joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180160dd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
cmp dword [0x1804023c4], 0
je 0x180160fc1
cmp qword [0x180402428], 0
je 0x180160fc1
mov ecx, dword [0x1804023c0]
test ecx, ecx
je 0x180160fc1
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180160e2d
test ebx, ebx
jne 0x180160fc1
mov edx, 1
mov ecx, dword [0x1804023c0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x180402428]
call fcn.1802a21b0
test eax, eax
je 0x180160fb2
xor eax, eax
movzx edx, al
lea rcx, [rsp + 0x60]
call fcn.180160730
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
xor esi, esi
mov ebx, esi
mov dword [rsp + 0x20], ebx
mov rdx, qword [0x180402428]
lea rcx, [rsp + 0x30]
call fcn.1802a1d60
nop
nop dword [rax]
nop dword [rax + rax]
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1802a2140
test rax, rax
je 0x180160ec7
cmp dword [rax + 8], edi
jne 0x180160ec5
cmp dword [rax + 0x24], 0
jne 0x180160ec5
mov dword [rax + 0x24], 1
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov rcx, qword [rax + 0x10]
call qword [rax]
jmp 0x180160e90
test ebx, ebx
je 0x180160f9d
mov byte [rsp + 0x60], 1
mov rcx, qword [0x180402428]
call fcn.1802a2260
mov rcx, qword [0x180402428]
call fcn.1802a21e0
test eax, eax
je 0x180160f9d
xor eax, eax
movzx edx, al
lea rcx, [rsp + 0x68]
call fcn.1801606d0
nop
mov edx, 1
mov rcx, qword [0x180402428]
call fcn.1802a2040
mov rbx, rax
nop dword [rax + rax]
mov rcx, qword [0x180402428]
test rbx, rbx
je 0x180160f75
mov r8d, 1
mov rdx, rbx
call fcn.1802a20c0
mov rdi, rax
mov rcx, rbx
call fcn.1800f1480
cmp dword [rax + 0x24], 0
je 0x180160f70
mov edx, 0x28
mov rcx, rax
call fcn.1802b8d50
mov r9d, 1
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [0x180402428]
call fcn.1802a22a0
mov rbx, rdi
jmp 0x180160f20
mov edx, 1
call fcn.1802a2210
mov ecx, dword [0x1804023c4]
test eax, eax
cmovne ecx, esi
mov dword [0x1804023c4], ecx
jmp 0x180160f92
lea rcx, [rsp + 0x68]
call fcn.1801608e0
nop
lea rcx, [rsp + 0x30]
call fcn.1802a1010
nop
lea rcx, [rsp + 0x60]
call fcn.180160940
xor edx, edx
mov ecx, dword [0x1804023c0]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x180161640
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
xor ebx, ebx
mov dword [rsp + 0x20], ebx
cmp qword [0x180402428], rbx
jne 0x18016168d
mov ecx, 0x88
call fcn.18011da30
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18016167d
mov rcx, rax
call fcn.1802a1d20
mov rbx, rax
mov qword [0x180402428], rbx
mov ebx, 1
mov dword [rsp + 0x20], ebx
cmp dword [0x1804023c0], 0
jne 0x1801616a2
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1804023c0], eax
mov eax, ebx
jmp 0x1801616aa
add rsp, 0x30
pop rbx
ret
Function at 0x180161cf0
Capabilities:
Set application hook

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rdx]
mov rbx, rcx
test eax, eax
je 0x180161d21
sub eax, 1
mov dword [rdx], eax
jne 0x180161d21
mov rcx, qword [rcx]
test rcx, rcx
je 0x180161d21
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx], 0
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180162350
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x190
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov bl, 1
mov byte [rsp + 0x30], bl
xor eax, eax
mov qword [r11 - 0x48], rax
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov word [r11 - 0x18], ax
mov edx, ecx
sub edx, 3
je 0x180162489
sub edx, 4
je 0x18016246c
sub edx, 3
je 0x18016244f
sub edx, 2
je 0x18016241f
cmp edx, 1
je 0x180162402
movsd xmm0, qword [0x180032290]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x180032298]
mov dword [rsp + 0x58], eax
movzx eax, word [0x18003229c]
mov word [rsp + 0x5c], ax
mov r8d, 0xa
lea rdx, [r11 - 0x48]
call fcn.1802e1cb4
mov edi, dword [rsp + 0x38]
jmp 0x1801624b3
mov edi, reloc.WSOCK32.dll_recv
movsd xmm0, qword [0x180032268]
movzx eax, byte [0x180032270]
mov byte [rsp + 0x58], al
jmp 0x1801624ad
mov edi, 2
movsd xmm0, qword [0x180032248]
mov eax, dword [0x180032250]
mov dword [rsp + 0x58], eax
movzx eax, word [0x180032254]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x180032256]
mov byte [rsp + 0x5e], al
jmp 0x1801624ad
mov edi, 0x40
mov eax, dword [0x180032274]
mov dword [rsp + 0x50], eax
movzx eax, word [0x180032278]
mov word [rsp + 0x54], ax
jmp 0x1801624b3
mov edi, 0x100
mov eax, dword [0x18003227c]
mov dword [rsp + 0x50], eax
movzx eax, word [0x180032280]
mov word [rsp + 0x54], ax
jmp 0x1801624b3
mov edi, 4
movsd xmm0, qword [0x180032258]
movzx eax, word [0x180032260]
mov word [rsp + 0x58], ax
movzx eax, byte [0x180032262]
mov byte [rsp + 0x5a], al
movsd qword [rsp + 0x50], xmm0
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800322a0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1801624ee
mov eax, 1
jmp 0x180162553
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1800322b8]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180162538
test dword [rsp + 0x34], edi
je 0x18016253e
xor bl, bl
jmp 0x18016253a
mov bl, 1
mov byte [rsp + 0x30], bl
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, bl
jmp 0x180162553
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.1802b85a0
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rdi
ret
Function at 0x180163a40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180163aaa
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180163a84
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180163ad5
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180163b2c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180163afa
jmp 0x180163ae0
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180163bc8
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180163b6b
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180163b89
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180163bb5
cmp rax, rbx
jne 0x180163b93
mov qword [rdx], rdi
jmp 0x180163bb5
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180163bb5
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180164460
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x180163e10
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163e3a
cmp byte [0x180400b38], 0
je 0x180163e3a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180163e40
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163e6a
cmp byte [0x180400b38], 0
je 0x180163e6a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret
Function at 0x180163e70
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163e9a
cmp byte [0x180400b38], 0
je 0x180163e9a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180163ea0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163eca
cmp byte [0x180400b38], 0
je 0x180163eca
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180163ed0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163efa
cmp byte [0x180400b38], 0
je 0x180163efa
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180163f00
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0xfffffffffffffffe
cmp byte [rcx], 0
jne 0x180163f2a
cmp byte [0x180400b38], 0
je 0x180163f2a
xor edx, edx
mov ecx, dword [0x180400b3c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x38
ret

Function at 0x180164a00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r9, r8
mov r10, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rdx
xor r8, rax
movzx eax, byte [r9 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x13]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x14]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x15]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x16]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x17]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r9
jne 0x180164ac9
cmp qword [rcx], r9
jne 0x180164abf
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x180164ad4
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x180164ad4
cmp qword [rcx], r9
jne 0x180164ad9
mov rax, qword [r9]
mov qword [rcx], rax
mov r9, qword [rsp + 0x40]
mov rax, qword [r9 + 8]
mov rcx, r9
mov rbx, qword [r9]
mov qword [rax], rbx
mov rdx, qword [r9]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.18011da90
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180164d60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 4
jae 0x180164dca
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180164da4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180164df5
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180164e65
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov eax, dword [rbx + 0x10]
cmp dword [r8], eax
je 0x180164e19
jmp 0x180164e00
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rax], rcx
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rax + 8], rcx
dec qword [r11 + 0x10]
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x38], rcx
add rcx, 8
mov qword [rsp + 0x38], rcx
call fcn.1800ad110
mov rcx, rdi
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180164f01
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180164ea4
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180164ec2
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180164eee
cmp rax, rbx
jne 0x180164ecc
mov qword [rdx], rdi
jmp 0x180164eee
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180164eee
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180167f50
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180164f20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x180164f8a
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x180164f64
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180164fb5
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x180164ff6
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x180164fda
jmp 0x180164fc0
mov rdx, qword [rsp + 0x78]
mov rcx, r11
call fcn.180168310
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180165092
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x180165035
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x180165053
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x18016507f
cmp rax, rbx
jne 0x18016505d
mov qword [rdx], rdi
jmp 0x18016507f
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x18016507f
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.180168010
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1801650b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r11, rcx
movabs r9, 0xcbf29ce484222325
mov qword [rsp + 0x20], r9
xor r10d, r10d
movabs rcx, 0x100000001b3
mov qword [rsp + 0x28], r10
cmp r10, 8
jae 0x18016511a
movzx eax, byte [r10 + r8]
xor r9, rax
mov qword [rsp + 0x20], r9
imul r9, rcx
mov qword [rsp + 0x20], r9
inc r10
jmp 0x1801650f4
mov r10, qword [r11 + 0x30]
and r10, r9
mov qword [rsp + 0x48], r10
mov rbx, qword [r11 + 8]
shl r10, 4
mov rcx, qword [r11 + 0x18]
cmp qword [rcx + r10], rbx
je 0x180165145
mov rbx, qword [rcx + r10 + 8]
mov rbx, qword [rbx]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
nop word [rax + rax]
cmp rbx, qword [rcx + r10]
je 0x18016519c
mov rbx, qword [rbx + 8]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
je 0x18016516a
jmp 0x180165150
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rax + 8], rdx
dec qword [r11 + 0x10]
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x180165238
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x1801651db
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r11 + 0x18]
add rdx, r10
mov rax, qword [rdx]
cmp rax, qword [r11 + 8]
jne 0x1801651f9
mov qword [rdx], rdi
mov rax, qword [r11 + 0x18]
mov qword [r10 + rax + 8], rdi
jmp 0x180165225
cmp rax, rbx
jne 0x180165203
mov qword [rdx], rdi
jmp 0x180165225
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180165225
mov rdx, qword [r11 + 0x18]
mov rax, qword [rdx + r10 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10 + 8], rcx
mov rcx, r11
call fcn.1801680d0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180165f20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov qword [rsp + 0x48], rcx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x40], r9d
movzx edx, al
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
movzx ecx, byte [rsp + 0x41]
xor rdx, rcx
imul rdx, r8
movzx eax, byte [rsp + 0x42]
xor rdx, rax
imul rdx, r8
movzx eax, byte [rsp + 0x43]
xor rdx, rax
imul rdx, r8
mov rcx, qword [rbx + 0xa0]
and rcx, rdx
mov r8, qword [rbx + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [r8 + rax*8]
mov rdx, qword [rbx + 0x78]
add rcx, rcx
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
cmp r10, rdx
jne 0x180165fc1
mov rcx, rdx
jmp 0x180165fc8
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180166006
cmp dword [rax + 0x10], r9d
je 0x180165fd8
mov rax, qword [rax]
jmp 0x180165fb7
mov rcx, rax
nop dword [rax + rax]
cmp r10, rdx
jne 0x180165fea
mov r8, rdx
jmp 0x180165ff1
mov r8, qword [r11 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x180166001
cmp r9d, dword [rax + 0x10]
jne 0x180166001
mov rax, qword [rax]
jmp 0x180165fe0
cmp rcx, rax
jne 0x18016600c
mov rax, rdx
mov rcx, rdx
xor edx, edx
cmp rcx, rax
je 0x18016601e
inc rdx
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x180166013
test rdx, rdx
setne bl
lea rcx, [rsp + 0x48]
call fcn.1800b0cb0
movzx eax, bl
add rsp, 0x30
pop rbx
ret

Function at 0x180166040
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov qword [rsp + 0x48], rcx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x40], r9d
movzx edx, al
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs r8, 0x100000001b3
imul rdx, r8
movzx ecx, byte [rsp + 0x41]
xor rdx, rcx
imul rdx, r8
movzx eax, byte [rsp + 0x42]
xor rdx, rax
imul rdx, r8
movzx eax, byte [rsp + 0x43]
xor rdx, rax
imul rdx, r8
mov rcx, qword [rbx + 0xa0]
and rcx, rdx
mov r8, qword [rbx + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [r8 + rax*8]
mov rdx, qword [rbx + 0x78]
add rcx, rcx
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
cmp r10, rdx
jne 0x1801660e1
mov rcx, rdx
jmp 0x1801660e8
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180166126
cmp dword [rax + 0x10], r9d
je 0x1801660f8
mov rax, qword [rax]
jmp 0x1801660d7
mov rcx, rax
nop dword [rax + rax]
cmp r10, rdx
jne 0x18016610a
mov r8, rdx
jmp 0x180166111
mov r8, qword [r11 + 8]
mov r8, qword [r8]
cmp rax, r8
je 0x180166121
cmp r9d, dword [rax + 0x10]
jne 0x180166121
mov rax, qword [rax]
jmp 0x180166100
cmp rcx, rax
jne 0x18016612c
mov rax, rdx
mov rcx, rdx
xor edx, edx
cmp rcx, rax
je 0x18016613e
inc rdx
mov rcx, qword [rcx]
cmp rcx, rax
jne 0x180166133
test rdx, rdx
setne bl
lea rcx, [rsp + 0x48]
call fcn.1800b0cb0
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x180166160
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov qword [rsp + 0x58], rcx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x50], r9d
movzx edx, al
movabs rsi, 0xcbf29ce484222325
xor rdx, rsi
movabs rdi, 0x100000001b3
imul rdx, rdi
movzx ecx, byte [rsp + 0x51]
xor rdx, rcx
imul rdx, rdi
movzx eax, byte [rsp + 0x52]
xor rdx, rax
imul rdx, rdi
movzx eax, byte [rsp + 0x53]
xor rdx, rax
imul rdx, rdi
mov rcx, qword [rbx + 0xa0]
and rcx, rdx
mov rdx, qword [rbx + 0x88]
mov rax, rcx
add rax, rax
mov rax, qword [rdx + rax*8]
mov r8, qword [rbx + 0x78]
add rcx, rcx
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
nop dword [rax]
cmp r10, r8
jne 0x18016620a
mov rcx, r8
jmp 0x180166211
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x180166227
cmp r9d, dword [rax + 0x10]
je 0x180166221
mov rax, qword [rax]
jmp 0x180166200
cmovne rax, r8
jmp 0x18016622a
mov rax, r8
cmp rax, r8
je 0x18016623d
lea rbx, [rax + 0x18]
lea rcx, [rsp + 0x58]
jmp 0x180166315
lea rcx, [rsp + 0x58]
call fcn.1800b0cb0
lea rdx, [rbx + 0xb0]
mov rcx, rbx
call fcn.1801676f0
mov qword [rsp + 0x60], rbx
mov rcx, rbx
call fcn.1800bd060
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r9d, eax
mov dword [rsp + 0x50], r9d
movzx r8d, al
xor r8, rsi
imul r8, rdi
movzx ecx, byte [rsp + 0x51]
xor r8, rcx
imul r8, rdi
movzx eax, byte [rsp + 0x52]
xor r8, rax
imul r8, rdi
movzx eax, byte [rsp + 0x53]
xor r8, rax
imul r8, rdi
mov rdx, qword [rbx + 0xa0]
and rdx, r8
mov r8, qword [rbx + 0x88]
mov rax, rdx
add rax, rax
mov rax, qword [r8 + rax*8]
mov rcx, qword [rbx + 0x78]
add rdx, rdx
mov r10, qword [r8 + rdx*8]
lea r11, [r8 + rdx*8]
nop dword [rax + rax]
cmp r10, rcx
jne 0x1801662da
mov rdx, rcx
jmp 0x1801662e1
mov rdx, qword [r11 + 8]
mov rdx, qword [rdx]
cmp rax, rdx
je 0x1801662f7
cmp r9d, dword [rax + 0x10]
je 0x1801662f1
mov rax, qword [rax]
jmp 0x1801662d0
cmovne rax, rcx
jmp 0x1801662fa
mov rax, rcx
cmp rax, rcx
jne 0x18016630c
lea rcx, [0x180092010]
call fcn.1802b9a54
int3
lea rbx, [rax + 0x18]
lea rcx, [rsp + 0x60]
call fcn.1800b0cb0
mov rax, rbx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret