joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c200
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x40]
xor ebx, ebx
mov dword [0x1405cec30], eax
mov eax, dword [rsp + 0x24]
mov dword [0x1405cec34], eax
mov eax, dword [rsp + 0x48]
mov dword [0x1405cec38], eax
mov dword [rsp + 0x60], ebx
mov byte [0x1405cec3d], bl
call fcn.14001db50
test al, al
je 0x14001c26e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
test eax, eax
je 0x14001c26e
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14001c26e
inc eax
mov byte [0x1405cec3d], 1
mov dword [0x1405cecc0], eax
mov byte [0x1405cec3e], bl
mov word [rsp + 0x60], bx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov edi, 1
test eax, eax
jne 0x14001c2ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001c2ab
movzx eax, word [rsp + 0x60]
jmp 0x14001c2b2
mov eax, edi
mov word [rsp + 0x60], ax
cmp ax, di
seta cl
call fcn.14001d990
test al, al
je 0x14001c2db
call fcn.14001bfe0
test al, al
je 0x14001c2db
cmp dword [0x1405cecc4], edi
seta al
mov byte [0x1405cec3e], al
jmp 0x14001c2e2
movzx eax, byte [0x1405cec3e]
test al, al
je 0x14001c330
mov r9d, dword [0x1405cecc8]
test r9, r9
je 0x14001c3b3
lea r8, [0x1405cec40]
nop dword [rax]
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
inc rbx
mov rax, qword [rdx]
bts rax, rcx
mov qword [rdx], rax
cmp rbx, r9
jb 0x14001c300
mov al, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x14001c3b3
mov r9, qword [rsp + 0x60]
lea r8, [0x1405cec40]
nop dword [rax]
test r9, rdi
je 0x14001c381
mov rcx, rbx
mov rax, rbx
shr rax, 6
and ecx, 0x3f
lea rdx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rcx
mov qword [rdx], rax
rol rdi, 1
test r9, rdi
je 0x14001c3a6
lea rdx, [rbx + 1]
mov rax, rdx
and edx, 0x3f
shr rax, 6
lea rcx, [r8 + rax*8]
mov rax, qword [r8 + rax*8]
bts rax, rdx
mov qword [rcx], rax
rol rdi, 1
add rbx, 2
cmp rbx, 0x40
jb 0x14001c360
mov rbx, qword [rsp + 0x70]
mov al, 1
add rsp, 0x50
pop rdi
ret
Function at 0x14006fba0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.14006d840
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.14006df70
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.14006e6a0
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14006e6a0

Function at 0x14006fcc0
Capabilities:
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r9
mov r12, r8
mov r13, rdx
call fcn.14006df70
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r9, r14
mov rdi, qword [rsp + 0x78]
mov r8, rsi
mov rbx, qword [rsp + 0x70]
mov rdx, rdi
mov rcx, rbx
call fcn.14006d840
vmovdqu32 zmm3, zmmword [rbx]
vpmaxsd zmm1, zmm3, zmmword [r15]
mov rax, qword [rsp + 0x50]
mov r9, r15
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r15]
vmovdqu32 zmmword [r15], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r12]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r12]
vmovdqu32 zmmword [r12], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r13]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r13]
vmovdqu32 zmmword [r13], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
mov r8, r12
mov rdx, r13
mov rcx, rax
vzeroupper
call fcn.14006e8a0
mov r9, r14
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.14006e8a0
Function at 0x1400713a0
Capabilities:
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xa8]
mov r14, qword [rsp + 0xa0]
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], r13
mov qword [r11 - 0x50], r12
mov qword [r11 - 0x58], r14
call fcn.14006fba0
mov r15, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r15
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.14006df70
vmovdqu32 zmm3, zmmword [rbx]
mov rax, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
vpmaxsd zmm1, zmm3, zmmword [rax]
mov rcx, qword [rsp + 0x80]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [rax]
vmovdqu32 zmmword [rax], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r13]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r13]
vmovdqu32 zmmword [r13], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [r12]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [r12]
vmovdqu32 zmmword [r12], zmm0
vmovdqu32 zmm4, zmmword [r15]
vpmaxsd zmm0, zmm4, zmmword [r14]
vmovdqu32 zmmword [r15], zmm0
vpminsd zmm1, zmm4, zmmword [r14]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
vmovdqu32 zmmword [r14], zmm1
mov qword [rsp + 0x20], r14
vzeroupper
call fcn.14006fde0
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.14006e6a0
Function at 0x1400732a0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], r9
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [rsp + 0xb8]
mov qword [r11 - 0x40], rax
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x48], rax
mov rax, qword [rsp + 0xa8]
mov qword [r11 - 0x50], rax
mov rax, qword [rsp + 0xa0]
mov qword [r11 - 0x58], rax
call fcn.14006fba0
mov rax, qword [rsp + 0xf8]
mov r13, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov r9, r14
mov rdi, qword [rsp + 0xc8]
mov r8, rsi
mov rbx, qword [rsp + 0xc0]
mov rdx, rdi
mov r15, qword [rsp + 0xe0]
mov rcx, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.14006fcc0
vmovdqu32 zmm3, zmmword [rbx]
mov r9, qword [rsp + 0xb8]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa8]
mov rax, qword [rsp + 0xa0]
vpmaxsd zmm1, zmm3, zmmword [r9]
vmovdqu32 zmmword [rbx], zmm1
vpminsd zmm0, zmm3, zmmword [r9]
vmovdqu32 zmmword [r9], zmm0
vmovdqu32 zmm4, zmmword [rdi]
vpmaxsd zmm0, zmm4, zmmword [r8]
mov r10, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov r11, qword [rsp + 0x90]
vmovdqu32 zmmword [rdi], zmm0
vpminsd zmm1, zmm4, zmmword [r8]
vmovdqu32 zmmword [r8], zmm1
vmovdqu32 zmm3, zmmword [rsi]
vpmaxsd zmm1, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rsi], zmm1
vpminsd zmm0, zmm3, zmmword [rdx]
vmovdqu32 zmmword [rdx], zmm0
vmovdqu32 zmm4, zmmword [r14]
vpmaxsd zmm0, zmm4, zmmword [rax]
vmovdqu32 zmmword [r14], zmm0
vpminsd zmm1, zmm4, zmmword [rax]
vmovdqu32 zmmword [rax], zmm1
vmovdqu32 zmm3, zmmword [r15]
vpmaxsd zmm1, zmm3, zmmword [r10]
vmovdqu32 zmmword [r15], zmm1
vpminsd zmm0, zmm3, zmmword [r10]
vmovdqu32 zmmword [r10], zmm0
vmovdqu32 zmm4, zmmword [r12]
vpmaxsd zmm0, zmm4, zmmword [r11]
vmovdqu32 zmmword [r12], zmm0
vpminsd zmm1, zmm4, zmmword [r11]
vmovdqu32 zmmword [r11], zmm1
vmovdqu32 zmm3, zmmword [r13]
vpmaxsd zmm1, zmm3, zmmword [rcx]
vmovdqu32 zmmword [r13], zmm1
vpminsd zmm0, zmm3, zmmword [rcx]
vmovdqu32 zmmword [rcx], zmm0
mov rcx, qword [rsp + 0xf8]
mov qword [rsp + 0x38], r9
mov r9, r10
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x28], rdx
vmovdqu32 zmm4, zmmword [rcx]
vpmaxsd zmm0, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rcx], zmm0
vpminsd zmm1, zmm4, zmmword [rbx]
vmovdqu32 zmmword [rbx], zmm1
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x88]
mov r8, r11
vzeroupper
call fcn.14006fde0
mov rax, qword [rsp + 0xf8]
mov r9, r14
mov rcx, qword [rsp + 0xc0]
mov r8, rsi
mov qword [rsp + 0xb8], rax
mov rdx, rdi
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xa0], r15
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
jmp fcn.14006fde0
Function at 0x1400804b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400804fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400804fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400804fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400804fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400804fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400804fc
xor al, al
add rsp, 0x28
ret
Function at 0x140094cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140094cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140094cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1400e4f10
Capabilities:
Read file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140007a50
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_ReadFile
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1400e4fd1
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1400e51d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0xc0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140007a50
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_WriteFile
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1400e5291
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400f7dd0
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rdi
sub rsp, 0x68
lea rbp, [rsp + 0x70]
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp + 0x10], rcx
movabs rax, 0xcdcdcdcdcdcdcdcd
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x40]
mov dword [rbp - 0xc], eax
cmp dword [rbp - 0xc], 0xffffffff
je 0x1400f7e15
mov eax, dword [rbp - 0xc]
add rsp, 0x68
pop rdi
pop rbp
ret
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp + 0x10]
mov r9d, 4
call fcn.14023eda0
mov dword [rbp - 0x3c], eax
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x1c], eax
cmp dword [rbp - 0x1c], 0
je 0x1400f7e70
mov ecx, dword [rbp - 0x1c]
call fcn.14023ece0
mov dword [rbp - 0x40], eax
mov ecx, dword [rbp - 0x40]
mov dword [rbp - 0x34], ecx
mov ecx, dword [rbp - 0x34]
lea rdx, [0x1405a7008]
call fcn.1401d4810
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp - 0x48]
call fcn.140007340
xor eax, eax
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x30
test eax, eax
jne 0x1400f7e8a
mov eax, dword [rbp - 0x20]
or eax, 0x40000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 2
test eax, eax
je 0x1400f7e9f
mov eax, dword [rbp - 0x20]
or eax, 0x80000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x800
test eax, eax
je 0x1400f7eb6
mov eax, dword [rbp - 0x20]
or eax, 0x10000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 4
test eax, eax
je 0x1400f7ecb
mov eax, dword [rbp - 0x20]
or eax, 0x8000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 0x1000
test eax, eax
je 0x1400f7ee2
mov eax, dword [rbp - 0x20]
or eax, 0x4000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x18]
and eax, 8
test eax, eax
je 0x1400f7ef7
mov eax, dword [rbp - 0x20]
or eax, 0x20000000
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x20]
mov dword [rbp - 0x38], eax
mov rax, qword [rbp + 0x10]
mov ecx, dword [rbp - 0x20]
mov dword [rax + 0x40], ecx
mov eax, dword [rbp - 0x38]
add rsp, 0x68
pop rdi
pop rbp
ret

Function at 0x140128f40
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
push rdi
lea rbp, [rsp + 8]
mov dword [rbp + 0x10], ecx
mov eax, dword [rbp + 0x10]
shr eax, 0xf
xor eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
imul eax, dword [rbp + 0x10], 0x85ebca77
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
shr eax, 0xd
xor eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
imul eax, dword [rbp + 0x10], 0xc2b2ae3d
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
shr eax, 0x10
xor eax, dword [rbp + 0x10]
mov dword [rbp + 0x10], eax
mov eax, dword [rbp + 0x10]
pop rdi
pop rbp
ret
Function at 0x14015c2f0
Capabilities:
Hash data using sha1

Disassembly:
push rbp
push rdi
sub rsp, 0x38
lea rbp, [rsp + 0x40]
xor eax, eax
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x18], rax
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
cmp qword [rcx], 0
jne 0x14015c33d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x10], rcx
lea rcx, [0x1404d1850]
mov edx, 0x55
call fcn.140006f00
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 0x18]
call fcn.140007120
xor eax, eax
cdqe
mov rdx, qword [rbp + 0x10]
mov qword [rdx + 8], rax
mov rax, qword [rbp + 0x10]
xor edx, edx
mov dword [rax + 0x10], edx
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0x50
cmp edx, dword [rax + 8]
jb 0x14015c368
call fcn.140234020
mov ecx, edx
lea rax, [rax + rcx*4 + 0x10]
mov dword [rax], 0x67452301
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0x51
cmp edx, dword [rax + 8]
jb 0x14015c38b
call fcn.140234020
mov ecx, edx
lea rax, [rax + rcx*4 + 0x10]
mov dword [rax], 0xefcdab89
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0x52
cmp edx, dword [rax + 8]
jb 0x14015c3ae
call fcn.140234020
mov ecx, edx
lea rax, [rax + rcx*4 + 0x10]
mov dword [rax], 0x98badcfe
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0x53
cmp edx, dword [rax + 8]
jb 0x14015c3d1
call fcn.140234020
mov ecx, edx
lea rax, [rax + rcx*4 + 0x10]
mov dword [rax], 0x10325476
mov rax, qword [rbp + 0x10]
mov rax, qword [rax]
mov edx, 0x54
cmp edx, dword [rax + 8]
jb 0x14015c3f4
call fcn.140234020
mov ecx, edx
lea rax, [rax + rcx*4 + 0x10]
mov dword [rax], 0xc3d2e1f0
nop
add rsp, 0x38
pop rdi
pop rbp
ret

Function at 0x1401c1620
Capabilities:
Hash data using djb2

Disassembly:
push rbp
push rdi
sub rsp, 0x38
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0xc], 0x1505
xor ecx, ecx
mov dword [rbp - 0x10], ecx
nop
jmp 0x1401c166c
mov ecx, dword [rbp - 0xc]
shl ecx, 5
add ecx, dword [rbp - 0xc]
mov dword [rbp - 0x1c], ecx
mov rcx, qword [rbp + 0x10]
mov edx, dword [rbp - 0x10]
cmp dword [rcx], ecx
call fcn.1401042d0
mov dword [rbp - 0x20], eax
mov eax, dword [rbp - 0x1c]
xor eax, dword [rbp - 0x20]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0x10]
inc eax
mov dword [rbp - 0x10], eax
mov ecx, dword [rbp - 0x10]
mov dword [rbp - 0x14], ecx
mov rcx, qword [rbp + 0x10]
cmp dword [rcx], ecx
call fcn.140104320
mov dword [rbp - 0x18], eax
mov ecx, dword [rbp - 0x14]
cmp ecx, dword [rbp - 0x18]
jl 0x1401c163e
mov eax, dword [rbp - 0xc]
add rsp, 0x38
pop rdi
pop rbp
ret
Function at 0x140239300
Capabilities:
Get geographical location

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
mov dword [rbp + 0x28], r9d
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x58], rcx
mov edx, dword [rbp + 0x18]
mov dword [rbp - 0x4c], edx
mov r8, qword [rbp + 0x20]
mov qword [rbp - 0x60], r8
mov r9d, dword [rbp + 0x28]
mov dword [rbp - 0x50], r9d
lea rcx, [rbp - 0x88]
call fcn.140007a50
mov rcx, qword [rbp - 0x58]
mov edx, dword [rbp - 0x4c]
mov r8, qword [rbp - 0x60]
mov r9d, dword [rbp - 0x50]
call sub.KERNEL32.dll_GetLocaleInfoEx
mov esi, eax
lea rcx, [rbp - 0x88]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.1402393ae
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140239a20
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x50], rcx
lea rcx, [rbp - 0x78]
call fcn.140007a50
mov rcx, qword [rbp - 0x50]
call sub.KERNEL32.dll_DeleteFileW
mov esi, eax
lea rcx, [rbp - 0x78]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.140239a9c
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140239f70
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov ecx, dword [rbp + 0x10]
mov dword [rbp - 0x4c], ecx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x54], rdx
lea rcx, [rbp - 0x80]
call fcn.140007a50
mov ecx, dword [rbp - 0x4c]
mov rdx, qword [rbp - 0x54]
call sub.KERNEL32.dll_GetCurrentDirectoryW
mov esi, eax
lea rcx, [rbp - 0x80]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.140239ff8
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14023a4d0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov edx, dword [rbp + 0x18]
mov dword [rbp - 0x4c], edx
lea rcx, [rbp - 0x80]
call fcn.140007a50
mov rcx, qword [rbp - 0x54]
mov edx, dword [rbp - 0x4c]
call sub.KERNEL32.dll_GetSystemDirectoryW
mov esi, eax
lea rcx, [rbp - 0x80]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14023a558
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x14023a580
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
xor eax, eax
mov dword [rbp - 0x3c], eax
mov dword [rbp - 0x40], eax
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov dword [rbp + 0x20], r8d
mov qword [rbp + 0x28], r9
mov rcx, qword [rbp + 0x10]
mov qword [rbp - 0x54], rcx
mov rdx, qword [rbp + 0x18]
mov qword [rbp - 0x5c], rdx
mov r8d, dword [rbp + 0x20]
mov dword [rbp - 0x4c], r8d
mov r9, qword [rbp + 0x28]
mov qword [rbp - 0x64], r9
lea rcx, [rbp - 0x90]
call fcn.140007a50
mov rcx, qword [rbp - 0x54]
mov rdx, qword [rbp - 0x5c]
mov r8d, dword [rbp - 0x4c]
mov r9, qword [rbp - 0x64]
call sub.KERNEL32.dll_GetTempFileNameW
mov esi, eax
lea rcx, [rbp - 0x90]
call fcn.140007aa0
mov dword [rbp - 0x44], esi
mov eax, dword [rbp - 0x44]
mov dword [rbp - 0x40], eax
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x3c], eax
nop
mov rcx, rsp
call fcn.14023a632
nop
mov eax, dword [rbp - 0x3c]
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret