joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d910
Capabilities:
Encode data using xor

Disassembly:
lea r9, [0x00480d80]
jmp 0x45e0b0
push rbx
push rbp
push rsi
push rdi
mov eax, ecx
mov rbp, r9
mov rdi, r8
cmp rdi, 0x1f
jb 0x45e273
test edx, 3
je 0x45e0e5
movzx esi, byte [rdx]
movzx ebx, al
inc rdx
shr eax, 8
xor esi, ebx
xor eax, dword [rbp + rsi*4]
dec rdi
jmp 0x45e0c6
xor eax, dword [rdx]
lea rdi, [rdx + rdi - 0x1b]
sub rdx, rdi
nop
mov ecx, dword [rdi + rdx + 0xc]
movzx ebx, word [rdi + rdx + 8]
movzx r9d, word [rdi + rdx + 0xa]
movzx esi, bl
shr ebx, 8
xor ecx, dword [rbp + rsi*4 + 0xc00]
movzx esi, r9b
shr r9d, 8
xor ecx, dword [rbp + rbx*4 + 0x800]
xor ecx, dword [rbp + rsi*4 + 0x400]
xor ecx, dword [rbp + r9*4]
movzx ebx, word [rdi + rdx + 4]
movzx r9d, word [rdi + rdx + 6]
movzx esi, bl
shr ebx, 8
xor ecx, dword [rbp + rsi*4 + 0x1c00]
movzx esi, r9b
shr r9d, 8
xor ecx, dword [rbp + rbx*4 + 0x1800]
xor ecx, dword [rbp + rsi*4 + 0x1400]
xor ecx, dword [rbp + r9*4 + 0x1000]
movzx esi, al
mov ebx, eax
shr ebx, 0x18
xor ecx, dword [rbp + rsi*4 + 0x2c00]
xor ecx, dword [rbp + rbx*4 + 0x2000]
ror eax, 0x10
movzx esi, al
shr eax, 0x18
xor ecx, dword [rbp + rsi*4 + 0x2400]
xor ecx, dword [rbp + rax*4 + 0x2800]
mov eax, dword [rdi + rdx + 0x18]
movzx ebx, word [rdi + rdx + 0x14]
movzx r9d, word [rdi + rdx + 0x16]
movzx esi, bl
shr ebx, 8
xor eax, dword [rbp + rsi*4 + 0xc00]
movzx esi, r9b
shr r9d, 8
xor eax, dword [rbp + rbx*4 + 0x800]
xor eax, dword [rbp + rsi*4 + 0x400]
xor eax, dword [rbp + r9*4]
movzx ebx, word [rdi + rdx + 0x10]
movzx r9d, word [rdi + rdx + 0x12]
movzx esi, bl
shr ebx, 8
xor eax, dword [rbp + rsi*4 + 0x1c00]
movzx esi, r9b
shr r9d, 8
xor eax, dword [rbp + rbx*4 + 0x1800]
xor eax, dword [rbp + rsi*4 + 0x1400]
xor eax, dword [rbp + r9*4 + 0x1000]
movzx esi, cl
mov ebx, ecx
shr ebx, 0x18
xor eax, dword [rbp + rsi*4 + 0x2c00]
xor eax, dword [rbp + rbx*4 + 0x2000]
ror ecx, 0x10
movzx esi, cl
shr ecx, 0x18
xor eax, dword [rbp + rsi*4 + 0x2400]
xor eax, dword [rbp + rcx*4 + 0x2800]
add rdx, 0x18
jae 0x45e0f0
add rdi, 0x18
sub rdx, 0x18
movzx ebx, al
movzx ecx, ah
shr eax, 0x10
movzx esi, al
shr eax, 8
mov eax, dword [rbp + rax*4]
xor eax, dword [rbp + rbx*4 + 0xc00]
xor eax, dword [rbp + rcx*4 + 0x800]
xor eax, dword [rbp + rsi*4 + 0x400]
add rdx, 4
jb 0x45e269
xor eax, dword [rdi + rdx]
jmp 0x45e236
add rdx, rdi
add rdi, 3
sub rdi, rdx
test rdi, rdi
je 0x45e28f
movzx esi, byte [rdx]
movzx ebx, al
inc rdx
shr eax, 8
xor esi, ebx
xor eax, dword [rbp + rsi*4]
dec rdi
jne 0x45e278
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x45da70
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp ax, 6
je 0x45daa9
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.SetDefaultDllDirectories
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x45daa9
mov ecx, 0xc00
call rax
add rsp, 0x28
ret
Function at 0x45ddd0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rdi
cmp word [0x00400000], 0x5a4d
je 0x45ddf1
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
movsxd rax, dword [0x0040003c]
lea rcx, [0x00400000]
add rax, rcx
cmp dword [rax], 0x4550
je 0x45de12
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45de50
cmp ecx, 0x20b
je 0x45de2e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
cmp dword [rax + 0x84], 0xe
ja 0x45de3f
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
cmp dword [rax + 0x74], 0xe
ja 0x45de5e
xor ebx, ebx
mov dword [rsp + 0x60], ebx
jmp 0x45de6d
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0x60], ebx
mov ecx, 1
call qword [sym.imp.msvcrt.dll___set_app_type]
mov qword [0x00483d90], 0xffffffffffffffff
mov qword [0x00483d98], 0xffffffffffffffff
mov rcx, qword [sym.imp.msvcrt.dll__fmode]
mov eax, dword [0x00483d8c]
mov dword [rcx], eax
mov rcx, qword [sym.imp.msvcrt.dll__commode]
mov eax, dword [0x00483d88]
mov dword [rcx], eax
call fcn.0045dfd0
cmp dword [0x004807b0], 0
jne 0x45dec7
lea rcx, [fcn.0045dfd0]
call qword [sym.imp.msvcrt.dll___setusermatherr]
lea rdx, [0x0045f4b0]
lea rcx, [0x0045f4a8]
call fcn.005fa000
mov r11d, dword [0x00483d84]
mov dword [rsp + 0x68], r11d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00483d80]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll___getmainargs]
lea rdx, [0x0045f4a0]
lea rcx, [0x0045f450]
call sub.msvcrt.dll__initterm
mov r11, qword [rsp + 0x38]
mov rax, qword [sym.imp.msvcrt.dll___initenv]
mov qword [rax], r11
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
call fcn.0045a9cc
mov edi, eax
mov dword [rsp + 0x34], eax
test ebx, ebx
jne 0x45df53
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
call qword [sym.imp.msvcrt.dll__cexit]
jmp 0x45df74
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x1400c5a00
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x38
mov r8, qword [rcx + 8]
test r8, r8
jne 0x1400c5a15
mov rax, rdx
add rsp, 0x38
ret
mov rcx, qword [rcx]
movzx eax, byte [rcx]
xor rax, rdx
imul rdx, rax, 0x1000193
lea rax, [rcx + 1]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [r8 - 1]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.1400c5a00
add rsp, 0x38
ret
Function at 0x140170bd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140424a38]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, edx
mov rbx, rcx
lea rax, vtable.._AV__StreamBufImpl_UOutputDebugWriter__A0xfd872225_Detail_Catch___0BAA___A0xfd872225_Detail_Catch__.0
mov qword [rcx], rax
mov rax, qword [rcx + 0x20]
mov rdx, qword [rax]
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
cmp rdx, r8
je 0x140170cac
sub r8, rdx
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
call fcn.140022100
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140170c8a
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140170c85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140170d21
call fcn.140322730
mov rdx, qword [rbx + 0x40]
mov rax, qword [rbx + 0x58]
movsxd r8, dword [rax]
add r8, qword [rdx]
mov rax, qword [rbx + 0x20]
mov rcx, qword [rax]
mov qword [rdx], rcx
sub r8d, ecx
mov rax, qword [rbx + 0x58]
mov dword [rax], r8d
lea rax, vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov qword [rbx], rax
mov rdi, qword [rbx + 0x60]
test rdi, rdi
je 0x140170cee
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140170ce0
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, rax
test rax, rax
je 0x140170ce0
mov rax, qword [rax]
mov edx, 1
call qword [rax]
mov edx, 0x10
mov rcx, rdi
call fcn.140322730
nop
test sil, 1
je 0x140170d01
mov edx, 0x170
mov rcx, rbx
call fcn.140322730
mov rax, rbx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140322a80
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.14032cbac
int3
Function at 0x14018a9f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140424a38]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx]
mov edi, edx
mov rbx, rcx
call qword [rax + 0x68]
cmp edi, 0xffffffff
je 0x14018aadb
mov rax, qword [rbx + 0x40]
mov r8, qword [rbx + 0x58]
mov r9, qword [rax]
movsxd rdx, dword [r8]
mov rax, qword [rbx + 0x20]
lea rcx, [r9 + rdx]
cmp qword [rax], rcx
jne 0x14018aaa7
xor ecx, ecx
movsx eax, dil
mov qword [rsp + 0x20], rcx
mov edx, 0xf
mov byte [rsp + 0x21], cl
lea rcx, [rsp + 0x20]
movzx eax, al
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 1
mov byte [rsp + 0x20], al
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x14018aadb
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14018aaa0
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14018aaf5
call fcn.140322730
jmp 0x14018aadb
xor ecx, ecx
mov eax, edx
test r9, r9
cmove eax, ecx
test eax, eax
jle 0x14018aace
lea eax, [rdx - 1]
mov dword [r8], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov byte [rdx], dil
jmp 0x14018aadb
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, dil
call qword [rax + 0x18]
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140322a80
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.14032cbac
int3
Function at 0x140195a80
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140424a38]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [rcx + 0x20]
mov rbx, rcx
mov rdx, qword [rax]
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
cmp rdx, r8
je 0x140195b43
xor eax, eax
mov qword [rsp + 0x38], 0xf
sub r8, rdx
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
call fcn.140022100
cmp qword [rsp + 0x38], 0x10
lea rcx, [rsp + 0x20]
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140195b21
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140195b1c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140195b58
call fcn.140322730
mov rax, qword [rbx + 0x58]
mov rdx, qword [rbx + 0x40]
movsxd r8, dword [rax]
mov rax, qword [rbx + 0x20]
add r8, qword [rdx]
mov rcx, qword [rax]
mov qword [rdx], rcx
sub r8d, ecx
mov rax, qword [rbx + 0x58]
mov dword [rax], r8d
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140322a80
add rsp, 0x50
pop rbx
ret
call fcn.14032cbac
int3
Function at 0x1401fe7c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rbx, rcx
movss xmm6, dword [0x1403a42c0]
movaps xmm0, xmm6
call fcn.140337fbc
movss xmm1, dword [0x1403a42b8]
divss xmm1, xmm0
cvttss2si ecx, xmm1
cmp ecx, 0x80000000
je 0x1401fe817
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
ucomiss xmm0, xmm1
je 0x1401fe817
unpcklps xmm1, xmm1
movmskps eax, xmm1
and eax, 1
xor eax, 1
add ecx, eax
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movss xmm2, dword [0x14036ef80]
mov ecx, 1
cvttss2si eax, xmm1
xorps xmm1, xmm1
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x1401fea39
mov r8d, dword [rbx]
mov qword [rsp + 0x40], rbp
xor ebp, ebp
mov qword [rsp + 0x48], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r14
movabs r14, 0x38eb3ffff6d3
mov edi, eax
cmp r8d, 0x138
jne 0x1401fe8c2
lea r8, [rbx + 0x10]
mov r9d, 0x138
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1401fe880
mov r8d, dword [rbx]
jmp 0x1401fe9a8
cmp r8d, 0x270
jb 0x1401fe9a8
lea r10, [rbx + 0x9c8]
mov r11d, 0x9c
mov rax, qword [r10]
nop
mov rdx, qword [r10 + 8]
lea r8, [r10 + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1401fe8e0
lea r10, [rbx + 0xea8]
mov r11d, 0x9b
mov rax, qword [r10]
nop
mov rdx, rax
lea r8, [r10 + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r10 - 0xea0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1401fe930
mov edx, dword [rbx + 0x1380]
mov r8d, ebp
xor edx, dword [rbx + 8]
btr edx, 0x1f
xor rdx, qword [rbx + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx + 0x9c0], rcx
mov dword [rbx], ebp
mov eax, r8d
xorps xmm0, xmm0
inc r8d
mov rcx, qword [rbx + rax*8 + 8]
mov rax, rcx
mov dword [rbx], r8d
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, r14
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x1401fe9fa
cvtsi2ss xmm0, rdx
jmp 0x1401fea0f
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mulss xmm0, xmm2
mulss xmm2, xmm6
addss xmm1, xmm0
sub rdi, 1
jne 0x1401fe867
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x20]
divss xmm1, xmm2
movaps xmm0, xmm1
add rsp, 0x30
pop rbx
ret
Function at 0x140267080
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rdx]
lea rcx, [0x140423108]
test rax, rax
mov rbx, rdx
cmovne rcx, rax
cmp qword [rcx + 0x18], 0x10
mov r8, qword [rcx + 0x10]
jb 0x1402670a8
mov rcx, qword [rcx]
mov edx, 0x811c9dc5
test r8, r8
je 0x1402670e9
movzx eax, byte [rcx]
xor rax, rdx
imul rdx, rax, 0x1000193
lea rax, [rcx + 1]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
lea rax, [r8 - 1]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.1400c5a00
mov rdx, rax
cmp byte [rbx + 0x10], 0
lea rax, [0x140398620]
lea r8, [0x14036e870]
mov rcx, 0xffffffffffffffff
cmovne r8, rax
inc rcx
cmp byte [r8 + rcx], 0
jne 0x140267106
test rcx, rcx
je 0x140267150
movzx eax, byte [r8]
xor rax, rdx
imul rdx, rax, 0x1000193
lea rax, [r8 + 1]
mov qword [rsp + 0x20], rax
lea rax, [rcx - 1]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.1400c5a00
add rsp, 0x30
pop rbx
ret
mov rax, rdx
add rsp, 0x30
pop rbx
ret

Function at 0x14027b840
Capabilities:
Read file on windows

Disassembly:
mov rax, r9
mov r10, r8
mov r9, qword [rcx + 0x10]
mov r11, rdx
mov r8, rax
mov rdx, r10
mov rcx, r11
mov r9, qword [r9 + 0x20]
jmp fcn.1403364cc
Function at 0x140288080
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbx, rdx
mov rsi, rcx
mov rdx, qword [rcx]
mov r15, rbx
sub r15, rdx
mov rax, qword [rcx + 8]
sub rax, rdx
sar rax, 4
movabs r8, 0xfffffffffffffff
cmp rax, r8
je 0x1402882ef
lea r13, [rax + 1]
mov rcx, qword [rcx + 0x10]
sub rcx, rdx
sar rcx, 4
mov rdx, rcx
shr rdx, 1
mov rax, r8
sub rax, rdx
cmp rcx, rax
ja 0x1402882e9
lea rax, [rdx + rcx]
mov r14, r13
cmp rax, r13
cmovae r14, rax
cmp r14, r8
ja 0x1402882e9
mov r12, r14
shl r12, 4
mov qword [rsp + 0xa8], r14
cmp r12, 0x1000
jb 0x140288143
lea rcx, [r12 + 0x27]
cmp rcx, r12
jbe 0x1402882e9
call fcn.1403226f4
test rax, rax
je 0x1402882fb
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14028816c
test r12, r12
je 0x140288162
mov rcx, r12
call fcn.1403226f4
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xa8], r14
jmp 0x140288171
xor edi, edi
mov qword [rsp + 0xa8], r14
mov qword [rsp + 0x30], rdi
and r15, 0xfffffffffffffff0
add r15, rdi
lea rax, [r15 + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x98], rax
mov ecx, 8
call fcn.1403226f4
mov r9, rax
test r9, r9
je 0x1402881a9
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [r9], rax
mov qword [rsp + 0x40], r9
lea r14, [r15 + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0
lea r8, [0x140288690]
xor edx, edx
xor ecx, ecx
call fcn.1403381f8
mov qword [r15], rax
test rax, rax
je 0x140288301
mov qword [rsp + 0x98], r15
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov rdx, rdi
cmp rbx, rcx
jne 0x14028821b
cmp rax, rcx
je 0x140288267
nop word [rax + rax]
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rcx
jne 0x140288200
jmp 0x140288267
cmp rax, rbx
je 0x14028823d
xorps xmm0, xmm0
movups xmm1, xmmword [rax]
movups xmmword [rax], xmm0
movups xmmword [rdx], xmm1
lea rdx, [rdx + 0x10]
add rax, 0x10
cmp rax, rbx
jne 0x140288220
mov rcx, qword [rsi + 8]
mov qword [rsp + 0x98], rdi
lea rax, [r15 + 0x10]
cmp rbx, rcx
je 0x140288267
sub rax, rbx
xorps xmm0, xmm0
movups xmm1, xmmword [rbx]
movups xmmword [rbx], xmm0
movups xmmword [rbx + rax], xmm1
add rbx, 0x10
cmp rbx, rcx
jne 0x140288251
mov rax, qword [rsi]
test rax, rax
je 0x1402882c0
mov rdx, qword [rsi + 8]
mov rcx, rax
cmp rax, rdx
je 0x14028828f
nop dword [rax + rax]
cmp dword [rax + 8], 0
jne 0x1402882f5
add rax, 0x10
cmp rax, rdx
jne 0x140288280
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
cmp rdx, 0x1000
jb 0x1402882bb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1402882fb
mov rcx, r8
call fcn.140322730
mov qword [rsi], rdi
shl r13, 4
add r13, rdi
mov qword [rsi + 8], r13
lea rcx, [r12 + rdi]
mov qword [rsi + 0x10], rcx
mov rax, r15
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140021e00
int3
call fcn.140021fe0
int3
call fcn.140336df4
int3
call fcn.14032cbac
nop
mov dword [r14], 0
mov ecx, 6
call fcn.140318760
int3
Function at 0x1402a8320
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [rdx]
mov rbx, rdx
movzx ecx, al
mov dword [rbp + 0x18], eax
mov eax, 0x811c9dc5
xor rcx, rax
mov qword [rbp - 8], 3
imul rdx, rcx, 0x1000193
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.1400c5a00
cmp dword [rbx], 1
mov r8, rax
je 0x1402a8420
movzx ecx, byte [rbx + 8]
xor edi, edi
mov byte [rbp + 0x18], cl
xor rcx, rax
mov qword [rbp - 8], rdi
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rcx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.1400c5a00
movzx ecx, byte [rbx + 9]
mov byte [rbp + 0x18], cl
xor rcx, rax
mov qword [rbp - 8], rdi
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rcx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.1400c5a00
movzx ecx, byte [rbx + 0xa]
mov byte [rbp + 0x18], cl
xor rcx, rax
mov qword [rbp - 8], rdi
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rcx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.1400c5a00
movzx ecx, byte [rbx + 0xb]
mov byte [rbp + 0x18], cl
xor rcx, rax
lea rax, [rbp + 0x19]
mov qword [rbp - 8], rdi
jmp 0x1402a84dc
movzx eax, word [rbx + 8]
movzx ecx, al
xor rcx, r8
mov qword [rbp - 8], 1
imul rdx, rcx, 0x1000193
mov word [rbp + 0x18], ax
lea rcx, [rbp - 0x10]
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.1400c5a00
movzx ecx, byte [rbx + 0xa]
xor edi, edi
mov byte [rbp + 0x18], cl
xor rcx, rax
mov qword [rbp - 8], rdi
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rcx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.1400c5a00
movzx ecx, word [rbx + 0xc]
movzx edx, cl
xor rdx, rax
mov qword [rbp - 8], 1
lea rax, [rbp + 0x19]
mov word [rbp + 0x18], cx
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x10]
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rdx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
call fcn.1400c5a00
movss xmm0, dword [rbx + 0x10]
movss dword [rbp + 0x18], xmm0
movzx ecx, byte [rbp + 0x18]
xor rcx, rax
mov qword [rbp - 8], 3
lea rax, [rbp + 0x19]
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
imul rdx, rcx, 0x1000193
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
call fcn.1400c5a00
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x1402debd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x150
mov rax, qword [0x140424a38]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor edi, edi
mov r14, rdx
mov rbx, rcx
cmp byte [rcx + 0x5c], dil
je 0x1402dec00
mov eax, edi
jmp 0x1402dec1a
mov rax, qword [rcx + 0x40]
test rax, rax
je 0x1402dec0e
sub eax, dword [rcx + 0x48]
jmp 0x1402dec1a
mov rcx, qword [rcx + 0x30]
call fcn.14033968c
sub eax, dword [rbx + 0x38]
mov dword [r14], eax
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x1402dec5a
lea rdx, [rcx + 0x1b]
cmp rdx, qword [rbx + 0x50]
ja 0x1402dec77
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x20], xmm0
movsd xmm1, qword [rcx + 0x10]
movsd qword [rsp + 0x30], xmm1
movzx eax, word [rcx + 0x18]
mov word [rsp + 0x38], ax
movzx eax, byte [rcx + 0x1a]
mov byte [rsp + 0x3a], al
mov qword [rbx + 0x40], rdx
jmp 0x1402dec81
mov r9, qword [rbx + 0x30]
lea rcx, [rsp + 0x20]
mov edx, 0x1b
lea r8d, [rdx - 0x1a]
call fcn.1403364cc
cmp rax, 1
je 0x1402dec81
mov dword [rbx + 0x98], 1
cmp byte [rsp + 0x20], 0x4f
jne 0x1402ded84
cmp byte [rsp + 0x21], 0x67
jne 0x1402ded84
cmp byte [rsp + 0x22], 0x67
jne 0x1402ded84
cmp byte [rsp + 0x23], 0x53
jne 0x1402ded84
movzx r8d, byte [rsp + 0x3a]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x180], rsi
mov rcx, rbx
mov esi, edi
call fcn.1402dedb0
movzx r8d, byte [rsp + 0x3a]
mov r9d, edi
cmp r8d, 2
jb 0x1402ded0f
lea eax, [r8 - 2]
mov rcx, rdi
shr eax, 1
inc eax
mov edx, eax
lea r10d, [rax + rax]
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x40]
add edi, eax
movzx eax, byte [rsp + rcx + 0x41]
add esi, eax
add rcx, 2
sub rdx, 1
jne 0x1402decf0
cmp r10d, r8d
jl 0x1402ded20
jmp 0x1402ded26
test r8d, r8d
je 0x1402ded26
mov rcx, rdi
nop word [rax + rax]
movzx r9d, byte [rsp + rcx + 0x40]
mov edx, dword [r14]
add r9d, 0x1b
mov rcx, rbx
lea eax, [rdx + r8]
movzx r8d, byte [rsp + 0x28]
shl r8d, 0x10
add eax, edi
add eax, esi
add eax, r9d
movzx r9d, byte [rsp + 0x27]
shl r9d, 8
add r9d, r8d
mov dword [r14 + 4], eax
movzx r8d, byte [rsp + 0x29]
shl r8d, 0x18
add r9d, r8d
movzx r8d, byte [rsp + 0x26]
add r9d, r8d
mov dword [r14 + 8], r9d
call fcn.1402e1580
mov rsi, qword [rsp + 0x180]
mov eax, 1
jmp 0x1402ded86
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140322a80
add rsp, 0x150
pop r14
pop rdi
pop rbx
ret

Function at 0x1402dedb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
movsxd rdi, r8d
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
test rdx, rdx
je 0x1402dedf5
lea rax, [rdi + rdx]
cmp rax, qword [rcx + 0x50]
ja 0x1402dee10
mov r8, rdi
mov rcx, r10
call fcn.140328640
add qword [rbx + 0x40], rdi
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 0x30]
mov r8d, 1
mov rcx, r10
mov rdx, rdi
call fcn.1403364cc
cmp rax, 1
je 0x1402dede5
mov dword [rbx + 0x98], 1
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret