joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140057bc0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140057c5e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140057c5e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140057cb0
cmp rbx, rax
jne 0x140057c50
mov rax, qword [rdi]
cmp rbx, rax
je 0x140057c93
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x140057cec
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140057d1b
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x10]
dec qword [rbp + 0x10]
call fcn.140058fc0
mov edx, 0x38
mov rcx, rdi
call fcn.140061b00
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x140057dcd
cmp rax, rbx
jne 0x140057cf7
mov qword [rdx + r8*8], rdi
jmp 0x140057d1b
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140057d1b
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x140087830]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140057d3c
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140057d4d
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140057dc5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x140057d6f
lea rdx, [rdx*8]
jmp 0x140057d81
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140057d81
add rdx, rdx
mov rcx, rbp
call fcn.140050470
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x140057dc0
mov rsi, qword [rsi + 8]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.140057bc0
cmp rbx, rsi
jne 0x140057da0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140057df0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x140057e8e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140057e8e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140057ee0
cmp rbx, rax
jne 0x140057e80
mov rax, qword [rdi]
cmp rbx, rax
je 0x140057ec3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x140057ef8
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140057f27
mov rdx, rdi
mov rcx, rbp
call fcn.14005cc00
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x140057fdd
cmp rax, rbx
jne 0x140057f03
mov qword [rdx + r8*8], rdi
jmp 0x140057f27
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140057f27
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x140087830]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140057f48
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140057f59
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x140057fd5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x140057f7b
lea rdx, [rdx*8]
jmp 0x140057f8d
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x140057f8d
add rdx, rdx
mov rcx, rbp
call fcn.140050470
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x140057fd0
mov rsi, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.140057df0
cmp rbx, rsi
jne 0x140057fb0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140058000
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r9
mov rbp, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r10, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [rbp + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r8, r9
add r8, r8
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x14005809e
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14005809e
mov ecx, dword [r10]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1400580f0
cmp rbx, rax
jne 0x140058090
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400580d3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rbp + 8]
jne 0x140058108
mov qword [rdx + r8*8], rdi
mov rax, qword [rbp + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140058137
mov rdx, rdi
mov rcx, rbp
call fcn.14005cc60
mov qword [r14], rbx
mov byte [r14 + 8], 0
jmp 0x1400581ed
cmp rax, rbx
jne 0x140058113
mov qword [rdx + r8*8], rdi
jmp 0x140058137
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140058137
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rbp + 0x10]
xorps xmm0, xmm0
mov rdx, qword [rbp + 0x38]
movss xmm2, dword [0x140087830]
cvtsi2ss xmm0, rax
test rax, rax
jns 0x140058158
addss xmm0, xmm2
xorps xmm1, xmm1
cvtsi2ss xmm1, rdx
test rdx, rdx
jns 0x140058169
addss xmm1, xmm2
divss xmm0, xmm1
comiss xmm0, dword [rbp]
jbe 0x1400581e5
mov qword [rsp + 0x40], rsi
cmp rdx, 0x200
jae 0x14005818b
lea rdx, [rdx*8]
jmp 0x14005819d
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14005819d
add rdx, rdx
mov rcx, rbp
call fcn.140050470
mov rsi, qword [rbp + 8]
cmp qword [rsi], rsi
je 0x1400581e0
mov rsi, qword [rsi + 8]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
mov rcx, rbp
mov rbx, qword [rbx]
mov r9, rbx
lea r8, [rbx + 0x10]
call fcn.140058000
cmp rbx, rsi
jne 0x1400581c0
mov rsi, qword [rsp + 0x40]
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, r14
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140058580
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x38
mov qword [rcx + 0x10], rdx
lea rax, [0x140087f90]
mov qword [rcx], rax
xor r12d, r12d
lea rax, [0x140087fa0]
mov rdi, rcx
mov qword [rcx + 8], rax
mov r14, rdx
mov qword [rcx + 0x18], r12
mov qword [rcx + 0x20], r12
mov rax, qword [rdx + 0x438]
mov dword [rcx + 0x28], eax
lea rcx, [rsp + 0x80]
call fcn.140064b60
mov rdx, rdi
mov rcx, rax
call fcn.140064b50
call fcn.140064c70
lea esi, [r12 + 1]
mov rcx, qword [rax]
mov qword [rsp + 0x78], rcx
test rcx, rcx
je 0x1400585f7
mov eax, esi
lock xadd dword [rcx + 8], eax
call fcn.140065740
mov rcx, rax
lea r9, [rsp + 0x78]
lea r8, str.ThreadLocalEventBuffer
lea rdx, [rdi + 8]
call fcn.1400657d0
call sub.KERNEL32.dll_GetCurrentThreadId
lea rbx, [r14 + 8]
mov dword [rsp + 0x70], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x140058636
mov rcx, rbx
call fcn.14004b5e0
call fcn.140064c70
mov rbp, qword [rax]
test rbp, rbp
je 0x140058648
lock xadd dword [rbp + 8], esi
mov r9d, dword [rsp + 0x70]
movabs rcx, 0x100000001b3
add r14, 0x3c8
movzx edx, r9b
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x71]
imul rdx, rcx
mov r8, qword [r14 + 8]
xor rdx, rax
movzx eax, byte [rsp + 0x72]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x73]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r14 + 0x30]
and rcx, rdx
mov rdx, qword [r14 + 0x18]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [rdx + rax*8]
mov r10, qword [rdx + rcx*8]
lea r11, [rdx + rcx*8]
nop dword [rax + rax]
cmp r10, r8
jne 0x1400586ca
mov rcx, r8
jmp 0x1400586d1
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400586e1
cmp dword [rax + 0x10], r9d
je 0x1400586e4
mov rax, qword [rax]
jmp 0x1400586c0
mov rax, r8
mov rcx, r8
mov qword [rsp + 0x30], r15
cmp rax, rcx
jne 0x14005875b
mov rsi, qword [r8]
mov ecx, 0x20
mov r15, qword [rsi + 8]
call fcn.14007fdf0
mov rdx, rax
mov qword [rax], rsi
mov qword [rax + 8], r15
mov ecx, dword [rsp + 0x70]
mov dword [rax + 0x10], ecx
movabs rcx, 0x7fffffffffffffe
mov qword [rax + 0x18], r12
mov rax, qword [r14 + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400587a9
inc rax
mov rcx, r14
mov qword [r14 + 0x10], rax
mov qword [rsi + 8], rdx
mov qword [r15], rdx
lea rdx, [rsp + 0x20]
mov r9, qword [r14 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140057df0
mov rax, qword [rsp + 0x20]
jmp 0x140058760
mov qword [rsp + 0x20], rax
mov rcx, qword [rax + 0x18]
mov qword [rax + 0x18], rbp
test rcx, rcx
je 0x14005878b
lea rdx, [rcx + 8]
mov eax, 0xffffffff
lock xadd dword [rdx], eax
cmp eax, 1
jne 0x14005878b
test rdx, rdx
cmove rcx, r12
call fcn.140061110
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov r15, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x38
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x14005d350
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r11, qword [rcx + 0x18]
movabs r12, 0x100000001b3
movzx eax, byte [rdx + 1]
movabs r13, 0xcbf29ce484222325
movzx r8d, byte [rdx]
mov r14, rcx
xor r8, r13
mov r9, rdx
imul r8, r12
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, r12
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, r12
xor r8, rax
mov rax, qword [rcx + 0x30]
mov rcx, qword [rcx + 8]
imul r8, r12
and rax, r8
mov rdi, rax
add rdi, rdi
add rax, rax
mov rbx, qword [r11 + rdi*8]
mov r8, qword [r11 + rax*8]
lea r10, [r11 + rax*8]
cmp r8, rcx
jne 0x14005d3e0
mov rax, rcx
jmp 0x14005d3e7
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005d426
mov edx, dword [r9]
cmp dword [rbx + 0x10], edx
je 0x14005d3f9
mov rbx, qword [rbx]
jmp 0x14005d3d6
mov rsi, rbx
nop dword [rax]
cmp r8, rcx
jne 0x14005d40a
mov rax, rcx
jmp 0x14005d412
mov rax, qword [r11 + rdi*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14005d421
cmp edx, dword [rbx + 0x10]
jne 0x14005d421
mov rbx, qword [rbx]
jmp 0x14005d400
cmp rsi, rbx
jne 0x14005d42c
mov rsi, rcx
mov rbx, rcx
xor ebp, ebp
mov rax, rsi
cmp rsi, rbx
je 0x14005d44b
nop word [rax + rax]
mov rax, qword [rax]
inc rbp
cmp rax, rbx
jne 0x14005d440
cmp rsi, qword [rcx]
jne 0x14005d470
cmp rbx, rcx
jne 0x14005d470
lea rcx, [r14 + 8]
call fcn.14005d2c0
mov edx, 8
mov rcx, r14
call fcn.140050470
jmp 0x14005d552
cmp rsi, rbx
je 0x14005d552
nop dword [rax]
mov rdx, qword [r14 + 0x30]
mov rdi, rsi
mov rsi, qword [rsi]
movzx eax, byte [rdi + 0x11]
movzx ecx, byte [rdi + 0x10]
xor rcx, r13
imul rcx, r12
xor rcx, rax
movzx eax, byte [rdi + 0x12]
imul rcx, r12
xor rcx, rax
movzx eax, byte [rdi + 0x13]
imul rcx, r12
xor rcx, rax
imul rcx, r12
and rdx, rcx
mov rcx, qword [r14 + 0x18]
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14005d4f2
cmp rax, rdi
jne 0x14005d4e8
mov rax, qword [r14 + 8]
mov qword [rcx], rax
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14005d4fa
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14005d4fa
cmp rax, rdi
jne 0x14005d4fa
mov qword [rcx], rsi
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r14 + 0x10]
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x14005d53c
lea rdx, [r8 + 8]
mov eax, 0xffffffff
lock xadd dword [rdx], eax
cmp eax, 1
jne 0x14005d53c
xor ecx, ecx
test rdx, rdx
cmovne rcx, r8
call fcn.140061110
mov edx, 0x20
mov rcx, rdi
call fcn.140061b00
cmp rsi, rbx
jne 0x14005d480
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14005d700
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rbx, r8
mov rdx, qword [r10 + 0x18]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
mov rax, qword [r10 + 0x30]
imul r9, rcx
and rax, r9
mov rcx, rax
add rcx, rcx
add rax, rax
mov rcx, qword [rdx + rcx*8]
mov r9, qword [rdx + rax*8]
lea r10, [rdx + rax*8]
cmp r9, r8
jne 0x14005d77f
mov rax, r8
jmp 0x14005d786
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x14005d7a3
mov eax, dword [rbx]
cmp dword [rcx + 0x10], eax
je 0x14005d797
mov rcx, qword [rcx]
jmp 0x14005d775
mov qword [r11], rcx
mov rax, r11
mov rbx, qword [rsp + 8]
ret
mov qword [r11], r8
mov rax, r11
mov rbx, qword [rsp + 8]
ret

Function at 0x14005d7b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov r13, qword [r8 + 0x18]
mov rsi, r8
mov r12, qword [r8 + 0x10]
mov rbp, rcx
mov r10, r8
cmp r13, 0x10
jb 0x14005d7da
mov r10, qword [r8]
xor r9d, r9d
movabs r8, 0xcbf29ce484222325
test r12, r12
je 0x14005d814
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r9 + r10]
inc r9
xor r8, rax
imul r8, rcx
cmp r9, r12
jb 0x14005d800
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and rcx, r8
mov rax, rcx
mov qword [rsp + 0x28], rbx
add rax, rax
mov qword [rsp + 0x20], r14
mov rdi, qword [rdx + rax*8]
lea rax, [rcx + rcx]
mov rcx, qword [rdx + rax*8]
lea rax, [rax + 1]
lea rax, [rdx + rax*8]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x70], rax
cmp rcx, rbp
jne 0x14005d85b
mov rax, rbp
jmp 0x14005d861
mov rax, qword [rax]
mov rax, qword [rax]
cmp rdi, rax
je 0x14005d8de
lea rbx, [rdi + 0x10]
mov rdx, rsi
cmp r13, 0x10
jb 0x14005d876
mov rdx, qword [rsi]
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
jb 0x14005d883
mov rcx, qword [rbx]
mov r14, qword [rbx + 0x10]
cmp r14, r12
jne 0x14005d898
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005d8a7
mov rdi, qword [rdi]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
jmp 0x14005d851
cmp qword [rbx + 0x18], 0x10
jb 0x14005d8b1
mov rbx, qword [rbx]
cmp r13, 0x10
jb 0x14005d8ba
mov rsi, qword [rsi]
cmp r12, r14
jne 0x14005d8d1
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005d8d4
mov rdi, rbp
mov rax, qword [rsp + 0x68]
mov qword [rax], rdi
jmp 0x14005d8e9
mov r11, qword [rsp + 0x68]
mov rax, r11
mov qword [r11], rbp
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005fd70
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor edi, edi
mov dword [rcx], 0xffffffff
mov dword [rcx + 4], edi
mov rsi, rcx
mov ecx, dword [0x14009cb18]
mov rbp, rdx
cmp ecx, 0xffffffff
je 0x14005fdaa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14005fdaf
call fcn.14005fed0
call fcn.140060020
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
jne 0x14005fdcc
mov rcx, rbx
call fcn.14004b5e0
mov r8, qword [0x1400b1830]
lea r9, [0x1400b0030]
nop word [rax + rax]
mov eax, edi
lea rcx, [r8 + 1]
add rcx, rax
movzx edx, cl
lea rax, [rdx + rdx*2]
cmp dword [r9 + rax*8], 0
je 0x14005fe03
inc edi
cmp edi, 0x100
jl 0x14005fde0
jmp 0x14005fe25
lea rax, [rdx + rdx*2]
mov qword [0x1400b1830], rdx
mov dword [r9 + rax*8], 1
mov qword [r9 + rax*8 + 8], rbp
mov dword [rsi], edx
mov eax, dword [r9 + rax*8 + 0x10]
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [rsi]
cmp eax, 0xffffffff
jne 0x14005fe36
int3
cmp eax, 0x100
jl 0x14005fe3e
int3
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14005fed0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
mov eax, 0x1040
call fcn.1400802b0
sub rsp, rax
mov rax, qword [0x14009cb48]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov eax, dword [0x14009cb18]
mov ecx, eax
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x14005ff63
lea rcx, [rsp + 0x20]
call fcn.1400702e0
test al, al
jne 0x14005ff11
int3
mov ecx, dword [rsp + 0x20]
cmp ecx, 0xffffffff
jne 0x14005ff3e
lea rcx, [rsp + 0x20]
call fcn.1400702e0
test al, al
je 0x14005ff2f
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14005ff30
int3
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x20]
mov eax, 0xffffffff
lock cmpxchg dword [0x14009cb18], ecx
mov ecx, dword [rsp + 0x20]
cmp eax, 0xffffffff
je 0x14005ff63
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x14009cb18]
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
je 0x14005ff6e
int3
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [rsp + 0x20]
lea rdx, [rsp + 0x30]
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14007fde0
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rsp + 0x20]
mov rdx, rbx
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rax, rbx
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400801e0
add rsp, 0x1040
pop rbx
ret
Function at 0x14005ffe0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x14009cb18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140060014
movsxd rdx, dword [rbx]
mov ecx, dword [rbx + 4]
add rdx, rdx
cmp dword [rax + rdx*8 + 8], ecx
jne 0x140060014
mov rax, qword [rax + rdx*8]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400600c0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14009cb18]
cmp ecx, 0xffffffff
jne 0x1400600d6
xor al, al
add rsp, 0x28
ret
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 1
setbe al
add rsp, 0x28
ret

Function at 0x140060260
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x14009cb18]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x14006028c
test rdi, rdi
je 0x1400602a3
call fcn.14005fed0
movsxd rcx, dword [rbx]
add rcx, rcx
mov qword [rax + rcx*8], rdi
movsxd rdx, dword [rbx]
mov ecx, dword [rbx + 4]
add rdx, rdx
mov dword [rax + rdx*8 + 8], ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140065000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [r8 + 0x18]
mov r14, r8
mov rbp, qword [r8 + 0x10]
mov r12, rdx
mov rsi, rcx
mov r10, r8
cmp r13, 0x10
jb 0x140065031
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rbp, rbp
je 0x140065064
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rbp
jb 0x140065050
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
mov rsi, qword [rsi + 8]
and rax, r9
mov rbx, rax
mov qword [rsp + 0x70], rdi
add rax, rax
add rbx, rbx
mov r15, qword [rcx + rax*8]
inc rax
mov rbx, qword [rcx + rbx*8]
lea rax, [rcx + rax*8]
mov qword [rsp + 0x60], rax
cmp r15, rsi
jne 0x14006509f
mov rax, rsi
jmp 0x1400650a5
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14006514d
mov rdx, r14
cmp r13, 0x10
jb 0x1400650ba
mov rdx, qword [r14]
cmp qword [rbx + 0x28], 0x10
lea rcx, [rbx + 0x10]
jb 0x1400650c9
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
cmp r8, rbp
jne 0x1400650db
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400650e5
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x60]
jmp 0x140065095
mov r12, qword [rsp + 0x60]
mov rdi, rbx
nop dword [rax]
cmp r15, rsi
jne 0x1400650fa
mov rax, rsi
jmp 0x140065101
mov rax, qword [r12]
mov rax, qword [rax]
cmp rbx, rax
je 0x140065138
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x140065115
mov rdx, qword [rbx + 0x10]
mov rcx, r14
cmp r13, 0x10
jb 0x140065121
mov rcx, qword [r14]
cmp rbp, qword [rbx + 0x20]
jne 0x140065138
mov r8, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140065138
mov rbx, qword [rbx]
jmp 0x1400650f0
mov r12, qword [rsp + 0x68]
cmp rdi, rbx
je 0x14006514d
mov qword [r12], rdi
mov qword [r12 + 8], rbx
jmp 0x140065156
mov qword [r12], rsi
mov qword [r12 + 8], rsi
mov rdi, qword [rsp + 0x70]
mov rax, r12
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret