joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b77e3
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov ecx, dword [0x14019c150]
cmp ecx, 0xffffffff
je 0x1400b78d6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rbp - 0x10], rax
test rax, rax
je 0x1400b78d6
mov rsi, rax
mov r14, rax
add r14, 0x28
cmp qword [rax + 0x30], 0
jne 0x1400b783c
cmp qword [rsi + 0x18], 0
je 0x1400b78c7
mov r15, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x1400b78bb
mov rax, qword [rbx + 8]
mov qword [rsi + 0x18], rax
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400b7884
mov rax, qword [rcx]
call qword [rax + 8]
mov rdi, qword [rbx]
mov rax, qword [rdi]
mov rcx, rdi
xor edx, edx
call qword [rax]
call r15
mov rcx, rax
xor edx, edx
mov r8, rdi
call r12
call r15
mov rcx, rax
xor edx, edx
mov r8, rbx
call r12
jmp 0x1400b784a
mov rax, qword [rsi + 0x28]
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400b78b0
mov rdx, qword [rbx + 0x38]
test rdx, rdx
je 0x1400b78b0
call qword [rbx + 0x28]
mov rcx, r14
mov rdx, rbx
call fcn.1400b85bc
cmp qword [rsi + 0x30], 0
jne 0x1400b7894
jmp 0x1400b7831
xor ecx, ecx
call fcn.1400b7d85
mov rcx, rsi
call fcn.1400b8601
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret

Function at 0x1400b7d85
Capabilities:
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rsi, rcx
lea rcx, [0x1401b4038]
lea rdx, [0x1400b8095]
call fcn.1400b7dc2
mov ecx, dword [0x14019c150]
cmp ecx, 0xffffffff
je 0x1400b7dba
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x28
pop rsi
pop rbp
ret

Function at 0x1400b973e
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9d, 0x1505
sub rcx, rdx
je 0x1400b97c3
movabs r8, 0x400000000003
movzx eax, byte [rdx + rcx - 1]
add eax, 0xffffffd2
cmp eax, 0x2e
ja 0x1400b977a
bt r8, rax
jae 0x1400b977a
dec rcx
jne 0x1400b9760
jmp 0x1400b97c3
mov r9d, 0x1505
mov r10b, 1
xor eax, eax
movzx esi, byte [rdx + rax]
xor r11d, r11d
mov edi, esi
add edi, 0xffffffd2
cmp edi, 0x2e
ja 0x1400b97a8
bt r8, rdi
jae 0x1400b97a8
test r10b, 1
jne 0x1400b97bb
mov sil, 0x2e
mov r11b, 1
mov edi, r9d
shl edi, 5
add edi, r9d
movzx r9d, sil
add r9d, edi
mov r10d, r11d
inc rax
cmp rcx, rax
jne 0x1400b9785
mov eax, r9d
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c1ece
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp], rax
movabs r9, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + rax]
xor r9, rdx
imul r9, rcx
inc rax
cmp rax, 4
jne 0x1400c1f05
lea rbx, [rbp - 0x10]
mov rcx, rdi
mov rdx, rbx
call fcn.1400c4748
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400c1f36
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400e77c0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c45a8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rsi + rax]
xor rbx, rdx
imul rbx, rcx
inc rax
cmp rax, 4
jne 0x1400c45e0
lea rdi, [rbp - 0x20]
mov rcx, r15
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call fcn.1400c4748
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c461f
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400c46f4
movabs rax, 0x7ffffffffffffff
cmp qword [r15 + 0x10], rax
je 0x1400c4704
lea rdx, [r15 + 8]
lea rcx, [rbp - 0x10]
mov r8, rsi
call fcn.1400c47a2
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x38]
inc rcx
js 0x1400c4657
cvtsi2ss xmm0, rcx
jmp 0x1400c466c
mov rdx, rcx
shr rdx, 1
and ecx, 1
or rcx, rdx
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
test rax, rax
js 0x1400c4678
cvtsi2ss xmm1, rax
jmp 0x1400c468d
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
ucomiss xmm0, dword [r15]
jbe 0x1400c46be
mov rcx, r15
call fcn.1400c481e
mov r8, qword [rbp - 8]
add r8, 0x10
lea rdx, [rbp - 0x30]
mov rcx, r15
mov r9, rbx
call fcn.1400c4748
movups xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x20], xmm0
mov r9, qword [rbp - 8]
mov qword [rbp - 8], 0
mov r8, qword [rbp - 0x20]
mov rcx, r15
mov rdx, rbx
call fcn.14000984c
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400c46f4
mov edx, 0x20
call fcn.1400e7768
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400e8940
int3
Function at 0x1400c48c2
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400c4a43
mov r14, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea rax, [r14 + 0x18]
mov r15, qword [r14 + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, r15
call fcn.1400092e6
lea rax, [rsi - 1]
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rsi
mov rax, qword [r14 + 8]
mov r10, qword [rax]
cmp r10, r15
je 0x1400c4a36
movabs r8, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
mov rax, r10
mov r10, qword [r10]
mov ecx, send
mov rbx, r8
movzx edi, byte [rax + rcx]
xor rbx, rdi
imul rbx, rdx
inc rcx
cmp rcx, 0x14
jne 0x1400c495a
and rbx, qword [r14 + 0x30]
mov rsi, qword [r14 + 0x18]
lea r9, [rbx + rbx]
mov rcx, rbx
shl rcx, 4
lea r11, [rbx + rbx]
inc r11
mov rdi, qword [rsi + rcx]
cmp rdi, r15
je 0x1400c49fc
mov rcx, qword [rsi + r11*8]
mov ebx, dword [rax + 0x10]
cmp ebx, dword [rcx + 0x10]
jne 0x1400c49c8
mov rcx, qword [rcx]
cmp rcx, rax
je 0x1400c4a00
mov r9, qword [rax + 8]
mov qword [r9], r10
mov rdi, qword [r10 + 8]
mov qword [rdi], rcx
mov rbx, qword [rcx + 8]
mov qword [rbx], rax
mov qword [rcx + 8], rdi
mov qword [r10 + 8], r9
mov qword [rax + 8], rbx
jmp 0x1400c4a00
cmp rdi, rcx
je 0x1400c4a0f
mov rcx, qword [rcx + 8]
cmp ebx, dword [rcx + 0x10]
jne 0x1400c49c8
mov rcx, qword [rcx]
mov rbx, qword [rax + 8]
mov qword [rbx], r10
mov rdi, qword [r10 + 8]
mov qword [rdi], rcx
mov rsi, qword [rcx + 8]
mov qword [rsi], rax
mov qword [rcx + 8], rdi
mov qword [r10 + 8], rbx
mov qword [rax + 8], rsi
jmp 0x1400c4a04
mov qword [rsi + r9*8], rax
mov qword [rsi + r11*8], rax
cmp r10, r15
jne 0x1400c494c
jmp 0x1400c4a36
mov r11, qword [rax + 8]
mov qword [r11], r10
mov rbx, qword [r10 + 8]
mov qword [rbx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov qword [rdi + 8], rbx
mov qword [r10 + 8], r11
mov qword [rax + 8], rcx
mov qword [rsi + r9*8], rax
jmp 0x1400c4a04
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400e8940
int3
Function at 0x1400c4b1e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rsi + rax]
xor rbx, rdx
imul rbx, rcx
inc rax
cmp rax, 4
jne 0x1400c4b56
lea rdi, [rbp - 0x20]
mov rcx, r15
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call fcn.1400c4748
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400c4b95
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400c4c6a
movabs rax, 0x276276276276276
cmp qword [r15 + 0x10], rax
je 0x1400c4c7a
lea rdx, [r15 + 8]
lea rcx, [rbp - 0x10]
mov r8, rsi
call fcn.1400c4cbe
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x38]
inc rcx
js 0x1400c4bcd
cvtsi2ss xmm0, rcx
jmp 0x1400c4be2
mov rdx, rcx
shr rdx, 1
and ecx, 1
or rcx, rdx
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
test rax, rax
js 0x1400c4bee
cvtsi2ss xmm1, rax
jmp 0x1400c4c03
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
ucomiss xmm0, dword [r15]
jbe 0x1400c4c34
mov rcx, r15
call fcn.1400c481e
mov r8, qword [rbp - 8]
add r8, 0x10
lea rdx, [rbp - 0x30]
mov rcx, r15
mov r9, rbx
call fcn.1400c4748
movups xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp - 0x20], xmm0
mov r9, qword [rbp - 8]
mov qword [rbp - 8], 0
mov r8, qword [rbp - 0x20]
mov rcx, r15
mov rdx, rbx
call fcn.14000984c
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400c4c6a
mov edx, 0x68
call fcn.1400e7768
mov rax, r14
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400e8940
int3

Function at 0x1400c4d4a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r10, rdx
movabs rdx, 0xcbf29ce484222325
mov esi, send
movabs r8, 0x100000001b3
movzx eax, byte [r10 + rsi]
xor rdx, rax
imul rdx, r8
inc rsi
cmp rsi, 0x14
jne 0x1400c4d71
and rdx, qword [rcx + 0x30]
mov rsi, qword [rcx + 0x18]
lea r8, [rdx + rdx]
mov rax, rdx
shl rax, 4
mov r9, qword [rsi + rax]
cmp qword [rsi + r8*8 + 8], r10
je 0x1400c4db2
cmp r9, r10
jne 0x1400c4dcf
mov rax, qword [r10]
mov qword [rsi + r8*8], rax
jmp 0x1400c4dcf
add rdx, rdx
inc rdx
cmp r9, r10
je 0x1400c4dc3
mov rax, qword [r10 + 8]
jmp 0x1400c4dcb
mov rax, qword [rcx + 8]
mov qword [rsi + r8*8], rax
mov qword [rsi + rdx*8], rax
mov rsi, qword [r10]
dec qword [rcx + 0x10]
mov rax, qword [r10 + 8]
mov qword [rax], rsi
mov qword [rsi + 8], rax
mov edx, 0x68
mov rcx, r10
call fcn.1400e7768
mov rax, rsi
add rsp, 0x28
pop rsi
pop rbp
ret
Function at 0x1400c50b7
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp - 8], rax
xor esi, esi
lea rdi, [rbp - 0xc]
mov dword [rdi], esi
lea rax, [rbp - 0x10]
mov dword [rax], 4
mov r8, qword [str.BootId]
mov rdx, qword [str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
mov r9d, send
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
cmove esi, dword [rdi]
mov rcx, qword [rbp - 8]
xor rcx, rbp
call fcn.1400e77c0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400c5d7a
Capabilities:
Get common file path

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x200
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x178], 0xfffffffffffffffe
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
lea rbx, [rbp + 0x170]
mov qword [rbx], 0
call fcn.1400c5b84
movzx edx, al
shl edx, 0x11
mov rcx, rdi
xor r8d, r8d
mov r9, rbx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0x1400c5dee
mov rdx, qword [rbp + 0x170]
mov rcx, rsi
call fcn.1400179c2
mov rax, rsi
add rsp, 0x200
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
mov edi, eax
call fcn.1400c62db
mov rbx, qword [rax]
lea rsi, [rbp + 0x150]
mov rcx, rax
mov rdx, rsi
mov r8d, edi
call qword [rbx + 0x10]
test r14b, r14b
je 0x1400c5ec0
call fcn.1400c5f96
test al, al
je 0x1400c5ec0
lea rax, str.GetKnownFolder
lea rcx, [rbp + 0x130]
mov qword [rcx], rax
lea rax, [0x14013b791]
mov qword [rcx + 8], rax
lea rax, str.xplat_archonZeratul_sharedAppUtils_srcPathUtils_win.cpp
lea r9, [rbp + 0x140]
mov qword [r9], rax
lea rax, [0x14013ba9c]
mov qword [r9 + 8], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x20], 0x44
lea rdx, [0x1401b4240]
lea rcx, [rbp - 0x40]
mov r8d, 0x7ffffffe
call fcn.1400798b6
lea rcx, [rbp + 0x18]
lea rdx, str.Cant_get_path.
call fcn.14000345f
mov r8, qword [rbp + 0x160]
cmp qword [rbp + 0x168], 0x10
jb 0x1400c5eac
mov rsi, qword [rbp + 0x150]
mov rcx, rax
mov rdx, rsi
call fcn.140004e8c
lea rcx, [rbp - 0x40]
call fcn.140079988
lea rdx, str.Cant_get_path.
lea rsi, [rbp - 0x40]
lea r8, [rbp + 0x150]
mov rcx, rsi
call fcn.14001e13c
cmp qword [rbp - 0x28], 0x10
jb 0x1400c5ee5
mov rsi, qword [rbp - 0x40]
lea rdi, [rbp + 0x118]
mov rcx, rdi
mov rdx, rsi
call fcn.140002484
lea rax, vtable.std::runtime_error.0
mov qword [rdi], rax
lea rdx, [0x140153f78]
mov rcx, rdi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400c64ee
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp], rax
cmp ecx, 2
je 0x1400c6528
mov esi, 0xffffffff
cmp ecx, 1
jne 0x1400c6538
lea rsi, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsi + 4]
jmp 0x1400c6538
lea rsi, [rbp - 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [rsi + 0x20]
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400e77c0
mov eax, esi
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x1400cef48
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
mov eax, r9d
and eax, 3
mov rsi, 0xffffffffffffffff
cmp eax, 3
jne 0x1400cef87
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
mov rbx, rdx
mov r12, rcx
mov ecx, dword [rbp + 0x60]
test r9b, 4
jne 0x1400cf02f
mov edx, r9d
and edx, 1
mov edi, ecx
not edi
or edi, edx
je 0x1400cef75
cmp r8d, 7
ja 0x1400cef75
mov edx, 0xbb
bt edx, r8d
jae 0x1400cef75
movsxd r15, r8d
lea rdx, [0x140136b9c]
mov r14d, dword [rdx + r15*4]
cmp eax, 1
jne 0x1400cf047
mov eax, dword [0x1401baa68]
mov ecx, dword [0x14019ea3c]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400cf0d5
mov rcx, qword [0x1401baa60]
add rbx, rcx
dec rbx
mov rax, rbx
xor edx, edx
div rcx
sub rbx, rdx
mov rcx, r12
mov rdx, rbx
mov r8d, 0x3000
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x1400cf0cd
jmp 0x1400cef75
test r8b, 2
je 0x1400cef9a
cmp ecx, 0xffffffff
jne 0x1400cef75
jmp 0x1400cef9a
mov rsi, 0xffffffffffffffff
mov rax, 0xffffffffffffffff
test r9b, 1
jne 0x1400cf060
call sub.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle
mov r9, rbx
shr r9, 0x20
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x28], 0
mov rcx, rax
xor edx, edx
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test rax, rax
je 0x1400cef75
mov rbx, rax
lea rax, [0x140136b7c]
mov r9d, dword [rbp + 0x70]
mov r8d, dword [rbp + 0x68]
mov edx, dword [rax + r15*4]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
xor edi, edi
cmp rax, 1
sbb rdi, rdi
or rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, rdi
jmp 0x1400cef75
lea rcx, [0x1401baa68]
call fcn.1400e78b0
cmp dword [0x1401baa68], 0xffffffff
jne 0x1400ceff1
lea rcx, [0x1401baa70]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1401baa98]
mov qword [0x1401baa60], rax
lea rcx, [0x1401baa68]
call fcn.1400e7948
jmp 0x1400ceff1

Function at 0x1400cffc7
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, rcx
mov r14, qword [sym.imp.WS2_32.dll_send]
call r14
movsxd rbx, eax
mov rdi, qword [0x14019d358]
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9d, eax
call rdi
mov esi, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov dword [rax], esi
mov rax, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400d138e
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140196d40]
xor rax, rbp
mov qword [rbp], rax
movabs r9, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + rax]
xor r9, rdx
imul r9, rcx
inc rax
cmp rax, 8
jne 0x1400d13c5
lea rbx, [rbp - 0x10]
mov rcx, rdi
mov rdx, rbx
call fcn.140056274
mov rax, qword [rbx + 8]
test rax, rax
jne 0x1400d13f6
mov rax, qword [rdi + 8]
mov qword [rsi], rax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.1400e77c0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400d3c90
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov ecx, send
call fcn.1400e7770
mov r9, rax
mov rax, qword [rdi]
mov qword [r9], rax
mov rax, qword [rbx]
mov qword [r9 + 8], rax
lea rdi, [rsi + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x1400d3d3a]
xor ecx, ecx
xor edx, edx
mov qword [rbp - 8], r9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex
mov qword [rsi], rax
test rax, rax
je 0x1400d3cfe
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov dword [rdi], 0
mov ecx, 6
call fcn.1400e86c0
int3
Function at 0x1400d3fc6
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
mov r14, rdx
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [rsi + rax]
xor rbx, rdx
imul rbx, rcx
inc rax
cmp rax, 8
jne 0x1400d3ffe
lea rdi, [rbp - 0x30]
mov rcx, r15
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call fcn.140056274
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400d403d
mov qword [r14], rax
mov byte [r14 + 8], 0
jmp 0x1400d411f
movabs rax, 0x7ffffffffffffff
cmp qword [r15 + 0x10], rax
je 0x1400d412f
lea r9, [rbp - 0x40]
mov qword [r9], rsi
lea rdx, [r15 + 8]
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r8, [0x140114e98]
lea rcx, [rbp - 0x18]
call fcn.1400d4168
mov rcx, qword [r15 + 0x10]
mov rax, qword [r15 + 0x38]
inc rcx
js 0x1400d4089
cvtsi2ss xmm0, rcx
jmp 0x1400d409e
mov rdx, rcx
shr rdx, 1
and ecx, 1
or rcx, rdx
cvtsi2ss xmm0, rcx
addss xmm0, xmm0
test rax, rax
js 0x1400d40aa
cvtsi2ss xmm1, rax
jmp 0x1400d40bf
mov rcx, rax
shr rcx, 1
and eax, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
ucomiss xmm0, dword [r15]
jbe 0x1400d40f0
mov rcx, r15
call fcn.1400d41ea
mov r8, qword [rbp - 0x10]
add r8, 0x10
lea rdx, [rbp - 0x40]
mov rcx, r15
mov r9, rbx
call fcn.140056274
movups xmm0, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x30], xmm0
lea rsi, [rbp - 0x18]
mov r9, qword [rsi + 8]
mov qword [rsi + 8], 0
mov r8, qword [rbp - 0x30]
mov rcx, r15
mov rdx, rbx
call fcn.14000984c
mov qword [r14], rax
mov byte [r14 + 8], 1
mov rcx, rsi
call fcn.1400d428e
mov rax, r14
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400e8940
int3
Function at 0x1400d42ca
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x1400d444e
mov r14, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov esi, 1
shl rsi, cl
lea rax, [r14 + 0x18]
mov r15, qword [r14 + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, r15
call fcn.1400092e6
lea rax, [rsi - 1]
mov qword [r14 + 0x30], rax
mov qword [r14 + 0x38], rsi
mov rax, qword [r14 + 8]
mov r10, qword [rax]
cmp r10, r15
je 0x1400d4441
movabs r8, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
mov rax, r10
mov r10, qword [r10]
mov ecx, send
mov rbx, r8
movzx edi, byte [rax + rcx]
xor rbx, rdi
imul rbx, rdx
inc rcx
cmp rcx, 0x18
jne 0x1400d4362
and rbx, qword [r14 + 0x30]
mov rsi, qword [r14 + 0x18]
lea r9, [rbx + rbx]
mov rcx, rbx
shl rcx, 4
lea r11, [rbx + rbx]
inc r11
mov rdi, qword [rsi + rcx]
cmp rdi, r15
je 0x1400d4407
mov rcx, qword [rsi + r11*8]
mov rbx, qword [rax + 0x10]
cmp rbx, qword [rcx + 0x10]
jne 0x1400d43d2
mov rcx, qword [rcx]
cmp rcx, rax
je 0x1400d440b
mov r9, qword [rax + 8]
mov qword [r9], r10
mov rdi, qword [r10 + 8]
mov qword [rdi], rcx
mov rbx, qword [rcx + 8]
mov qword [rbx], rax
mov qword [rcx + 8], rdi
mov qword [r10 + 8], r9
mov qword [rax + 8], rbx
jmp 0x1400d440b
cmp rdi, rcx
je 0x1400d441a
mov rcx, qword [rcx + 8]
cmp rbx, qword [rcx + 0x10]
jne 0x1400d43d2
mov rcx, qword [rcx]
mov rbx, qword [rax + 8]
mov qword [rbx], r10
mov rdi, qword [r10 + 8]
mov qword [rdi], rcx
mov rsi, qword [rcx + 8]
mov qword [rsi], rax
mov qword [rcx + 8], rdi
mov qword [r10 + 8], rbx
mov qword [rax + 8], rsi
jmp 0x1400d440f
mov qword [rsi + r9*8], rax
mov qword [rsi + r11*8], rax
cmp r10, r15
jne 0x1400d4354
jmp 0x1400d4441
mov r11, qword [rax + 8]
mov qword [r11], r10
mov rbx, qword [r10 + 8]
mov qword [rbx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov qword [rdi + 8], rbx
mov qword [r10 + 8], r11
mov qword [rax + 8], rcx
mov qword [rsi + r9*8], rax
jmp 0x1400d440f
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400e8940
int3
Function at 0x1400d4594
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rbx, rdx
movabs rsi, 0xcbf29ce484222325
mov edx, send
movabs r8, 0x100000001b3
movzx edi, byte [rbx + rdx]
xor rsi, rdi
imul rsi, r8
inc rdx
cmp rdx, 0x18
jne 0x1400d45bd
and rsi, qword [rcx + 0x30]
mov rdx, qword [rcx + 0x18]
lea r8, [rsi + rsi]
mov rax, rsi
shl rax, 4
mov rdi, qword [rdx + rax]
cmp qword [rdx + r8*8 + 8], rbx
je 0x1400d45fd
cmp rdi, rbx
jne 0x1400d461b
mov rax, qword [rbx]
mov qword [rdx + r8*8], rax
jmp 0x1400d461b
lea rax, [rsi + rsi]
inc rax
cmp rdi, rbx
je 0x1400d460f
mov rdi, qword [rbx + 8]
jmp 0x1400d4617
mov rdi, qword [rcx + 8]
mov qword [rdx + r8*8], rdi
mov qword [rdx + rax*8], rdi
mov rdi, qword [rbx]
dec qword [rcx + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov qword [rdi + 8], rax
lea rcx, [rbx + 0x18]
call fcn.1400bb8e4
mov edx, 0x20
mov rcx, rbx
call fcn.1400e7768
mov rax, rdi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret