joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004ace0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14004aced
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14004acfd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14004ace5
lea eax, [rcx + 1]
jmp 0x14004ad0b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14004ad1e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14004ad04
sub eax, 3
jb 0x14004ad3e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14004ad8d
sar eax, 1
movsxd rbp, eax
jb 0x14004ad74
jmp 0x14004ad4c
add ebx, ebx
jne 0x14004ad4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004ad74
inc ecx
add ebx, ebx
jne 0x14004ad5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14004ad74
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14004ad6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14004ad5c
add ecx, 2
jmp 0x14004ad79
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14004aca2
jmp 0x14004aced
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2b000
mov dl, 0x11
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14004add9
cmp rsi, rcx
jae 0x14004ade1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14004adc0
cmp al, 0x8f
ja 0x14004adc0
cmp byte [rsi - 2], 0xf
je 0x14004adc6
sub al, 0xe8
cmp al, 1
ja 0x14004adaa
cmp rsi, rcx
jae 0x14004ade1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14004adb0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14004ade1
lodsb al, byte [rsi]
jmp 0x14004adc0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x48000]
mov eax, dword [rdi]
or eax, eax
je 0x14004ae4a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x4b954]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14004adee
jns 0x14004ae23
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14004ae2d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14004ae44
mov qword [rbx], rax
add rbx, 8
jmp 0x14004ae0e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14004ae84
cmp al, 0xef
ja 0x14004ae76
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14004ae56
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14004ae65
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x23f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14004aed8
sub rsp, 0xffffffffffffff80
jmp 0x14000c540
Function at 0x140001cb0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001cfa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001cfa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001cfa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001cfa
cmp dword [rcx + 0x84], 0xe
jbe 0x140001cfa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001cfc
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140009860]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140009870]
mov dword [rax], 1
mov rax, qword [0x140009880]
mov dword [rax], 1
mov rax, qword [0x140009800]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140009850]
mov dword [0x14000c020], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x140009930]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140009910]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1400097b0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001584
Capabilities:
Get system information on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
call dbg.__main
lea rax, [rbp - 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
lea rax, str.Hardware_information:__n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x30]
mov edx, eax
lea rax, str.__OEM_ID:__u_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x10]
mov edx, eax
lea rax, str.__Number_of_processors:__u_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x2c]
mov edx, eax
lea rax, str.__Page_size:__u_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0xc]
mov edx, eax
lea rax, str.__Processor_type:__u_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x28]
mov rdx, rax
lea rax, str.__Minimum_application_address:__lx_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x20]
mov rdx, rax
lea rax, str.__Maximum_application_address:__lx_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x18]
mov rdx, rax
lea rax, str.__Active_processor_mask:__u_n
mov rcx, rax
call sym.printf
nop
add rsp, 0x50
pop rbp
ret

Function at 0x140001910
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x140001980
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x14000c0b4]
mov r12, rcx
test ebx, ebx
jle 0x140001ab0
mov rax, qword [0x14000c0b8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x1400019cc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140001a53
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x1400019b0
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x140001ad2
mov rax, qword [0x14000c0b8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x14000c0b8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001ab7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140001a4c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140001a60
add dword [0x14000c0b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x14000c0b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001a4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x1400019d7
mov rax, qword [0x14000c0b8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140002050
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x14000c120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000c100]
test rbx, rbx
je 0x1400020a4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x14000209b
test r12, r12
je 0x14000209b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140002080
lea rcx, [0x14000c120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x1400022c0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400022d8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x1400022e0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x1400022f0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x14000233c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x140002333
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x14000233e
add rax, 0x28
cmp rax, r9
jne 0x140002320
xor eax, eax
ret

Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x1400023d0
mov rdx, qword [0x140009800]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x1400023be
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400023be
cmp word [rax + 0x18], 0x20b
jne 0x1400023be
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x1400023d0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x1400023a9
add r12, 0x28
cmp r12, rsi
je 0x1400023d0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x1400023a0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x1400023e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009800]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002400
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002408
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002400
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140002455
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000244c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002400
add rax, 0x28
cmp rax, r9
jne 0x140002438
xor eax, eax
ret

Function at 0x140002460
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009800]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002480
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002488
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140002480
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400024a0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140009800]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400024c0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400024c8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400024c0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002508
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400024ff
test rcx, rcx
je 0x1400024c0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x1400024f0
xor eax, eax
ret
Function at 0x140002510
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009800]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002530
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002538
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002550
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x140009800]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002570
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002578
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002570
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002570
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400025b4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400025c8
add rax, 0x28
cmp r9, rax
jne 0x1400025a0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x1400025e0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140009800]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002602
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002610
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002602
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002602
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002602
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000265d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002670
add rdx, 0x28
cmp r10, rdx
jne 0x140002648
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000267f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x14000268f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002666
test ecx, ecx
jg 0x140002678
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140002420
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._FastFind__Starting_n
call fcn.1400021e0
lea rcx, str..FastFind64.dll
mov qword [rdi], rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x14000248c
lea rdx, str.Could_not_load_the_dll
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400021e0
lea rdx, [0x1400025a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, str.SetHWnd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SnapShot
mov rcx, rbx
mov qword [rdi + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddColor
mov rcx, rbx
mov qword [rdi + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.FFGetPixel
mov rcx, rbx
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.AddExcludedArea
mov rcx, rbx
mov qword [rdi + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GenericColorSearch
mov rcx, rbx
mov qword [rdi + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [rdi + 0x10], 0
mov qword [rdi + 0x38], rax
jne 0x140002517
lea rdx, str.Could_not_locate_SetHWnd
jmp 0x140002462
cmp qword [rdi + 0x18], 0
jne 0x14000252a
lea rdx, str.Could_not_locate_SnapShot
jmp 0x140002462
cmp qword [rdi + 0x20], 0
jne 0x14000253d
lea rdx, str.Could_not_locate_AddColor
jmp 0x140002462
cmp qword [rdi + 0x28], 0
jne 0x140002550
lea rdx, str.Could_not_locate_GetPixel
jmp 0x140002462
cmp qword [rdi + 0x30], 0
jne 0x140002563
lea rdx, str.Could_not_locate_AddExcludedArea
jmp 0x140002462
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test rax, rax
jne 0x14000257b
lea rdx, str.Could_not_locate_GenericColorSearch
jmp 0x140002469
lea rdx, str._FastFind__Started_n
call fcn.1400021e0
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400032a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov rdx, qword [rcx]
mov r8d, 0x27
lea rcx, [rsp + 0x40]
mov byte [rsp + 0x40], 0
call fcn.1400137f0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0x42c00000
call fcn.14003ae00
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0x42e00000
call fcn.14003ae00
movss xmm1, dword [0x14005ec00]
xorps xmm0, xmm0
call fcn.140019130
lea rcx, [0x1400680b8]
call fcn.140009bd0
movss xmm2, dword [0x14005eb7c]
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140005f20
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0x41a00000
call fcn.14003ae00
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], 0x42e00000
call fcn.14003ae00
movss xmm1, dword [0x14005ec00]
xorps xmm0, xmm0
call fcn.140019130
cmp byte [0x14005cb47], 0
mov rdx, qword [str.tV__USY_w_HYI]
mov qword [rsp + 0x40], rdx
je 0x1400034d1
xor r8d, r8d
cmp dword [0x140068088], 2
jl 0x14000348d
movdqa xmm2, xmmword [0x14005ec70]
lea rcx, [rsp + 0x40]
movdqa xmm4, xmmword [0x14005ed60]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14005ec90]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14005eca0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x40]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14005ed00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14005ed20]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x40], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14005eca0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x44]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005ed00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14005ed20]
xorps xmm2, xmm0
movd dword [rsp + 0x44], xmm2
call fcn.140038290
add rsp, 0x38
jmp fcn.140015a30
lea r9, [rsp + 0x40]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x51eb851f
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x1400034a0
lea rcx, [rsp + 0x40]
call fcn.140038290
add rsp, 0x38
jmp fcn.140015a30
Function at 0x140006da0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140006dd1
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140068a78]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140068a88]
lea rdx, [rdi + rdi]
call fcn.1400067a0
mov rax, qword [0x140068a78]
lea r9, [rdi - 1]
mov qword [0x140068aa0], r9
mov qword [0x140068aa8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140006f44
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140068a88]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140006e90
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140006f05
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140006ecd
mov r10, qword [rdx]
cmp r10, rax
je 0x140006ec7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140006f05
cmp r9, rdx
je 0x140006ee1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140006f19
cmp r9, rdx
jne 0x140006ed2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140006f3f
mov r9, qword [0x140068aa0]
jmp 0x140006e41
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140006f05
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret