joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0330
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rcx
xor r14d, r14d
xor sil, sil
lea rbx, [rcx + 0x18]
mov qword [rbp + 0x27], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
cmp qword [rdi + 0x40], r14
je 0x1401b045e
call fcn.1401ade50
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp rax, qword [rdi + 0x40]
je 0x1401b045e
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f], xmm0
lea rdx, [rbp + 0x2f]
mov rcx, rdi
call fcn.140003770
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
mov esi, r14d
mov rcx, qword [rbp + 0x37]
test rcx, rcx
je 0x1401b03d7
lock inc dword [rcx + 0xc]
mov r14, qword [rbp + 0x2f]
mov rcx, qword [rbp + 0x37]
mov rsi, rcx
mov rbx, qword [rbp + 0x27]
lea r15, [0x1401b04b0]
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], rdi
test rcx, rcx
je 0x1401b0408
mov eax, 0xffffffff
lock xadd dword [rcx + 0xc], eax
cmp eax, 1
jne 0x1401b0404
mov rcx, qword [rbp + 0x37]
mov rax, qword [rcx]
call qword [rax + reloc.SinoSPE.dll_Ordinal_8]
mov rbx, qword [rbp + 0x27]
lea rax, vtable.std::_Func_impl_no_alloc_class_nbase::WeakCallback_class_std::_Binder_struct_std::_Unforced__void__volatile____thiscall_nbase::MessageLoopProxy::__void_____ptr64__class_nbase::MessageLoopProxy_const____ptr64____ptr64____void___.0
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov qword [rbp - 1], r15
mov qword [rbp + 7], rdi
lea rax, [rbp - 0x19]
mov qword [rbp + 0x1f], rax
lea rdx, [rbp - 0x19]
mov rcx, qword [rdi + 0x40]
call fcn.1401acf00
nop
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x1401b045b
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + reloc.SinoSPE.dll_Ordinal_32]
nop
mov sil, 1
test rbx, rbx
je 0x1401b046c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test sil, sil
jne 0x1401b047e
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1401b4e20
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
cmp qword [rdx + 0x18], 7
mov rsi, r8
mov qword [rsp + 0x20], r8
mov rbx, rdx
mov r8, rdx
mov r14, rcx
jbe 0x1401b4e46
mov r8, qword [rdx]
mov rdx, qword [rdx + 0x10]
movabs r9, 0xcbf29ce484222325
mov ecx, 0
add rdx, rdx
je 0x1401b4e84
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, rdx
jb 0x1401b4e70
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [r14 + 0x288]
call fcn.140125c20
mov rdi, qword [rax + 8]
test rdi, rdi
jne 0x1401b4ea8
mov rdi, qword [r14 + 0x290]
cmp rdi, qword [r14 + 0x290]
je 0x1401b4f0e
mov rdx, qword [rdi + 0x38]
mov r8, rsi
mov rcx, qword [rdi + 0x30]
call fcn.1403c9dd0
cmp rax, qword [rdi + 0x38]
je 0x1401b4ed4
xor al, al
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdx, qword [rdi + 0x38]
cmp rdx, qword [rdi + 0x40]
je 0x1401b4ef3
mov qword [rdx], rsi
mov al, 1
add qword [rdi + 0x38], 8
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rdi + 0x30]
lea r8, [rsp + 0x20]
call fcn.1401ba200
mov al, 1
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, rbx
lea rdx, [rsp + 0x28]
lea rcx, [r14 + 0x288]
call fcn.1401b98d0
mov rcx, qword [rax]
add rcx, 0x30
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1401b4ef7
mov qword [rdx], rsi
mov al, 1
add qword [rcx + 8], 8
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401b4f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov rsi, rcx
mov r10, rdx
jbe 0x1401b4f6f
mov r10, qword [rdx]
mov r8, qword [rdx + 0x10]
mov ebx, 0
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
add r8, r8
je 0x1401b4fb4
movabs r11, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r8
jb 0x1401b4fa0
mov r8, rdx
lea rcx, [rsi + 0x288]
lea rdx, [rsp + 0x20]
call fcn.140125c20
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x1401b4fd8
mov rdx, qword [rsi + 0x290]
cmp rdx, qword [rsi + 0x290]
lea rcx, [rdx + 0x30]
mov rsi, qword [rsp + 0x58]
cmovne rbx, rcx
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1401b5000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov r15, r8
mov r8, rdx
mov rbp, rcx
jbe 0x1401b5022
mov r8, qword [rdx]
mov r10, qword [rdx + 0x10]
movabs rdi, 0xcbf29ce484222325
mov esi, 0
mov r9, rdi
movabs r12, 0x100000001b3
mov ecx, esi
add r10, r10
je 0x1401b5064
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor r9, rax
imul r9, r12
cmp rcx, r10
jb 0x1401b5050
mov r8, rdx
lea rcx, [rbp + 0x288]
