joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400163a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x20], rax
sub r9, r8
mov rax, rdx
sub rax, rcx
mov rdi, r8
xor rax, r9
mov rbx, rdx
mov rsi, rcx
test rax, 0xfffffffffffffffe
je 0x1400163df
xor al, al
jmp 0x140016426
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
cmp rcx, rbx
je 0x14001641a
sub rdi, rcx
movzx ecx, word [rsi]
movzx r14d, word [rdi + rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towupper]
movzx ecx, r14w
movzx ebp, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towupper]
cmp bp, ax
jne 0x140016443
add rsi, 2
cmp rsi, rbx
jne 0x1400163f1
mov al, 1
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140026a70
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
xor al, al
jmp 0x14001641c
Function at 0x140016e30
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rbp, rcx
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], rax
mov rdi, qword [rdx + 0x48]
mov rbx, qword [rdx + 0x40]
mov rdx, qword [rsp + 0x48]
cmp rbx, rdi
je 0x140016f88
movabs r12, 0xcbf29ce484222325
movabs r15, 0x100000001b3
nop
mov r9, qword [rbx]
mov qword [rsp + 0x30], r9
movzx r8d, byte [r9]
xor r8, r12
imul r8, r15
movzx eax, byte [r9 + 1]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 2]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 3]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 4]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 5]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 6]
xor r8, rax
imul r8, r15
movzx eax, byte [r9 + 7]
xor r8, rax
imul r8, r15
and r8, qword [rbp + 0x70]
shl r8, 4
add r8, qword [rbp + 0x58]
mov rax, qword [r8 + 8]
mov r10, qword [rbp + 0x48]
cmp rax, r10
je 0x140016f7b
mov r8, qword [r8]
mov rcx, qword [r9]
cmp rcx, qword [rax + 0x10]
je 0x140016f2f
nop dword [rax]
cmp rax, r8
je 0x140016f7b
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x140016f20
test rax, rax
cmove rax, r10
cmp rax, r10
je 0x140016f7b
add rax, 0x18
mov qword [rsp + 0x28], rax
cmp rdx, qword [rsp + 0x50]
je 0x140016f62
mov qword [rdx], r9
mov qword [rdx + 8], rax
mov rdx, qword [rsp + 0x48]
add rdx, 0x10
mov qword [rsp + 0x48], rdx
jmp 0x140016f7b
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140017530
mov rdx, qword [rsp + 0x48]
add rbx, 8
cmp rbx, rdi
jne 0x140016e90
xor ebx, ebx
mov r8, rdx
mov rcx, qword [rsp + 0x40]
sub r8, rcx
sar r8, 4
test r8, r8
je 0x14001700c
movzx r9d, byte [rsp + 0x20]
call fcn.140017e80
mov rdx, qword [rsp + 0x40]
mov rax, qword [rdx + 8]
mov ebx, dword [rax]
xor ecx, ecx
xor r8d, r8d
mov rdi, qword [rsp + 0x48]
cmp rdx, rdi
je 0x140017006
nop dword [rax]
nop word [rax + rax]
mov r11d, ecx
mov r9, qword [rdx + 8]
mov eax, dword [r9]
mov r10d, dword [r9 + 4]
cmp ebx, eax
jne 0x140016fee
mov ecx, r10d
cmp r10d, r11d
cmovbe ecx, r11d
jmp 0x140016ff6
add r8d, ecx
mov ebx, eax
mov ecx, r10d
add eax, r8d
mov dword [r9 + 8], eax
add rdx, 0x10
cmp rdx, rdi
jne 0x140016fd0
add r8d, ecx
add ebx, r8d
lea rcx, [rbp + 0x40]
mov r8, rsi
lea rdx, [rsp + 0x30]
call fcn.1400178a0
mov rcx, qword [rax]
mov dword [rcx + 0x18], 0
mov dword [rcx + 0x1c], ebx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14001706d
mov rdx, qword [rsp + 0x50]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017068
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017068
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026ad0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140026a70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140017310
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, qword [rdx + 0x48]
mov r12d, r9d
mov rdi, qword [rdx + 0x40]
mov r14d, r8d
mov rbp, rcx
cmp rdi, r15
je 0x140017457
mov qword [rsp + 0x88], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r13
movabs r13, 0x100000001b3
nop dword [rax]
mov rsi, qword [rdi]
mov rcx, qword [rbp + 0x70]
movzx edx, byte [rsi]
xor rdx, rax
movzx eax, byte [rsi + 1]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 2]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 3]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 4]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 5]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 6]
imul rdx, r13
xor rdx, rax
movzx eax, byte [rsi + 7]
imul rdx, r13
xor rdx, rax
mov rax, qword [rbp + 0x58]
imul rdx, r13
and rcx, rdx
mov rdx, qword [rbp + 0x48]
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rdx
je 0x14001742e
mov rcx, qword [rax + rcx*8]
mov rax, qword [rsi]
cmp rax, qword [rbx + 0x10]
je 0x1400173f2
cmp rbx, rcx
je 0x14001742e
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x1400173e3
test rbx, rbx
cmove rbx, rdx
cmp rbx, rdx
je 0x14001742e
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140017b90
mov r8d, r14d
mov rdx, rsi
mov rcx, qword [rax]
mov dword [rcx + 0x18], r14d
mov r9d, dword [rbx + 0x20]
add r9d, r12d
mov dword [rcx + 0x1c], r9d
mov rcx, rbp
call fcn.140017310
add rdi, 8
movabs rax, 0xcbf29ce484222325
cmp rdi, r15
jne 0x140017360
mov r13, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14001afc0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14001afd0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rdx + 8]
mov rdi, rcx
mov r8, qword [rcx + 8]
movabs r10, 0x100000001b3
xor esi, esi
mov r9, qword [rax + 8]
movabs rax, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, rax
mov rax, r9
imul rdx, r10
shr rax, 8
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x10
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x18
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x20
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x28
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x30
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r8 + 0x38]
imul rdx, r10
xor rdx, rax
imul rdx, r10
and rcx, rdx
mov rdx, qword [r8 + 0x10]
shl rcx, 4
add rcx, qword [r8 + 0x20]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x14001b0b9
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x14001b0bc
cmp rax, rcx
je 0x14001b0b9
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x14001b0a8
jmp 0x14001b0bc
mov rax, rsi
test rax, rax
cmove rax, rdx
cmp rax, rdx
lea rbx, [rax + 0x18]
cmove rbx, rsi
test rbx, rbx
je 0x14001b123
mov rax, qword [rbx + 0x48]
sub rax, qword [rbx + 0x40]
test rax, 0xfffffffffffffff8
jne 0x14001b10b
lea rcx, [rdi + 0x70]
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.1400178a0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140016b50
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140016e30
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001afd0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14001afd0
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rdx + 8]
mov rdi, rcx
mov r8, qword [rcx + 8]
movabs r10, 0x100000001b3
xor esi, esi
mov r9, qword [rax + 8]
movabs rax, 0xcbf29ce484222325
movzx edx, r9b
xor rdx, rax
mov rax, r9
imul rdx, r10
shr rax, 8
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x10
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x18
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x20
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x28
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x30
imul rdx, r10
movzx ecx, al
mov rax, r9
xor rdx, rcx
shr rax, 0x38
mov rcx, qword [r8 + 0x38]
imul rdx, r10
xor rdx, rax
imul rdx, r10
and rcx, rdx
mov rdx, qword [r8 + 0x10]
shl rcx, 4
add rcx, qword [r8 + 0x20]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x14001b0b9
mov rcx, qword [rcx]
cmp r9, qword [rax + 0x10]
je 0x14001b0bc
cmp rax, rcx
je 0x14001b0b9
mov rax, qword [rax + 8]
cmp r9, qword [rax + 0x10]
jne 0x14001b0a8
jmp 0x14001b0bc
mov rax, rsi
test rax, rax
cmove rax, rdx
cmp rax, rdx
lea rbx, [rax + 0x18]
cmove rbx, rsi
test rbx, rbx
je 0x14001b123
mov rax, qword [rbx + 0x48]
sub rax, qword [rbx + 0x40]
test rax, 0xfffffffffffffff8
jne 0x14001b10b
lea rcx, [rdi + 0x70]
mov r8, rbx
lea rdx, [rsp + 0x20]
call fcn.1400178a0
mov rcx, qword [rax]
mov qword [rcx + 0x18], rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140016b50
mov rdx, rbx
lea rcx, [rdi + 0x30]
call fcn.140016e30
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14001b630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14001b660
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14001b688
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14001b68a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14001b6e3
test ecx, ecx
jle 0x14001b6c3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14001b6e3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001b6e3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test dword [rax - 0x39], ecx
xor al, 0xfb
invalid
and r13b, cl
adc al, 0x29
xor eax, 0xfbbe7226
insd dword [rdi], dx
cmpsd dword cs:[rsi], dword [rdi]
call rdx
mov ebx, 0xbb66f3b3
jb 0x14005ec16
wait
sbb al, 0x85
cmp esi, eax
scasd eax, dword [rdi]
jp 0x14005ec0f
test byte [rax + 0x7ffe7e2a], dh
push rbp
out 0x9d, eax
out 0x72, al
mov dh, 0xef
jb 0x14005eb42
idiv dword [rsi - 0xc5644ba]
jno 0x14005ec24
ja 0x14005ec17
fidivr dword [rax + 0x79]
pop rsi
mov ch, byte [rsp + rbx*8]
fstp qword [rsi + 0x7b4cbfff]
sub ebp, dword [rdx]
sub eax, edx
ja 0x14005ebdc
ret 0xfd77
invalid
pop rbp
scasd eax, dword [rdi]
push rbx
sbb eax, edi
fnstcw word ds:[rsp + rbx - 0xa81eff1]
fnstcw word [rsp + rbx - 0xa81eff1]
mov esp, 0x7e100f1c
cmc
leave
out dx, eax
jge 0x14005ec20
jge 0x14005ec20
movsb byte [rdi], byte [rsi]
or al, 0x87
or al, 0x87
cmp al, 0xa7
add al, 0x9e
sbb ch, byte [rsi + 0x37]
invalid
Function at 0x14001b710
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14001b732
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14001b741
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x20], rdi
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14001b764
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001b766
xor ecx, ecx
mov qword [rsp + 0x28], rbx
movsxd rax, ecx
test ecx, ecx
je 0x14001b7a0
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rdi, rbx
add r14, rbx
mov r8, rdi
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001b847
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14001b7db
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rbx, r8
cmp r8, 0xfff
jbe 0x14001b821
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
add r14, rax
mov rbx, rdi
cmp rax, 0xfff
jne 0x14001b860
cmp rdi, rax
ja 0x14001b7f0
mov r8, rbx
test rbx, rbx
je 0x14001b847
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rbp, r8
mov rbx, qword [rsp + 0x28]
mov rax, rbp
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rdi
jmp 0x14001b84a
invalid
Function at 0x14001bc90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001bcbd
xor eax, eax
jmp 0x14001be12
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14001bce8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14001bce8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14001be12
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14001be05
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14001bd2b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001bd56
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001be0a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
js 0x14001be05
cmp eax, 1
jle 0x14001bdc5
cmp eax, 3
jne 0x14001be05
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001be0a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14001bdf3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14001be05
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001be0a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140026a70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14001d2b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14001d383
cmp byte [rcx + 0x71], 0
je 0x14001d383
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001d37f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14001d344
sub eax, 1
je 0x14001d348
cmp eax, 2
jne 0x14001d37f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140026a70
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14001d376
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001d37f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001d32c
xor al, al
jmp 0x14001d32c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140026a70
add rsp, 0x60
pop rbx
ret

Function at 0x140020ef0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140036010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, rcx
movabs rax, 0xcbf29ce484222325
movabs rcx, 0x100000001b3
mov r10, r8
mov r8, qword [rdx + 8]
mov rdi, qword [r9 + 0x10]
movzx edx, byte [r8 + 8]
xor rdx, rax
movzx eax, byte [r8 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r8 + 0xf]
imul rdx, rcx
xor rdx, rax
mov rax, qword [r9 + 0x20]
imul rdx, rcx
mov rcx, qword [r9 + 0x38]
and rcx, rdx
add rcx, rcx
mov rbx, qword [rax + rcx*8 + 8]
cmp rbx, rdi
je 0x140020fc2
mov rcx, qword [rax + rcx*8]
mov rax, qword [r8 + 8]
cmp rax, qword [rbx + 0x10]
je 0x140020fc4
cmp rbx, rcx
je 0x140020fc2
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x140020fb1
jmp 0x140020fc4
xor ebx, ebx
mov rdx, r10
mov rcx, r9
call fcn.140021120
test rbx, rbx
mov qword [rsp + 0x20], rax
cmove rbx, rdi
mov rdx, qword [rbx + 0x60]
cmp rdx, qword [rbx + 0x68]
je 0x140020fef
mov qword [rdx], rax
add qword [rbx + 0x60], 8
jmp 0x140020ffd
lea r8, [rsp + 0x20]
lea rcx, [rbx + 0x58]
call fcn.140009e50
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140026a70
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140021020
Capabilities:
Hash data using fnv

Disassembly:
mov r10, qword [rdx + 8]
mov r8, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
movzx edx, byte [r10 + 8]
mov r9, qword [r8 + 0x10]
xor rdx, rax
movzx eax, byte [r10 + 9]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xa]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xb]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xc]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xd]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xe]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [r10 + 0xf]
imul rdx, rcx
xor rdx, rax
mov rax, qword [r8 + 0x20]
imul rdx, rcx
and rdx, qword [r8 + 0x38]
add rdx, rdx
mov rcx, qword [rax + rdx*8 + 8]
cmp rcx, r9
je 0x1400210d3
mov rdx, qword [rax + rdx*8]
mov rax, qword [r10 + 8]
cmp rax, qword [rcx + 0x10]
je 0x1400210d5
cmp rcx, rdx
je 0x1400210d3
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x1400210c2
jmp 0x1400210d5
xor ecx, ecx
test rcx, rcx
cmove rcx, r9
mov r9, qword [r10 + 0x10]
test r9, r9
jg 0x1400210ee
mov qword [rcx + 0x30], 0
ret
mov rax, qword [r10 + 0x20]
cqo
idiv r9
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv r9
imul rdx, r8, 0x3b9aca00
add rax, rdx
mov qword [rcx + 0x30], rax
ret
Function at 0x140021b30
Capabilities:
Hash data using fnv

Disassembly:
mov r10, qword [rdx + 8]
mov r9, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov r11, rdx
movzx r8d, byte [r10 + 8]
mov rdx, qword [r9 + 0x38]
xor r8, rax
movzx eax, byte [r10 + 9]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xa]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xb]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xc]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xd]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xe]
imul r8, rcx
xor r8, rax
movzx eax, byte [r10 + 0xf]
imul r8, rcx
xor r8, rax
mov rax, qword [r9 + 0x20]
mov r9, qword [r9 + 0x10]
imul r8, rcx
and rdx, r8
add rdx, rdx
mov rcx, qword [rax + rdx*8 + 8]
cmp rcx, r9
je 0x140021be9
mov rdx, qword [rax + rdx*8]
mov rax, qword [r10 + 8]
cmp rax, qword [rcx + 0x10]
je 0x140021beb
cmp rcx, rdx
je 0x140021be9
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140021bd8
jmp 0x140021beb
xor ecx, ecx
mov rax, qword [r11 + 0x18]
mov r8, 0xffffffffffffffff
mov rdx, qword [rax]
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140021c00
test rcx, rcx
cmove rcx, r9
add rcx, 0x38
jmp fcn.140003f90
Function at 0x140021c20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rsi, rdx
mov r9, rcx
mov rdx, qword [r8 + 8]
movzx r8d, byte [rdx + 8]
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs rcx, 0x100000001b3
imul r8, rcx
movzx eax, byte [rdx + 9]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xa]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xb]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xc]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xd]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xe]
xor r8, rax
imul r8, rcx
movzx eax, byte [rdx + 0xf]
xor r8, rax
imul r8, rcx
mov rcx, qword [r9 + 0x38]
and rcx, r8
add rcx, rcx
mov rax, qword [r9 + 0x20]
mov rbx, qword [rax + rcx*8 + 8]
mov r8, qword [r9 + 0x10]
cmp rbx, r8
je 0x140021ce4
mov rcx, qword [rax + rcx*8]
mov rax, qword [rdx + 8]
cmp rax, qword [rbx + 0x10]
je 0x140021ce6
cmp rbx, rcx
je 0x140021ce4
mov rbx, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
jne 0x140021cd3
jmp 0x140021ce6
xor ebx, ebx
test rbx, rbx
cmove rbx, r8
mov rdx, qword [rdx + 0x68]
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140021d12
lea rcx, [rsp + 0x40]
call fcn.140003f90
nop
mov rax, qword [rsi + 8]
mov rdx, qword [rax + 0x68]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140021d46
mov r8, rdi
lea rcx, [rsp + 0x20]
call fcn.140003f90
nop
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140006060
lea rcx, [rbx + 0x38]
lea rdx, [rsp + 0x60]
call fcn.140023ef0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140021dc0
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021dba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021dba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026ad0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140021e01
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021dfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021dfb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026ad0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140021e41
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140021e3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140026ad0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret