joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019960
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
movzx r10d, byte [r8]
lea r11, [r8 + 1]
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov eax, 0x1505
test r10d, r10d
je 0x1400199a5
imul eax, eax, 0x21
lea r11, [r11 + 1]
add eax, r10d
movzx r10d, byte [r11 - 1]
test r10d, r10d
jne 0x140019991
test eax, eax
mov esi, 1
mov rcx, rbx
cmovne esi, eax
mov edx, esi
call fcn.140010ba0
cmp eax, 0xffffffff
je 0x1400199e4
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
je 0x1400199e4
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x20]
mov rcx, r15
movaps xmmword [rsp + 0x20], xmm0
call fcn.140007950
jmp 0x140019ab3
mov eax, dword [r14]
movzx ecx, byte [rbx + 0x14]
mov edx, dword [rbx + 0x10]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x60], rbp
mov ebp, dword [rbx + 0x18]
mov qword [rsp + 0x28], rax
inc ebp
mov eax, ebp
shl rax, 8
shr rax, cl
movaps xmmword [rsp + 0x30], xmm6
cmp rax, 0x50
jbe 0x140019a24
mov rcx, rbx
call fcn.14001f520
mov edx, dword [rbx + 0x10]
mov r8, qword [rbx]
lea ecx, [rdx - 1]
mov edx, ecx
and edx, esi
cmp dword [r8 + rdx*4], 0
je 0x140019a40
inc edx
and edx, ecx
cmp dword [r8 + rdx*4], 0
jne 0x140019a35
movaps xmm6, xmmword [rsp + 0x20]
mov dword [r8 + rdx*4], esi
mov rax, qword [rbx + 8]
movsxd rcx, edx
add rcx, rcx
mov qword [rax + rdx*8], rdi
mov rax, qword [rbx + 0x28]
mov dword [rbx + 0x18], ebp
mov rbx, 0xffffffffffffffff
mov rbp, qword [rsp + 0x60]
movups xmmword [rax + rcx*8], xmm6
nop
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140019a70
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
lea r8, [rbx + 1]
call fcn.140007ed0
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.14004eca0
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
mov rcx, r15
call fcn.140007950
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140020be0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push r14
push r15
sub rsp, 0x80
mov r15, rcx
mov rbp, r9
lea rcx, [rsp + 0x20]
mov r14, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140020dfb
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x60]
sub rax, qword [0x140098f18]
xor edx, edx
imul rax, rax, 0xf4240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0xa0], rsi
div qword [0x140098f10]
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r12
mov r12, rax
add r12, qword [0x140098f20]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], 0
call fcn.140007d60
lea rcx, [rsp + 0x60]
mov rsi, rax
call fcn.140007d60
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.140007d60
mov ecx, dword [rbx]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
lea rcx, [r15 + 0x70]
mov qword [rsp + 0x30], rbx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140021050
mov rdx, qword [rsi + 0x10]
lea rcx, [rsi + 0x18]
mov r8d, 4
call fcn.140007ed0
mov r8d, 4
lea rcx, [rsi + 0x18]
mov dword [rax], 0x6a683db9
mov rdx, qword [rsi + 0x10]
mov ebx, dword [r15 + 0x88]
call fcn.140007ed0
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, rsi
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rax], ebx
call fcn.140007950
mov rdx, qword [rsi + 0x10]
lea rcx, [rsi + 0x18]
mov r8d, 4
call fcn.140007ed0
lea rcx, [r15 + 0x50]
mov dword [rax], 0x6a683db9
call fcn.14003bf50
mov rdx, rbp
mov qword [r15 + 0x10], 0
lea rcx, [rsp + 0x60]
call fcn.140007b80
mov rdi, qword [rsp + 0xa8]
movzx ebx, al
mov rsi, qword [rsp + 0xa0]
mov rcx, rbp
test al, al
je 0x140020d81
mov rdx, r14
call fcn.140014780
movzx ebx, al
test al, al
jne 0x140020d86
mov r9, r14
lea rdx, str.Failed_to_rename___s__to___s_
mov r8, rbp
mov ecx, 1
call fcn.140013c50
jmp 0x140020d86
call fcn.1400146b0
lea rcx, [rsp + 0x60]
call fcn.140007a60
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140020dee
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
sub rax, r12
add rax, qword [0x140098f20]
lock xadd qword [0x140098870], rax
mov r12, qword [rsp + 0xb0]
movzx eax, bl
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
Function at 0x140024130
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
xor eax, eax
mov rbp, rdx
mov rdx, rcx
mov qword [r11 - 0x40], rax
mov rdi, rcx
mov qword [r11 - 0x38], rax
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x30], rax
mov r14, r8
mov qword [r11 - 0x28], rax
call fcn.14003bd00
mov rbx, qword [rsp + 0x38]
mov r8, rdi
mov ecx, 8
test rbx, rbx
je 0x14002421f
mov rsi, qword [rsp + 0x40]
lea rdx, str._s:_successfully_mapped_at__p___d_bytes_
mov r9, rbx
mov dword [rsp + 0x20], esi
call fcn.140013c50
cmp rsi, 0x14
jae 0x1400241bf
mov r9d, esi
mov dword [rsp + 0x20], 0x14
mov r8, rdi
lea rdx, str._s:_Bad_mmap_size__d___need_at_least__d_bytes
mov ecx, 2
call fcn.140013c50
jmp 0x14002422b
mov r9d, dword [rbx]
cmp r9d, 0xe0afb8f1
je 0x1400241e9
mov r8, rdi
mov dword [rsp + 0x20], 0xe0afb8f1
lea rdx, str._s:_Bad_magic_number__08x___current_is__08x
mov ecx, 8
call fcn.140013c50
jmp 0x14002422b
cmp dword [rbx + 0x10], 0xe0afb8f1
je 0x140024203
mov r8, rdi
lea rdx, str.Did_not_find_expected_magic_number_marker_at_the_end_of__s._This_most_likely_means_data_writing_code_for_that_file_is_writing_too_much_or_too_little_data
mov ecx, 1
jmp 0x140024226
movups xmm0, xmmword [rsp + 0x38]
mov al, 1
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov qword [r14], rbx
jmp 0x1400242e7
lea rdx, str._s:_mmap_failed
call fcn.140013c50
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140024309
mov rax, qword [rsp + 0x98]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
mov rdi, rax
add rdi, qword [0x140098f20]
test rbx, rbx
je 0x1400242a0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x140024316
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop word [rax + rax]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400242fc
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
sub rax, rdi
add rax, qword [0x140098f20]
lock inc dword [0x140098800]
lock xadd qword [0x140098808], rax
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.140013bd0
int3
Function at 0x1400251b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp byte [0x140098f68], 0
mov rdi, rcx
movsxd rbx, edx
je 0x140025232
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov esi, r14d
test edx, edx
je 0x140025216
nop
mov rcx, qword [0x1400ce090]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov dword [rsp + 0x60], r14d
mov rdx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025216
mov eax, dword [rsp + 0x60]
add esi, eax
add rdi, rax
mov eax, esi
cmp rax, rbx
jb 0x1400251e0
add dword [0x1400988ec], ebx
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x38
pop rdi
pop rbx
ret
add dword [0x1400988ec], ebx
test edx, edx
jle 0x140025263
nop dword [rax]
mov r9, qword [0x1400988b8]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.140056750
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140025240
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x140025270
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x58
movsxd rbx, dword [rcx + 0x7c]
lea r12, [rcx + 0x7c]
xor r13d, r13d
mov qword [rsp + 0x98], rbp
mov ebp, r8d
mov r14, rdx
mov r15, rcx
mov r11d, r13d
test rbx, rbx
je 0x1400252c0
mov r10d, r13d
nop word [rax + rax]
add r11d, 5
add r11d, dword [rcx + r10*4]
inc r10
cmp r10, rbx
jne 0x1400252b0
lea eax, [r8 + 0xc]
mov qword [rsp + 0x50], rdi
add eax, r11d
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], eax
mov esi, 0xc
mov eax, dword [0x1400988e8]
mov dword [rsp + 0x40], eax
inc eax
cmp byte [0x140098f68], r13b
mov dword [0x1400988e8], eax
je 0x140025344
lea rdi, [rsp + 0x38]
mov ebx, r13d
nop dword [rax]
mov rcx, qword [0x1400ce090]
lea r9, [rsp + 0xa0]
mov r8d, esi
mov dword [rsp + 0xa0], r13d
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002533c
mov eax, dword [rsp + 0xa0]
add ebx, eax
add rdi, rax
cmp ebx, esi
jb 0x140025300
add dword [0x1400988ec], esi
jmp 0x140025373
add dword [0x1400988ec], esi
lea rbx, [rsp + 0x38]
nop
mov r9, qword [0x1400988b8]
mov edx, 1
mov r8d, esi
mov rcx, rbx
call fcn.140056750
movsxd rcx, eax
sub esi, eax
add rbx, rcx
test esi, esi
jg 0x140025350
mov edx, ebp
mov rcx, r14
call fcn.1400251b0
mov esi, r13d
mov rbp, qword [rsp + 0x98]
cmp dword [r12], r13d
je 0x1400254f7
lea r14, [r15 + 0x28]
nop word [rax + rax]
cmp byte [0x140098f68], r13b
lea rdi, [rsp + 0xa8]
mov eax, dword [r15]
mov ebx, 4
mov dword [rsp + 0xa8], eax
je 0x140025419
mov ebx, r13d
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x1400ce090]
lea r9, [rsp + 0x90]
mov r8d, 4
mov dword [rsp + 0x90], r13d
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025410
mov eax, dword [rsp + 0x90]
add ebx, eax
add rdi, rax
cmp ebx, 4
jb 0x1400253d0
add dword [0x1400988ec], 4
jmp 0x140025443
add dword [0x1400988ec], ebx
nop
mov r9, qword [0x1400988b8]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.140056750
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140025420
mov edx, dword [rsp + 0xa8]
mov rcx, qword [r14]
call fcn.1400251b0
cmp byte [0x140098f68], r13b
lea rdi, [rsp + 0xa0]
mov byte [rsp + 0xa0], r13b
mov ebx, 1
je 0x1400254b2
mov ebx, r13d
mov rcx, qword [0x1400ce090]
lea r9, [rsp + 0x30]
mov r8d, 1
mov dword [rsp + 0x30], r13d
mov rdx, rdi
mov qword [rsp + 0x20], r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400254aa
mov eax, dword [rsp + 0x30]
add ebx, eax
add rdi, rax
cmp ebx, 1
jb 0x140025473
inc dword [0x1400988ec]
jmp 0x1400254e3
inc dword [0x1400988ec]
nop dword [rax + rax]
mov r9, qword [0x1400988b8]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.140056750
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x1400254c0
inc esi
add r14, 8
add r15, 4
cmp esi, dword [r12]
jne 0x1400253a0
mov rdi, qword [rsp + 0x50]
add rsp, 0x58
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
ret
Function at 0x140025b90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r14
sub rsp, 0x20
mov r12, qword [rcx + 0x10]
mov rsi, r8
mov r14, rdx
mov rbx, rcx
test r12, r12
jne 0x140025bdb
lea ecx, [r12 + 1]
call fcn.140053a48
mov r9, rax
lea edx, [r12 + 1]
mov r8, rsi
mov rcx, r14
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
jmp fcn.140056750
movsxd rcx, dword [rcx + 0x20]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r15
lea rdx, [r8 + rcx]
cmp rdx, qword [rbx + 0x18]
jbe 0x140025c4c
mov edi, dword [rbx + 0x18]
add edi, edi
movsxd rax, edi
cmp rax, rdx
jae 0x140025c09
lea edi, [rcx + r8]
mov rax, qword [r12 - 8]
mov r15, qword [rbx + 0x28]
neg rax
movsxd rbp, edi
lock xadd qword [r15], rax
lea rdx, [rbp + 8]
lea rcx, [r12 - 8]
call fcn.14005c684
mov rcx, rax
test rax, rax
je 0x140025c80
mov qword [rax], rbp
mov rax, rbp
lock xadd qword [r15], rax
add rcx, 8
je 0x140025c94
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rbp
movsxd rcx, dword [rbx + 0x20]
mov r8, rsi
add rcx, qword [rbx + 0x10]
mov rdx, r14
call fcn.14004eca0
add dword [rbx + 0x20], esi
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
lea r8, [r12 - 8]
mov edx, edi
lea rcx, str.out_of_memory_reallocating__d_bytes_at__p
call fcn.140013b50
int3
mov edx, edi
lea rcx, str.out_of_memory_allocating__d_bytes_for_output_buffer
call fcn.140013b50
int3
Function at 0x140028b60
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
mov rbx, rdx
lea rcx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140028db2
mov rax, qword [rbp + 0x20]
lea rcx, [rbp - 0x48]
sub rax, qword [0x140098f18]
xor edx, edx
imul rax, rax, 0xf4240
mov qword [rsp + 0xa8], rsi
div qword [0x140098f10]
mov rdx, rbx
mov rsi, rax
add rsi, qword [0x140098f20]
call fcn.140013ff0
xor edx, edx
lea rcx, [rbp - 0x48]
call fcn.140014240
test al, al
je 0x140028ccd
cmp qword [rbp - 0x30], 8
lea rcx, [rbp - 0x48]
lea r8, [rbp - 0x28]
cmovae rcx, qword [rbp - 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x140028ccd
mov ecx, dword [rbp - 0x28]
bt ecx, 0xa
jae 0x140028c04
mov eax, 0x11
jmp 0x140028c14
test cl, 0x10
mov eax, 5
mov edx, 9
cmovne eax, edx
mov edx, eax
or edx, 0x20
and cl, 1
cmove edx, eax
test dl, 8
je 0x140028c2e
mov qword [rbp - 0x50], 1
jmp 0x140028c3f
mov ecx, dword [rbp - 0x10]
mov eax, dword [rbp - 0x14]
shl rcx, 0x20
add rcx, rax
mov qword [rbp - 0x50], rcx
mov ecx, dword [rbp - 0xc]
mov eax, dword [rbp - 8]
movsd xmm1, qword [rbp - 0x50]
shl rcx, 0x20
add rcx, rax
mov dword [rbp - 0x60], edx
mov rdx, qword [rbp - 0x30]
mov qword [rbp - 0x58], rcx
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
cmp rdx, 8
jb 0x140028ca4
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140028c9f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028d9f
mov rcx, r8
call fcn.14004c810
xor ebx, ebx
mov qword [rbp - 0x30], 7
lea rcx, [rbp + 0x30]
mov qword [rbp - 0x38], rbx
mov word [rbp - 0x48], bx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140028da5
jmp 0x140028d54
call fcn.14005688c
mov rdx, qword [rbp - 0x30]
xor ebx, ebx
mov ecx, 2
mov qword [rbp - 0x58], rbx
mov qword [rbp - 0x50], rbx
cmp dword [rax], ecx
movsd xmm1, qword [rbp - 0x50]
cmove ecx, ebx
mov dword [rbp - 0x60], ecx
movups xmm0, xmmword [rbp - 0x60]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
cmp rdx, 8
jb 0x140028d36
mov rcx, qword [rbp - 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140028d31
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140028d9f
mov rcx, r8
call fcn.14004c810
lea rcx, [rbp + 0x30]
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], bx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140028dbf
mov rax, qword [rbp + 0x30]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
sub rax, rsi
add rax, qword [0x140098f20]
lock inc dword [0x140098830]
lock xadd qword [0x140098838], rax
mov rsi, qword [rsp + 0xa8]
mov rax, rdi
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
call fcn.1400561ac
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
Function at 0x14002b780
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
lea rcx, [0x1400bf080]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x1400988f0]
lea rdx, [0x140089804]
lea rcx, [0x140098900]
mov qword [rsp + 0x60], rax
call fcn.140014890
mov rbx, rax
test rax, rax
je 0x14002b81a
mov edx, 8
lea rcx, [rsp + 0x60]
mov r9, rax
lea r8d, [rdx - 7]
call fcn.140056750
mov rcx, rbx
call fcn.14005649c
lea rdx, [0x140098900]
lea rcx, [rsp + 0x38]
call fcn.140028b60
lea rcx, [0x1400bf080]
movsd xmm1, qword [rax + 0x10]
movsd qword [rsp + 0x30], xmm1
mov rax, qword [rsp + 0x30]
mov qword [0x1400988f0], rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1400988f0]
add rsp, 0x50
pop rbx
ret
xor edx, edx
lea rcx, str.Unable_to_create_timestamp_file__s
call fcn.140013bd0
int3
Function at 0x140037530
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, qword [rcx + 0x28]
mov rbp, rdx
mov rsi, qword [rcx + 8]
test rbx, rbx
je 0x140037590
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov edi, 0x3f8
mov r9, rbp
cmp rbx, rdi
mov edx, 1
mov rcx, rsi
cmovb rdi, rbx
mov r8, rdi
call fcn.140056750
mov rsi, qword [rsi + 0x3f8]
sub rbx, rdi
jne 0x140037560
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x1400394f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400396a1
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038fa0
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140039666
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rdi
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rdi
xor r9, rax
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400395e0
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140039655
mov rax, qword [r11 + 8]
mov r8d, dword [rcx + 0x10]
cmp r8d, dword [rax + 0x10]
jne 0x14003961d
mov r8, qword [rax]
cmp r8, rcx
je 0x140039617
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140039655
cmp r9, rax
je 0x140039631
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
je 0x14003967b
cmp r9, rax
jne 0x140039622
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], rax
mov r8, qword [rax + 8]
mov qword [r8], rcx
mov qword [rax + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x140039590
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140039655
lea rcx, str.invalid_hash_bucket_count
call fcn.14004aa5c
int3
Function at 0x14003bd00
Capabilities:
Check for time delay via queryperformancecounter
Get file size
Read file via mapping

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003bf3b
mov rax, qword [rsp + 0xa8]
lea rcx, [rsp + 0x48]
sub rax, qword [0x140098f18]
xor edx, edx
imul rax, rax, 0xf4240
mov qword [rsp + 0x90], rbp
div qword [0x140098f10]
mov qword [rsp + 0x70], r14
mov rdx, rbx
mov r14, rax
add r14, qword [0x140098f20]
call fcn.140013ff0
cmp qword [rax + 0x18], 8
jb 0x14003bd70
mov rax, qword [rax]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x60]
mov rbx, rax
cmp rdx, 8
jb 0x14003bde1
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003bddc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003bf48
mov rcx, r8
call fcn.14004c810
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bp
cmp rbx, 0xffffffffffffffff
je 0x14003bed5
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x98], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [rsp + 0xa0]
xor edx, edx
mov eax, eax
mov rcx, rbx
shl rsi, 0x20
or rsi, rax
mov qword [rsp + 0x28], rbp
mov r9, rsi
mov dword [rsp + 0x20], esi
shr r9, 0x20
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
jne 0x14003be71
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateFileMapping___failed:__u
lea ecx, [rbp + 1]
call fcn.140013c50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003becd
xor r9d, r9d
mov eax, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbp
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x14003bebe
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MapViewOfFile___failed:__u
mov ecx, 1
mov r8d, eax
call fcn.140013c50
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003becd
mov qword [rdi], rax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov rsi, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003bf2e
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rax, qword [0x140098f18]
imul rax, rax, 0xf4240
div qword [0x140098f10]
sub rax, r14
add rax, qword [0x140098f20]
lock inc dword [0x140098800]
lock xadd qword [0x140098808], rax
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013bd0
int3
call fcn.1400561ac
int3