joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041750
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x60
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x140041763
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x1400417ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400417a4
cmp qword [rbx + 0x18], 0x10
jb 0x140041786
mov rbx, qword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140129b14
test eax, eax
js 0x1400417a4
movzx eax, word [rsp + 0x26]
shr ax, 0xe
and al, 1
jne 0x1400417ac
xor al, al
add rsp, 0x60
pop rbx
ret
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x140041d50
Capabilities:
Timestomp file

Disassembly:
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x18], 0x10
jb 0x140041d60
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x30], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140041d9c
xor al, al
add rsp, 0x50
pop rdi
ret
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
mov rcx, rdi
setne bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400425c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140151d00]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x140042639
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400425e0
test r8, r8
je 0x14004265d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140042640
not ecx
mov eax, ecx
ret
Function at 0x140042f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call fcn.1401247d0
mov rcx, qword [rbx + 0x68]
add rdi, qword [rcx + 0x78]
js 0x140042ff9
cmp rax, rdi
je 0x140042fdf
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call fcn.140124280
test eax, eax
jne 0x140042ff9
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call fcn.140124a38
jmp 0x140043002
mov dword [rbx + 0x1c], 0x16
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140052aa0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
push r14
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r14, rdx
mov rdi, rcx
cmp rax, qword [rcx]
jbe 0x140052ccb
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r12
movabs r12, 0xcbf29ce484222325
mov qword [rsp + 0x20], r15
movabs r15, 0x100000001b3
nop dword [rax + rax]
mov rbx, qword [rdi + 0x88]
sub rax, qword [rbx + 0x20]
mov qword [rdi + 8], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
test rcx, rcx
je 0x140052b11
mov qword [rcx + 8], rax
jmp 0x140052b18
mov qword [rdi + 0x80], rax
test rax, rax
je 0x140052b22
mov qword [rax], rcx
jmp 0x140052b29
mov qword [rdi + 0x88], rcx
mov rcx, qword [r14]
lea rdx, [rsp + 0x50]
mov rax, qword [rbx + 0x18]
add rcx, 0x448
mov rsi, qword [rbx + 0x10]
mov qword [rsp + 0x50], rax
call fcn.14005e0e0
test rsi, rsi
je 0x140052b82
mov rax, qword [r14]
mov rdx, rsi
mov rcx, qword [rax + 0x1050]
add rcx, 0xec8
call fcn.140013200
mov rax, qword [r14]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rax + 0x1050]
mov rcx, qword [rcx + 0x18]
call qword [0x140202108]
mov rcx, qword [r14]
mov eax, 1
lock xadd dword [rcx + 0x1020], eax
movzx eax, byte [rbx + 0x19]
movzx edx, byte [rbx + 0x18]
mov r11, qword [rdi + 0x58]
xor rdx, r12
mov r9, qword [rdi + 0x48]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1a]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1b]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1c]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1d]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1e]
imul rdx, r15
xor rdx, rax
movzx eax, byte [rbx + 0x1f]
imul rdx, r15
xor rdx, rax
imul rdx, r15
and rdx, qword [rdi + 0x70]
mov r10, rdx
add r10, r10
mov rsi, qword [r11 + r10*8 + 8]
mov rcx, rsi
cmp rsi, r9
je 0x140052c7e
mov rax, qword [rbx + 0x18]
mov r8, qword [r11 + r10*8]
cmp rax, qword [rsi + 0x10]
je 0x140052c26
cmp rcx, r8
je 0x140052c7e
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x140052c17
test rcx, rcx
je 0x140052c7e
add rdx, rdx
mov rax, qword [r11 + rdx*8]
cmp rsi, rcx
jne 0x140052c52
cmp rax, rcx
jne 0x140052c47
mov qword [r11 + rdx*8], r9
mov qword [r11 + r10*8 + 8], r9
jmp 0x140052c5e
mov r9, qword [rcx + 8]
mov qword [r11 + r10*8 + 8], r9
jmp 0x140052c5e
cmp rax, rcx
jne 0x140052c5e
mov rax, qword [rcx]
mov qword [r11 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [rdi + 0x50]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x20
call fcn.140116b70
mov rdx, qword [rdi + 0x18]
mov qword [rsp + 0x60], rbx
cmp rdx, qword [rdi + 0x20]
je 0x140052c97
mov qword [rdx], rbx
add qword [rdi + 0x18], 8
jmp 0x140052ca5
lea r8, [rsp + 0x60]
lea rcx, [rdi + 0x10]
call fcn.1400022c0
mov rax, qword [rdi + 8]
cmp rax, qword [rdi]
ja 0x140052af0
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop r14
pop rdi
ret
Function at 0x140058840
Capabilities:
Create pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x150
mov ebx, dword [0x140201e0c]
mov rbp, r8
movzx edi, r9b
mov r14, rdx
mov rsi, rcx
lea eax, [rbx + 1]
mov dword [0x140201e0c], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, ebx
lea rdx, str..PipeFossilize._08lx._08x
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140031820
mov qword [rsp + 0x38], rbp
lea rcx, [rsp + 0x40]
mov r9d, 1
mov dword [rsp + 0x30], 0x2710
mov edx, edi
mov dword [rsp + 0x28], 0x1000
shl edx, 0x1e
or edx, 1
mov dword [rsp + 0x20], 0x1000
lea r8d, [r9 + 5]
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x14005891a
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
mov r9, rbp
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [r14], rax
cmp rax, 0xffffffffffffffff
jne 0x14005891e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140058920
mov al, 1
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14005c410
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
lea rdx, [0x140201b80]
lea rcx, [rsp + 0x38]
call fcn.140053060
call fcn.140062740
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Crashed_or_hung_while_replaying._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x14005de80
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
sub rsp, 0x60
mov r10, rcx
movzx r9d, dl
lea rbx, [rcx + 0x448]
movabs r11, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rax, rdx
imul r9, r11
shr rax, 8
movzx r8d, al
mov rax, rdx
xor r9, r8
shr rax, 0x10
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x18
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x20
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x28
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x30
imul r9, r11
movzx ecx, al
mov rax, rdx
xor r9, rcx
shr rax, 0x38
mov rcx, qword [r10 + 0x478]
imul r9, r11
xor r9, rax
imul r9, r11
and rcx, r9
shl rcx, 4
add rcx, qword [r10 + 0x460]
mov rax, qword [rcx + 8]
cmp rax, qword [r10 + 0x450]
je 0x14005df6f
mov rcx, qword [rcx]
cmp rdx, qword [rax + 0x10]
je 0x14005df62
cmp rax, rcx
je 0x14005df6f
mov rax, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
jne 0x14005df53
test rax, rax
je 0x14005df6f
xor al, al
add rsp, 0x60
pop rbx
ret
mov rcx, qword [r10 + 0x138]
test rcx, rcx
je 0x14005df8a
mov eax, 1
lock xadd dword [rcx + 0x60], eax
mov rdx, qword [rsp + 0x78]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdx
xor eax, eax
mov qword [rsp + 0x38], 4
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x58], rax
mov rcx, r10
mov word [rsp + 0x44], 1
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 3
call fcn.14005dfe0
lea r8, [rsp + 0x78]
mov rcx, rbx
lea rdx, [rsp + 0x20]
call fcn.140033000
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x14005e0e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rdx]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov rbx, rdx
movzx eax, byte [rdx + 1]
mov rdi, qword [r10 + 0x18]
mov r9, qword [r10 + 8]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 2]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 3]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 4]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 5]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 6]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdx + 7]
imul r8, rcx
xor r8, rax
imul r8, rcx
and r8, qword [r10 + 0x30]
mov r11, r8
shl r11, 4
add r11, rdi
mov rcx, qword [r11 + 8]
cmp rcx, r9
je 0x14005e206
mov rax, qword [rbx]
mov rdx, qword [r11]
cmp rax, qword [rcx + 0x10]
je 0x14005e19f
nop dword [rax + rax]
cmp rcx, rdx
je 0x14005e206
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x14005e190
test rcx, rcx
je 0x14005e206
add r8, r8
mov rax, qword [rdi + r8*8]
cmp qword [r11 + 8], rcx
jne 0x14005e1ca
cmp rax, rcx
jne 0x14005e1c0
mov qword [rdi + r8*8], r9
mov qword [r11 + 8], r9
jmp 0x14005e1d6
mov r9, qword [rcx + 8]
mov qword [r11 + 8], r9
jmp 0x14005e1d6
cmp rax, rcx
jne 0x14005e1d6
mov rax, qword [rcx]
mov qword [rdi + r8*8], rax
mov rdx, qword [rcx]
dec qword [r10 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, 0x18
call fcn.140116b70
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14005e220
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rcx
movzx r10d, r8b
movabs rbx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r10, rax
mov rax, r8
imul r10, rbx
shr rax, 8
movzx r9d, al
mov rax, r8
xor r10, r9
shr rax, 0x10
mov r9, qword [r11 + 0x48]
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x18
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x20
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x28
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x30
imul r10, rbx
movzx ecx, al
mov rax, r8
xor r10, rcx
shr rax, 0x38
mov rcx, qword [r11 + 0x70]
imul r10, rbx
xor r10, rax
imul r10, rbx
and rcx, r10
shl rcx, 4
add rcx, qword [r11 + 0x58]
mov rax, qword [rcx + 8]
cmp rax, r9
je 0x14005e37e
mov rcx, qword [rcx]
cmp r8, qword [rax + 0x10]
je 0x14005e2f8
cmp rax, rcx
je 0x14005e37e
mov rax, qword [rax + 8]
cmp r8, qword [rax + 0x10]
jne 0x14005e2e5
test rax, rax
cmove rax, r9
cmp rax, r9
je 0x14005e37e
mov rcx, qword [rax + 0x18]
mov r9, qword [rcx]
mov r8, qword [rcx + 8]
test r9, r9
je 0x14005e31a
mov qword [r9 + 8], r8
jmp 0x14005e321
mov qword [r11 + 0x80], r8
test r8, r8
je 0x14005e32b
mov qword [r8], r9
jmp 0x14005e332
mov qword [r11 + 0x88], r9
mov r8, qword [r11 + 0x80]
test r8, r8
je 0x14005e34a
mov qword [r8], rcx
mov r8, qword [r11 + 0x80]
jmp 0x14005e354
mov qword [r11 + 0x88], rcx
xor r8d, r8d
mov qword [rcx + 8], r8
mov qword [rcx], 0
mov qword [r11 + 0x80], rcx
mov rcx, qword [rax + 0x18]
mov byte [rdx + 8], 1
mov rax, qword [rcx + 0x10]
mov qword [rdx], rax
mov rax, rdx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov rax, rdx
mov qword [rdx], 0
mov byte [rdx + 8], 0
ret
Function at 0x14005e3a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x1050]
test rcx, rcx
je 0x14005e597
mov rdx, qword [rdi + 0x488]
test rdx, rdx
je 0x14005e597
cmp qword [rdi + 0x20], 0
je 0x14005e571
mov qword [rsp + 0x60], 0
mov rax, qword [0x1402021f0]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
jne 0x14005e571
mov rbp, qword [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test rbp, rbp
je 0x14005e495
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
ja 0x14005e5b0
cmp rbp, 0x1000
jb 0x14005e465
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x14005e5b6
call fcn.140116b34
test rax, rax
je 0x14005e5aa
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14005e470
mov rcx, rbp
call fcn.140116b34
mov rbx, rax
mov qword [rsp + 0x20], rbx
lea rsi, [rbx + rbp]
mov qword [rsp + 0x30], rsi
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.140119350
mov r14, rsi
mov qword [rsp + 0x28], rsi
jmp 0x14005e49f
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov r10, qword [0x1402021f0]
mov rax, qword [rdi + 0x1050]
mov r9, rbx
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x488]
mov rcx, qword [rax + 0x18]
call r10
test eax, eax
jne 0x14005e53d
lea rcx, [rdi + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14005e4d5
mov rcx, qword [rcx]
lea rdx, [0x14014cfb8]
call fcn.140123cbc
mov rbp, rax
test rax, rax
je 0x14005e504
sub r14, rbx
mov r9, rax
mov r8, r14
mov edx, 1
mov rcx, rbx
call fcn.140124a38
cmp rax, r14
je 0x14005e534
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
test rbp, rbp
je 0x14005e53d
mov rcx, rbp
call fcn.140123b9c
nop
test rbx, rbx
je 0x14005e571
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x14005e566
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e5aa
mov rdx, rsi
mov rcx, rbx
call fcn.140116b70
mov rcx, qword [rdi + 0x1050]
xor r8d, r8d
mov rdx, qword [rdi + 0x488]
mov rcx, qword [rcx + 0x18]
call qword [0x1402020d8]
mov qword [rdi + 0x488], 0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.14011d1bc
int3
call fcn.140002a20
int3
call fcn.140001a90
int3
Function at 0x14005e5c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rdi, rcx
mov rcx, qword [rcx + 0x1050]
test rcx, rcx
je 0x14005e7b7
mov rdx, qword [rdi + 0x490]
test rdx, rdx
je 0x14005e7b7
cmp qword [rdi + 0x40], 0
je 0x14005e791
mov qword [rsp + 0x60], 0
mov rax, qword [0x140202850]
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, qword [rcx + 0x18]
call rax
test eax, eax
jne 0x14005e791
mov rbp, qword [rsp + 0x60]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor esi, esi
mov qword [rsp + 0x30], rsi
test rbp, rbp
je 0x14005e6b5
movabs rax, 0x7fffffffffffffff
cmp rbp, rax
ja 0x14005e7d0
cmp rbp, 0x1000
jb 0x14005e685
lea rcx, [rbp + 0x27]
cmp rcx, rbp
jbe 0x14005e7d6
call fcn.140116b34
test rax, rax
je 0x14005e7ca
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14005e690
mov rcx, rbp
call fcn.140116b34
mov rbx, rax
mov qword [rsp + 0x20], rbx
lea rsi, [rbx + rbp]
mov qword [rsp + 0x30], rsi
mov r8, rbp
xor edx, edx
mov rcx, rbx
call fcn.140119350
mov r14, rsi
mov qword [rsp + 0x28], rsi
jmp 0x14005e6bf
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov r10, qword [0x140202850]
mov rax, qword [rdi + 0x1050]
mov r9, rbx
lea r8, [rsp + 0x60]
mov rdx, qword [rdi + 0x490]
mov rcx, qword [rax + 0x18]
call r10
test eax, eax
jne 0x14005e75d
lea rcx, [rdi + 0x30]
cmp qword [rcx + 0x18], 0x10
jb 0x14005e6f5
mov rcx, qword [rcx]
lea rdx, [0x14014cfb8]
call fcn.140123cbc
mov rbp, rax
test rax, rax
je 0x14005e724
sub r14, rbx
mov r9, rax
mov r8, r14
mov edx, 1
mov rcx, rbx
call fcn.140124a38
cmp rax, r14
je 0x14005e754
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_write_pipeline_cache_data_to_disk._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
test rbp, rbp
je 0x14005e75d
mov rcx, rbp
call fcn.140123b9c
nop
test rbx, rbx
je 0x14005e791
sub rsi, rbx
mov rax, rbx
cmp rsi, 0x1000
jb 0x14005e786
add rsi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005e7ca
mov rdx, rsi
mov rcx, rbx
call fcn.140116b70
mov rcx, qword [rdi + 0x1050]
xor r8d, r8d
mov rdx, qword [rdi + 0x490]
mov rcx, qword [rcx + 0x18]
call qword [0x140202848]
mov qword [rdi + 0x490], 0
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.14011d1bc
int3
call fcn.140002a20
int3
call fcn.140001a90
int3
Function at 0x14005e7e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x2f8]
mov rsi, rcx
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14005e835
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14005e82d
mov rcx, qword [rsi + 0x1050]
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call qword [0x1402020d0]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14005e810
mov rdi, qword [rsi + 0x338]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14005e869
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14005e861
mov rcx, qword [rsi + 0x1050]
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call qword [0x1402020d0]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14005e844
mov rdi, qword [rsi + 0x378]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14005e8a5
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x14005e89d
mov rcx, qword [rsi + 0x1050]
xor r8d, r8d
mov rcx, qword [rcx + 0x18]
call qword [0x1402020d0]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14005e880
mov rax, qword [rsi + 0x300]
lea rcx, [rsi + 0x2f0]
add qword [rsi + 0x3b0], rax
mov rax, qword [rsi + 0x340]
add qword [rsi + 0x3b8], rax
mov rax, qword [rsi + 0x380]
add qword [rsi + 0x3c0], rax
call fcn.14001b380
lea rcx, [rsi + 0x330]
call fcn.14001b380
lea rcx, [rsi + 0x370]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14001b380

Function at 0x140060360
Capabilities:
Write file on windows

Disassembly:
push rsi
sub rsp, 0x30
mov rsi, qword [0x140201e00]
test rsi, rsi
je 0x1400603d9
mov qword [rsp + 0x48], rbx
lea rbx, str.HEARTBEAT_n
mov qword [rsp + 0x50], rbp
xor ebp, ebp
mov qword [rsp + 0x58], rdi
mov edi, 0xa
nop
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400603ca
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
je 0x1400603ca
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x1400603ca
add rbx, rax
sub rdi, rax
jne 0x140060390
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
ret

Function at 0x1400609a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
xor eax, eax
lea r8, [rcx + 0x38]
mov qword [rcx + 0x38], rax
lea rdx, [rcx + 0x58]
mov qword [rcx + 0x40], rax
xor r9d, r9d
mov qword [rcx + 0x48], rax
mov rax, qword [rcx + 0x30]
mov qword [rcx + 0x50], rax
mov rcx, qword [rcx + 0x20]
mov qword [rsp + 0x20], r8
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400609f2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x1400609f2
xor al, al
add rsp, 0x38
ret
mov al, 1
add rsp, 0x38
ret
Function at 0x140060a00
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov r9d, 0x400
mov qword [rsp + 0x30], rcx
mov r8d, eax
mov dword [rsp + 0x28], ecx
xor edx, edx
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rbx, qword [rsp + 0x50]
mov ecx, 2
call fcn.140121190
mov r8, rbx
lea rdx, str.Fossilize_ERROR:_Error:__s_n
mov rcx, rax
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140061660
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov r8, rcx
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov rdi, rax
test rax, rax
jne 0x1400616b7
lea ecx, [rax + 2]
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_open_file_mapping_in_replayer._n
call fcn.1400020d0
lea ecx, [rdi + 2]
call fcn.140121190
mov rcx, rax
call fcn.14012154c
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rcx, rdi
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x140061719
lea ecx, [rax + 2]
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Failed_to_map_view_of_file_in_replayer._n
call fcn.1400020d0
lea ecx, [rbx + 2]
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rbx, qword [rsp + 0x40]
xor al, al
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rax], 0x19bcde1d
mov qword [0x140201d88], rbx
jne 0x140061748
cmp dword [rax + 0xca4], 0xcac
jb 0x140061748
mov eax, dword [rax + 0xca8]
test eax, eax
je 0x140061748
mov ecx, eax
dec rax
test rcx, rax
je 0x140061790
mov ecx, 2
call fcn.140121190
mov rcx, rax
lea rdx, str.Fossilize_ERROR:_Control_block_is_corrupt._n
call fcn.1400020d0
mov ecx, 2
call fcn.140121190
mov rcx, rax
call fcn.14012154c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140201d88], 0
mov r8, rsi
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
mov rbx, qword [rsp + 0x40]
test rax, rax
mov rsi, qword [rsp + 0x48]
mov qword [0x140201da0], rax
setne al
add rsp, 0x30
pop rdi
ret