lea rdx, [rsp + 0x20]
call fcn.140125c20
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x1401b5088
mov rbx, qword [rbp + 0x290]
cmp rbx, qword [rbp + 0x290]
je 0x1401b5183
mov rdx, qword [rbx + 0x38]
mov r8, r15
mov rcx, qword [rbx + 0x30]
call fcn.1403c9dd0
mov r8, qword [rbx + 0x38]
cmp rax, r8
je 0x1401b50c2
lea rdx, [rax + 8]
mov rcx, rax
sub r8, rdx
call sub.VCRUNTIME140.dll_memmove
add qword [rbx + 0x38], 0xfffffffffffffff8
mov rax, qword [rbx + 0x38]
cmp qword [rbx + 0x30], rax
jne 0x1401b5183
cmp qword [rbx + 0x28], 7
lea rcx, [rbx + 0x10]
jbe 0x1401b50df
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x20]
add rdx, rdx
je 0x1401b5103
nop dword [rax + rax]
movzx eax, byte [rcx + rsi]
inc rsi
xor rdi, rax
imul rdi, r12
cmp rsi, rdx
jb 0x1401b50f0
mov rdx, qword [rbp + 0x2b8]
and rdx, rdi
shl rdx, 4
add rdx, qword [rbp + 0x2a0]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1401b5140
cmp rax, rbx
jne 0x1401b5136
mov rax, qword [rbp + 0x290]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1401b514b
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1401b514b
cmp rax, rbx
jne 0x1401b514b
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x30]
dec qword [rbp + 0x298]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.1400cec70
lea rcx, [rbx + 0x10]
call fcn.140006060
mov edx, 0x48
mov rcx, rbx
call fcn.1403ca488
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401b74b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rdx
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
je 0x1401b74f6
cmp rbx, qword [rdi + 0x158]
je 0x1401b74f6
test rbx, rbx
je 0x1401b74f6
call qword [sym.imp.USER32.dll_SetFocus]
mov rsi, qword [rdi + 0x158]
cmp rbx, rsi
je 0x1401b7679
mov qword [rsp + 0x90], r14
xor r14d, r14d
test rsi, rsi
je 0x1401b75a6
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x40], 6
mov word [rbp - 0x24], r14w
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 0x2c], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x30], eax
lea rdx, [rbp - 0x40]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x238]
mov rsi, qword [rdi + 0x158]
mov qword [rdi + 0x158], r14
test rsi, rsi
je 0x1401b75a6
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x2c], rax
mov word [rbp - 0x24], r14w
mov dword [rbp - 0x10], r14d
mov qword [rbp - 0x38], rsi
mov dword [rbp - 0x40], Ordinal_51
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x30], eax
mov rcx, rsi
mov rax, qword [rsi]
mov qword [rbp - 0x18], r14
call qword [rax + 0x238]
test rbx, rbx
je 0x1401b7671
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
cmp rax, rdi
jne 0x1401b7671
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SinoSPE.dll_Ordinal_40]
test al, al
je 0x1401b7671
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x128]
test al, al
je 0x1401b7671
mov qword [rdi + 0x158], rbx
mov qword [rbp - 0x38], rbx
mov dword [rbp - 0x40], 5
mov word [rbp - 0x24], r14w
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 0x2c], r14
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x30], eax
lea rdx, [rbp - 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x238]
mov rbx, qword [rdi + 0x158]
test rbx, rbx
je 0x1401b7671
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x2c], rax
mov word [rbp - 0x24], r14w
mov dword [rbp - 0x10], r14d
mov qword [rbp - 0x38], rbx
mov dword [rbp - 0x40], reloc.SinoSPE.dll_Ordinal_49
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x30], eax
mov rcx, rbx
mov rax, qword [rbx]
mov qword [rbp - 0x18], r14
call qword [rax + 0x238]
mov r14, qword [rsp + 0x90]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1403ca460
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b7910
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov rbx, rcx
mov r10, rdx
jbe 0x1401b792a
mov r10, qword [rdx]
mov r8, qword [rdx + 0x10]
movabs r9, 0xcbf29ce484222325
mov ecx, 0
add r8, r8
je 0x1401b7964
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [r10 + rcx]
inc rcx
xor r9, rax
imul r9, r11
cmp rcx, r8
jb 0x1401b7950
mov r8, rdx
lea rcx, [rbx + 0x358]
lea rdx, [rsp + 0x20]
call fcn.140125c20
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401b7988
mov rax, qword [rbx + 0x360]
cmp rax, qword [rbx + 0x360]
je 0x1401b79a0
mov rax, qword [rax + 0x30]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401b79b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [rcx + 0x180]
xor esi, esi
mov word [rsp + 0x44], si
mov rbp, rcx
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x3c], rax
mov dword [rsp + 0x28], reloc.WS2_32.dll_gethostbyname
call qword [sym.imp.KERNEL32.dll_GetTickCount]
movzx ecx, byte [rsp + 0x28]
movabs rdx, 0x100000001b3
mov dword [rsp + 0x38], eax
movabs rax, 0xcbf29ce484222325
xor rcx, rax
mov qword [rsp + 0x48], rsi
movzx eax, byte [rsp + 0x29]
imul rcx, rdx
mov qword [rsp + 0x50], rsi
xor rcx, rax
movzx eax, byte [rsp + 0x2a]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rsp + 0x2b]
imul rcx, rdx
xor rcx, rax
mov rax, qword [rbp + 0x48]
imul rcx, rdx
mov rdx, qword [rbp + 0x38]
and rcx, qword [rbp + 0x60]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rdx
je 0x1401b7a83
mov rcx, qword [rax + rcx*8]
mov eax, dword [rsp + 0x28]
cmp eax, dword [rbx + 0x10]
je 0x1401b7a86
cmp rbx, rcx
je 0x1401b7a83
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1401b7a73
jmp 0x1401b7a86
mov rbx, rsi
test rbx, rbx
mov qword [rsp + 0x88], rdi
cmove rbx, rdx
cmp rbx, rdx
je 0x1401b7ae0
mov rdi, qword [rbx + 0x18]
cmp rdi, qword [rbx + 0x20]
je 0x1401b7ae0
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rdi + 0x38]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x1401b7b95
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
test al, al
je 0x1401b7ae0
add rdi, 0x40
cmp rdi, qword [rbx + 0x20]
jne 0x1401b7ab0
mov rcx, qword [rbp + 0x60]
movabs rax, 0xecf582caa5b1b50e
mov rdx, qword [rbp + 0x48]
and rcx, rax
mov r8, qword [rbp + 0x38]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, r8
je 0x1401b7b22
cmp dword [rax + 0x10], 0xb
mov rdx, qword [rdx + rcx*8]
je 0x1401b7b1f
cmp rax, rdx
je 0x1401b7b22
mov rax, qword [rax + 8]
cmp dword [rax + 0x10], 0xb
jne 0x1401b7b10
mov rsi, rax
test rsi, rsi
je 0x1401b7b6c
cmp rsi, r8
je 0x1401b7b6c
mov rbx, qword [rsi + 0x18]
cmp rbx, qword [rsi + 0x20]
je 0x1401b7b6c
nop word [rax + rax]
mov rcx, qword [rbx + 0x38]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x1401b7b9c
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + reloc.SinoSPE.dll_Ordinal_16]
test al, al
je 0x1401b7b6c
add rbx, 0x40
cmp rbx, qword [rsi + 0x20]
jne 0x1401b7b40
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1403ca460
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop rsi
ret
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
Function at 0x1401bbc40
Capabilities:
Hash data using fnv

Disassembly:
cmp qword [rcx + 0x2f0], 0
je 0x1401bbc52
lea rax, [rcx + 0x2c0]
ret
add rcx, 0x3c0
xor edx, edx
jmp fcn.140225780

Function at 0x1401bbd90
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov eax, edx
mov r9d, edx
mov rdi, rcx
shr eax, 8
mov ecx, edx
movzx eax, al
shr ecx, 0x10
mov rbx, r8
mov r8d, edx
mov dword [rsp + 0x30], r9d
movzx edx, dl
movabs r10, 0xcbf29ce484222325
xor rdx, r10
shr r8d, 0x18
movabs r10, 0x100000001b3
imul rdx, r10
xor rdx, rax
movzx eax, cl
mov rcx, qword [rdi + 0x430]
imul rdx, r10
xor rdx, rax
imul rdx, r10
xor rdx, r8
imul rdx, r10
and rcx, rdx
mov rdx, qword [rdi + 0x408]
shl rcx, 4
add rcx, qword [rdi + 0x418]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1401bbe41
mov rcx, qword [rcx]
cmp r9d, dword [rax + 0x10]
je 0x1401bbe43
nop
cmp rax, rcx
je 0x1401bbe41
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
jne 0x1401bbe30
jmp 0x1401bbe43
xor eax, eax
test rax, rax
je 0x1401bbe96
cmp rax, rdx
je 0x1401bbe96
cmp qword [rbx + 0x18], 7
mov rcx, rbx
jbe 0x1401bbe5a
mov rcx, qword [rbx]
cmp qword [rax + 0x30], 7
lea r8, [rax + 0x18]
jbe 0x1401bbe69
mov r8, qword [rax + 0x18]
mov rdx, qword [rax + 0x28]
cmp rdx, qword [rbx + 0x10]
jne 0x1401bbe96
test rdx, rdx
je 0x1401bbed9
sub r8, rcx
nop dword [rax + rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x1401bbe96
add rcx, 2
sub rdx, 1
jne 0x1401bbe80
jmp 0x1401bbed9
lea rcx, [rdi + 0x400]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
call fcn.1401c4f40
mov rcx, qword [rax]
add rcx, 0x18
cmp rcx, rbx
je 0x1401bbece
cmp qword [rbx + 0x18], 7
mov rdx, rbx
jbe 0x1401bbec5
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
call fcn.1400050d0
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x60]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1403ca460
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1401bd230
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [rcx + 0x16d], 0
jne 0x1401bd24d
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x1401bd24d
mov rdx, rcx
mov rcx, rax
jmp fcn.1401b74b0
ret

Function at 0x1401bdff0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx eax, word [rsp + 0x90]
mov rbx, rcx
movss xmm0, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
xor edx, edx
mov qword [rsp + 0x28], rcx
mov word [rsp + 0x3c], ax
mov rax, qword [rsp + 0x98]
test eax, eax
movss dword [rsp + 0x50], xmm0
mov rcx, rax
mov qword [rsp + 0x40], r8
sete dl
mov qword [rsp + 0x48], r9
shr rcx, 0x20
cmp edx, ecx
jne 0x1401be063
mov rax, qword [rbx + 0x30]
mov rcx, qword [rax + 0x180]
mov qword [rsp + 0x34], rcx
jmp 0x1401be068
mov qword [rsp + 0x34], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x238]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1403ca460
add rsp, 0x60
pop rbx
ret
Function at 0x1401c4f40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x1401c4fc7
mov rbx, r15
mov rbp, r15
jmp 0x1401c500a
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x1401c4fe1
cmp rbx, rcx
je 0x1401c5004
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x1401c4fd3
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0x492492492492492
cmp qword [rsi + 0x10], rax
jne 0x1401c5028
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, Ordinal_60
call fcn.1403ca490
mov rdi, rax
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rdi + 0x10], eax
xorps xmm0, xmm0
movups xmmword [rdi + 0x18], xmm0
xor r13d, r13d
mov qword [rdi + 0x28], r13
mov qword [rdi + 0x30], 7
mov word [rdi + 0x18], r13w
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401c507e
cvtsi2ss xmm0, rcx
jmp 0x1401c5093
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401c50a6
cvtsi2ss xmm1, rcx
jmp 0x1401c50bb
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x1401c5115
mov rcx, rsi
call fcn.1401c5470
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
je 0x1401c5108
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x1401c5105
mov rbx, rax
cmp rax, rdx
je 0x1401c5149
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x1401c50f4
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x1401c5150
mov qword [rcx + rax*8], rdi
jmp 0x1401c5162
mov qword [rsp + 0x20], rax
jmp 0x1401c510d
cmp r8, rbp
jne 0x1401c515b
mov qword [rcx + rax*8], rdi
jmp 0x1401c5167
cmp qword [rcx + rax*8 + 8], rdx
jne 0x1401c5167
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x1401c4fe9
Function at 0x1401c5540
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x1401c5575
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140005630
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1401c56b6
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1401c5630
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1401c56a5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1401c566d
mov r10, qword [rdx]
cmp r10, rax
je 0x1401c5667
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1401c56a5
cmp r9, rdx
je 0x1401c5681
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1401c56c7
cmp r9, rdx
jne 0x1401c5672
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1401c55e0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1401c56a5
Function at 0x1401ca820
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1401ca8e9
cmp dword [rax + 8], 0
je 0x1401ca8e9
mov r9, qword [rdx]
movabs rax, 0xcbf29ce484222325
mov r8, qword [rcx + 0x18]
movabs rcx, 0x100000001b3
movzx edx, byte [r9]
mov r10, qword [r8 + 0xe0]
xor rdx, rax
movzx eax, byte [r9 + 1]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r9 + 2]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r9 + 3]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + 0x108]
and rcx, rdx
mov rdx, qword [r8 + 0xf0]
shl rcx, 4
add rdx, rcx
mov rcx, qword [rdx + 8]
cmp rcx, r10
je 0x1401ca8c8
mov eax, dword [r9]
mov rdx, qword [rdx]
cmp eax, dword [rcx + 0x10]
je 0x1401ca8ca
cmp rcx, rdx
je 0x1401ca8c8
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x1401ca8b8
jmp 0x1401ca8ca
xor ecx, ecx
test rcx, rcx
cmove rcx, r10
cmp rcx, r10
je 0x1401ca8e2
add rcx, 0x18
mov rdx, r9
call fcn.1401ba4a0
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret