joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000328a
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [0x1400140e8], 0
jne 0x1400032a0
add rsp, 0x40
pop rbx
jmp fcn.14000324b
lea rbx, [rsp + 0x30]
mov rdx, rcx
mov rcx, rbx
call fcn.1400031c4
movaps xmm0, xmmword [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call qword [0x1400140e8]
mov rcx, rbx
call fcn.140002143
cmp byte [0x1400140c0], 0
je 0x1400032f9
mov rax, qword [0x1400140f0]
lea rcx, [0x1400140f0]
mov byte [0x1400140c0], 0
mov rdx, qword [rax + 0x38]
add rsp, 0x40
pop rbx
jmp fcn.140002515
add rsp, 0x40
pop rbx
ret

Function at 0x1400033d8
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rsi, [0x14000e37f]
mov rbp, qword [rcx]
mov rdi, qword [rcx + 8]
mov ecx, 2
call rbx
lea rdx, str.could_not_load:
mov rcx, rax
call fcn.1400020e0
test rbp, rbp
je 0x140003414
lea rsi, [rdi + 8]
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400020e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xc1
jne 0x140003449
mov ecx, 2
call rbx
lea rdx, str._n_bad_format__library_may_be_wrong_architecture_
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
lea rdx, [0x14000e3c2]
mov rcx, rax
call fcn.1400020e0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x14000346a
Capabilities:
Terminate process

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rcx
mov ecx, 2
call rbx
lea rdx, str.could_not_import:
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
mov rdx, rsi
mov rcx, rax
call fcn.1400020e0
mov ecx, 2
call rbx
lea rdx, [0x14000e3c2]
mov rcx, rax
call fcn.1400020e0
mov ecx, 1
call sub.ucrtbase.dll_exit
nop

Function at 0x140003c5d
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400140c0], 0
je 0x140003c94
mov rcx, qword [0x1400140f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400140f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140014390], xmm0
call fcn.140005028
mov rbx, qword [0x14000f530]
cmp byte [rbx], 0
jne 0x14000592a
mov word [0x140014384], 0xaa
lea rcx, [0x140014384]
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x14000592a
lea rcx, [0x140014390]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.1400058b1
nop
add rsp, 0x28
jmp 0x1400058d5
Function at 0x140005028
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
xor esi, esi
lea rdi, str.ntdll.dll
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rbx, qword [rax + 0x10]
xor eax, eax
mov rbp, qword [rbx + 0x30]
test rbp, rbp
je 0x1400050b9
movsxd rax, dword [rbp + 0x3c]
add rax, rbp
jo 0x140005076
movsxd rax, dword [rax + 0x88]
test eax, eax
je 0x140005099
add rax, rbp
jno 0x14000508b
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400021b0
movsxd rcx, dword [rax + 0xc]
mov rsi, rax
add rcx, rbp
jno 0x1400050a1
jmp 0x140005076
mov rbx, qword [rbx]
mov rax, rbp
jmp 0x140005054
cmp rcx, rdi
je 0x1400050bc
test rcx, rcx
je 0x14000509c
mov rdx, rdi
call sub.ucrtbase.dll_strcmp
test eax, eax
jne 0x14000509c
jmp 0x1400050bc
mov rbp, rax
movsxd rdi, dword [rsi + 0x1c]
mov r14d, dword [rsi + 0x18]
add rdi, rbp
jo 0x140005076
movsxd rax, dword [rsi + 0x20]
add rax, rbp
jo 0x140005076
movsxd rsi, dword [rsi + 0x24]
mov ebx, dword [rax]
add rsi, rbp
jo 0x140005076
mov r13, qword [0x14000f530]
xor r12d, r12d
mov r15d, 0x80000000
cmp r12d, r14d
jle 0x140005136
xor eax, eax
mov r9d, 1
lea r8, [rsp + 0x50]
mov rdx, qword [0x140014390]
mov qword [rsp + 0x68], rax
lea rax, [0x140004f40]
mov qword [rsp + 0x60], rax
mov rax, qword [0x140014398]
movaps xmm1, xmmword [rsp + 0x60]
lea rcx, [rax + 8]
movaps xmmword [rsp + 0x50], xmm1
call fcn.1400041ab
jmp 0x14000520a
movsxd rdx, ebx
mov rax, rbp
add rax, rdx
mov qword [rsp + 0x28], rax
jo 0x140005076
mov bx, word [rsi]
cmp byte [r13], 0
mov word [rsp + 0x36], bx
jne 0x14000520a
test rax, rax
je 0x140005174
mov rcx, rax
mov qword [rsp + 0x38], rdx
call sub.ucrtbase.dll_strlen
mov rdx, qword [rsp + 0x38]
lea rbx, [rax + 1]
mov ecx, 0xffffffff
movsxd rbx, ebx
add rbx, rdx
lea rax, [rbx + r15]
cmp rcx, rax
jb 0x140005076
mov rcx, qword [rsp + 0x28]
lea rdx, [0x14000ea6a]
add rsi, 2
call fcn.140003e30
cmp byte [r13], 0
jne 0x14000520a
test al, al
je 0x1400051f5
mov rcx, qword [rsp + 0x28]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
call fcn.140004fe3
cmp byte [r13], 0
jne 0x14000520a
movzx edx, word [rsp + 0x36]
mov qword [rsp + 0x60], rax
lea rcx, [0x140014390]
mov edx, dword [rdi + rdx*4]
mov dword [rsp + 0x68], edx
movaps xmm2, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x40]
movaps xmmword [rsp + 0x40], xmm2
call fcn.14000364a
cmp r12d, 0x7fffffff
je 0x140005076
inc r12d
jmp 0x1400050ed
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000521b
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x48], rax
call fcn.140004e96
mov rax, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [0x14000f530]
cmp byte [rsi], 0
jne 0x1400052b8
mov qword [rsp + 0x40], rax
dec rax
mov qword [rsp + 0x48], rbx
jle 0x14000531a
cmp qword [rbx + 8], 5
jne 0x14000531a
mov rax, qword [rbx + 0x10]
mov r8d, 5
lea rdx, [0x14000ec18]
lea rcx, [rax + 8]
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x14000531a
movups xmm0, xmmword [rbx + 0x18]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
call fcn.140004602
cmp byte [rsi], 0
mov rbx, rax
jne 0x1400052b8
mov rcx, rdi
call fcn.1400037d7
jmp 0x140005321
mov rcx, rdi
xor ebx, ebx
call fcn.1400037d7
cmp byte [rsi], 0
je 0x140005321
mov rax, qword [0x14000f520]
mov rax, qword [rax]
mov rax, qword [rax]
mov rdi, qword [rax + 0x18]
test rdi, rdi
je 0x140005321
mov rcx, rdi
call sub.ucrtbase.dll_strlen
cmp rax, 0x2c
jbe 0x140005321
lea rcx, [rdi + rax - 0x2d]
mov r8d, 0x2d
lea rdx, str.ValueErrorCatchableErrorExceptionRootObj
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x140005321
mov edx, 1
lea rcx, [0x14000ebd0]
mov byte [rsi], 0
call fcn.140001f44
xor ecx, ecx
call sub.ucrtbase.dll_exit
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x14000532c
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xdc07230
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x140005354
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0x2421bd37
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x14000537c
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
mov rcx, 0xd0d9f24
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x1400053a4
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
sub rsp, 0x20
movabs rcx, 0xdb05a7f6
call fcn.140004f52
add rsp, 0x20
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret
Function at 0x1400058d5
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400140c0], 0
je 0x140003c94
mov rcx, qword [0x1400140f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400140f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140014390], xmm0
call fcn.140005028
mov rbx, qword [0x14000f530]
cmp byte [rbx], 0
jne 0x14000592a
mov word [0x140014384], 0xaa
lea rcx, [0x140014384]
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x14000592a
lea rcx, [0x140014390]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.1400058b1
nop
add rsp, 0x28
jmp 0x1400058d5

Function at 0x140005936
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x1400140c0], 0
je 0x140003c94
mov rcx, qword [0x1400140f0]
test rcx, rcx
je 0x140003c94
call fcn.140003c38
lea rcx, [0x1400140f0]
xor edx, edx
call fcn.14000231d
mov ecx, 1
call sub.ucrtbase.dll_exit
nop
add rsp, 0x28
ret
push rbx
sub rsp, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000361b
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [0x140014390], xmm0
call fcn.140005028
mov rbx, qword [0x14000f530]
cmp byte [rbx], 0
jne 0x14000592a
mov word [0x140014384], 0xaa
lea rcx, [0x140014384]
call fcn.1400053cf
cmp byte [rbx], 0
jne 0x14000592a
lea rcx, [0x140014390]
call fcn.1400037c2
nop
add rsp, 0x30
pop rbx
jmp 0x140003c5d
sub rsp, 0x28
call fcn.1400058b1
nop
add rsp, 0x28
jmp 0x1400058d5

Function at 0x140005c80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, [0x14000edc0]
mov rcx, rax
call sub.ucrtbase.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.ucrtbase.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.14000c9e0
call sub.ucrtbase.dll_abort
nop
Function at 0x140006952
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140014468]
test eax, eax
je 0x1400069ea
lea rax, [0x140014440]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140014470]
mov qword [rbp - 8], rax
jmp 0x1400069ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1400069c2
cmp qword [rbp - 0x10], 0
je 0x1400069c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140006988
lea rax, [0x140014440]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1400069eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140006af0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140006b18
mov eax, 0
jmp 0x140006b66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140006b41
mov eax, 0
jmp 0x140006b66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140006b61
mov eax, 0
jmp 0x140006b66
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140006b6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140006bea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140006be1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140006be1
mov rax, qword [rbp - 8]
jmp 0x140006bff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140006bb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1400f92f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400f92fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400f930d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400f92f5
lea eax, [rcx + 1]
jmp 0x1400f931b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1400f932e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1400f9314
sub eax, 3
jb 0x1400f934e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1400f939d
sar eax, 1
movsxd rbp, eax
jb 0x1400f9384
jmp 0x1400f935c
add ebx, ebx
jne 0x1400f935a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f9384
inc ecx
add ebx, ebx
jne 0x1400f936a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1400f9384
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1400f937d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1400f936c
add ecx, 2
jmp 0x1400f9389
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1400f92b2
jmp 0x1400f92fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa8200
mov dl, 0x22
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400f93ed
cmp rsi, rcx
jae 0x1400f93f5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1400f93d4
cmp al, 0x8f
ja 0x1400f93d4
cmp byte [rsi - 2], 0xf
je 0x1400f93da
sub al, 0xe8
cmp al, 1
ja 0x1400f93be
cmp rsi, rcx
jae 0x1400f93f5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1400f93c4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400f93f5
lodsb al, byte [rsi]
jmp 0x1400f93d4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf6000]
mov eax, dword [rdi]
or eax, eax
je 0x1400f945e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x106694]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400f9402
jns 0x1400f9437
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1400f9441
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1400f9458
mov qword [rbx], rax
add rbx, 8
jmp 0x1400f9422
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1400f9498
cmp al, 0xef
ja 0x1400f948a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1400f946a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x1400f9479
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x257]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400f94ec
sub rsp, 0xffffffffffffff80
jmp 0x14007bce4
Function at 0x140008050
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [rcx]
test edx, edx
jne 0x140008078
mov dword [rcx + 4], 2
lea rax, [rcx + 4]
cmp edx, 3
jne 0x1400080a1
mov dword [rax], 4
cmp edx, 0x22
jne 0x1400080ac
mov dword [rax], 0x4a
ret
cmp edx, 1
jne 0x140008082
mov dword [rcx + 4], edx
jmp 0x14000805d
cmp edx, 2
jne 0x14000805d
lea rax, [rcx + 4]
mov dword [rax], 3
cmp edx, 0x17
jne 0x140008244
mov dword [rax], 0x38
ret
cmp edx, 4
jne 0x1400080b8
mov dword [rax], 5
cmp edx, 0x23
jne 0x1400080c3
mov dword [rax], 0x4b
ret
cmp edx, 5
jne 0x1400080cf
mov dword [rax], 6
cmp edx, 0x24
jne 0x1400080da
mov dword [rax], 0x4c
ret
cmp edx, 6
jne 0x1400080e6
mov dword [rax], 8
cmp edx, 0x25
jne 0x1400080f1
mov dword [rax], 0x4d
ret
cmp edx, 7
jne 0x1400080fd
mov dword [rax], 9
cmp edx, 0x26
jne 0x140008108
mov dword [rax], 0x4e
ret
cmp edx, 8
jne 0x140008114
mov dword [rax], 0xc
cmp edx, 0x27
jne 0x14000811f
mov dword [rax], 0x4f
ret
cmp edx, 9
jne 0x14000812b
mov dword [rax], 0xd
cmp edx, 0x28
jne 0x140008136
mov dword [rax], 0x50
ret
cmp edx, 0xa
jne 0x140008142
mov dword [rax], 0x10
cmp edx, 0x29
jne 0x14000814d
mov dword [rax], 0x51
ret
cmp edx, 0xb
jne 0x140008159
mov dword [rax], 0x11
cmp edx, 0x2a
jne 0x140008164
mov dword [rax], 0x52
ret
cmp edx, 0xc
jne 0x140008170
mov dword [rax], 0x12
cmp edx, 0x2b
jne 0x14000817b
mov dword [rax], 0x53
ret
cmp edx, 0xd
jne 0x140008187
mov dword [rax], 0x13
cmp edx, 0x2c
jne 0x140008192
mov dword [rax], 0x54
ret
cmp edx, 0xe
jne 0x14000819e
mov dword [rax], 0x14
cmp edx, 0x2d
jne 0x1400081a9
mov dword [rax], 0x55
ret
cmp edx, 0xf
jne 0x1400081b5
mov dword [rax], 0x30
cmp edx, 0x2e
jne 0x1400081c0
mov dword [rax], 0x56
ret
cmp edx, 0x10
jne 0x1400081cc
mov dword [rax], 0x31
cmp edx, 0x2f
jne 0x1400081d7
mov dword [rax], 0x57
ret
cmp edx, 0x11
jne 0x1400081e3
mov dword [rax], 0x32
cmp edx, 0x30
jne 0x1400081ee
mov dword [rax], 0x58
ret
cmp edx, 0x12
jne 0x1400081fa
mov dword [rax], 0x33
cmp edx, 0x31
jne 0x140008205
mov dword [rax], 0x59
ret
cmp edx, 0x13
jne 0x140008211
mov dword [rax], 0x34
cmp edx, 0x32
jne 0x14000821c
mov dword [rax], 0x5a
ret
cmp edx, 0x14
jne 0x140008228
mov dword [rax], 0x35
cmp edx, 0x33
jne 0x140008227
mov dword [rax], 0x18
ret
cmp edx, 0x15
jne 0x140008234
mov dword [rax], 0x36
ret
cmp edx, 0x16
jne 0x140008091
mov dword [rax], 0x37
ret
cmp edx, 0x18
jne 0x140008250
mov dword [rax], 0x39
ret
cmp edx, 0x19
jne 0x14000825c
mov dword [rax], 0x41
ret
cmp edx, 0x1a
jne 0x140008268
mov dword [rax], 0x42
ret
cmp edx, 0x1b
jne 0x140008274
mov dword [rax], 0x43
ret
cmp edx, 0x1c
jne 0x140008280
mov dword [rax], 0x44
ret
cmp edx, 0x1d
jne 0x14000828c
mov dword [rax], 0x45
ret
cmp edx, 0x1e
jne 0x140008298
mov dword [rax], 0x46
ret
cmp edx, 0x1f
jne 0x1400082a4
mov dword [rax], 0x47
ret
cmp edx, 0x20
jne 0x1400082b0
mov dword [rax], 0x48
ret
cmp edx, 0x21
jne 0x14000806c
mov dword [rax], 0x49
ret
Function at 0x14000a3b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14000a3e5
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140009fa0
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14000a526
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14000a4a0
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14000a515
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14000a4dd
mov r10, qword [rdx]
cmp r10, rax
je 0x14000a4d7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14000a515
cmp r9, rdx
je 0x14000a4f1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14000a537
cmp r9, rdx
jne 0x14000a4e2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x14000a450
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14000a515
Function at 0x14000c0b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000c10d
lea rbx, [0x140043ce0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000c0f4
cmp r10, 2
jb 0x14000c0f4
cmp byte [r9], r8b
jne 0x14000c0f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000c0d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000c14f
lea rbx, [0x140043ce0]
cmp r8b, 0x23
jne 0x14000c133
cmp byte [r9], r8b
jne 0x14000c133
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000c120
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000c290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000c2aa
mov qword [r8], 0
lea rdx, [0x14004387c]
call fcn.14000c160
mov rbx, rax
test rax, rax
jne 0x14000c2ca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000c3a1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c3a1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000c3a1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000c3a1
cmp rdi, 0xffffffffffffffff
je 0x14000c3a1
mov rax, qword [0x140139df8]
test rax, rax
je 0x14000c33e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000c3a1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000c38e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140139df8]
test rax, rax
je 0x14000c383
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000c3aa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000c39c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000c3ac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000f560
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xe8]
mov rax, qword [rcx + 0xf0]
movsxd r9, edx
mov ebx, dword [rax + r8*4 - 4]
lea r8, [0x140043ce0]
not ebx
movzx eax, r9b
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r8 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [0x140139df8]
xor ebx, dword [r8 + rdx*4]
not ebx
cmp dword [rcx + 0x3ee8], ebx
jne 0x14000f5f6
mov r8, r9
mov edx, 4
mov ecx, ebx
call fcn.140021960
mov eax, ebx
add rsp, 0x20
pop rbx
ret