joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004d1d0
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, qword [rsp + 0x100]
lea rax, [0x1400c8f20]
mov r15, qword [rsp + 0x118]
mov rbx, rcx
mov r14, qword [rsp + 0x120]
xor r12d, r12d
mov qword [rcx], rax
or r9, 0xffffffffffffffff
add rcx, 8
xor r8d, r8d
mov rdi, rdx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], r12
mov byte [rcx], r12b
call fcn.140003580
mov dword [rbx + 0x28], r12d
lea rax, [0x1400c8ce0]
mov qword [rbx], rax
movabs rax, 0xfeedc0dedeadbeef
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], r12
mov qword [rbx + 0x40], r12
test rsi, rsi
jne 0x14004d26f
int3
mov ecx, 0x40
call fcn.140080c00
cmp qword [rdi + 0x18], 0x10
mov rbp, rax
jb 0x14004d288
mov rcx, qword [rdi]
jmp 0x14004d28b
mov rcx, rdi
mov rax, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov qword [rsp + 0x4c], 0x10325476
mov dword [rsp + 0x54], r12d
call fcn.140065470
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400655f0
mov rax, qword [rsp + 0x108]
mov r9, r15
mov rdx, qword [rsp + 0x30]
mov r8, rsi
bswap rdx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140062610
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x38], rax
test rcx, rcx
je 0x14004d317
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov ecx, 0x40
call fcn.140080c00
mov r10, rax
mov r9, r14
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
mov rcx, r10
call fcn.140062610
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x40], rax
test rcx, rcx
je 0x14004d362
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400812a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14004fb30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp byte [rdx], 0
mov rdi, rdx
mov rbx, rcx
je 0x14004fb5f
mov eax, dword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov dword [rcx + 0x10], eax
mov rax, rcx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rsi
call fcn.140062a00
mov ecx, dword [0x1400d6d18]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fb82
call fcn.140027ad0
movsxd rdx, dword [rsi + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rsi + 8]
mov rsi, qword [rsp + 0x30]
cmp dword [rdx + 8], eax
jne 0x14004fba6
mov rax, qword [rdx]
test rax, rax
je 0x14004fba6
mov ecx, dword [rax]
jmp 0x14004fbab
mov ecx, 1
cmp byte [rdi + 8], 0
mov dword [rbx + 4], ecx
setne al
mov byte [rbx], 1
cmp byte [rdi + 0x10], 0
mov byte [rbx + 8], al
mov eax, dword [rdi + 0xc]
mov dword [rbx + 0xc], eax
setne al
cmp byte [rdi + 0x11], 0
mov byte [rbx + 0x10], al
mov rax, rbx
setne cl
mov byte [rbx + 0x11], cl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14004fbf0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x20
xor r14d, r14d
mov rbp, rcx
mov dword [rsp + 0x48], r14d
call fcn.140060b70
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fc22
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov qword [rsp + 0x40], rsi
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
jne 0x14004fca0
cmp qword [rdx], r14
je 0x14004fca0
call fcn.140060b70
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fc5d
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
jne 0x14004fc78
mov r14, qword [rdx]
test r14, r14
jne 0x14004fc79
int3
mov rax, qword [r14]
test rax, rax
je 0x14004fc8b
mov esi, 1
lock xadd dword [rax + 8], esi
mov qword [rbp], rax
mov rax, rbp
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
call fcn.14004fdf0
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004fcbe
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
jne 0x14004fd04
mov rax, qword [rdx]
test rax, rax
je 0x14004fd04
mov rax, qword [rax]
mov qword [rbp], rax
test rax, rax
je 0x14004fdcc
mov esi, 1
lock xadd dword [rax + 8], esi
mov rax, rbp
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r15
call fcn.140032000
mov esi, 1
test rax, rax
jne 0x14004fd25
mov rbx, r14
mov r15, r14
jmp 0x14004fd3d
mov rbx, qword [rax + 0x70]
test rbx, rbx
je 0x14004fd35
mov eax, esi
lock xadd dword [rbx + 8], eax
mov r15, rbx
test rbx, rbx
jne 0x14004fd3e
int3
call fcn.140032000
mov edi, r14d
test rax, rax
je 0x14004fd4e
mov edi, dword [rax + 0x78]
mov ecx, 0x20
call fcn.140080c00
mov rdx, rax
test rbx, rbx
je 0x14004fd67
mov ecx, esi
lock xadd dword [rbx + 8], ecx
mov dword [rax + 8], r14d
lea rcx, fcn.140031aa0
mov qword [rax], rcx
mov qword [rax + 0x10], rbx
mov dword [rax + 0x18], edi
mov dword [rax + 0x1c], 2
mov eax, esi
lock xadd dword [rdx + 8], eax
mov rdi, qword [rsp + 0x50]
mov qword [rbp], rdx
test rbx, rbx
je 0x14004fdc7
add rbx, 8
or eax, 0xffffffff
lock xadd dword [rbx], eax
cmp eax, esi
jne 0x14004fdc7
test rbx, rbx
cmove r15, r14
mov rax, qword [r15]
mov rdx, qword [rax + 0x18]
cmp rax, rcx
jne 0x14004fddd
test r15, r15
je 0x14004fdc7
mov edx, esi
mov rcx, r15
call qword [rax + 0x10]
mov r15, qword [rsp + 0x58]
mov rax, rbp
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, r15
call rdx
jmp 0x14004fdc7
Function at 0x140050a10
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
call fcn.1400632f0
mov ecx, dword [0x1400d6d18]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140050a4a
call fcn.140027ad0
movsxd rdx, dword [rbx + 4]
shl rdx, 4
add rdx, rax
mov eax, dword [rbx + 8]
cmp dword [rdx + 8], eax
jne 0x140050a67
cmp qword [rdx], 0
jne 0x140050b44
call fcn.140051320
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x140050a88
call fcn.140027ad0
mov rcx, rax
movsxd r8, dword [0x1400dc7e4]
mov eax, dword [0x1400dc7e8]
add r8, r8
cmp dword [rcx + r8*8 + 8], eax
jne 0x140050aaa
cmp qword [rcx + r8*8], 0
jne 0x140050b44
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140050420
mov rcx, rax
call fcn.1400514a0
mov rcx, qword [rsp + 0x38]
mov rbx, rax
cmp rcx, 0x10
jb 0x140050b06
mov rdx, qword [rsp + 0x20]
inc rcx
cmp rcx, 0x1000
jb 0x140050afe
test dl, 0x1f
jne 0x140050b5c
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140050b62
sub rdx, rax
cmp rdx, 8
jb 0x140050b68
cmp rdx, 0x27
ja 0x140050b6e
mov rdx, rax
mov rcx, rdx
call fcn.140080c40
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140050b22
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [0x1400dc7e4]
add rax, rax
mov qword [rdx + rax*8], rbx
movsxd rcx, dword [0x1400dc7e4]
mov eax, dword [0x1400dc7e8]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400812a0
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
Function at 0x140050b80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [0x1400dc7e0]
test eax, eax
jne 0x140050bb1
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0x58
ret
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x140050bcd
call fcn.140027ad0
mov rcx, rax
movsxd rdx, dword [0x1400dc7e4]
mov eax, dword [0x1400dc7e8]
add rdx, rdx
cmp dword [rcx + rdx*8 + 8], eax
jne 0x140050bf0
mov rax, qword [rcx + rdx*8]
test rax, rax
jne 0x140050cba
mov r8d, 0xe
mov qword [rsp + 0x50], rbx
lea rdx, str.WorkerThread_
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], 0
mov byte [rsp + 0x20], 0
call fcn.140003450
lea rcx, [rsp + 0x20]
call fcn.1400514a0
mov rcx, qword [rsp + 0x38]
mov rbx, rax
cmp rcx, 0x10
jb 0x140050c74
mov rdx, qword [rsp + 0x20]
inc rcx
cmp rcx, 0x1000
jb 0x140050c6c
test dl, 0x1f
jne 0x140050ccc
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140050cd2
sub rdx, rax
cmp rdx, 8
jb 0x140050cd8
cmp rdx, 0x27
ja 0x140050cde
mov rdx, rax
mov rcx, rdx
call fcn.140080c40
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140050c90
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [0x1400dc7e4]
add rax, rax
mov qword [rdx + rax*8], rbx
movsxd rcx, dword [0x1400dc7e4]
mov eax, dword [0x1400dc7e8]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0x58
ret
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3
call fcn.1400853c8
int3

Function at 0x1400524b0
Capabilities:
Encode data using xor

Disassembly:
mov r9d, edx
mov r8, rcx
mov eax, edx
test edx, edx
jle 0x14005258e
test rcx, rcx
je 0x14005258e
mov r10d, edx
sar r9d, 2
and r10d, 3
test r9d, r9d
jle 0x14005250a
nop dword [rax]
movzx ecx, word [r8]
dec r9d
movzx edx, word [r8 + 2]
add eax, ecx
mov ecx, eax
shl edx, 0xb
shl ecx, 0x10
add r8, 4
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
add eax, ecx
test r9d, r9d
jg 0x1400524e0
sub r10d, 1
je 0x14005254e
sub r10d, 1
je 0x14005253a
cmp r10d, 1
jne 0x140052561
movzx ecx, word [r8]
movsx edx, byte [r8 + 2]
add eax, ecx
mov ecx, eax
shl edx, 0x12
shl ecx, 0x10
xor edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0xb
jmp 0x14005255f
movzx ecx, word [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
jmp 0x14005255f
movsx ecx, byte [r8]
add eax, ecx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
mov ecx, eax
shr ecx, 1
add eax, ecx
lea ecx, [rax*8]
xor eax, ecx
mov ecx, eax
shr ecx, 5
add eax, ecx
mov ecx, eax
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
mov ecx, eax
shl ecx, 0x19
xor eax, ecx
mov ecx, eax
shr ecx, 6
add eax, ecx
ret
xor eax, eax
ret
Function at 0x140057dd0
Capabilities:
Hash data with md5

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1400d61c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
call fcn.140065470
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1400655f0
mov rax, qword [rsp + 0x20]
bswap rax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400812a0
add rsp, 0xa8
ret

Function at 0x14005b0c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [r8 + 0x18]
mov r15, r8
mov rsi, qword [r8 + 0x10]
mov rbp, rdx
mov r14, rcx
cmp r13, 0x10
jb 0x14005b0ee
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test rsi, rsi
je 0x14005b124
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r9
cmp rdx, rsi
jb 0x14005b110
mov rax, qword [r14 + 0x30]
and rax, rcx
mov qword [rsp + 0x70], rdi
mov rcx, qword [r14 + 0x18]
mov rbx, rax
mov r14, qword [r14 + 8]
add rbx, rbx
add rax, rax
lea r9, [rcx + 8]
mov rbx, qword [rcx + rbx*8]
mov r12, qword [rcx + rax*8]
lea r9, [r9 + rax*8]
mov qword [rsp + 0x60], r9
cmp r12, r14
jne 0x14005b160
mov rax, r14
jmp 0x14005b166
mov rax, qword [r9]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005b238
cmp r13, 0x10
jb 0x14005b17a
mov rdx, qword [r15]
jmp 0x14005b17d
mov rdx, r15
cmp qword [rbx + 0x28], 0x10
jb 0x14005b18a
mov rcx, qword [rbx + 0x10]
jmp 0x14005b18e
lea rcx, [rbx + 0x10]
mov rdi, qword [rbx + 0x20]
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
test r8, r8
je 0x14005b1af
call fcn.140082950
test eax, eax
jne 0x14005b1b6
mov r9, qword [rsp + 0x60]
cmp rdi, rsi
jb 0x14005b1b6
jbe 0x14005b1c0
mov rbx, qword [rbx]
mov r9, qword [rsp + 0x60]
jmp 0x14005b156
mov rdi, rbx
cmp r12, r14
jne 0x14005b1cd
mov rax, r14
jmp 0x14005b1d3
mov rax, qword [r9]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005b224
cmp qword [rbx + 0x28], 0x10
jb 0x14005b1e5
mov rdx, qword [rbx + 0x10]
jmp 0x14005b1e9
lea rdx, [rbx + 0x10]
cmp r13, 0x10
jb 0x14005b1f4
mov rcx, qword [r15]
jmp 0x14005b1f7
mov rcx, r15
mov rbp, qword [rbx + 0x20]
cmp rsi, rbp
mov r8, rbp
cmovb r8, rsi
test r8, r8
je 0x14005b213
call fcn.140082950
test eax, eax
jne 0x14005b224
cmp rsi, rbp
jb 0x14005b224
ja 0x14005b224
mov rbx, qword [rbx]
mov r9, qword [rsp + 0x60]
jmp 0x14005b1c3
mov rbp, qword [rsp + 0x68]
cmp rdi, rbx
je 0x14005b238
mov qword [rbp], rdi
mov qword [rbp + 8], rbx
jmp 0x14005b240
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov rax, rbp
mov rdi, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005db10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9, qword [r8 + 0x18]
mov r14, r8
mov rsi, qword [r8 + 0x10]
mov r15, rdx
mov rbp, rcx
cmp r9, 0x10
jb 0x14005db41
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rsi, rsi
je 0x14005db74
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, rsi
jb 0x14005db60
mov r13, qword [rbp + 0x30]
mov rax, qword [rbp + 0x18]
and r13, rdx
mov rbx, qword [rbp + 8]
shl r13, 4
mov r12, qword [rax + r13]
cmp r12, rbx
je 0x14005db98
mov rbx, qword [rax + r13 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rdi
cmp rbx, r12
je 0x14005dc00
mov rbx, qword [rbx + 8]
cmp qword [rbx + 0x28], 0x10
jb 0x14005dbb3
mov rdx, qword [rbx + 0x10]
jmp 0x14005dbb7
lea rdx, [rbx + 0x10]
cmp r9, 0x10
jb 0x14005dbc2
mov rcx, qword [r14]
jmp 0x14005dbc5
mov rcx, r14
mov rdi, qword [rbx + 0x20]
cmp rsi, rdi
mov r8, rdi
cmovb r8, rsi
test r8, r8
je 0x14005dbe1
call fcn.140082950
test eax, eax
jne 0x14005dbe8
cmp rsi, rdi
jb 0x14005dbe8
jbe 0x14005dbf3
cmp rbx, r12
je 0x14005dc00
mov r9, qword [r14 + 0x18]
jmp 0x14005dba2
mov qword [r15], rbx
mov byte [r15 + 8], 0
jmp 0x14005dcdc
mov rax, qword [rbp + 8]
mov r9, r14
mov rdi, qword [rax]
mov rdx, rdi
mov r8, qword [rdi + 8]
call fcn.14005dd10
mov rdx, rax
movabs rcx, 0x555555555555554
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x14005dcfc
inc rax
mov qword [rbp + 0x10], rax
mov qword [rdi + 8], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdx
mov rdi, qword [rbp + 8]
mov rdi, qword [rdi]
mov rax, qword [rdi]
cmp rbx, rax
je 0x14005dc82
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
add rdx, r13
mov rax, qword [rdx]
cmp rax, qword [rbp + 8]
jne 0x14005dca0
mov qword [rdx], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r13 + 8], rdi
jmp 0x14005dccc
cmp rax, rbx
jne 0x14005dcaa
mov qword [rdx], rdi
jmp 0x14005dccc
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14005dccc
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r13 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r13 + 8], rcx
mov rcx, rbp
call fcn.14004ba40
mov qword [r15], rdi
mov byte [r15 + 8], 1
mov rdi, qword [rsp + 0x50]
mov rax, r15
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
lea rcx, str.list_T__too_long
call fcn.14007f5f0
int3
Function at 0x140062970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
sub rcx, r9
sar rcx, 2
test rcx, rcx
je 0x1400629f7
mov r10, rcx
lea r11, [0x1400c44d0]
nop dword [rax]
mov eax, dword [r9]
lea r9, [r9 + 4]
movzx r8d, cl
shr ecx, 8
movzx edx, al
xor r8, rdx
mov dword [rsp + 8], eax
movzx eax, byte [rsp + 9]
mov edx, dword [r11 + r8*4]
xor edx, ecx
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0xa]
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
mov edx, dword [r11 + rcx*4]
xor edx, r8d
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov eax, dword [r11 + rcx*4]
xor eax, edx
mov ecx, eax
sub r10, 1
jne 0x140062990
ret
mov eax, ecx
ret

Function at 0x140062fc0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
test rax, rax
jne 0x140062fe2
call fcn.140027ad0
mov rcx, rax
movsxd rbx, dword [0x1400dc90c]
mov eax, dword [0x1400dc910]
add rbx, rbx
cmp dword [rcx + rbx*8 + 8], eax
je 0x140062ffc
xor ebx, ebx
jmp 0x140063000
mov rbx, qword [rcx + rbx*8]
mov rax, rbx
and rax, 0xfffffffffffffffe
cmp rax, 0xfffffffffffffffe
jne 0x140063015
xor eax, eax
add rsp, 0x20
pop rbx
ret
test rbx, rbx
jne 0x1400630c1
mov ecx, dword [0x1400d6d18]
mov rbx, qword [0x1400c7210]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
test rax, rax
jne 0x140063041
call fcn.140027ad0
mov rdx, rax
movsxd rax, dword [0x1400dc90c]
add rax, rax
mov qword [rdx + rax*8], rbx
movsxd rcx, dword [0x1400dc90c]
mov eax, dword [0x1400dc910]
add rcx, rcx
mov dword [rdx + rcx*8 + 8], eax
mov ecx, 0x30
call fcn.140080c00
mov rbx, rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov ecx, dword [0x1400d6d18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14006309f
call fcn.140027ad0
movsxd rcx, dword [0x1400dc90c]
add rcx, rcx
mov qword [rax + rcx*8], rbx
movsxd rdx, dword [0x1400dc90c]
mov ecx, dword [0x1400dc910]
add rdx, rdx
mov dword [rax + rdx*8 + 8], ecx
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140066780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10, qword [r8 + 0x18]
mov rdi, r9
mov rbp, qword [r8 + 0x10]
mov r14, r8
mov r12, rdx
mov r15, rcx
cmp r10, 0x10
jb 0x1400667b6
mov r9, qword [r8]
jmp 0x1400667b9
mov r9, r14
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
test rbp, rbp
je 0x1400667f4
movabs r8, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
xor rdx, rax
imul rdx, r8
cmp rcx, rbp
jb 0x1400667e0
mov r8, qword [r15 + 0x30]
mov rax, qword [r15 + 0x18]
and r8, rdx
mov rbx, qword [r15 + 8]
shl r8, 4
mov qword [rsp + 0x50], r8
mov r13, qword [r8 + rax]
cmp r13, rbx
je 0x14006681d
mov rbx, qword [r8 + rax + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x58], rsi
cmp rbx, r13
je 0x1400668a0
nop word [rax + rax]
mov rbx, qword [rbx + 8]
cmp qword [rbx + 0x28], 0x10
jb 0x140066841
mov rdx, qword [rbx + 0x10]
jmp 0x140066845
lea rdx, [rbx + 0x10]
cmp r10, 0x10
jb 0x140066850
mov rcx, qword [r14]
jmp 0x140066853
mov rcx, r14
mov rsi, qword [rbx + 0x20]
cmp rbp, rsi
mov r8, rsi
cmovb r8, rbp
test r8, r8
je 0x14006686f
call fcn.140082950
test eax, eax
jne 0x140066876
cmp rbp, rsi
jb 0x140066876
jbe 0x140066881
cmp rbx, r13
je 0x14006689b
mov r10, qword [r14 + 0x18]
jmp 0x140066830
mov rdx, rdi
mov rcx, r15
call fcn.140066a20
mov qword [r12], rbx
mov byte [r12 + 8], 0
jmp 0x140066931
mov r8, qword [rsp + 0x50]
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400668d5
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r15 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r15 + 8]
jne 0x1400668f3
mov qword [rdx], rdi
mov rax, qword [r15 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x14006691f
cmp rax, rbx
jne 0x1400668fd
mov qword [rdx], rdi
jmp 0x14006691f
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14006691f
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r15
call fcn.140066960
mov qword [r12], rdi
mov byte [r12 + 8], 1
mov rsi, qword [rsp + 0x58]
mov rax, r12
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140068a30
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
test r8, r8
je 0x140068c16
push rsi
push r14
sub rsp, 8
mov qword [rsp + 0x20], rbx
mov rsi, r8
mov qword [rsp + 0x28], rbp
mov r14, rdx
mov qword [rsp + 0x30], rdi
mov r9, rcx
mov qword [rsp + 0x38], r12
xor r12d, r12d
mov qword [rsp], r15
mov r15d, 0x8f1bbcdc
nop word [rax + rax]
movzx eax, byte [r14]
lea r14, [r14 + 1]
mov ecx, dword [r9 + 0x168]
dec rsi
mov byte [rcx + r9 + 0x28], al
inc dword [r9 + 0x168]
cmp dword [r9 + 0x168], 0x40
jb 0x140068be6
lea rcx, [r9 + 0x28]
mov edx, 0x10
nop word [rax + rax]
mov eax, dword [rcx]
lea rcx, [rcx + 4]
bswap eax
mov dword [rcx - 4], eax
sub rdx, 1
jne 0x140068ab0
lea rdx, [r9 + 0x68]
mov r8d, 0x40
lea rcx, [r9 + 0x30]
nop
mov eax, dword [rcx + 0x2c]
lea rdx, [rdx + 4]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rdx - 4], eax
sub r8, 1
jne 0x140068ad0
mov eax, dword [r9 + 0x14]
mov edx, r12d
mov dword [r9], eax
mov edi, 0x28
mov r10d, dword [r9 + 0x18]
mov dword [r9 + 4], r10d
mov r8d, dword [r9 + 0x1c]
mov dword [r9 + 8], r8d
mov r11d, dword [r9 + 0x20]
mov dword [r9 + 0xc], r11d
mov ebp, dword [r9 + 0x24]
mov dword [r9 + 0x10], ebp
nop dword [rax]
mov ebx, dword [r9]
cmp edx, 0x14
jae 0x140068b3a
mov eax, r10d
mov ecx, r8d
not eax
and ecx, r10d
and eax, r11d
or eax, ecx
jmp 0x140068b60
cmp edx, 0x28
jb 0x140068b57
cmp edx, 0x3c
jae 0x140068b57
mov eax, r8d
mov ecx, r8d
or eax, r11d
and ecx, r11d
and eax, r10d
or eax, ecx
jmp 0x140068b60
mov eax, r8d
xor eax, r11d
xor eax, r10d
cmp edx, 0x14
jae 0x140068b6c
mov ecx, 0x5a827999
jmp 0x140068b84
cmp edx, 0x28
jae 0x140068b78
mov ecx, 0x6ed9eba1
jmp 0x140068b84
cmp edx, 0x3c
mov ecx, 0xca62c1d6
cmovb ecx, r15d
rol ebx, 5
inc edx
add ebx, dword [rdi + r9]
add rdi, 4
add ebx, ebp
mov dword [r9 + 0xc], r8d
add ebx, ecx
mov dword [r9 + 0x10], r11d
add ebx, eax
mov ebp, r11d
mov r11d, r8d
mov r8d, r10d
mov r10d, dword [r9]
ror r8d, 2
mov dword [r9 + 8], r8d
mov dword [r9 + 4], r10d
mov dword [r9], ebx
cmp edx, 0x50
jb 0x140068b20
add dword [r9 + 0x14], ebx
add dword [r9 + 0x18], r10d
add dword [r9 + 0x1c], r8d
mov eax, dword [r9 + 0xc]
add dword [r9 + 0x20], eax
mov eax, dword [r9 + 0x10]
add dword [r9 + 0x24], eax
mov dword [r9 + 0x168], r12d
add qword [r9 + 0x170], 8
test rsi, rsi
jne 0x140068a70
mov r15, qword [rsp]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
add rsp, 8
pop r14
pop rsi
ret