joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1803d5220
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
cmp r9d, 8
jge 0x1803d5271
movzx r10d, dx
sub r8d, r10d
movzx eax, r8w
xor edx, edx
test r9d, r9d
jle 0x1803d549b
movsxd r8, edx
movzx r8d, word [rcx + r8*2]
sub r8d, r10d
movzx r8d, r8w
cmp r8d, eax
jle 0x1803d5265
inc edx
cmp edx, r9d
jl 0x1803d5245
jmp 0x1803d549b
mov eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
movzx r10d, dx
movd xmm0, r10d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov eax, r8d
sub eax, r10d
movzx eax, ax
movd xmm1, eax
punpcklwd xmm1, xmm1
pshufd xmm1, xmm1, 0
mov rax, rcx
add r9d, 0xfffffff8
mov edx, r9d
add rdx, rdx
lea r8, [rax + rdx]
movups xmm2, xmmword [0x180570180]
movaps xmm3, xmm1
psubw xmm3, xmm2
movups xmm4, xmmword [rax]
psubw xmm4, xmm0
movaps xmm5, xmm4
psubw xmm5, xmm2
movaps xmm6, xmm3
pcmpgtw xmm6, xmm5
pcmpeqw xmm4, xmm1
por xmm4, xmm6
movaps xmmword [rsp + 0x20], xmm4
xorps xmm5, xmm5
pcmpeqw xmm4, xmm5
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x1803d53db
add rax, 0x10
cmp rax, r8
jb 0x1803d52b8
movups xmm4, xmmword [r8]
psubw xmm4, xmm0
movaps xmm0, xmm4
psubw xmm0, xmm2
pcmpgtw xmm3, xmm0
pcmpeqw xmm1, xmm4
por xmm1, xmm3
movaps xmmword [rsp + 0x20], xmm1
xorps xmm0, xmm0
pcmpeqw xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x1803d549b
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
bsf ecx, eax
mov r8d, 0x20
test eax, eax
cmove ecx, r8d
mov eax, ecx
shr rdx, 1
add eax, edx
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
bsf r8d, edx
mov r10d, 0x20
test edx, edx
cmove r8d, r10d
sub rax, rcx
shr rax, 1
add eax, r8d
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
mov eax, 0xffffffff
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x180dd9058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.180dd91df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x180dd9089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180dd906f
add dl, dl
jne 0x180dd9096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180dd90f6
xor eax, eax
add dl, dl
jne 0x180dd90a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x180dd91ad
add dl, dl
jne 0x180dd90b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180dd90c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180dd90d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180dd90dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x180dd90ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x180dd907e
mov eax, 1
add dl, dl
jne 0x180dd9106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x180dd9113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180dd90fb
sub eax, ebx
mov ebx, 1
jne 0x180dd914c
mov ecx, 1
add dl, dl
jne 0x180dd912e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180dd913b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180dd9123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180dd907e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x180dd9168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x180dd9175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x180dd915d
cmp eax, 0x7d00
jae 0x180dd919b
cmp eax, 0x500
jb 0x180dd9196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180dd907e
cmp eax, 0x7f
ja 0x180dd919e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x180dd907e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x180dd91d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x180dd907e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x0059f800]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x0059f810]
mov dword [rax], 1
mov rax, qword [0x0059f820]
mov dword [rax], 1
mov rax, qword [0x0059f7f0]
mov dword [rax], 1
mov rax, qword [0x0059f680]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x0059f7e0]
mov dword [0x005ac00c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x0059f750]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x0059f630]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067
Function at 0x494810
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x150
mov r12, 0xffffffffffffffba
mov rax, qword [rsp + 0x1c8]
mov esi, dword [rax]
mov rdi, rdx
test esi, esi
mov edx, 3
mov r13, rcx
cmove esi, edx
mov r14, r8
mov rbx, r9
cmp rdi, r9
jb 0x49498f
mov r12, 0xffffffffffffffb8
cmp r9, 0x7f
jbe 0x49498f
mov r12, 0xffffffffffffffba
cmp rdi, 0xff
jbe 0x49498f
mov rcx, r14
mov r12d, dword [rax + 8]
xor r8d, r8d
mov rdx, r9
mov dword [rsp + 0x50], 0xec30a437
mov ebp, dword [rax + 4]
call sym.XXH64
mov rcx, rax
test r12d, r12d
je 0x4949a8
mov dword [rsp + 0x54], r12d
cmp ebp, 1
jbe 0x494910
mov r12, qword [dbg.__acrt_iob_func]
mov ecx, 2
call r12
lea r8, [0x0056863f]
lea rdx, str._r_70s_r
mov rcx, rax
call sym.fprintf
mov ecx, 2
call r12
mov rcx, rax
call sym.fflush
mov ecx, 2
call r12
mov r8d, 0x10
mov edx, 1
lea rcx, str.statistics_...__n
mov r9, rax
call sym.fwrite
mov ecx, 2
call r12
mov rcx, rax
call sym.fflush
mov eax, dword [rsp + 0x1c0]
mov dword [rsp + 0x40], ebp
mov r8d, esi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rbx
mov r9, qword [rsp + 0x1b0]
mov edx, 0xf8
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call sym.ZDICT_analyzeEntropy
mov r12, rax
cmp rax, 0xffffffffffffff88
ja 0x49498f
lea rsi, [rax + 8]
lea r12, [rbx + rsi]
cmp r12, rdi
jbe 0x49496f
mov rbx, rdi
mov r12, rdi
sub rbx, rsi
lea rcx, [r13 + rsi]
mov r8, rbx
mov rdx, r14
call sym.memmove
lea rdx, [rsp + 0x50]
mov r8, rsi
mov rcx, r13
call sym.memcpy
mov rax, r12
add rsp, 0x150
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
movabs rdx, 0x8000800080008001
mul rdx
shr rdx, 0x1e
mov rax, rdx
shl rax, 0x10
sub rax, rdx
shl rax, 0xf
sub rcx, rax
lea r12d, [rcx + 0x8000]
jmp 0x49489f
Function at 0x4faa20
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
push rdi
push rsi
push rbx
mov edi, r8d
lea rbx, [rcx + rdx]
lea eax, [r8 + 0x165667b1]
cmp rdx, 0xf
jbe 0x4faafb
lea rax, [rbx - 0x10]
lea r9d, [r8 + 0x24234428]
mov r10, rcx
lea esi, [r8 - 0x7a143589]
lea ebp, [r8 + 0x61c8864f]
nop dword [rax + rax]
imul r8d, dword [r10], 0x85ebca77
add r10, 0x10
imul r11d, dword [r10 - 4], 0x85ebca77
add r9d, r8d
imul r8d, dword [r10 - 0xc], 0x85ebca77
add r11d, ebp
rol r9d, 0xd
rol r11d, 0xd
imul r9d, r9d, 0x9e3779b1
add esi, r8d
imul r8d, dword [r10 - 8], 0x85ebca77
rol esi, 0xd
imul ebp, r11d, 0x9e3779b1
imul esi, esi, 0x9e3779b1
add r8d, edi
rol r8d, 0xd
imul edi, r8d, 0x9e3779b1
cmp rax, r10
jae 0x4faa60
lea rax, [rdx - 0x10]
lea r8, [rcx + 1]
mov r11d, ebp
and rax, 0xfffffffffffffff0
lea r10, [rbx - 0xf]
add rax, 0x10
cmp r10, r8
mov r8d, 0x10
cmovb rax, r8
rol r9d, 1
rol esi, 7
rol edi, 0xc
add rcx, rax
lea eax, [r9 + rsi]
ror r11d, 0xe
add eax, edi
add eax, r11d
lea r9, [rcx + 4]
add eax, edx
cmp rbx, r9
jb 0x4fab3d
mov r8, r9
nop dword [rax]
imul edx, dword [r8 - 4], 0xc2b2ae3d
add r8, 4
add edx, eax
ror edx, 0xf
imul eax, edx, 0x27d4eb2f
cmp rbx, r8
jae 0x4fab10
lea rdx, [rbx - 4]
sub rdx, rcx
mov rcx, rdx
and rcx, 0xfffffffffffffffc
add rcx, r9
cmp rcx, rbx
jae 0x4fabb0
movzx edx, byte [rcx]
imul edx, edx, 0x165667b1
add edx, eax
rol edx, 0xb
imul eax, edx, 0x9e3779b1
lea rdx, [rcx + 1]
cmp rbx, rdx
jbe 0x4fabb0
movzx edx, byte [rcx + 1]
imul edx, edx, 0x165667b1
add edx, eax
rol edx, 0xb
imul eax, edx, 0x9e3779b1
lea rdx, [rcx + 2]
cmp rbx, rdx
jbe 0x4fabb0
movzx edx, byte [rcx + 2]
imul edx, edx, 0x165667b1
add edx, eax
rol edx, 0xb
imul eax, edx, 0x9e3779b1
lea rdx, [rcx + 3]
cmp rbx, rdx
jbe 0x4fabb0
movzx edx, byte [rcx + 3]
imul edx, edx, 0x165667b1
add edx, eax
rol edx, 0xb
imul eax, edx, 0x9e3779b1
mov edx, eax
shr edx, 0xf
xor edx, eax
imul eax, edx, 0x85ebca77
mov edx, eax
shr edx, 0xd
xor eax, edx
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x4fabe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
movabs rax, 0x27d4eb2f165667c5
mov rsi, rdx
lea r10, [rcx + rdx]
lea rdx, [r8 + rax]
cmp rsi, 0x1f
jbe 0x4fad61
movabs r12, 0x60ea27eeadc0b5d6
lea r14, [r10 - 0x20]
mov rdi, rcx
movabs rax, 0xc2b2ae3d27d4eb4f
movabs r9, 0x61c8864e7a143579
add r12, r8
lea r13, [r8 + rax]
movabs rdx, 0x9e3779b185ebca87
lea r15, [r8 + r9]
nop dword [rax]
mov rbp, qword [rdi]
mov rbx, qword [rdi + 8]
add rdi, 0x20
mov r11, qword [rdi - 0x10]
mov r9, qword [rdi - 8]
imul rbp, rax
imul rbx, rax
imul r11, rax
imul r9, rax
add rbp, r12
add rbx, r13
rol rbp, 0x1f
add r11, r8
rol rbx, 0x1f
mov r12, rbp
add r9, r15
rol r11, 0x1f
imul r12, rdx
mov r13, rbx
rol r9, 0x1f
imul r13, rdx
mov r8, r11
mov r15, r9
imul r8, rdx
imul r15, rdx
cmp r14, rdi
jae 0x4fac48
lea rax, [rsi - 0x20]
lea rdi, [rcx + 1]
and rax, 0xffffffffffffffe0
lea r14, [r10 - 0x1f]
add rax, 0x20
cmp r14, rdi
mov edi, 0x20
cmovb rax, rdi
rol r12, 1
rol r13, 7
rol r8, 0xc
add rcx, rax
lea rdi, [r12 + r13]
rol r15, 0x12
movabs rax, 0xdef35b010f796ca9
add rdi, r8
imul rbp, rax
lea r8, [rdi + r15]
movabs rdi, 0x85ebca77c2b2ae63
imul rbx, rax
imul r11, rax
rol rbp, 0x1f
imul rax, r9
mov r15, rbp
rol rbx, 0x1f
imul r15, rdx
imul rbx, rdx
rol rax, 0x1f
imul rax, rdx
xor r8, r15
mov r15, r8
imul r15, rdx
lea r8, [r15 + rdi]
xor r8, rbx
mov rbx, r8
mov r8, r11
imul rbx, rdx
rol r8, 0x1f
imul r8, rdx
lea r11, [rbx + rdi]
xor r8, r11
imul r8, rdx
lea r9, [r8 + rdi]
xor rax, r9
imul rax, rdx
lea rdx, [rax + rdi]
lea rax, [rsi + rdx]
lea rsi, [rcx + 8]
cmp rsi, r10
ja 0x4fadc9
movabs rbx, 0xc2b2ae3d27d4eb4f
mov r8, rsi
movabs r9, 0x9e3779b185ebca87
movabs r11, 0x85ebca77c2b2ae63
nop
mov rdx, qword [r8 - 8]
add r8, 8
imul rdx, rbx
rol rdx, 0x1f
imul rdx, r9
xor rdx, rax
rol rdx, 0x1b
imul rdx, r9
lea rax, [rdx + r11]
cmp r10, r8
jae 0x4fad90
lea rdx, [r10 - 8]
sub rdx, rcx
mov rcx, rdx
and rcx, 0xfffffffffffffff8
add rcx, rsi
lea r8, [rcx + 4]
cmp r10, r8
jb 0x4fae07
mov edx, dword [rcx]
movabs rcx, 0x9e3779b185ebca87
imul rdx, rcx
mov rcx, r8
xor rdx, rax
movabs rax, 0xc2b2ae3d27d4eb4f
rol rdx, 0x17
imul rdx, rax
movabs rax, 0x165667b19e3779f9
add rax, rdx
cmp r10, rcx
jbe 0x4fae3e
movabs r9, 0x27d4eb2f165667c5
movabs r8, 0x9e3779b185ebca87
movzx edx, byte [rcx]
add rcx, 1
imul rdx, r9
xor rdx, rax
rol rdx, 0xb
mov rax, rdx
imul rax, r8
cmp r10, rcx
jne 0x4fae20
mov rdx, rax
shr rdx, 0x21
xor rdx, rax
movabs rax, 0xc2b2ae3d27d4eb4f
imul rdx, rax
mov rax, rdx
shr rax, 0x1d
xor rax, rdx
movabs rdx, 0x165667b19e3779f9
imul rax, rdx
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4fb1b0
Capabilities:
Hash data using murmur3

Disassembly:
mov r9d, dword [rcx + 0x28]
mov r8d, dword [rcx + 0x10]
mov edx, dword [rcx + 4]
lea eax, [r8 + 0x165667b1]
lea r10, [rcx + 0x18]
add r9, r10
test edx, edx
je 0x4fb1ed
mov edx, dword [rcx + 8]
mov eax, dword [rcx + 0xc]
rol r8d, 0xc
rol eax, 7
rol edx, 1
add edx, eax
lea eax, [rdx + r8]
mov r8d, dword [rcx + 0x14]
ror r8d, 0xe
add eax, r8d
add eax, dword [rcx]
lea r11, [rcx + 0x1c]
mov r8d, eax
cmp r9, r11
jb 0x4fb22e
mov rdx, r11
nop
imul eax, dword [rdx - 4], 0xc2b2ae3d
add rdx, 4
add eax, r8d
ror eax, 0xf
imul r8d, eax, 0x27d4eb2f
cmp r9, rdx
jae 0x4fb200
mov rax, r9
sub rax, rcx
lea r10, [rax - 0x1c]
and r10, 0xfffffffffffffffc
add r10, r11
cmp r9, r10
jbe 0x4fb2ad
movzx eax, byte [r10]
imul eax, eax, 0x165667b1
add eax, r8d
rol eax, 0xb
imul r8d, eax, 0x9e3779b1
lea rax, [r10 + 1]
cmp r9, rax
jbe 0x4fb2ad
movzx eax, byte [r10 + 1]
imul eax, eax, 0x165667b1
add eax, r8d
rol eax, 0xb
imul r8d, eax, 0x9e3779b1
lea rax, [r10 + 2]
cmp r9, rax
jbe 0x4fb2ad
movzx eax, byte [r10 + 2]
imul eax, eax, 0x165667b1
add eax, r8d
rol eax, 0xb
imul r8d, eax, 0x9e3779b1
lea rax, [r10 + 3]
cmp r9, rax
jbe 0x4fb2ad
movzx eax, byte [r10 + 3]
imul eax, eax, 0x165667b1
add eax, r8d
rol eax, 0xb
imul r8d, eax, 0x9e3779b1
mov eax, r8d
shr eax, 0xf
xor eax, r8d
imul eax, eax, 0x85ebca77
mov r8d, eax
shr r8d, 0xd
xor eax, r8d
imul eax, eax, 0xc2b2ae3d
mov edx, eax
shr edx, 0x10
xor eax, edx
ret
Function at 0x4fb510
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
movabs rax, 0x27d4eb2f165667c5
mov r10d, dword [rcx + 0x48]
mov r11, qword [rcx + 0x18]
mov rbx, qword [rcx]
add rax, r11
lea r9, [rcx + 0x28]
add r10, r9
cmp rbx, 0x1f
jbe 0x4fb5f1
mov rax, qword [rcx + 8]
mov r12, qword [rcx + 0x10]
movabs rdx, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
mov r8, qword [rcx + 0x20]
mov rbp, rax
mov rdi, r12
rol rax, 1
imul rbp, rdx
rol rdi, 7
add rax, rdi
imul r12, rdx
mov rdi, r11
rol rdi, 0xc
imul r11, rdx
rol rbp, 0x1f
imul rdx, r8
add rax, rdi
mov rdi, r8
imul rbp, rsi
rol rdi, 0x12
add rdi, rax
rol r11, 0x1f
movabs rax, 0x85ebca77c2b2ae63
imul r11, rsi
rol rdx, 0x1f
xor rdi, rbp
imul rdx, rsi
imul rdi, rsi
mov rbp, rdi
mov rdi, r12
rol rdi, 0x1f
imul rdi, rsi
mov r12, rdi
lea rdi, [rbp + rax]
xor rdi, r12
imul rdi, rsi
add rdi, rax
xor r11, rdi
imul r11, rsi
lea r8, [r11 + rax]
xor rdx, r8
imul rdx, rsi
add rax, rdx
lea rsi, [rcx + 0x30]
lea rdx, [rbx + rax]
cmp r10, rsi
jb 0x4fb659
movabs rbx, 0xc2b2ae3d27d4eb4f
mov r8, rsi
movabs r9, 0x9e3779b185ebca87
movabs r11, 0x85ebca77c2b2ae63
nop
mov rax, qword [r8 - 8]
add r8, 8
imul rax, rbx
rol rax, 0x1f
imul rax, r9
xor rax, rdx
rol rax, 0x1b
imul rax, r9
lea rdx, [rax + r11]
cmp r10, r8
jae 0x4fb620
mov rax, r10
sub rax, rcx
lea r9, [rax - 0x30]
and r9, 0xfffffffffffffff8
add r9, rsi
lea rcx, [r9 + 4]
cmp r10, rcx
jb 0x4fb698
movabs r8, 0x9e3779b185ebca87
mov eax, dword [r9]
mov r9, rcx
imul rax, r8
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
rol rax, 0x17
imul rax, rdx
movabs rdx, 0x165667b19e3779f9
add rdx, rax
cmp r10, r9
jbe 0x4fb6d7
movabs r8, 0x27d4eb2f165667c5
movabs rcx, 0x9e3779b185ebca87
nop dword [rax]
movzx eax, byte [r9]
add r9, 1
imul rax, r8
xor rax, rdx
rol rax, 0xb
imul rax, rcx
mov rdx, rax
cmp r10, r9
jne 0x4fb6b8
mov rax, rdx
shr rax, 0x21
xor rax, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul rax, rdx
mov rdx, rax
shr rdx, 0x1d
xor rax, rdx
movabs rdx, 0x165667b19e3779f9
imul rax, rdx
mov rdx, rax
shr rdx, 0x20
xor rax, rdx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4fd290
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbx
sub rsp, 0x20
mov r13, rcx
mov rcx, rdx
mov edx, 1
mov rbx, r8
mov r9, r13
call sym.fread
mov r12, rax
cmp rbx, rax
je 0x4fd2c3
mov rcx, r13
call sym.ferror
test eax, eax
jne 0x4fd2d0
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
ret
mov rcx, r13
call sym.checkErr__systemZio_141.part.0
nop
nop dword [rax]

Function at 0x4fdcd0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
mov r12, rcx
mov rcx, rdx
mov edx, 1
mov r9, r12
call sym.fwrite
mov rcx, r12
mov r13, rax
call sym.ferror
test eax, eax
jne 0x4fdd06
mov rax, r13
add rsp, 0x28
pop r12
pop r13
ret
mov rcx, r12
call sym.checkErr__systemZio_141.part.0
nop
nop
Function at 0x4fdd10
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, qword [dbg.__acrt_iob_func]
xor ebx, ebx
mov rbp, rcx
mov rsi, rdx
test rdx, rdx
jle 0x4fdd53
nop
mov r12, qword [rbp + rbx*8]
mov ecx, 1
add rbx, 1
call rdi
xor r8d, r8d
mov rcx, rax
mov rdx, r12
call sym.writeWindows__systemZio_205
cmp rsi, rbx
jg 0x4fdd30
mov ecx, 1
call rdi
mov r8d, 1
mov edx, 1
lea rcx, [0x0056c541]
mov r9, rax
call sym.fwrite
mov ecx, 1
call rdi
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.fflush

Function at 0x4fddf0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x20
xor r12d, r12d
mov r15, rcx
mov ecx, 0xfa0
call sym.mnewString
mov r14, rax
lea rbx, [rax + 0x10]
test rax, rax
je 0x4fdf00
nop dword [rax]
mov rdx, qword [r14]
test rdx, rdx
jg 0x4fde33
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
mov r9, r15
mov r8d, 0xfa0
mov edx, 1
mov rcx, rbx
call sym.fread
mov r13, rax
cmp rax, 0xfa0
je 0x4fdec8
mov rcx, r15
call sym.ferror
test eax, eax
jne 0x4fdf89
test r13, r13
js 0x4fdf70
mov rdx, r13
mov rcx, r14
call sym.setLengthStr
mov rbx, rax
test rax, rax
je 0x4fdf50
mov rdx, qword [rax]
mov rcx, r12
call sym.resizeString
lea rdx, [rbx + 0x10]
mov r12, rax
mov rax, qword [rax]
lea rcx, [r12 + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sym.memcpy
mov rax, qword [rbx]
add qword [r12], rax
mov rax, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, qword [r14]
mov rcx, r12
call sym.resizeString
mov r8, qword [r14]
mov rdx, rbx
mov r12, rax
mov rax, qword [rax]
add r8, 1
lea rcx, [r12 + rax + 0x10]
call sym.memcpy
mov rax, qword [r14]
add qword [r12], rax
jmp 0x4fde20
mov r12, rax
jmp 0x4fdf15
mov rcx, r12
xor edx, edx
call sym.resizeString
mov r12, rax
mov rdx, 0xffffffffffffffff
xor ecx, ecx
call sym.raiseIndexError2
mov r9, r15
mov edx, 1
mov rcx, rbx
mov r8d, 0xfa0
call sym.fread
mov r13, rax
cmp rax, 0xfa0
jne 0x4fde54
jmp 0x4fdf08
xor edx, edx
mov rcx, r12
add rsp, 0x20
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp sym.resizeString
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r13
call sym.raiseRangeErrorI
jmp 0x4fde6d
mov rcx, r15
call sym.checkErr__systemZio_141.part.0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x4fdfa0
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x20
mov r13, rcx
mov rbx, rdx
test rdx, rdx
js 0x4fe108
mov rcx, rbx
call sym.mnewString
mov r12, rax
test rax, rax
je 0x4fe0f8
mov rdx, qword [rax]
test rdx, rdx
jle 0x4fe060
test rbx, rbx
js 0x4fe074
lea rcx, [r12 + 0x10]
mov r9, r13
mov r8, rbx
mov edx, 1
call sym.fread
mov rcx, r13
mov r14, rax
cmp rbx, rax
je 0x4fe090
call sym.ferror
mov rcx, r13
test eax, eax
jne 0x4fe159
call sym.fgetc
mov rdx, r13
mov esi, eax
mov ecx, eax
call sym.ungetc
test esi, esi
jns 0x4fe0a5
cmp rbx, r14
jle 0x4fe0e2
test r14, r14
js 0x4fe140
mov rdx, r14
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp sym.setLengthStr
sub rdx, 1
xor ecx, ecx
call sym.raiseIndexError2
test rbx, rbx
jns 0x4fdfe4
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x4fdfe4
call sym.fgetc
mov rdx, r13
mov ebx, eax
mov ecx, eax
call sym.ungetc
test ebx, ebx
js 0x4fe0e2
mov rcx, r13
call sym.readAllBuffer__systemZio_421
mov rbx, rax
test rax, rax
je 0x4fe128
mov rdx, qword [rax]
mov rcx, r12
call sym.resizeString
lea rdx, [rbx + 0x10]
mov r12, rax
mov rax, qword [rax]
lea rcx, [r12 + rax + 0x10]
mov rax, qword [rbx]
lea r8, [rax + 1]
call sym.memcpy
mov rax, qword [rbx]
add qword [r12], rax
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret
mov rdx, 0xffffffffffffffff
jmp 0x4fe064
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbx
call sym.raiseRangeErrorI
jmp 0x4fdfbb
xor edx, edx
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
pop r13
pop r14
jmp sym.resizeString
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, r14
call sym.raiseRangeErrorI
jmp 0x4fe03f
call sym.checkErr__systemZio_141.part.0
nop
nop

Function at 0x4fe160
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x28
mov r12, rcx
xor ecx, ecx
call qword [dbg.__acrt_iob_func]
cmp r12, rax
je 0x4fe1b8
mov r13, qword [dbg._ftelli64]
mov rcx, r12
call r13
xor edx, edx
mov r8d, 2
mov rcx, r12
mov r14, rax
mov rbx, qword [dbg._fseeki64]
call rbx
mov rcx, r12
call r13
xor r8d, r8d
mov rdx, r14
mov rcx, r12
mov r13, rax
call rbx
test r13, r13
jg 0x4fe1d0
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
jmp sym.readAllBuffer__systemZio_421
mov rdx, r13
mov rcx, r12
add rsp, 0x28
pop rbx
pop r12
pop r13
pop r14
jmp sym.readAllFile__systemZio_434

Function at 0x4fe7f0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x28
xor r8d, r8d
mov r13, rcx
mov r12, rdx
test rdx, rdx
je 0x4fe811
mov rcx, rdx
call sym.strlen
mov r8, rax
mov rcx, r12
mov r9, r13
mov edx, 1
call sym.fwrite
mov rcx, r13
add rsp, 0x28
pop r12
pop r13
jmp sym.fflush

Function at 0x4fe880
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov ecx, 2
call qword [dbg.__acrt_iob_func]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov r12, rax
mov r9, rax
call sym.fwrite
mov rcx, r12
call sym.fflush
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop dword [rax]