joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035980
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rdx
mov rdi, rcx
cmp dword [rax + 0x2a8], 1
jne 0x140035a87
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, rax
test rax, rax
je 0x140035a87
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebp
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x140035a87
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140035a59
mov rax, qword [rdi]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x58]
test al, al
jne 0x140035a79
call fcn.14001bd20
cmp eax, 2
jg 0x140035a50
lea rdx, str.Failed_to_write_metadata_block._n
mov ecx, 2
call fcn.14001c3a0
test al, al
jne 0x140035a50
mov ecx, 2
call fcn.140121458
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_metadata_block._n
call fcn.1400020d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, rbx
jmp 0x140035a64
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400362d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 8
movsxd rax, edx
add rax, rax
mov r11, qword [rcx + rax*8 + 0x18]
test r11, r11
je 0x140035b33
mov qword [rsp], rbx
mov rbx, qword [rcx + rax*8 + 0x10]
add rbx, rcx
shl r11, 5
mov rcx, r11
mov r10, rbx
sar rcx, 5
test rcx, rcx
jle 0x140035b04
mov rdx, rcx
shr rdx, 1
mov rax, rdx
shl rax, 5
cmp qword [rax + r10], r8
jae 0x140035afc
add rax, 0x20
add r10, rax
mov rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
jmp 0x140035aff
mov rcx, rdx
test rcx, rcx
jg 0x140035ad3
lea rax, [r11 + rbx]
mov rbx, qword [rsp]
cmp r10, rax
je 0x140035b33
cmp qword [r10], r8
jne 0x140035b33
test r9, r9
je 0x140035b2c
mov rax, qword [r10 + 8]
mov qword [r9], rax
movups xmm0, xmmword [r10 + 0x10]
movups xmmword [r9 + 8], xmm0
mov al, 1
add rsp, 8
ret
xor al, al
add rsp, 8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rsi, edx
mov rbx, r8
mov edx, esi
mov rdi, rcx
call fcn.140039230
test al, al
jne 0x140036308
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14003632d
xor r9d, r9d
mov r8, rbx
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140035aa0
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rsi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rdi + 0x70]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rdi + 0x58]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rdi + 0x48]
je 0x1400363e1
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1400363e3
nop dword [rax + rax]
cmp rax, rcx
je 0x1400363e1
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400363d0
jmp 0x1400363e3
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x140036400
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, r8
mov edx, edi
mov rsi, rcx
call fcn.140039230
test al, al
jne 0x140036438
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rdi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rsi + 0xd0]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rsi + 0xb8]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rsi + 0xa8]
je 0x1400364f1
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x1400364f3
nop
cmp rax, rcx
je 0x1400364f1
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400364e0
jmp 0x1400364f3
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x140036530
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
cmp qword [rax], 0
jne 0x14003660c
cmp qword [rax + 8], 0
jne 0x14003660c
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x140036644
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400365ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r8, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.140036c30
movzx esi, al
test al, al
je 0x1400365ef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.14001bd20
cmp eax, 2
jg 0x140036644
lea rdx, str.Cannot_use_imported_metadata_along_with_white__or_blacklists._n
mov ecx, 2
call fcn.14001c3a0
test al, al
jne 0x140036644
mov ecx, 2
call fcn.140121458
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Cannot_use_imported_metadata_along_with_white__or_blacklists._n
call fcn.1400020d0
mov rbx, qword [rsp + 0x70]
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x140039700
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r14, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
test byte [rbp + 0x38], 1
jne 0x14003991f
cmp dword [rcx + 0x30], 1
je 0x14003991f
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x14003974f
mov al, 1
jmp 0x140039921
mov r9, rdi
mov r8d, esi
lea rdx, str._02x._016llx.json
lea rcx, [rbp - 0x60]
call fcn.1400319c0
xor edi, edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], dil
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140039786
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140001ad0
nop
lea rdx, [rbx + 0x10]
lea r8, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.1400417b0
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400397ea
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400397e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140039944
call fcn.140116d50
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
lea rdx, [0x14014dfb8]
call fcn.140123fac
mov rdi, rax
test rax, rax
jne 0x14003987b
call fcn.14001bd20
cmp eax, 2
jg 0x1400398d5
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r8, qword [rbp - 0x40]
lea rdx, str.Failed_to_write_serialized_state_to_disk___s_._n
lea ecx, [rdi + 2]
call fcn.14001c3a0
test al, al
jne 0x1400398d5
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea ecx, [rdi + 2]
call fcn.140121458
mov r8, rbx
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk___s_._n
mov rcx, rax
call fcn.1400020d0
xor bl, bl
jmp 0x1400398e3
mov r9, rdi
mov r8, qword [rbp + 0x30]
mov edx, 1
mov rcx, r14
call fcn.140124cf8
cmp rax, qword [rbp + 0x30]
je 0x1400398d9
call fcn.14001bd20
cmp eax, 2
jg 0x1400398cd
lea rdx, str.Failed_to_write_serialized_state_to_disk._n
mov ecx, 2
call fcn.14001c3a0
test al, al
jne 0x1400398cd
mov ecx, 2
call fcn.140121458
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk._n
call fcn.1400020d0
mov rcx, rdi
call fcn.140123e8c
xor bl, bl
jmp 0x1400398e3
mov rcx, rdi
call fcn.140123e8c
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14003991a
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003993e
call fcn.140116d50
movzx eax, bl
jmp 0x140039921
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14011d39c
nop
call fcn.14011d39c
nop
int3
Function at 0x1400418f0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x60
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x140041903
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x14004194c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140041944
cmp qword [rbx + 0x18], 0x10
jb 0x140041926
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140129e3c
test eax, eax
js 0x140041944
movzx eax, word [rsp + 0x26]
shr ax, 0xe
and al, 1
jne 0x14004194c
xor al, al
add rsp, 0x60
pop rbx
ret
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140041ef0
Capabilities:
Timestomp file

Disassembly:
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x18], 0x10
jb 0x140041f00
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140041f3c
xor al, al
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
mov rcx, rdi
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140042760
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140152d00]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1400427d9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140042780
test r8, r8
je 0x1400427fd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400427e0
not ecx
mov eax, ecx
ret
Function at 0x140043130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call fcn.140124a90
mov rcx, qword [rbx + 0x68]
add rdi, qword [rcx + 0x78]
js 0x140043199
cmp rax, rdi
je 0x14004317f
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call fcn.140124540
test eax, eax
jne 0x140043199
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call fcn.140124cf8
jmp 0x1400431a2
mov dword [rbx + 0x1c], 0x16
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140052c30
Capabilities:
Hash data using fnv

Disassembly:
push rdi
push r14
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r14, rdx
mov rdi, rcx
cmp rax, qword [rcx]
jbe 0x140052e5b
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop dword [rax + rax]
mov rbx, qword [rdi + 0x88]
sub rax, qword [rbx + 0x20]
mov qword [rdi + 8], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x140052ca1
mov qword [rcx + 8], rax
jmp 0x140052ca8
mov qword [rdi + 0x80], rax
test rax, rax
je 0x140052cb2
mov qword [rax], rcx
jmp 0x140052cb9
mov qword [rdi + 0x88], rcx
mov rcx, qword [r14]
lea rdx, [rsp + 0x50]
mov rax, qword [rbx + 0x18]
add rcx, 0x448
mov rsi, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
call fcn.14005e270
test rsi, rsi
je 0x140052d12
mov rax, qword [r14]
mov rdx, rsi
mov rcx, qword [rax + 0x1050]
add rcx, 0xec8
call fcn.1400133a0
mov rax, qword [r14]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rax + 0x1050]
mov rcx, qword [rcx + 0x18]
call qword [0x140203228]
mov rcx, qword [r14]
mov eax, 1
lock xadd dword [rcx + 0x1020], eax
movzx eax, byte [rbx + 0x19]
movzx edx, byte [rbx + 0x18]
mov r11, qword [rdi + 0x58]
xor rdx, r12
mov r9, qword [rdi + 0x48]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1a]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1b]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1c]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1d]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1e]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1f]
imul rdx, r15
xor rdx, rax
imul rdx, r15
and rdx, qword [rdi + 0x70]
mov r10, rdx
add r10, r10
mov rsi, qword [r11 + r10*8 + 8]
mov rcx, rsi
cmp rsi, r9
je 0x140052e0e
mov rax, qword [rbx + 0x18]
mov r8, qword [r11 + r10*8]
cmp rax, qword [rsi + 0x10]
je 0x140052db6
cmp rcx, r8
je 0x140052e0e
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140052da7
test rcx, rcx
je 0x140052e0e
add rdx, rdx
mov rax, qword [r11 + rdx*8]
cmp rsi, rcx
jne 0x140052de2
cmp rax, rcx
jne 0x140052dd7
mov qword [r11 + rdx*8], r9
mov qword [r11 + r10*8 + 8], r9
jmp 0x140052dee
mov r9, qword [rcx + 8]
mov qword [r11 + r10*8 + 8], r9
jmp 0x140052dee
cmp rax, rcx
jne 0x140052dee
mov rax, qword [rcx]
mov qword [r11 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x50]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.140116d50
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x60], rbx
cmp rdx, qword [rdi + 0x20]
je 0x140052e27
mov qword [rdx], rbx
add qword [rdi + 0x18], 8
jmp 0x140052e35
lea r8, [rsp + 0x60]
lea rcx, [rdi + 0x10]
call fcn.140002300
mov rax, qword [rdi + 8]
cmp rax, qword [rdi]
ja 0x140052c80
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop r14
pop rdi
ret
Function at 0x1400589d0
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov ebx, dword [0x140202f2c]
mov rbp, r8
movzx edi, r9b
mov r14, rdx
mov rsi, rcx
lea eax, [rbx + 1]
mov dword [0x140202f2c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str..PipeFossilize._08lx._08x
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400319c0
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x30], 0x2710
mov edx, edi
mov dword [rsp + 0x28], 0x1000
shl edx, 0x1e
or edx, 1
mov dword [rsp + 0x20], 0x1000
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x140058aaa
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
mov r9, rbp
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x140058aae
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140058ab0
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14005c5a0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, [0x140202ca0]
lea rcx, [rsp + 0x38]
call fcn.1400531f0
call fcn.1400628d0
mov ecx, 2
call fcn.140121458
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121458
mov rcx, rax
call fcn.140121814
mov ecx, 2
call fcn.140121458
mov rcx, rax
call fcn.140121814
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14005e010
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x60
mov r10, rcx
movzx r9d, dl
lea rbx, [rcx + 0x448]
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, rdx
imul r9, r11
shr rax, 8
movzx r8d, al
mov rax, rdx
xor r9, r8
shr rax, 0x10
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x38
mov rcx, qword [r10 + 0x478]
imul r9, r11
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x460]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 0x450]
je 0x14005e0ff
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14005e0f2
cmp rax, rcx
je 0x14005e0ff
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14005e0e3
test rax, rax
je 0x14005e0ff
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [r10 + 0x138]
test rcx, rcx
je 0x14005e11a
mov eax, 1
lock xadd dword [rcx + 0x60], eax
mov rdx, qword [rsp + 0x78]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdx
xor eax, eax
mov qword [rsp + 0x38], 4
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, r10
mov word [rsp + 0x44], 1
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 3
call fcn.14005e170
lea r8, [rsp + 0x78]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.1400331a0
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x14005e270
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov rbx, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r11, r8
shl r11, 4
add r11, rdi
mov rcx, qword [r11 + 8]
cmp rcx, r9
je 0x14005e396
mov rax, qword [rbx]
mov rdx, qword [r11]
cmp rax, qword [rcx + 0x10]
je 0x14005e32f
nop dword [rax + rax]
cmp rcx, rdx
je 0x14005e396
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x14005e320
test rcx, rcx
je 0x14005e396
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r11 + 8], rcx
jne 0x14005e35a
cmp rax, rcx
jne 0x14005e350
mov qword [rdi + r8*8], r9
mov qword [r11 + 8], r9
jmp 0x14005e366
mov r9, qword [rcx + 8]
mov qword [r11 + 8], r9
jmp 0x14005e366
cmp rax, rcx
jne 0x14005e366
mov rax, qword [rcx]
mov qword [rdi + r8*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140116d50
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14005e3b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
movzx r10d, r8b
movabs rbx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r10, rax
mov rax, r8
imul r10, rbx
shr rax, 8
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x10
mov r9, qword [r11 + 0x48]
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x18
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x20
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x28
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x30
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x38
mov rcx, qword [r11 + 0x70]
imul r10, rbx
xor r10, rax
imul r10, rbx
and rcx, r10
shl rcx, 4
add rcx, qword [r11 + 0x58]
mov rax, qword [rcx + 8]
cmp rax, r9
je 0x14005e50e
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x14005e488
cmp rax, rcx
je 0x14005e50e
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x14005e475
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14005e50e
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx]
mov r8, qword [rcx + 8]
test r9, r9
je 0x14005e4aa
mov qword [r9 + 8], r8
jmp 0x14005e4b1
mov qword [r11 + 0x80], r8
test r8, r8
je 0x14005e4bb
mov qword [r8], r9
jmp 0x14005e4c2
mov qword [r11 + 0x88], r9
mov r8, qword [r11 + 0x80]
test r8, r8
je 0x14005e4da
mov qword [r8], rcx
mov r8, qword [r11 + 0x80]
jmp 0x14005e4e4
mov qword [r11 + 0x88], rcx
xor r8d, r8d
mov qword [rcx + 8], r8
mov qword [rcx], 0
mov qword [r11 + 0x80], rcx
mov rcx, qword [rax + 0x18]
mov byte [rdx + 8], 1
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, rdx
mov qword [rdx], 0
mov byte [rdx + 8], 0
ret