joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
xor r8d, r8d
xor edx, edx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [rbp + 2]
mov esi, eax
call fcn.1400e8270
mov qword [rbx], rax
mov word [rax], bp
lea rbp, [rsi*2 + 2]
mov rcx, qword [rbx]
mov rdx, rbp
call fcn.1400e8278
mov qword [rbx], rax
test rax, rax
je 0x1400189f2
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
mov rdx, qword [rbx]
mov r8d, esi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140018ad0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x48]
lea rcx, [0x1401791c0]
xor r9d, r9d
lea rdx, [rsp + 0x50]
call fcn.140008c40
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140018b07
mov rcx, qword [rbx]
jmp 0x140018b09
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
test rbx, rbx
je 0x140018b64
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140018b64
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140018b3f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018b55
call fcn.1400e0fb8
mov qword [rbx + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140018b70
Capabilities:
Get file system object information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov edi, r9d
mov qword [rsp + 0x20], rcx
mov rsi, r8
lea rcx, [0x1401791c0]
mov ebp, edx
lea r8, [rsp + 0x30]
xor r9d, r9d
lea rdx, [rsp + 0x38]
call fcn.140008c40
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140018bb9
mov rcx, qword [rbx]
jmp 0x140018bbb
xor ecx, ecx
mov eax, dword [rsp + 0x70]
mov r9d, edi
mov r8, rsi
mov dword [rsp + 0x20], eax
mov edx, ebp
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rdi, rax
test rbx, rbx
je 0x140018c27
mov ecx, 0xffffffff
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140018c27
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rbx]
test rcx, rcx
je 0x140018c02
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140018c18
call fcn.1400e0fb8
mov qword [rbx + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140018f50
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
sub rsp, 0x60
mov rsi, rcx
lea rax, [r11 + 0x20]
xor ecx, ecx
mov rbx, r8
mov qword [r11 - 0x10], rcx
mov ebp, edx
mov qword [r11 - 0x18], rcx
xor r9d, r9d
mov qword [r11 - 0x20], rcx
xor r8d, r8d
mov qword [r11 - 0x28], rcx
xor edx, edx
mov qword [r11 - 0x30], rcx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x48], rcx
mov dword [r11 + 0x20], ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140018fff
mov eax, dword [rsp + 0x88]
mov rcx, qword [rbx]
inc eax
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x88], eax
lea rdi, [rax*2 + 2]
mov rdx, rdi
call fcn.1400e8278
mov qword [rbx], rax
test rax, rax
je 0x140018fe4
mov r8, rdi
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
mov r9d, dword [rsp + 0x88]
mov edx, ebp
mov r8, qword [rbx]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x60
pop rsi
ret

Function at 0x140019020
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x70
mov rbp, rcx
lea rax, [r11 - 0x24]
xor ecx, ecx
mov r14, r9
mov qword [r11 - 0x30], rcx
mov rsi, r8
mov qword [r11 - 0x38], rcx
mov r15d, edx
mov qword [r11 - 0x40], rax
xor r9d, r9d
lea rax, [r11 - 0x28]
mov dword [rsp + 0x60], ecx
mov qword [r11 - 0x48], rax
xor r8d, r8d
mov qword [r11 - 0x50], rcx
xor edx, edx
mov qword [r11 - 0x58], rcx
mov qword [r11 - 0x60], rcx
mov qword [r11 - 0x68], rcx
mov dword [rsp + 0x64], ecx
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140019145
mov eax, dword [rsp + 0x60]
mov rcx, qword [rsi]
inc eax
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0x60], eax
lea rbx, [rax*2 + 2]
mov rdx, rbx
call fcn.1400e8278
mov qword [rsi], rax
test rax, rax
je 0x1400190c9
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
mov edi, dword [rsp + 0x64]
mov rbx, qword [rsp + 0xb8]
inc edi
and rdi, 0xfffffffffffffffe
mov rcx, qword [rbx]
lea rdx, [rdi + 2]
call fcn.1400e8278
mov qword [rbx], rax
test rax, rax
je 0x1400190fd
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
mov rax, qword [rbx]
lea rcx, [rsp + 0x64]
mov r8, qword [rsi]
lea r9, [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov edx, r15d
mov qword [rsp + 0x30], rax
mov rcx, rbp
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rdi, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rsi
ret
Function at 0x140019160
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x40
mov r14, rcx
lea rax, [rsp + 0x30]
xor ecx, ecx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], ecx
mov r15, r9
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov rcx, r14
mov rsi, r8
mov rbp, rdx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001920b
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x80]
mov qword [rsp + 0x68], rdi
mov edi, dword [rsp + 0x30]
inc edi
mov rcx, qword [rbx]
and rdi, 0xfffffffffffffffe
lea rdx, [rdi + 2]
call fcn.1400e8278
mov qword [rbx], rax
test rax, rax
je 0x1400191dd
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
lea rax, [rsp + 0x30]
mov r9, r15
mov qword [rsp + 0x28], rax
mov r8, rsi
mov rax, qword [rbx]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rsi
ret

Function at 0x140019220
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, r8
mov dword [rsp + 0x48], 0
xor r8d, r8d
lea r9, [rsp + 0x48]
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x14001929f
mov eax, dword [rsp + 0x48]
mov rcx, qword [rbx]
inc eax
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
and rdi, 0xfffffffffffffffe
lea rdx, [rdi + 2]
call fcn.1400e8278
mov qword [rbx], rax
test rax, rax
je 0x140019286
lea r8, [rdi + 2]
xor edx, edx
mov rcx, rax
call fcn.1400e36c0
mov r8, qword [rbx]
lea r9, [rsp + 0x48]
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x14002a2b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rdi, rcx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1400e36c0
mov rcx, qword [0x140178378]
test rcx, rcx
jne 0x14002a310
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rcx + 0x1c]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
jmp 0x14002a375
add rcx, 0x418
lea rdx, [rsp + 0x40]
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14002a320
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x14002a340
movups xmm0, xmmword [str.AppDataLocal]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x140125008]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x140125010]
mov dword [rcx + 0x18], eax
movzx eax, word [0x140125014]
mov word [rcx + 0x1c], ax
lea rax, [rsp + 0x40]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x14002a380
movaps xmm0, xmmword [str.MicrosoftWindows_SidebarSettings.ini]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x140125030]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x140125040]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x140125050]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x140125060]
movups xmmword [rax + 0x40], xmm0
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14002a3fb
mov qword [rax + 8], 0
mov dword [rax + 0x10], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x14002a434
jmp 0x14002a3fd
xor ebx, ebx
mov qword [rdi], rbx
test rbx, rbx
je 0x14002a429
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
mov ecx, 0x8007000e
call fcn.1400e0b70
nop
mov ecx, 0x8007000e
call fcn.1400e0b70
int3
Function at 0x1400356c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140035738
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140035738
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140035725
nop
cmp rbx, rcx
jae 0x140035738
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140035710
cmp rbx, rcx
jae 0x140035738
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
jmp 0x14003573a
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140035800
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov rsi, rcx
test rcx, rcx
je 0x14003589d
lea eax, [rdx - 1]
test eax, eax
jne 0x14003589d
cmp edx, 1
jne 0x140035898
xor edx, edx
mov qword [rsp + 0x168], rbx
mov r8d, VarUI4FromDisp
lea rcx, [rsp + 0x24]
call fcn.1400e36c0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], VarUI4FromDisp
mov ebx, edi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14003587c
cmp dword [rsp + 0x24], 6
ja 0x140035877
jne 0x14003587c
cmp dword [rsp + 0x28], ebx
jbe 0x14003587c
mov ebx, 1
shl ebx, 0xb
xor edx, edx
mov r8d, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbx, qword [rsp + 0x168]
mov rdi, rax
mov rax, rdi
jmp 0x1400358aa
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e17a0
mov rsi, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
ret
Function at 0x140038cb0
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x1401794b8], 0
jne 0x140038e1d
lea rcx, str.Wintrust.dll
mov byte [0x1401794b8], 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140038ce5
add rsp, 0x20
pop rbx
ret
lea rdx, str.WinVerifyTrust
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperGetProvSignerFromChain
mov rcx, rbx
mov qword [0x140179450], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WTHelperProvDataFromStateData
mov rcx, rbx
mov qword [0x140179458], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminReleaseContext
mov rcx, rbx
mov qword [0x140179460], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminReleaseCatalogContext
mov rcx, rbx
mov qword [0x140179468], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATCatalogInfoFromContext
mov rcx, rbx
mov qword [0x140179470], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminEnumCatalogFromHash
mov rcx, rbx
mov qword [0x140179478], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminCalcHashFromFileHandle
mov rcx, rbx
mov qword [0x140179480], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminAcquireContext
mov rcx, rbx
mov qword [0x140179488], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminAddCatalog
mov rcx, rbx
mov qword [0x140179490], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCATAdminRemoveCatalog
mov rcx, rbx
mov qword [0x1401794a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IsCatalogFile
mov rcx, rbx
mov qword [0x1401794a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.crypt32.dll
mov qword [0x1401794b0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.CertNameToStrW
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140179498], rax
cmp qword [0x140179490], 0
setne al
add rsp, 0x20
pop rbx
ret
Function at 0x140044b50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret

Function at 0x140045170
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x20
mov rax, r8
mov r10, rdx
movzx ebx, r9b
mov rdx, rax
mov r9, qword [rcx]
mov r8d, 0xffffffff
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0xffffffff
jne 0x1400451a3
movzx eax, bl
add rsp, 0x20
pop rbx
ret
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x140045370
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r14
push r15
sub rsp, 0x40
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rdi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
call fcn.140033570
mov rcx, rax
test rax, rax
je 0x140045479
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbx], rax
mov esi, 1
mov dword [rsp + 0x30], esi
mov rdi, qword [rdi]
mov ecx, esi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
add eax, 0xffffff80
or ecx, eax
jge 0x1400453e5
lea edx, [rsi + 0x7f]
mov rcx, rbx
call fcn.140033e60
mov r9, qword [rbx]
cmp dword [r9 - 0xc], 0x80
jl 0x140045484
mov dword [r9 - 0x10], 0x80
mov rax, qword [rbx]
mov word [rax + 0x100], r15w
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80
mov r8, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
movsxd rdi, eax
test eax, eax
js 0x140045484
mov rcx, qword [rbx]
sub esi, dword [rcx - 8]
mov edx, dword [rcx - 0xc]
sub edx, edi
or esi, edx
jge 0x14004544a
mov edx, edi
mov rcx, rbx
call fcn.140033e60
mov rax, qword [rbx]
cmp edi, dword [rax - 0xc]
jg 0x140045484
mov dword [rax - 0x10], edi
mov rax, qword [rbx]
mov word [rax + rdi*2], r15w
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140032b30
nop
mov ecx, 0x80070057
call fcn.140032b30
int3
Function at 0x14004f2c0
Capabilities:
Hash data using fnv

Disassembly:
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov r11, rdx
movzx eax, byte [r8 + 1]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
and rdx, r9
mov r9, qword [r10 + 8]
shl rdx, 4
add rdx, qword [r10 + 0x18]
mov rax, qword [rdx + 8]
cmp rax, r9
je 0x14004f37e
mov rcx, qword [r8]
mov rdx, qword [rdx]
cmp rcx, qword [rax + 0x10]
je 0x14004f380
cmp rax, rdx
je 0x14004f37e
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x14004f361
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret
xor eax, eax
test rax, rax
cmove rax, r9
mov qword [r11], rax
mov rax, r11
ret

Function at 0x140050950
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, rdx
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [rax + 1]
test edi, edi
js 0x1400509ef
mov rax, qword [rbx]
mov r9d, 1
mov r8d, dword [rax - 0xc]
sub r9d, dword [rax - 8]
sub r8d, edi
or r9d, r8d
jge 0x140050998
mov edx, edi
mov rcx, rbx
call fcn.140033e60
mov rdx, qword [rbx]
mov r8d, edi
mov rcx, qword [rsi]
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400509c5
mov rcx, qword [rbx]
test rcx, rcx
jne 0x1400509bc
mov eax, esi
jmp 0x1400509c9
movsxd rdx, dword [rcx - 0xc]
call fcn.1400fb8e8
test eax, eax
js 0x1400509ef
mov rcx, qword [rbx]
cmp eax, dword [rcx - 0xc]
jg 0x1400509ef
mov dword [rcx - 0x10], eax
mov ecx, eax
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov word [rax + rcx*2], si
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, 0x80070057
call fcn.140032b30
int3
Function at 0x140054a30
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rdx
push rdi
sub rsp, 0x20
movzx eax, byte [r11 + 0x11]
movabs rbx, 0x100000001b3
mov r10, qword [rcx + 0x40]
movabs rdi, 0xcbf29ce484222325
movzx r8d, dl
mov r9, rcx
xor r8, rdi
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x12]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x13]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x14]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x15]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x16]
imul r8, rbx
xor r8, rax
movzx eax, byte [r11 + 0x17]
mov r11, qword [rcx + 0x28]
imul r8, rbx
xor r8, rax
mov rax, r10
imul r8, rbx
and rax, r8
mov r8, qword [r9 + 0x18]
add rax, rax
mov rcx, qword [r11 + rax*8 + 8]
cmp rcx, r8
je 0x140054af1
mov rax, qword [r11 + rax*8]
cmp rdx, qword [rcx + 0x10]
je 0x140054af3
nop
cmp rcx, rax
je 0x140054af1
mov rcx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x140054ae0
jmp 0x140054af3
xor ecx, ecx
test rcx, rcx
cmove rcx, r8
cmp rcx, r8
je 0x140054bc0
movzx eax, byte [rcx + 0x11]
movzx edx, byte [rcx + 0x10]
xor rdx, rdi
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x12]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x13]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x14]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x15]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x16]
imul rdx, rbx
xor rdx, rax
movzx eax, byte [rcx + 0x17]
imul rdx, rbx
xor rdx, rax
imul rdx, rbx
and r10, rdx
add r10, r10
mov rax, qword [r11 + r10*8]
cmp qword [r11 + r10*8 + 8], rcx
jne 0x140054b87
cmp rax, rcx
jne 0x140054b7c
mov qword [r11 + r10*8], r8
mov qword [r11 + r10*8 + 8], r8
jmp 0x140054b93
mov r8, qword [rcx + 8]
mov qword [r11 + r10*8 + 8], r8
jmp 0x140054b93
cmp rax, rcx
jne 0x140054b93
mov rax, qword [rcx]
mov qword [r11 + r10*8], rax
mov rdx, qword [rcx]
dec qword [r9 + 0x20]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e0fb8
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x140055320
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x1400554ff
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1400551e0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x1400554c4
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x14]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x15]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x16]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x17]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14005543c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400554b3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140055479
mov r10, qword [rdx]
cmp r10, rax
je 0x140055473
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400554b3
cmp r9, rdx
je 0x14005548f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x1400554d9
cmp r9, rdx
jne 0x140055480
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x1400553c0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400554b3
lea rcx, str.invalid_hash_bucket_count
call fcn.1400df1dc
int3