joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400318b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x140224ae8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x105
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1400318e6
xor eax, eax
jmp 0x140031932
lea rcx, [rsp + 0x20]
call fcn.1401685a4
cmp word [rsp + rax*2 + 0x1e], 0x5c
je 0x140031912
lea r8, [0x14019a158]
lea rcx, [rsp + 0x20]
mov edx, 0x105
call fcn.14016aeb4
test eax, eax
jne 0x1400318e2
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x105
call fcn.14016aeb4
test eax, eax
jne 0x1400318e2
lea rcx, [rsp + 0x20]
call fcn.140022a24
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140164540
add rsp, 0x240
pop rbx
ret

Function at 0x1400341bc
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov rdi, rdx
test rcx, rcx
je 0x1400341e2
mov r8, rdx
mov rdx, qword [rbx]
call fcn.140018b54
jmp 0x140034249
cmp byte [0x14022a550], 0
jne 0x140034226
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140034216
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14022a548], rax
jmp 0x14003421d
mov rax, qword [0x14022a548]
mov byte [0x14022a550], 1
jmp 0x14003422d
mov rax, qword [0x14022a548]
mov rcx, qword [rbx]
mov rdx, rdi
test rax, rax
je 0x140034243
mov r8d, dword [rbx + 8]
xor r9d, r9d
call rax
jmp 0x140034249
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140034540
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rdx]
mov rbx, rdx
cmp dword [rcx - 0x10], 0
je 0x140034572
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140034572
lea rcx, [rdi + 0x120]
mov rdx, rbx
call fcn.140084fe4
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a45cc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r13, rcx
test r8, r8
jne 0x1400a45fd
call fcn.14002a978
mov rdi, qword [rax + 0x18]
mov r8, qword [0x14022d148]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbp, rax
test rax, rax
jne 0x1400a461c
xor eax, eax
jmp 0x1400a4668
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rsi, rax
test rax, rax
je 0x1400a4618
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov r12, rax
test rax, rax
je 0x1400a465d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, r12
mov rcx, r13
mov r8d, eax
call fcn.1400a4490
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x1400d4090
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400d40a1
xor eax, eax
jmp 0x1400d40cf
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400d4264
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400d4275
xor eax, eax
jmp 0x1400d4299
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400d42a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
jne 0x1400d42e2
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret
Function at 0x1400d43f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x1400d441f
call fcn.140013e90
int3
test rbx, rbx
jne 0x1400d442a
call fcn.140013e90
int3
test r9, r9
jne 0x1400d4435
call fcn.140013e90
int3
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x28], r9
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400d44b8
cmp dword [rsp + 0x48], 3
jne 0x1400d44b8
test eax, eax
jne 0x1400d44b8
cmp dword [rdi], eax
je 0x1400d44b8
mov ecx, dword [rdi]
call fcn.140012bd8
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400d44ac
cmp dword [rsp + 0x48], 3
jne 0x1400d44ac
test eax, eax
jne 0x1400d44ac
mov eax, 1
jmp 0x1400d44ba
mov rcx, qword [rbx]
call fcn.140012c24
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d45c4
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140141ffc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x140142025
mov rdi, qword [rdx + 0x10]
jmp 0x140142076
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x140142046
call fcn.14001c338
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x140142060
call fcn.14001c338
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x140142076
call fcn.14001c338
call fcn.14002a978
cmp qword [rax + 0x68], 0
je 0x140142090
mov rdx, rdi
mov rcx, rbp
call fcn.1401406c4
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.140141e3c
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x1401420b7
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x1401420c6
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14016d61b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140224ae8]
jne 0x14016455a
rol rcx, 0x10
test cx, 0xffff
jne 0x140164556
repz ret
ror rcx, 0x10
jmp 0x14016d574
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1402307b0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1402308a8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14016d5f9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1402307b0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14016d61b
mov rax, qword [rsp + 0x88]
mov qword [0x1402308a8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140230848], rax
mov rax, qword [0x1402308a8]
mov qword [0x140230720], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140230830], rax
mov dword [0x140230710], 0xc0000409
mov dword [0x140230714], 1
mov rax, qword [0x140224ae8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140224af0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1402307a8], eax
mov ecx, 1
call fcn.14017a0c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1401df3e8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1402307a8], 0
jne 0x14016d6a2
mov ecx, 1
call fcn.14017a0c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14017b598
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140224ae8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14016e49c
xor ebx, ebx
cmp qword [0x1402317d8], rbx
mov rdi, rax
jne 0x14017b6ab
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14017b782
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14017b782
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401e1b68]
mov rcx, rsi
mov qword [0x1402317d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x1401e1b50]
mov rcx, rsi
mov qword [0x1402317e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1402317e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1402317f8], rax
test rax, rax
je 0x14017b6a2
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1402317f0], rax
jmp 0x14017b6b2
mov rax, qword [0x1402317f0]
jmp 0x14017b6b9
mov rax, qword [0x1402317f0]
mov r11, qword [0x1402317f8]
cmp rax, rdi
je 0x14017b720
cmp r11, rdi
je 0x14017b720
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1402317f8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14017b720
test rax, rax
je 0x14017b720
call rsi
test rax, rax
je 0x14017b71a
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x14017b71a
test byte [rsp + 0x40], 1
jne 0x14017b720
bts ebp, 0x15
jmp 0x14017b760
mov rcx, qword [0x1402317e0]
cmp rcx, rdi
je 0x14017b760
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14017b760
call rax
mov rbx, rax
test rax, rax
je 0x14017b760
mov rcx, qword [0x1402317e8]
cmp rcx, rdi
je 0x14017b760
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14017b760
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1402317d8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14017b782
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x14017b784
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140164540
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14017eeb0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x14017eeda
call fcn.140165ec8
and dword [rax], 0
call fcn.140165ea8
mov ebx, 0x16
mov dword [rax], ebx
call main
mov eax, ebx
jmp 0x14017ef2a
test edx, 0xfffffff9
jne 0x14017eebd
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14017ef03
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140165ee8
call fcn.140165ea8
mov eax, dword [rax]
jmp 0x14017ef2a
test al, 0x10
jne 0x14017ef28
test al, 1
je 0x14017ef28
test bl, 2
je 0x14017ef28
call fcn.140165ec8
mov dword [rax], 5
call fcn.140165ea8
mov dword [rax], SafeArrayGetDim
jmp 0x14017eefa
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140002f70
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [fcn.140066600]
xor ebx, ebx
mov r12, rcx
mov rdi, rdx
test rdx, rdx
jle 0x140002fb2
nop
mov rsi, qword [r12 + rbx*8]
mov ecx, 1
add rbx, 1
call rbp
xor r8d, r8d
mov rcx, rax
mov rdx, rsi
call fcn.140002cf0
cmp rbx, rdi
jne 0x140002f90
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x1400681dc]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fflush

Function at 0x1400031d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rbp, rcx
mov ecx, 0xfa0
call fcn.14000bbb0
mov rdi, rax
test rax, rax
je 0x1400032b5
lea r12, [rax + 0x10]
nop dword [rax]
mov rdx, qword [rdi]
test rdx, rdx
jg 0x140003213
sub rdx, 1
xor ecx, ecx
call fcn.14000e210
mov r9, rbp
mov r8d, 0xfa0
mov edx, 1
mov rcx, r12
call sub.msvcrt.dll_fread
mov rsi, rax
cmp rax, 0xfa0
je 0x1400032f0
mov rcx, rbp
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x140003351
test rsi, rsi
js 0x140003338
mov rdx, rsi
mov rcx, rdi
call fcn.14000c2a0
mov rsi, rax
test rax, rax
je 0x140003320
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000c800
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
xor edx, edx
call fcn.14000c800
mov rbx, rax
mov rdx, 0xffffffffffffffff
xor ecx, ecx
call fcn.14000e210
mov r9, rbp
mov r8d, 0xfa0
mov edx, 1
mov ecx, 0x10
call sub.msvcrt.dll_fread
mov rsi, rax
cmp rax, 0xfa0
jne 0x140003238
jmp 0x1400032a8
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.14000c800
mov r8, qword [rdi]
mov rdx, r12
mov rbx, rax
mov rax, qword [rax]
add r8, 1
lea rcx, [rbx + rax + 0x10]
call sub.msvcrt.dll_memcpy
mov rax, qword [rdi]
add qword [rbx], rax
jmp 0x140003200
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c800
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000e070
jmp 0x140003251
mov rcx, rbp
call fcn.140002b70
nop
nop word [rax + rax]
Function at 0x140003360
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
test rdx, rdx
js 0x1400034a0
mov rcx, rsi
call fcn.14000bbb0
mov rbx, rax
test rax, rax
je 0x1400034c8
mov rdx, qword [rax]
test rdx, rdx
jle 0x140003410
test rsi, rsi
js 0x140003424
lea rcx, [rbx + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, rdi
mov rbp, rax
cmp rsi, rax
je 0x140003440
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x140003509
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x140003455
cmp rsi, rbp
jle 0x140003491
test rbp, rbp
js 0x1400034f0
mov rdx, rbp
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c2a0
sub rdx, 1
xor ecx, ecx
call fcn.14000e210
test rsi, rsi
jns 0x14000339e
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000e070
jmp 0x14000339e
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov esi, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test esi, esi
js 0x140003491
mov rcx, rdi
call fcn.1400031d0
mov rsi, rax
test rax, rax
je 0x1400034d8
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000c800
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000e070
mov rcx, rsi
call fcn.14000bbb0
mov rbx, rax
test rax, rax
jne 0x14000338d
mov rdx, 0xffffffffffffffff
jmp 0x140003414
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c800
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call fcn.14000e070
jmp 0x1400033fa
call fcn.140002b70
nop
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor ecx, ecx
call qword [fcn.140066600]
cmp rbx, rax
je 0x140003563
mov rsi, qword [0x140067160]
mov rcx, rbx
call rsi
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
mov rbp, qword [0x140067168]
call rbp
mov rcx, rbx
call rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call rbp
test rsi, rsi
jg 0x140003578
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400031d0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140003360
Function at 0x140003510
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
test rdx, rdx
js 0x1400034a0
mov rcx, rsi
call fcn.14000bbb0
mov rbx, rax
test rax, rax
je 0x1400034c8
mov rdx, qword [rax]
test rdx, rdx
jle 0x140003410
test rsi, rsi
js 0x140003424
lea rcx, [rbx + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, rdi
mov rbp, rax
cmp rsi, rax
je 0x140003440
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x140003509
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x140003455
cmp rsi, rbp
jle 0x140003491
test rbp, rbp
js 0x1400034f0
mov rdx, rbp
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c2a0
sub rdx, 1
xor ecx, ecx
call fcn.14000e210
test rsi, rsi
jns 0x14000339e
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000e070
jmp 0x14000339e
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov esi, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test esi, esi
js 0x140003491
mov rcx, rdi
call fcn.1400031d0
mov rsi, rax
test rax, rax
je 0x1400034d8
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000c800
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000e070
mov rcx, rsi
call fcn.14000bbb0
mov rbx, rax
test rax, rax
jne 0x14000338d
mov rdx, 0xffffffffffffffff
jmp 0x140003414
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c800
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call fcn.14000e070
jmp 0x1400033fa
call fcn.140002b70
nop
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor ecx, ecx
call qword [fcn.140066600]
cmp rbx, rax
je 0x140003563
mov rsi, qword [0x140067160]
mov rcx, rbx
call rsi
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
mov rbp, qword [0x140067168]
call rbp
mov rcx, rbx
call rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call rbp
test rsi, rsi
jg 0x140003578
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400031d0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140003360
Function at 0x140003ca0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x140003cbf
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x140003d70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.140066600]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
ret

Function at 0x140013ce0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
xor r13d, r13d
mov rdi, rdx
sar rdx, 0x3f
mov rbp, rcx
shr rdx, 0x3e
mov r12, rdi
lea rsi, [rdi - 1]
lea rax, [rdi + rdx]
and eax, 3
sub rax, rdx
sub r12, rax
cmp rdi, 3
jle 0x140013e50
nop dword [rax]
cmp rdi, rbx
jle 0x140013e10
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp rbx, r12
jl 0x140013d28
mov rax, rdi
xor ebx, ebx
sar rax, 0x3f
shr rax, 0x3e
lea r14, [rdi + rax]
and r14d, 3
sub r14, rax
test r14, r14
jle 0x140013dcc
lea rsi, [rdi - 1]
jmp 0x140013d95
test r15, r15
js 0x140013da2
movzx eax, byte [rbp + r15]
shl ebx, 8
or ebx, eax
test r14, r14
je 0x140013dbd
sub r14, 1
lea r15, [r12 + r14]
cmp r15, rdi
jl 0x140013d80
mov rdx, rsi
mov rcx, r15
shl ebx, 8
call fcn.14000e210
movzx eax, byte [rbp + r15]
or ebx, eax
test r14, r14
jne 0x140013d95
imul ebx, ebx, 0xcc9e2d51
rol ebx, 0xf
imul ebx, ebx, 0x1b873593
xor r13d, edi
mov eax, r13d
xor eax, ebx
mov r13d, eax
shr r13d, 0x10
xor r13d, eax
imul r13d, r13d, 0x85ebca6b
mov edx, r13d
shr edx, 0xd
xor edx, r13d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, rsi
call fcn.14000e210
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp r12, rbx
jg 0x140013d28
jmp 0x140013d5b
xor r12d, r12d
jmp 0x140013d5b
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
test rcx, rcx
je 0x140013e7b
mov rdx, qword [rcx]
test rdx, rdx
js 0x140013e90
add rbx, 0x10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140013ce0
lea rax, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, rax
call fcn.140010dc0
mov rdx, qword [rbx]
jmp 0x140013e77