joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400139f0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp - 0x70], eax
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x102
lea rcx, [rbp - 0x6c]
call fcn.1400a96a0
lea r8, [0x1400ee314]
mov edx, 0x104
lea rcx, [rbp - 0x6c]
call fcn.1400b3c10
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x104
lea rcx, [rbp + 0x19c]
call fcn.1400a96a0
mov ecx, dword [0x140112b70]
mov eax, dword [0x140112b74]
xor ebx, ebx
add ecx, eax
je 0x140013b2a
mov dword [rsp + 0x68], ebx
call fcn.140021750
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x140013ab1
call fcn.140021750
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x70], 0x20
mov edx, 1
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x19c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0x70]
movsx edx, dx
call fcn.140001cf0
mov qword [rsp + 0x60], rbx
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
js 0x140013b25
nop dword [rax]
call fcn.14002ade0
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
jns 0x140013b10
lock inc dword [rsp + 0x68]
call fcn.140013450
test al, al
je 0x140013bd3
mov dword [rbp - 0x7c], ebx
mov word [rbp - 0x78], 0x500
mov qword [rsp + 0x78], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x7c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140013bb3
mov dword [rbp - 0x80], ebx
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp - 0x80]
test eax, eax
cmove ecx, ebx
mov dword [rbp - 0x80], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x80], 1
je 0x140013bd3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140011b10
test al, al
sete bl
lea rcx, [rbp - 0x70]
call fcn.140001d50
movzx eax, bl
jmp 0x140013bde
lea rcx, [rbp - 0x70]
call fcn.140001d50
xor al, al
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400a2a50
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rbp
ret
Function at 0x140013f40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov edi, ecx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareBitdefenderInternalCrashEnabled
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013f92
mov rbx, qword [rsp + 0x30]
test eax, eax
jne 0x1400140ad
test rbx, rbx
je 0x140013fa8
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
js 0x1400140bb
mov edx, 0xb8
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140112c38], eax
jle 0x140013ff3
lea rcx, [0x140112c38]
call fcn.1400a2c90
cmp dword [0x140112c38], 0xffffffff
jne 0x140013ff3
mov dword [0x140112c3c], edi
lea rcx, [0x140112c38]
call fcn.1400a2c30
xor ecx, ecx
mov rdx, qword [0x140112c30]
lea r8, str.crash
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14001402e
cmp rcx, 8
jne 0x140014010
lea r8, [0x140013c90]
jmp 0x14001406d
xor eax, eax
lea r8, str.abort
nop word [rax + rax]
movzx ecx, word [rdx + rax*2]
inc rax
cmp cx, word [r8 + rax*2 - 2]
jne 0x14001405b
cmp rax, 8
jne 0x140014040
cmp cx, word [r8 + rax*2 - 2]
lea r8, [0x140013ce0]
lea rax, [0x140013cc0]
cmove r8, rax
lea rax, [0x140112c3c]
xor r9d, r9d
cmp dword [0x140112c3c], r9d
cmova r9, rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1400140bb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400140bb
test rbx, rbx
je 0x1400140bb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a2a50
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14001afa0
Capabilities:
Get token membership

Disassembly:
sub rsp, 0x88
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rax, qword gs:[0x58]
mov edx, 0xb8
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140112c54], eax
jle 0x14001b094
lea rcx, [0x140112c54]
call fcn.1400a2c90
cmp dword [0x140112c54], 0xffffffff
jne 0x14001b094
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rbx
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
lea rcx, [rsp + 0x6c]
mov dword [rsp + 0x40], ebx
mov r9d, 0x220
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x6c], ebx
mov word [rsp + 0x70], 0x500
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14001b074
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov edx, dword [rsp + 0x68]
test eax, eax
mov rcx, qword [rsp + 0x60]
cmove edx, ebx
mov dword [rsp + 0x68], edx
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x68], 1
lea rcx, [0x140112c54]
sete byte [0x140112c58]
call fcn.1400a2c30
mov rbx, qword [rsp + 0x80]
movzx eax, byte [0x140112c58]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a2a50
add rsp, 0x88
ret
Function at 0x14001b520
Capabilities:
Set current directory

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x190
mov rax, qword [0x14010c1d0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xor ebx, ebx
mov qword [r11 - 0x38], rbx
mov qword [r11 - 0x28], rbx
mov qword [r11 - 0x20], 7
mov word [r11 - 0x38], bx
lea rcx, [rsp + 0x40]
call fcn.140006d10
lea rcx, [rsp + 0x160]
cmp rcx, rax
je 0x14001b598
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x160], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x170], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
jmp 0x14001b5ad
movups xmm0, xmmword [rsp + 0x170]
movups xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rsp + 0x160]
movups xmmword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14001b5f5
lea rdx, [rax*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b5ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b796
call fcn.1400a2ab0
nop
mov rdx, qword [0x14010ce68]
cmp rdx, 8
jb 0x14001b63b
mov rcx, qword [0x14010ce50]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001b636
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001b7a2
mov rcx, r8
call fcn.1400a2ab0
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x14010ce50], xmm0
movups xmm1, xmmword [rsp + 0x30]
movaps xmmword [0x14010ce60], xmm1
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], bx
lea rcx, [rsp + 0x40]
call fcn.14001aee0
cmp qword [rax + 0x18], 8
jb 0x14001b683
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
sete bl
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x14001b6d3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b6ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b79c
call fcn.1400a2ab0
test bl, bl
je 0x14001b733
lea r8, str.set_current_dir
mov edx, 4
lea rcx, [rsp + 0x68]
call fcn.140003650
nop
cmp byte [rsp + 0xe8], 0
je 0x14001b709
lea rdx, str.Failed_to_set_current_directory__err:
lea rcx, [rsp + 0x68]
call fcn.14002bd90
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rsp + 0xe8], 0
je 0x14001b726
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140038e40
nop
lea rcx, [rsp + 0x68]
call fcn.1400038d0
nop
jmp 0x14001b77b
mov al, 1
jmp 0x14001b77d
xor al, al
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400a2a50
add rsp, 0x190
pop rbx
ret
call fcn.1400a99c0
nop
call fcn.1400a99c0
int3
call fcn.1400a99c0
nop
call fcn.1400a99c0
int3
Function at 0x14001e4e0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r10, rcx
mov rdx, qword [rdx + 0x10]
mov r8d, 0x1505
mov r9, qword [rdx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x14001e527
nop dword [rax]
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14001e510
mov rcx, qword [rcx + 0x38]
and rcx, r8
mov r8, qword [r10 + 0x20]
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x14001e580
cmp rax, rdx
jne 0x14001e565
mov rax, qword [r10 + 0x10]
lea rcx, [r10 + 0x10]
mov qword [r8], rax
mov qword [r8 + 8], rax
call fcn.140027630
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rdx + 8]
lea rcx, [r10 + 0x10]
mov qword [r8 + 8], rax
call fcn.140027630
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
cmp rax, rdx
jne 0x14001e58b
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [r10 + 0x10]
call fcn.140027630
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x14001e5a0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov ebx, 0x1505
mov rcx, qword [rdx]
movzx eax, word [rcx]
test ax, ax
je 0x14001e5e6
nop dword [rax]
nop word [rax + rax]
imul rbx, rbx, 0x21
movzx eax, ax
lea rcx, [rcx + 2]
add rbx, rax
movzx eax, word [rcx]
test ax, ax
jne 0x14001e5d0
mov r8, rdx
mov r9, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14002e140
xor esi, esi
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14001e672
mov rcx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
and rcx, rbx
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x14001e657
cmp rax, rdx
jne 0x14001e63f
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.140027630
mov ecx, 1
jmp 0x14001e675
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.140027630
mov ecx, 1
jmp 0x14001e675
cmp rax, rdx
jne 0x14001e662
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [rdi + 8]
call fcn.140027630
mov ecx, 1
jmp 0x14001e675
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
test rcx, rcx
mov eax, 0x490
cmovne eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001e690
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov r8, rdx
mov rdi, rcx
mov rdx, qword [rdx]
mov r9d, 0x1505
movzx eax, word [rdx]
test ax, ax
je 0x14001e6c7
imul r9, r9, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r9, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14001e6b1
lea rdx, [rsp + 0x20]
add rcx, 8
call fcn.14002e140
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14001e6e2
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x50]
lea rax, [rcx + 0x18]
xor edx, edx
cmp qword [rdi + 0x10], rcx
cmove rax, rdx
add rsp, 0x30
pop rdi
ret
Function at 0x14001e700
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, rcx
mov r8, rdx
mov r9d, 0x1505
mov rdx, qword [rdx]
movzx eax, word [rdx]
test ax, ax
je 0x14001e738
imul r9, r9, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r9, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14001e722
lea rdx, [rsp + 0x20]
add rcx, 8
call fcn.14002e140
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x14001e753
mov rcx, qword [rdi + 0x10]
cmp qword [rdi + 0x10], rcx
jne 0x14001e766
mov eax, 0x490
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rcx + 0x18]
xor eax, eax
mov qword [rsi], rcx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x14001ea10
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rdx]
mov r10d, 0x1505
mov rdx, rdi
movzx eax, word [rdi]
test ax, ax
je 0x14001ea56
nop word [rax + rax]
imul r10, r10, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r10, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14001ea40
and r10, qword [rcx + 0x38]
lea rsi, [rcx + 0x10]
mov rbp, qword [rcx + 0x20]
mov rax, r10
mov rbx, qword [rsi]
add rax, rax
xor r15d, r15d
mov qword [rsp + 0x40], r14
mov r8, qword [rbp + rax*8 + 8]
cmp r8, rbx
je 0x14001eb22
mov r11, qword [rbp + rax*8]
lea r14, [0x1400ee574]
nop dword [rax]
mov rax, qword [r8 + 0x10]
mov r9, r14
test rax, rax
cmovne r9, rax
test rdi, rdi
mov rax, r14
cmovne rax, rdi
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x14001eac4
add rax, 2
test ecx, ecx
jne 0x14001eab0
test edx, edx
je 0x14001ead3
cmp r8, r11
je 0x14001eb22
mov r8, qword [r8 + 8]
jmp 0x14001ea90
test r8, r8
je 0x14001eb22
add r10, r10
mov rax, qword [rbp + r10*8]
cmp qword [rbp + r10*8 + 8], r8
jne 0x14001eb03
cmp rax, r8
jne 0x14001eaf8
mov qword [rbp + r10*8], rbx
mov qword [rbp + r10*8 + 8], rbx
jmp 0x14001eb10
mov rbx, qword [r8 + 8]
mov qword [rbp + r10*8 + 8], rbx
jmp 0x14001eb10
cmp rax, r8
jne 0x14001eb10
mov rax, qword [r8]
mov qword [rbp + r10*8], rax
mov rdx, r8
mov rcx, rsi
call fcn.140027630
mov ecx, 1
jmp 0x14001eb25
mov rcx, r15
mov r14, qword [rsp + 0x40]
test rcx, rcx
mov rbx, qword [rsp + 0x48]
mov eax, 0x490
mov rbp, qword [rsp + 0x50]
cmovne eax, r15d
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret

Function at 0x14001eb50
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rdx]
mov rbx, rcx
add rcx, 8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x14001eb87
nop
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14001eb70
call fcn.140035510
cmp qword [rbx + 0x10], rax
je 0x14001eb9c
add rax, 0x18
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14001ebb0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rdx]
mov rdi, rcx
add rcx, 8
mov rbx, r8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x14001ebf7
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14001ebe0
call fcn.140035510
cmp qword [rdi + 0x10], rax
jne 0x14001ec12
mov eax, 0x490
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rax + 0x18]
xor eax, eax
mov qword [rbx], rcx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001ee00
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 0x10]
mov rsi, rdx
mov r10, rcx
mov r8d, 0x1505
mov r9, qword [rbx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x14001ee47
nop dword [rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14001ee30
mov rcx, qword [rcx + 0x38]
mov rdx, qword [r10 + 0x20]
and rcx, r8
shl rcx, 4
add rdx, rcx
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14001ee7e
cmp rax, rbx
jne 0x14001ee74
mov rax, qword [r10 + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x14001ee89
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x14001ee89
cmp rax, rbx
jne 0x14001ee89
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
dec qword [r10 + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.140035eb0
mov edx, 0x20
mov rcx, rbx
call fcn.1400a2ab0
mov rbx, qword [rsp + 0x40]
mov qword [rsi + 0x10], rdi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14001eed0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rdx]
mov rsi, rcx
mov r9d, 0x1505
mov rdx, rdi
movzx eax, word [rdi]
test ax, ax
je 0x14001ef08
imul r9, r9, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r9, rax
movzx eax, word [rdx]
test ax, ax
jne 0x14001eef2
and r9, qword [rcx + 0x38]
xor r15d, r15d
mov rbp, qword [rcx + 0x20]
mov rax, r9
mov r11, qword [rcx + 0x10]
add rax, rax
mov qword [rsp + 0x60], r14
mov rbx, qword [rbp + rax*8 + 8]
cmp rbx, r11
je 0x14001eff3
mov r10, qword [rbp + rax*8]
lea r14, [0x1400ee574]
nop dword [rax]
mov rax, qword [rbx + 0x10]
mov r8, r14
test rax, rax
cmovne r8, rax
test rdi, rdi
mov rax, r14
cmovne rax, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001ef74
add rax, 2
test ecx, ecx
jne 0x14001ef60
test edx, edx
je 0x14001ef83
cmp rbx, r10
je 0x14001eff3
mov rbx, qword [rbx + 8]
jmp 0x14001ef40
test rbx, rbx
je 0x14001eff3
add r9, r9
mov rax, qword [rbp + r9*8]
cmp qword [rbp + r9*8 + 8], rbx
jne 0x14001efb3
cmp rax, rbx
jne 0x14001efa8
mov qword [rbp + r9*8], r11
mov qword [rbp + r9*8 + 8], r11
jmp 0x14001efc0
mov r11, qword [rbx + 8]
mov qword [rbp + r9*8 + 8], r11
jmp 0x14001efc0
cmp rax, rbx
jne 0x14001efc0
mov rax, qword [rbx]
mov qword [rbp + r9*8], rax
mov rdx, qword [rbx]
dec qword [rsi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
lea rdx, [rbx + 0x10]
call fcn.140035eb0
mov edx, 0x20
mov rcx, rbx
call fcn.1400a2ab0
mov ecx, 1
jmp 0x14001eff6
mov rcx, r15
mov r14, qword [rsp + 0x60]
test rcx, rcx
mov eax, 0x490
cmovne eax, r15d
add rsp, 0x20
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001f020
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rdx]
mov rdi, rcx
add rcx, 8
mov rbx, r8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x14001f067
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14001f050
call fcn.140035510
cmp qword [rdi + 0x10], rax
jne 0x14001f082
mov eax, 0x490
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rdx, [rax + 0x18]
mov rcx, rbx
call fcn.14002b9a0
mov rbx, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001f770
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14001f811
test r8, r8
jle 0x14001f809
mov rcx, rdi
call fcn.1400252e0
test rax, rax
jle 0x14001f7e0
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.1400a5290
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14001f801
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
mov rax, qword [rax + 0x18]
call qword [case.0x14003c22e.0]
cmp eax, 0xffffffff
je 0x14001f809
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14001f7a2
sub r14, rbx
mov rax, r14
jmp 0x14001f885
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x14001f825
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001f827
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14001f87f
test ecx, ecx
jle 0x14001f860
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.1400a5290
mov rax, qword [rdi + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14001f87f
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001f87f
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1400b46a0
sub r14, rax
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14001f8a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001f8c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001f943
mov rdi, r14
mov rcx, rbx
call fcn.140025300
test rax, rax
jle 0x14001f914
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400a5290
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001f933
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x14003c22e.0]
cmp eax, 0xffffffff
je 0x14001f93b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001f8d6
sub r14, rdi
jmp 0x14001fa38
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001f95a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001f95c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001f991
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400a5290
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001fa35
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14001f9cc
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14001fa10
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b4984
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14001fa4e
cmp rbp, rax
ja 0x14001f9e0
mov r8, rdi
test rdi, rdi
je 0x14001fa35
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b4984
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14001fa38