joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003d44
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x1801659a0]
test rax, rax
jne 0x180003d6e
mov rax, qword [0x1801659a8]
jmp 0x180003d77
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
call fcn.180004444
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180003da7
mov rax, qword [rax]
movabs r10, 0xfd41b67356dad870
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x180004bac.0]
nop
test rbx, rbx
jne 0x180003db3
mov eax, 0x8007000e
jmp 0x180003e04
mov rax, qword [rbx]
movabs r10, 0xdee01e7974d59970
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x180004bac.0]
mov edi, eax
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
movabs r10, 0xbaac1f10365eb170
mov rcx, rbx
call qword [case.0x180004bac.0]
mov eax, edi
jmp 0x180003e04
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x180004870
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801659a0]
test rax, rax
je 0x1800048bf
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x1801659a0]
xor edx, edx
mov rbx, rax
mov ecx, dword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rbx, rbx
je 0x1800048bf
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
movabs r10, 0xbaac1f10365eb170
mov rcx, rbx
call qword [case.0x180004bac.0]
add rsp, 0x20
pop rbx
ret

Function at 0x1800048cc
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801659a0]
mov rbx, rdx
mov rdi, rcx
test rax, rax
jne 0x1800048f1
mov rcx, qword [0x1801659a8]
jmp 0x180004904
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, rax
mov rax, qword [0x1801659a0]
test rbx, rbx
je 0x18000490c
mov qword [rbx], rcx
mov ecx, dword [rax + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x180004964
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801659a0]
mov rbx, qword [rcx + 8]
test rax, rax
je 0x18000498a
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rax, qword [0x1801659a0]
mov ecx, dword [rax + 8]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x180005694
Capabilities:
Get thread local storage value

Disassembly:
mov byte [rsp + 0x20], r9b
mov dword [rsp + 0x18], r8d
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rsi, rcx
test rcx, rcx
je 0x180005807
mov rdi, qword [rbp + 0x60]
test rdi, rdi
je 0x180005807
and qword [rdi], 0
mov rax, qword [0x1801659a0]
test rax, rax
jne 0x1800056dd
mov r14, qword [0x1801659a8]
jmp 0x1800056e9
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r14, rax
mov rcx, qword [rsi]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rbp + 0x58]
mov rcx, rsi
lea rdx, [0x180130f20]
call qword [case.0x180004bac.0]
test eax, eax
js 0x18000571f
mov rax, qword [rbp + 0x58]
mov qword [rdi], rax
xor eax, eax
jmp 0x18000580c
and qword [rbp + 0x30], 0
mov rax, qword [rsi]
movabs r10, 0xdee01e7974d59970
mov rax, qword [rax]
lea r8, [rbp + 0x30]
lea rdx, [0x180130ef8]
mov rcx, rsi
call qword [case.0x180004bac.0]
test eax, eax
js 0x1800057a4
mov rcx, qword [rbp + 0x30]
mov rax, qword [rcx]
movabs r10, 0x93ed37fb1a51fb70
mov rax, qword [rax + 0x28]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x48]
call qword [case.0x180004bac.0]
mov ebx, eax
test eax, eax
js 0x1800057e3
cmp dword [rbp + 0x48], 0
mov ebx, 0xfde9
je 0x1800057bd
cmp dword [rbp + 0x40], ebx
jne 0x1800057bd
mov r9, rdi
mov r8, r14
mov edx, ebx
mov rcx, rsi
call fcn.1800051bc
test al, al
jne 0x1800057e1
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
jmp 0x1800057de
mov ebx, 0xfde9
mov r9, rdi
mov edx, ebx
mov r8, r14
mov rcx, rsi
call fcn.1800051bc
test al, al
jne 0x1800057e1
lea rax, [rbp + 0x58]
mov r9d, ebx
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.180006264
mov ebx, eax
test eax, eax
js 0x1800057e3
mov rax, qword [rbp + 0x58]
mov qword [rdi], rax
xor ebx, ebx
mov rcx, qword [rbp + 0x30]
test rcx, rcx
je 0x180005803
mov rdx, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rdx + 0x10]
call qword [case.0x180004bac.0]
mov eax, ebx
jmp 0x18000580c
mov eax, 0x80004003
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000c4b4
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x18015ebc0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [0x1801659a0]
mov rdi, rdx
mov esi, r8d
mov rbx, rcx
test rax, rax
jne 0x18000c4ef
mov rax, qword [0x1801659a8]
jmp 0x18000c4f8
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rcx, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x38], rcx
mov r9b, 1
mov qword [rsp + 0x30], rax
xor r8d, r8d
and dword [rsp + 0x28], 0
mov rcx, rdi
mov byte [rsp + 0x20], 0
call fcn.1800052cc
test eax, eax
js 0x18000c54a
mov rax, qword [rsp + 0x40]
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18010c4d0
add rsp, 0xa0
pop rdi
pop rsi
pop rbx
ret
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.180002204
lea rdx, [0x18015cae0]
lea rcx, [rsp + 0x50]
call fcn.180112e50
int3
Function at 0x1800104e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
xor r12d, r12d
mov r14, r8
mov r10d, r12d
mov rsi, rcx
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rbp + r10 + 0x48]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x180010514
mov rax, qword [rsi + 0x170]
mov r8, qword [rsi + 0x158]
and rax, r9
mov rcx, qword [rsi + 0x148]
add rax, rax
mov rbx, qword [r8 + rax*8 + 8]
cmp rbx, rcx
je 0x180010570
mov r9, qword [r8 + rax*8]
jmp 0x180010568
cmp rbx, r9
je 0x180010570
mov rbx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
jne 0x18001055f
jmp 0x180010573
mov rbx, r12
test rbx, rbx
mov rdx, r14
cmove rbx, rcx
cmp rbx, rcx
lea rcx, [rbp + 0x40]
je 0x1800105bd
call fcn.1800e52a4
mov rax, qword [rbx + 0x18]
cmp eax, dword [rbp + 0x40]
jne 0x18001059d
shr rax, 0x20
cmp eax, dword [rbp + 0x44]
je 0x1800105ae
mov r8d, 0x54
mov rdx, r14
mov rcx, rsi
call fcn.180011748
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1800e52a4
lea r15, [rsi + 0x140]
mov rcx, r15
lea r8, [rbp + 0x48]
lea rdx, [rbp - 0x20]
call fcn.180029e40
mov rcx, qword [rax]
mov rax, qword [rbp + 0x40]
mov qword [rcx + 0x18], rax
mov rbx, qword [rbp + 0x48]
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x1800105ae
mov r9d, 0x2c
mov rcx, rbx
call fcn.18008fdec
mov rdi, rax
movzx eax, byte [rax + 0x18]
cmp al, 0x30
je 0x18001062c
cmp al, 7
jne 0x180010631
cmp word [rdi + 0x1a], 0x1d
jne 0x180010631
cmp al, 0x30
je 0x18001062c
cmp al, al
jne 0x1800106e5
cmp word [rdi + 0x1a], 0x1d
jne 0x1800106e5
test rdi, rdi
jne 0x180010692
mov ecx, eax
cmp al, 0x44
jne 0x180010681
cmp eax, 0x44
jne 0x1800106e5
test rdi, rdi
je 0x180010681
lea edx, [rax + 0x5c]
mov rcx, rdi
call fcn.1800d8000
test al, al
je 0x1800106cd
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.1800e52a4
lea r8, [rbp + 0x58]
mov qword [rbp + 0x58], rdi
lea rdx, [rbp - 0x10]
mov rcx, r15
call fcn.18002a084
mov rcx, qword [rax]
mov rax, qword [rbp - 0x20]
mov qword [rcx + 0x18], rax
jmp 0x1800106cd
add ecx, 0xffffffed
cmp al, 0x13
jb 0x1800106ab
cmp ecx, 0x1b
jne 0x1800106a2
test rdi, rdi
je 0x1800106bc
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.1800104e8
jmp 0x1800106cd
cmp al, 0x13
jb 0x1800106ab
cmp ecx, r9d
je 0x1800106b6
cmp al, 7
jne 0x1800106bc
cmp word [rdi + 0x1a], r9w
jne 0x1800106bc
cmp qword [rdi + 0x10], r12
je 0x1800106d3
mov r8d, 0x57
mov rdx, r14
mov rcx, rsi
call fcn.180011748
mov r9d, 0x2c
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1800105ae
jmp 0x1800105f7
lea rcx, str.llvm::cast
call fcn.180031904
int3
Function at 0x180012cd8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov rdx, qword [rdi + 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x180012d15
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180012d6a
mov rcx, r8
call fcn.18010ca08
and qword [rdi + 0x18], 0
and qword [rdi + 0x20], 0
and qword [rdi + 0x28], 0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
and qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x180012d52
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.18010ca08
mov rcx, rbx
test rbx, rbx
jne 0x180012d3d
mov rcx, qword [rdi + 8]
mov edx, 0x18
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18010ca08
call fcn.1800fd71c
int3

Function at 0x180012d78
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x18]
mov rdx, qword [rdi + 0x20]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x180012db5
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180012e0a
mov rcx, r8
call fcn.18010ca08
and qword [rdi + 0x18], 0
and qword [rdi + 0x20], 0
and qword [rdi + 0x28], 0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
and qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x180012df2
mov rbx, qword [rcx]
mov edx, 0x20
call fcn.18010ca08
mov rcx, rbx
test rbx, rbx
jne 0x180012ddd
mov rcx, qword [rdi + 8]
mov edx, 0x20
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18010ca08
call fcn.1800fd71c
int3

Function at 0x180013334
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [rsp + r10 + 0x18]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 8
jb 0x180013349
mov rcx, qword [r11 + 0x170]
mov r10, qword [r11 + 0x158]
and rcx, r9
mov r9, qword [r11 + 0x148]
add rcx, rcx
mov rax, qword [r10 + rcx*8 + 8]
cmp rax, r9
je 0x1800133a5
mov r10, qword [r10 + rcx*8]
jmp 0x18001339d
cmp rax, r10
je 0x1800133a5
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x180013394
jmp 0x1800133a7
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x1800133bc
mov rcx, qword [rax + 0x18]
mov qword [rdx], rcx
jmp 0x1800133ce
and dword [rsp + 8], 0
and dword [rsp + 0xc], 0
mov rax, qword [rsp + 8]
mov qword [rdx], rax
mov rax, rdx
ret
Function at 0x18001b260
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rsi, rdx
mov r12, rcx
xorps xmm0, xmm0
movss dword [rbp - 9], xmm0
and qword [rbp - 1], 0
and qword [rbp + 7], 0
mov ecx, 0x18
call fcn.1800017b8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbp - 1], rax
and qword [rbp + 0xf], 0
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rbp + 0x27], 7
mov qword [rbp + 0x2f], 8
movss xmm0, dword [0x1801459b8]
movss dword [rbp - 9], xmm0
mov r8, rax
mov edx, 0x10
lea rcx, [rbp + 0xf]
call fcn.180027e78
nop
mov rdi, qword [r12 + 8]
mov rbx, qword [r12]
jmp 0x18001b316
mov rax, qword [rbx]
mov rcx, qword [rax + 0x38]
mov rax, qword [rcx + 0x50]
mov qword [rbp + 0x77], rax
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 9]
call fcn.18002a74c
add rbx, 8
cmp rbx, rdi
jne 0x18001b2f2
mov rax, qword [rsi + 0x18]
mov rcx, qword [rax + 0x90]
mov rbx, qword [rcx + 0x40]
lea rax, [rcx + 0x30]
add rcx, 0xffffffffffffffd0
neg rax
sbb rdi, rdi
and rdi, rcx
jmp 0x18001b40a
mov rcx, rbx
call fcn.18003f294
test al, al
jne 0x18001b406
mov qword [rbp + 0x77], rbx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rbp + rdx + 0x77]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x18001b360
and rcx, qword [rbp + 0x27]
add rcx, rcx
mov rdx, qword [rbp + 0xf]
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rbp - 1]
je 0x18001b3ac
mov r8, qword [rdx + rcx*8]
jmp 0x18001b3a4
cmp rax, r8
je 0x18001b3ac
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x18001b39b
jmp 0x18001b3ae
xor eax, eax
test rax, rax
je 0x18001b406
lea rcx, [rbp - 0x39]
call fcn.18000e3f4
nop
mov rdx, rbx
mov rcx, qword [rbp - 0x11]
call fcn.18004cc9c
mov r15, qword [rbx + 0x80]
mov rsi, qword [r12]
mov r14, qword [r12 + 8]
jmp 0x18001b3f8
mov rax, qword [rsi]
mov rdx, qword [rax + 0x38]
cmp qword [rdx + 0x50], rbx
jne 0x18001b3f4
mov r8, r15
mov rcx, qword [rbp - 0x11]
call fcn.18004b830
add rsi, 8
cmp rsi, r14
jne 0x18001b3db
lea rcx, [rbp - 0x39]
call fcn.1800b1e8c
mov rbx, qword [rbx + 0x68]
cmp rbx, rdi
jne 0x18001b340
lea rcx, [rbp - 9]
call fcn.180012cd8
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180023d38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [rcx]
mov rsi, r8
mov r15d, dword [r8 + 0x10]
mov r14, rdx
mov rdi, rcx
mov qword [rbp + 0x30], rax
lea r8, [rbp + 0x30]
mov rcx, r9
lea rdx, [rbp - 0x30]
mov r12, r9
call fcn.18002a74c
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
jmp 0x180023ea7
mov rax, qword [rbx + 0x18]
lea r8, [rbp + 0x30]
lea rdx, [rbp - 0x30]
mov qword [rbp + 0x30], rax
mov rcx, rsi
call fcn.180028f18
cmp byte [rbp - 0x28], 0
je 0x180023ecb
lea r8, [rbp + 0x30]
mov rcx, r14
lea rdx, [rbp - 0x20]
call fcn.180028cd4
mov rcx, qword [rax]
cmp dword [rcx + 0x18], r15d
jae 0x180023dd7
lea r8, [rbp + 0x30]
mov rcx, r14
lea rdx, [rbp - 0x10]
call fcn.180028cd4
mov rcx, qword [rax]
mov dword [rcx + 0x18], r15d
mov rcx, qword [rbp + 0x30]
mov r9, r12
mov r8, rsi
mov rdx, r14
call fcn.180023d38
test rax, rax
jne 0x180023eb2
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rbp + rdx + 0x30]
movabs r8, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r8
cmp rdx, 8
jb 0x180023dfe
mov rdx, qword [rsi + 0x30]
mov r8, qword [rsi + 0x18]
and rdx, rcx
mov r9, qword [rsi + 8]
add rdx, rdx
mov rcx, qword [r8 + rdx*8 + 8]
cmp rcx, r9
je 0x180023e51
mov rax, qword [rbp + 0x30]
jmp 0x180023e49
cmp rcx, qword [r8 + rdx*8]
je 0x180023e51
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x180023e3f
jmp 0x180023e53
xor ecx, ecx
test rcx, rcx
je 0x180023ea3
cmp qword [r8 + rdx*8 + 8], rcx
jne 0x180023e76
cmp qword [r8 + rdx*8], rcx
jne 0x180023e6b
mov qword [r8 + rdx*8], r9
jmp 0x180023e6f
mov r9, qword [rcx + 8]
mov qword [r8 + rdx*8 + 8], r9
jmp 0x180023e83
cmp qword [r8 + rdx*8], rcx
jne 0x180023e83
mov rax, qword [rcx]
mov qword [r8 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rsi + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.18010ca08
add rbx, 0x20
cmp rbx, rdi
jne 0x180023d85
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov rax, qword [rbp + 0x30]
jmp 0x180023eb2
Function at 0x180024a44
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x2f]
sub rsp, 0xa0
mov rax, qword [0x18015ebc0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r12, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test r9, r9
jne 0x180024add
mov rax, qword [r8]
movabs r10, 0xf7fd373c5ed6cb70
mov rcx, r8
mov rax, qword [rax + 8]
call qword [case.0x180004bac.0]
test eax, eax
je 0x180024add
mov qword [rbp - 0x51], rsi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x180024aa1
mov qword [rbp - 0x49], rax
lea rax, [rbp - 0x51]
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], 1
movaps xmm0, xmmword [rbp - 0x41]
mov edx, 3
lea r8, [rbp - 0x31]
movdqa xmmword [rbp - 0x31], xmm0
mov rcx, r14
call fcn.180010fd8
jmp 0x180024c5d
mov rax, qword [rdi]
movabs r10, 0xf7fd373c5ed6cb70
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x180004bac.0]
cmp eax, dword [rbp + 0x7f]
je 0x180024b2c
mov qword [rbp - 0x41], rsi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x180024b04
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], 1
movaps xmm0, xmmword [rbp - 0x51]
mov edx, 2
jmp 0x180024ac7
cmp dword [rbp + 0x7f], 0
je 0x180024c5d
and qword [rbp - 0x51], 0
mov rax, qword [0x1801659a0]
test rax, rax
jne 0x180024b50
mov rax, qword [0x1801659a8]
jmp 0x180024b59
mov ecx, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rdx, [rbp - 0x51]
mov rcx, rax
call fcn.1800060fc
test eax, eax
js 0x180024c80
mov rbx, qword [rbp - 0x51]
mov rax, qword [rbx]
movabs r10, 0xf7f13fac1458d270
mov edx, dword [rbp + 0x7f]
mov rcx, rbx
mov rax, qword [rax + 0x90]
call qword [case.0x180004bac.0]
mov rax, qword [rdi]
movabs r10, 0xd18c0ebf1ade7870
mov rdx, rbx
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x180004bac.0]
mov edi, dword [rbp + 0x7f]
mov rax, qword [rbx]
movabs r10, 0xe385369156db1170
mov rcx, rbx
mov rax, qword [rax + 0x70]
call qword [case.0x180004bac.0]
mov rdx, rax
mov r8d, edi
mov rcx, r12
call fcn.18010f570
test eax, eax
je 0x180024c3e
mov qword [rbp - 0x41], rsi
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x180024be5
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], 1
movaps xmm0, xmmword [rbp - 0x31]
movdqa xmmword [rbp - 0x31], xmm0
lea r8, [rbp - 0x31]
mov edx, 2
mov rcx, r14
call fcn.180010fd8
nop
test rbx, rbx
je 0x180024c5d
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x180004bac.0]
jmp 0x180024c5d
test rbx, rbx
je 0x180024c5d
mov rax, qword [rbx]
movabs r10, 0xbaac1f10365eb170
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x180004bac.0]
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.18010c4d0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
mov edx, eax
lea rcx, [rbp - 0x21]
call fcn.180002204
lea rdx, [0x18015cae0]
lea rcx, [rbp - 0x21]
call fcn.180112e50
int3
Function at 0x180026ed4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
cmp dword [rcx + 0xc], ebx
je 0x180026f10
mov esi, dword [rcx + 8]
test esi, esi
je 0x180026f10
mov rax, qword [rdi]
mov rcx, qword [rax + rbx*8]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x180026f0a
call fcn.18000182c
inc ebx
cmp ebx, esi
jne 0x180026ef4
mov rcx, qword [rdi]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18000182c

Function at 0x180027044
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx]
mov rsi, rcx
mov rax, qword [rdx + 8]
and qword [rax], 0
mov rbx, qword [rdx]
test rbx, rbx
je 0x18002709f
mov rdi, qword [rbx + 0x18]
mov rbp, qword [rbx]
test rdi, rdi
je 0x18002708a
mov rcx, rdi
call fcn.180027c18
mov rcx, rdi
call fcn.18000182c
mov edx, 0x20
mov rcx, rbx
call fcn.18010ca08
mov rbx, rbp
test rbp, rbp
jne 0x18002706e
mov rcx, qword [rsi]
mov edx, 0x20
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.18010ca08

Function at 0x1800270c8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdx, qword [rcx]
mov rdi, rcx
mov rax, qword [rdx + 8]
and qword [rax], 0
mov rbx, qword [rdx]
test rbx, rbx
je 0x18002714e
mov rcx, qword [rbx + 0x18]
mov rsi, qword [rbx]
test rcx, rcx
je 0x180027139
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x180027125
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002716a
mov rcx, r8
call fcn.18010ca08
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov edx, 0x30
mov rcx, rbx
call fcn.18010ca08
test rsi, rsi
mov rbx, rsi
jmp 0x1800270eb
mov rcx, qword [rdi]
mov edx, 0x30
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18010ca08
call fcn.1800fd71c
int3

Function at 0x1800273d0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.180027260
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x180027427
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x180027413
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180027434
mov rcx, r8
call fcn.18010ca08
and qword [rbx + 0x18], 0
and qword [rbx + 0x20], 0
and qword [rbx + 0x28], 0
mov rcx, qword [rbx]
add rsp, 0x20
pop rbx
jmp fcn.18000182c
call fcn.1800fd71c
int3
Function at 0x180027854
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov r13, rcx
cmp rdx, r8
je 0x180027908
mov rax, qword [rcx + 8]
mov rdi, rdx
mov r12, qword [rcx + 0x18]
movabs r15, 0xcbf29ce484222325
mov r14, qword [rdx + 8]
xor ecx, ecx
mov qword [rsp + 0x68], rax
movabs rdx, 0x100000001b3
movzx eax, byte [rcx + rbp + 0x10]
inc rcx
xor r15, rax
imul r15, rdx
cmp rcx, 8
jb 0x1800278a4
and r15, qword [r13 + 0x30]
add r15, r15
mov rax, qword [r12 + r15*8]
mov qword [rsp + 0x70], rax
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x78], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x18
call fcn.18010ca08
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x78]
je 0x180027920
cmp rdi, rsi
jne 0x1800278d3
cmp qword [rsp + 0x70], rbp
jne 0x180027901
mov qword [r12 + r15*8], rdi
mov qword [r14], rdi
mov qword [rdi + 8], r14
mov rbx, qword [rsp + 0x60]
mov rax, rsi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp qword [rsp + 0x70], rbp
jne 0x180027935
mov rbp, qword [rsp + 0x68]
mov qword [r12 + r15*8], rbp
mov rax, rbp
jmp 0x180027938
mov rax, r14
mov qword [r12 + r15*8 + 8], rax
cmp rdi, rsi
je 0x180027901
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movabs rbp, 0x100000001b3
movzx eax, byte [rdi + rdx + 0x10]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x180027958
mov r15, qword [r13 + 0x30]
mov rbp, qword [rsp + 0x68]
and r15, rcx
add r15, r15
mov rax, qword [r12 + r15*8 + 8]
mov qword [rsp + 0x70], rax
mov rcx, rdi
mov rbx, rdi
mov rdi, qword [rdi]
mov edx, 0x18
call fcn.18010ca08
dec qword [r13 + 0x10]
cmp rbx, qword [rsp + 0x70]
je 0x1800279af
cmp rdi, rsi
je 0x1800278fd
jmp 0x180027986
mov qword [r12 + r15*8], rbp
mov qword [r12 + r15*8 + 8], rbp
jmp 0x18002793d

Function at 0x180028c5c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rcx
movabs r9, 0xcbf29ce484222325
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 4
jb 0x180028c6c
mov rcx, qword [r11 + 0x30]
and rcx, r9
mov r9, qword [r11 + 0x18]
add rcx, rcx
mov rax, qword [r9 + rcx*8 + 8]
cmp rax, qword [r11 + 8]
je 0x180028cbd
mov r9, qword [r9 + rcx*8]
mov ecx, dword [r8]
jmp 0x180028cb6
cmp rax, r9
je 0x180028cbd
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180028cad
jmp 0x180028cbf
xor eax, eax
test rax, rax
cmove rax, qword [r11 + 8]
mov qword [rdx], rax
mov rax, rdx
ret