joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019490
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
movzx r10d, byte [r8]
lea r11, [r8 + 1]
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov eax, 0x1505
test r10d, r10d
je 0x1400194d5
imul eax, eax, 0x21
lea r11, [r11 + 1]
add eax, r10d
movzx r10d, byte [r11 - 1]
test r10d, r10d
jne 0x1400194c1
test eax, eax
mov esi, 1
mov rcx, rbx
cmovne esi, eax
mov edx, esi
call fcn.140010c70
cmp eax, 0xffffffff
je 0x140019514
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
je 0x140019514
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x20]
mov rcx, r15
movaps xmmword [rsp + 0x20], xmm0
call fcn.140007980
jmp 0x1400195f3
mov eax, dword [r14]
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
mov qword [rsp + 0x60], rbp
mov ebp, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
movaps xmmword [rsp + 0x30], xmm6
lea edx, [rbp + 1]
mov qword [rsp + 0x28], rax
shl rdx, 8
shr rdx, cl
cmp rdx, 0x50
jbe 0x140019554
mov rcx, rbx
call fcn.14001e300
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea eax, [r8 - 1]
and eax, esi
cmp dword [rdx + rax*4], 0
je 0x14001957b
dec r8d
nop word [rax + rax]
inc eax
and eax, r8d
cmp dword [rdx + rax*4], 0
jne 0x140019570
movaps xmm6, xmmword [rsp + 0x20]
mov dword [rdx + rax*4], esi
mov rcx, qword [rbx + 8]
mov qword [rcx + rax*8], rdi
lea ecx, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x18], ecx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
add rcx, rcx
mov rbx, 0xffffffffffffffff
movups xmmword [rax + rcx*8], xmm6
nop dword [rax + rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1400195b0
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
lea r8, [rbx + 1]
call fcn.140007f10
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.14004dd10
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
mov rcx, r15
call fcn.140007980
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001f910
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x80
mov r14, rcx
mov rsi, r9
lea rcx, [rsp + 0x20]
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001fb18
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x60]
sub rax, qword [0x140099f88]
xor edx, edx
imul rax, rax, 0xf4240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0xa0], rdi
div qword [0x140099f80]
mov qword [rsp + 0xa8], r15
mov r15, rax
mov qword [rsp + 0x60], rbx
add r15, qword [0x140099f90]
mov qword [rsp + 0x78], 0
call fcn.140007d90
lea rcx, [rsp + 0x60]
mov rdi, rax
call fcn.140007d90
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.140007d90
mov ecx, dword [rbx]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
lea rcx, [r14 + 0x70]
mov qword [rsp + 0x30], rbx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.14001fd70
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140007f10
lea rcx, [rdi + 0x18]
mov r8d, 4
mov dword [rax], 0x6a683db9
mov rdx, qword [rdi + 0x10]
mov ebx, dword [r14 + 0x88]
call fcn.140007f10
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, rdi
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rax], ebx
call fcn.140007980
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140007f10
lea rcx, [r14 + 0x50]
mov dword [rax], 0x6a683db9
call fcn.14003ba70
mov rdx, rsi
mov qword [r14 + 0x10], 0
lea rcx, [rsp + 0x60]
call fcn.140007bb0
mov rdi, qword [rsp + 0xa0]
movzx ebx, al
mov rcx, rsi
test al, al
je 0x14001faa0
mov rdx, rbp
call fcn.1400146c0
movzx ebx, al
test al, al
jne 0x14001faa5
mov r9, rbp
lea rdx, str.Failed_to_rename___s__to___s_
mov r8, rsi
mov ecx, 1
call fcn.140013ae0
jmp 0x14001faa5
call fcn.1400145f0
lea rcx, [rsp + 0x60]
call fcn.140007aa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001fb0b
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
sub rax, r15
add rax, qword [0x140099f90]
lock add qword [0x1400998e0], rax
mov r15, qword [rsp + 0xa8]
movzx eax, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
Function at 0x140022c00
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
xor eax, eax
mov rbp, rdx
mov rdx, rcx
mov qword [r11 - 0x40], rax
mov rdi, rcx
mov qword [r11 - 0x38], rax
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x30], rax
mov r14, r8
mov qword [r11 - 0x28], rax
call fcn.14003b820
mov rbx, qword [rsp + 0x38]
mov r8, rdi
mov ecx, 8
test rbx, rbx
je 0x140022cee
mov rsi, qword [rsp + 0x40]
lea rdx, str._s:_successfully_mapped_at__p___d_bytes_
mov r9, rbx
mov dword [rsp + 0x20], esi
call fcn.140013ae0
cmp rsi, 0x14
jae 0x140022c8f
mov r9d, esi
mov dword [rsp + 0x20], 0x14
mov r8, rdi
lea rdx, str._s:_Bad_mmap_size__d___need_at_least__d_bytes
mov ecx, 2
call fcn.140013ae0
jmp 0x140022cfa
cmp dword [rbx], 0xe0afb8f1
je 0x140022cb8
mov r9d, dword [rbx]
lea rdx, str._s:_Bad_magic_number__08x___current_is__08x
mov r8, rdi
mov dword [rsp + 0x20], 0xe0afb8f1
mov ecx, 8
call fcn.140013ae0
jmp 0x140022cfa
cmp dword [rbx + 0x10], 0xe0afb8f1
je 0x140022cd2
mov r8, rdi
lea rdx, str.Did_not_find_expected_magic_number_marker_at_the_end_of__s._This_most_likely_means_data_writing_code_for_that_file_is_writing_too_much_or_too_little_data
mov ecx, 1
jmp 0x140022cf5
movups xmm0, xmmword [rsp + 0x38]
mov al, 1
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov qword [r14], rbx
jmp 0x140022dab
lea rdx, str._s:_mmap_failed
call fcn.140013ae0
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140022dcd
mov rax, qword [rsp + 0x98]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
mov rdi, rax
add rdi, qword [0x140099f90]
test rbx, rbx
je 0x140022d65
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x140022dda
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140022dc0
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
sub rax, rdi
add rax, qword [0x140099f90]
lock inc dword [0x140099870]
lock add qword [0x140099878], rax
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.140013a60
int3
Function at 0x140023c60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp byte [0x140099fd8], 0
mov rdi, rcx
movsxd rbx, edx
je 0x140023ce2
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov esi, r14d
test edx, edx
je 0x140023cc6
nop
mov rcx, qword [0x1400cf100]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov dword [rsp + 0x60], r14d
mov rdx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140023cc6
mov eax, dword [rsp + 0x60]
add esi, eax
add rdi, rax
mov eax, esi
cmp rax, rbx
jb 0x140023c90
add dword [0x14009995c], ebx
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x38
pop rdi
pop rbx
ret
add dword [0x14009995c], ebx
test edx, edx
jle 0x140023d13
nop dword [rax]
mov r9, qword [0x140099928]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.1400570cc
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140023cf0
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x140023d20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x58
mov r14, rcx
xor r11d, r11d
movsxd rcx, dword [rcx + 0x7c]
mov ebx, r8d
mov rdi, rdx
test rcx, rcx
je 0x140023d60
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
add r11d, 5
add r11d, dword [r14 + r10*4]
inc r10
cmp r10, rcx
jne 0x140023d50
lea eax, [r8 + 0xc]
mov dword [rsp + 0x34], r9d
add eax, r11d
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov edx, 0xc
mov eax, dword [0x140099958]
mov dword [rsp + 0x38], eax
inc eax
mov dword [0x140099958], eax
call fcn.140023c60
mov edx, ebx
mov rcx, rdi
call fcn.140023c60
xor r15d, r15d
cmp dword [r14 + 0x7c], r15d
je 0x140023ed9
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], r12
lea r12, [r14 + 0x28]
mov qword [rsp + 0x40], r13
lea r13, [r14 + 0x7c]
nop word [rax + rax]
mov eax, dword [r14]
lea rcx, [rsp + 0x98]
mov edx, 4
mov dword [rsp + 0x98], eax
call fcn.140023c60
cmp byte [0x140099fd8], 0
movsxd rbx, dword [rsp + 0x98]
mov rdi, qword [r12]
je 0x140023e5b
xor eax, eax
mov esi, eax
test ebx, ebx
je 0x140023e53
nop dword [rax]
mov rcx, qword [0x1400cf100]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov dword [rsp + 0x90], eax
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140023e53
mov eax, dword [rsp + 0x90]
add esi, eax
add rdi, rax
mov eax, esi
cmp rax, rbx
mov eax, 0
jb 0x140023e10
add dword [0x14009995c], ebx
jmp 0x140023e93
add dword [0x14009995c], ebx
test ebx, ebx
jle 0x140023e93
nop word [rax + rax]
mov r9, qword [0x140099928]
mov edx, 1
movsxd r8, ebx
mov rcx, rdi
call fcn.1400570cc
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140023e70
mov edx, 1
mov byte [rsp + 0x90], 0
lea rcx, [rsp + 0x90]
call fcn.140023c60
inc r15d
add r12, 8
add r14, 4
cmp r15d, dword [r13]
jne 0x140023dd0
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x140024060
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, qword [0x140099fd0]
xor r12d, r12d
cmp byte [0x140099b70], r12b
mov ebx, r8d
mov edi, edx
je 0x1400240e9
lea rax, str.EmitBuildStart
mov dword [rbp - 0x30], r12d
xorps xmm0, xmm0
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x30]
mov dword [rbp - 8], 0x32
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002425e
mov rax, qword [rbp + 0x30]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
add rax, qword [0x140099f90]
mov qword [rbp - 0x10], rax
cmp qword [0x140099928], r12
jne 0x1400240ff
cmp byte [0x140099fd8], r12b
je 0x140024246
lea rcx, [0x140099930]
mov qword [rsp + 0xb8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14009995c]
add eax, 0x18
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x4c], ebx
test r15, r15
jne 0x140024130
mov ebx, r12d
mov eax, r12d
jmp 0x140024140
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], r12b
jne 0x140024137
mov dword [rbp - 0x48], eax
lea rcx, [rbp - 0x40]
lea eax, [rbx + 0x1d]
mov dword [rbp - 0x3c], 1
mov dword [rbp - 0x40], eax
mov esi, 0xc
mov eax, dword [0x140099958]
mov edx, esi
mov dword [rbp - 0x38], eax
inc eax
mov dword [0x140099958], eax
call fcn.140023c60
cmp byte [0x140099fd8], r12b
je 0x1400241d0
mov qword [rsp + 0xc0], r14
mov edi, r12d
lea r14, [rbp - 0x50]
nop dword [rax]
mov rcx, qword [0x1400cf100]
lea r9, [rbp + 0x48]
mov r8d, esi
mov dword [rbp + 0x48], r12d
mov rdx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400241c0
mov eax, dword [rbp + 0x48]
add edi, eax
add r14, rax
cmp edi, esi
jb 0x140024190
add dword [0x14009995c], esi
mov r14, qword [rsp + 0xc0]
jmp 0x140024203
add dword [0x14009995c], esi
lea rdi, [rbp - 0x50]
nop word [rax + rax]
mov r9, qword [0x140099928]
mov edx, 1
mov r8d, esi
mov rcx, rdi
call fcn.1400570cc
movsxd rcx, eax
sub esi, eax
add rdi, rcx
test esi, esi
jg 0x1400241e0
mov edx, 4
mov dword [rbp + 0x30], ebx
lea rcx, [rbp + 0x30]
call fcn.140023c60
mov edx, dword [rbp + 0x30]
mov rcx, r15
call fcn.140023c60
mov edx, 1
mov byte [rbp + 0x48], r12b
lea rcx, [rbp + 0x48]
call fcn.140023c60
lea rcx, [0x140099930]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0xb8]
lea rcx, [rbp - 0x30]
call fcn.140001250
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
Function at 0x140024270
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
push rbp
push rbx
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x90
xor r15d, r15d
mov ebx, ecx
cmp byte [0x140099b70], r15b
je 0x1400242ed
lea rax, str.EmitBuildFinish
mov dword [rbp - 1], r15d
xorps xmm0, xmm0
mov qword [rbp + 7], rax
lea rcx, [rbp - 0x19]
mov dword [rbp + 0x27], 0x32
movdqu xmmword [rbp + 0xf], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002446c
mov rax, qword [rbp - 0x19]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
add rax, qword [0x140099f90]
mov qword [rbp + 0x1f], rax
mov rcx, qword [0x140099928]
test rcx, rcx
jne 0x140024306
cmp byte [0x140099fd8], r15b
je 0x140024446
mov qword [rsp + 0xb0], rsi
lea rcx, [0x140099930]
mov qword [rsp + 0x80], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x140099958]
lea rcx, [rbp - 0x11]
mov dword [rbp - 9], eax
mov edx, 0xc
inc eax
mov dword [rbp + 0x7f], ebx
mov dword [0x140099958], eax
mov dword [rbp + 0x83], r15d
mov dword [rbp - 0x11], 0x19
mov dword [rbp - 0xd], 7
call fcn.140023c60
cmp byte [0x140099fd8], r15b
mov esi, 8
mov r14d, r15d
je 0x1400243c0
mov qword [rsp + 0x88], rdi
mov ebx, r15d
lea rdi, [rbp + 0x7f]
nop word [rax + rax]
mov rcx, qword [0x1400cf100]
lea r9, [rbp + 0x6f]
mov r8d, esi
mov dword [rbp + 0x6f], r15d
mov rdx, rdi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400243b0
mov eax, dword [rbp + 0x6f]
add ebx, eax
add rdi, rax
cmp ebx, esi
jb 0x140024380
add dword [0x14009995c], esi
mov rdi, qword [rsp + 0x88]
jmp 0x1400243f3
add dword [0x14009995c], esi
lea rbx, [rbp + 0x7f]
nop word [rax + rax]
mov r9, qword [0x140099928]
mov edx, 1
mov r8d, esi
mov rcx, rbx
call fcn.1400570cc
movsxd rcx, eax
sub esi, eax
add rbx, rcx
test esi, esi
jg 0x1400243d0
mov edx, 4
mov dword [rbp + 0x77], r14d
lea rcx, [rbp + 0x77]
call fcn.140023c60
mov edx, dword [rbp + 0x77]
mov rcx, r15
call fcn.140023c60
mov edx, 1
mov byte [rbp + 0x6f], r15b
lea rcx, [rbp + 0x6f]
call fcn.140023c60
lea rcx, [0x140099930]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x140099928]
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xb0]
test rcx, rcx
je 0x140024450
call fcn.140056cc4
lea rcx, [rbp - 1]
mov qword [0x140099928], r15
call fcn.140001250
add rsp, 0x90
pop r15
pop rbx
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
Function at 0x1400249d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0xe8
cmp qword [0x140099928], 0
mov rbx, rcx
jne 0x1400249f9
cmp byte [0x140099fd8], 0
je 0x140024c1b
mov qword [rsp + 0xe0], rdi
lea rcx, [0x140099930]
mov qword [rsp + 0xd8], r14
mov qword [rsp + 0xd0], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rbx]
xor r15d, r15d
mov r9d, dword [0x14009995c]
add r9d, 0x18
mov ecx, dword [rax]
mov rax, qword [rbx + 8]
mov dword [rbp - 0x69], ecx
mov rcx, 0xffffffffffffffff
mov r8, qword [rax]
test r8, r8
jne 0x140024a53
mov edx, r15d
mov dword [rbp - 0x49], r15d
mov eax, r15d
jmp 0x140024a65
mov rdx, rcx
inc rdx
cmp byte [r8 + rdx], r15b
jne 0x140024a56
mov dword [rbp - 0x49], edx
mov eax, r9d
mov dword [rbp - 0x65], eax
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x21], r8
lea r8d, [r9 + rdx]
mov rdx, qword [rax]
test rdx, rdx
jne 0x140024a90
mov ecx, r15d
mov dword [rbp - 0x45], r15d
mov eax, r15d
jmp 0x140024aa0
inc rcx
cmp byte [rdx + rcx], r15b
jne 0x140024a90
mov dword [rbp - 0x45], ecx
lea eax, [r8 + 5]
add r8d, 0xa
mov qword [rbp - 0x19], rdx
add ecx, r8d
mov dword [rbp - 0x61], eax
mov r14d, 2
mov dword [rbp + 0x2f], ecx
lea rcx, [rbp - 0x49]
mov dword [rbp + 0x33], r14d
mov edx, r15d
mov r8d, r14d
nop word [rax + rax]
add edx, 5
add edx, dword [rcx]
lea rcx, [rcx + 4]
sub r8, 1
jne 0x140024ad0
lea eax, [rdx + 0x18]
mov dword [rbp - 0x55], 8
mov dword [rbp - 0x59], eax
lea rcx, [rbp - 0x59]
mov eax, dword [0x140099958]
mov edi, 0xc
mov dword [rbp - 0x51], eax
mov edx, edi
inc eax
mov dword [0x140099958], eax
call fcn.140023c60
cmp byte [0x140099fd8], r15b
je 0x140024b70
mov qword [rsp + 0x100], rsi
mov ebx, r15d
lea rsi, [rbp - 0x69]
nop word [rax + rax]
mov rcx, qword [0x1400cf100]
lea r9, [rbp + 0x6f]
mov r8d, edi
mov dword [rbp + 0x6f], r15d
mov rdx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140024b60
mov eax, dword [rbp + 0x6f]
add ebx, eax
add rsi, rax
cmp ebx, edi
jb 0x140024b30
add dword [0x14009995c], edi
mov rsi, qword [rsp + 0x100]
jmp 0x140024ba3
add dword [0x14009995c], edi
lea rbx, [rbp - 0x69]
nop word [rax + rax]
mov r9, qword [0x140099928]
mov edx, 1
mov r8d, edi
mov rcx, rbx
call fcn.1400570cc
movsxd rcx, eax
sub edi, eax
add rbx, rcx
test edi, edi
jg 0x140024b80
mov r15, qword [rsp + 0xd0]
lea rbx, [rbp - 0x21]
lea rdi, [rbp - 0x49]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdi]
lea rcx, [rbp + 0x77]
mov edx, 4
mov dword [rbp + 0x77], eax
call fcn.140023c60
mov edx, dword [rbp + 0x77]
mov rcx, qword [rbx]
call fcn.140023c60
mov edx, 1
mov byte [rbp + 0x6f], 0
lea rcx, [rbp + 0x6f]
call fcn.140023c60
lea rdi, [rdi + 4]
lea rbx, [rbx + 8]
sub r14, 1
jne 0x140024bc0
mov r14, qword [rsp + 0xd8]
lea rcx, [0x140099930]
mov rdi, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsp, 0xe8
pop rbx
pop rbp
ret
Function at 0x140038830
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400389f3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140038290
mov qword [rsi + 0x38], rdi
lea rax, [rdi - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
mov rdx, rcx
cmp rcx, rbx
je 0x1400389bd
mov qword [rsp + 0x38], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x40], r14
movabs r14, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r8, qword [rsi + 0x30]
xor r9, r14
mov rdi, qword [rsi + 0x18]
mov rdx, qword [rdx]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbp
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbp
xor r9, rax
imul r9, rbp
and r8, r9
mov r11, r8
shl r8, 4
shl r11, 4
add rdi, r8
add r11, qword [rsi + 0x18]
cmp qword [r11], rbx
jne 0x14003892b
mov qword [r11], rcx
mov qword [rdi + 8], rcx
jmp 0x1400389a7
mov rax, qword [rdi + 8]
mov r8d, dword [rax + 0x10]
cmp dword [rcx + 0x10], r8d
jne 0x140038968
mov r8, qword [rax]
cmp r8, rcx
je 0x140038962
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov r9, qword [r8 + 8]
mov qword [r9], rcx
mov qword [r8 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [rdi + 8], rcx
jmp 0x1400389a7
cmp qword [r11], rax
je 0x140038983
mov r9d, dword [rcx + 0x10]
mov r8, qword [r11]
mov rax, qword [rax + 8]
cmp r9d, dword [rax + 0x10]
je 0x1400389cd
cmp r8, rax
jne 0x140038974
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov qword [rax + 8], r8
mov qword [rdx + 8], r10
mov qword [rcx + 8], r9
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rbx
jne 0x1400388d0
mov r14, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rax]
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov rax, qword [rdx + 8]
mov qword [rax], r9
mov r8, qword [r9 + 8]
mov qword [r8], rcx
mov qword [r9 + 8], rax
mov qword [rdx + 8], r10
mov qword [rcx + 8], r8
jmp 0x1400389a7
lea rcx, str.invalid_hash_bucket_count
call fcn.14004a3cc
int3
Function at 0x14003b820
Capabilities:
Check for time delay via queryperformancecounter
Get file size
Read file via mapping

Disassembly:
push rbx
push rdi
sub rsp, 0x78
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003ba5a
mov rax, qword [rsp + 0xa8]
lea rcx, [rsp + 0x48]
sub rax, qword [0x140099f88]
xor edx, edx
imul rax, rax, 0xf4240
mov qword [rsp + 0x90], rbp
div qword [0x140099f80]
mov qword [rsp + 0x70], r14
mov rdx, rbx
mov r14, rax
add r14, qword [0x140099f90]
call fcn.140013d00
cmp qword [rax + 0x18], 8
jb 0x14003b890
mov rax, qword [rax]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rax
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdx, qword [rsp + 0x60]
mov rbx, rax
cmp rdx, 8
jb 0x14003b901
mov rcx, qword [rsp + 0x48]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003b8fc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003ba67
mov rcx, r8
call fcn.14004ba4c
movdqa xmm0, xmmword [0x14008df80]
mov word [rsp + 0x48], bp
movdqu xmmword [rsp + 0x58], xmm0
cmp rbx, 0xffffffffffffffff
je 0x14003b9f5
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x98], rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [rsp + 0xa0]
xor edx, edx
mov eax, eax
mov rcx, rbx
shl rsi, 0x20
or rsi, rax
mov qword [rsp + 0x28], rbp
mov r9, rsi
mov dword [rsp + 0x20], esi
shr r9, 0x20
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbp, rax
test rax, rax
jne 0x14003b991
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.CreateFileMapping___failed:__u
lea ecx, [rbp + 1]
call fcn.140013ae0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003b9ed
xor r9d, r9d
mov eax, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbp
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x14003b9de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.MapViewOfFile___failed:__u
mov ecx, 1
mov r8d, eax
call fcn.140013ae0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14003b9ed
mov qword [rdi], rax
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbp
mov rsi, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14003ba4d
mov rax, qword [rsp + 0x40]
xor edx, edx
sub rax, qword [0x140099f88]
imul rax, rax, 0xf4240
div qword [0x140099f80]
sub rax, r14
add rax, qword [0x140099f90]
lock inc dword [0x140099870]
lock add qword [0x140099878], rax
mov rbp, qword [rsp + 0x90]
mov r14, qword [rsp + 0x70]
add rsp, 0x78
pop rdi
pop rbx
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140013a60
int3
call fcn.14005689c
int3