joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002af90
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call fcn.1400085d0
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140008260
call fcn.14002b040
mov ecx, 9
mov dl, 1
call fcn.14002b200
test al, al
je 0x14000968a
call fcn.140008710
call fcn.14001f690
mov rcx, rbx
test al, al
je 0x140009675
call fcn.1400096c0
call fcn.140008830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400096a2
call fcn.140009a10
call fcn.140008830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400096a2
call fcn.14001f690
mov rcx, rbx
test al, al
je 0x14000969d
call fcn.1400096c0
jmp 0x1400096a2
call fcn.140009a10
mov ecx, 0x1e
call fcn.140001b90
test al, al
je 0x1400096b5
call fcn.140009e80
add rsp, 0x20
pop rbx
jmp 0x14002af90
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
xor dil, dil
xor ebp, ebp
cmp bp, word [0x14013693c]
jae 0x14002b025
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r14
lea r14, [0x140132fd0]
mov qword [rsp + 0x38], rsi
nop
movzx eax, dil
imul rbx, rax, 0x24c
add rbx, r14
cmp byte [rbx + 0x248], bpl
je 0x14002b006
lea rcx, [rbx + 0x40]
call fcn.140002100
test al, al
je 0x14002b006
lea r9, [rbx + 0x40]
mov r8, rbx
lea rdx, str.Deleting_engine_crash_file___s__at___ws_
mov ecx, 0xf
call fcn.14002a430
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dil
movzx eax, dil
cmp ax, word [0x14013693c]
jb 0x14002afc0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [0x140136940], bp
mov word [0x14013693c], bp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14002c630
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x4060
call fcn.1400d57d0
sub rsp, rax
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x4050], rax
mov rdi, rcx
xor bl, bl
mov ecx, 0xa
call fcn.1400018d0
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000080
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x20], 3
mov rbp, rax
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
test rax, rax
je 0x14002c722
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4000
call sub.VCRUNTIME140.dll_memset
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov r8d, 0x4000
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002c719
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.14002cb20
cmp dword [rax + 0x50], 0
jne 0x14002c705
cmp word [rdi + 0xe], 3
jne 0x14002c705
mov bl, 1
jmp 0x14002c719
mov r8, rbp
lea rdx, str.Failed_to_parse_the_JSON_file__ws
mov ecx, 2
call fcn.14002a3c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x4050]
xor rcx, rsp
call fcn.1400d51a0
lea r11, [rsp + 0x4060]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002ccc0
Capabilities:
Enumerate files on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x6b8
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
lea rdx, str.Try_to_directly_extract_the_engine_files_from_the_Temp_directory
mov ecx, 0xf
call fcn.14002a430
mov ecx, 9
call fcn.1400018d0
xor edx, edx
lea rcx, [rsp + 0x490]
mov r8d, 0x208
mov rsi, rax
call sub.VCRUNTIME140.dll_memset
mov r9, rsi
lea r8, str._s
mov edx, 0x104
lea rcx, [rsp + 0x490]
call fcn.14001f730
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x490]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002cf39
mov qword [rsp + 0x6d0], rbx
mov qword [rsp + 0x6d8], rbp
lea rbp, [0x140133010]
mov qword [rsp + 0x6e0], r14
xor r14d, r14d
mov qword [rsp + 0x6b0], r15
lea r15, [0x140132fd0]
nop dword [rax]
test byte [rsp + 0x30], 0x10
je 0x14002cd93
lea rdx, str.Directory___ws__skipped.
jmp 0x14002cee1
lea rdx, str.crashhandler
lea rcx, [rsp + 0x5c]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x14002ceda
lea rdx, str.dxdiag
lea rcx, [rsp + 0x5c]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x14002ceda
xor edx, edx
lea rcx, [rsp + 0x280]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x5c]
mov r9, rsi
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.14001f730
movzx eax, word [0x14013693c]
movzx ebx, r14w
cmp r14w, ax
jae 0x14002ce44
movzx eax, bx
lea rcx, [rsp + 0x280]
imul rdx, rax, 0x24c
add rdx, rbp
call fcn.140002980
test al, al
jne 0x14002ced1
movzx eax, word [0x14013693c]
inc bx
cmp bx, ax
jb 0x14002ce13
movzx eax, ax
lea r9, [rsp + 0x5c]
imul rbx, rax, 0x24c
lea r8, [0x1400e6f4c]
mov edx, 0x40
add rbx, r15
mov rcx, rbx
mov word [rbx + 0x249], 3
mov byte [rbx + 0x248], 1
call fcn.14002aca0
lea rcx, [rbx + 0x40]
mov edx, 0x104
lea r9, [rsp + 0x280]
lea r8, [0x1400e527c]
call fcn.14001f730
movzx eax, byte [rbx + 0x249]
lea rdx, str.File_extracted_from_the_Temp_directory__max:__u____u_:___s___Priority__u_
movzx r8d, word [0x14013693c]
mov r9d, 0x19
mov dword [rsp + 0x28], eax
inc r8d
mov qword [rsp + 0x20], rbx
lea ecx, [r9 - 0xa]
call fcn.14002a430
inc word [0x14013693c]
jmp 0x14002cef0
lea rdx, str.File___ws__already_in_the_extracted_crash_files.
jmp 0x14002cee1
lea rdx, str.File___ws__skipped.___crash_handler_file__
lea r8, [rsp + 0x5c]
mov ecx, 0xf
call fcn.14002a430
cmp word [0x14013693c], 0x19
jae 0x14002cf10
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14002cd80
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov r15, qword [rsp + 0x6b0]
mov r14, qword [rsp + 0x6e0]
mov rbp, qword [rsp + 0x6d8]
mov rbx, qword [rsp + 0x6d0]
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x6b8
pop rdi
pop rsi
ret
Function at 0x1400398d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x140039ada
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140039994
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x140039950
mov ecx, dword [r10]
jmp 0x140039a77
cmp ecx, 0x4e0
jb 0x140039a77
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400399b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140039a00
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x140039930
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x140039920
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x140039afa
cmp r8d, r14d
jne 0x140039900
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x14003a720
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x13f0
call fcn.1400d57d0
sub rsp, rax
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rsi, rcx
movzx ebx, r8b
mov ecx, 0x15
movzx ebp, dl
call fcn.140001b90
test al, al
jne 0x14003a78c
lea rdx, str.Crash_upload_has_been_disabled.
mov ecx, 8
call fcn.14002a430
mov eax, 3
mov dword [0x14011e2e8], 3
jmp 0x14003a8ce
mov edi, 8
test bpl, bpl
jne 0x14003a89c
test bl, bl
je 0x14003a7a8
movzx ebx, di
call fcn.14001f5b0
jmp 0x14003a7b2
mov ebx, 7
call fcn.14001f580
movaps xmm1, xmm0
movzx ecx, bx
call fcn.14002b260
movaps xmm1, xmm0
lea rdx, str.Throttle:__u__max:__u___based_on_received_throttle:__f
mulss xmm1, dword [0x1400e8f88]
mov r9d, 0x2710
mov ecx, edi
cvtss2sd xmm0, xmm0
cvttss2si rbp, xmm1
movsd qword [rsp + 0x20], xmm0
mov r8d, ebp
call fcn.14002a430
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x54], eax
mov r8d, 1
mov dword [rsp + 0x13d4], 0xffffffff
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x54], eax
inc r8
cmp r8, 0x270
jb 0x14003a810
lea rax, [rsp + 0x50]
mov dword [rsp + 0x50], 0x270
mov edx, 0x2710
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], 0x20
mov dword [rsp + 0x40], 0xffffffff
call fcn.1400398d0
mov r8d, eax
lea rdx, str.Generated_number_for_throttle:__u
mov ecx, edi
mov ebx, eax
call fcn.14002a430
cmp ebx, ebp
jb 0x14003a89c
mov r8, rsi
lea rdx, str._CTDumpster_only__Uploading_crash_zip___ws__isnt_allowed_by_throttle.
mov ecx, edi
call fcn.14002a650
mov eax, 2
mov dword [0x14011e2e8], 2
jmp 0x14003a8ce
mov r8, rsi
lea rdx, str.Allowed_to_upload_the_crash_zip_:___ws_
mov ecx, edi
call fcn.14002a430
mov rcx, rsi
call fcn.14003a350
test eax, eax
mov dword [0x14011e2e8], eax
mov rcx, rsi
sete dl
call fcn.1400252e0
mov eax, dword [0x14011e2e8]
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1400d51a0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003a950
Capabilities:
Initialize winhttp library

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0xc0], rax
call fcn.140038550
xorps xmm0, xmm0
xor ecx, ecx
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm0
call fcn.1400017d0
mov edx, 0x40
lea rcx, str.HTTP_1.1
mov qword [rsp + 0x28], rcx
lea r9, str._S_crashhandler__s
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rdx - 0x41]
call fcn.1400029a0
xor r9d, r9d
mov dword [rsp + 0x20], 0x10000000
xor r8d, r8d
lea rcx, [rsp + 0x40]
lea edx, [r9 + 4]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [0x140174d98], rax
test rax, rax
jne 0x14003aa23
call fcn.1400023f0
mov r9, rax
lea r8, [rsp + 0x40]
lea rdx, str.User_agent__ws:_Failed_to_create_a_HTTP_session___ws_.
mov ecx, 8
call fcn.14002a3c0
jmp 0x14003ab48
lea r8, [rsp + 0x40]
mov ecx, 8
lea rdx, str.User_agent__ws:_HTTP_session_has_been_created.
call fcn.14002a430
mov rcx, qword [0x140174d98]
lea r8, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x30], 0x2800
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp eax, 1
jne 0x14003aa8b
lea rdx, [0x1400e8e60]
lea ecx, [rax + 7]
call fcn.14002a430
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xd8
ret
mov rcx, qword [0x140174d98]
lea r8, [rsp + 0x38]
mov r9d, 4
mov dword [rsp + 0x38], 0x800
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp eax, 1
jne 0x14003aadd
lea rdx, str.Security_protocol_of_the_HTTP_session_has_been_set_to_TLS_1.2
lea ecx, [rax + 7]
call fcn.14002a430
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xd8
ret
mov rcx, qword [0x140174d98]
lea r8, [rsp + 0x30]
mov r9d, 4
mov dword [rsp + 0x30], 0x200
lea edx, [r9 + 0x50]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
cmp eax, 1
jne 0x14003ab2f
lea rdx, str.Security_protocol_of_the_HTTP_session_has_been_set_to_TLS_1.1
lea ecx, [rax + 7]
call fcn.14002a430
mov al, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xd8
ret
call fcn.1400023f0
mov r8, rax
lea rdx, str.Failed_to_set_a_valid_secure_protocol_for_current_HTTP_session.___ws_
mov ecx, 8
call fcn.14002a3c0
xor al, al
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xd8
ret
Function at 0x14003aba0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14001f690
test al, al
jne 0x14003abc8
lea rdx, str.RichEdit_is_disabled_on_ship_build.
jmp 0x14003ac8d
xor eax, eax
mov dword [rsp + 0x28], 0x490052
lea rcx, [rsp + 0x28]
mov word [rsp + 0x40], ax
mov dword [rsp + 0x2c], 0x480043
mov dword [rsp + 0x30], 0x440045
mov dword [rsp + 0x34], 0x300032
mov dword [rsp + 0x38], 0x64002e
mov dword [rsp + 0x3c], 0x6c006c
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140174da8], rax
test rax, rax
jne 0x14003ac36
call fcn.1400023f0
mov r9, rax
lea r8, [rsp + 0x28]
lea rdx, str.Impossible_to_load_the_dll___ws____ws_
mov ecx, 0xb
call fcn.14002a3c0
jmp 0x14003ac97
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 8
mov dword [rsp + 0x24], 0x40ff
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
jne 0x14003ac7f
lea rdx, str.Impossible_to_init_common_controls_for_RichEdit.
lea ecx, [rax + 0xb]
call fcn.14002a3c0
mov rcx, qword [0x140174da8]
test rcx, rcx
je 0x14003ac76
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [0x140174da0], 0
jmp 0x14003ac97
mov byte [0x140174da0], 1
lea rdx, str.RichEdit_successfully_initialized.
mov ecx, 0xb
call fcn.14002a430
call fcn.14001c910
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x58
ret
Function at 0x14005eee0
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, r8
mov rcx, qword [rcx]
mov rsi, rdx
cmp qword [r8 + 0x50], rcx
je 0x14005ef10
lea r9, str.Field_does_not_match_message_type.
mov rdx, rbx
lea r8, str.GetEnumValue
call fcn.140061a60
cmp dword [rbx + 0x3c], 3
jne 0x14005ef2f
mov rcx, qword [rdi]
lea r9, str.Field_is_repeated__the_method_requires_a_singular_field.
lea r8, str.GetEnumValue
mov rdx, rbx
call fcn.140061a60
mov rcx, rbx
call fcn.140064600
movsxd rcx, eax
lea rax, [0x1400f1f70]
cmp dword [rax + rcx*4], 8
je 0x14005ef5f
mov rcx, qword [rdi]
lea r8, str.GetEnumValue
mov r9d, 8
mov rdx, rbx
call fcn.140061b50
cmp byte [rbx + 0x42], 0
je 0x14005ef83
mov rcx, rbx
call fcn.1400b5be0
mov ecx, dword [rdi + 0x28]
mov edx, dword [rbx + 0x44]
add rcx, rsi
mov r8d, dword [rax + 0x10]
call fcn.14006c650
mov edi, eax
jmp 0x14005ef93
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.14005b5f0
mov edi, dword [rax]
mov rcx, rbx
call fcn.1400b5d60
mov rcx, rax
mov edx, edi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp 0x1400a7a60
Function at 0x140064bb0
Capabilities:
Hash data using fnv

Disassembly:
mov r9, rdx
movabs rax, 0xcbf29ce484222325
mov rdx, rcx
movabs rcx, 0x100000001b3
movzx r8d, byte [r9]
xor r8, rax
movzx eax, byte [r9 + 1]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [rdx + 0x30]
and rcx, r8
mov r8, qword [rdx + 0x18]
mov rdx, qword [rdx + 8]
mov rax, rcx
add rax, rax
add rcx, rcx
mov rax, qword [r8 + rax*8]
mov r10, qword [r8 + rcx*8]
lea r11, [r8 + rcx*8]
nop dword [rax]
cmp r10, rdx
jne 0x140064c5a
mov rcx, rdx
jmp 0x140064c61
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x140064c7e
mov rcx, qword [r9]
cmp qword [rax + 0x10], rcx
je 0x140064c74
mov rax, qword [rax]
jmp 0x140064c50
cmp rax, rdx
je 0x140064c7e
mov rax, qword [rax + 0x18]
ret
xor eax, eax
ret
Function at 0x1400650f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r11, qword [r10 + 0x30]
and r11, r9
mov rbx, qword [r10 + 8]
mov rdx, r11
add rdx, rdx
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + rdx*8]
cmp rbx, rcx
je 0x1400651fb
mov rbx, qword [rax + rdx*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rcx
je 0x1400651fb
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x1400651b4
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov edx, 0x20
mov rcx, rdi
call fcn.1400d5498
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140065291
mov rax, qword [rdi]
cmp rbx, rax
je 0x140065230
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
shl r11, 4
mov rdx, qword [r10 + 0x18]
add rdx, r11
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x140065252
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r11 + 8], rdi
jmp 0x14006527e
cmp rax, rbx
jne 0x14006525c
mov qword [rdx], rdi
jmp 0x14006527e
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x14006527e
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r11 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r11 + 8], rcx
mov rcx, r10
call fcn.140068bc0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140065490
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
mov r14, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 4]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 5]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 6]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 7]
xor r9, rax
imul r9, rcx
mov r12, qword [r14 + 0x30]
and r12, r9
mov rdi, qword [r14 + 8]
mov rbx, r12
add rbx, rbx
mov rax, qword [r14 + 0x18]
mov rcx, qword [rax + rbx*8]
cmp rcx, rdi
jne 0x140065551
mov rbx, rdi
jmp 0x140065560
mov rbx, qword [rax + rbx*8 + 8]
mov rbx, qword [rbx]
nop dword [rax]
cmp rbx, rcx
je 0x140065581
mov rbx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
cmp qword [r8], rax
jne 0x140065560
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x14006566c
mov rdi, qword [rdi]
mov r13, qword [rdi + 8]
mov r9, r8
mov r8, r13
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.140064e00
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x7fffffffffffffe
sub rcx, rax
cmp rcx, 1
jb 0x140065684
inc rax
mov qword [r14 + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r13], rdx
mov rcx, qword [r14 + 8]
mov rdi, qword [rcx]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x14006560c
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [r14 + 8]
shl r12, 4
mov rdx, qword [r14 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, rcx
jne 0x14006562d
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x140065659
cmp rax, rbx
jne 0x140065637
mov qword [rdx], rdi
jmp 0x140065659
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140065659
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r14
call fcn.140068bc0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x140065760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r9d, byte [r8 + 0x10]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rdi, rdx
movzx eax, byte [r8 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x12]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x13]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x14]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x15]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x16]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 0x17]
imul r9, rcx
xor r9, rax
imul r9, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140065824
cmp rax, r8
jne 0x14006581a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14006582f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14006582f
cmp rax, r8
jne 0x14006582f
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov edx, 0x20
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
mov rcx, r8
dec qword [r10 + 0x10]
call fcn.1400d5498
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret