joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c4e0
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp - 0x70], eax
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x102
lea rcx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r8, [0x1400710fc]
mov edx, 0x104
lea rcx, [rbp - 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x104
lea rcx, [rbp + 0x19c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ecx, dword [0x14008b5cc]
mov eax, dword [0x14008b5c8]
xor ebx, ebx
add ecx, eax
je 0x14000c61a
mov dword [rsp + 0x70], ebx
call fcn.140018520
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rax, qword [rsp + 0x68]
test rax, rax
jne 0x14000c5a4
call fcn.140018520
mov qword [rsp + 0x68], rax
lock inc dword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x78], 0x20
mov edx, 1
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x19c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0x78]
movsx edx, dx
call fcn.140003c70
mov qword [rsp + 0x68], rbx
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
js 0x14000c615
call fcn.14001ed00
mov eax, 0xffffffff
lock xadd dword [rsp + 0x70], eax
cmp eax, 1
jns 0x14000c600
lock inc dword [rsp + 0x70]
call fcn.14000bd70
test al, al
je 0x14000c6c4
mov dword [rbp - 0x78], ebx
mov word [rbp - 0x74], 0x500
mov qword [rbp - 0x80], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x14000c6a4
mov dword [rsp + 0x60], ebx
lea r8, [rsp + 0x60]
mov rdx, qword [rbp - 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x60]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x60], ecx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x60], 1
je 0x14000c6c4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140009db0
test al, al
sete bl
lea rcx, [rbp - 0x70]
call fcn.140003cd0
movzx eax, bl
jmp 0x14000c6cf
lea rcx, [rbp - 0x70]
call fcn.140003cd0
xor al, al
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140030280
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rbp
ret
Function at 0x1400158d0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r8d, 0x1505
mov rdx, qword [rdx + 0x10]
mov r9, qword [rdx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x140015907
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x1400158f0
and r8, qword [rcx + 0x38]
shl r8, 4
add r8, qword [rcx + 0x20]
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x14001595a
cmp rax, rdx
jne 0x14001593f
mov rax, qword [rcx + 0x10]
add rcx, 0x10
mov qword [r8], rax
mov qword [r8 + 8], rax
call fcn.14001b470
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rdx + 8]
add rcx, 0x10
mov qword [r8 + 8], rax
call fcn.14001b470
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
cmp rax, rdx
jne 0x140015965
mov rax, qword [rdx]
mov qword [r8], rax
add rcx, 0x10
call fcn.14001b470
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret

Function at 0x140015980
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rdi, [rcx + 8]
mov ebx, 0x1505
mov rcx, qword [rdx]
movzx eax, word [rcx]
test ax, ax
je 0x1400159c6
nop dword [rax]
nop word [rax + rax]
imul rbx, rbx, 0x21
movzx eax, ax
lea rcx, [rcx + 2]
add rbx, rax
movzx eax, word [rcx]
test ax, ax
jne 0x1400159b0
mov r8, rdx
mov r9, rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140021430
xor esi, esi
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140015a52
mov rcx, qword [rdi + 0x30]
mov r8, qword [rdi + 0x18]
and rcx, rbx
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x140015a37
cmp rax, rdx
jne 0x140015a1f
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.14001b470
mov ecx, 1
jmp 0x140015a55
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
lea rcx, [rdi + 8]
call fcn.14001b470
mov ecx, 1
jmp 0x140015a55
cmp rax, rdx
jne 0x140015a42
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [rdi + 8]
call fcn.14001b470
mov ecx, 1
jmp 0x140015a55
mov rcx, rsi
mov rbx, qword [rsp + 0x40]
test rcx, rcx
mov eax, 0x490
cmovne eax, esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140015a70
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8, qword [rdx]
mov rdi, rcx
mov r9d, 0x1505
movzx eax, word [r8]
test ax, ax
je 0x140015aa7
nop
imul r9, r9, 0x21
movzx eax, ax
lea r8, [r8 + 2]
add r9, rax
movzx eax, word [r8]
test ax, ax
jne 0x140015a90
mov r8, rdx
add rcx, 8
lea rdx, [rsp + 0x20]
call fcn.140021430
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140015ac5
mov rcx, qword [rdi + 0x10]
mov rbx, qword [rsp + 0x40]
lea rax, [rcx + 0x18]
xor edx, edx
cmp qword [rdi + 0x10], rcx
cmove rax, rdx
add rsp, 0x30
pop rdi
ret
Function at 0x140015ae0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rdx]
mov rsi, r8
mov rbx, rcx
mov r9d, 0x1505
movzx eax, word [r10]
test ax, ax
je 0x140015b27
nop word [rax + rax]
imul r9, r9, 0x21
movzx eax, ax
lea r10, [r10 + 2]
add r9, rax
movzx eax, word [r10]
test ax, ax
jne 0x140015b10
mov r8, rdx
add rcx, 8
lea rdx, [rsp + 0x20]
call fcn.140021430
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x140015b45
mov rcx, qword [rbx + 0x10]
cmp qword [rbx + 0x10], rcx
jne 0x140015b60
mov eax, 0x490
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 0x18]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov qword [rsi], rcx
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140015e10
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rdx]
mov r10d, 0x1505
mov rdx, rdi
movzx eax, word [rdi]
test ax, ax
je 0x140015e56
nop word [rax + rax]
imul r10, r10, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r10, rax
movzx eax, word [rdx]
test ax, ax
jne 0x140015e40
and r10, qword [rcx + 0x38]
lea rsi, [rcx + 0x10]
mov rbp, qword [rcx + 0x20]
mov rax, r10
mov rbx, qword [rsi]
add rax, rax
xor r15d, r15d
mov qword [rsp + 0x40], r14
mov r8, qword [rbp + rax*8 + 8]
cmp r8, rbx
je 0x140015f22
mov r11, qword [rbp + rax*8]
lea r14, [0x140071674]
nop dword [rax]
mov rax, qword [r8 + 0x10]
mov r9, r14
test rax, rax
cmovne r9, rax
test rdi, rdi
mov rax, r14
cmovne rax, rdi
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x140015ec4
add rax, 2
test ecx, ecx
jne 0x140015eb0
test edx, edx
je 0x140015ed3
cmp r8, r11
je 0x140015f22
mov r8, qword [r8 + 8]
jmp 0x140015e90
test r8, r8
je 0x140015f22
add r10, r10
mov rax, qword [rbp + r10*8]
cmp qword [rbp + r10*8 + 8], r8
jne 0x140015f03
cmp rax, r8
jne 0x140015ef8
mov qword [rbp + r10*8], rbx
mov qword [rbp + r10*8 + 8], rbx
jmp 0x140015f10
mov rbx, qword [r8 + 8]
mov qword [rbp + r10*8 + 8], rbx
jmp 0x140015f10
cmp rax, r8
jne 0x140015f10
mov rax, qword [r8]
mov qword [rbp + r10*8], rax
mov rdx, r8
mov rcx, rsi
call fcn.14001b470
mov ecx, 1
jmp 0x140015f25
mov rcx, r15
mov r14, qword [rsp + 0x40]
test rcx, rcx
mov rbx, qword [rsp + 0x48]
mov eax, 0x490
mov rbp, qword [rsp + 0x50]
cmovne eax, r15d
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret

Function at 0x140015f50
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rdx]
mov rbx, rcx
add rcx, 8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x140015f87
nop
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x140015f70
call fcn.140027950
cmp qword [rbx + 0x10], rax
je 0x140015f9c
add rax, 0x18
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140015fb0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rdx]
mov rbx, rcx
add rcx, 8
mov rdi, r8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x140015ff7
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x140015fe0
call fcn.140027950
cmp qword [rbx + 0x10], rax
jne 0x140016012
mov eax, 0x490
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rax + 0x18]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov qword [rdi], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x140016200
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rdx + 0x10]
mov rsi, rdx
mov r8d, 0x1505
mov r9, qword [rbx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x140016247
nop dword [rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x140016230
mov rdx, qword [rcx + 0x38]
and rdx, r8
shl rdx, 4
add rdx, qword [rcx + 0x20]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x14001627b
cmp rax, rbx
jne 0x140016271
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140016286
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x140016286
cmp rax, rbx
jne 0x140016286
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
dec qword [rcx + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rdi
mov rax, qword [rbx + 8]
mov qword [rdi + 8], rax
call fcn.140028070
mov edx, 0x20
mov rcx, rbx
call fcn.1400302a0
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 0x10], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400162d0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [rdx]
mov rsi, rcx
mov r9d, 0x1505
mov rdx, rdi
movzx eax, word [rdi]
test ax, ax
je 0x140016316
nop dword [rax]
imul r9, r9, 0x21
movzx eax, ax
lea rdx, [rdx + 2]
add r9, rax
movzx eax, word [rdx]
test ax, ax
jne 0x140016300
and r9, qword [rcx + 0x38]
xor r15d, r15d
mov rbp, qword [rcx + 0x20]
mov rax, r9
mov r11, qword [rcx + 0x10]
add rax, rax
mov qword [rsp + 0x40], r14
mov rbx, qword [rbp + rax*8 + 8]
cmp rbx, r11
je 0x140016403
mov r10, qword [rbp + rax*8]
lea r14, [0x140071674]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
mov r8, r14
test rax, rax
cmovne r8, rax
test rdi, rdi
mov rax, r14
cmovne rax, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140016384
add rax, 2
test ecx, ecx
jne 0x140016370
test edx, edx
je 0x140016393
cmp rbx, r10
je 0x140016403
mov rbx, qword [rbx + 8]
jmp 0x140016350
test rbx, rbx
je 0x140016403
add r9, r9
mov rax, qword [rbp + r9*8]
cmp qword [rbp + r9*8 + 8], rbx
jne 0x1400163c3
cmp rax, rbx
jne 0x1400163b8
mov qword [rbp + r9*8], r11
mov qword [rbp + r9*8 + 8], r11
jmp 0x1400163d0
mov r11, qword [rbx + 8]
mov qword [rbp + r9*8 + 8], r11
jmp 0x1400163d0
cmp rax, rbx
jne 0x1400163d0
mov rax, qword [rbx]
mov qword [rbp + r9*8], rax
mov rdx, qword [rbx]
dec qword [rsi + 0x18]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
lea rdx, [rbx + 0x10]
call fcn.140028070
mov edx, 0x20
mov rcx, rbx
call fcn.1400302a0
mov ecx, 1
jmp 0x140016406
mov rcx, r15
mov r14, qword [rsp + 0x40]
test rcx, rcx
mov rbx, qword [rsp + 0x48]
mov eax, 0x490
mov rbp, qword [rsp + 0x50]
cmovne eax, r15d
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret

Function at 0x140016430
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rdx]
mov rbx, rcx
add rcx, 8
mov rdi, r8
mov r8d, 0x1505
movzx eax, word [r9]
test ax, ax
je 0x140016477
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x140016460
call fcn.140027950
cmp qword [rbx + 0x10], rax
jne 0x140016492
mov eax, 0x490
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [rax + 0x18]
mov rcx, rdi
call fcn.14001f620
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x140016cb0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140016ce0
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140016d08
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140016d0a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140016d6b
test ecx, ecx
jle 0x140016d43
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140016d6b
cmp qword [rdi + 0x80], 0
je 0x140016d6b
lfence
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140016d90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140016dc1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140016ddb
lfence
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x38], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140016dfe
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140016e00
xor ecx, ecx
mov qword [rsp + 0x30], rbx
movsxd rax, ecx
test ecx, ecx
je 0x140016e37
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140016ed4
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140016e72
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, rdi
cmp rdi, 0xfff
jbe 0x140016eb1
nop
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x140016ed4
cmp rdi, rax
ja 0x140016e80
test rbx, rbx
je 0x140016ed4
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rdi, rbx
sub rdi, rax
sub rbp, rdi
mov rax, rbp
lfence
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
invalid
Function at 0x140017320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001734d
xor eax, eax
jmp 0x1400174a5
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140017378
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140017378
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400174a5
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140017498
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1400173bb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400173e6
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001749d
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140017455
sub eax, 1
je 0x140017455
cmp eax, 2
jne 0x140017498
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001749d
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140017486
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140017498
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov eax, edi
jne 0x14001749d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140030280
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140019a60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140087010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140019b3d
cmp byte [rcx + 0x71], 0
je 0x140019b3d
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x14002e715.0]
cmp eax, 0xffffffff
je 0x140019b39
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140019afb
sub eax, 1
je 0x140019aff
cmp eax, 2
jne 0x140019b39
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030280
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140019b30
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140019b39
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140019ae3
xor al, al
jmp 0x140019ae3
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140030280
add rsp, 0x60
pop rbx
ret
Function at 0x14001c7a0
Capabilities:
Hash data using djb2

Disassembly:
push rdi
push r15
sub rsp, 0x38
movabs rax, 0xfffffffffffffff
mov r15, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14001c7d6
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [r15 + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x30], r12
inc ecx
shl rdi, cl
lea rcx, [r15 + 0x18]
lea rdx, [rdi + rdi]
call fcn.14001b320
lea rax, [rdi - 1]
mov qword [r15 + 0x38], rdi
mov qword [r15 + 0x30], rax
mov rax, qword [r15 + 8]
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x14001c997
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], r13
lea r13, [0x140071674]
mov qword [rsp + 0x20], r14
nop
mov rbp, qword [rax + 0x10]
mov r9d, 0x1505
mov rdx, qword [rdx]
mov r8, rbp
movzx ecx, word [rbp]
test cx, cx
je 0x14001c877
nop dword [rax]
imul r9, r9, 0x21
movzx ecx, cx
lea r8, [r8 + 2]
add r9, rcx
movzx ecx, word [r8]
test cx, cx
jne 0x14001c860
mov r14, qword [r15 + 0x30]
and r14, r9
shl r14, 4
add r14, qword [r15 + 0x18]
mov rsi, qword [r14]
cmp rsi, rbx
jne 0x14001c89a
mov qword [r14], rax
mov qword [r14 + 8], rax
jmp 0x14001c977
mov rcx, qword [r14 + 8]
mov r11, r13
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
mov r8, rbp
sub r11, rbp
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x14001c8c9
add r8, 2
test r9d, r9d
jne 0x14001c8b2
test r10d, r10d
jne 0x14001c8fd
mov r10, qword [rcx]
cmp r10, rax
je 0x14001c8f7
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14 + 8], rax
jmp 0x14001c977
mov rdi, rcx
cmp rsi, rcx
je 0x14001c953
nop word [rax + rax]
mov rcx, qword [rcx + 8]
mov r11, r13
mov rdi, rcx
mov r8, qword [rcx + 0x10]
test r8, r8
cmovne r11, r8
test rbp, rbp
mov r8, r13
cmovne r8, rbp
sub r11, r8
movzx r10d, word [r8]
movzx r9d, word [r8 + r11]
sub r10d, r9d
jne 0x14001c949
add r8, 2
test r9d, r9d
jne 0x14001c932
test r10d, r10d
je 0x14001c9a9
cmp rsi, rcx
jne 0x14001c910
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov qword [rdi + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [r14], rax
mov rax, rdx
cmp rdx, rbx
jne 0x14001c840
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
add rsp, 0x38
pop r15
pop rdi
ret
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x14001c977