joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002cc50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x30], xmm0
mov rbp, rcx
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x40], xmm1
inc r8
cmp byte [rdx + r8], 0
jne 0x14002cc86
lea rcx, [rsp + 0x30]
call fcn.140006860
mov rsi, qword [rsp + 0x48]
lea rdx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
cmp rsi, 0xf
mov r8, qword [rsp + 0x40]
movabs r9, 0xcbf29ce484222325
cmova rdx, rbx
xor ecx, ecx
test r8, r8
je 0x14002cce4
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x14002ccd1
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.14001dac0
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14002cd04
mov rcx, qword [rbp + 0x20]
cmp rcx, qword [rbp + 0x20]
setne dil
cmp rsi, 0xf
jbe 0x14002cd46
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002cd3e
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002cd3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1400734ec
movzx eax, dil
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140073840
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14002d88d
xor eax, eax
jmp 0x14002d9f6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14002d8cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14002d8cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14002d9ee
cmp qword [rdi + 0x80], 0
je 0x14002d9e9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14002d907
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14002d932
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d9ee
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002d9a1
sub eax, 1
je 0x14002d9a1
cmp eax, 2
jne 0x14002d9e9
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d9ee
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14002d9cf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14002d9e9
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14002d9ee
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140073840
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400317a0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rdi, [0x14009a8a0]
mov rdx, rdi
lea rcx, str.TERM
lea r8d, [rbx + 0x32]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rbx
test rdi, rdi
je 0x140031825
cmp byte [rdi], bl
je 0x140031825
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbx
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x40], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], bl
jne 0x140031803
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140006860
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
jmp 0x140031840
xorps xmm0, xmm0
mov qword [rsp + 0x38], rbx
mov edi, 0xf
movups xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x40], rdi
mov rsi, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
cmp rdi, 0xf
cmova rcx, rsi
cmp rbx, 5
jne 0x14003186f
mov r8, rbx
lea rdx, str.xterm
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xb
jne 0x140031899
mov r8, rbx
lea rdx, str.xterm_color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xe
jne 0x1400318c3
mov r8, rbx
lea rdx, str.xterm_256color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 6
jne 0x1400318e9
mov r8, rbx
lea rdx, str.screen
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 5
jne 0x14003190f
mov r8, rbx
lea rdx, str.linux
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 6
jne 0x140031935
mov r8, rbx
lea rdx, str.cygwin
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003195b
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xf
jne 0x14003195f
mov r8, rbx
lea rdx, str.screen_256color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14003195f
mov bl, 1
jmp 0x140031961
xor bl, bl
cmp rdi, 0xf
jbe 0x14003199b
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140031993
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031993
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400734ec
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140073840
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140032470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.14002b9b0
mov rsi, rax
test rax, rax
je 0x140032580
mov r8, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x40], rbp
call qword [r8 + 0x58]
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
mov r8, qword [rdi + 0x10]
mov rbp, rax
jbe 0x1400324b9
mov rdx, qword [rdi]
xor ecx, ecx
movabs rbx, 0xcbf29ce484222325
test r8, r8
je 0x1400324f3
movabs r9, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor rbx, rax
imul rbx, r9
cmp rcx, r8
jb 0x1400324e0
mov r9, rbx
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, rbp
call fcn.14001dac0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003256d
mov r8, qword [rbp + 0x30]
and r8, rbx
shl r8, 4
add r8, qword [rbp + 0x18]
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x140032543
cmp rax, rdx
jne 0x140032539
mov rax, qword [rbp + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x14003254e
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
jmp 0x14003254e
cmp rax, rdx
jne 0x14003254e
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
lea rcx, [rbp + 8]
dec qword [rcx + 8]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.14001dd60
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + 0x18]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140033a80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140033ab1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140033ac8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140033b19
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140033b91
mov rcx, rbp
call fcn.140027490
cmp rbx, 0xfff
jbe 0x140033b71
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140033bb2
cmp rbx, rax
ja 0x140033b40
test rdi, rdi
je 0x140033b91
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140033b94
Function at 0x140033bc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140033be1
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140033c5c
test rax, rax
jle 0x140033c3c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140033c5c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140033c5c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x140035da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
call fcn.140035be0
nop
lea rcx, [rbx + 0x40]
call fcn.140035990
nop
mov qword [rbx + 0x128], 0x1dcd6500
mov byte [rbx + 0x130], 0
mov ecx, sendto
call fcn.1400734b0
test rax, rax
je 0x140035df1
mov qword [rax], rbx
lea rcx, [0x14003b270]
mov qword [rax + 8], rcx
mov qword [rsp + 0x48], rax
lea rdi, [rbx + 0x140]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140034dc0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx + 0x138], rax
test rax, rax
je 0x140035e3f
mov byte [rbx + 0x148], 1
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140037d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rdx + 0x28], 0xf
lea r10, [rdx + 0x10]
mov r11, qword [r10 + 0x10]
mov r8, rdx
mov rbx, rcx
jbe 0x140037d8e
mov r10, qword [r10]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x140037dc4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r10]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r11
jb 0x140037db0
mov rdx, qword [rbx + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [rbx + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x140037df8
cmp rax, r8
jne 0x140037dee
mov rax, qword [rbx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140037e03
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x140037e03
cmp rax, r8
jne 0x140037e03
mov rax, qword [r8]
mov qword [rdx], rax
lea rcx, [rbx + 8]
mov rbx, qword [r8]
dec qword [rcx + 8]
mov rdx, qword [r8 + 8]
mov qword [rdx], rbx
mov rdx, qword [r8 + 8]
mov qword [rbx + 8], rdx
mov rdx, r8
call fcn.140034d50
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14003c5a0
Capabilities:
Initialize winsock library

Disassembly:
jmp 0x14003c5a0
push rbx
sub rsp, 0xa0
mov rax, qword [0x140098500]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov ecx, 0x202
lea rdx, [0x14019a950]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x14003c5ea
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140073840
add rsp, 0xa0
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea rcx, [rsp + 0x70]
call fcn.140033f90
nop
lea rcx, str.message:__with_code:_
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0x19
mov r9, rax
lea r8, str.unable_to_startup_winsock
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140006e20
mov rbx, rax
lea rdx, str.C:BuildXoap1YSt2HaplyInternalhardware_api_service_srclts_srccommunication_socket.cpp
lea rcx, [rsp + 0x30]
call fcn.1400073f0
nop
mov r9, rbx
mov r8d, 0x43
lea rdx, [rsp + 0x30]
lea ecx, [r8 - 0x40]
call fcn.14004f120
nop
lea rcx, [rsp + 0x30]
call fcn.140007850
nop
lea rcx, [rsp + 0x50]
call fcn.140007850
nop
lea rcx, [rsp + 0x70]
call fcn.140007850
call fcn.140007ec0
int3
Function at 0x14003d210
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r9, rcx
movabs rcx, 0x100000001b3
mov r10, rdx
movabs rax, 0xcbf29ce484222325
xor r8, rax
movzx eax, byte [rdx + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
imul r8, rcx
lea rcx, [r9 + 8]
and rdx, r8
shl rdx, 4
add rdx, qword [r9 + 0x18]
mov rbx, qword [rdx + 8]
cmp rbx, qword [rcx]
je 0x14003d29b
mov eax, dword [r10]
mov r8, qword [rdx]
cmp eax, dword [rbx + 0x10]
je 0x14003d29d
cmp rbx, r8
je 0x14003d297
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x14003d283
lea rcx, [r9 + 8]
jmp 0x14003d29d
lea rcx, [r9 + 8]
xor ebx, ebx
test rbx, rbx
je 0x14003d34c
mov rax, qword [rdx]
mov qword [rsp + 0x38], rdi
cmp qword [rdx + 8], rbx
jne 0x14003d2cf
cmp rax, rbx
jne 0x14003d2c5
mov rax, qword [rcx]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14003d2da
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14003d2da
cmp rax, rbx
jne 0x14003d2da
mov rax, qword [rbx]
mov qword [rdx], rax
mov rcx, qword [rbx]
dec qword [r9 + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rcx
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14003d32f
mov qword [rsp + 0x30], rsi
mov esi, 0xffffffff
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x14003d32a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x14003d32a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + ioctlsocket]
mov rsi, qword [rsp + 0x30]
mov edx, 0x58
mov rcx, rbx
call fcn.1400734ec
mov rdi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14003dd60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14003df11
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14000e340
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14003ded6
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003de50
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14003dec5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14003de8d
mov r10, qword [rdx]
cmp r10, rax
je 0x14003de87
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003dec5
cmp r9, rdx
je 0x14003dea1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14003deeb
cmp r9, rdx
jne 0x14003de92
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14003de00
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003dec5
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14003f230
Capabilities:
Hash data using fnv

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
sub rsp, 0x50
mov rbx, rdx
mov r9, rcx
movabs rcx, 0x100000001b3
movzx edx, r8b
movabs rax, 0xcbf29ce484222325
xor r10d, r10d
xor rdx, rax
movzx eax, byte [rsp + 0x71]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x72]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x73]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r9 + 0x38]
and rcx, rdx
mov rdx, qword [r9 + 0x10]
shl rcx, 4
add rcx, qword [r9 + 0x20]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x14003f2c1
mov rcx, qword [rcx]
cmp r8d, dword [rax + 0x10]
je 0x14003f2c4
nop dword [rax + rax]
cmp rax, rcx
je 0x14003f2c1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x14003f2b0
jmp 0x14003f2c4
mov rax, r10
test rax, rax
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
cmove rax, rdx
cmp rax, rdx
jne 0x14003f2f4
mov qword [rbx], r10
mov rax, rbx
mov qword [rbx + 8], r10
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x14003f301
lock inc dword [rcx + 8]
mov rdx, qword [rax + 0x20]
mov rcx, qword [rax + 0x18]
mov rax, rbx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov qword [rbx], rcx
mov qword [rbx + 8], rdx
add rsp, 0x50
pop rbx
ret
Function at 0x1400503c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140050551
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140050551
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x14005045b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140050578
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140050472
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x140050472
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140050485
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x1400504d2
mov r9d, eax
cmp eax, 0x800
jae 0x14005049f
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x1400504d2
cmp eax, 0x10000
jae 0x1400504b9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x1400504d2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x140050551
add qword [r14], 2
test sil, sil
jne 0x1400504f3
cmp r10d, 3
jae 0x1400504ff
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x14005052e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x140050510
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14005040f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x14005055f