joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d520
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor esi, esi
lea r15, [0x1412cc0f0]
mov r14, rdx
mov rbp, rcx
mov rdx, qword [0x1412d34a0]
mov ecx, esi
test rdx, rdx
je 0x14002d583
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r15
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002d564
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x140cc7edc]
xorps xmm6, xmm6
xorps xmm0, xmm0
cvtss2sd xmm6, xmm2
mov rdi, r15
cmovae rdi, qword [0x1412cc0f0]
movups xmmword [rsp + 0x50], xmm0
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.14002d1f0
movdqa xmm0, xmmword [0x140ccd010]
lea rcx, [rsp + 0x30]
movsxd rbx, eax
mov rdx, rbx
mov qword [rsp + 0x30], rsi
movdqu xmmword [rsp + 0x40], xmm0
call fcn.14002d9d0
cmp qword [rsp + 0x48], 0x10
lea rcx, [rsp + 0x30]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmovae rcx, qword [rsp + 0x30]
lea r8, [0x140cc7edc]
movq r9, xmm6
call fcn.14002d190
cmp qword [rsp + 0x48], 0x10
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
cmovae r8, qword [rsp + 0x30]
mov rdx, r14
mov rcx, rbp
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0x30]
call fcn.14002ca90
mov rcx, qword [0x1412d34a0]
test rcx, rcx
je 0x14002d66f
nop word [rax + rax]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, r15
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rsi], 0x35
inc rsi
cmp rsi, rcx
jb 0x14002d650
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140138a50
mov rbx, qword [rsp + 0xc8]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002d6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
mov edx, r8d
lea rcx, [rsp + 0x20]
call fcn.14000ede0
mov rdx, qword [0x1412d34a0]
lea rbp, [0x1412cc0f0]
xor ebx, ebx
mov ecx, ebx
test rdx, rdx
je 0x14002d714
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbp
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002d6f5
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r8, [rsp + 0x20]
mov r9, rbp
mov rdx, rsi
cmovae r9, qword [0x1412cc0f0]
mov rcx, rdi
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1412d34a0]
test rcx, rcx
je 0x14002d76f
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbp
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rcx
jb 0x14002d750
lea rcx, [rsp + 0x20]
call fcn.14002ca90
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140138a50
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002d7a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rsp + 0x40], rax
xorps xmm6, xmm6
mov rbp, rdx
cvtss2sd xmm6, xmm2
mov rsi, rcx
lea rcx, [0x140cc7edc]
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.14002d1f0
movdqa xmm0, xmmword [0x140ccd010]
lea rcx, [rsp + 0x20]
movsxd rbx, eax
xor edi, edi
mov rdx, rbx
mov qword [rsp + 0x20], rdi
movdqu xmmword [rsp + 0x30], xmm0
call fcn.14002d9d0
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmovae rcx, qword [rsp + 0x20]
lea r8, [0x140cc7edc]
movq r9, xmm6
call fcn.14002d190
mov rdx, qword [0x1412d34a0]
lea rbx, [0x1412cc0f0]
mov ecx, edi
test rdx, rdx
je 0x14002d863
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbx
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002d844
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea r8, [rsp + 0x20]
mov r9, rbx
mov rdx, rbp
cmovae r9, qword [0x1412cc0f0]
mov rcx, rsi
cmp qword [rsp + 0x38], 0x10
cmovae r8, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rcx, qword [0x1412d34a0]
test rcx, rcx
je 0x14002d8bf
nop
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rbx
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rdi], 0x35
inc rdi
cmp rdi, rcx
jb 0x14002d8a0
lea rcx, [rsp + 0x20]
call fcn.14002ca90
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140138a50
mov rbx, qword [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002d8f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rsi, [0x1412cc0f0]
mov r11, rdx
mov r10, rcx
mov rdx, qword [0x1412d34a0]
mov rdi, r8
mov ecx, ebx
test rdx, rdx
je 0x14002d93f
nop dword [rax + rax]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rsi
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rcx], 0x35
inc rcx
cmp rcx, rdx
jb 0x14002d920
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov r9, rsi
cmovae r9, qword [0x1412cc0f0]
cmp qword [r8 + 0x18], 0x10
jb 0x14002d95c
mov r8, qword [r8]
mov rdx, r11
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov rdx, qword [0x1412d34a0]
test rdx, rdx
je 0x14002d993
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
mov rax, rsi
cmovae rax, qword [0x1412cc0f0]
xor byte [rax + rbx], 0x35
inc rbx
cmp rbx, rdx
jb 0x14002d974
mov rcx, rdi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.14002ca90

Function at 0x140032050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140032073
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140032060
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140032080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400320a5
xor eax, eax
mov r8d, 0x534
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 6
jb 0x140032090
mov byte [rcx + 0xe], 0
mov rax, rcx
ret
Function at 0x1400320f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140032113
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140032100
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x140032520
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140032543
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140032530
mov byte [rcx + 4], 0
ret

Function at 0x140032560
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140032583
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x34]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140032570
mov byte [rcx + 5], 0
ret
Function at 0x140032640
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400326ec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14003267a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1400341d0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400326ba
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, Ordinal_27
call fcn.140138cc0
mov rcx, rbx
test rbx, rbx
jne 0x1400326a0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140036750
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400342ce
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_27
call fcn.140138cc0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1400342da
cmp rbx, rbp
jne 0x140034280
cmp qword [rsp + 0x68], r14
jne 0x1400342ad
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1400342e9
mov qword [r15], r12
mov rax, r12
jmp 0x1400342ec
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400342ad
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_27
call fcn.140138cc0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140034386
cmp rbx, rbp
jne 0x140034360
jmp 0x1400342aa
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140034300
jmp 0x1400342ad
Function at 0x1400332d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140033300
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140033328
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003332a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140033383
test ecx, ecx
jle 0x140033363
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140033383
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140033383
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sahf
cdqe
sub eax, 0x9c40efe3
invalid
Function at 0x1400333b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400333e1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400333f8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140033420
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140033422
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140033454
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
mov rbx, rdi
je 0x1400334f1
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140033492
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x1400334d1
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140033512
cmp rdi, rax
ja 0x1400334a0
test rbx, rbx
je 0x1400334f1
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
sub rbp, rdi
jmp 0x1400334f4
int 0x77
outsd dx, dword [rsi]
Function at 0x140033900
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003392d
xor eax, eax
jmp 0x140033a82
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140033958
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140033958
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140033a82
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140033a75
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14003399b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400339c6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140033a7a
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140033a35
sub eax, 1
je 0x140033a35
cmp eax, 2
jne 0x140033a75
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140033a7a
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140033a63
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140033a75
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x140033a7a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140138a50
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400341d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400326ec
mov rax, qword [rdi + 0x38]
shr rax, 3
cmp rax, rcx
jbe 0x14003267a
mov rdx, qword [rdi + 8]
mov rcx, rdi
mov r8, rdx
mov rdx, qword [rdx]
add rsp, 0x20
pop rdi
jmp 0x1400341d0
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], 0
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400326ba
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, Ordinal_27
call fcn.140138cc0
mov rcx, rbx
test rbx, rbx
jne 0x1400326a0
mov rbx, qword [rsp + 0x38]
mov rax, qword [rdi + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rdi + 8]
mov qword [rax + 8], rax
mov qword [rdi + 0x10], 0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140036750
add rsp, 0x20
pop rdi
ret
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x1400342ce
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_27
call fcn.140138cc0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x1400342da
cmp rbx, rbp
jne 0x140034280
cmp qword [rsp + 0x68], r14
jne 0x1400342ad
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x1400342e9
mov qword [r15], r12
mov rax, r12
jmp 0x1400342ec
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x1400342ad
nop word [rax + rax]
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r15, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r15, rcx
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, Ordinal_27
call fcn.140138cc0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x140034386
cmp rbx, rbp
jne 0x140034360
jmp 0x1400342aa
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x140034300
jmp 0x1400342ad
Function at 0x1400344b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140cec080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140034583
cmp byte [rcx + 0x71], 0
je 0x140034583
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14003457f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140034544
sub eax, 1
je 0x140034548
cmp eax, 2
jne 0x14003457f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140138a50
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140034576
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14003457f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14003452c
xor al, al
jmp 0x14003452c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140138a50
add rsp, 0x60
pop rbx
ret
Function at 0x1400391e0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140039211
lea rcx, [0x140cc82c0]
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x141306218]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x141306228]
lea rdx, [rdi + rdi]
call fcn.140034a70
mov rcx, qword [0x141306218]
lea r9, [rdi - 1]
mov qword [0x141306240], r9
mov qword [0x141306248], rdi
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x140039395
mov qword [rsp + 0x38], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx eax, byte [rcx + 0x11]
movzx r11d, byte [rcx + 0x10]
mov rdx, qword [rdx]
xor r11, rsi
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x12]
imul r11, rdi
xor r11, rax
movzx eax, byte [rcx + 0x13]
imul r11, rdi
xor r11, rax
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x141306228]
mov r10, qword [r11]
cmp r10, rbx
jne 0x1400392d3
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140039356
mov rax, qword [r11 + 8]
mov r9d, dword [rcx + 0x10]
cmp r9d, dword [rax + 0x10]
jne 0x140039310
mov r10, qword [rax]
cmp r10, rcx
je 0x14003930a
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140039356
mov r8, rax
cmp r10, rax
je 0x140039332
nop dword [rax + rax]
mov rax, qword [rax + 8]
mov r8, rax
cmp r9d, dword [rax + 0x10]
je 0x14003936a
cmp r10, rax
jne 0x140039320
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
je 0x140039390
mov r9, qword [0x141306240]
jmp 0x140039281
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140039356
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret