joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bb00
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
lea rcx, [rbx + 0x148]
call fcn.14001b380
lea rcx, [rbx + 0x188]
call fcn.14001b380
lea rcx, [rbx + 0x1c8]
add rsp, 0x20
pop rbx
jmp fcn.14001b380

Function at 0x14001bba0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, r8
mov r9, rdx
movabs r10, 0x100000001b3
test rbx, rbx
je 0x14001bbfc
nop dword [rax + rax]
mov eax, dword [rbx]
cmp eax, 0x3b9f9c62
je 0x14001bc04
cmp eax, 0x3b9ddf10
je 0x14001bc04
cmp eax, 0x3b9e3cd3
je 0x14001bc04
cmp eax, 0x3b9f2730
je 0x14001bc04
cmp eax, 0x3b9fc371
je 0x14001bc04
cmp eax, 0x3b9fcb40
je 0x14001bc04
cmp eax, 0x3b9fe698
je 0x14001bc04
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14001bbc0
mov al, 1
add rsp, 0x40
pop rbx
ret
mov rdx, qword [r9]
imul rdx, r10
xor rdx, rax
mov qword [r9], rdx
mov eax, dword [rbx]
cmp eax, 0x3b9f9c62
jg 0x14001bccc
je 0x14001bc8e
cmp eax, 0x3b9ddf10
je 0x14001bc6a
cmp eax, 0x3b9e3cd3
je 0x14001bc39
cmp eax, 0x3b9f2730
jne 0x14001bd78
mov eax, dword [rbx + 0x10]
imul rdx, r10
xor rax, rdx
mov qword [r9], rax
mov ecx, dword [rbx + 0x14]
imul rax, r10
xor rcx, rax
mov qword [r9], rcx
mov r8d, dword [rbx + 0x18]
imul rcx, r10
xor r8, rcx
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
mov eax, dword [rbx + 0x10]
imul rdx, r10
xor rax, rdx
mov qword [r9], rax
mov r8d, dword [rbx + 0x14]
imul rax, r10
xor r8, rax
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
mov eax, dword [rbx + 0x10]
imul rdx, r10
xor rax, rdx
mov qword [r9], rax
mov ecx, dword [rbx + 0x14]
imul rax, r10
xor rcx, rax
mov qword [r9], rcx
mov eax, dword [rbx + 0x18]
imul rcx, r10
xor rax, rcx
mov qword [r9], rax
mov r8d, dword [rbx + 0x1c]
imul rax, r10
xor r8, rax
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
cmp eax, 0x3b9fc371
je 0x14001bd47
cmp eax, 0x3b9fcb40
je 0x14001bcfc
cmp eax, 0x3b9fe698
jne 0x14001bd78
mov r8d, dword [rbx + 0x10]
imul rdx, r10
xor r8, rdx
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
mov eax, dword [rbx + 0x10]
imul rdx, r10
xor rax, rdx
mov qword [r9], rax
mov ecx, dword [rbx + 0x14]
imul rax, r10
xor rcx, rax
mov qword [r9], rcx
mov eax, dword [rbx + 0x18]
imul rcx, r10
xor rax, rcx
mov qword [r9], rax
mov ecx, dword [rbx + 0x1c]
imul rax, r10
xor rcx, rax
mov qword [r9], rcx
mov r8d, dword [rbx + 0x20]
imul rcx, r10
xor r8, rcx
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
mov eax, dword [rbx + 0x18]
imul rdx, r10
xor rax, rdx
mov qword [r9], rax
mov ecx, dword [rbx + 0x10]
imul rax, r10
xor rcx, rax
mov qword [r9], rcx
mov r8d, dword [rbx + 0x14]
imul rcx, r10
xor r8, rcx
mov qword [r9], r8
mov rbx, qword [rbx + 8]
jmp 0x14001bbb6
xor eax, eax
mov qword [rsp + 0x38], 0xf
lea rdx, [0x14014f040]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea r8d, [rax + 0x25]
call fcn.140001ad0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14001bdc0
xor al, al
add rsp, 0x40
pop rbx
ret
Function at 0x14001dca0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
lea rcx, str.application
xorps xmm0, xmm0
lea r8, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
mov r13, rdx
mov dword [rbp - 0x10], 0xb
mov esi, 0x405
lea rdx, [rbp + 0x38]
mov word [rbp - 2], si
movabs r14, 0xffff000000000000
mov rax, qword [rbp - 8]
and rax, r14
or rax, rcx
mov rcx, rdi
mov qword [rbp - 8], rax
call fcn.140015670
mov ecx, dword [rdi]
lea rbx, [0x140201b48]
mov rax, qword [rdi + 8]
movabs r15, 0xffffffffffff
and rax, r15
shl rcx, 5
add rcx, rax
mov rax, qword [rbp + 0x38]
cmp rax, rcx
je 0x14001dd3b
lea rcx, [rax + 0x10]
jmp 0x14001dd48
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [0x140201b48], xmm0
mov eax, 0x1000
test word [rcx + 0xe], ax
jne 0x14001dd5a
mov rcx, qword [rcx + 8]
and rcx, r15
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.140121044
xorps xmm0, xmm0
lea r8, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
mov word [rbp - 2], si
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 8]
mov r12, rax
and rcx, r14
mov dword [rbp - 0x10], 3
lea rax, [0x14014f2ac]
or rcx, rax
mov qword [rbp - 8], rcx
mov rcx, rdi
call fcn.140015670
mov r14d, dword [rdi]
mov rsi, qword [rdi + 8]
mov ecx, r14d
shl rcx, 5
mov rax, rsi
and rax, r15
add rcx, rax
mov rax, qword [rbp + 0x38]
cmp rax, rcx
je 0x14001ddc5
add rax, 0x10
jmp 0x14001ddd9
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [0x140201b48], xmm0
mov r14d, dword [rdi]
mov rsi, qword [rdi + 8]
mov r15d, dword [rax]
lea r8, [rbp - 0x10]
xorps xmm0, xmm0
lea rdx, [rbp + 0x38]
movups xmmword [rbp - 0x10], xmm0
mov eax, 0x405
mov dword [rbp - 0x10], 4
mov word [rbp - 2], ax
movabs rcx, 0xffff000000000000
mov rax, qword [rbp - 8]
and rax, rcx
lea rcx, str.hash
or rax, rcx
mov rcx, rdi
mov qword [rbp - 8], rax
call fcn.140015670
mov rax, qword [rbp + 0x38]
movabs rdx, 0xffffffffffff
and rsi, rdx
mov ecx, r14d
shl rcx, 5
add rcx, rsi
cmp rax, rcx
je 0x14001de48
lea rbx, [rax + 0x10]
jmp 0x14001de52
xorps xmm0, xmm0
movups xmmword [0x140201b48], xmm0
mov eax, 0x1000
test word [rbx + 0xe], ax
jne 0x14001de64
mov rbx, qword [rbx + 8]
and rbx, rdx
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.140121044
mov r10, qword [r13]
mov r8, rax
movabs r9, 0x100000001b3
mov edx, r12d
movabs rax, 0xaf63bd4c8601b7df
mov qword [rsp + 0x20], r8
xor rdx, rax
mov rcx, r12
imul rdx, r9
mov eax, r8d
shr rcx, 0x20
xor rdx, rcx
mov rcx, r13
imul rdx, r9
xor rdx, r15
imul rdx, r9
xor rdx, rax
mov rax, r8
imul rdx, r9
shr rax, 0x20
mov r9d, r15d
xor rdx, rax
mov r8, r12
call qword [r10 + 0x18]
lea r11, [rsp + 0x40]
mov al, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140025c70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rdi, r8
mov ecx, 0x1000
mov rax, rdx
test word [rdx + 0xe], cx
jne 0x140025ca4
mov rax, qword [rdx + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 0x10]
call fcn.140121044
mov rbx, rax
test rax, rax
je 0x140025e16
movabs r8, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
mov rax, rbx
imul rdx, r8
shr rax, 8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x10
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x18
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x20
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x28
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x30
imul rdx, r8
movzx ecx, al
mov rax, rbx
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [rsi + 0xb8]
imul rdx, r8
xor rdx, rax
imul rdx, r8
and rcx, rdx
mov rdx, qword [rsi + 0x90]
shl rcx, 4
add rcx, qword [rsi + 0xa0]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x140025da4
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x140025d8f
nop
cmp rax, rcx
je 0x140025da4
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x140025d80
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x140025da4
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x140025e18
mov ecx, dword [0x140203bf0]
mov rax, qword gs:[0x58]
mov edx, 8
mov rax, qword [rax + rcx*8]
cmp dword [rdx + rax], 1
jg 0x140025e04
mov r9, rbx
lea r8, str.Pipeline_layout
lea rdx, str.Referenced__s__016llx__but_it_does_not_exist._nThis_can_be_expected_when_replaying_an_archive_from_Steam._nIf_replaying_just_the_application_cache__make_sure_to_replay_together_with_the_common_cache__as_application_cache_can_depend_on_common_cache._n
mov ecx, 1
call fcn.14001c200
test al, al
jne 0x140025e04
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea r8, str.Pipeline_layout
mov r9, rbx
lea rdx, str.Fossilize_WARN:_Referenced__s__016llx__but_it_does_not_exist._nThis_can_be_expected_when_replaying_an_archive_from_Steam._nIf_replaying_just_the_application_cache__make_sure_to_replay_together_with_the_common_cache__as_application_cache_can_depend_on_common_cache._n
call fcn.1400020d0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov qword [rdi], rcx
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400348c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x140034aa3
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.140001960
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x140034a68
mov qword [rsp + 0x30], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x1400349dc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140034a57
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x140034a19
mov r10, qword [rax]
cmp r10, rcx
je 0x140034a13
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140034a57
mov r8, rax
cmp r10, rax
je 0x140034a33
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x140034a7d
cmp r10, rax
jne 0x140034a21
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x140034960
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140034a57
lea rcx, str.invalid_hash_bucket_count
call fcn.140113b58
int3
Function at 0x1400355e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov eax, dword [r9 + 0x14]
cmp rax, r8
je 0x140035610
xor al, al
jmp 0x140035781
xor ebx, ebx
mov qword [rsp + 0x88], rbx
lea r15, [rcx + 0x2e0]
mov qword [rsp + 0x20], r15
movzx ebp, byte [rsp + 0x90]
mov byte [rsp + 0x28], bpl
test bpl, bpl
je 0x140035648
mov rcx, r15
call fcn.140113e88
test eax, eax
jne 0x1400357ca
mov edx, dword [rsi + 8]
test bpl, bpl
je 0x14003570c
mov ecx, edx
call fcn.140116d48
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x88], rax
xor r8d, r8d
mov edx, dword [rsi]
mov rcx, qword [rdi + 0x18]
call fcn.140124288
test eax, eax
js 0x140035760
mov r8d, dword [rsi + 8]
mov r9, qword [rdi + 0x18]
mov edx, 1
mov rcx, r14
call fcn.140123fb0
mov edx, dword [rsi + 8]
cmp rax, rdx
jne 0x140035760
test bpl, bpl
je 0x1400356ad
mov rcx, r15
call fcn.140113eac
cmp dword [rsi + 0x10], 0
je 0x140035796
mov r8d, dword [rsi + 8]
mov rdx, r14
xor ecx, ecx
call fcn.1400425c0
cmp eax, dword [rsi + 0x10]
je 0x140035796
call fcn.14001bb80
cmp eax, 2
jg 0x14003576d
lea rdx, str.CRC_mismatch__n
mov ecx, 2
call fcn.14001c200
test al, al
jne 0x14003576d
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_CRC_mismatch__n
call fcn.1400020d0
jmp 0x14003576d
mov r14, qword [rdi + 0x2c8]
cmp qword [rdi + 0x2d0], rdx
jae 0x140035669
mov rcx, r14
call fcn.140124c08
mov r14, rax
test rax, rax
je 0x140035746
mov qword [rdi + 0x2c8], rax
mov eax, dword [rsi + 8]
mov qword [rdi + 0x2d0], rax
jmp 0x140035669
mov rcx, qword [rdi + 0x2c8]
call fcn.140123a80
mov qword [rdi + 0x2c8], rbx
mov qword [rdi + 0x2d0], rbx
test bpl, bpl
je 0x14003576d
mov rcx, r15
call fcn.140113eac
xor dil, dil
test rbx, rbx
je 0x14003577d
mov rcx, rbx
call fcn.140116b70
movzx eax, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x80], r12d
mov r9d, dword [rsi + 8]
mov r8, r14
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.1400429c0
test eax, eax
jne 0x14003576d
mov eax, dword [rsp + 0x80]
cmp rax, r12
jne 0x14003576d
mov dil, 1
jmp 0x140035770
mov ecx, eax
call fcn.140113fb8
int3
Function at 0x1400357e0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rdx
mov rdi, rcx
cmp dword [rax + 0x2a8], 1
jne 0x1400358e7
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, rax
test rax, rax
je 0x1400358e7
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebp
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x1400358e7
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x1400358b9
mov rax, qword [rdi]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x58]
test al, al
jne 0x1400358d9
call fcn.14001bb80
cmp eax, 2
jg 0x1400358b0
lea rdx, str.Failed_to_write_metadata_block._n
mov ecx, 2
call fcn.14001c200
test al, al
jne 0x1400358b0
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_metadata_block._n
call fcn.1400020d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, rbx
jmp 0x1400358c4
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140036130
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 8
movsxd rax, edx
add rax, rax
mov r11, qword [rcx + rax*8 + 0x18]
test r11, r11
je 0x140035993
mov qword [rsp], rbx
mov rbx, qword [rcx + rax*8 + 0x10]
add rbx, rcx
shl r11, 5
mov rcx, r11
mov r10, rbx
sar rcx, 5
test rcx, rcx
jle 0x140035964
mov rdx, rcx
shr rdx, 1
mov rax, rdx
shl rax, 5
cmp qword [rax + r10], r8
jae 0x14003595c
add rax, 0x20
add r10, rax
mov rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
jmp 0x14003595f
mov rcx, rdx
test rcx, rcx
jg 0x140035933
lea rax, [r11 + rbx]
mov rbx, qword [rsp]
cmp r10, rax
je 0x140035993
cmp qword [r10], r8
jne 0x140035993
test r9, r9
je 0x14003598c
mov rax, qword [r10 + 8]
mov qword [r9], rax
movups xmm0, xmmword [r10 + 0x10]
movups xmmword [r9 + 8], xmm0
mov al, 1
add rsp, 8
ret
xor al, al
add rsp, 8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rsi, edx
mov rbx, r8
mov edx, esi
mov rdi, rcx
call fcn.140039090
test al, al
jne 0x140036168
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14003618d
xor r9d, r9d
mov r8, rbx
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140035900
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rsi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rdi + 0x70]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rdi + 0x58]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rdi + 0x48]
je 0x140036241
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x140036243
nop dword [rax + rax]
cmp rax, rcx
je 0x140036241
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x140036230
jmp 0x140036243
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x140036260
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, r8
mov edx, edi
mov rsi, rcx
call fcn.140039090
test al, al
jne 0x140036298
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rdi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rsi + 0xd0]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rsi + 0xb8]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rsi + 0xa8]
je 0x140036351
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x140036353
nop
cmp rax, rcx
je 0x140036351
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x140036340
jmp 0x140036353
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x140036390
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
cmp qword [rax], 0
jne 0x14003646c
cmp qword [rax + 8], 0
jne 0x14003646c
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x1400364a4
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x14003641a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r8, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.140036a90
movzx esi, al
test al, al
je 0x14003644f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.14001bb80
cmp eax, 2
jg 0x1400364a4
lea rdx, str.Cannot_use_imported_metadata_along_with_white__or_blacklists._n
mov ecx, 2
call fcn.14001c200
test al, al
jne 0x1400364a4
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Cannot_use_imported_metadata_along_with_white__or_blacklists._n
call fcn.1400020d0
mov rbx, qword [rsp + 0x70]
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140039560
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r14, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
test byte [rbp + 0x38], 1
jne 0x14003977f
cmp dword [rcx + 0x30], 1
je 0x14003977f
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x1400395af
mov al, 1
jmp 0x140039781
mov r9, rdi
mov r8d, esi
lea rdx, str._02x._016llx.json
lea rcx, [rbp - 0x60]
call fcn.140031820
xor edi, edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], dil
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x1400395e6
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140001ad0
nop
lea rdx, [rbx + 0x10]
lea r8, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140041610
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14003964a
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400397a4
call fcn.140116b70
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
lea rdx, [0x14014cfb8]
call fcn.140123cbc
mov rdi, rax
test rax, rax
jne 0x1400396db
call fcn.14001bb80
cmp eax, 2
jg 0x140039735
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r8, qword [rbp - 0x40]
lea rdx, str.Failed_to_write_serialized_state_to_disk___s_._n
lea ecx, [rdi + 2]
call fcn.14001c200
test al, al
jne 0x140039735
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea ecx, [rdi + 2]
call fcn.140121190
mov r8, rbx
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk___s_._n
mov rcx, rax
call fcn.1400020d0
xor bl, bl
jmp 0x140039743
mov r9, rdi
mov r8, qword [rbp + 0x30]
mov edx, 1
mov rcx, r14
call fcn.140124a38
cmp rax, qword [rbp + 0x30]
je 0x140039739
call fcn.14001bb80
cmp eax, 2
jg 0x14003972d
lea rdx, str.Failed_to_write_serialized_state_to_disk._n
mov ecx, 2
call fcn.14001c200
test al, al
jne 0x14003972d
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk._n
call fcn.1400020d0
mov rcx, rdi
call fcn.140123b9c
xor bl, bl
jmp 0x140039743
mov rcx, rdi
call fcn.140123b9c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14003977a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039775
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003979e
call fcn.140116b70
movzx eax, bl
jmp 0x140039781
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14011d1bc
nop
call fcn.14011d1bc
nop
int3