joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002982c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001ce24
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001ce24
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002997c
cmp rax, 0xffffffffffffffff
je 0x14002997c
xor edi, edi
test rbp, rbp
jle 0x140029927
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f738
mov rbx, rax
test rax, rax
jne 0x1400298b4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002991d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a758
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001db00
cmp eax, 0xffffffff
je 0x1400298fd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400298c4
mov edx, r15d
mov ecx, r14d
call fcn.14001a758
jmp 0x14002991d
cmp byte [rsi + 0x38], dil
je 0x140029914
cmp dword [rsi + 0x34], 5
jne 0x140029914
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002991d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b4ec
jmp 0x140029990
jns 0x140029990
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001ce24
cmp rax, 0xffffffffffffffff
jne 0x140029948
cmp byte [rsi + 0x30], dil
je 0x140029990
mov edi, dword [rsi + 0x2c]
jmp 0x140029990
mov ecx, r14d
call fcn.140018c10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140029990
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140029990
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029989
mov eax, dword [rsi + 0x2c]
jmp 0x14002998e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001ce24
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14002aa80
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002aaa8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002aaa8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1004010e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call sub.cygwin1.dll___getreent
mov rcx, qword [rax + 0x18]
lea r9, str._______________Q_msgkey____M_shmkey____S_semkey__...
lea r8, str.usage:_ipcrm___q_msqid____m_shmid____s_semid_
lea rdx, str._s_n_s_n
call sub.cygwin1.dll_fprintf
mov ecx, 1
call sub.cygwin1.dll_exit
nop
nop word cs:[rax + rax]
Function at 0x14013c06b
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], r8
mov r8d, 0x87189e09
shl r8w, 0x2c
push r8
mov qword [rsp + 8], rsi
lea r8, [0x140158958]
lea rsp, [rsp + 8]
movzx esi, byte [rax]
push 0x7b327030
xor esi, ebx
and esi, 0xff
mov esi, dword [r8 + rsi*4]
shr ebx, 8
xor ebx, esi
push 0xffffffffa48c6d06
inc rax
push 0x8d0528
xor ebx, 0xf49f9f3e
dec r9
lea rsp, [rsp + 0x18]
jne 0x14013c08e
pop rsi
pop r8
Function at 0x100401080
Capabilities:
Terminate process
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [str.clear]
call sub.msys_2.0.dll___getreent
mov r8, rbx
lea rdx, str.Usage:__s__options__n
mov rcx, qword [rax + 0x18]
call sub.msys_2.0.dll_fprintf
call sub.msys_2.0.dll___getreent
mov r8d, 0x82
mov edx, 1
lea rcx, str._nOptions:_n___T_TERM_____use_this_instead_of__TERM_n___V__________print_curses_version_n___x__________do_not_try_to_clear_scrollback_n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
mov ecx, 1
call sub.msys_2.0.dll_exit
nop
nop
jmp 0x100401480
jmp qword [sym.imp.msys_2.0.dll_putchar]

Function at 0x100401180
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov dword [0x10040704c], 2
mov rbx, rcx
mov esi, edx
mov rdx, rcx
mov ecx, 2
call sub.msys_2.0.dll_tcgetattr
test eax, eax
js 0x1004011e0
movdqu xmm0, xmmword [rbx]
mov byte [section..bss], 1
movaps xmmword [0x100407020], xmm0
movdqu xmm1, xmmword [rbx + 0x10]
movaps xmmword [0x100407030], xmm1
movdqu xmm2, xmmword [rbx + 0x1c]
movups xmmword [0x10040703c], xmm2
mov eax, dword [0x10040704c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov rdx, rbx
mov ecx, 1
mov dword [0x10040704c], 1
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x1004011a7
mov dword [0x10040704c], 0
xor ecx, ecx
mov rdx, rbx
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x1004011a7
test sil, sil
je 0x1004012a0
mov edx, 2
lea rcx, str._dev_tty
call sub.msys_2.0.dll_open
mov dword [0x10040704c], eax
test eax, eax
jns 0x1004012c0
call sub.msys_2.0.dll___errno
mov esi, dword [rax]
mov ecx, esi
call sub.msys_2.0.dll_strerror
mov rbx, rax
mov rax, qword [0x100403110]
mov rdi, qword [rax]
call sub.msys_2.0.dll___getreent
lea r9, str.terminal_attributes
lea rdx, str._s:__s:__s_n
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x20], rbx
mov r8, rdi
call sub.msys_2.0.dll_fprintf
cmp byte [section..bss], 0
jne 0x1004012d7
call sub.msys_2.0.dll___getreent
mov ecx, 0xa
mov rdx, qword [rax + 0x18]
call sub.msys_2.0.dll_fputc
lea ecx, [rsi + 4]
call sub.msys_2.0.dll_exit
nop
call sub.msys_2.0.dll___getreent
mov rcx, qword [rax + 0x10]
call sub.msys_2.0.dll_fileno
mov dword [0x10040704c], eax
jmp 0x1004011d7
mov rdx, rbx
mov ecx, eax
call sub.msys_2.0.dll_tcgetattr
test eax, eax
jns 0x1004011d1
jmp 0x10040123b
mov ecx, dword [0x10040704c]
lea r8, [0x100407020]
mov edx, 3
call sub.msys_2.0.dll_tcsetattr
jmp 0x100401283
Function at 0x140004200
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
cmp edx, 0xffffffff
je 0x14000431a
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x14000424b
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x14000424b
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x14000435d
cmp qword [rdi + 0x80], 0
je 0x14000431e
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140004285
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x140004325
mov byte [rsp + 0x4f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x50]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x4f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x14000433d
mov r15, qword [rsp + 0x50]
sub r15, r14
je 0x14000430a
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call fcn.14006cb18
cmp r15, rax
jne 0x14000435b
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x58], rbx
mov eax, 0xffffffff
jmp 0x140004356
xor esi, esi
jmp 0x14000435d
mov esi, 0xffffffff
jmp 0x14000435d
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call fcn.14006c47c
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x14000435d
cmp eax, 3
jne 0x14000435b
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x4f]
call fcn.14006c47c
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400047b0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x140004846
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000484d
mov r15, rsi
jmp 0x14000480b
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.14008a510
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14000483e
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140004823
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x1400047e0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000483e
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14000480b
sub rsi, r15
jmp 0x14000493a
xor esi, esi
jmp 0x14000493a
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400048a0
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x1400048a0
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.14008a510
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x1400048b1
jmp 0x140004937
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140004937
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x1400048e0
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x140004913
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14006c648
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x1400048e0
jmp 0x140004937
test r14, r14
je 0x140004934
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14006c648
sub r14, rax
jmp 0x140004937
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140004950
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400049e9
mov r14, rsi
test rsi, rsi
jle 0x140004a5d
mov r14, rsi
jmp 0x1400049af
cmp r14, r15
cmovb r15, r14
mov rdx, rdi
mov r8, r15
call fcn.14008a510
add rdi, r15
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jle 0x140004a5d
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400049c7
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jg 0x140004980
movzx edx, byte [rdi]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004a5d
inc rdi
dec r14
test r14, r14
jg 0x1400049af
jmp 0x140004a5d
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140004a36
test rsi, rsi
jle 0x140004a36
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x140004a36
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call fcn.14008a510
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x140004a3e
jmp 0x140004a5d
mov r14, rsi
test r14, r14
jle 0x140004a5d
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140004a5d
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14006cb18
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140004df0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov al, 1
cmp qword [rcx + 0x68], 0
je 0x140004e88
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x140004e88
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004e86
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x140004e90
cmp eax, 1
je 0x140004e57
test eax, eax
jne 0x140004e86
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140004e7d
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call fcn.14006cb18
cmp rbx, rax
jne 0x140004e86
cmp byte [rsi + 0x71], 0
sete al
jmp 0x140004e88
xor eax, eax
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov al, 1
jmp 0x140004e88
Function at 0x14001fa60
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10d, ecx
shr r10d, 0x10
mov eax, ecx
shr eax, 0x18
mov rdi, rcx
shr rdi, 0x20
mov r14, rcx
shr r14, 0x28
mov rsi, rcx
shr rsi, 0x30
mov r11, rcx
shr r11, 0x38
movzx r9d, cl
movabs r8, 0xcbf29ce484222325
xor r8, r9
movabs rbx, 0x100000001b3
imul r8, rbx
movzx edx, ch
xor r8, rdx
imul r8, rbx
movzx r10d, r10b
xor r8, r10
imul r8, rbx
xor r8, rax
imul r8, rbx
movzx edi, dil
xor r8, rdi
imul r8, rbx
movzx r14d, r14b
xor r8, r14
imul r8, rbx
movzx r15d, sil
xor r8, r15
imul r8, rbx
xor r8, r11
imul r8, rbx
and r8, qword [0x1401ab730]
mov rbx, qword [0x1401ab718]
mov r11, r8
shl r11, 4
mov r11, qword [rbx + r11 + 8]
mov rsi, qword [0x1401ab708]
cmp r11, rsi
je 0x14001fb8a
movabs r12, 0xff00000000000000
and rcx, r12
shl r15, 0x30
or r15, rcx
shl r14, 0x28
or r14, r15
shl rdi, 0x20
or rdi, r14
shl rax, 0x18
or rax, rdi
shl r10, 0x10
or r10, rax
shl rdx, 8
or rdx, r10
or rdx, r9
cmp rdx, qword [r11 + 0x10]
je 0x14001fb7f
add r8, r8
mov rcx, qword [rbx + r8*8]
xor eax, eax
nop word cs:[rax + rax]
cmp r11, rcx
je 0x14001fb8c
mov r11, qword [r11 + 8]
cmp rdx, qword [r11 + 0x10]
jne 0x14001fb70
cmp r11, rsi
je 0x14001fb8a
mov rax, qword [r11 + 0x18]
jmp 0x14001fb8c
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001fba0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov r10d, ecx
shr r10d, 0x10
mov eax, ecx
shr eax, 0x18
mov rdi, rcx
shr rdi, 0x20
mov r14, rcx
shr r14, 0x28
mov rsi, rcx
shr rsi, 0x30
mov r11, rcx
shr r11, 0x38
movzx r9d, cl
movabs r8, 0xcbf29ce484222325
xor r8, r9
movabs rbx, 0x100000001b3
imul r8, rbx
movzx edx, ch
xor r8, rdx
imul r8, rbx
movzx r10d, r10b
xor r8, r10
imul r8, rbx
xor r8, rax
imul r8, rbx
movzx edi, dil
xor r8, rdi
imul r8, rbx
movzx r14d, r14b
xor r8, r14
imul r8, rbx
movzx r15d, sil
xor r8, r15
imul r8, rbx
xor r8, r11
imul r8, rbx
and r8, qword [0x1401ab770]
mov rbx, qword [0x1401ab758]
mov r11, r8
shl r11, 4
mov r11, qword [rbx + r11 + 8]
mov rsi, qword [0x1401ab748]
cmp r11, rsi
je 0x14001fcca
movabs r12, 0xff00000000000000
and rcx, r12
shl r15, 0x30
or r15, rcx
shl r14, 0x28
or r14, r15
shl rdi, 0x20
or rdi, r14
shl rax, 0x18
or rax, rdi
shl r10, 0x10
or r10, rax
shl rdx, 8
or rdx, r10
or rdx, r9
cmp rdx, qword [r11 + 0x10]
je 0x14001fcbf
add r8, r8
mov rcx, qword [rbx + r8*8]
xor eax, eax
nop word cs:[rax + rax]
cmp r11, rcx
je 0x14001fccc
mov r11, qword [r11 + 8]
cmp rdx, qword [r11 + 0x10]
jne 0x14001fcb0
cmp r11, rsi
je 0x14001fcca
mov rax, qword [r11 + 0x18]
jmp 0x14001fccc
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14002db00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rax, qword [rcx + 0x100]
test rax, rax
je 0x14002db83
mov r8, qword [rcx + 0x130]
and r8, qword [rcx + 0x140]
tzcnt r9, r8
cmovb r9, r8
lea r8, [0x14008e640]
mov r8d, dword [r8 + r9*4]
lea r10, [0x14008e8c0]
mov r9d, dword [r10 + r9*4]
lea r10, [0x14008e840]
nop word cs:[rax + rax]
tzcnt r11, rax
movsxd rsi, dword [rcx + r11*4]
mov edi, r8d
xor edi, r11d
add edi, dword [r10 + rsi*4]
add edi, r9d
mov r11, qword [rdx + 0x80]
lea rsi, [r11 + 1]
blsr rax, rax
mov qword [rdx + 0x80], rsi
mov dword [rdx + r11*4], edi
jne 0x14002db50
pop rdi
pop rsi
ret

Function at 0x14002db90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov rax, qword [rcx + 0x100]
test rax, rax
je 0x14002dc14
mov r8, qword [rcx + 0x130]
and r8, qword [rcx + 0x148]
tzcnt r9, r8
cmovb r9, r8
lea r8, [0x14008e640]
mov r8d, dword [r8 + r9*4 + 0x100]
lea r10, [0x14008e8c0]
mov r9d, dword [r10 + r9*4 + 0x100]
lea r10, [0x14008e840]
nop word [rax + rax]
tzcnt r11, rax
movsxd rsi, dword [rcx + r11*4]
mov edi, r8d
xor edi, r11d
add edi, dword [r10 + rsi*4 + 0x40]
add edi, r9d
mov r11, qword [rdx + 0x80]
lea rsi, [r11 + 1]
blsr rax, rax
mov qword [rdx + 0x80], rsi
mov dword [rdx + r11*4], edi
jne 0x14002dbe0
pop rdi
pop rsi
ret
Function at 0x140030890
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx + 0x358]
mov qword [rax + 8], 0
mov rax, qword [rcx + 0x358]
mov qword [rax + 0x28], 0
mov rax, qword [0x1401aea48]
mov rcx, qword [rcx + 0x358]
mov qword [rcx], rax
mov rax, qword [rsi + 0x358]
mov dword [rax + 0x14], 0
mov rax, qword [rsi + 0x358]
mov dword [rax + 0x10], 0
movsxd rax, dword [rsi + 0x364]
mov rcx, qword [rsi + 0x130]
mov r8, qword [rsi + rax*8 + 0x140]
and r8, rcx
tzcnt rdx, r8
cmovb rdx, r8
lea r8, [0x1400d7f00]
mov r9, qword [rsi + 0x140]
and r9, qword [r8 + rdx*8 + 0x200]
mov r11, qword [rsi + 0x148]
and r11, qword [r8 + rdx*8]
or r11, r9
and r11, qword [rsi + 0x108]
lea r10, [0x1400d6f00]
mov r9, qword [rsi + 0x100]
mov r8, qword [rsi + 0x110]
and r8, qword [r10 + rdx*8 + 0x400]
or r8, r11
and rcx, qword [r10 + rdx*8 + 0xc00]
shl rdx, 5
lea r10, [0x1400d8300]
pext r11, r9, qword [rdx + r10]
mov r10, qword [rdx + r10 + 0x10]
mov r11d, r11d
mov rdi, qword [rsi + 0x128]
mov rbx, qword [rsi + 0x120]
or rbx, rdi
and rbx, qword [r10 + r11*8]
lea r10, [0x1400d8b00]
mov r11, qword [rdx + r10 + 0x10]
pext rdx, r9, qword [rdx + r10]
mov edx, edx
or rdi, qword [rsi + 0x118]
and rdi, qword [r11 + rdx*8]
or rbx, r8
or rcx, rdi
or rcx, rbx
xor rax, 1
and rcx, qword [rsi + rax*8 + 0x140]
mov rax, qword [rsi + 0x358]
mov qword [rax + 0x30], rcx
mov rcx, rsi
call fcn.140030c00
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x140030a56
lea rcx, [0x1401ac980]
lea rdx, [0x14008ec50]
jmp 0x140030a0e
mov r9d, dword [rdx + r8*4]
mov r10, qword [rsi + 0x358]
sar r8d, 3
movsxd r8, r8d
add dword [r10 + r8*4 + 0x10], r9d
blsr rax, rax
je 0x140030a56
tzcnt r9, rax
movsxd r8, dword [rsi + r9*4]
mov r10, r8
shl r10, 9
add r10, rcx
mov r11, qword [r10 + r9*8]
mov rdi, qword [rsi + 0x358]
xor qword [rdi + 0x28], r11
mov r11d, r8d
and r11d, 7
cmp r11d, 6
je 0x140030a07
cmp r11d, 1
jne 0x1400309f0
lea r8, [r10 + r9*8]
mov r8, qword [r8]
mov r9, qword [rsi + 0x358]
xor qword [r9], r8
jmp 0x140030a07
mov rax, qword [rsi + 0x358]
mov ecx, dword [rax + 0x24]
cmp rcx, 0x40
je 0x140030a7f
and ecx, 7
lea rdx, [0x1401ae980]
mov rcx, qword [rdx + rcx*8]
xor qword [rax + 0x28], rcx
mov rax, qword [rsi + 0x358]
cmp dword [rsi + 0x364], 1
jne 0x140030a9a
mov rcx, qword [0x1401aea40]
xor qword [rax + 0x28], rcx
mov rax, qword [rsi + 0x358]
movsxd rcx, dword [rax + 0x18]
lea rdx, [0x1401ae9c0]
mov rcx, qword [rdx + rcx*8]
xor qword [rax + 0x28], rcx
lea rax, [0x14008ec20]
lea rcx, [0x1401ac980]
lea rdx, [0x14008ec50]
jmp 0x140030ad9
add rax, 4
cmp rax, rdx
je 0x140030b25
movsxd r8, dword [rax]
cmp dword [rsi + r8*4 + 0x150], 0
jle 0x140030ad0
mov r9, r8
shl r9, 9
xor r10d, r10d
nop word cs:[rax + rax]
lea r11, [r9 + r10*8]
mov r11, qword [rcx + r11]
mov rdi, qword [rsi + 0x358]
xor qword [rdi + 8], r11
inc r10
movsxd r11, dword [rsi + r8*4 + 0x150]
cmp r10, r11
jl 0x140030b00
jmp 0x140030ad0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140050d80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov ebp, r9d
mov rbx, r8
mov rsi, rdx
mov r14, rcx
cmp qword [rcx + 0x90], 0
je 0x140050dac
mov rcx, r14
call fcn.140003d10
lea rdi, [r14 + 0xa8]
cmp qword [r14 + 0xc0], 0x10
mov rcx, rdi
jb 0x140050dc7
mov rcx, qword [r14 + 0xa8]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x10000000
mov dword [rsp + 0x20], 3
mov edx, 0x80000000
mov r8d, 1
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x140050eeb
mov r15, rax
lea rdx, [rsp + 0x3c]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
and ecx, 0x3f
cmp ecx, 0x10
jne 0x140050f09
mov r9d, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], 0
mov rcx, r15
xor edx, edx
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r12, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12, r12
je 0x140050f29
mov qword [rbx], r12
mov qword [rsp + 0x20], 0
mov rcx, r12
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi], rax
test rax, rax
je 0x140050f3e
xor ecx, ecx
test ebp, ebp
sete cl
lea rdx, [0x14008f75c]
mov r8d, dword [rax]
cmp r8d, dword [rdx + rcx*4]
je 0x140050ef6
lea rcx, [0x1401e2000]
lea rdx, str.Corrupted_table_in_file
call fcn.140003770
mov r8, qword [r14 + 0xb8]
cmp qword [r14 + 0xc0], 0x10
jb 0x140050ec3
mov rdi, qword [r14 + 0xa8]
mov rcx, rax
mov rdx, rdi
call fcn.140008cb0
mov rcx, rax
call fcn.140003b70
mov rdi, qword [rbx]
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi], 0
xor eax, eax
jmp 0x140050efa
add rax, 4
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x1401e2000]
lea rdx, str.Corrupt_tablebase_file
call fcn.140003770
mov rcx, rax
mov rdx, rdi
call fcn.140020590
jmp 0x140050f7e
lea rcx, [0x1401e2000]
lea rdx, str.CreateFileMapping___failed
call fcn.140003770
jmp 0x140050f7e
lea rcx, [0x1401e2000]
lea rdx, str.MapViewOfFile___failed__name_
call fcn.140003770
mov rcx, rax
mov rdx, rdi
call fcn.140020590
lea rdx, str.__error_
mov rcx, rax
call fcn.140003770
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov edx, eax
call fcn.140021cd0
mov rcx, rax
call fcn.140003b70
mov ecx, 1
call fcn.140067e64
int3