joyce8/EMBER2024-capa huggingface dataset:
Function at 0x729fc0
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call fcn.00739a60
mov rdi, rax
test rdi, rdi
je 0x72a0aa
lea rcx, [rbp - 8]
call fcn.00739bc0
movzx r8d, word [rbp - 6]
movzx r9d, word [rbp - 2]
movzx eax, word [rbp - 8]
movzx ecx, word [rbp]
movzx edx, word [rbp + 2]
movzx ebx, word [rbp + 4]
movzx esi, word [rbp + 6]
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], eax
lea rbx, [0x00988e60]
lea rdx, [0x0094e960]
mov rcx, rbx
call fcn.0073aad8
mov rcx, rbx
call fcn.0071a220
mov qword [rsp + 0x20], 0
lea r14, [rbp - 8]
mov rcx, rdi
mov rdx, rbx
mov r8d, eax
mov r9, r14
call fcn.00739f30
mov rcx, r15
call fcn.0071a220
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, r15
mov r8d, eax
mov r9, r14
call fcn.00739f30
mov rcx, rdi
call fcn.00739a38
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x72a100
Capabilities:
Write file on windows

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rcx, qword [0x00988e88]
test rcx, rcx
mov rax, qword [0x00988e80]
jne 0x72a1d5
test rax, rax
jne 0x72a1d5
cmp dword [0x0096b260], 0
je 0x72a21f
lea rdi, [rbp - 0x50]
xor ecx, ecx
mov r8d, 0x80
mov rdx, rdi
call fcn.00739be0
mov edx, 0x5c
mov rcx, rdi
call fcn.007295e0
test rax, rax
jne 0x72a17d
mov edx, 0x3a
mov rcx, rdi
call fcn.007295e0
test rax, rax
je 0x72a183
inc rax
mov rdi, rax
mov dword [rbp + 0x3c], 0
call fcn.00739cb0
mov r9d, 0x12010
test eax, eax
jns 0x72a1c3
call fcn.00739b60
lea rdx, [0x0072a2e0]
lea r8, [rbp + 0x3c]
mov ecx, eax
call fcn.0073a610
cmp dword [rbp + 0x3c], 0
mov eax, 0x11010
mov r9d, 0x12010
cmove r9d, eax
xor ecx, ecx
mov rdx, rsi
mov r8, rdi
call sub.USER32_MessageBoxA
jmp 0x72a293
test rax, rax
je 0x72a1ef
cmp eax, 0xffffffff
je 0x72a293
mov rcx, rsi
call rax
mov rcx, qword [0x00988e88]
test rcx, rcx
je 0x72a293
cmp ecx, 0xffffffff
je 0x72a293
cmp byte [rcx], 0
je 0x72a293
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.00729fc0
mov ecx, 0xfffffff4
call fcn.00739c30
mov rdi, rax
mov qword [rsp + 0x20], 0
lea r14, [0x0094e990]
lea rbx, [rbp - 0x50]
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call fcn.00739f30
mov rcx, rsi
call fcn.0071a220
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rsi
mov r8d, eax
mov r9, rbx
call fcn.00739f30
mov qword [rsp + 0x20], 0
mov r8d, 2
mov rcx, rdi
mov rdx, r14
mov r9, rbx
call fcn.00739f30
nop
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x72bc60
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x00998f38]
test rax, rax
je 0x72bca9
mov rcx, qword [rax]
test rcx, rcx
je 0x72bd20
add rax, 8
xor esi, esi
nop
cmp byte [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x72bc90
jmp 0x72bd51
mov r14, qword [0x00998fe0]
test r14, r14
jne 0x72bcdc
call fcn.00739b78
mov r14, rax
mov qword [0x00998fe0], r14
test r14, r14
jne 0x72bcdc
lea rcx, [0x0094eae0]
call fcn.0072a2c0
mov r14, qword [0x00998fe0]
mov rcx, r14
call fcn.0071a220
xor r15d, r15d
test eax, eax
je 0x72bd24
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax + 1]
mov rcx, rbx
call fcn.0071a220
test eax, eax
jne 0x72bd00
inc edi
movsxd rbx, edi
jmp 0x72bd2b
xor esi, esi
jmp 0x72bd51
mov ebx, 1
xor esi, esi
mov rcx, rbx
call fcn.00718c10
mov qword [0x00998f30], rax
test rax, rax
je 0x72be2b
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.00719810
lea eax, [rsi + 4]
mov dword [0x00998f40], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.00718c00
mov rdi, rax
test rdi, rdi
je 0x72bdc2
mov r14, qword [0x00998f38]
test r14, r14
je 0x72bdc7
mov rdx, qword [r14]
test rdx, rdx
je 0x72be16
lea rax, [r14 + 8]
xor ecx, ecx
cmp byte [rdx], 0
je 0x72bdb0
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x72bdb2
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x72bd90
jmp 0x72be11
xor r15d, r15d
jmp 0x72be2b
mov rbx, qword [0x00998f30]
mov rcx, rbx
call fcn.0071a220
test eax, eax
je 0x72be1e
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x20
add rbx, rax
mov rcx, rbx
call fcn.0071a220
add rsi, 8
test eax, eax
jne 0x72bdf0
test r14, r14
je 0x72be1e
mov rcx, r14
call fcn.00718c20
mov qword [0x00998f38], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x72bf40
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rax, qword [0x00998f68]
test rax, rax
je 0x72bf8a
mov rcx, qword [rax]
test rcx, rcx
je 0x72c003
add rax, 8
xor esi, esi
nop
cmp word [rcx], 1
sbb esi, 0
inc esi
mov rcx, qword [rax]
add rax, 8
test rcx, rcx
jne 0x72bf70
jmp 0x72c034
mov r14, qword [0x00998fe8]
test r14, r14
jne 0x72bfbd
call fcn.00739b80
mov r14, rax
mov qword [0x00998fe8], r14
test r14, r14
jne 0x72bfbd
lea rcx, [0x0094eb50]
call fcn.0072a2c0
mov r14, qword [0x00998fe8]
mov rcx, r14
call fcn.007197f0
xor r15d, r15d
test eax, eax
je 0x72c007
xor edi, edi
xor esi, esi
mov rbx, r14
nop word cs:[rax + rax]
lea edi, [rax + rdi + 1]
inc esi
cdqe
lea rbx, [rbx + rax*2 + 2]
mov rcx, rbx
call fcn.007197f0
test eax, eax
jne 0x72bfe0
inc edi
movsxd rbx, edi
add rbx, rbx
jmp 0x72c00e
xor esi, esi
jmp 0x72c034
mov ebx, 2
xor esi, esi
mov rcx, rbx
call fcn.00718c10
mov qword [0x00998f60], rax
test rax, rax
je 0x72c11b
mov rcx, rax
mov rdx, r14
mov r8, rbx
call fcn.00719810
lea eax, [rsi + 4]
mov dword [0x00998f70], eax
add esi, 5
movsxd rcx, esi
mov edx, 8
call fcn.00718c00
mov rdi, rax
test rdi, rdi
je 0x72c0b2
mov r14, qword [0x00998f68]
test r14, r14
je 0x72c0b7
mov rdx, qword [r14]
test rdx, rdx
je 0x72c106
lea rax, [r14 + 8]
xor ecx, ecx
nop word cs:[rax + rax]
cmp word [rdx], 0
je 0x72c0a0
mov rdx, qword [rax - 8]
movsxd rbx, ecx
mov qword [rdi + rbx*8], rdx
jmp 0x72c0a2
dec ecx
inc ecx
mov rdx, qword [rax]
add rax, 8
test rdx, rdx
jne 0x72c080
jmp 0x72c101
xor r15d, r15d
jmp 0x72c11b
mov rbx, qword [0x00998f60]
mov rcx, rbx
call fcn.007197f0
test eax, eax
je 0x72c10e
movabs r15, 0x100000000
mov rsi, rdi
nop word [rax + rax]
mov qword [rsi], rbx
shl rax, 0x20
add rax, r15
sar rax, 0x1f
add rbx, rax
mov rcx, rbx
call fcn.007197f0
add rsi, 8
test eax, eax
jne 0x72c0e0
test r14, r14
je 0x72c10e
mov rcx, r14
call fcn.00718c20
mov qword [0x00998f68], rdi
mov r15d, 1
mov eax, r15d
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x72c930
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call fcn.00739bf8
mov qword [0x009500a0], rax
call fcn.00719050
call fcn.00718f40
call fcn.00719160
lea rax, [section..data]
lea rcx, [0x00414910]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x00404354]
mov qword [rax + 8], rcx
lea rcx, [0x00404354]
mov qword [rax + 0x10], rcx
lea rcx, [entry0]
mov qword [rax + 0x18], rcx
lea rcx, [0x0072af20]
mov qword [rax + 0x68], rcx
lea rcx, [0x0072b320]
mov qword [rax + 0x70], rcx
lea rcx, [0x0072b350]
mov qword [rax + 0x78], rcx
lea rcx, [0x0072b900]
mov qword [rax + 0x80], rcx
lea rcx, [0x0096a5a0]
mov qword [rax + 0x50], rcx
mov dword [rax + 0x20], 1
mov rcx, rax
push 0
jmp 0x72c930
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.0072c8d0
test edi, edi
je 0x72acc5
test ebx, ebx
jne 0x72acdc
test edi, edi
jne 0x72acb6
call qword [0x0096b208]
call qword [0x0096b210]
call fcn.0072c8f0
mov ecx, r14d
call fcn.0072c680
jmp 0x72acdc
mov rcx, rsi
call fcn.0072aa70
call fcn.0072c7a0
call qword [0x0096b200]
test ebx, ebx
je 0x72aca6
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0072c8f0
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x0096b260], eax
mov rcx, qword [rsi + 0x50]
call fcn.0071b8c0
mov rcx, qword [rsi + 0x88]
call fcn.0071b8d0
mov dword [0x00999040], 1
lea rdi, [0x00999040]
mov qword [0x00999048], rsi
call fcn.00739b80
mov qword [0x00998fe8], rax
call fcn.00739b40
mov qword [0x00998ff8], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.0072aef0
xor edx, edx
mov rcx, rdi
call fcn.0072c6a0
test byte [rsi + 0x20], 1
jne 0x72c9f4
mov ecx, dword [0x0099900c]
mov rdx, qword [0x00999020]
mov r8, qword [0x00999028]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x72ac80
mov rax, qword [0x00998ff8]
nop dword [rax + rax]
add rax, 2
movzx ecx, word [rax - 2]
cmp ecx, 9
je 0x72ca00
movzx edx, cx
cmp edx, 0x20
je 0x72ca00
cmp edx, 0x22
jne 0x72ca24
mov cx, word [rax]
mov edx, 0x22
jmp 0x72ca2d
add rax, 0xfffffffffffffffe
mov edx, 0x20
movzx edi, cx
cmp edx, edi
je 0x72ca59
nop word cs:[rax + rax]
test cx, cx
je 0x72ca59
movzx edi, cx
cmp edi, 9
je 0x72ca59
movzx ecx, word [rax + 2]
add rax, 2
cmp edx, ecx
jne 0x72ca40
movzx ecx, cx
lea rdi, [rax + 2]
cmp ecx, 0x22
cmovne rdi, rax
jmp 0x72ca74
add rdi, 2
movzx eax, word [rdi]
cmp eax, 0x20
je 0x72ca70
movzx eax, ax
cmp eax, 9
je 0x72ca70
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call fcn.00739bf8
mov rsi, rax
lea rcx, [rbp - 0x60]
call fcn.00739c28
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x72ac80
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x72cd30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x009500b4], 0
je 0x72cd92
mov ecx, dword [0x00999070]
call fcn.00739eb8
test rax, rax
jne 0x72cd9e
call fcn.0072cb80
mov edi, eax
test edi, edi
je 0x72cd85
call fcn.00739c18
movsxd r8, edi
mov edx, 8
mov rcx, rax
call fcn.00739d00
mov ecx, dword [0x00999070]
mov rdx, rax
call fcn.00739ec0
mov ecx, dword [0x00999070]
call fcn.00739eb8
jmp 0x72cd9e
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret

Function at 0x72d230
Capabilities:
Create thread

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov r14, r9
mov r15, r8
mov ebx, edx
mov rsi, rcx
cmp ebx, 0xf
jg 0x72d26c
test ebx, ebx
je 0x72d26c
call fcn.0072a0c0
mov dword [rax], 0x13
mov rax, 0xffffffffffffffff
jmp 0x72d2fc
call fcn.0072cee0
mov rdi, rax
test rdi, rdi
je 0x72d2c9
mov eax, dword [rbp + 0x70]
mov ecx, dword [rbp + 0x60]
mov qword [rdi + 8], r15
mov qword [rdi + 0x20], rsi
mov dword [rdi + 0x94], eax
mov edx, ebx
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
lea r8, [0x0072d410]
mov rcx, r14
mov r9, rdi
call fcn.00739a88
test rax, rax
je 0x72d2dd
mov rcx, qword [rbp + 0x68]
mov qword [rdi + 0x10], rax
test rcx, rcx
je 0x72d2c5
mov edx, dword [rbp + 4]
mov dword [rcx], edx
cdqe
jmp 0x72d2fc
call fcn.0072a0c0
mov dword [rax], 8
mov rax, 0xffffffffffffffff
jmp 0x72d2fc
call fcn.00739bb8
cmp eax, 0x718
jne 0x72d2f5
mov ecx, 0x59
call fcn.0071cdc0
jmp 0x72d2fa
call fcn.0071ce80
cdqe
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x732860
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov ecx, dword [0x009a3470]
call fcn.00739eb8
mov rsi, rax
test rsi, rsi
je 0x7328d9
xor r14d, r14d
lea rbx, [0x009a3480]
nop dword [rax]
cmp r14d, 3
ja 0x7328d9
inc r14d
xor edi, edi
xor eax, eax
nop dword [rax]
cmp byte [rbx + rdi*2], 0
je 0x7328c8
mov rdx, qword [rbx + rdi*2 + 8]
test rdx, rdx
je 0x7328c8
mov rcx, qword [rsi + rdi]
test rcx, rcx
je 0x7328c8
mov qword [rsi + rdi], 0
call rdx
mov eax, 1
add rdi, 8
cmp rdi, 0x190
jne 0x7328a0
test eax, eax
jne 0x732890
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x733da0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov r14d, r9d
mov ebx, r8d
mov rsi, rdx
mov r15, rcx
mov edi, ebx
sar edi, 0x1f
shr edi, 0x1c
add edi, ebx
mov eax, edi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, rsi
call fcn.00739af0
mov r12, rax
test r12, r12
je 0x733efe
mov rcx, rsi
mov rdx, r12
call fcn.00739d78
test rax, rax
je 0x733efe
mov rcx, rax
call fcn.00739da0
test rax, rax
je 0x733ef6
mov rcx, rax
and edi, 0xfffffff0
add rax, 2
sub ebx, edi
movzx ecx, word [rcx]
je 0x733eb5
lea edx, [rbx - 1]
mov edi, ebx
and edi, 7
je 0x733e55
neg edi
mov rsi, rax
nop word cs:[rax + rax]
dec ebx
movzx ecx, cx
lea rax, [rsi + rcx*2 + 2]
movzx ecx, word [rsi + rcx*2]
inc edi
mov rsi, rax
jne 0x733e40
cmp edx, 7
jb 0x733eb5
nop word [rax + rax]
movzx ecx, cx
lea rdx, [rax + rcx*2]
movzx eax, word [rax + rcx*2]
lea rcx, [rdx + rax*2]
movzx eax, word [rdx + rax*2 + 2]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
add ebx, 0xfffffff8
movzx ecx, word [rcx + rax*2 + 4]
lea rax, [rdx + rcx*2 + 6]
movzx ecx, word [rdx + rcx*2 + 4]
jne 0x733e60
test cx, cx
je 0x733ef6
movzx r8d, cx
mov qword [rbp - 8], 0
xor r9d, r9d
cmp r14d, 0xffff
cmovne r9w, r14w
lea rcx, [rbp - 8]
mov rdx, rax
call fcn.0042d7b0
mov rdx, qword [rbp - 8]
mov rcx, r15
call fcn.0042d9a0
lea rcx, [rbp - 8]
call fcn.0042d240
mov rcx, r12
call fcn.00739b20
mov rax, r15
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x735fa0
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov r15, rdx
mov r14, rcx
movzx eax, byte [r15]
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rcx, rax
movzx edx, byte [r15 + 1]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 2]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r15 + 3]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 4]
xor rcx, rdx
imul rcx, rax
movzx edx, byte [r15 + 5]
xor rdx, rcx
imul rdx, rax
movzx ecx, byte [r15 + 6]
xor rcx, rdx
imul rcx, rax
movzx esi, byte [r15 + 7]
xor rsi, rcx
imul rsi, rax
and rsi, qword [r14 + 0x58]
mov rdi, qword [r14 + 0x10]
mov rax, qword [r14 + 0x40]
lea rcx, [rsi + rsi*2]
shl rcx, 4
mov rdx, qword [rax + rcx + 0x10]
mov rbx, qword [r15]
lea rcx, [rsi + rsi + 1]
lea rcx, [rcx + rcx*2]
lea rsi, [rax + rcx*8 + 0x10]
mov rax, rdx
jmp 0x736063
mov rax, qword [rax]
cmp rdx, rdi
mov rcx, rdi
je 0x736071
mov rcx, qword [rsi]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x736087
cmp qword [rax + 0x10], rbx
jne 0x736060
cmp rax, rdi
jne 0x73610c
jmp 0x73608f
mov rax, rdi
cmp rax, rdi
jne 0x73610c
mov rbx, qword [rdi]
mov rsi, qword [rbx + 8]
mov ecx, 0x20
call fcn.00715590
test rbx, rbx
cmove rsi, rax
mov rcx, rbx
cmove rcx, rax
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov rcx, qword [r15]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], 0
mov rcx, qword [r14 + 0x18]
movabs rdx, 0x7fffffffffffffe
cmp rcx, rdx
je 0x73611d
inc rcx
mov qword [r14 + 0x18], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov rax, qword [r14 + 0x10]
mov r8, qword [rax]
mov qword [rbp], r8
add r8, 0x10
lea rdx, [rbp - 0x30]
lea r9, [rbp - 0x10]
mov rcx, r14
call fcn.00736b50
mov rax, qword [rbp - 0x20]
add rax, 0x18
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, [0x0094f46d]
call fcn.00716cb0
ud2
Function at 0x736f00
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov r14, rdx
mov rax, qword [r8 + 0x10]
movzx edx, byte [rax + 0x10]
movabs rbx, 0xcbf29ce484222325
xor rbx, rdx
movabs rdx, 0x100000001b3
imul rbx, rdx
movzx edi, byte [rax + 0x11]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x12]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x13]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x14]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x15]
xor rdi, rbx
imul rdi, rdx
movzx ebx, byte [rax + 0x16]
xor rbx, rdi
imul rbx, rdx
movzx edi, byte [rax + 0x17]
xor rdi, rbx
imul rdi, rdx
and rdi, qword [rcx + 0x58]
lea rdx, [rdi + rdi + 1]
mov rsi, qword [rcx + 0x40]
lea r11, [rdx + rdx*2]
lea rbx, [rdi + rdi*2]
shl rbx, 4
cmp qword [rsi + r11*8 + 0x10], rax
lea r10, [rsi + rbx + 0x10]
mov rdx, qword [rsi + rbx + 0x10]
je 0x736fbc
cmp rdx, rax
je 0x736fd7
test r9b, r9b
je 0x737002
mov rsi, qword [r8 + 0x10]
jmp 0x737027
cmp rdx, rax
je 0x736fe6
lea rdx, [rsi + r11*8]
lea r10, [rsi + r11*8 + 0x10]
mov rax, qword [rax + 8]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rdx], xmm0
jmp 0x736ffa
add rsi, rbx
mov rax, qword [rax]
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
jmp 0x736ffa
mov rax, qword [rcx + 0x10]
mov qword [r10], rax
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x40]
lea r10, [rdx + r11*8 + 0x10]
mov qword [r10], rax
test r9b, r9b
jne 0x736fb6
mov rax, qword [r8 + 0x10]
mov rsi, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rdx], rsi
mov rdx, qword [rax]
mov rbx, qword [rax + 8]
mov qword [rdx + 8], rbx
dec qword [rcx + 0x18]
mov rcx, rax
call fcn.00712d50
mov qword [r14 + 0x10], rsi
mov rax, r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x737d20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov ebx, r8d
mov rdi, rdx
mov r14, rcx
mov esi, ebx
sar esi, 0x1f
shr esi, 0x1c
add esi, ebx
mov eax, esi
shr eax, 4
inc eax
movzx edx, ax
mov r8d, 6
mov rcx, rdi
call fcn.00739af0
mov r15, rax
test r15, r15
je 0x737f67
mov rcx, rdi
mov rdx, r15
call fcn.00739d78
test rax, rax
je 0x737f67
mov rcx, rax
call fcn.00739da0
mov r13, rax
test r13, r13
je 0x737f5f
mov rax, r13
and esi, 0xfffffff0
add r13, 2
sub ebx, esi
movzx eax, word [rax]
je 0x737e38
lea ecx, [rbx - 1]
mov edx, ebx
and edx, 7
je 0x737dd5
neg edx
mov rdi, r13
nop dword [rax + rax]
dec ebx
movzx eax, ax
lea r13, [rdi + rax*2 + 2]
movzx eax, word [rdi + rax*2]
inc edx
mov rdi, r13
jne 0x737dc0
cmp ecx, 7
jb 0x737e38
nop word [rax + rax]
movzx eax, ax
lea rcx, [r13 + rax*2]
movzx eax, word [r13 + rax*2]
lea rdx, [rcx + rax*2]
movzx eax, word [rcx + rax*2 + 2]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
movzx eax, word [rdx + rax*2 + 4]
lea rdx, [rcx + rax*2 + 2]
movzx eax, word [rcx + rax*2 + 4]
lea rcx, [rdx + rax*2 + 2]
add ebx, 0xfffffff8
movzx eax, word [rdx + rax*2 + 4]
lea r13, [rcx + rax*2 + 6]
movzx eax, word [rcx + rax*2 + 4]
jne 0x737de0
test ax, ax
je 0x737f5f
movzx r12d, ax
mov rcx, r14
mov edx, r12d
call fcn.005b2940
mov r8, qword [r14]
lea ecx, [r12 - 1]
lea rax, [rcx + 1]
cmp rax, 0x10
jb 0x737e7e
lea rdx, [r13 + rcx*2 + 2]
cmp r8, rdx
jae 0x737f0d
lea rcx, [r8 + rcx*2 + 2]
cmp r13, rcx
jae 0x737f0d
mov ecx, r12d
mov rdx, r8
mov rsi, r13
lea eax, [rcx - 1]
mov edi, ecx
and edi, 7
je 0x737eb4
neg edi
nop word cs:[rax + rax]
dec ecx
movzx ebx, word [rsi]
add rsi, 2
mov word [rdx], bx
add rdx, 2
inc edi
jne 0x737ea0
cmp eax, 7
jb 0x737f58
nop dword [rax]
movzx eax, word [rsi]
mov word [rdx], ax
movzx eax, word [rsi + 2]
mov word [rdx + 2], ax
movzx eax, word [rsi + 4]
mov word [rdx + 4], ax
movzx eax, word [rsi + 6]
mov word [rdx + 6], ax
movzx eax, word [rsi + 8]
mov word [rdx + 8], ax
movzx eax, word [rsi + 0xa]
mov word [rdx + 0xa], ax
movzx eax, word [rsi + 0xc]
mov word [rdx + 0xc], ax
add ecx, 0xfffffff8
movzx eax, word [rsi + 0xe]
lea rsi, [rsi + 0x10]
mov word [rdx + 0xe], ax
lea rdx, [rdx + 0x10]
jne 0x737ec0
jmp 0x737f58
mov r9d, r12d
and r9d, 0xf
sub rax, r9
mov ecx, r12d
sub ecx, eax
lea rdx, [r8 + rax*2]
lea rsi, [r13 + rax*2]
add r13, 0x10
lea rbx, [r8 + 0x10]
nop dword [rax]
movups xmm0, xmmword [r13 - 0x10]
movups xmm1, xmmword [r13]
movups xmmword [rbx - 0x10], xmm0
movups xmmword [rbx], xmm1
add r13, 0x20
add rbx, 0x20
add rax, 0xfffffffffffffff0
jne 0x737f30
test r9d, r9d
jne 0x737e87
mov word [r8 + r12*2], 0
mov rcx, r15
call fcn.00739b20
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140005970
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140005998
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400059be
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400059c0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005a19
test ecx, ecx
jle 0x1400059f9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005a19
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005a19
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140005a40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005a62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140005a78
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005a94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005a96
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005ad2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005b6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005b0d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140005b4e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140005b6e
cmp rbx, rax
ja 0x140005b20
test rbx, rbx
je 0x140005b6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret