joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d140
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
mov eax, 0x1050
call fcn.1402e0680
sub rsp, rax
mov rax, qword [0x14045d5f0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 1
mov rdi, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], 0x800
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14002d28b
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jne 0x14002d1ff
cmp word [rsp + 0x40], ax
jne 0x14002d1ce
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000ef50
mov eax, ebx
jmp 0x14002d28b
lea rax, [rsp + 0x40]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002d1e0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000ef50
mov eax, ebx
jmp 0x14002d28b
cmp ecx, 2
jne 0x14002d286
mov r8d, 0x400
lea rdx, [rsp + 0x840]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x34], eax
dec eax
cmp eax, 0x3ff
ja 0x14002d27f
cmp word [rsp + 0x840], 0
jne 0x14002d250
xor r8d, r8d
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14000ef50
mov eax, ebx
jmp 0x14002d28b
lea rax, [rsp + 0x840]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14002d260
lea rdx, [rsp + 0x840]
mov rcx, rdi
call fcn.14000ef50
mov eax, ebx
jmp 0x14002d28b
mov eax, 0xea
jmp 0x14002d28b
mov eax, 0x3f4
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.1402e0100
mov rbx, qword [rsp + 0x1078]
add rsp, 0x1050
pop rdi
ret

Function at 0x14002d2b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [rcx]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x50], 4
mov rbx, r8
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x30], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002d31e
mov ecx, dword [rsp + 0x50]
add ecx, 0xfffffffd
cmp ecx, 1
ja 0x14002d319
cmp dword [rsp + 0x68], 4
jne 0x14002d319
mov ecx, dword [rsp + 0x30]
mov dword [rbx], ecx
add rsp, 0x40
pop rbx
ret
mov eax, 0x3f4
add rsp, 0x40
pop rbx
ret

Function at 0x14002d330
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov r10, rcx
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [r8 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14002d340
lea ecx, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], ecx
mov rcx, qword [r10]
mov qword [rsp + 0x20], r8
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x38
ret
Function at 0x14002f1c0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp byte [rcx + 8], 0
movzx esi, r8b
mov ebp, edx
mov dword [rsp + 0x30], 0
mov rbx, rcx
je 0x14002f1f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14002f1f6
mov rax, qword [rcx]
mov edx, ebp
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne dil
test dil, dil
je 0x14002f25f
test sil, sil
je 0x14002f230
cmp byte [rbx + 8], 0
je 0x14002f21f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14002f222
mov rax, qword [rbx]
mov edx, 0xea60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [rbx + 8], 0
je 0x14002f23e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x14002f241
mov rax, qword [rbx]
mov rcx, rax
call sub.KERNEL32.dll_GetProcessId
mov rcx, qword [0x14045f080]
test rcx, rcx
je 0x14002f25f
mov r8d, ebp
mov edx, eax
call fcn.1400425b0
mov rbx, qword [rsp + 0x38]
movzx eax, dil
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140030380
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.140031ba0
call fcn.14004bcc0
test al, al
je 0x1400303b3
xor r9d, r9d
lea rdx, str.File::GetLength
mov r8, rbx
lea rcx, [rsp + 0x20]
call fcn.14004bc80
mov rcx, qword [rbx]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rbx, qword [rsp + 0x40]
or rcx, 0xffffffffffffffff
test eax, eax
cmove rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.14004bc50
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400306e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
movsxd rdi, r9d
mov rbp, r8
mov rsi, rdx
mov r14, rcx
test r9d, r9d
jns 0x140030712
or eax, 0xffffffff
mov rbp, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x80], rbx
call fcn.140031ba0
call fcn.14004bcc0
test al, al
je 0x140030744
mov r9, rdi
lea rdx, str.File::Read
mov r8, r14
lea rcx, [rsp + 0x30]
call fcn.14004bc80
mov rcx, qword [r14]
lea r9, [rsp + 0x98]
xor eax, eax
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov r8d, edi
mov dword [rsp + 0x50], esi
mov rdx, rbp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
shr rsi, 0x20
mov dword [rsp + 0x54], esi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140030796
mov ebx, dword [rsp + 0x98]
jmp 0x1400307a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1400307a4
or ebx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14004bc50
mov rbp, qword [rsp + 0x88]
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x1400307d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
movsxd rdi, r8d
mov rbp, rdx
mov rsi, rcx
test r8d, r8d
jns 0x140030800
or eax, 0xffffffff
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x50], rbx
call fcn.140031ba0
call fcn.14004bcc0
test al, al
je 0x14003082f
mov r9, rdi
lea rdx, str.File::ReadAtCurrentPos
mov r8, rsi
lea rcx, [rsp + 0x30]
call fcn.14004bc80
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
xor ebx, ebx
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140030854
mov ebx, dword [rsp + 0x60]
jmp 0x140030862
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x140030862
or ebx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14004bc50
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x140030a10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rdi, rcx
movsxd rbx, r9d
lea rcx, [rsp + 0x30]
mov rbp, r8
mov rsi, rdx
call fcn.140031ba0
call fcn.14004bcc0
test al, al
je 0x140030a5a
mov r9, rbx
lea rdx, str.File::Write
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.14004bc80
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
xor eax, eax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x50], rax
mov r8d, ebx
mov dword [rsp + 0x50], esi
mov rdx, rbp
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
shr rsi, 0x20
mov dword [rsp + 0x54], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
or ebx, 0xffffffff
lea rcx, [rsp + 0x30]
test eax, eax
cmovne ebx, dword [rsp + 0x70]
call fcn.14004bc50
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140030ad0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
movsxd rbx, r8d
mov rsi, rdx
mov rdi, rcx
test r8d, r8d
jns 0x140030b00
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x30]
call fcn.140031ba0
call fcn.14004bcc0
test al, al
je 0x140030b2a
mov r9, rbx
lea rdx, str.File::WriteAtCurrentPos
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.14004bc80
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
or ebx, 0xffffffff
lea rcx, [rsp + 0x30]
test eax, eax
cmovne ebx, dword [rsp + 0x60]
call fcn.14004bc50
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140031e40
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x70
mov rsi, rcx
movsxd r15, edx
add rcx, 0x28
mov r14, r8
call fcn.140031c40
test al, al
jne 0x140031e78
xor al, al
mov rbp, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rsi
ret
cmp r14, 0x7fffffff
ja 0x140031e64
cmp qword [rsi + 0x58], 0
jne 0x140031e64
cmp byte [rsi], 0
je 0x140031ea2
lea rcx, [rsi + 0x28]
call fcn.140031c30
mov rcx, rax
call fcn.140031dc0
test al, al
je 0x140031e64
mov qword [rsp + 0x90], rbx
lea rcx, [rsi + 0x28]
mov qword [rsp + 0x98], rdi
mov eax, 4
mov rdi, r15
mov ebx, 6
shr rdi, 0x20
cmp byte [rsi + 0x60], 0
cmovne ebx, eax
call fcn.140031c30
mov rcx, rax
mov qword [rsp + 0x20], r14
mov r9d, r15d
mov r8d, edi
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, qword [rsp + 0x98]
mov rbx, rax
mov qword [rsi + 0x58], rax
test rax, rax
je 0x140031f4e
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140031f23
mov rax, qword [rsp + 0x48]
sub rax, rbx
add rax, qword [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov qword [rsi + 0x50], rax
lea rcx, [rsi + 0x28]
call fcn.140031c80
movups xmm0, xmmword [rax]
movups xmmword [rsi + 0x70], xmm0
call fcn.14004f6a0
mov rcx, rax
mov rdx, rsi
call fcn.14004f930
mov al, 1
mov rbx, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rsi
ret

Function at 0x1400329d0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
mov edi, r8d
mov ecx, 0x10
mov rbx, rdx
call fcn.1402dfa60
mov r14, rax
lea r8, [0x140032e30]
mov edx, 0x10000
mov r9, r14
mov qword [rax], rbx
mov byte [rax + 8], 0
mov dword [rax + 0xc], edi
xor eax, eax
mov qword [rsp + 0x28], rax
test rsi, rsi
cmove edx, eax
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140032a41
mov rcx, r14
call fcn.1402dfaa0
xor al, al
jmp 0x140032a4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x140032a70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
mov rsi, rcx
mov edi, r9d
mov ecx, 0x10
mov r14, r8
mov rbx, rdx
call fcn.1402dfa60
mov r15, rax
lea r8, [0x140032e30]
test r14, r14
mov r9, r15
setne dl
mov qword [rax], rbx
mov byte [rax + 8], dl
mov edx, 0x10000
mov dword [rax + 0xc], edi
xor eax, eax
mov qword [rsp + 0x28], rax
test rsi, rsi
cmove edx, eax
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
jne 0x140032aee
mov rcx, r15
call fcn.1402dfaa0
xor al, al
jmp 0x140032b03
test r14, r14
je 0x140032af8
mov qword [r14], rax
jmp 0x140032b01
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
jmp 0x140032a70

Function at 0x140035060
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov r10, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
xor r9, rax
mov rsi, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [r10 + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and r8, r9
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x1400350fe
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400350fe
mov ecx, dword [r11]
nop word [rax + rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140035151
cmp rbx, rax
jne 0x1400350f0
mov rax, qword [rdi]
cmp rbx, rax
je 0x140035133
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x140035195
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x1400351c1
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r10 + 0x10]
call fcn.14035c440
mov rcx, rdi
call fcn.1402dfaa0
mov rax, rsi
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, rbx
jne 0x14003519f
mov qword [rdx], rdi
jmp 0x1400351c1
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400351c1
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.1400398c0
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400351f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r9
mov r10, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
xor r9, rax
mov r14, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [r10 + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and r8, r9
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x14003528e
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14003528e
mov ecx, dword [r11]
nop dword [rax + rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1400352e4
cmp rbx, rax
jne 0x140035280
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400352c3
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x140035345
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x140035371
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rsp + 0x30], rsi
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r10 + 0x10]
call fcn.140039f50
mov rcx, qword [rdi + 0x18]
call fcn.1402dfaa0
mov rcx, rdi
mov qword [rdi + 0x18], 0
call fcn.1402dfaa0
mov rsi, qword [rsp + 0x30]
mov rax, r14
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
cmp rax, rbx
jne 0x14003534f
mov qword [rdx], rdi
jmp 0x140035371
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140035371
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.140039980
mov rbx, qword [rsp + 0x38]
mov rax, r14
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
mov byte [r14 + 8], 1
add rsp, 0x20
pop r14
ret
Function at 0x140035450
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
movzx r9d, byte [r8]
mov rbp, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rsi, rdx
movzx eax, byte [r8 + 1]
mov r15, qword [rbp + 0x30]
mov rbx, qword [rbp + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [rbp + 0x18]
and r15, r9
shl r15, 4
mov rax, qword [rcx + r15]
cmp rbx, rax
je 0x14003551f
mov rbx, qword [rcx + r15 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14003551f
mov rcx, qword [r8]
nop dword [rax + rax]
mov rbx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x14003558e
cmp rbx, rax
jne 0x140035510
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 8]
mov qword [rsp + 0x40], rdi
mov rdx, qword [rdx]
call fcn.1400353a0
mov rdi, qword [rbp + 8]
mov rdi, qword [rdi]
mov rax, qword [rdi]
cmp rbx, rax
je 0x140035570
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rbp + 0x18]
add rdx, r15
mov rax, qword [rdx]
cmp rax, qword [rbp + 8]
jne 0x140035597
mov qword [rdx], rdi
mov rax, qword [rbp + 0x18]
mov qword [r15 + rax + 8], rdi
jmp 0x1400355c3
mov qword [rdx], rbx
mov byte [rdx + 8], 0
jmp 0x1400355d7
cmp rax, rbx
jne 0x1400355a1
mov qword [rdx], rdi
jmp 0x1400355c3
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x1400355c3
mov rdx, qword [rbp + 0x18]
mov rax, qword [rdx + r15 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r15 + 8], rcx
mov rcx, rbp
call fcn.140039a40
mov qword [rsi], rdi
mov rdi, qword [rsp + 0x40]
mov byte [rsi + 8], 1
mov rbx, qword [rsp + 0x48]
mov rax, rsi
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x1400355f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
mov r10, rcx
movzx r9d, byte [r8]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, r8
xor r9, rax
mov rsi, rdx
movzx eax, byte [r8 + 1]
mov rbx, qword [r10 + 8]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and r8, r9
shl r8, 4
mov rax, qword [rcx + r8]
cmp rbx, rax
je 0x1400356bf
mov rbx, qword [rcx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x1400356bf
mov rcx, qword [r11]
nop word [rax + rax]
mov rbx, qword [rbx + 8]
cmp rcx, qword [rbx + 0x10]
je 0x140035712
cmp rbx, rax
jne 0x1400356b0
mov rax, qword [rdi]
cmp rbx, rax
je 0x1400356f4
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rcx, qword [rax + 8]
mov rdx, qword [rbx + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x14003574d
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [r8 + rax + 8], rdi
jmp 0x140035779
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov rcx, rdi
dec qword [r10 + 0x10]
call fcn.1402dfaa0
mov rax, rsi
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp rax, rbx
jne 0x140035757
mov qword [rdx], rdi
jmp 0x140035779
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140035779
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.140039a40
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140035e70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rax, [0x1403b1ad0]
mov rbx, rcx
mov qword [rcx], rax
add rcx, 8
call fcn.140031ba0
lea rcx, [rbx + 0x10]
call fcn.140031ba0
xor edi, edi
mov byte [rbx + 0x18], 0
mov dword [rbx + 0x1c], edi
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
lea ecx, [rdi + 0x40]
mov qword [rbx + 0x38], rdi
mov byte [rbx + 0x40], dil
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x68], rdi
call fcn.1402dfa60
test rax, rax
je 0x1400360a0
lea rcx, [rax + 8]
mov qword [rax], rax
test rcx, rcx
je 0x140035eea
mov qword [rcx], rax
lea rcx, [rax + 0x10]
test rcx, rcx
je 0x140035ef6
mov qword [rcx], rax
mov word [rax + 0x18], 0x101
lea rcx, [rbx + 0x90]
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x88], 0xf
mov qword [rbx + 0x80], rdi
mov byte [rbx + 0x70], dil
call fcn.140035ba0
lea rcx, [rbx + 0xd8]
mov dword [rbx + 0xd0], edi
call fcn.140035c10
lea rcx, [rbx + 0x118]
call fcn.140035ba0
lea rcx, [rbx + 0x158]
call fcn.140035b30
lea rcx, [rbx + 0x198]
call fcn.140035ba0
mov qword [rbx + 0x1d8], rdi
lea rcx, [rbx + 0x200]
mov qword [rbx + 0x1e0], rdi
mov dword [rbx + 0x1e8], edi
mov qword [rbx + 0x1f0], rdi
mov eax, dword [0x1403b392c]
mov qword [rbx + 0x1f8], rax
call fcn.140051bb0
lea rcx, [rbx + 0x2b0]
mov qword [rbx + 0x298], rdi
xor edx, edx
mov qword [rbx + 0x2a0], rdi
mov qword [rbx + 0x2a8], rdi
call fcn.1400478a0
lea rcx, [rbx + 0x2bc]
xor edx, edx
call fcn.1400478a0
lea rcx, [rbx + 0x2c8]
xor edx, edx
call fcn.1400478a0
lea rcx, [rbx + 0x2d8]
call fcn.140035c10
mov qword [rbx + 0x318], rdi
lea rcx, [rbx + 0x328]
xor edx, edx
mov qword [rbx + 0x320], rdi
call fcn.14002db90
lea rcx, [rbx + 0x338]
mov qword [rbx + 0x330], rdi
xor edx, edx
call fcn.14002db90
mov qword [rbx + 0x340], rdi
mov byte [rbx + 0x348], dil
mov qword [rbx + 0x350], rdi
call fcn.140292ef0
call sub.KERNEL32.dll_GetCurrentProcessId
movsxd rcx, eax
mov dword [rbx + 0x1e8], eax
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
mov qword [rbx + 0x1e0], rcx
mov rcx, rbx
call fcn.1400382d0
mov rcx, qword [rbx + 0x20]
mov qword [rbx + 0x20], rax
test rcx, rcx
je 0x140036071
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rsp + 0x30], rdi
call fcn.1400551f0
mov rcx, rax
lea r9, [rsp + 0x30]
lea r8, str.TraceLog
mov rdx, rbx
call fcn.140055210
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.1402e5d40
int3