joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026a00
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rdx]
mov rsi, r8
mov rbx, rcx
mov r9d, 0x1505
movzx eax, word [r10]
test ax, ax
je 0x140026a47
nop word [rax + rax]
imul r9, r9, 0x21
movzx eax, ax
lea r10, [r10 + 2]
add r9, rax
movzx eax, word [r10]
test ax, ax
jne 0x140026a30
mov r8, rdx
add rcx, 8
lea rdx, [rsp + 0x20]
call fcn.140027e10
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140026a65
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x10], rcx
jne 0x140026a80
mov eax, 0x490
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x18]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov qword [rsi], rcx
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140026ee0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 0x10]
mov rsi, rdx
mov r8d, 0x1505
mov r9, qword [rbx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x140026f27
nop dword [rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x140026f10
mov rdx, qword [rcx + 0x38]
and rdx, r8
shl rdx, 4
add rdx, qword [rcx + 0x20]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x140026f5b
cmp rax, rbx
jne 0x140026f51
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140026f66
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140026f66
cmp rax, rbx
jne 0x140026f66
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
dec qword [rcx + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.140028f40
mov edx, 0x20
mov rcx, rbx
call fcn.140071e50
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140026fb0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rsi, [rcx + 8]
mov ebx, 0x1505
mov rcx, qword [rdx]
movzx eax, word [rcx]
test ax, ax
je 0x140026ff6
nop dword [rax + rax]
imul rbx, rbx, 0x21
movzx eax, ax
lea rcx, [rcx + 2]
add rbx, rax
movzx eax, word [rcx]
test ax, ax
jne 0x140026fe0
mov r8, rdx
mov r9, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140027e10
xor ebp, ebp
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x140027089
mov rcx, qword [rsi + 0x30]
mov rdx, qword [rsi + 0x18]
and rcx, rbx
shl rcx, 4
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14002704b
cmp rax, rdi
jne 0x140027041
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140027056
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x140027056
cmp rax, rdi
jne 0x140027056
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
dec qword [rsi + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdx, [rdi + 0x10]
call fcn.140028f40
mov edx, 0x20
mov rcx, rdi
call fcn.140071e50
mov ecx, 1
jmp 0x14002708c
mov rcx, rbp
mov rbx, qword [rsp + 0x40]
test rcx, rcx
mov rsi, qword [rsp + 0x50]
mov eax, 0x490
cmovne eax, ebp
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400270b0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rdx]
mov rsi, r8
mov rbx, rcx
mov r9d, 0x1505
movzx eax, word [r10]
test ax, ax
je 0x1400270f7
nop word [rax + rax]
imul r9, r9, 0x21
movzx eax, ax
lea r10, [r10 + 2]
add r9, rax
movzx eax, word [r10]
test ax, ax
jne 0x1400270e0
mov r8, rdx
add rcx, 8
lea rdx, [rsp + 0x20]
call fcn.140027e10
mov rdx, qword [rax + 8]
test rdx, rdx
jne 0x140027115
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x10], rdx
jne 0x140027130
mov eax, 0x490
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
add rdx, 0x18
mov rcx, rsi
call fcn.14001a180
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400278f0
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push r15
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov r15, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140027926
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [r15 + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x30], r12
inc ecx
shl rdi, cl
lea rcx, [r15 + 0x18]
lea rdx, [rdi + rdi]
call fcn.140027760
lea rax, [rdi - 1]
mov qword [r15 + 0x38], rdi
mov qword [r15 + 0x30], rax
mov rax, qword [r15 + 8]
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x140027ae7
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r13
lea r13, [0x140162244]
mov qword [rsp + 0x20], r14
nop
mov rbp, qword [rax + 0x10]
mov r9d, 0x1505
mov rdx, qword [rdx]
mov r8, rbp
movzx ecx, word [rbp]
test cx, cx
je 0x1400279c7
nop dword [rax]
imul r9, r9, 0x21
movzx ecx, cx
lea r8, [r8 + 2]
add r9, rcx
movzx ecx, word [r8]
test cx, cx
jne 0x1400279b0
mov r14, qword [r15 + 0x30]
and r14, r9
shl r14, 4
add r14, qword [r15 + 0x18]
mov rsi, qword [r14]
cmp rsi, rbx
jne 0x1400279ea
mov qword [r14], rax
mov qword [r14 + 8], rax
jmp 0x140027ac7
mov rcx, qword [r14 + 8]
mov r11, r13
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
mov r8, rbp
sub r11, rbp
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x140027a19
add r8, 2
test r9d, r9d
jne 0x140027a02
test r10d, r10d
jne 0x140027a4d
mov r10, qword [rcx]
cmp r10, rax
je 0x140027a47
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14 + 8], rax
jmp 0x140027ac7
mov rdi, rcx
cmp rsi, rcx
je 0x140027aa3
nop word [rax + rax]
mov rcx, qword [rcx + 8]
mov r11, r13
mov rdi, rcx
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
test rbp, rbp
mov r8, r13
cmovne r8, rbp
sub r11, r8
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x140027a99
add r8, 2
test r9d, r9d
jne 0x140027a82
test r10d, r10d
je 0x140027af9
cmp rsi, rcx
jne 0x140027a60
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov qword [rdi + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14], rax
mov rax, rdx
cmp rdx, rbx
jne 0x140027990
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop rdi
ret
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x140027ac7
Function at 0x14002a0a0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
movabs rax, 0xcbf29ce484222325
mov rcx, qword [rdx + 0x10]
mov rdi, rdx
movabs rdx, 0x100000001b3
movzx r8d, byte [rcx + 0x10]
xor r8, rax
movzx eax, byte [rcx + 0x11]
imul r8, rdx
xor r8, rax
movzx eax, byte [rcx + 0x12]
imul r8, rdx
xor r8, rax
movzx eax, byte [rcx + 0x13]
imul r8, rdx
xor r8, rax
imul r8, rdx
and r8, qword [r9 + 0x38]
shl r8, 4
add r8, qword [r9 + 0x20]
mov rax, qword [r8]
cmp qword [r8 + 8], rcx
jne 0x14002a126
cmp rax, rcx
jne 0x14002a11c
mov rax, qword [r9 + 0x10]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x14002a131
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
jmp 0x14002a131
cmp rax, rcx
jne 0x14002a131
mov rax, qword [rcx]
mov qword [r8], rax
mov rbx, qword [rcx]
mov edx, 0x18
dec qword [r9 + 0x18]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
call fcn.140071e50
mov qword [rdi + 0x10], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002a160
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r11, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
xor ebp, ebp
movzx eax, byte [rdx + 1]
mov rbx, rdx
mov rdi, qword [r11 + 0x20]
mov r9, qword [r11 + 0x10]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r11 + 0x38]
mov r10, r8
shl r10, 4
add r10, rdi
mov rcx, qword [r10 + 8]
cmp rcx, r9
je 0x14002a24c
mov eax, dword [rbx]
mov rdx, qword [r10]
cmp eax, dword [rcx + 0x10]
je 0x14002a1ee
cmp rcx, rdx
je 0x14002a24c
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x14002a1e0
test rcx, rcx
je 0x14002a24c
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r10 + 8], rcx
jne 0x14002a219
cmp rax, rcx
jne 0x14002a20f
mov qword [rdi + r8*8], r9
mov qword [r10 + 8], r9
jmp 0x14002a225
mov r9, qword [rcx + 8]
mov qword [r10 + 8], r9
jmp 0x14002a225
cmp rax, rcx
jne 0x14002a225
mov rax, qword [rcx]
mov qword [rdi + r8*8], rax
mov rdx, qword [rcx]
dec qword [r11 + 0x18]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140071e50
mov ecx, 1
jmp 0x14002a24f
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
test rcx, rcx
mov eax, 0x490
cmovne eax, ebp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a4d0
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x14002a4d0
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14002a57c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14002a50a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x14002a710
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002a54a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140071e50
mov rcx, rbx
test rbx, rbx
jne 0x14002a530
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140027d80
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14002a80e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140071e50
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x14002a81a
cmp rbx, rbp
jne 0x14002a7c0
cmp qword [rsp + 0x68], r14
jne 0x14002a7ed
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x14002a829
mov qword [r15], r12
mov rax, r12
jmp 0x14002a82c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14002a7ed
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140071e50
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14002a8c6
cmp rbx, rbp
jne 0x14002a8a0
jmp 0x14002a7ea
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14002a840
jmp 0x14002a7ed
Function at 0x14002a710
Capabilities:
Hash data using fnv

Disassembly:
add rcx, 8
jmp 0x14002a4d0
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14002a57c
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14002a50a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x14002a710
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002a54a
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.140071e50
mov rcx, rbx
test rbx, rbx
jne 0x14002a530
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140027d80
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x14002a80e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140071e50
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x14002a81a
cmp rbx, rbp
jne 0x14002a7c0
cmp qword [rsp + 0x68], r14
jne 0x14002a7ed
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x14002a829
mov qword [r15], r12
mov rax, r12
jmp 0x14002a82c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x14002a7ed
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.140071e50
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x14002a8c6
cmp rbx, rbp
jne 0x14002a8a0
jmp 0x14002a7ea
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x14002a840
jmp 0x14002a7ed
Function at 0x14002b000
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14002b038
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140027760
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x14002b187
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rbx
jne 0x14002b0f3
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x14002b176
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x14002b130
mov r10, qword [rax]
cmp r10, rcx
je 0x14002b12a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x14002b176
mov r8, rax
cmp r10, rax
je 0x14002b152
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x14002b19c
cmp r10, rax
jne 0x14002b140
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x14002b0a0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x14002b176

Function at 0x14002ea00
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x58
mov rcx, qword [rcx]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002ea54
mov dword [rsp + 0x40], eax
lea rax, [0x1401921e8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
xor eax, eax
add rsp, 0x58
ret
mov rax, qword [rsp + 0x80]
lea rcx, [0x1401921c0]
mov dword [rax], 0
mov qword [rax + 8], rcx
mov eax, dword [rsp + 0x60]
add rsp, 0x58
ret
Function at 0x14002ee80
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rcx, qword [rcx]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rbx, r9
lea rax, [rsp + 0x60]
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x28], rax
mov r9d, Ordinal_21
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x78], 4
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002eee7
mov dword [rsp + 0x40], eax
lea rax, [0x1401921e8]
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
mov rcx, qword [rbx + 8]
jmp 0x14002eef8
lea rcx, [0x1401921c0]
mov dword [rbx], 0
mov qword [rbx + 8], rcx
mov rax, qword [0x1401921c8]
cmp qword [rcx + 8], rax
jne 0x14002ef14
cmp dword [rbx], 0
jne 0x14002ef14
mov eax, dword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x14002f5d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf90]
mov eax, 0x1090
call fcn.1400a5da0
sub rsp, rax
mov rax, qword [0x140191010]
xor rax, rsp
mov qword [rbp + 0xf80], rax
mov rbx, r8
mov rdi, rdx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov qword [rcx], rdx
lea rsi, [rbp + 0xfd8]
call fcn.140004440
mov rcx, qword [rax]
or rcx, 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
mov r9, rbx
mov r8d, 0x7fe
lea rdx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov esi, 0xffffffff
test eax, eax
cmovs eax, esi
test eax, eax
js 0x14002f65c
cmp eax, 0x7fe
jb 0x14002f664
mov word [rbp + 0xf7c], r14w
mov qword [rsp + 0x70], r14
mov ecx, dword [0x1401993f8]
mov eax, dword [0x1401993fc]
test rdi, rdi
je 0x14002f733
add ecx, eax
je 0x14002f6f1
mov dword [rsp + 0x50], r14d
call fcn.1400057e0
mov qword [rsp + 0x48], rax
lock inc dword [rsp + 0x50]
mov ebx, 1
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x48]
call fcn.140005740
mov dword [rsp + 0x68], 0x20
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdi
lea rcx, str._s_start:__s
mov qword [rsp + 0x28], rcx
lea rcx, str._CScopeTrace::operator___
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rsp + 0x68]
movsx edx, r14w
mov rcx, rax
call fcn.140004bd0
jmp 0x14002f6f5
mov ebx, dword [rsp + 0x40]
test bl, 1
je 0x14002f7da
and ebx, 0xfffffffe
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x48], r14
mov eax, esi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
js 0x14002f729
call fcn.140005b50
mov eax, esi
lock xadd dword [rsp + 0x50], eax
cmp eax, 1
jns 0x14002f717
lock inc dword [rsp + 0x50]
jmp 0x14002f7da
add ecx, eax
je 0x14002f7a1
mov dword [rsp + 0x60], r14d
call fcn.1400057e0
mov qword [rsp + 0x58], rax
lock inc dword [rsp + 0x60]
mov ebx, 2
mov dword [rsp + 0x40], ebx
lea rcx, [rsp + 0x58]
call fcn.140005740
mov dword [rsp + 0x6c], 0x20
lea rcx, [rbp - 0x80]
mov qword [rsp + 0x30], rcx
lea rcx, str.start:__s
mov qword [rsp + 0x28], rcx
lea rcx, str._CScopeTrace::operator___
mov qword [rsp + 0x20], rcx
lea r9, [0x140000000]
lea r8, [rsp + 0x6c]
movsx edx, r14w
mov rcx, rax
call fcn.140004bd0
jmp 0x14002f7a5
mov ebx, dword [rsp + 0x40]
test bl, 2
je 0x14002f7da
and ebx, 0xfffffffd
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x58], r14
mov eax, esi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
js 0x14002f7d5
call fcn.140005b50
mov eax, esi
lock xadd dword [rsp + 0x60], eax
cmp eax, 1
jns 0x14002f7c3
lock inc dword [rsp + 0x60]
mov rax, qword [0x140198db8]
cmp eax, 0xffffffff
je 0x14002f805
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [0x140198db8]
cmp ecx, 0xffffffff
je 0x14002f805
inc eax
movsxd rdx, eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbp + 0xf80]
xor rcx, rsp
call fcn.140071e30
add rsp, 0x1090
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret