joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140961bcb
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
mov r9, qword [rsp + 0x2c]
mov dx, sp
bts r10w, r13w
mov qword [rsp + 0x14], rbp
mov edx, 0xc60cb78
jmp 0x1409614f8
xchg r9w, r12w
not dx
mov r10w, si
neg r11b
pop r11w
rol r12b, 2
jmp 0x1409614a9
push rbp
bts r11w, r8w
pop rcx
add rsp, 0xf
pop si
jmp 0x140961515
add rsp, 0x20
lea r10, [rax + rdi]
lea rbx, [rbx + rbx]
xchg qword [rsp + 8], r11
pop word [rsp + 0xb]
bsf r9w, bx
jmp 0x1409614e2
mov word [rsp], r9w
xchg word [rsp], r12w
bswap r12d
setp r9b
xchg byte [rsp], r12b
jmp 0x140961733
pushfq
sub rsp, 4
xchg r8, r10
sub rsp, 0x1e
lea rcx, [rax + riz - 0xfda8]
adc r11w, r14w
jmp 0x1409614ca
lea r12, [r14 + riz + 0xd30a]
mov si, word [rsp + 2]
call 0x14096154e
mov qword [rsp], r10
mov r12, qword [rsp + 6]
lea r10, [r13 + r13]
xchg edi, edx
mov bl, r15b
mov r12w, word [rsp + 6]
jmp 0x1409615e9
mov r11, 0x69a8b051
mov r8w, 0x2a29
sub rsp, 0
bswap rsi
cpuid
mov r12, r13
jmp 0x140961576
btc edx, ecx
mov eax, dword [rsp]
mov word [rsp], bx
xchg rsi, rdx
mov byte [rsp + 1], r14b
rdtsc
jmp 0x140961614
xchg r8w, di
xchg word [rsp + 0xc], di
mov r10b, dl
pop rax
push word [rsp + 7]
pop rdx
jmp 0x1409615cb
lea r9, [rdx + r13]
xchg byte [rsp + 1], bl
xchg r12b, al
jmp 0x140961662
not esi
bsf rax, rcx
sub r10d, 0x6c94e63d
bswap r8
bswap r12d
jmp 0x1409615fe
std
xchg qword [rsp], rbx
bsf rcx, rbx
mov rbx, 0x422f8c4a
xchg word [rsp + 1], r9w
mov rdx, qword [rsp]
jmp 0x1409615b1
lea rsp, [rsp + 9]
bsr dx, r9w
bsf r10w, r10w
jmp 0x1409616a7
lea rsi, [rbx + riz - 0xfb5a]
mov r10, qword [rsp]
dec dil
lea rax, [rdx + r13]
sub rsp, 0x16
pop bx
jmp 0x14096164c
mov qword [rsp], rdx
lea r12, [rsi + rsi]
mov r10w, 0x73f8
sbb rdx, rbp
mov dword [rsp + 6], r14d
rdtsc
jmp 0x1409616d8
xchg al, r9b
bt si, dx
mov r10b, cl
mov bl, dil
lea rsp, [rsp]
xchg word [rsp + 9], cx
jmp 0x14096167e
xchg r11d, eax
mov r12, rax
xchg byte [rsp + 2], cl
bsf r8w, r15w
cpuid
rcr ax, 1
jmp 0x140961709
bsf r11, r14
mov qword [rsp], rdi
mov ecx, 0xb154c022
mov cx, word [rsp + 6]
mov sil, dl
lea r9, [rdx + r9]
jmp 0x1409616bf
xchg qword [rsp], r8
lea rsp, [rsp + 4]
mov dl, 0xf0
jmp 0x140961795
pop word [rsp + 6]
lea r11, [rcx + riz]
bswap r11d
xchg r12b, dil
mov word [rsp], r9w
mov r10d, 0xff3e51b8
jmp 0x1409616f3
bswap r11d
clc
lea rbx, [rbp + riz + 0x3c]
add rsp, 1
mov di, 0x8ef7
pushfq
jmp 0x14096162d
lea rdi, [rax + rsi]
bsr di, bp
lea r9, [r8 + r15]
jmp 0x14096177c
mov rsi, qword [rsp + 8]
mov r11d, dword [rsp]
rdtsc
inc rcx
bsr bx, r11w
mov rdx, 0xffffffffc29bcdcd
jmp 0x14096174a
mov r12, 0x58a1a72f
mov rax, qword [rsp + 0x10]
sub rsp, 5
jmp 0x140961849
lea rdx, [rbp + riz - 0xa681]
mov esi, dword [rsp]
dec si
mov rax, qword [rsp]
inc r11b
mov rdx, qword [rsp]
jmp 0x140961760
xchg r8, r9
lea rbx, [0xffffffffbc5e8044]
clc
mov r11d, eax
mov r12, qword [rsp]
call fcn.1409617c6
xchg word [rsp + 1], di
mov word [rsp], r9w
sub ecx, edx
mov r12b, 0xfe
lea rsp, [rsp + 5]
mov r10, qword [rsp + 0x18]
jmp 0x140961812
cmc
xchg sil, r12b
mov r12b, byte [rsp + 0xa]
mov r8d, r10d
pop r8w
cpuid
jmp 0x140961531
rdtsc
inc rbx
lea rsp, [rsp + 2]
mov edi, ebx
mov qword [rsp], r15
jmp 0x140961914
Function at 0x140962e97
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
call fcn.14096202e
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x140962029
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x140962697
lea rsp, [rsp + 5]
mov qword [rsp], r15
mov dword [rsp + 0xb], r11d
mov qword [rsp + 0x1d], r8
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x28]
jmp 0x1409626c2
mov word [rsp + 0x20], r9w
jmp 0x1409628cf
Function at 0x1400dbce0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400dbced
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400dbcfd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400dbce5
lea eax, [rcx + 1]
jmp 0x1400dbd0b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400dbd1e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400dbd04
sub eax, 3
jb 0x1400dbd3e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400dbd8d
sar eax, 1
movsxd rbp, eax
jb 0x1400dbd74
jmp 0x1400dbd4c
add ebx, ebx
jne 0x1400dbd4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400dbd74
inc ecx
add ebx, ebx
jne 0x1400dbd5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400dbd74
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400dbd6d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400dbd5c
add ecx, 2
jmp 0x1400dbd79
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400dbca2
jmp 0x1400dbced
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x8b600
mov dl, 0xc
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400dbdd9
cmp rsi, rcx
jae 0x1400dbde1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400dbdc0
cmp al, 0x8f
ja 0x1400dbdc0
cmp byte [rsi - 2], 0xf
je 0x1400dbdc6
sub al, 0xe8
cmp al, 1
ja 0x1400dbdaa
cmp rsi, rcx
jae 0x1400dbde1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400dbdb0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400dbde1
lodsb al, byte [rsi]
jmp 0x1400dbdc0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd9000]
mov eax, dword [rdi]
or eax, eax
je 0x1400dbe3e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xdb798]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400dbdee
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400dbe38
mov qword [rbx], rax
add rbx, 8
jmp 0x1400dbe0e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400dbe78
cmp al, 0xef
ja 0x1400dbe6a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400dbe4a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400dbe59
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x20f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400dbecc
sub rsp, 0xffffffffffffff80
jmp 0x14000e57c
Function at 0x14001a06c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov rdi, rcx
call fcn.14001a914
mov qword [rdi + 0x28], rax
test rax, rax
jne 0x14001a0a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x14001a12d
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x14001a0dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rcx, rdi
mov ebx, eax
call fcn.14001a144
mov eax, ebx
jmp 0x14001a12d
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
nop dword [rax + rax]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x14001a0c3
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
nop dword [rax + rax]
mov dword [rdi + 0x18], eax
test eax, eax
je 0x14001a0c3
mov rcx, qword [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LockResource]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
je 0x14001a0c3
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001af98
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140033880], eax
call fcn.14001b6d0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140033880], 0
jne case.default.0x14001afee
mov ecx, 1
call fcn.14001b6d0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
invalid
Function at 0x14003a060
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14003a06d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14003a07d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14003a065
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14003a095
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14003a082
sub eax, 3
jb 0x14003a0af
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14003a0e6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14003a0d6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14003a0d4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14003a0c3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14003a022
jmp 0x14003a06d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x15000
mov dl, 5
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14003a132
cmp rsi, rcx
jae 0x14003a13a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14003a119
cmp al, 0x8f
ja 0x14003a119
cmp byte [rsi - 2], 0xf
je 0x14003a11f
sub al, 0xe8
cmp al, 1
ja 0x14003a103
cmp rsi, rcx
jae 0x14003a13a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14003a109
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14003a13a
lodsb al, byte [rsi]
jmp 0x14003a119
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x36000]
mov eax, dword [rdi]
or eax, eax
je 0x14003a1a3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x3d2e0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14003a147
jns 0x14003a17c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14003a186
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14003a19d
mov qword [rbx], rax
add rbx, 8
jmp 0x14003a167
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14003a1dd
cmp al, 0xef
ja 0x14003a1cf
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14003a1af
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14003a1be
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14003a231
sub rsp, 0xffffffffffffff80
jmp 0x140002504
Function at 0x81c480
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x81c48d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x81c49d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x81c485
lea eax, [rcx + 1]
jmp 0x81c4ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x81c4be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x81c4a4
sub eax, 3
jb 0x81c4de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x81c52d
sar eax, 1
movsxd rbp, eax
jb 0x81c514
jmp 0x81c4ec
add ebx, ebx
jne 0x81c4ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x81c514
inc ecx
add ebx, ebx
jne 0x81c4fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x81c514
call r11
adc ecx, ecx
add ebx, ebx
jne 0x81c50d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x81c4fc
add ecx, 2
jmp 0x81c519
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0081c442
jmp 0x81c48d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x3c3000
mov dl, 0xb9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x81c579
cmp rsi, rcx
jae 0x81c581
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x81c560
cmp al, 0x8f
ja 0x81c560
cmp byte [rsi - 2], 0xf
je 0x81c566
sub al, 0xe8
cmp al, 1
ja 0x81c54a
cmp rsi, rcx
jae 0x81c581
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x81c550
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x81c581
lodsb al, byte [rsi]
jmp 0x81c560
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x41a000]
mov eax, dword [rdi]
or eax, eax
je 0x81c5de
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x41c000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x81c58e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x81c5d8
mov qword [rbx], rax
add rbx, 8
jmp 0x81c5ae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x81c636
sub rsp, 0xffffffffffffff80
jmp 0x454e00
Function at 0x140004420
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1400850c0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov eax, dword [rcx + 0x40]
mov edi, r8d
movzx esi, byte [rcx + 0xd8]
cmp r8d, eax
mov rbx, rcx
setge bpl
jge 0x14000446b
test sil, sil
je 0x140004550
add rcx, 8
cmp qword [rbx + 0x20], 0xf
jbe 0x14000447a
mov rcx, qword [rbx + 8]
movups xmm0, xmmword [r9]
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x30], rcx
movaps xmmword [rsp + 0x50], xmm0
movups xmm0, xmmword [rdx]
mov qword [rsp + 0x38], rax
movaps xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [rdx + 0x10]
movsd qword [rsp + 0x20], xmm0
call fcn.140037604
movups xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov rax, qword gs:[0x58]
mov edx, 0xc
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], edi
mov rcx, qword [rax]
mov r8d, 0x10
mov eax, dword [rdx + rcx]
test al, 1
jne 0x1400044f1
or eax, 1
lea rdi, [rcx + r8]
mov dword [rdx + rcx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rdi], rax
jmp 0x1400044f5
lea rdi, [r8 + rcx]
mov rax, qword [rdi]
lea rdx, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x40]
movzx r9d, sil
movsd xmm1, qword [rsp + 0x20]
movzx r8d, bpl
mov qword [rsp + 0x80], rax
mov rcx, rbx
xor eax, eax
movsd qword [rsp + 0xa8], xmm1
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0x88], rax
movaps xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0xb0], xmm0
call fcn.140005e00
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140038a60
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140009540
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140009562
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400095dc
mov rdi, r14
mov rcx, rbx
call fcn.14000bc10
test rax, rax
jle 0x1400095b4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140063850
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400095cc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400095d4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140009576
sub r14, rdi
jmp 0x1400096bf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400095f3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400095f5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009627
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140063850
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400096bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140009662
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000969d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140048cd8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400096bc
cmp rbp, rax
ja 0x140009670
test rbp, rbp
je 0x1400096bc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140048cd8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140017210
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x14001738c
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.14000bdc0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140017355
mov qword [rsp + 0x58], rbp
movabs rdi, 0xcbf29ce484222325
movabs rbp, 0x100000001b3
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
mov edx, r9d
mov rcx, qword [rcx]
xor rdx, rdi
imul rdx, rbp
and r11, rdx
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rbx
jne 0x1400172d3
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140017344
mov rdx, qword [r11 + 8]
cmp r9b, byte [rdx + 0x10]
jne 0x14001730c
mov r10, qword [rdx]
cmp r10, rax
je 0x140017306
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140017344
cmp r8, rdx
je 0x140017320
mov rdx, qword [rdx + 8]
cmp r9b, byte [rdx + 0x10]
je 0x140017366
cmp r8, rdx
jne 0x140017311
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400172a1
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140017344
lea rcx, str.invalid_hash_bucket_count
call fcn.140037a00
int3
Function at 0x140019f80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x1400850c0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx + 0x10]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14001a176
mov rbx, qword [rcx + 0x18]
mov qword [rsp + 0x30], rbx
mov rcx, rbx
call fcn.1400380a4
test eax, eax
jne 0x14001a1a3
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x14001a1ae
xor r14d, r14d
mov qword [rsi + 0x28], r14
mov qword [rsi + 0x30], r14
xor edx, edx
mov r8d, 0x120
lea rcx, [rsp + 0x50]
call fcn.140063ef0
mov qword [rsp + 0x60], r14
lea r15, vtable.fmt::v10::basic_memory_buffer_char__250__class_std::allocator_char__.0
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], 0xfa
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
mov rdx, rsi
call qword [rax + 8]
cmp byte [rdi + 0x20], r14b
je 0x14001a10a
mov r8, qword [rsi + 0x28]
cmp qword [rsi + 0x30], r8
jbe 0x14001a10a
test r8, r8
je 0x14001a06a
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movsxd rax, dword [rsi + 0x10]
movzx ebp, word [rdi + rax*2 + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x14001a08b
lea ebp, [rax + 7]
jmp 0x14001a0a6
mov edx, dword [rsp + 0x40]
and edx, 0xfff0
or edx, ebp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movzx ebp, word [rsp + 0x40]
mov r8, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x28]
cmp r8, rcx
jbe 0x14001a0d0
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
movzx edx, bp
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, qword [rsi + 0x30]
mov r8, qword [rsp + 0x60]
cmp r8, rcx
jbe 0x14001a12e
sub r8d, ecx
mov rdx, qword [rsp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteConsoleA]
jmp 0x14001a12e
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x14001a16e
mov rdx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a168
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001a19d
call fcn.140038a80
nop
mov rcx, rbx
call fcn.1400380ac
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140038a60
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x180
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1400494e8
nop
mov ecx, 5
call fcn.140037844
int3
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call fcn.140037844
int3