joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180016ec0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x3882114bde571ad4
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180016f10
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801bde80]
xor edx, edx
mov dword [0x1801bde78], edx
mov dword [0x1801bde88], edx
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xfaee099c6f890bb8
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017020
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm2
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm3
mov eax, dword [0x1801bde78]
mov ecx, dword [rsp + 0x28]
inc eax
mov dword [0x1801bde78], eax
mov edx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rdx*8], ecx
movabs rdx, 0x8524a8b0171d5e07
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x1800170e0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801bde80]
xor r8d, r8d
mov dword [0x1801bde78], r8d
mov dword [0x1801bde88], r8d
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xea1c610a04db6bbb
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], r8d
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017150
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x9b1e824ffbb7027a
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017180
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801bde80]
xor r8d, r8d
mov dword [0x1801bde78], r8d
mov dword [0x1801bde88], r8d
movss dword [rax], xmm0
mov eax, dword [0x1801bde78]
movss xmm0, dword [rsp + 0x28]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm2
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], r9d
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm0
mov eax, dword [0x1801bde78]
mov ecx, dword [rsp + 0x30]
inc eax
mov dword [0x1801bde78], eax
mov edx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rdx*8], ecx
mov eax, dword [0x1801bde78]
mov ecx, dword [rsp + 0x38]
inc eax
mov dword [0x1801bde78], eax
mov edx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rdx*8], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], r8d
mov eax, dword [0x1801bde78]
mov ecx, dword [rsp + 0x48]
inc eax
mov dword [0x1801bde78], eax
mov edx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rdx*8], ecx
movabs rdx, 0xe3ad2bdbaee269ac
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017360
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x1d408577d440e81e
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
movss dword [rax], xmm0
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x1800175c0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x7a6535691b477c48
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x180017610
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x9f8aa94d6d97dbf4
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017660
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xf0a4f1bbf4fa7497
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x1800176f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xb128377056a54e2a
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017740
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x1913fe4cbf41c463
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], r8d
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x1800177b0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x96a05e4fb321b1ba
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm2
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
movss dword [rax + rcx*8], xmm3
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017850
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xdf993ee5e90aba25
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x1800178a0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0xed7f7efe9fabf340
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x1800178f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x9f7794730795e019
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 0x11
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017960
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801bde80]
xor edx, edx
mov dword [0x1801bde78], edx
mov dword [0x1801bde88], edx
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x70a2d1137c8ed7c9
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017aa0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x5e6cc07646bbeab8
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017af0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0xe532f5d78798daab
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180017c20
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x183dadc6aa953186
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x180017cd0
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
sub rsp, 0x98
cmp byte [0x1801cef4f], 0
je 0x180017e6b
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x180017e6b
mov qword [rsp + 0xa0], rbx
call fcn.180007bb0
mov ecx, eax
call fcn.1800176b0
test eax, eax
jne 0x180017dc6
call fcn.180007bb0
mov ecx, eax
call fcn.180017580
test eax, eax
je 0x180017dc6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
call fcn.180007bb0
mov ebx, eax
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.180017660
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.180017850
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.1800176f0
movss xmm7, dword [0x1801a03fc]
xorps xmm3, xmm3
mov dword [rsp + 0x48], 1
xorps xmm2, xmm2
mov dword [rsp + 0x40], 1
mov ecx, ebx
movss dword [rsp + 0x20], xmm7
xorps xmm6, xmm6
call fcn.180016ad0
mov dword [rsp + 0x48], 1
movaps xmm3, xmm7
mov dword [rsp + 0x40], 1
xorps xmm2, xmm2
mov ecx, ebx
movss dword [rsp + 0x20], xmm6
call fcn.180016ad0
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
movzx eax, byte [0x1801cef4a]
test al, al
je 0x180017e39
mov qword [rsp + 0x90], rdi
xor edi, edi
test al, al
mov ebx, edi
sete bl
call fcn.180007bb0
mov edx, ebx
mov ecx, eax
call fcn.180017660
mov ebx, edi
cmp byte [0x1801cef4a], bl
sete bl
call fcn.180007bb0
mov edx, ebx
mov ecx, eax
call fcn.180017850
cmp byte [0x1801cef4a], dil
sete dil
call fcn.180007bb0
mov edx, edi
mov ecx, eax
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x98
jmp fcn.1800176f0
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.180017660
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.180017850
call fcn.180007bb0
mov ecx, eax
xor edx, edx
call fcn.1800176f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x98
ret
Function at 0x18001a2e0
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movss xmm0, dword [0x1801a0c9c]
lea rcx, [rbp + 0x10]
movss xmm1, dword [0x1801a0c5c]
xor edx, edx
movss dword [rbp + 0x10], xmm0
movss dword [rbp + 0x14], xmm1
call fcn.180084610
cmp dword [0x1801cef28], 8
jne 0x18001a53e
xor edx, edx
lea rcx, str.Witch
lea r8d, [rdx + 3]
call fcn.1800809a0
test al, al
je 0x18001a53e
lea rdx, [rbp + 0x18]
mov qword [rsp + 0x48], r15
lea rcx, str.Players
mov dword [rbp + 0x18], 0x43380000
mov dword [rbp + 0x1c], 0x42480000
call fcn.1800b4fc0
mov ecx, dword [0x1801cef28]
test al, al
movss xmm1, dword [0x1801a0eac]
mov edx, 2
cmovne ecx, edx
xorps xmm0, xmm0
mov dword [0x1801cef28], ecx
call fcn.180085c50
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x43380000
lea rcx, str.Session
mov dword [rbp + 0x24], 0x42480000
call fcn.1800b4fc0
mov ecx, dword [0x1801cef28]
test al, al
movss xmm1, dword [0x1801a0eac]
mov edx, 0xb
cmovne ecx, edx
xorps xmm0, xmm0
mov dword [0x1801cef28], ecx
call fcn.180085c50
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x28], 0x43380000
lea rcx, str.Coming_soon
mov dword [rbp + 0x2c], 0x42480000
call fcn.1800b4fc0
call fcn.1800b40c0
movss xmm0, dword [0x1801a09f8]
lea rdx, [rbp - 0x50]
movss xmm1, dword [0x1801a0c58]
lea rcx, [0x1801508ac]
xor r9d, r9d
movss dword [rbp - 0x50], xmm0
xor r8d, r8d
movss dword [rbp - 0x4c], xmm1
call fcn.180083e50
xor r8d, r8d
lea rdx, [0x180180794]
lea rcx, str.Open_Key
call fcn.1800b68e0
xor r15d, r15d
test al, al
je 0x18001a4c5
mov qword [rsp + 0x68], rbx
mov ebx, r15d
mov qword [rsp + 0x60], rsi
lea rsi, [0x18015d760]
mov qword [rsp + 0x58], rdi
lea rdi, str.pqrstuvwx_
mov qword [rsp + 0x50], r14
nop dword [rax + rax]
cmp dword [0x1801cef60], ebx
lea r9, [rbp - 0x48]
mov rcx, qword [rsi]
sete r14b
mov qword [rbp - 0x48], r15
movzx edx, r14b
xor r8d, r8d
call fcn.1800bffe0
test al, al
je 0x18001a493
mov eax, dword [rdi]
mov dword [0x1801bc624], eax
mov dword [0x1801cef60], ebx
test r14b, r14b
je 0x18001a49d
call fcn.180088710
inc ebx
add rsi, 8
add rdi, 4
cmp ebx, 0xa
jl 0x18001a460
call fcn.1800b70a0
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
lea rdx, [0x1801bc628]
lea rcx, str.Tool_Tips
call fcn.1800b55d0
lea rdx, [0x1801bc629]
lea rcx, str.Watch_Dogs_Hacking
call fcn.1800b55d0
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], r15
lea rcx, str.Unload
call fcn.1800b4fc0
test al, al
je 0x18001a50a
xchg byte [0x1801bde30], r15b
lea rdx, [rbp + 0x10]
mov qword [rbp + 0x10], 0
lea rcx, str.Exit
call fcn.1800b4fc0
mov r15, qword [rsp + 0x48]
test al, al
je 0x18001a534
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x70
pop rbp
jmp fcn.180083ef0
add rsp, 0x70
pop rbp
ret

Function at 0x180027040
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
lea rcx, str.STRING
mov dword [0x1801bde78], eax
movabs rdx, 0x8509b634fbe7da11
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov qword [rax], rcx
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x180027080
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [0x1801bde80]
xor edx, edx
mov dword [0x1801bde78], edx
mov dword [0x1801bde88], edx
mov dword [rax], edx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], edx
movabs rdx, 0x238ffe5c7b0498a6
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 1
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x180027110
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
movabs rdx, 0x6c188be134e074aa
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov qword [rax], rcx
inc dword [0x1801bde78]
jmp fcn.1800325a0

Function at 0x1800271f0
Capabilities:
Hash data using fnv

Disassembly:
xor eax, eax
mov dword [0x1801bde78], eax
mov dword [0x1801bde88], eax
mov rax, qword [0x1801bde80]
mov dword [rax], ecx
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov qword [rax + rcx*8], rdx
movabs rdx, 0x388eb2b86c73b6b3
mov eax, dword [0x1801bde78]
inc eax
mov dword [0x1801bde78], eax
mov ecx, eax
mov rax, qword [0x1801bde80]
mov dword [rax + rcx*8], 0xd
inc dword [0x1801bde78]
jmp fcn.1800325a0
Function at 0x180029040
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180029071
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x18002908f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1800290ab
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800290ad
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800290e9
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18002917e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180029124
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18002915e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18002917e
cmp rbx, rax
ja 0x180029130
test rbx, rbx
je 0x18002917e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1800291a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1800291c8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800291ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800291f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180029249
test ecx, ecx
jle 0x180029229
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180029249
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180029249
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x180029860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1801bc5d0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18002988d
xor eax, eax
jmp 0x1800299ea
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1800298b8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1800298b8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1800299ea
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1800299dd
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x1800298fb
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x180029926
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800299e2
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180029995
sub eax, 1
je 0x180029995
cmp eax, 2
jne 0x1800299dd
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1800299e2
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1800299c3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1800299dd
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1800299e2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180138e90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret