joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6189c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0061e900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0061e8e0]
test rbx, rbx
je 0x618a14
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x618a0b
test r12, r12
je 0x618a0b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6189f0
lea rcx, [0x0061e900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x618c40
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x618c50
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x618c60
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x618ca5
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x618c9c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x618ca7
add rax, 0x28
cmp rax, r9
jne 0x618c88
xor eax, eax
ret

Function at 0x618d50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x0061b3b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x618dc9
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x618dc9
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x618dc6
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x618dbd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x618dc9
add r8, 0x28
cmp r8, r9
jne 0x618da8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x618eb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x0061b3b0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x618f1f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x618f1f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x618f1d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x618f14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x618f28
add rax, 0x28
cmp rax, r9
jne 0x618f00
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x618f40
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x0061b3b0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x618fb8
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x618fb8
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x618fb8
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x618fb8
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x618fac
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x618fc0
add rdx, 0x28
cmp rdx, r10
jne 0x618f98
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x618fd0
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x618fde
mov edx, dword [rax + 0xc]
test edx, edx
je 0x618fb5
test r8d, r8d
jg 0x618fc8
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r12
sub rsp, 0x20
cmp dword [0x14000e660], 0
jne 0x1400011fe
mov rax, qword gs:[0x60]
xor r12d, r12d
mov edx, r12d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000120a
nop word [rax + rax]
mov r11, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r11 + 0x88]
test ecx, ecx
je 0x14000107d
lea rdx, [r11 + rcx]
mov ecx, dword [r11 + rcx + 0xc]
mov eax, dword [rcx + r11]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000107d
mov eax, dword [rcx + r11 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x140001089
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001040
test rdx, rdx
je 0x14000120a
mov qword [rsp + 0x30], rbx
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x38], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x40], rsi
mov esi, dword [rdx + 0x20]
mov qword [rsp + 0x18], rdi
add rsi, r11
mov qword [rsp + 0x10], r13
mov r13d, 0x775a
mov qword [rsp + 8], r14
mov r14d, dword [rdx + 0x1c]
mov edx, r12d
add r14, r11
mov qword [rsp], r15
add rbp, r11
lea r15, [0x14000e660]
nop word [rax + rax]
dec ebx
mov r10d, dword [rsi + rbx*4]
add r10, r11
cmp word [r10], r13w
jne 0x140001143
mov r9d, r12d
mov r8d, 0x7dd6ee27
mov rax, r10
nop dword [rax + rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc r9d
add ecx, eax
mov eax, r9d
add rax, r10
xor r8d, ecx
cmp byte [rax], r12b
jne 0x140001100
mov ecx, edx
inc edx
add rcx, rcx
mov dword [r15 + rcx*8 + 8], r8d
movzx eax, word [rbp + rbx*2]
mov eax, dword [r14 + rax*4]
mov dword [r15 + rcx*8 + 0xc], eax
mov qword [r15 + rcx*8 + 0x10], r12
cmp edx, 0x1f4
je 0x140001147
test ebx, ebx
jne 0x1400010e0
mov r14, qword [rsp + 8]
lea eax, [rdx - 1]
mov r13, qword [rsp + 0x10]
mov r11d, r12d
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov dword [0x14000e660], edx
test eax, eax
je 0x1400011f0
nop
mov ecx, edx
mov eax, r12d
sub ecx, r11d
cmp ecx, 1
je 0x1400011e5
nop dword [rax]
lea r10d, [rax + 1]
mov r9d, eax
add r9, r9
mov r8d, r10d
add r8, r8
mov edi, dword [r15 + r9*8 + 0xc]
mov ebx, dword [r15 + r8*8 + 0xc]
cmp edi, ebx
jbe 0x1400011d6
mov edx, dword [r15 + r9*8 + 8]
mov eax, dword [r15 + r8*8 + 8]
mov rcx, qword [r15 + r9*8 + 0x10]
mov dword [r15 + r9*8 + 8], eax
mov rax, qword [r15 + r8*8 + 0x10]
mov qword [r15 + r9*8 + 0x10], rax
mov dword [r15 + r9*8 + 0xc], ebx
mov dword [r15 + r8*8 + 8], edx
mov dword [r15 + r8*8 + 0xc], edi
mov qword [r15 + r8*8 + 0x10], rcx
mov edx, dword [0x14000e660]
mov ecx, edx
mov eax, r10d
sub ecx, r11d
dec ecx
cmp r10d, ecx
jb 0x140001180
inc r11d
lea eax, [rdx - 1]
cmp r11d, eax
jb 0x140001170
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x30]
mov r15, qword [rsp]
mov eax, 1
add rsp, 0x20
pop r12
ret
xor eax, eax
add rsp, 0x20
pop r12
ret
Function at 0x140001ad0
Capabilities:
Execute syscall

Disassembly:
push rcx
pop rcx
mov qword [rsp + 8], rcx
push rdx
pop rdx
mov qword [rsp + 0x10], rdx
push r8
pop r8
mov qword [rsp + 0x18], r8
push r9
pop r9
mov qword [rsp + 0x20], r9
sub rsp, 0x30
mov ecx, 0x8f18958b
call fcn.140001220
add rsp, 0x30
push rcx
pop rcx
mov rcx, qword [rsp + 8]
push rdx
pop rdx
mov rdx, qword [rsp + 0x10]
push r8
pop r8
mov r8, qword [rsp + 0x18]
push r9
pop r9
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x140007ba0
Capabilities:
Encode data using xor

Disassembly:
shr edx, 2
xor r8d, r8d
test edx, edx
je 0x140007c76
cmp edx, 8
jb 0x140007c40
movdqa xmm4, xmmword [0x1402238c0]
mov eax, edx
and eax, 7
mov r9d, edx
sub r9d, eax
mov eax, 0x10
movd xmm3, eax
nop dword [rax]
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r8*4]
lea eax, [r8 + 4]
movdqa xmm1, xmm2
psrld xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movdqa xmm0, xmm1
pslld xmm0, xmm3
orps xmm0, xmm1
xorps xmm0, xmm2
movdqu xmmword [rcx + r8*4], xmm0
add r8d, 8
movdqu xmm2, xmmword [rcx + rax*4]
movdqa xmm1, xmm2
psrld xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movdqa xmm0, xmm1
pslld xmm0, xmm3
orps xmm0, xmm1
xorps xmm0, xmm2
movdqu xmmword [rcx + rax*4], xmm0
cmp r8d, r9d
jb 0x140007be0
cmp r8d, edx
jae 0x140007c76
sub edx, r8d
lea rax, [rcx + r8*4]
mov r9d, edx
nop word [rax + rax]
mov r8d, dword [rax]
lea rax, [rax + 4]
mov ecx, r8d
shr ecx, 0x10
xor ecx, r8d
movzx edx, cl
mov ecx, edx
shl ecx, 0x10
or ecx, edx
xor ecx, r8d
mov dword [rax - 4], ecx
sub r9, 1
jne 0x140007c50
ret
Function at 0x1400368e0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003694d
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140036916
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x1400399e0
call fcn.14003bb50
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.14003ae10
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, r8
je 0x140039b01
cmp qword [rdx + 0x28], 8
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov r13, qword [rcx + 8]
mov qword [rsp + 0x28], r14
mov r14, qword [rdx + 8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x70], r10
jb 0x140039a3b
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
add r9, r9
je 0x140039a74
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140039a60
mov r15, qword [rdi + 0x30]
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r10
mov rax, qword [r15]
mov r12, qword [r15 + 8]
mov qword [rsp + 0x68], rax
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r12
je 0x140039ac3
mov r14, rbx
cmp rbx, rbp
je 0x140039ad2
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp r14, r12
jne 0x140039aa2
mov r14, qword [rsp + 0x78]
cmp qword [rsp + 0x68], rsi
jne 0x140039b0c
mov qword [r15], r13
mov rax, r13
jmp 0x140039b0f
cmp qword [rsp + 0x68], rsi
jne 0x140039adc
mov qword [r15], rbx
mov rax, qword [rsp + 0x78]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rax, r14
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140039adc
mov r12, qword [rsp + 0x70]
nop dword [rax]
cmp qword [rbx + 0x28], 8
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jb 0x140039b35
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x140039b69
movabs r12, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r12
cmp rdx, r9
jb 0x140039b50
mov r12, qword [rsp + 0x70]
mov r15, qword [rdi + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
add r15, r12
mov r14, qword [r15 + 8]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r14
je 0x140039bb0
nop
mov rsi, rbx
cmp rbx, rbp
je 0x140039ad9
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r14
jne 0x140039b90
mov qword [r15], r13
mov qword [r15 + 8], r13
cmp rbx, rbp
jne 0x140039b20
jmp 0x140039adc
Function at 0x140036bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rbx, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140036c11
mov rdx, qword [rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140036c43
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140036c30
mov r8, rdi
lea rdx, [rsp + 0x20]
call fcn.14003d180
mov rdx, qword [0x140273f78]
mov rcx, qword [rax + 8]
test rcx, rcx
cmovne rdx, rcx
cmp rdx, qword [0x140273f78]
je 0x140036c79
add rdx, 0x30
mov rcx, rbx
call fcn.1400394a0
jmp 0x140036c92
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, rdi
call fcn.1400392d0
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140036cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [rdx + 0x18]
mov rbx, rdx
mov r8, qword [rdx + 0x10]
cmp rdi, 0x10
jb 0x140036cd3
mov rdx, qword [rdx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140036d03
movabs r10, 0x100000001b3
nop
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140036cf0
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.14003d180
mov rcx, qword [rax + 8]
mov rax, qword [0x140273f78]
test rcx, rcx
cmovne rax, rcx
cmp rax, qword [0x140273f78]
setne sil
cmp rdi, 0x10
jb 0x140036d60
mov rcx, qword [rbx]
lea rdx, [rdi + 1]
cmp rdx, 0x1000
jb 0x140036d5b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140036d87
mov rcx, r8
call fcn.14005ca98
mov qword [rbx + 0x10], 0
movzx eax, sil
mov rsi, qword [rsp + 0x48]
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call fcn.140176448
int3
Function at 0x1400378f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140037921
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14003799b
mov rdi, r14
mov rcx, rbx
call fcn.14003a090
test rax, rax
jle 0x140037973
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140171d30
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14003798b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140037993
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140037935
sub r14, rdi
jmp 0x140037a7f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400379b2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400379b4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400379e6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140171d30
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140037a7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140037a21
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140037a5d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140178e6c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140037a7c
cmp rbp, rax
ja 0x140037a30
test rbp, rbp
je 0x140037a7c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140178e6c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400399e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x14003694d
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x140036916
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x1400399e0
call fcn.14003bb50
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.14003ae10
add rsp, 0x20
pop rbx
ret
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, r8
je 0x140039b01
cmp qword [rdx + 0x28], 8
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov r13, qword [rcx + 8]
mov qword [rsp + 0x28], r14
mov r14, qword [rdx + 8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x70], r10
jb 0x140039a3b
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
add r9, r9
je 0x140039a74
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140039a60
mov r15, qword [rdi + 0x30]
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r10
mov rax, qword [r15]
mov r12, qword [r15 + 8]
mov qword [rsp + 0x68], rax
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r12
je 0x140039ac3
mov r14, rbx
cmp rbx, rbp
je 0x140039ad2
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp r14, r12
jne 0x140039aa2
mov r14, qword [rsp + 0x78]
cmp qword [rsp + 0x68], rsi
jne 0x140039b0c
mov qword [r15], r13
mov rax, r13
jmp 0x140039b0f
cmp qword [rsp + 0x68], rsi
jne 0x140039adc
mov qword [r15], rbx
mov rax, qword [rsp + 0x78]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
mov rax, r14
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140039adc
mov r12, qword [rsp + 0x70]
nop dword [rax]
cmp qword [rbx + 0x28], 8
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jb 0x140039b35
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x140039b69
movabs r12, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r12
cmp rdx, r9
jb 0x140039b50
mov r12, qword [rsp + 0x70]
mov r15, qword [rdi + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
add r15, r12
mov r14, qword [r15 + 8]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r14
je 0x140039bb0
nop
mov rsi, rbx
cmp rbx, rbp
je 0x140039ad9
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.14003c270
dec qword [rdi + 0x10]
cmp rsi, r14
jne 0x140039b90
mov qword [r15], r13
mov qword [r15 + 8], r13
cmp rbx, rbp
jne 0x140039b20
jmp 0x140039adc
Function at 0x14003bbf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, r8
mov r14, rdx
mov r8, qword [r8 + 0x10]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14003bc17
mov rdx, qword [rdi]
xor ecx, ecx
movabs rbx, 0xcbf29ce484222325
test r8, r8
je 0x14003bc45
movabs r9, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor rbx, rax
imul rbx, r9
cmp rcx, r8
jb 0x14003bc32
mov r9, rbx
lea rdx, [rsp + 0x20]
mov r8, rdi
call fcn.14003d180
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x14003bc7b
mov qword [r14], rax
mov rax, r14
mov byte [r14 + 8], 0
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
movabs rax, 0x333333333333333
cmp qword [0x140273f80], rax
je 0x14003be52
mov qword [rsp + 0x40], rbp
mov ecx, 0x50
mov qword [rsp + 0x48], rsi
call fcn.14005caa0
mov rdx, rdi
mov rsi, rax
lea rcx, [rax + 0x10]
call fcn.1400394a0
xorps xmm0, xmm0
movups xmmword [rsi + 0x30], xmm0
mov qword [rsi + 0x40], 0
mov qword [rsi + 0x48], 0xf
xorps xmm0, xmm0
mov byte [rsi + 0x30], 0
mov r9, qword [0x140273f80]
lea rcx, [r9 + 1]
test rcx, rcx
js 0x14003bcea
cvtsi2ss xmm0, rcx
jmp 0x14003bcff
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rdi, qword [0x140273fa8]
xorps xmm2, xmm2
test rdi, rdi
js 0x14003bd15
cvtsi2ss xmm2, rdi
jmp 0x14003bd2d
mov rax, rdi
mov rcx, rdi
shr rcx, 1
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movss xmm3, dword [0x140273f70]
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, xmm3
jbe 0x14003bdcd
divss xmm0, xmm3
call fcn.140188608
movss xmm1, dword [0x140223828]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x14003bd73
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x14003bd73
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rdi, rcx
jae 0x14003bda5
cmp rdi, 0x200
jae 0x14003bda2
lea rdi, [rdi*8]
cmp rdi, rcx
jae 0x14003bda5
mov rdi, rcx
mov rdx, rdi
call fcn.14003cc80
mov r9, rbx
lea r8, [rsi + 0x10]
lea rdx, [rsp + 0x20]
call fcn.14003d180
mov r9, qword [0x140273f80]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
inc r9
mov rbp, qword [rsp + 0x40]
mov r8, qword [rdx + 8]
mov qword [0x140273f80], r9
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rax, qword [0x140273fa0]
mov rcx, qword [0x140273f88]
and rax, rbx
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [0x140273f78]
jne 0x14003be1a
mov qword [rcx + rax*8], rsi
jmp 0x14003be2c
cmp r9, rdx
jne 0x14003be25
mov qword [rcx + rax*8], rsi
jmp 0x14003be31
cmp qword [rcx + rax*8 + 8], r8
jne 0x14003be31
mov qword [rcx + rax*8 + 8], rsi
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rdi, qword [rsp + 0x58]
mov qword [r14], rsi
mov rsi, qword [rsp + 0x48]
mov byte [r14 + 8], 1
add rsp, 0x30
pop r14
ret
lea rcx, str.unordered_map_set_too_long
call fcn.14016de78
int3
Function at 0x140053510
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
xor ebp, ebp
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0x40], rbp
lea ecx, [rbp + 0x18]
call fcn.14005caa0
xorps xmm0, xmm0
lea edx, [rbp + 0x10]
mov r8, rax
lea rcx, [rsp + 0x48]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rbp
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 8
mov dword [rsp + 0x30], 0x3f800000
call fcn.14003a420
mov rdi, qword [rdi + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1400535ab
nop dword [rax]
lea r8, [rbx + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14005b3a0
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140053590
mov rdi, qword [rsi + 8]
mov rbx, qword [rsi]
cmp rbx, rdi
je 0x1400535d8
cmp dword [rbx + 0x40], ebp
lea r8, [rbx + 0x40]
jl 0x1400535cf
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14005b3a0
add rbx, 0x48
cmp rbx, rdi
jne 0x1400535b7
mov r10, qword [rsp + 0x60]
mov edi, ebp
mov r9, qword [rsp + 0x48]
movabs rbx, 0xcbf29ce484222325
mov r8, qword [rsp + 0x38]
movabs r11, 0x100000001b3
mov dword [rsp + 0x80], ebp
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsp + 0x81]
movzx edx, dil
xor rdx, rbx
imul rdx, r11
xor rdx, rax
movzx eax, byte [rsp + 0x82]
imul rdx, r11
xor rdx, rax
movzx eax, byte [rsp + 0x83]
imul rdx, r11
xor rdx, rax
imul rdx, r11
and rdx, r10
add rdx, rdx
mov rcx, qword [r9 + rdx*8 + 8]
cmp rcx, r8
je 0x140053671
mov rax, qword [r9 + rdx*8]
cmp edi, dword [rcx + 0x10]
je 0x140053674
cmp rcx, rax
je 0x140053671
mov rcx, qword [rcx + 8]
cmp edi, dword [rcx + 0x10]
jne 0x140053661
jmp 0x140053674
mov rcx, rbp
test rcx, rcx
mov rax, r8
cmovne rax, rcx
cmp rax, r8
je 0x14005368e
inc edi
mov dword [rsp + 0x80], edi
jmp 0x140053610
test r9, r9
je 0x1400536db
mov rdx, qword [rsp + 0x58]
mov rax, r9
sub rdx, r9
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400536c0
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005372c
mov rcx, r9
call fcn.14005ca98
mov r8, qword [rsp + 0x38]
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x48], rbp
mov rax, qword [r8 + 8]
mov qword [rax], rbp
mov rcx, qword [r8]
test rcx, rcx
je 0x140053705
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x18
call fcn.14005ca98
mov rcx, rbx
test rbx, rbx
jne 0x1400536f0
mov rcx, qword [rsp + 0x38]
mov edx, 0x18
call fcn.14005ca98
lea r11, [rsp + 0x70]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140176448
int3