joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400409d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
push r14
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r14, rdx
mov rdi, rcx
cmp rax, qword [rcx]
jbe 0x140040be4
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop dword [rax + rax]
mov rbx, qword [rdi + 0x88]
sub rax, qword [rbx + 0x20]
mov qword [rdi + 8], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x140040a41
mov qword [rcx + 8], rax
jmp 0x140040a48
mov qword [rdi + 0x80], rax
test rax, rax
je 0x140040a52
mov qword [rax], rcx
jmp 0x140040a59
mov qword [rdi + 0x88], rcx
mov rcx, qword [r14]
lea rdx, [rsp + 0x50]
mov rax, qword [rbx + 0x18]
add rcx, 0x3c8
mov rsi, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
call fcn.14004a3b0
test rsi, rsi
je 0x140040a99
mov rax, qword [r14]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rax + 0xe48]
mov rcx, qword [rcx + 0x18]
call qword [0x1401bc990]
mov rcx, qword [r14]
mov eax, 1
lock xadd dword [rcx + 0xe1c], eax
movzx eax, byte [rbx + 0x19]
movzx edx, byte [rbx + 0x18]
mov r11, qword [rdi + 0x58]
xor rdx, r12
mov r9, qword [rdi + 0x48]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1a]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1b]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1c]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1d]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1e]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1f]
imul rdx, r15
xor rdx, rax
imul rdx, r15
and rdx, qword [rdi + 0x70]
mov r10, rdx
add r10, r10
mov rsi, qword [r11 + r10*8 + 8]
mov rcx, rsi
cmp rsi, r9
je 0x140040b97
mov rax, qword [rbx + 0x18]
mov r8, qword [r11 + r10*8]
cmp rax, qword [rsi + 0x10]
je 0x140040b3f
nop
cmp rcx, r8
je 0x140040b97
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140040b30
test rcx, rcx
je 0x140040b97
add rdx, rdx
mov rax, qword [r11 + rdx*8]
cmp rsi, rcx
jne 0x140040b6b
cmp rax, rcx
jne 0x140040b60
mov qword [r11 + rdx*8], r9
mov qword [r11 + r10*8 + 8], r9
jmp 0x140040b77
mov r9, qword [rcx + 8]
mov qword [r11 + r10*8 + 8], r9
jmp 0x140040b77
cmp rax, rcx
jne 0x140040b77
mov rax, qword [rcx]
mov qword [r11 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x50]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.1400ec648
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x60], rbx
cmp rdx, qword [rdi + 0x20]
je 0x140040bb0
mov qword [rdx], rbx
add qword [rdi + 0x18], 8
jmp 0x140040bbe
lea r8, [rsp + 0x60]
lea rcx, [rdi + 0x10]
call fcn.14003bad0
mov rax, qword [rdi + 8]
cmp rax, qword [rdi]
ja 0x140040a20
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop r14
pop rdi
ret
Function at 0x140043280
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov rsi, qword [rax + 8]
mov rbx, qword [rax]
cmp rbx, rsi
je 0x1400434b9
mov qword [r11 + 0x10], rbp
movabs rbp, 0x100000001b3
mov qword [r11 + 0x18], r14
movabs r14, 0xcbf29ce484222325
nop dword [rax]
mov r9, qword [rbx]
test r9, r9
je 0x14004349c
mov r9, qword [r9 + 0x50]
mov r8, qword [rdi + 8]
mov rax, r9
shr rax, 8
movzx ecx, al
mov rax, r9
shr rax, 0x10
movzx edx, r9b
xor rdx, r14
mov qword [rsp + 0x80], r9
imul rdx, rbp
xor rdx, rcx
movzx ecx, al
imul rdx, rbp
mov rax, r9
xor rdx, rcx
shr rax, 0x18
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x20
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x28
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x30
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r8 + 0x30]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + 8]
je 0x140043398
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x14004338f
nop dword [rax]
cmp rax, rcx
je 0x140043398
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x140043380
test rax, rax
jne 0x14004349c
movzx eax, byte [rsp + 0x81]
mov r10, qword [rdi + 0x20]
movzx edx, r9b
xor rdx, r14
imul rdx, rbp
mov rcx, qword [r10 + 0x30]
xor rdx, rax
movzx eax, byte [rsp + 0x82]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x83]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x84]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x85]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x86]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x87]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rcx, rdx
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 8]
je 0x140043443
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x140043445
cmp rax, rcx
je 0x140043443
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x140043432
jmp 0x140043445
xor eax, eax
test rax, rax
jne 0x14004349c
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
mov eax, dword [rbx + 0x18]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov rcx, r10
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x44], 0x101
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 7
call fcn.140023390
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call fcn.14004a2b0
add rbx, 0x20
cmp rbx, rsi
jne 0x1400432c0
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
add rcx, 8
jmp 0x140043280
Function at 0x140043db0
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 0x10]
mov rdi, rcx
mov rsi, qword [rax + 8]
mov rbx, qword [rax]
cmp rbx, rsi
je 0x140043fe9
mov qword [r11 + 0x10], rbp
movabs rbp, 0x100000001b3
mov qword [r11 + 0x18], r14
movabs r14, 0xcbf29ce484222325
nop dword [rax]
mov r9, qword [rbx]
test r9, r9
je 0x140043fcc
mov r9, qword [r9 + 0x80]
mov r8, qword [rdi + 8]
mov rax, r9
shr rax, 8
movzx ecx, al
mov rax, r9
shr rax, 0x10
movzx edx, r9b
xor rdx, r14
mov qword [rsp + 0x80], r9
imul rdx, rbp
xor rdx, rcx
movzx ecx, al
imul rdx, rbp
mov rax, r9
xor rdx, rcx
shr rax, 0x18
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x20
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x28
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x30
imul rdx, rbp
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r8 + 0x30]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + 8]
je 0x140043ec8
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x140043ebf
cmp rax, rcx
je 0x140043ec8
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x140043eb0
test rax, rax
jne 0x140043fcc
movzx eax, byte [rsp + 0x81]
mov r10, qword [rdi + 0x20]
movzx edx, r9b
xor rdx, r14
imul rdx, rbp
mov rcx, qword [r10 + 0x30]
xor rdx, rax
movzx eax, byte [rsp + 0x82]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x83]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x84]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x85]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x86]
imul rdx, rbp
xor rdx, rax
movzx eax, byte [rsp + 0x87]
imul rdx, rbp
xor rdx, rax
imul rdx, rbp
and rcx, rdx
shl rcx, 4
add rcx, qword [r10 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 8]
je 0x140043f73
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x140043f75
cmp rax, rcx
je 0x140043f73
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x140043f62
jmp 0x140043f75
xor eax, eax
test rax, rax
jne 0x140043fcc
xorps xmm0, xmm0
mov qword [rsp + 0x58], rax
mov eax, dword [rbx + 0x18]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x3c], eax
mov rcx, r10
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x44], 0x101
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x38], 6
call fcn.140023390
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
call fcn.14004a2b0
add rbx, 0x20
cmp rbx, rsi
jne 0x140043df0
mov r14, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
add rcx, 8
jmp 0x140043db0
Function at 0x140045560
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov ebx, dword [0x1401bc694]
mov rbp, r8
movzx edi, r9b
mov r14, rdx
mov rsi, rcx
lea eax, [rbx + 1]
mov dword [0x1401bc694], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str..PipeFossilize._08lx._08x
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400215e0
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x30], 0x2710
mov edx, edi
mov dword [rsp + 0x28], 0x1000
shl edx, 0x1e
or edx, 1
mov dword [rsp + 0x20], 0x1000
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x14004563a
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
mov r9, rbp
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14004563e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140045640
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x1400488a0
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
xor r12d, r12d
mov r15, rdx
mov r13, rcx
mov r14d, r12d
lea rsi, [r12 - 1]
cmp dword [rdx + 0xa8], r12d
jbe 0x14004897c
nop word [rax + rax]
mov r8d, r14d
lea rdx, str.MODULE__llx_n
lea rcx, [rsp + 0x30]
mov r8, qword [r15 + r8*8 + 0x28]
call fcn.1400215e0
mov rbp, qword [0x1401bc688]
lea rax, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140048910
test rbx, rbx
je 0x14004896c
nop
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x20], r12
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140048b07
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x140048b07
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x140048b07
add rdi, rax
sub rbx, rax
jne 0x140048920
inc r14d
cmp r14d, dword [r15 + 0xa8]
jb 0x1400488e0
mov r9, qword [r15 + 0x18]
lea rdx, str.GRAPHICS__d__llx_n
mov r8d, dword [r15 + 0xc]
lea rcx, [rsp + 0x30]
call fcn.1400215e0
mov rbp, qword [0x1401bc688]
lea rax, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov rbx, rsi
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x1400489b0
test rbx, rbx
je 0x140048a0c
nop
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x20], r12
mov r8d, ebx
mov rdx, rdi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140048b07
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x140048b07
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x140048b07
add rdi, rax
sub rbx, rax
jne 0x1400489c0
mov r9, qword [r15 + 0x20]
lea rdx, str.COMPUTE__d__llx_n
mov r8d, dword [r15 + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400215e0
mov rdi, qword [0x1401bc688]
lea rax, [rsp + 0x30]
lea rbx, [rsp + 0x30]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x140048a36
test rsi, rsi
je 0x140048a98
nop dword [rax]
nop dword [rax + rax]
lea r9, [rsp + 0xa8]
mov qword [rsp + 0x20], r12
mov r8d, esi
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140048b07
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x140048b07
mov eax, dword [rsp + 0xa8]
test eax, eax
je 0x140048b07
add rbx, rax
sub rsi, rax
jne 0x140048a50
mov rcx, r13
call fcn.14004a6c0
mov rcx, r13
call fcn.14004a8e0
mov rcx, qword [r13 + 0x750]
test rcx, rcx
je 0x140048aba
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [r13 + 0x758]
test rcx, rcx
je 0x140048acc
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [r13 + 0xe48]
mov qword [r13 + 0xe48], r12
test rcx, rcx
je 0x140048ae9
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140048b20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, [0x1401bc430]
lea rcx, [rsp + 0x38]
call fcn.140040dd0
call fcn.14004e1b0
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
call fcn.140002150
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
call fcn.1400f7084
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
call fcn.1400f7084
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14004a150
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x60
mov r10, rcx
movzx r9d, dl
lea rbx, [rcx + 0x3c8]
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, rdx
imul r9, r11
shr rax, 8
movzx r8d, al
mov rax, rdx
xor r9, r8
shr rax, 0x10
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x38
mov rcx, qword [r10 + 0x3f8]
imul r9, r11
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x3e0]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 0x3d0]
je 0x14004a23f
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14004a232
cmp rax, rcx
je 0x14004a23f
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14004a223
test rax, rax
je 0x14004a23f
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [r10 + 0x110]
test rcx, rcx
je 0x14004a25a
mov eax, 1
lock xadd dword [rcx + 0x48], eax
mov rdx, qword [rsp + 0x78]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdx
xor eax, eax
mov qword [rsp + 0x38], 4
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, r10
mov word [rsp + 0x44], 1
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 3
call fcn.14004a2b0
lea r8, [rsp + 0x78]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.140023390
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x14004a3b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov rbx, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r11, r8
shl r11, 4
add r11, rdi
mov rcx, qword [r11 + 8]
cmp rcx, r9
je 0x14004a4d6
mov rax, qword [rbx]
mov rdx, qword [r11]
cmp rax, qword [rcx + 0x10]
je 0x14004a46f
nop dword [rax + rax]
cmp rcx, rdx
je 0x14004a4d6
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x14004a460
test rcx, rcx
je 0x14004a4d6
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r11 + 8], rcx
jne 0x14004a49a
cmp rax, rcx
jne 0x14004a490
mov qword [rdi + r8*8], r9
mov qword [r11 + 8], r9
jmp 0x14004a4a6
mov r9, qword [rcx + 8]
mov qword [r11 + 8], r9
jmp 0x14004a4a6
cmp rax, rcx
jne 0x14004a4a6
mov rax, qword [rcx]
mov qword [rdi + r8*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.1400ec648
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14004a540
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
movzx r10d, r8b
movabs rbx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r10, rax
mov rax, r8
imul r10, rbx
shr rax, 8
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x10
mov r9, qword [r11 + 0x48]
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x18
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x20
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x28
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x30
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x38
mov rcx, qword [r11 + 0x70]
imul r10, rbx
xor r10, rax
imul r10, rbx
and rcx, r10
shl rcx, 4
add rcx, qword [r11 + 0x58]
mov rax, qword [rcx + 8]
cmp rax, r9
je 0x14004a69e
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x14004a618
cmp rax, rcx
je 0x14004a69e
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x14004a605
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14004a69e
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx]
mov r8, qword [rcx + 8]
test r9, r9
je 0x14004a63a
mov qword [r9 + 8], r8
jmp 0x14004a641
mov qword [r11 + 0x80], r8
test r8, r8
je 0x14004a64b
mov qword [r8], r9
jmp 0x14004a652
mov qword [r11 + 0x88], r9
mov r8, qword [r11 + 0x80]
test r8, r8
je 0x14004a66a
mov qword [r8], rcx
mov r8, qword [r11 + 0x80]
jmp 0x14004a674
mov qword [r11 + 0x88], rcx
xor r8d, r8d
mov qword [rcx + 8], r8
mov qword [rcx], 0
mov qword [r11 + 0x80], rcx
mov rcx, qword [rax + 0x18]
mov byte [rdx + 8], 1
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, rdx
mov qword [rdx], 0
mov byte [rdx + 8], 0
ret
Function at 0x14004a6c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0xe48]
test rcx, rcx
je 0x14004a8b7
mov rdx, qword [rdi + 0x408]
test rdx, rdx
je 0x14004a8b7
cmp qword [rdi + 0x20], 0
je 0x14004a891
mov qword [rsp + 0x60], 0
mov rax, qword [0x1401bca78]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
jne 0x14004a891
mov rbp, qword [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test rbp, rbp
je 0x14004a7b5
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
ja 0x14004a8d0
cmp rbp, 0x1000
jb 0x14004a785
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x14004a8d6
call fcn.1400ec60c
test rax, rax
je 0x14004a8ca
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14004a790
mov rcx, rbp
call fcn.1400ec60c
mov rbx, rax
mov qword [rsp + 0x20], rbx
lea rsi, [rbx + rbp]
mov qword [rsp + 0x30], rsi
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.1400eee20
mov r14, rsi
mov qword [rsp + 0x28], rsi
jmp 0x14004a7bf
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov r10, qword [0x1401bca78]
mov rax, qword [rdi + 0xe48]
mov r9, rbx
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x408]
mov rcx, qword [rax + 0x18]
call r10
test eax, eax
jne 0x14004a85d
lea rcx, [rdi + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14004a7f5
mov rcx, qword [rcx]
lea rdx, [0x140122eb8]
call fcn.1400f981c
mov rbp, rax
test rax, rax
je 0x14004a824
sub r14, rbx
mov r9, rax
mov r8, r14
mov edx, 1
mov rcx, rbx
call fcn.1400fa568
cmp rax, r14
je 0x14004a854
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
call fcn.140002150
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
call fcn.1400f7084
test rbp, rbp
je 0x14004a85d
mov rcx, rbp
call fcn.1400f96fc
nop
test rbx, rbx
je 0x14004a891
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x14004a886
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a8ca
mov rdx, rsi
mov rcx, rbx
call fcn.1400ec648
mov rcx, qword [rdi + 0xe48]
xor r8d, r8d
mov rdx, qword [rdi + 0x408]
mov rcx, qword [rcx + 0x18]
call qword [0x1401bc960]
mov qword [rdi + 0x408], 0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.1400f2c0c
int3
call fcn.1400026c0
int3
call fcn.140001b10
int3
Function at 0x14004a8e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0xe48]
test rcx, rcx
je 0x14004aad7
mov rdx, qword [rdi + 0x410]
test rdx, rdx
je 0x14004aad7
cmp qword [rdi + 0x40], 0
je 0x14004aab1
mov qword [rsp + 0x60], 0
mov rax, qword [0x1401bcdf8]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
jne 0x14004aab1
mov rbp, qword [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test rbp, rbp
je 0x14004a9d5
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
ja 0x14004aaf0
cmp rbp, 0x1000
jb 0x14004a9a5
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x14004aaf6
call fcn.1400ec60c
test rax, rax
je 0x14004aaea
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14004a9b0
mov rcx, rbp
call fcn.1400ec60c
mov rbx, rax
mov qword [rsp + 0x20], rbx
lea rsi, [rbx + rbp]
mov qword [rsp + 0x30], rsi
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.1400eee20
mov r14, rsi
mov qword [rsp + 0x28], rsi
jmp 0x14004a9df
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov r10, qword [0x1401bcdf8]
mov rax, qword [rdi + 0xe48]
mov r9, rbx
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x410]
mov rcx, qword [rax + 0x18]
call r10
test eax, eax
jne 0x14004aa7d
lea rcx, [rdi + 0x30]
cmp qword [rcx + 0x18], 0x10
jb 0x14004aa15
mov rcx, qword [rcx]
lea rdx, [0x140122eb8]
call fcn.1400f981c
mov rbp, rax
test rax, rax
je 0x14004aa44
sub r14, rbx
mov r9, rax
mov r8, r14
mov edx, 1
mov rcx, rbx
call fcn.1400fa568
cmp rax, r14
je 0x14004aa74
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
call fcn.140002150
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
call fcn.1400f7084
test rbp, rbp
je 0x14004aa7d
mov rcx, rbp
call fcn.1400f96fc
nop
test rbx, rbx
je 0x14004aab1
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x14004aaa6
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004aaea
mov rdx, rsi
mov rcx, rbx
call fcn.1400ec648
mov rcx, qword [rdi + 0xe48]
xor r8d, r8d
mov rdx, qword [rdi + 0x410]
mov rcx, qword [rcx + 0x18]
call qword [0x1401bcdf0]
mov qword [rdi + 0x410], 0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.1400f2c0c
int3
call fcn.1400026c0
int3
call fcn.140001b10
int3

Function at 0x14004c420
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rcx + 0x30]
mov qword [rcx + 0x30], rax
lea rdx, [rcx + 0x50]
mov qword [rcx + 0x38], rax
xor r9d, r9d
mov qword [rcx + 0x40], rax
mov rax, qword [rcx + 0x28]
mov qword [rcx + 0x48], rax
mov rcx, qword [rcx + 0x18]
mov qword [rsp + 0x20], r8
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14004c472
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14004c472
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret