joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012b50
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rdi, r8
lea rcx, str.application
xorps xmm0, xmm0
lea r8, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
mov r13, rdx
mov dword [rbp - 0x10], 0xb
mov esi, 0x405
lea rdx, [rbp + 0x38]
mov word [rbp - 2], si
movabs r14, 0xffff000000000000
mov rax, qword [rbp - 8]
and rax, r14
or rax, rcx
mov rcx, rdi
mov qword [rbp - 8], rax
call fcn.14000af80
mov ecx, dword [rdi]
lea rbx, [0x1401bc408]
mov rax, qword [rdi + 8]
movabs r15, 0xffffffffffff
and rax, r15
shl rcx, 5
add rcx, rax
mov rax, qword [rbp + 0x38]
cmp rax, rcx
je 0x140012beb
lea rcx, [rax + 0x10]
jmp 0x140012bf8
xorps xmm0, xmm0
mov rcx, rbx
movups xmmword [0x1401bc408], xmm0
mov eax, 0x1000
test word [rcx + 0xe], ax
jne 0x140012c0a
mov rcx, qword [rcx + 8]
and rcx, r15
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400f6b50
xorps xmm0, xmm0
lea r8, [rbp - 0x10]
movups xmmword [rbp - 0x10], xmm0
mov word [rbp - 2], si
lea rdx, [rbp + 0x38]
mov rcx, qword [rbp - 8]
mov r12, rax
and rcx, r14
mov dword [rbp - 0x10], 3
lea rax, [0x140124a64]
or rcx, rax
mov qword [rbp - 8], rcx
mov rcx, rdi
call fcn.14000af80
mov r14d, dword [rdi]
mov rsi, qword [rdi + 8]
mov ecx, r14d
shl rcx, 5
mov rax, rsi
and rax, r15
add rcx, rax
mov rax, qword [rbp + 0x38]
cmp rax, rcx
je 0x140012c75
add rax, 0x10
jmp 0x140012c89
xorps xmm0, xmm0
mov rax, rbx
movups xmmword [0x1401bc408], xmm0
mov r14d, dword [rdi]
mov rsi, qword [rdi + 8]
mov r15d, dword [rax]
lea r8, [rbp - 0x10]
xorps xmm0, xmm0
lea rdx, [rbp + 0x38]
movups xmmword [rbp - 0x10], xmm0
mov eax, 0x405
mov dword [rbp - 0x10], 4
mov word [rbp - 2], ax
movabs rcx, 0xffff000000000000
mov rax, qword [rbp - 8]
and rax, rcx
lea rcx, str.hash
or rax, rcx
mov rcx, rdi
mov qword [rbp - 8], rax
call fcn.14000af80
mov rax, qword [rbp + 0x38]
movabs rdx, 0xffffffffffff
and rsi, rdx
mov ecx, r14d
shl rcx, 5
add rcx, rsi
cmp rax, rcx
je 0x140012cf8
lea rbx, [rax + 0x10]
jmp 0x140012d02
xorps xmm0, xmm0
movups xmmword [0x1401bc408], xmm0
mov eax, 0x1000
test word [rbx + 0xe], ax
jne 0x140012d14
mov rbx, qword [rbx + 8]
and rbx, rdx
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400f6b50
mov r10, qword [r13]
mov r8, rax
movabs r9, 0x100000001b3
mov edx, r12d
movabs rax, 0xaf63bd4c8601b7df
mov qword [rsp + 0x20], r8
xor rdx, rax
mov rcx, r12
imul rdx, r9
mov eax, r8d
shr rcx, 0x20
xor rdx, rcx
mov rcx, r13
imul rdx, r9
xor rdx, r15
imul rdx, r9
xor rdx, rax
mov rax, r8
imul rdx, r9
shr rax, 0x20
mov r9d, r15d
xor rdx, rax
mov r8, r12
call qword [r10 + 0x18]
lea r11, [rsp + 0x40]
mov al, 1
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140024cb0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x140024e93
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.1400019e0
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx]
cmp rdx, rdi
je 0x140024e58
mov qword [rsp + 0x30], rbp
mov rcx, rdx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + 0x11]
movzx r9d, byte [rcx + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rdx, qword [rdx]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x12]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x13]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x14]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x15]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x16]
imul r9, rbx
xor r9, rax
movzx eax, byte [rcx + 0x17]
imul r9, rbx
xor r9, rax
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r10, qword [r11]
cmp r10, rdi
jne 0x140024dcc
mov qword [r11], rcx
mov qword [r11 + 8], rcx
jmp 0x140024e47
mov rax, qword [r11 + 8]
mov r9, qword [rcx + 0x10]
cmp r9, qword [rax + 0x10]
jne 0x140024e09
mov r10, qword [rax]
cmp r10, rcx
je 0x140024e03
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
mov qword [r11 + 8], rcx
jmp 0x140024e47
mov r8, rax
cmp r10, rax
je 0x140024e23
mov rax, qword [rax + 8]
mov r8, rax
cmp r9, qword [rax + 0x10]
je 0x140024e6d
cmp r10, rax
jne 0x140024e11
mov r10, qword [rcx + 8]
mov qword [r10], rdx
mov r9, qword [rdx + 8]
mov qword [r9], r8
mov rax, qword [r8 + 8]
mov qword [rax], rcx
mov qword [r8 + 8], r9
mov qword [rdx + 8], r10
mov qword [rcx + 8], rax
mov qword [r11], rcx
mov rcx, rdx
cmp rdx, rdi
jne 0x140024d50
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rax]
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rax, qword [r10 + 8]
mov qword [rax], rcx
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rcx + 8], rax
jmp 0x140024e47
lea rcx, str.invalid_hash_bucket_count
call fcn.1400e95d0
int3
Function at 0x1400259a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rsi, r9
mov r12, r8
mov r13, rdx
mov rdi, rcx
mov eax, dword [r9 + 0x14]
cmp rax, r8
je 0x1400259d0
xor al, al
jmp 0x140025b41
xor ebx, ebx
mov qword [rsp + 0x88], rbx
lea r15, [rcx + 0x2a0]
mov qword [rsp + 0x20], r15
movzx ebp, byte [rsp + 0x90]
mov byte [rsp + 0x28], bpl
test bpl, bpl
je 0x140025a08
mov rcx, r15
call fcn.1400e9ba0
test eax, eax
jne 0x140025b8a
mov edx, dword [rsi + 8]
test bpl, bpl
je 0x140025acc
mov ecx, edx
call fcn.1400ec820
mov r14, rax
mov rbx, rax
mov qword [rsp + 0x88], rax
xor r8d, r8d
mov edx, dword [rsi]
mov rcx, qword [rdi + 0x18]
call fcn.1400f9db8
test eax, eax
js 0x140025b20
mov r8d, dword [rsi + 8]
mov r9, qword [rdi + 0x18]
mov edx, 1
mov rcx, r14
call fcn.1400f9ae0
mov edx, dword [rsi + 8]
cmp rax, rdx
jne 0x140025b20
test bpl, bpl
je 0x140025a6d
mov rcx, r15
call fcn.1400e9bc4
cmp dword [rsi + 0x10], 0
je 0x140025b56
mov r8d, dword [rsi + 8]
mov rdx, r14
xor ecx, ecx
call fcn.140031bd0
cmp eax, dword [rsi + 0x10]
je 0x140025b56
call fcn.1400111b0
cmp eax, 2
jg 0x140025b2d
lea rdx, str.CRC_mismatch__n
mov ecx, 2
call fcn.1400112d0
test al, al
jne 0x140025b2d
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_CRC_mismatch__n
call fcn.140002150
jmp 0x140025b2d
mov r14, qword [rdi + 0x288]
cmp qword [rdi + 0x290], rdx
jae 0x140025a29
mov rcx, r14
call fcn.1400fa738
mov r14, rax
test rax, rax
je 0x140025b06
mov qword [rdi + 0x288], rax
mov eax, dword [rsi + 8]
mov qword [rdi + 0x290], rax
jmp 0x140025a29
mov rcx, qword [rdi + 0x288]
call fcn.1400f95e0
mov qword [rdi + 0x288], rbx
mov qword [rdi + 0x290], rbx
test bpl, bpl
je 0x140025b2d
mov rcx, r15
call fcn.1400e9bc4
xor dil, dil
test rbx, rbx
je 0x140025b3d
mov rcx, rbx
call fcn.1400ec648
movzx eax, dil
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x80], r12d
mov r9d, dword [rsi + 8]
mov r8, r14
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.140031fd0
test eax, eax
jne 0x140025b2d
mov eax, dword [rsp + 0x80]
cmp rax, r12
jne 0x140025b2d
mov dil, 1
jmp 0x140025b30
mov ecx, eax
call fcn.1400e9ff0
int3
Function at 0x140025ba0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, rdx
mov rdi, rcx
cmp dword [rax + 0x268], 1
jne 0x140025ca7
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, rax
test rax, rax
je 0x140025ca7
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor edx, edx
mov dword [rsp + 0x20], ebp
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x140025ca7
xor r9d, r9d
mov qword [rsp + 0x40], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
test rax, rax
je 0x140025c79
mov rax, qword [rdi]
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [rax + 0x58]
test al, al
jne 0x140025c99
call fcn.1400111b0
cmp eax, 2
jg 0x140025c70
lea rdx, str.Failed_to_write_metadata_block._n
mov ecx, 2
call fcn.1400112d0
test al, al
jne 0x140025c70
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_metadata_block._n
call fcn.140002150
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rax, rbx
jmp 0x140025c84
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400264f0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 8
movsxd rax, edx
add rax, rax
mov r11, qword [rcx + rax*8 + 0x18]
test r11, r11
je 0x140025d53
mov qword [rsp], rbx
mov rbx, qword [rcx + rax*8 + 0x10]
add rbx, rcx
shl r11, 5
mov rcx, r11
mov r10, rbx
sar rcx, 5
test rcx, rcx
jle 0x140025d24
mov rdx, rcx
shr rdx, 1
mov rax, rdx
shl rax, 5
cmp qword [rax + r10], r8
jae 0x140025d1c
add rax, 0x20
add r10, rax
mov rax, 0xffffffffffffffff
sub rax, rdx
add rcx, rax
jmp 0x140025d1f
mov rcx, rdx
test rcx, rcx
jg 0x140025cf3
lea rax, [r11 + rbx]
mov rbx, qword [rsp]
cmp r10, rax
je 0x140025d53
cmp qword [r10], r8
jne 0x140025d53
test r9, r9
je 0x140025d4c
mov rax, qword [r10 + 8]
mov qword [r9], rax
movups xmm0, xmmword [r10 + 0x10]
movups xmmword [r9 + 8], xmm0
mov al, 1
add rsp, 8
ret
xor al, al
add rsp, 8
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rsi, edx
mov rbx, r8
mov edx, esi
mov rdi, rcx
call fcn.140028ef0
test al, al
jne 0x140026528
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14002654d
xor r9d, r9d
mov r8, rbx
mov edx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140025cc0
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rsi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rdi + 0x70]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rdi + 0x58]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rdi + 0x48]
je 0x140026601
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x140026603
nop dword [rax + rax]
cmp rax, rcx
je 0x140026601
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x1400265f0
jmp 0x140026603
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x140026620
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, r8
mov edx, edi
mov rsi, rcx
call fcn.140028ef0
test al, al
jne 0x140026658
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
mov r8, rdi
xor rdx, rax
shl r8, 6
movzx eax, byte [rsp + 0x41]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x42]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x43]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x44]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x45]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x46]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x47]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [r8 + rsi + 0xd0]
and rcx, rdx
shl rcx, 4
add rcx, qword [r8 + rsi + 0xb8]
mov rax, qword [rcx + 8]
cmp rax, qword [r8 + rsi + 0xa8]
je 0x140026711
mov rcx, qword [rcx]
cmp rbx, qword [rax + 0x10]
je 0x140026713
nop
cmp rax, rcx
je 0x140026711
mov rax, qword [rax + 8]
cmp rbx, qword [rax + 0x10]
jne 0x140026700
jmp 0x140026713
xor eax, eax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x140026750
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 8]
mov rdi, rdx
mov rsi, rcx
cmp qword [rax], 0
jne 0x14002682c
cmp qword [rax + 8], 0
jne 0x14002682c
xor r9d, r9d
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
je 0x140026864
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400267da
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor al, al
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov r8, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, qword [rsi + 8]
call fcn.140026980
movzx esi, al
test al, al
je 0x14002680f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
movzx eax, sil
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.1400111b0
cmp eax, 2
jg 0x140026864
lea rdx, str.Cannot_use_imported_metadata_along_with_white__or_blacklists._n
mov ecx, 2
call fcn.1400112d0
test al, al
jne 0x140026864
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Cannot_use_imported_metadata_along_with_white__or_blacklists._n
call fcn.140002150
mov rbx, qword [rsp + 0x70]
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400293b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
mov r14, r9
mov rdi, r8
mov esi, edx
mov rbx, rcx
test byte [rbp + 0x38], 1
jne 0x1400295cf
cmp dword [rcx + 0x30], 1
je 0x1400295cf
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
je 0x1400293ff
mov al, 1
jmp 0x1400295d1
mov r9, rdi
mov r8d, esi
lea rdx, str._02x._016llx.json
lea rcx, [rbp - 0x60]
call fcn.1400215e0
xor edi, edi
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], dil
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140029436
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.140001b50
nop
lea rdx, [rbx + 0x10]
lea r8, [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140030c20
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14002949a
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029495
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400295f4
call fcn.1400ec648
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rcx, qword [rbp - 0x40]
lea rdx, [0x140122eb8]
call fcn.1400f981c
mov rdi, rax
test rax, rax
jne 0x14002952b
call fcn.1400111b0
cmp eax, 2
jg 0x140029585
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae r8, qword [rbp - 0x40]
lea rdx, str.Failed_to_write_serialized_state_to_disk___s_._n
lea ecx, [rdi + 2]
call fcn.1400112d0
test al, al
jne 0x140029585
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea ecx, [rdi + 2]
call fcn.1400f6cc8
mov r8, rbx
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk___s_._n
mov rcx, rax
call fcn.140002150
xor bl, bl
jmp 0x140029593
mov r9, rdi
mov r8, qword [rbp + 0x30]
mov edx, 1
mov rcx, r14
call fcn.1400fa568
cmp rax, qword [rbp + 0x30]
je 0x140029589
call fcn.1400111b0
cmp eax, 2
jg 0x14002957d
lea rdx, str.Failed_to_write_serialized_state_to_disk._n
mov ecx, 2
call fcn.1400112d0
test al, al
jne 0x14002957d
mov ecx, 2
call fcn.1400f6cc8
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_serialized_state_to_disk._n
call fcn.140002150
mov rcx, rdi
call fcn.1400f96fc
xor bl, bl
jmp 0x140029593
mov rcx, rdi
call fcn.1400f96fc
mov bl, 1
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x1400295ca
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400295c5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400295ee
call fcn.1400ec648
movzx eax, bl
jmp 0x1400295d1
xor al, al
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400f2c0c
nop
call fcn.1400f2c0c
nop
int3
Function at 0x140030d60
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x60
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x140030d73
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140030dbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140030db4
cmp qword [rbx + 0x18], 0x10
jb 0x140030d96
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400ff69c
test eax, eax
js 0x140030db4
movzx eax, word [rsp + 0x26]
shr ax, 0xe
and al, 1
jne 0x140030dbc
xor al, al
add rsp, 0x60
pop rbx
ret
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140031360
Capabilities:
Timestomp file

Disassembly:
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x18], 0x10
jb 0x140031370
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400313ac
xor al, al
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
mov rcx, rdi
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140031bd0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140126ea0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140031c49
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x140031bf0
test r8, r8
je 0x140031c6d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140031c50
not ecx
mov eax, ecx
ret
Function at 0x1400325a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call fcn.1400fa300
mov rcx, qword [rbx + 0x68]
add rdi, qword [rcx + 0x78]
js 0x140032609
cmp rax, rdi
je 0x1400325ef
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call fcn.1400f9db0
test eax, eax
jne 0x140032609
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call fcn.1400fa568
jmp 0x140032612
mov dword [rbx + 0x1c], 0x16
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140040870
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [r8 + 0x18], 0x10
mov rbx, rdx
mov r11, qword [r8 + 0x10]
mov rdx, r8
mov rdi, rcx
jb 0x140040891
mov rdx, qword [r8]
xor r10d, r10d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1400408c4
movabs rcx, 0x100000001b3
nop dword [rax]
movzx eax, byte [r10 + rdx]
inc r10
xor r9, rax
imul r9, rcx
cmp r10, r11
jb 0x1400408b0
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140004570
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400408eb
mov qword [rbx], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi + 8]
mov qword [rbx], rax
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret