joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005850
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400059ff
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.1400055e0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x1400059f2
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x1400058f1
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x1400059f2
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x13]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x1400058e0
mov r14, qword [r9 + rbx*8]
mov ebp, dword [rdx + 0x10]
cmp ebp, dword [r14 + 0x10]
jne 0x140005990
mov r10, qword [r14]
cmp r10, rdx
je 0x1400058e4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x1400058e4
cmp r11, r14
je 0x1400059c8
mov r14, qword [r14 + 8]
cmp ebp, dword [r14 + 0x10]
jne 0x140005990
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400058e8
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x1400058e8
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140006e30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
mov eax, dword [rcx]
cmp eax, 0x138
jne 0x140006ecd
movq xmm0, qword [rcx + 8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xfffffffffffffec8
movaps xmm0, xmmword [0x140059e80]
movaps xmm1, xmmword [0x140059e90]
movdqa xmm2, xmmword [0x140059ea0]
nop dword [rax]
movups xmm4, xmmword [rcx + rax*8 + 0x9d0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
movaps xmm3, xmm4
psllq xmm4, 0x3f
psrad xmm4, 0x1f
pshufd xmm4, xmm4, 0xf5
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0xea8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x1388], xmm6
add rax, 2
jne 0x140006e70
mov eax, 0x138
jmp 0x14000705e
cmp eax, 0x270
jb 0x14000705e
movq xmm0, qword [rcx + 0x9c8]
pshufd xmm3, xmm0, 0x44
mov rax, 0xffffffffffffff64
movaps xmm0, xmmword [0x140059e80]
movaps xmm1, xmmword [0x140059e90]
movdqa xmm2, xmmword [0x140059ea0]
nop word cs:[rax + rax]
movups xmm4, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm3, xmm4, 0x4e
andps xmm3, xmm0
movaps xmm5, xmm4
andps xmm5, xmm1
orps xmm5, xmm3
psrlq xmm5, 1
movaps xmm3, xmm4
psllq xmm4, 0x3f
psrad xmm4, 0x1f
pshufd xmm4, xmm4, 0xf5
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 0x1388]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
add rax, 2
jne 0x140006f10
movq xmm3, qword [rcx + 0xea8]
pshufd xmm3, xmm3, 0x44
xor eax, eax
nop word cs:[rax + rax]
movdqa xmm4, xmm3
movups xmm3, xmmword [rcx + rax*8 + 0xeb0]
shufps xmm4, xmm3, 0x4e
andps xmm4, xmm0
movaps xmm5, xmm3
andps xmm5, xmm1
orps xmm5, xmm4
psrlq xmm5, 1
movaps xmm4, xmm3
psllq xmm4, 0x3f
psrad xmm4, 0x1f
pshufd xmm4, xmm4, 0xf5
pand xmm4, xmm2
movdqu xmm6, xmmword [rcx + rax*8 + 8]
pxor xmm6, xmm4
pxor xmm6, xmm5
movdqu xmmword [rcx + rax*8 + 0x4e8], xmm6
add rax, 2
cmp rax, 0x9a
jne 0x140006f80
pshufd xmm0, xmm3, 0xee
movq rax, xmm0
and rax, 0xffffffff80000000
mov rdx, qword [rcx + 0x1380]
mov r8d, edx
and r8d, 0x7ffffffe
or r8, rax
shr r8, 1
mov eax, edx
and eax, 1
neg rax
movabs r9, 0xb5026f5aa96619e9
and rax, r9
xor rax, qword [rcx + 0x4d8]
xor rax, r8
mov qword [rcx + 0x9b8], rax
and rdx, 0xffffffff80000000
mov rax, qword [rcx + 8]
mov r8d, eax
and r8d, 0x7ffffffe
or r8, rdx
and eax, 1
neg rax
and rax, r9
xor rax, qword [rcx + 0x4e0]
shr r8, 1
xor rax, r8
mov qword [rcx + 0x9c0], rax
xor eax, eax
lea edx, [rax + 1]
mov dword [rcx], edx
mov eax, eax
mov rax, qword [rcx + rax*8 + 8]
mov rdx, rax
shr rdx, 0x1d
and rdx, qword [rcx + 0x1388]
xor rdx, rax
mov rax, rdx
shl rax, 0x11
movabs rcx, 0x71d67fffeda60000
and rcx, rax
xor rcx, rdx
mov edx, ecx
and edx, 0x7ffbf77
shl rdx, 0x25
xor rdx, rcx
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
movaps xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x14002d8a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
sub rsp, 0x20
mov eax, edx
shr eax, 0x10
mov r10d, edx
shr r10d, 0x18
movzx r8d, dl
movabs r9, 0xcbf29ce484222325
xor r9, r8
movabs r8, 0x100000001b3
imul r9, r8
movzx esi, dh
xor rsi, r9
imul rsi, r8
movzx eax, al
xor rax, rsi
imul rax, r8
xor r10, rax
imul r10, r8
mov r8, qword [rcx + 0x38]
and r10, r8
mov r9, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
mov rax, r10
shl rax, 4
mov rax, qword [rcx + rax + 8]
cmp rax, r9
je 0x14002d930
cmp dword [rax + 0x10], edx
je 0x14002d932
add r10, r10
mov r10, qword [rcx + r10*8]
nop word [rax + rax]
cmp rax, r10
je 0x14002d930
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], edx
jne 0x14002d920
jmp 0x14002d932
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x14002da0f
add r8, r8
movabs rdx, 0x7f4b2ab0f3ef5dfa
and rdx, r8
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, r9
je 0x14002d984
cmp dword [rax + 0x10], 0xfffd
je 0x14002d986
mov rdx, qword [rcx + rdx*8]
nop dword [rax]
cmp rax, rdx
je 0x14002d984
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], 0xfffd
jne 0x14002d970
jmp 0x14002d986
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x14002da0f
movabs rdx, 0xdac02447d2fdf374
and rdx, r8
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, r9
je 0x14002d9d1
cmp dword [rax + 0x10], 0x3f
je 0x14002d9d3
mov rdx, qword [rcx + rdx*8]
nop word cs:[rax + rax]
cmp rax, rdx
je 0x14002d9d1
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], 0x3f
jne 0x14002d9c0
jmp 0x14002d9d3
xor eax, eax
test rax, rax
cmove rax, r9
cmp rax, r9
jne 0x14002da0f
movabs rax, 0x9a4aecff3b9c27ea
and r8, rax
mov rax, qword [rcx + r8*8 + 8]
cmp rax, r9
je 0x14002da19
cmp dword [rax + 0x10], 0
je 0x14002da0f
mov rcx, qword [rcx + r8*8]
cmp rax, rcx
je 0x14002da19
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], 0
jne 0x14002da00
add rax, 0x18
add rsp, 0x20
pop rsi
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x14002e8e0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rcx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x14002e922
mov rcx, rsi
mov r8, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.14002ebe0
mov word [rbp - 0xf], 0x303
mov byte [rbp - 0x10], dl
movzx eax, word [rdi + 0x10]
mov word [rbp - 0xc], ax
lea rcx, [rbp - 0x10]
lea rbx, [rbp - 0x30]
mov rdx, rbx
xor r8d, r8d
call fcn.14002f4a0
mov r8, qword [rdi + 0x10]
cmp qword [rdi + 0x18], 0x10
jb 0x14002e954
mov rdi, qword [rdi]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x14002e97d
mov qword [rsp + 0x20], r8
lea rcx, [rbp - 0x30]
mov rdx, r8
mov r9, rdi
call fcn.140002e80
jmp 0x14002e99f
lea r14, [rcx + r8]
mov qword [rbp - 0x20], r14
cmp rax, 0x10
jb 0x14002e98f
mov rbx, qword [rbp - 0x30]
add rcx, rbx
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r14], 0
mov edi, dword [rbp - 0x20]
cmp qword [rbp - 0x18], 0x10
jb 0x14002e9af
mov rdx, qword [rbp - 0x30]
jmp 0x14002e9b3
lea rdx, [rbp - 0x30]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x14002ea00
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002e9fb
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002ea10
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055568
cmp esi, edi
sete al
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002eb90
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x20
mov r8, rdx
mov rax, qword [rcx + 0xc0]
cmp rax, qword [rcx + 0xc8]
je 0x14002ebb4
mov dl, 0x17
add rsp, 0x20
pop rsi
jmp fcn.14002ebe0
mov esi, dword [r8 + 0x10]
cmp qword [r8 + 0x18], 0x10
jb 0x14002ebc2
mov r8, qword [r8]
mov rcx, qword [rcx + 0x30]
mov rdx, r8
mov r8d, esi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, esi
sete al
add rsp, 0x20
pop rsi
ret
Function at 0x14002ebe0
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r9, r8
mov ebx, edx
mov rsi, rcx
add rcx, 0xb8
lea rdx, [rbp - 0x50]
mov r8d, ebx
call fcn.14004f190
mov word [rbp - 7], 0x303
mov byte [rbp - 8], bl
mov r14, qword [rbp - 0x48]
sub r14, qword [rbp - 0x50]
mov word [rbp - 4], r14w
lea rcx, [r14 + 5]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov byte [rbp - 0x30], 0
lea rcx, method.soup::dnsOsResolver.virtual_0
mov qword [rbp - 0x38], rcx
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x28], rcx
lea rdi, [rbp - 7]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
add r14, 5
mov qword [rbp - 0x10], r14
je 0x14002ed86
mov byte [rax], bl
inc qword [rbp - 0x18]
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
mov r8d, 1
mov rdx, rdi
call qword [rax + 0x18]
lea rdx, [rbp - 6]
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
mov r8d, 1
call qword [rax + 0x18]
lea rdi, [rbp - 4]
cmp byte [rbp - 0x30], 0
je 0x14002ecba
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14002ecdb
lea rdi, [rbp - 3]
jmp 0x14002eccd
lea rdx, [rbp - 3]
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
call qword [rax + reloc.WS2_32.dll_recv]
test al, al
je 0x14002ecdb
mov rax, qword [rbp - 0x38]
lea rcx, [rbp - 0x38]
mov rdx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
sub rdi, rbx
mov r14, qword [rbp - 0x18]
lea rax, [rdi + r14]
cmp qword [rbp - 0x10], rax
jb 0x14002ed9b
mov rax, qword [rbp - 0x20]
add r14, rax
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, qword [rbp - 0x18]
mov qword [rbp - 0x18], rdi
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rsi + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov esi, eax
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14002ed3a
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x14002ed74
mov rdx, qword [rbp - 0x40]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x14002ed6f
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14002edee
add rdx, 0x27
mov rcx, rax
call fcn.140055568
cmp esi, edi
sete al
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
test rax, rax
je 0x14002edbc
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
jmp 0x14002edc7
mov r15, rax
shr r15, 1
add r15, rax
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14002edd8
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov r14, qword [rbp - 0x18]
jmp 0x14002ede1
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 1
jmp 0x14002ec69
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], r15
jmp 0x14002ecfc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002fb10
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1400c0e18]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rcx, qword [rcx + 0x30]
lea rdx, [rsp + 0x27]
mov r8d, 1
mov r9d, 2
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 1
sete bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400556d0
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x14002fb60
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
test r8d, r8d
js 0x14002fd3b
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
movsxd r14, r8d
cmp r8d, 0xf
ja 0x14002fbc5
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], recv
lea rcx, [rbp - 0x30]
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
lea r15, [r14 + rbp]
add r15, 0xffffffffffffffd0
jmp 0x14002fc24
mov rax, r14
or rax, 0xf
cmp rax, 0x17
mov r12d, 0x16
cmovae r12, rax
cmp r12, 0xfff
jb 0x14002fbfb
lea rcx, [r12 + 0x28]
call fcn.140055524
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x14002fc08
lea rcx, [r12 + 1]
call fcn.140055524
mov r15, rax
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r12
mov rcx, r15
xor edx, edx
mov r8, r14
call sub.VCRUNTIME140.dll_memset
add r15, r14
mov byte [r15], 0
cmp qword [rbp - 0x18], 0x10
jb 0x14002fc35
mov rdx, qword [rbp - 0x30]
jmp 0x14002fc39
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx + 0x30]
mov r8d, edi
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14002fc8a
mov edi, eax
mov rcx, qword [rbp - 0x20]
cmp rcx, rdi
jae 0x14002fcdd
mov r8, rdi
sub r8, rcx
mov rax, qword [rbp - 0x18]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x14002fcee
mov byte [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
mov rdx, r8
mov r9, r8
call fcn.140007ed0
jmp 0x14002fd1a
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], recv
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x14002fd29
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002fcd6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002fd40
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140055568
jmp 0x14002fd29
cmp qword [rbp - 0x18], 0x10
jb 0x14002fcfe
mov rbx, qword [rbp - 0x30]
mov qword [rbp - 0x20], rdi
jmp 0x14002fd16
mov qword [rbp - 0x20], rdi
cmp rax, 0x10
jb 0x14002fd08
mov rbx, qword [rbp - 0x30]
jmp 0x14002fd0c
lea rbx, [rbp - 0x30]
mov qword [rbp - 0x20], rdi
jmp 0x14002fd16
lea rbx, [rbp - 0x30]
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rdi], 0
movaps xmm0, xmmword [rbp - 0x30]
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140001860
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140032470
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
cmp byte [rcx + 8], 0
jne 0x140032509
mov rdi, r8
mov rsi, rcx
mov qword [rcx + 0x10], rdx
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x1400324a9
mov rcx, qword [rsi + 0x18]
call rax
mov rax, qword [rdi]
mov qword [rsi + 0x18], rax
mov rax, qword [rdi + 8]
mov qword [rsi + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400324cd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x140032750]
xor ecx, ecx
xor edx, edx
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
test rax, rax
je 0x14003250e
mov byte [rsi + 8], 1
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
call fcn.14000eb30
mov qword [rsi], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x14], eax
lea rdx, str.Failed_to_create_thread:_
lea rsi, [rbp - 0x30]
mov rcx, rsi
call fcn.14000a370
lea rcx, [rbp - 0x10]
lea r8, [rbp + 0x14]
mov rdx, rsi
call fcn.1400327c0
lea rsi, [rbp - 0x48]
lea rdx, [rbp - 0x10]
mov rcx, rsi
call fcn.140017890
lea rdx, [0x1400b1800]
mov rcx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400329a0
Capabilities:
Terminate thread

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x1400329d6
cmp byte [rsi + 8], 0
je 0x1400329d0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsi + 0x20]
test rax, rax
je 0x1400329e5
mov rcx, qword [rsi + 0x18]
call rax
nop
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x140033dc0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
movzx eax, byte [rcx]
movabs r8, 0xcbf29ce484222325
xor r8, rax
movabs rax, 0x100000001b3
imul r8, rax
movzx r9d, byte [rcx + 1]
xor r9, r8
imul r9, rax
movzx r8d, byte [rcx + 2]
xor r8, r9
imul r8, rax
movzx r9d, byte [rcx + 3]
xor r9, r8
imul r9, rax
movzx r8d, byte [rcx + 4]
xor r8, r9
imul r8, rax
movzx r9d, byte [rcx + 5]
xor r9, r8
imul r9, rax
movzx r10d, byte [rcx + 6]
xor r10, r9
imul r10, rax
movzx r8d, byte [rcx + 7]
xor r8, r10
imul r8, rax
and r8, qword [0x1400c4020]
mov r10, qword [0x1400c4008]
mov rax, r8
shl rax, 4
mov rax, qword [r10 + rax + 8]
cmp rax, qword [0x1400c3ff8]
je 0x140033e8b
mov r9, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x140033e7f
add r8, r8
mov r8, qword [r10 + r8*8]
nop dword [rax]
cmp rax, r8
je 0x140033e8b
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x140033e70
mov qword [rax + 0x28], rdx
mov rax, rcx
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x140034710
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400348f8
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.1400055e0
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov r8, qword [rax]
cmp r8, rdi
je 0x1400348ec
movabs rax, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
jmp 0x1400347b1
mov qword [r9 + r10*8], rdx
mov qword [r9 + rbx*8], rdx
cmp r8, rdi
je 0x1400348ec
mov rdx, r8
movzx r8d, byte [r8 + 0x10]
xor r8, rcx
imul r8, rax
movzx r9d, byte [rdx + 0x11]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x12]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x13]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x14]
xor r8, r9
imul r8, rax
movzx r9d, byte [rdx + 0x15]
xor r9, r8
imul r9, rax
movzx r8d, byte [rdx + 0x16]
xor r8, r9
imul r8, rax
movzx r11d, byte [rdx + 0x17]
xor r11, r8
imul r11, rax
and r11, qword [rsi + 0x30]
mov r8, qword [rdx]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11 + r11]
inc rbx
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x1400347a0
mov r14, qword [r9 + rbx*8]
mov r15, qword [rdx + 0x10]
cmp r15, qword [r14 + 0x10]
je 0x140034890
nop dword [rax]
cmp r11, r14
je 0x1400348c2
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140034850
mov r9, qword [r14]
mov r10, qword [rdx + 8]
mov qword [r10], r8
mov r11, qword [r8 + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], rdx
mov qword [r9 + 8], r11
mov qword [r8 + 8], r10
mov qword [rdx + 8], rbx
jmp 0x1400347a8
mov r10, qword [r14]
cmp r10, rdx
je 0x1400347a4
mov r11, qword [rdx + 8]
mov qword [r11], r8
mov r14, qword [r8 + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], rdx
mov qword [r10 + 8], r14
mov qword [r8 + 8], r11
mov qword [rdx + 8], r15
jmp 0x1400347a4
mov rbx, qword [rdx + 8]
mov qword [rbx], r8
mov r14, qword [r8 + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], rdx
mov qword [r11 + 8], r14
mov qword [r8 + 8], rbx
mov qword [rdx + 8], r15
mov qword [r9 + r10*8], rdx
jmp 0x1400347a8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14003f050
Capabilities:
Encode data using base64

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
lea rax, [r8 + 2]
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
mov r15, rdx
add r15, rdx
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
and r15, 0xfffffffffffffffc
js 0x14003f28d
mov ebx, r9d
mov r14, r8
cmp r15, 0xf
ja 0x14003f0cb
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], recv
mov rcx, rsi
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
add r15, rsi
mov r12, r15
jmp 0x14003f12b
mov rax, r15
or rax, 0xf
cmp rax, 0x17
mov r13d, 0x16
cmovae r13, rax
cmp r13, 0xfff
jb 0x14003f104
lea rcx, [r13 + 0x28]
call fcn.140055524
mov r12, rax
add r12, 0x27
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x14003f110
lea rcx, [r13 + 1]
call fcn.140055524
mov r12, rax
mov qword [rsi], r12
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r13
mov rcx, r12
xor edx, edx
mov r8, r15
call sub.VCRUNTIME140.dll_memset
add r12, r15
mov byte [r12], 0
cmp qword [rsi + 0x18], 0x10
mov rax, rsi
jb 0x14003f13d
mov rax, qword [rsi]
mov rcx, qword [rbp + 0x70]
cmp r14, 3
jb 0x14003f216
lea r8, [r14 - 2]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, byte [rdi + rdx]
shr r9, 2
movzx r9d, byte [rcx + r9]
mov byte [rax], r9b
movzx r9d, byte [rdi + rdx]
shl r9d, 4
and r9d, 0x30
movzx r10d, byte [rdi + rdx + 1]
shr r10, 4
or r10, r9
movzx r9d, byte [rcx + r10]
mov byte [rax + 1], r9b
movzx r9d, byte [rdi + rdx + 1]
and r9d, 0xf
movzx r10d, byte [rdi + rdx + 2]
shr r10, 6
lea r9, [r10 + r9*4]
movzx r9d, byte [rcx + r9]
mov byte [rax + 2], r9b
movzx r9d, byte [rdi + rdx + 2]
and r9d, 0x3f
movzx r9d, byte [rcx + r9]
mov byte [rax + 3], r9b
add rax, 4
add rdx, 3
cmp rdx, r8
jb 0x14003f160
cmp rdx, r14
jae 0x14003f21d
movzx r8d, byte [rdi + rdx]
shr r8, 2
movzx r8d, byte [rcx + r8]
mov byte [rax], r8b
dec r14
movzx r8d, byte [rdi + rdx]
shl r8d, 4
and r8d, 0x30
cmp rdx, r14
jne 0x14003f223
movzx ecx, byte [rcx + r8]
mov byte [rax + 1], cl
test bl, bl
je 0x14003f256
mov byte [rax + 2], 0x3d
mov byte [rax + 3], 0x3d
jmp 0x14003f279
xor edx, edx
cmp rdx, r14
jb 0x14003f1da
test bl, bl
je 0x14003f256
jmp 0x14003f279
movzx r9d, byte [rdx + rdi + 1]
shr r9, 4
movzx r8d, r8b
or r8, r9
movzx r8d, byte [rcx + r8]
mov byte [rax + 1], r8b
movzx edx, byte [rdx + rdi + 1]
and edx, 0xf
movzx ecx, byte [rcx + rdx*4]
mov byte [rax + 2], cl
test bl, bl
je 0x14003f256
mov byte [rax + 3], 0x3d
jmp 0x14003f279
cmp qword [rsi + 0x18], 0x10
mov rdi, rsi
jb 0x14003f263
mov rdi, qword [rsi]
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp qword [rsi + 0x10], rax
jb 0x14003f292
mov qword [rsi + 0x10], rax
mov byte [rdi + rax], 0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140001860
call fcn.140003530
int3