joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ef10
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x14010b018]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x14002f12e
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14002f12e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, qword [0x14010b018]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x14002efe4
movsx rdx, word [r8 + 0x60f0]
lea rax, [r8 + 0x60f4]
mov r9d, dword [r8 + 0x3f58]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x14002efd9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x60f0], cx
movsx rax, cx
lea rax, [rax*8 + 0x60f4]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x60e8]
test rdi, rdi
je 0x14002f001
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x14002f004
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x140047b58]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x14002f047
mov rsi, qword [r8 + 0x90]
jmp 0x14002f04a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x14002f075
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x14010b018]
mov rcx, qword [rax + 0x4b10]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, str.xinput1_4.dll
mov qword [rsp + 0x30], rax
lea rax, str.xinput1_3.dll
mov qword [rsp + 0x38], rax
lea rax, str.xinput9_1_0.dll
mov qword [rsp + 0x40], rax
lea rax, str.xinput1_2.dll
mov qword [rsp + 0x48], rax
lea rax, str.xinput1_1.dll
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x14002f0ee
inc rbx
cmp rbx, 5
jl 0x14002f0d0
jmp 0x14002f11a
lea rdx, str.XInputGetCapabilities
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.XInputGetState
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x14002f130
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14003ed20
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x14003a000
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14004f010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rdx
mov rdi, rcx
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003a052
xor r9d, r9d
lea r8, str.Inject_Error
lea rdx, str.Run_GTA5_first_before_injecting_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14003a05f
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea rdx, str.Grand_Theft_Auto_V
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rbp, rax
jb 0x14003a0a4
mov rcx, qword [rdi]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp byte [rcx + r8], 0
jne 0x14003a0b0
inc r8
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x1000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
cmp qword [rdi + 0x18], 0x10
mov r9, rbx
mov r14, rax
jb 0x14003a0f5
mov rcx, qword [rdi]
inc r9
cmp byte [rcx + r9], 0
jne 0x14003a0e6
mov r8, rcx
jmp 0x14003a102
inc r9
cmp byte [rdi + r9], 0
jne 0x14003a0f5
mov r8, rdi
xor r15d, r15d
inc r9
mov rdx, r14
mov qword [rsp + 0x20], r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140047ec8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], r15d
xor edx, edx
mov qword [rsp + 0x20], r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [rdi + 0x18], 0x10
mov rax, rdi
jb 0x14003a171
mov rax, qword [rdi]
cmp byte [rax + rbx + 1], r15b
lea rbx, [rbx + 1]
jne 0x14003a171
lea r8, [rbx + 1]
mov r9d, 0x8000
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14003a1c8
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14003a1c3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a23d
mov rcx, r8
call fcn.14003eebc
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003a20d
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14003a208
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a23d
mov rcx, r8
call fcn.14003eebc
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], 0xf
mov byte [rsi], r15b
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003ed20
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003f8cc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003f916
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003f916
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003f916
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003f916
cmp dword [rcx + 0x84], 0xe
jbe 0x14003f916
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003f918
xor al, al
add rsp, 0x28
ret
Function at 0x1400416b0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rcx, [0x14048cc2b]
mov rdi, r8
mov rsi, rdx
movabs rbx, 0xcbf29ce484222325
call fcn.140289ea0
xor ecx, ecx
test rdi, rdi
je 0x140041703
movabs rdx, 0x100000001b3
nop dword [rax]
movzx eax, byte [rsi + rcx]
inc rcx
xor rbx, rax
imul rbx, rdx
cmp rcx, rdi
jb 0x1400416f0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140044bf0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
lea rcx, [0x14048bc63]
call fcn.140289ea0
mov rbx, qword [rbx]
movsxd r8, dword [rdi]
mov edx, 0xfff0b9d8
mov rcx, rbx
call fcn.140096e10
mov edx, 0xffffffff
mov rcx, rbx
call fcn.140096730
mov rdi, rax
mov edx, 0xfffffffe
mov rcx, rbx
call fcn.1400960f0
nop
movzx r8d, dil
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rcx, rdi
shr rcx, 8
movzx edx, cl
xor r8, rdx
imul r8, r9
mov rax, rdi
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdi
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdi
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rdi
shr rax, 0x28
movzx eax, al
xor rax, r8
imul rax, r9
mov rcx, rdi
shr rcx, 0x30
movzx edx, cl
xor rax, rdx
imul rax, r9
shr rdi, 0x38
xor rax, rdi
imul rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400473f0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x380
mov rax, qword [0x1403f20c0]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
lea rcx, [0x14048a1e9]
xor esi, esi
call fcn.140289ea0
lea rax, [rsp + 0x160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, reloc.WLDAP32.dll_Ordinal_26
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x1400474b3
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
lea r8, [rsp + 0x160]
mov rbx, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x104
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1400474b3
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
inc rbx
cmp byte [rax + rbx], sil
jne 0x1400474a0
mov r8, rbx
lea rdx, [rsp + 0x50]
jmp 0x1400474cb
xorps xmm0, xmm0
lea rdx, [0x1403b0689]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
xor r8d, r8d
mov qword [rdi + 0x18], rsi
mov rcx, rdi
call fcn.140043b60
mov rax, rdi
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.1402889f0
lea r11, [rsp + 0x380]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14004c930
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1403f20c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
lea rcx, [0x14048d6c2]
call fcn.140289ea0
lea r14, [0x140466c98]
mov qword [rsp + 0x50], r14
mov rcx, r14
call sub.KERNEL32.dll_AcquireSRWLockExclusive
nop
mov rdi, qword [0x140466ce8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14004cae6
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x78], eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
lea rdx, [rbx + 0x18]
lea rcx, [rsp + 0x80]
call fcn.1400581f0
nop
mov ecx, dword [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebp, ax
shr ebp, 0xf
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
lea rcx, [0x140466d20]
call fcn.140063620
mov rcx, qword [rax]
movzx edx, byte [rcx + 0x14]
mov rsi, qword [rsp + 0x88]
and bpl, 1
je 0x14004ca48
test dl, dl
jne 0x14004ca9e
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.14005b5e0
mov rax, qword [rsi + 0x10]
mov byte [rax + 8], reloc.WS2_32.dll_recvfrom
add qword [rsi + 0x10], 0x10
mov qword [rsp + 0x20], 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x80]
call fcn.1400652e0
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x14004ca9e
mov edx, 0xffffffff
sub edx, dword [rsp + 0x3c]
jmp 0x14004ca98
test dl, dl
je 0x14004ca9e
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.14005b5e0
mov rax, qword [rsi + 0x10]
mov byte [rax + 8], 1
add qword [rsi + 0x10], 0x10
mov qword [rsp + 0x20], 1
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x80]
call fcn.1400652e0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14004ca9e
mov edx, 0xffffffff
sub edx, dword [rsp + 0x4c]
call fcn.1400960f0
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x68]
lea rcx, [0x140466d20]
call fcn.140063620
mov rcx, qword [rax]
mov byte [rcx + 0x14], bpl
test rsi, rsi
je 0x14004cada
cmp dword [rsp + 0x80], 0xfffffffe
je 0x14004cada
mov rdx, rsi
lea rcx, [rsp + 0x80]
call fcn.140044a90
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14004c993
mov rcx, r14
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1402889f0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140052860
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov rax, qword [0x1403f20c0]
xor rax, rsp
mov qword [rsp + 0xe8], rax
mov rsi, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0xc0], rdx
mov qword [rsp + 0xc0], rbx
lea rcx, [0x14048d6c2]
call fcn.140289ea0
mov r8, rsi
lea rdx, [rsp + 0xc8]
mov rcx, rbx
call fcn.140052a20
nop
cmp byte [rsp + 0xd8], 0
je 0x140052944
lea rdx, [rsp + 0xc8]
mov rcx, rdi
call fcn.1400581f0
nop
cmp byte [rsp + 0xd8], 0
je 0x14005290d
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x140052905
cmp dword [rsp + 0xc8], 0xfffffffe
je 0x140052905
lea rcx, [rsp + 0xc8]
call fcn.140044a90
mov byte [rsp + 0xd8], 0
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140052923
cmp dword [rbx], 0xfffffffe
je 0x140052923
mov rcx, rbx
call fcn.140044a90
mov rax, rdi
mov rcx, qword [rsp + 0xe8]
xor rcx, rsp
call fcn.1402889f0
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov rdi, qword [r14]
movss xmm1, dword [0x1403bf34c]
movss dword [rsp + 0x20], xmm1
movss xmm2, dword [0x1403bf2e4]
movaps xmm3, xmm2
lea rcx, [rsp + 0x38]
call fcn.140043390
mov rbp, rax
lea rdx, [rsp + 0x70]
call fcn.140052ca0
lea rdx, [rax + 1]
mov r8, rdx
mov ebx, 0x47
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rax]
xor byte [r8], cl
lea r8, [r8 + 1]
sub r9, 1
jne 0x140052990
mov byte [rdx + 0x47], r9b
mov r8, rsi
lea rcx, [rsp + 0x50]
call fcn.14005d2c0
nop
mov r8, rbp
mov rdx, rax
mov rcx, rdi
call fcn.140047a80
nop
lea rcx, [rsp + 0x50]
call fcn.140059620
lea rdx, [rsp + 0x70]
call fcn.140052d40
lea rdx, [rax + 1]
mov r9, rdx
nop dword [rax]
movzx ecx, byte [rax]
xor byte [r9], cl
lea r9, [r9 + 1]
sub rbx, 1
jne 0x1400529e0
mov byte [rdx + 0x47], bl
mov r8, rsi
lea rcx, [rsp + 0x50]
call fcn.14005d2c0
nop
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.140041a30
lea rdx, [0x1403ecb70]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140056c00
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
lea rcx, [0x14048b5da]
mov r15, rdx
call fcn.140289ea0
cmp qword [rdi + 0x68], 0
je 0x140056c3d
mov r8, rbx
mov rdx, r15
mov rcx, rdi
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rdi + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140056c63
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
jmp 0x140056c65
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140056cc1
test ecx, ecx
jle 0x140056ca1
cmp rbx, rbp
mov rdx, r15
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140056cc1
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140056cc1
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140056ce0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, rcx
mov rbp, r8
lea rcx, [0x14048b5da]
mov r14, rdx
call fcn.140289ea0
test rbp, rbp
jg 0x140056d0e
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rsi + 0x68], 0
je 0x140056d2d
mov r8, rbp
mov rdx, r14
mov rcx, rsi
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rsi + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140056d49
mov rax, qword [rsi + 0x50]
mov ecx, dword [rax]
jmp 0x140056d4b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140056d87
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140056e1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140056dc2
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140056dfe
nop dword [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140056e1e
cmp rbx, rax
ja 0x140056dd0
test rbx, rbx
je 0x140056e1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400571f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1403f20c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov edi, edx
lea rcx, [0x14048b5da]
call fcn.140289ea0
cmp edi, 0xffffffff
jne 0x140057229
xor eax, eax
jmp 0x140057395
mov rax, qword [rbx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140057263
mov rax, qword [rbx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140057263
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140057395
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140057388
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400572a6
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400572d1
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005738d
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140057340
sub eax, 1
je 0x140057340
cmp eax, 2
jne 0x140057388
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14005738d
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14005736e
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140057388
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14005738d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402889f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140057660
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x14048c6e3]
call fcn.140289ea0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400576d9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rbx + 8]
shr rax, 3
cmp rax, rcx
jbe 0x1400576a2
mov r8, rdx
mov rcx, rbx
mov rdx, qword [rdx]
add rsp, 0x20
pop rbx
jmp 0x14005b0a0
call fcn.140064460
mov rax, qword [rbx + 8]
lea r8, [rsp + 0x30]
mov qword [rax], rax
mov rax, qword [rbx + 8]
mov qword [rax + 8], rax
mov qword [rbx + 0x10], 0
mov rax, qword [rbx + 8]
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x30], rax
call fcn.140063bb0
add rsp, 0x20
pop rbx
ret
push rsi
push r14
push r15
sub rsp, 0x50
mov rsi, rcx
mov r14, r8
lea rcx, [0x14048c6e3]
mov r15, rdx
call fcn.140289ea0
cmp r15, r14
je 0x14005b1a1
mov rax, qword [rsi + 8]
lea rdx, [r15 + 0x10]
mov qword [rsp + 0x78], rbx
mov rcx, rsi
mov qword [rsp + 0x80], rbp
mov rbx, r15
mov qword [rsp + 0x88], rdi
mov rdi, qword [rsi + 0x18]
mov qword [rsp + 0x30], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r13
call fcn.14005c990
add rax, rax
mov r13, qword [rdi + rax*8 + 8]
lea r12, [rdi + rax*8]
mov rax, qword [rdi + rax*8]
mov qword [rsp + 0x28], rax
nop word [rax + rax]
mov rdi, rbx
mov rbp, rbx
mov rdx, qword [rdi + 0x20]
lea rcx, [rdi + 0x18]
mov rbx, qword [rbx]
test rdx, rdx
je 0x14005b150
cmp dword [rcx], 0xfffffffe
je 0x14005b150
call fcn.140044a90
mov edx, Ordinal_41
mov rcx, rdi
call fcn.140288a10
dec qword [rsi + 0x10]
cmp rbp, r13
je 0x14005b1ae
cmp rbx, r14
jne 0x14005b130
cmp qword [rsp + 0x28], r15
jne 0x14005b176
mov qword [r12], rbx
mov rax, qword [rsp + 0x20]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x78]
mov rax, r14
add rsp, 0x50
pop r15
pop r14
pop rsi
ret
mov r13, qword [rsp + 0x30]
cmp qword [rsp + 0x28], r15
jne 0x14005b1c3
mov qword [r12], r13
mov rax, r13
jmp 0x14005b1c8
mov rax, qword [rsp + 0x20]
mov qword [r12 + 8], rax
cmp rbx, r14
je 0x14005b176
movzx ecx, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
mov r12, qword [rsi + 0x30]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movzx eax, byte [rbx + 0x11]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x12]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [rbx + 0x13]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x38]
mov r15, qword [r12 + 8]
nop word [rax + rax]
mov rdi, rbx
mov rbp, rbx
mov rdx, qword [rdi + 0x20]
lea rcx, [rdi + 0x18]
mov rbx, qword [rbx]
test rdx, rdx
je 0x14005b250
cmp dword [rcx], 0xfffffffe
je 0x14005b250
call fcn.140044a90
mov edx, Ordinal_41
mov rcx, rdi
call fcn.140288a10
dec qword [rsi + 0x10]
cmp rbp, r15
je 0x14005b270
cmp rbx, r14
jne 0x14005b230
jmp 0x14005b172
mov qword [r12], r13
mov qword [r12 + 8], r13
jmp 0x14005b1cd