joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026590
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.WriteAtCurrentPos
lea r8, str..._.._base_files_file_win.cc
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov r9d, 0x87
call fcn.1400167c0
lea rcx, [rsp + 0x58]
mov rdx, rdi
xor r8d, r8d
call fcn.140024c80
test esi, esi
js 0x140026644
lea rcx, [rsp + 0x38]
call fcn.140022810
call fcn.140040160
test al, al
je 0x140026610
movsxd r9, esi
lea rdx, str.File::WriteAtCurrentPos
lea rcx, [rsp + 0x38]
mov r8, rbx
call fcn.140040200
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x34]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x34]
lea rcx, [rsp + 0x38]
call fcn.1400401d0
jmp 0x140026649
mov esi, 0xffffffff
lea rcx, [rsp + 0x58]
call fcn.140024db0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a5a90
mov eax, esi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140027ef0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x28], rax
movsd xmm6, qword [0x1401280f0]
xorpd xmm0, xmm0
ucomisd xmm6, xmm0
jne 0x14002805f
jp 0x14002805f
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentThread]
call rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov ebp, eax
call rdi
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [0x140128100]
mov ecx, dword [0x140127e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002807e
mov eax, dword [0x140128110]
mov ecx, dword [0x140127e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400280ba
rdtsc
mov rdi, rax
mov rbx, rdx
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rsi, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
sub rsi, qword [0x140128108]
movq xmm1, rsi
punpckldq xmm1, xmmword [0x1400f6050]
subpd xmm1, xmmword [0x1400f6060]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addpd xmm0, xmm1
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x20]
divsd xmm0, xmm1
xorpd xmm6, xmm6
movsd xmm1, qword [0x1400f6078]
ucomisd xmm1, xmm0
ja 0x14002805f
shl rbx, 0x20
or rdi, rbx
sub rdi, qword [0x1401280f8]
movq xmm1, rdi
punpckldq xmm1, xmmword [0x1400f6050]
subpd xmm1, xmmword [0x1400f6060]
movapd xmm6, xmm1
unpckhpd xmm6, xmm1
addpd xmm6, xmm1
divsd xmm6, xmm0
movsd qword [0x1401280f0], xmm6
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a5a90
movapd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
ret
lea rcx, [0x140128100]
call fcn.1400a58b0
mov eax, dword [0x140128100]
cmp eax, 0xffffffff
jne 0x140027f71
rdtsc
shl rdx, 0x20
or rdx, rax
mov qword [0x1401280f8], rdx
lea rcx, [0x140128100]
call fcn.1400a5920
jmp 0x140027f71
lea rcx, [0x140128110]
call fcn.1400a58b0
mov eax, dword [0x140128110]
cmp eax, 0xffffffff
jne 0x140027f96
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [0x140128108], rax
lea rcx, [0x140128110]
call fcn.1400a5920
jmp 0x140027f96
Function at 0x14002dd00
Capabilities:
Check os version
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x158], rax
mov eax, dword [0x1401281e0]
mov ecx, dword [0x140127e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14002dd62
lea rsi, [0x1401281d8]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400a5a90
mov rax, rsi
add rsp, 0x160
pop rbx
pop rdi
pop rsi
ret
lea rcx, [0x1401281e0]
call fcn.1400a58b0
mov eax, dword [0x1401281e0]
cmp eax, 0xffffffff
jne 0x14002dd3d
lea rcx, [rsp + 0x3c]
xor esi, esi
mov r8d, 0x118
xor edx, edx
call fcn.1400c9890
mov dword [rsp + 0x38], 0x11c
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x34], 0
mov eax, dword [rsp + 0x3c]
cmp eax, 0xa
je 0x14002ddb6
cmp eax, 6
jne 0x14002ddf1
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [rsp + 0x3c]
mov edx, dword [rsp + 0x40]
lea rbx, [rsp + 0x34]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor r9d, r9d
call rax
mov esi, dword [rsp + 0x34]
mov ecx, pe_nt_image_headers64
call fcn.1400a56d0
mov rdi, rax
lea rbx, [0x1401281e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rdx, [rsp + 0x38]
mov rcx, rdi
mov r8, rbx
mov r9d, esi
call fcn.14002def0
mov qword [0x1401281d8], rdi
lea rcx, [0x1401281e0]
call fcn.1400a5920
jmp 0x14002dd3d

Function at 0x14002de60
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
lea rcx, [0x1401281e8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx ecx, word [0x1401281e8]
cmp rcx, 0xc
ja case.0x14002de8e.1
xor eax, eax
lea rdx, [0x14002deb0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, 2
jmp case.0x14002de8e.0
mov eax, 4
jmp case.0x14002de8e.0
mov eax, 1
jmp case.0x14002de8e.0
mov eax, 3
add rsp, 0x28
ret
Function at 0x140034340
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x70], rax
cmp qword [r8 + 0x10], 0
je 0x140034397
mov r12, r8
mov ebx, edx
mov edi, ecx
bt edx, 8
jae 0x14003437c
mov eax, ebx
and eax, 0x200
jne 0x140034397
cmp edi, 2
lea rax, [0x140128520]
lea rcx, [0x140128720]
cmove rcx, rax
cmp word [rcx], 0
je 0x1400343b6
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400a5a90
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xorps xmm0, xmm0
lea rsi, [rsp + 0x40]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [rsi], 0
je 0x140034397
cmp byte [0x140128510], 0
setne al
bt ebx, 8
jb 0x140034397
shr ebx, 9
and ebx, 1
or bl, al
je 0x140034397
cmp edi, 2
lea rax, str.SOFTWAREClasses
lea rsi, str.SOFTWARE
cmove rsi, rax
cmp qword [r12 + 0x18], 8
mov rdi, r12
jb 0x140034416
mov rdi, qword [r12]
mov rbp, qword [r12 + 0x10]
mov r13d, 1
xor r15d, r15d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1400344b2
movzx edx, word [rdi + rbx*2]
cmp dx, 0x5c
je 0x14003444f
test dx, dx
jne 0x1400344d4
lea rax, [rdi + rbx*2]
mov ebp, dword [rsi + 0x10]
lea rcx, str.WOW6432Node_
cmp ebp, 1
je 0x14003447d
cmp ebp, 2
jne 0x140034473
mov rdi, rax
lea rcx, str.WOW6432Node
jmp 0x14003447d
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
cmp dx, 0x5c
mov dword [rsp + 0x2c], ebp
jne 0x140034495
dec r14
cmp word [rax + 2], 0x5c
lea rax, [rax + 2]
je 0x140034487
mov r13, qword [rsi + 0x20]
mov rsi, qword [rsi + 0x18]
mov rbp, r14
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov rdi, rax
jmp 0x1400344db
mov rbx, qword [rsi + 8]
mov r14, rbp
sub r14, rbx
jb 0x1400344d4
mov rdx, qword [rsi]
mov rcx, rdi
mov r8, rbx
call fcn.1400d6990
test eax, eax
je 0x14003443c
add rsi, 0x28
inc r15
cmp r15, r13
jb 0x1400344b2
cmp dword [rsp + 0x2c], 0
je 0x140034397
cmp qword [r12 + 0x18], 8
mov rax, r12
jb 0x1400344fa
mov rax, qword [r12]
mov rdi, qword [rsp + 0x30]
sub rdi, rax
sar rdi, 1
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
call fcn.1400dd300
mov rcx, r12
mov rdx, rdi
mov r8, rsi
mov r9, rax
call fcn.140034dc0
jmp 0x140034397

Function at 0x140035480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140124180]
cmp ecx, 0xffffffff
je 0x14003549e
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, 1
sete al
jmp 0x1400354a0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400354b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x140124180]
cmp ecx, 0xffffffff
je 0x1400354dd
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x1400354e2
call fcn.140035610
mov eax, dword [0x14012aad8]
mov ecx, dword [0x140127e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400355ab
mov rbx, qword [0x14012aad0]
mov rcx, rbx
call fcn.140022820
mov rcx, qword [0x1401292c8]
add rcx, 1
xor edx, edx
lea rax, [0x1401292d0]
nop word [rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140035561
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140035561
add rdx, 2
add rcx, 2
cmp rdx, 0x100
jb 0x140035530
jmp 0x140035586
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1401292c8], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x1400355f3
cmp eax, 0x100
jge 0x1400355fa
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x14012aad8]
call fcn.1400a58b0
mov eax, dword [0x14012aad8]
cmp eax, 0xffffffff
jne 0x140035507
mov ecx, 8
call fcn.1400a56d0
mov rbx, rax
mov rcx, rax
call fcn.140022810
mov qword [0x14012aad0], rbx
lea rcx, [0x14012aad8]
call fcn.1400a5920
jmp 0x140035507
int3
int3

Function at 0x140035610
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.1400a7810
sub rsp, rax
lea rbp, [rsp + 0x80]
mov rax, qword [0x140124058]
xor rax, rbp
mov qword [rbp + 0xfb8], rax
mov ecx, dword [0x140124180]
mov dword [rbp - 0x54], ecx
cmp ecx, 0xffffffff
jne 0x1400356a8
lea rcx, [rbp - 0x54]
call fcn.140068b10
test al, al
je 0x14003571f
mov ecx, dword [rbp - 0x54]
cmp ecx, 0xffffffff
jne 0x140035688
lea rcx, [rbp - 0x54]
call fcn.140068b10
test al, al
je 0x140035726
cmp dword [rbp - 0x54], 0xffffffff
je 0x140035726
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rbp - 0x54]
mov eax, 0xffffffff
lock cmpxchg dword [0x140124180], ecx
mov ecx, dword [rbp - 0x54]
je 0x1400356a8
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x140124180]
mov dword [rbp - 0x54], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035718
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.1400c9890
mov ecx, dword [rbp - 0x54]
mov rdx, rsi
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.1400a7870
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.1400c9420
mov ecx, dword [rbp - 0x54]
mov rdx, rdi
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rbp + 0xfb8]
xor rcx, rbp
call fcn.1400a5a90
mov rax, rdi
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
int3
int3
int3
Function at 0x140035800
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140124180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003582f
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x14003582f
mov rax, qword [rax + rcx]
jmp 0x140035831
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140035840
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x140124180]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140035867
test rdi, rdi
je 0x140035880
call fcn.140035610
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140035b30
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov r14, rcx
mov rax, qword [0x140124058]
xor rax, rsp
mov qword [rsp + 0x28], rax
movzx eax, byte [rdx]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx ebx, byte [rdx + 1]
xor rbx, rcx
imul rbx, rax
movzx ecx, byte [rdx + 2]
xor rcx, rbx
imul rcx, rax
movzx ebx, byte [rdx + 3]
xor rbx, rcx
imul rbx, rax
and rbx, qword [r14 + 0x30]
mov r9, qword [r14 + 8]
mov r10, qword [r14 + 0x18]
lea r11, [rbx + rbx]
add r11, 1
shl rbx, 4
mov rax, qword [r10 + rbx]
mov edx, dword [rdx]
xor edi, edi
mov r8, rax
jmp 0x140035bc3
mov r8, qword [r8]
mov rbx, rax
cmp rax, r9
je 0x140035bd2
mov rcx, qword [r10 + r11*8]
mov rbx, qword [rcx]
mov cl, 1
cmp rbx, r8
je 0x140035c42
cmp dword [r8 + 0x10], edx
jne 0x140035bc0
mov rsi, r8
jmp 0x140035bf3
mov rsi, qword [rsi]
mov rdi, rax
cmp rax, r9
je 0x140035c02
mov rdi, qword [r10 + r11*8]
mov rdi, qword [rdi]
cmp rdi, rsi
je 0x140035c0c
cmp edx, dword [rsi + 0x10]
je 0x140035bf0
xor edi, edi
cmp r8, rsi
je 0x140035c42
mov rax, r8
nop word cs:[rax + rax]
add rdi, 1
mov rax, qword [rax]
cmp rsi, rax
jne 0x140035c20
xor ecx, ecx
cmp qword [r9], r8
jne 0x140035c4d
cmp rsi, r9
jne 0x140035c4d
mov rcx, r14
call fcn.140037cd0
jmp 0x140035c76
mov r8, r9
mov rsi, r9
cmp qword [r9], r8
je 0x140035c33
test cl, cl
jne 0x140035c76
lea r15, [rsp + 0x20]
nop word cs:[rax + rax]
mov rbx, qword [r8]
mov rcx, r14
mov rdx, r15
call fcn.14003a160
mov r8, rbx
cmp rsi, rbx
jne 0x140035c60
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400a5a90
mov rax, rdi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140039d10
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x140039da3
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x140039db2
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x140039dcb
cmp dword [rdx + 0x10], ebx
jne 0x140039da0
cmp rdx, rax
je 0x140039dcb
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x140039e3e
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x20
call fcn.1400a56d0
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov qword [rax + 0x18], 0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x7fffffffffffffe
cmp rcx, rdx
je 0x140039e51
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.140039e60
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a6f60
ud2
Function at 0x14003a160
Capabilities:
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, r8
movzx eax, byte [r8 + 0x10]
movabs rbx, 0xcbf29ce484222325
xor rbx, rax
movabs r8, 0x100000001b3
imul rbx, r8
movzx edi, byte [rsi + 0x11]
xor rdi, rbx
imul rdi, r8
movzx eax, byte [rsi + 0x12]
xor rax, rdi
imul rax, r8
movzx ebx, byte [rsi + 0x13]
xor rbx, rax
imul rbx, r8
and rbx, qword [rcx + 0x30]
mov r14, rdx
lea rdx, [rbx + rbx]
mov rdi, qword [rcx + 0x18]
mov rax, rbx
shl rax, 4
lea r8, [rdi + rax]
mov rax, qword [rdi + rax]
cmp qword [rdi + rdx*8 + 8], rsi
je 0x14003a1dc
cmp rax, rsi
jne 0x14003a210
mov rdx, rsi
jmp 0x14003a20a
cmp rax, rsi
je 0x14003a1ef
lea r8, [rdi + rdx*8]
add r8, 8
lea rdx, [rsi + 8]
jmp 0x14003a20a
mov rax, qword [rcx + 8]
mov qword [r8], rax
lea r8, [rbx + rbx]
add r8, 1
lea rdx, [rcx + 8]
shl r8, 3
add r8, qword [rcx + 0x18]
mov rax, qword [rdx]
mov qword [r8], rax
mov rbx, qword [rsi]
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov rax, qword [rsi]
mov rdx, qword [rsi + 8]
mov qword [rax + 8], rdx
add qword [rcx + 0x10], 0xffffffffffffffff
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x14003a247
lock sub dword [rcx + 8], 1
jne 0x14003a247
add rcx, 8
add rcx, 0xfffffffffffffff8
call fcn.1400469e0
mov edx, 0x20
mov rcx, rsi
call fcn.1400a5740
mov qword [r14], rbx
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14003a830
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14003a8c3
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x14003a8d2
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14003a8ee
cmp dword [rdx + 0x10], ebx
jne 0x14003a8c0
cmp rdx, rax
je 0x14003a8ee
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14003a971
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400a56d0
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov ecx, 0xf
movq xmm0, rcx
pslldq xmm0, 8
movdqu xmmword [rax + 0x28], xmm0
mov byte [rax + 0x18], 0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x14003a984
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.14003a9a0
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a6f60
ud2
Function at 0x14003acd0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r13, r8
mov r14, rdx
mov r12, rcx
movzx eax, byte [r8]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r8 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r8 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r8 + 3]
xor rdx, rcx
imul rdx, rax
and rdx, qword [r12 + 0x30]
mov rax, qword [r12 + 8]
mov r8, qword [r12 + 0x18]
lea rsi, [rdx + rdx]
add rsi, 1
shl rdx, 4
mov rcx, qword [r8 + rdx]
mov ebx, dword [r13]
mov rdx, rcx
jmp 0x14003ad63
mov rdx, qword [rdx]
mov rdi, rcx
cmp rcx, rax
je 0x14003ad72
mov rdi, qword [r8 + rsi*8]
mov rdi, qword [rdi]
cmp rdi, rdx
je 0x14003ad8b
cmp dword [rdx + 0x10], ebx
jne 0x14003ad60
cmp rdx, rax
je 0x14003ad8b
mov qword [r14], rdx
mov byte [r14 + 8], 0
jmp 0x14003ae01
mov rsi, qword [rax]
mov r15, qword [rsi + 8]
mov ecx, 0x38
call fcn.1400a56d0
test rsi, rsi
mov rcx, r15
cmove rcx, rax
mov rdx, rsi
cmove rdx, rax
mov qword [rax], rdx
mov qword [rax + 8], rcx
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
xorps xmm0, xmm0
movups xmmword [rax + 0x28], xmm0
movups xmmword [rax + 0x18], xmm0
mov rcx, qword [r12 + 0x10]
movabs rdx, 0x492492492492491
cmp rcx, rdx
je 0x14003ae14
add rcx, 1
mov qword [r12 + 0x10], rcx
mov qword [rsi + 8], rax
mov qword [r15], rax
mov rax, qword [r12 + 8]
mov r9, qword [rax]
lea r8, [r9 + 0x10]
mov rcx, r12
mov rdx, r14
call fcn.14003ae30
mov rax, r14
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.list_T__too_long
call fcn.1400a6f60
ud2
Function at 0x14003b430
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r12, r8
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 0xf
jbe 0x14003b452
mov r12, qword [r12]
movabs rbx, 0xcbf29ce484222325
mov rbp, r15
sub rbp, 1
mov qword [rsp + 0x20], rdx
jae 0x14003b472
mov rdx, rbx
jmp 0x14003b507
movabs rax, 0x100000001b3
mov r8d, r15d
and r8d, 3
cmp rbp, 3
jae 0x14003b48d
xor esi, esi
jmp 0x14003b4dc
mov rbp, r15
sub rbp, r8
xor esi, esi
nop word cs:[rax + rax]
nop
movzx edx, byte [r12 + rsi]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 1]
xor rbx, rdx
imul rbx, rax
movzx edx, byte [r12 + rsi + 2]
xor rdx, rbx
imul rdx, rax
movzx ebx, byte [r12 + rsi + 3]
xor rbx, rdx
imul rbx, rax
add rsi, 4
cmp rbp, rsi
jne 0x14003b4a0
mov rdx, rbx
test r8, r8
je 0x14003b507
add rsi, r12
xor ebp, ebp
nop dword [rax]
movzx edx, byte [rsi + rbp]
xor rdx, rbx
imul rdx, rax
add rbp, 1
mov rbx, rdx
cmp r8, rbp
jne 0x14003b4f0
and rdx, qword [rcx + 0x30]
mov rbx, qword [rcx + 8]
mov r13, qword [rcx + 0x18]
mov rax, rdx
shl rax, 4
mov rbp, qword [r13 + rax]
lea r14, [rdx + rdx]
add r14, 1
mov rdi, rbp
cmp rbp, rbx
jne 0x14003b548
jmp 0x14003b570
mov rdi, qword [rdi]
cmp rbp, rbx
je 0x14003b570
mov rax, qword [r13 + r14*8]
mov rax, qword [rax]
cmp rax, rdi
je 0x14003b5a8
cmp qword [rdi + 0x20], r15
jne 0x14003b540
cmp qword [rdi + 0x28], 0xf
jbe 0x14003b580
mov rsi, qword [rdi + 0x10]
jmp 0x14003b584
mov rax, rbx
cmp rax, rdi
jne 0x14003b555
jmp 0x14003b5a8
lea rsi, [rdi + 0x10]
mov rcx, rsi
mov rdx, r12
mov r8, r15
call fcn.1400c9320
test eax, eax
jne 0x14003b540
mov rcx, r12
mov rdx, rsi
mov r8, r15
call fcn.1400c9320
test eax, eax
je 0x14003b5c1
mov rax, qword [rsp + 0x20]
mov qword [rax], rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x20]
mov qword [rax], rdi
jmp 0x14003b5b0
Function at 0x140040240
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test rdx, rdx
je 0x140040282
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14004028d
add rdi, rbx
sub rsi, rbx
jne 0x140040260
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
int3