joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f0b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14003f0d8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14003f0fe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14003f100
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14003f159
test ecx, ecx
jle 0x14003f139
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14003f159
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14003f159
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14003f180
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14003f1a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14003f1b8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14003f1d4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14003f1d6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14003f212
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14003f2ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14003f24d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14003f28e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14003f2ae
cmp rbx, rax
ja 0x14003f260
test rbx, rbx
je 0x14003f2ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x14003f710
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140063040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14003f73d
xor eax, eax
jmp 0x14003f8a9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14003f777
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14003f777
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14003f8a9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14003f89c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14003f7ba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14003f7e5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f8a1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14003f854
sub eax, 1
je 0x14003f854
cmp eax, 2
jne 0x14003f89c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f8a1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14003f882
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14003f89c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14003f8a1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004e7c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140040e10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140063040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140040ee3
cmp byte [rcx + 0x71], 0
je 0x140040ee3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140040edf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140040ea4
sub eax, 1
je 0x140040ea8
cmp eax, 2
jne 0x140040edf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004e7c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140040ed6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140040edf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140040e8c
xor al, al
jmp 0x140040e8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004e7c0
add rsp, 0x60
pop rbx
ret

Function at 0x14004f2e4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004f32e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004f32e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004f32e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004f32e
cmp dword [rcx + 0x84], 0xe
jbe 0x14004f32e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004f330
xor al, al
add rsp, 0x28
ret
Function at 0x140002f50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140002fc8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140002fc8
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x140002fb5
nop
cmp rbx, rcx
jae 0x140002fc8
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x140002fa0
cmp rbx, rcx
jae 0x140002fc8
cmp word [rbx], 0
je 0x140002fc8
lfence
mov rax, rbx
jmp 0x140002fca
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d530
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14017a390]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov dword [rsp + 0x3c], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov dword [rsp + 0x38], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str..DEFAULTSoftwareSetID
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000d5c7
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rdx, [0x140149340]
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rsp + 0x38]
test eax, eax
cmovne ecx, ebx
mov dword [rsp + 0x38], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 1
sete al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400f2e00
add rsp, 0x50
pop rbx
ret
Function at 0x14002c200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov rdi, rdx
mov r14, rcx
test rdx, rdx
jne 0x14002c22c
mov rcx, qword [rcx]
mov dl, 0x30
mov rax, qword [rcx]
mov rax, qword [rax]
add rsp, 0x28
pop r14
pop rdi
jmp qword [case.0x14002c3eb.0]
mov qword [rsp + 0x48], rbx
mov ebx, 1
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x20], rsi
lea rsi, [rcx + 0x10]
test rdx, rdx
jns 0x14002c367
mov rax, rdx
mov byte [rcx + 0x10], 0x2d
cqo
mov rdi, rax
xor rdi, rdx
sub rdi, rdx
mov rdx, rdi
cmp rdi, 0xa
jb 0x14002c2a9
movabs rcx, 0x346dc5d63886594b
cmp rdx, 0x64
jb 0x14002c360
cmp rdx, 0x3e8
jb 0x14002c358
cmp rdx, 0x2710
jb 0x14002c350
mov rax, rcx
add ebx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x14002c272
inc ebx
cmp ebx, 0x3f
jb 0x14002c2c9
mov r8d, 0x285
lea rdx, str.E:xml_data_build_dirCODRU_CL23M_SOURCES3rdparty_nlohmanninclude_nlohmanndetailoutput_serializer.hpp
lea rcx, str.n_chars___number_buffer.size_____1
call fcn.140100428
mov r8d, ebx
lea r9, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
mov rbx, qword [rsp + 0x48]
add rsi, r8
cmp rdi, 0x64
jb 0x14002c32d
movabs r10, 0x47ae147ae147ae15
nop dword [rax + rax]
mov rcx, rdi
mov rax, r10
mul rdi
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 6
imul rax, rdi, 0x64
sub rcx, rax
mov eax, ecx
lea rcx, [rax + rax]
movzx eax, byte [rcx + r9 + 1]
mov byte [rsi - 1], al
add rsi, 0xfffffffffffffffe
movzx eax, byte [rcx + r9]
mov byte [rsi], al
cmp rdi, 0x64
jae 0x14002c2f0
cmp rdi, 0xa
jb 0x14002c3c4
mov eax, edi
lea rcx, [rax + rax]
movzx eax, byte [rcx + r9 + 1]
mov byte [rsi - 1], al
movzx eax, byte [rcx + r9]
mov byte [rsi - 2], al
jmp 0x14002c3cc
add ebx, 3
jmp 0x14002c2a9
add ebx, 2
jmp 0x14002c2a9
inc ebx
jmp 0x14002c2a9
cmp rdx, 0xa
jb 0x14002c2ab
movabs rcx, 0x346dc5d63886594b
nop dword [rax + rax]
cmp rdx, 0x64
jb 0x14002c2a9
cmp rdx, 0x3e8
jb 0x14002c3bc
cmp rdx, 0x2710
jb 0x14002c3b4
mov rax, rcx
add ebx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x14002c380
jmp 0x14002c2ab
add ebx, 3
jmp 0x14002c2ab
add ebx, 2
jmp 0x14002c2ab
add dil, 0x30
mov byte [rsi - 1], dil
mov rcx, qword [r14]
lea rdx, [r14 + 0x10]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x50]
add rsp, 0x28
pop r14
pop rdi
jmp qword [case.0x14002c3eb.0]
Function at 0x140049810
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14017a390]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [rbp - 0x70], eax
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x102
lea rcx, [rbp - 0x6c]
call fcn.1400ff100
lea r8, [0x140148214]
mov edx, 0x104
lea rcx, [rbp - 0x6c]
call fcn.1400ffc40
mov r9, 0xffffffffffffffff
lea r8, str.bd::process_broker::client::this_process_should_be_started_by_broker
mov edx, 0x104
lea rcx, [rbp + 0x19c]
call fcn.1400ff100
mov ecx, dword [0x140182324]
mov eax, dword [0x140182320]
xor ebx, ebx
add ecx, eax
je 0x14004994a
mov dword [rsp + 0x68], ebx
call fcn.140004ab0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
test rax, rax
jne 0x1400498d1
call fcn.140004ab0
mov qword [rsp + 0x60], rax
lock inc dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x70], 0x20
mov edx, 1
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x30], rax
lea rax, str.____s
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x19c]
mov qword [rsp + 0x20], rax
lea r9, [0x140000000]
lea r8, [rsp + 0x70]
movsx edx, dx
call fcn.140004000
mov qword [rsp + 0x60], rbx
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
js 0x140049945
nop dword [rax]
call fcn.140004c10
mov eax, 0xffffffff
lock xadd dword [rsp + 0x68], eax
cmp eax, 1
jns 0x140049930
lock inc dword [rsp + 0x68]
call fcn.140049270
test al, al
je 0x1400499f3
mov dword [rbp - 0x7c], ebx
mov word [rbp - 0x78], 0x500
mov qword [rsp + 0x78], rbx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov r9d, 0x220
mov r8d, 0x20
mov dl, 2
lea rcx, [rbp - 0x7c]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400499d3
mov dword [rbp - 0x80], ebx
lea r8, [rbp - 0x80]
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rbp - 0x80]
test eax, eax
cmove ecx, ebx
mov dword [rbp - 0x80], ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rbp - 0x80], 1
je 0x1400499f3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.140047860
test al, al
sete bl
lea rcx, [rbp - 0x70]
call fcn.140004060
movzx eax, bl
jmp 0x1400499fe
lea rcx, [rbp - 0x70]
call fcn.140004060
xor al, al
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1400f2e00
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rbp
ret
Function at 0x14004d800
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14017a390]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14004d834
xor eax, eax
jmp 0x14004d98f
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x14004d871
mov r9, qword [rcx + 0x58]
movsxd r10, dword [r9]
lea rdx, [r8 + r10*2]
cmp r8, rdx
jae 0x14004d871
lea ecx, [r10 - 1]
movzx eax, si
mov dword [r9], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], si
jmp 0x14004d98f
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xc0], rbp
je 0x14004d984
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14004d8b8
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004d8e1
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call fcn.140105ed4
cmp ax, di
je 0x14004d984
movzx edi, si
jmp 0x14004d984
lea r8, [rsp + 0x50]
mov word [rsp + 0x60], si
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x62]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [case.0x14002c3eb.0]
test eax, eax
je 0x14004d941
sub eax, 1
je 0x14004d941
cmp eax, 2
jne 0x14004d984
movzx ecx, word [rsp + 0x60]
jmp 0x14004d8c4
mov rbp, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rbp, rax
je 0x14004d971
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rbp
mov edx, 1
call fcn.140107740
cmp rbp, rax
jne 0x14004d984
lea rax, [rsp + 0x60]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x58], rax
movzx eax, si
jne 0x14004d987
movzx eax, di
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400f2e00
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004e5d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14004e671
test r8, r8
jle 0x14004e669
mov rcx, rdi
call fcn.140005ff0
test rax, rax
jle 0x14004e640
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.1400f5570
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14004e661
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
mov rax, qword [rax + 0x18]
call qword [case.0x14002c3eb.0]
cmp eax, 0xffffffff
je 0x14004e669
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14004e602
sub r14, rbx
mov rax, r14
jmp 0x14004e6ed
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x14004e685
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14004e687
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14004e6e7
test ecx, ecx
jle 0x14004e6c0
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.1400f5570
mov rax, qword [rdi + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14004e6e7
cmp qword [rdi + 0x80], 0
je 0x14004e6e7
lfence
mov r9, qword [rdi + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140107740
sub r14, rax
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14004e710
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14004e732
xor eax, eax
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14004e7be
lfence
mov rdi, rbp
nop dword [rax]
mov rcx, rbx
call fcn.140013780
test rax, rax
jle 0x14004e78e
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rsi, rdi
mov rcx, r14
cmovge rsi, rax
mov r8, rsi
mov rdx, qword [rdx]
call fcn.1400f5570
mov rax, qword [rbx + 0x50]
sub rdi, rsi
sub dword [rax], esi
mov rcx, qword [rbx + 0x38]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14004e7ae
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x14002c3eb.0]
cmp eax, 0xffffffff
je 0x14004e7b6
mov byte [r14], al
dec rdi
mov esi, 1
add r14, rsi
test rdi, rdi
jg 0x14004e750
sub rbp, rdi
jmp 0x14004e8a8
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14004e7d5
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14004e7d7
xor ecx, ecx
movsxd rax, ecx
mov rdi, rbp
test ecx, ecx
je 0x14004e80c
cmp rax, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1400f5570
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
mov rdi, rsi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14004e8a2
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004e847
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rdi, 0xfff
jbe 0x14004e880
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.140107c2c
sub rsi, rax
add r14, rax
mov rdi, rsi
cmp rax, 0xfff
jne 0x14004e8a2
cmp rsi, rax
ja 0x14004e850
test rdi, rdi
je 0x14004e8a2
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140107c2c
mov rsi, rdi
sub rsi, rax
sub rbp, rsi
lfence
mov rsi, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret
Function at 0x14004ece0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14017a390]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14004ed10
xor eax, eax
jmp 0x14004ee63
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14004ed4a
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14004ed4a
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14004ee63
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x14004ee56
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14004ed8d
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14004ed9c
movsx ecx, dil
jmp 0x14004edfa
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [case.0x14002c3eb.0]
test eax, eax
je 0x14004ee14
sub eax, 1
je 0x14004ee14
cmp eax, 2
jne 0x14004ee56
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.140105c34
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14004ee5b
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x14004ee44
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.140107740
cmp rsi, rax
jne 0x14004ee56
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x14004ee5b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400f2e00
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret

Function at 0x14004f8d0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
mov r10, rcx
mov rdx, qword [rdx + 0x10]
mov r8d, 0x1505
mov r9, qword [rdx + 0x10]
movzx eax, word [r9]
test ax, ax
je 0x14004f917
nop dword [rax]
nop word [rax + rax]
imul r8, r8, 0x21
movzx eax, ax
lea r9, [r9 + 2]
add r8, rax
movzx eax, word [r9]
test ax, ax
jne 0x14004f900
mov rcx, qword [rcx + 0x38]
and rcx, r8
mov r8, qword [r10 + 0x20]
shl rcx, 4
add r8, rcx
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x14004f970
cmp rax, rdx
jne 0x14004f955
mov rax, qword [r10 + 0x10]
lea rcx, [r10 + 0x10]
mov qword [r8], rax
mov qword [r8 + 8], rax
call fcn.140052ec0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
mov rax, qword [rdx + 8]
lea rcx, [r10 + 0x10]
mov qword [r8 + 8], rax
call fcn.140052ec0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret
cmp rax, rdx
jne 0x14004f97b
mov rax, qword [rdx]
mov qword [r8], rax
lea rcx, [r10 + 0x10]
call fcn.140052ec0
mov qword [rbx + 0x10], rax
add rsp, 0x20
pop rbx
ret