
xor ecx, ecx
call fcn.1400bca28
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002bfa4
cmp dword [rsi + 0x20], ebx
jne 0x14002bf9e
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x70], xmm0
movups xmmword [rsi + 0x18], xmm0
mov rax, qword [rsi]
test rax, rax
je 0x14002bfe6
cmp byte [rsi + 8], bl
je 0x14002bec6
cmp byte [rax + 0xb8], bl
jne 0x14002bfe6
cmp byte [rsi + 0x10], 0
jne 0x14002bfb3
mov byte [rsi + 0x10], 1
mov rcx, rbx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
cmp rax, rsi
je 0x14002bf07
mov rax, qword [rsi]
test rax, rax
je 0x14002beff
lock inc dword [rax + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rcx
mov rbx, rcx
jmp 0x14002bf07
mov rcx, rbx
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x38], 1
test rbx, rbx
je 0x14002bfce
cmp byte [rcx + 0xb8], 0
jne 0x14002bfce
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14005c601.0]
nop
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14002bf76
mov r8, qword [rsp + 0x30]
mov rcx, qword [r8 + 0xc8]
test rcx, rcx
je 0x14002bf61
mov rax, qword [rcx]
mov rdx, r8
mov rax, qword [rax]
call qword [case.0x14005c601.0]
jmp 0x14002bf76
mov rcx, qword [r8]
mov rax, qword [rcx]
mov edx, 1
mov rcx, r8
call qword [case.0x14005c601.0]
nop
mov rax, rsi
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400ab6c0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1400b920c
nop
mov dword [rsp + 0x48], ebx
mov ecx, 6
call fcn.1400a9148
nop
mov edx, 2
lea rcx, [rsp + 0x80]
call fcn.140020d40
mov rcx, rax
call fcn.1400aaebc
nop
mov edx, 4
lea rcx, [rsp + 0x70]
call fcn.140020d40
mov rcx, rax
call fcn.1400aaebc
nop
mov edx, 4
lea rcx, [rsp + 0x90]
call fcn.140020d40
mov rcx, rax
call fcn.1400aaebc
int3
Function at 0x14003f230
Capabilities:
Get session information
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rbp - 8], rax
xor esi, esi
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x2c], esi
mov edi, esi
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 1]
call qword [sym.imp.WTSAPI32.dll_WTSEnumerateSessionsW]
test eax, eax
jne 0x14003f2cd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x30], eax
lea ecx, [rsi + 5]
call fcn.14009c140
test eax, eax
je 0x14003f2c3
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_EnumerateSessions_Error:__lu
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 0x22]
lea r8, str.CTP::RegistrationMessageInterfaceHelper::getUserSessionCount
lea rdx, str.E:BT84f93cf4_3aa9_4a85_9be2_79e782bf7724WSSModularizationCore_srcModuleCoreServiceModuleCoreServiceImplRegistrationMessageInterfaceHelper.cpp
lea ecx, [rsi + 5]
call fcn.14000aa30
mov eax, 1
jmp 0x14003f3d1
mov ebx, esi
cmp dword [rbp - 0x2c], ebx
jbe 0x14003f3c5
nop dword [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*2]
mov rax, qword [rbp - 0x38]
mov edx, dword [rax + rcx*8]
test edx, edx
je 0x14003f3ba
test dword [rax + rcx*8 + 0x10], 0xfffffffa
jne 0x14003f3ba
mov qword [rbp - 0x40], rsi
mov dword [rbp - 0x30], esi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x40]
xor ecx, ecx
lea r8d, [rcx + 5]
call qword [sym.imp.WTSAPI32.dll_WTSQuerySessionInformationW]
test eax, eax
je 0x14003f3ba
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], 7
mov rdx, qword [rbp - 0x40]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x14003f350
lea rcx, [rbp - 0x28]
call fcn.14000de60
cmp qword [rbp - 0x18], 0
je 0x14003f36d
inc edi
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov qword [rbp - 0x40], rsi
mov dword [rbp - 0x30], esi
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14003f3ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003f3b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003f3f3
call fcn.1400ab6e0
inc ebx
cmp ebx, dword [rbp - 0x2c]
jb 0x14003f2e0
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.WTSAPI32.dll_WTSFreeMemory]
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ab6c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.1400b2bb8
int3
Function at 0x140041a60
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov r14, r8
movzx edi, dl
mov rbp, rcx
mov qword [rsp + 0x50], r8
add rcx, 0xc0
call fcn.1400a8fdc
test eax, eax
jne 0x140041cb6
mov ecx, edi
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
and rcx, qword [rbp + 0xb0]
mov r9, qword [rbp + 0x98]
mov r8, rcx
add r8, r8
mov r10, qword [r9 + r8*8 + 8]
mov rsi, r10
mov rdx, qword [rbp + 0x88]
cmp r10, rdx
je 0x140041b6f
mov rax, qword [r9 + r8*8]
cmp dil, byte [r10 + 0x10]
je 0x140041af3
cmp rsi, rax
je 0x140041b6f
mov rsi, qword [rsi + 8]
cmp dil, byte [rsi + 0x10]
jne 0x140041ae0
test rsi, rsi
je 0x140041b6f
add rcx, rcx
mov rax, qword [r9 + rcx*8]
cmp r10, rsi
jne 0x140041b1f
cmp rax, rsi
jne 0x140041b14
mov qword [r9 + rcx*8], rdx
mov qword [r9 + r8*8 + 8], rdx
jmp 0x140041b2b
mov rdx, qword [rsi + 8]
mov qword [r9 + r8*8 + 8], rdx
jmp 0x140041b2b
cmp rax, rsi
jne 0x140041b2b
mov rax, qword [rsi]
mov qword [r9 + rcx*8], rax
mov rdx, qword [rsi]
dec qword [rbp + 0x90]
mov rax, qword [rsi + 8]
mov qword [rax], rdx
mov rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rcx, [rsi + 0x98]
call fcn.14002daa0
lea rcx, [rsi + 0x58]
call fcn.14002d8b0
lea rcx, [rsi + 0x18]
call fcn.14002d8b0
mov edx, 0xc0
mov rcx, rsi
call fcn.1400ab6e0
lea rcx, [rbp + 0xc0]
call fcn.1400a9000
mov rcx, rbp
call fcn.140043ef0
mov edi, eax
mov dword [rsp + 0x40], eax
test eax, eax
je 0x140041c52
mov ecx, 6
call fcn.14009c140
test eax, eax
je 0x140041bea
mov ecx, edi
call fcn.14007e5b0
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, str.Failed_to_broadcast_subscriptions_to_v1_clients._Error_code:__ls__lu_
mov qword [rsp + 0x20], rax
mov r9d, 0x14e
lea r8, str.Intel::IPCServer::processDisconnect
lea rdx, str.E:BT84f93cf4_3aa9_4a85_9be2_79e782bf7724WSSModularizationCore_srcCommonIPCIPCCommonIPCCommonIPCServer.cpp
mov ecx, 6
call fcn.140030cb0
nop
mov rbx, qword [r14]
test rbx, rbx
je 0x140041c45
mov rcx, qword [rbx]
test rcx, rcx
je 0x140041c38
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140041c26
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041cbe
mov rcx, r8
call fcn.1400ab6e0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov edx, 0x18
mov rcx, rbx
call fcn.1400ab6e0
mov eax, edi
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rbx, qword [r14]
test rbx, rbx
je 0x140041ca9
mov rcx, qword [rbx]
test rcx, rcx
je 0x140041c9c
mov rdx, qword [rbx + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140041c8a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140041cbe
mov rcx, r8
call fcn.1400ab6e0
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov edx, 0x18
mov rcx, rbx
call fcn.1400ab6e0
xor eax, eax
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, eax
call fcn.1400a910c
nop
call fcn.1400b2bb8
int3
Function at 0x140042b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov rsi, rdx
mov rbx, rcx
lea rdi, [rcx + 0xc0]
mov qword [rsp + 0x30], rdi
mov rcx, rdi
call fcn.1400a8fdc
test eax, eax
jne 0x140042c93
mov r13, qword [rbx + 0x88]
mov rbx, qword [r13]
cmp rbx, r13
je 0x140042c74
movabs rdi, 0xcbf29ce484222325
movabs r10, 0x100000001b3
mov r8, qword [rsi + 0x10]
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140042b92
mov rdx, qword [rsi]
mov r9, rdi
xor ecx, ecx
add r8, r8
je 0x140042bb3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140042ba0
mov r8, rsi
lea rdx, [rsp + 0x38]
lea rcx, [rbx + 0x18]
call fcn.140046390
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140042bd3
cmp rcx, qword [rbx + 0x20]
jne 0x140042c34
mov rbp, qword [rbx + 0x98]
mov r14, qword [rbx + 0xa0]
cmp rbp, r14
je 0x140042c56
cmp qword [rsi + 0x18], 8
jb 0x140042bfa
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi]
lea rdx, [rax + rcx*2]
jmp 0x140042c07
mov rax, qword [rsi + 0x10]
lea rdx, [rsi + rax*2]
mov rax, rsi
jb 0x140042c0a
mov rax, qword [rsi]
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x10
mov r9, rbp
xor r8d, r8d
mov rcx, rax
call fcn.140016d10
test al, al
jne 0x140042c34
add rbp, 0x28
cmp rbp, r14
jne 0x140042be6
jmp 0x140042c56
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x140042c4a
movzx eax, byte [rbx + 0x10]
mov byte [rdx], al
inc qword [r15 + 8]
jmp 0x140042c56
lea r8, [rbx + 0x10]
mov rcx, r15
call fcn.140045630
mov rax, qword [rbx]
mov rbx, rax
cmp rax, r13
movabs r10, 0x100000001b3
jne 0x140042b81
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.1400a9000
mov ecx, eax
call fcn.1400a910c
int3
Function at 0x140042ca0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x140150a10]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14d, r8d
mov rsi, rcx
mov byte [rbp + 0x17], dl
lea rbx, [rcx + 0xc0]
mov qword [rbp - 1], rbx
mov rcx, rbx
call fcn.1400a8fdc
test eax, eax
jne 0x140042e8e
movzx edx, byte [rbp + 0x17]
mov eax, edx
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
mov rcx, qword [rsi + 0xb0]
and rcx, rax
shl rcx, 4
add rcx, qword [rsi + 0x98]
mov rax, qword [rcx + 8]
mov r8, qword [rsi + 0x88]
cmp rax, r8
je 0x140042d51
mov rcx, qword [rcx]
cmp dl, byte [rax + 0x10]
je 0x140042d41
cmp rax, rcx
je 0x140042d51
mov rax, qword [rax + 8]
cmp dl, byte [rax + 0x10]
jne 0x140042d33
test rax, rax
cmove rax, r8
cmp rax, r8
jne 0x140042e6c
mov rcx, qword [rsi + 0x30]
mov rax, qword [rcx]
lea r8, [rbp + 0x1f]
mov edx, r14d
mov rax, qword [rax + 0x18]
call qword [case.0x14005c601.0]
xor edi, edi
test eax, eax
cmovne edi, dword [rbp + 0x1f]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
lea rcx, [rsp + 0x20]
call fcn.140040e00
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov eax, 3
mov word [rbp - 0x11], ax
mov dword [rbp - 0xd], edi
mov dword [rbp - 9], r14d
lea rcx, [rsi + 0x80]
lea r8, [rbp + 0x17]
lea rdx, [rbp + 7]
call fcn.140045110
mov rsi, qword [rax]
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x18]
call fcn.140044140
lea rcx, [rsi + 0x58]
lea rdx, [rbp - 0x69]
call fcn.140044140
lea rdi, [rsi + 0x98]
lea rax, [rbp - 0x29]
cmp rdi, rax
je 0x140042e32
mov rcx, rdi
call fcn.14002daa0
mov rax, qword [rbp - 0x29]
mov qword [rdi], rax
mov rax, qword [rbp - 0x21]
mov qword [rdi + 8], rax
mov rax, qword [rbp - 0x19]
mov qword [rdi + 0x10], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
movzx eax, word [rbp - 0x11]
mov word [rsi + 0xb0], ax
mov eax, dword [rbp - 0xd]
mov dword [rsi + 0xb4], eax
mov eax, dword [rbp - 9]
mov dword [rsi + 0xb8], eax
lea rcx, [rbp - 0x29]
call fcn.14002daa0
lea rcx, [rbp - 0x69]
call fcn.14002d8b0
lea rcx, [rsp + 0x20]
call fcn.14002d8b0
nop
mov rcx, rbx
call fcn.1400a9000
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400ab6c0
add rsp, 0x100
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.1400a910c
int3