joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f5d74
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800f5da4
xor eax, eax
jmp 0x1800f5e67
mov rbp, rbx
cmp word [rax], si
je 0x1800f5dc9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800f5db0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800f5dac
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1800f5c94
movsxd r14, eax
test eax, eax
jne 0x1800f5e07
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1800f5d9d
mov rcx, r14
call fcn.1800f1f28
mov rdi, rax
test rax, rax
jne 0x1800f5e20
xor ecx, ecx
call fcn.1800eef98
jmp 0x1800f5dfc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1800f5c94
test eax, eax
jne 0x1800f5e51
mov rcx, rdi
call fcn.1800eef98
jmp 0x1800f5e5b
xor ecx, ecx
call fcn.1800eef98
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1800f5e84
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1800f5f0b
mov rsi, rbx
cmp word [rax], bp
je 0x1800f5eca
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1800f5eb4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1800f5eb0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1800f1f28
mov rdi, rax
test rax, rax
je 0x1800f5ef8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1801022b0
mov rbp, rdi
xor ecx, ecx
call fcn.1800eef98
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fb7c8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800ed954
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800ed954
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1800fb918
cmp rax, 0xffffffffffffffff
je 0x1800fb918
xor edi, edi
test rbp, rbp
jle 0x1800fb8c3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1800eef20
mov rbx, rax
test rax, rax
jne 0x1800fb850
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1800fb8b9
mov edx, 0x8000
mov ecx, r14d
call fcn.1800fb64c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800f01ec
cmp eax, 0xffffffff
je 0x1800fb899
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1800fb860
mov edx, r15d
mov ecx, r14d
call fcn.1800fb64c
jmp 0x1800fb8b9
cmp byte [rsi + 0x38], dil
je 0x1800fb8b0
cmp dword [rsi + 0x34], 5
jne 0x1800fb8b0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1800fb8b9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1800eef98
jmp 0x1800fb92c
jns 0x1800fb92c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800ed954
cmp rax, 0xffffffffffffffff
jne 0x1800fb8e4
cmp byte [rsi + 0x30], dil
je 0x1800fb92c
mov edi, dword [rsi + 0x2c]
jmp 0x1800fb92c
mov ecx, r14d
call fcn.1800f6dbc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1800fb92c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1800fb92c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1800fb925
mov eax, dword [rsi + 0x2c]
jmp 0x1800fb92a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800ed954
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1800fc830
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800fc858
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800fc858
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14002d050
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov rdx, qword [rcx]
xor r8d, r8d
mov edx, dword [rdx + 0x98]
lea rcx, [rsp + 0x20]
call fcn.1400366f0
nop
cmp byte [rsp + 0x40], 0
je 0x14002d1c4
mov rsi, qword [rsi + 8]
add rsi, 0x140
mov r8d, 0xfde9
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140045fe0
mov r8, rax
mov r9, qword [rax + 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002d0ca
mov rdx, qword [rax]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x14002d103
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r10
inc rcx
cmp rcx, r9
jb 0x14002d0f0
mov r9, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14001dc50
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14002d18a
mov rcx, qword [rsi + 0x30]
and rcx, rbx
shl rcx, 4
mov rdx, qword [rsi + 0x18]
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14002d153
cmp rax, rdi
jne 0x14002d149
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14002d15e
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x14002d15e
cmp rax, rdi
jne 0x14002d15e
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
dec qword [rsi + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rcx, [rdi + 0x10]
call fcn.14000b9a0
mov edx, 0x40
mov rcx, rdi
call fcn.140074c44
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14002d1c4
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d1be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d1f7
call fcn.140074c44
nop
cmp byte [rsp + 0x40], 0
je 0x14002d1d5
lea rcx, [rsp + 0x20]
call fcn.14000d740
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140074d60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14007b488
nop
int3
add rcx, 8
jmp 0x14002d050
Function at 0x140030a60
Capabilities:
Hash data using fnv

Disassembly:
mov rcx, qword [rcx + 8]
mov rdx, qword [rcx + 0xa0]
mov ecx, dword [rcx + 0x98]
jmp 0x140051850
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 8], ecx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov rdi, rdx
mov ebx, ecx
lea r14, [0x1400d66f0]
mov qword [rbp + 0x17], r14
mov byte [rbp + 0x1f], 0
mov rcx, r14
call fcn.1400561d0
test eax, eax
jne 0x140051a11
cmp dword [0x1400d673c], 0x7fffffff
je 0x140051a1c
mov byte [rbp + 0x1f], 1
lea r8, [0x1400d66b0]
mov qword [rbp + 0x27], r8
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rbp + 0x68]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbp + 0x69]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbp + 0x6a]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1400d66e0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1400d66c8]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1400d66b8]
cmp rax, rdx
je 0x140051930
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x140051932
nop dword [rax]
cmp rax, rcx
je 0x140051930
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x140051920
jmp 0x140051932
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400519d1
lea rdx, [rbp + 0x67]
mov rcx, r8
call fcn.140052f70
mov dword [rbp - 0x19], 1
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rax
movups xmm6, xmmword [rbp - 0x19]
movups xmmword [rbp - 1], xmm6
mov ecx, 0x18
call fcn.140074c08
test rax, rax
je 0x140051984
movups xmm0, xmmword [rbp - 9]
movups xmmword [rax], xmm0
unpckhpd xmm6, xmm6
movsd qword [rax + 0x10], xmm6
mov qword [rbp + 0x77], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14004b9f0]
xor edx, edx
xor ecx, ecx
call fcn.140087e14
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1400519ff
cmp dword [rbp - 0x11], 0
je 0x1400519f4
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.140056714
test eax, eax
jne 0x1400519f4
mov rcx, r14
mov rbx, qword [rsp + 0xb8]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r14
pop rdi
pop rbp
jmp fcn.1400561d8
mov ecx, 1
call fcn.14005644c
nop
mov dword [rbp - 0x11], 0
mov ecx, 6
call fcn.14005644c
nop
mov ecx, 5
call fcn.14005644c
int3
mov dword [0x1400d673c], 0x7ffffffe
mov ecx, 6
call fcn.14005644c
int3
Function at 0x140031050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rsi, rcx
mov rdx, qword [rcx]
xor r8d, r8d
mov edx, dword [rdx + 0x98]
lea rcx, [rsp + 0x20]
call fcn.1400366f0
nop
cmp byte [rsp + 0x40], 0
je 0x14002d1c4
mov rsi, qword [rsi + 8]
add rsi, 0x140
mov r8d, 0xfde9
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.140045fe0
mov r8, rax
mov r9, qword [rax + 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14002d0ca
mov rdx, qword [rax]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
test r9, r9
je 0x14002d103
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor rbx, rax
imul rbx, r10
inc rcx
cmp rcx, r9
jb 0x14002d0f0
mov r9, rbx
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.14001dc50
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x14002d18a
mov rcx, qword [rsi + 0x30]
and rcx, rbx
shl rcx, 4
mov rdx, qword [rsi + 0x18]
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14002d153
cmp rax, rdi
jne 0x14002d149
mov rax, qword [rsi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14002d15e
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x14002d15e
cmp rax, rdi
jne 0x14002d15e
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
dec qword [rsi + 0x10]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rcx, [rdi + 0x10]
call fcn.14000b9a0
mov edx, 0x40
mov rcx, rdi
call fcn.140074c44
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14002d1c4
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002d1be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002d1f7
call fcn.140074c44
nop
cmp byte [rsp + 0x40], 0
je 0x14002d1d5
lea rcx, [rsp + 0x20]
call fcn.14000d740
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140074d60
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14007b488
nop
int3
add rcx, 8
jmp 0x14002d050
Function at 0x14004eee0
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, eax
je 0x14004f04c
lea r10, [rsp + 0x9a]
nop word [rax + rax]
sub r10, 2
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub bx, cx
add bx, 0x30
mov word [r10], bx
mov ebx, edx
test edx, edx
jne 0x14004ef20
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x9a]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400147c0
nop
lea r8, [rsp + 0x50]
lea rdx, str.LUNA_VNR_HOOKMAN_
lea rcx, [rsp + 0x30]
call fcn.14004b230
mov rdi, rax
cmp qword [rax + 0x10], 0
jne 0x14004ef8c
xor r8d, r8d
jmp 0x14004ef99
mov r8, rdi
cmp qword [rax + 0x18], 7
jbe 0x14004ef99
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rbx, rax
mov rcx, rdi
call fcn.14000b6f0
nop
lea rax, [rbx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14004efc6
mov rcx, rbx
mov rax, qword [0x1400a7b70]
call rax
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004f004
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004efff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f073
call fcn.140074c44
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14004f050
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov r8d, 4
lea rdx, [0x1400aa278]
lea rcx, [rsp + 0x50]
call fcn.140014920
lea rcx, [rsp + 0x50]
call fcn.14004ec90
xor al, al
jmp 0x14004f052
mov al, 1
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140074d60
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rdi
ret
call fcn.14007b488
int3
Function at 0x14004f6b0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 8], ecx
push rsi
sub rsp, 0x70
mov ebx, ecx
lea rsi, [0x1400d66f0]
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x58], 0
mov rcx, rsi
call fcn.1400561d0
test eax, eax
jne 0x14004f860
cmp dword [0x1400d673c], 0x7fffffff
je 0x14004f86b
mov byte [rsp + 0x58], 1
lea r8, [0x1400d66b0]
mov qword [rsp + 0x60], r8
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rsp + 0x81]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x82]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rsp + 0x83]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1400d66e0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1400d66c8]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1400d66b8]
cmp rax, rdx
je 0x14004f790
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x14004f792
nop word [rax + rax]
cmp rax, rcx
je 0x14004f790
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x14004f780
jmp 0x14004f792
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x14004f82d
lea rdx, [rsp + 0x80]
mov rcx, r8
call fcn.140052f70
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 5
mov ecx, 0x10
call fcn.140074c08
test rax, rax
je 0x14004f7d6
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax], xmm0
mov qword [rsp + 0x88], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14004b870]
xor edx, edx
xor ecx, ecx
call fcn.140087e14
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14004f84d
cmp dword [rsp + 0x38], 0
je 0x14004f842
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140056714
test eax, eax
jne 0x14004f842
mov rcx, rsi
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
jmp fcn.1400561d8
mov ecx, 1
call fcn.14005644c
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14005644c
nop
mov ecx, 5
call fcn.14005644c
int3
mov dword [0x1400d673c], 0x7ffffffe
mov ecx, 6
call fcn.14005644c
int3
Function at 0x1400514b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rdi, rdx
mov ebx, ecx
mov qword [rsp + 0x50], rdx
call fcn.14004f080
mov ecx, ebx
call fcn.14004eee0
test al, al
je 0x140051596
mov dword [rsp + 0x58], ebx
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.14000a290
nop
mov ecx, 0x28
call fcn.140074c08
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14005152c
mov eax, dword [rsp + 0x58]
mov dword [rbx], eax
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x60]
call fcn.14000a290
jmp 0x14005152e
xor ebx, ebx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x14004b910]
xor edx, edx
xor ecx, ecx
call fcn.140087e14
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400515ca
cmp dword [rsp + 0x38], 0
je 0x1400515bf
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140056714
test eax, eax
jne 0x1400515bf
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x60]
call fcn.14000b6f0
nop
mov rcx, rdi
call fcn.14000b6f0
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140074d60
mov rbx, qword [rsp + 0xb0]
add rsp, 0x90
pop rdi
ret
mov ecx, 1
call fcn.14005644c
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call fcn.14005644c
int3
Function at 0x1400515e0
Capabilities:
Create thread
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x14c0
call fcn.1400750d0
sub rsp, rax
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rsp + 0x14b0], rax
mov r14, rdx
mov ebx, ecx
mov dword [rsp + 0x30], ebx
mov edi, ecx
shr edi, 0x18
mov esi, ecx
shr esi, 0x10
mov ebp, ecx
shr ebp, 8
xor r15d, r15d
lea r12, [0x1400d66f0]
mov qword [rsp + 0x60], r12
mov byte [rsp + 0x68], r15b
mov rcx, r12
call fcn.1400561d0
test eax, eax
jne 0x140051824
cmp dword [0x1400d673c], 0x7fffffff
je 0x14005182f
movzx r8d, bl
movzx eax, bpl
movzx ecx, sil
movzx edx, dil
mov byte [rsp + 0x68], 1
lea r10, [0x1400d66b0]
mov qword [rsp + 0x70], r10
movabs r9, 0xcbf29ce484222325
xor r8, r9
movabs r9, 0x100000001b3
imul r8, r9
xor r8, rax
imul r8, r9
xor r8, rcx
imul r8, r9
xor r8, rdx
imul r8, r9
mov rcx, qword [0x1400d66e0]
and rcx, r8
shl rcx, 4
add rcx, qword [0x1400d66c8]
mov rax, qword [rcx + 8]
mov r8, qword [0x1400d66b8]
cmp rax, r8
je 0x1400516f0
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x1400516f3
nop dword [rax + rax]
cmp rax, rcx
je 0x1400516f0
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x1400516e0
jmp 0x1400516f3
mov rax, r15
mov rdx, r8
test rax, rax
cmovne rdx, rax
cmp rdx, r8
je 0x1400517d5
lea rdx, [rsp + 0x30]
mov rcx, r10
call fcn.140052f70
mov rbx, rax
mov dword [rsp + 0x80], r15d
lea rcx, [rsp + 0x88]
mov rdx, r14
mov r8d, 0xa08
call fcn.14009e8a0
mov qword [rsp + 0xa90], rbx
lea rcx, [rsp + 0xa98]
lea rdx, [rsp + 0x80]
mov r8d, 0xa10
call fcn.14009e8a0
mov ecx, 0xa18
call fcn.140074c08
mov rbx, rax
test rax, rax
je 0x140051781
mov rcx, rax
lea rdx, [rsp + 0xa90]
mov r8d, 0xa18
call fcn.14009e8a0
jmp 0x140051784
mov rbx, r15
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rbx
lea r8, [0x14004b9a0]
xor edx, edx
xor ecx, ecx
call fcn.140087e14
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140051814
cmp dword [rsp + 0x48], 0
je 0x140051809
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140056714
test eax, eax
jne 0x140051809
mov rcx, r12
call fcn.1400561d8
mov rcx, qword [rsp + 0x14b0]
xor rcx, rsp
call fcn.140074d60
lea r11, [rsp + 0x14c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov ecx, 1
call fcn.14005644c
nop
mov dword [rsp + 0x48], r15d
mov ecx, 6
call fcn.14005644c
nop
mov ecx, 5
call fcn.14005644c
int3
mov dword [0x1400d673c], 0x7ffffffe
mov ecx, 6
call fcn.14005644c
int3
Function at 0x140051850
Capabilities:
Create thread
Hash data using fnv

Disassembly:
mov rcx, qword [rcx + 8]
mov rdx, qword [rcx + 0xa0]
mov ecx, dword [rcx + 0x98]
jmp 0x140051850
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 8], ecx
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0x90
movaps xmmword [rax - 0x28], xmm6
mov rdi, rdx
mov ebx, ecx
lea r14, [0x1400d66f0]
mov qword [rbp + 0x17], r14
mov byte [rbp + 0x1f], 0
mov rcx, r14
call fcn.1400561d0
test eax, eax
jne 0x140051a11
cmp dword [0x1400d673c], 0x7fffffff
je 0x140051a1c
mov byte [rbp + 0x1f], 1
lea r8, [0x1400d66b0]
mov qword [rbp + 0x27], r8
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rbp + 0x68]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbp + 0x69]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbp + 0x6a]
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x1400d66e0]
and rcx, rdx
shl rcx, 4
add rcx, qword [0x1400d66c8]
mov rax, qword [rcx + 8]
mov rdx, qword [0x1400d66b8]
cmp rax, rdx
je 0x140051930
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x140051932
nop dword [rax]
cmp rax, rcx
je 0x140051930
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x140051920
jmp 0x140051932
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400519d1
lea rdx, [rbp + 0x67]
mov rcx, r8
call fcn.140052f70
mov dword [rbp - 0x19], 1
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rax
movups xmm6, xmmword [rbp - 0x19]
movups xmmword [rbp - 1], xmm6
mov ecx, 0x18
call fcn.140074c08
test rax, rax
je 0x140051984
movups xmm0, xmmword [rbp - 9]
movups xmmword [rax], xmm0
unpckhpd xmm6, xmm6
movsd qword [rax + 0x10], xmm6
mov qword [rbp + 0x77], rax
lea rcx, [rbp - 0x11]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14004b9f0]
xor edx, edx
xor ecx, ecx
call fcn.140087e14
mov qword [rbp - 0x19], rax
test rax, rax
je 0x1400519ff
cmp dword [rbp - 0x11], 0
je 0x1400519f4
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.140056714
test eax, eax
jne 0x1400519f4
mov rcx, r14
mov rbx, qword [rsp + 0xb8]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r14
pop rdi
pop rbp
jmp fcn.1400561d8
mov ecx, 1
call fcn.14005644c
nop
mov dword [rbp - 0x11], 0
mov ecx, 6
call fcn.14005644c
nop
mov ecx, 5
call fcn.14005644c
int3
mov dword [0x1400d673c], 0x7ffffffe
mov ecx, 6
call fcn.14005644c
int3