joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011ea0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x14006d0d8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor r15d, r15d
lea r8, str.AppID
mov r14d, edx
mov qword [rsp + 0x50], r15
mov rdi, rcx
mov dword [rsp + 0x58], r15d
mov rdx, 0xffffffff80000000
mov qword [rsp + 0x60], r15
lea rcx, [rsp + 0x50]
mov r9d, 0x20019
call fcn.14000ff10
mov ebx, eax
test eax, eax
je 0x140011f11
mov dword [rdi + 0x27c], eax
jmp 0x14001206e
mov rdx, qword [rsp + 0x50]
lea r8, str.84081F6F_8B2D_4FFE_AF7F_E72D488FABEB
mov r9d, 0x20019
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0x38]
mov dword [rsp + 0x40], r15d
mov qword [rsp + 0x48], r15
call fcn.14000ff10
mov ebx, eax
test eax, eax
jne 0x140012056
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x90]
mov dword [rsp + 0x30], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LocalService
call qword [sym.imp.ADVAPI32.DLL_RegQueryValueExW]
test eax, eax
jne 0x140011fc0
mov eax, dword [rsp + 0x34]
dec eax
cmp eax, 1
jbe 0x140011f93
lea eax, [rbx + 0xd]
jmp 0x140011fc0
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140011fb4
test al, 1
jne 0x140011fad
shr rax, 1
cmp word [rsp + rax*2 + 0x8e], r15w
je 0x140011fbd
mov eax, SafeArrayDestroy
jmp 0x140011fc0
mov word [rsp + 0x90], r15w
mov eax, r15d
mov dword [rdi + 0x28c], r15d
test eax, eax
jne 0x14001201a
lea rax, [rdi + 0x68]
mov dword [rdi + 0x28c], 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
lea rax, [0x140012b20]
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.DLL_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x140012012
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rdi + 0x27c], eax
mov ebx, dword [rdi + 0x27c]
jmp 0x14001205c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.OLE32.DLL_CoInitializeEx]
mov ebx, eax
test eax, eax
jns 0x140012045
cmp eax, 0x80010106
jne 0x14001205c
lea rcx, str.Mscoree.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test rax, rax
jne 0x140012049
jmp 0x14001205c
mov byte [rdi + 0x62], 1
mov edx, r14d
mov rcx, rdi
call fcn.140011a10
mov ebx, eax
mov dword [rdi + 0x27c], eax
cmp qword [rsp + 0x38], r15
je 0x14001206e
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp qword [rsp + 0x50], r15
je 0x140012080
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14001bae0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
Function at 0x140017e10
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
mov r8, qword [0x1400700d8]
xor ecx, ecx
test r8, r8
je 0x140017e69
lea rdx, str.instance_to_be_deleted:___p
mov qword [rsp + 0x20], rbx
call fcn.140005e60
mov rbx, qword [0x1400700d8]
test rbx, rbx
je 0x140017e54
mov rcx, rbx
call fcn.140016be0
mov edx, 0x88
mov rcx, rbx
call fcn.14001ba4c
mov rbx, qword [rsp + 0x20]
mov qword [0x1400700d8], 0
add rsp, 0x28
ret
lea rdx, str.instance_is_NULL
add rsp, 0x28
jmp fcn.140005e60

Function at 0x14001e06c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
je 0x14001e07f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.DLL_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14001e698
lea rdx, [0x14006af58]
lea rcx, [rsp + 0x20]
call fcn.14003aa38
int3

Function at 0x140029f9c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140070980]
xor edx, edx
jmp fcn.14001e06c

Function at 0x14002a958
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140070980]
jmp fcn.14001e06c
Function at 0x140036770
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140036830]
mov r9, qword [r9 + 8]
jmp fcn.1400263e4

Function at 0x140036804
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140036840]
mov r9, qword [r9 + 8]
jmp fcn.1400263e4
Function at 0x1412cab0c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1412cab16
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1412cab3f
pop rbp
sub rbp, 0x33
sub rbp, 0x12cab0c
sub rsp, 0x20
jmp 0x1412cab5e
mov rax, 0x12cab0c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x12542762
xor byte [rax], dl
inc rax
dec rcx
jne 0x1412cab7d
jmp 0x1412cab94
sub ch, bl
mov ebp, ecx
jmp 0x1412cabf8
movabs dword [0x6daa9d2a62626266], eax
out 0x8c, eax
popfq
popfq
popfq
movabs eax, dword [0x409ada2a3230383a]
invalid
Function at 0x14000f620
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000f681
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000f640
mov ecx, dword [r9]
jmp 0x14000f76b
cmp ecx, 0x4e0
jb 0x14000f76b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000f6a0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14000f6f0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400121e0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2160
call fcn.1400de6e0
sub rsp, rax
mov rax, qword [0x140114480]
xor rax, rsp
mov qword [rsp + 0x2150], rax
lea rax, str.dbghelp.dll
mov qword [rsp + 0x28], rax
lea rax, str.dbgcore.dll
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r9, [rsp + 0x20]
mov r8d, 0x2000
mov rcx, rax
lea rdx, [rsp + 0x40]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x1400122b0
xor edi, edi
test dword [rsp + 0x20], 0xfffffff8
jbe 0x1400122b0
nop dword [rax + rax]
mov rbx, qword [rsp + rdi*8 + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x2040]
mov rcx, rax
mov rdx, rbx
call sub.KERNEL32.dll_K32GetModuleBaseNameA
test eax, eax
je 0x1400122a3
lea rbx, [rsp + 0x28]
nop dword [rax]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x2040]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400122d3
add rbx, 8
lea rax, [rsp + 0x38]
cmp rbx, rax
jne 0x140012280
mov eax, dword [rsp + 0x20]
inc edi
shr eax, 3
cmp edi, eax
jb 0x140012250
xor al, al
mov rcx, qword [rsp + 0x2150]
xor rcx, rsp
call fcn.1400de740
mov rbx, qword [rsp + 0x2170]
add rsp, 0x2160
pop rdi
ret
mov al, 1
jmp 0x1400122b2
Function at 0x140014700
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x140114480]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, r8
mov rdi, rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], r8
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor r14d, r14d
mov qword [rdx], r14
mov qword [rdx + 8], r14
mov qword [rdx + 0x10], r14
mov dword [rsp + 0x20], 1
cmp qword [r8 + 0x10], r14
je 0x1400148a2
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140014898
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x8c]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1400147b2
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0x28]
call fcn.1400031e0
mov rax, rsi
cmp qword [rsi + 0x18], 7
jbe 0x1400147dc
mov rax, qword [rsi]
lea r8, [rsp + 0x28]
mov r9, qword [rsp + 0x28]
mov r10, qword [rsp + 0x40]
cmp r10, 7
cmova r8, r9
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsi + 0x10]
jne 0x14001481e
test rdx, rdx
je 0x14001481a
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14001481e
add rax, 2
sub rdx, 1
jne 0x140014806
mov bl, 1
jmp 0x140014820
xor bl, bl
cmp r10, 7
jbe 0x14001485b
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x140014853
add rdx, 0x27
mov r9, qword [r9 - 8]
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400148d5
mov rcx, r9
call fcn.1400de37c
test bl, bl
je 0x140014883
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140014876
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rdi + 8], 4
jmp 0x140014883
lea r8, [rsp + 0x68]
mov rcx, rdi
call fcn.140003b00
lea rdx, [rsp + 0x60]
mov rcx, rbp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140014791
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rsi
call fcn.140016020
mov rax, rdi
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400de740
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
int3
Function at 0x140014e00
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13d8
call fcn.1400de6e0
sub rsp, rax
mov rax, qword [0x140114480]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x34], eax
mov edx, 1
mov dword [rsp + 0x13b4], 0xffffffff
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, 0x270
jb 0x140014e40
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x270
call fcn.14000f620
mov ecx, eax
imul rax, rcx, 0x385
cmp eax, 0x132
ja 0x140014e9b
lea rcx, [rsp + 0x30]
call fcn.14000f620
mov ecx, eax
imul rax, rcx, 0x385
cmp eax, 0x133
jb 0x140014e81
shr rax, 0x20
lea rcx, [rsp + 0x20]
sub rax, 0x7fffff9c
xor rax, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call fcn.14000be40
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400de740
add rsp, 0x13d8
ret

Function at 0x140014ee0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
call fcn.14000fad0
call fcn.140014e00
call fcn.14000ff60
add rsp, 0x28
jmp fcn.140014e00

Function at 0x140015250
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140114480]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140015323
cmp byte [rcx + 0x71], 0
je 0x140015323
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14001531f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400152e4
sub eax, 1
je 0x1400152e8
cmp eax, 2
jne 0x14001531f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400de740
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140015316
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001531f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400152cc
xor al, al
jmp 0x1400152cc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400de740
add rsp, 0x60
pop rbx
ret
Function at 0x14001f160
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140114480]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14001f18d
xor eax, eax
jmp 0x14001f2f6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14001f1cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14001f1cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14001f2ee
cmp qword [rdi + 0x80], 0
je 0x14001f2e9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14001f207
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14001f232
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14001f2ee
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001f2a1
sub eax, 1
je 0x14001f2a1
cmp eax, 2
jne 0x14001f2e9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14001f2ee
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14001f2cf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14001f2e9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14001f2ee
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400de740
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140025c30
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140025c52
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140025c68
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140025cb2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140025d21
mov rcx, rbp
call fcn.140015c40
cmp rbx, 0xfff
jbe 0x140025d01
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140025d3a
cmp rbx, rax
ja 0x140025cd0
test rdi, rdi
je 0x140025d21
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x140025d24
Function at 0x140025d40
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140025d68
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x140025ddc
test rax, rax
jle 0x140025dbc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x140025ddc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140025ddc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400299c0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140029b6d
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140029880
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140029b36
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140029ab0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140029b25
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140029aed
mov r10, qword [rdx]
cmp r10, rax
je 0x140029ae7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140029b25
cmp r9, rdx
je 0x140029b01
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140029b47
cmp r9, rdx
jne 0x140029af2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x140029a60
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140029b25
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3