joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140154c00
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140154c45
mov edx, dword [rcx + 4]
test edx, edx
je 0x140154c45
mov rcx, qword [rcx + 8]
mov eax, dword [rcx + 4]
cmp dword [rcx], eax
jge 0x140154c7e
cmp edx, 1
je 0x140154c45
sub edx, 2
lea rax, [rcx + 4]
lea rcx, [rcx + rdx*8 + 0xc]
nop dword [rax]
mov edx, dword [rax + 4]
cmp dword [rax], edx
jge 0x140154c4a
cmp edx, dword [rax + 8]
jge 0x140154c64
add rax, 8
cmp rax, rcx
jne 0x140154c30
add rsp, 0x28
ret
mov r8d, 0x68
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_i_1_.end___rs__ranges_i_.start
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x69
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_i_.start___rs__ranges_i_.end
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x65
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_0_.start___rs__ranges_0_.end
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]
sub rsp, 0x28
test rcx, rcx
je 0x140154cfe
cmp dword [rcx + 8], edx
jl 0x140154cfe
mov rax, qword [rcx]
test rax, rax
je 0x140154ce4
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140154ce4
test edx, edx
jne 0x140154cd0
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x10]
movsxd rdx, edx
mov edx, dword [rcx + rdx*4]
lea rax, [rax + rdx + 1]
add rsp, 0x28
ret
mov r8d, 0x22a
lea rdx, str.line_log.c
lea rcx, str.d__spec__d__spec__data
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x229
lea rdx, str.line_log.c
lea rcx, str.d__line___d__lines
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]

Function at 0x140154ca0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x140154c45
mov edx, dword [rcx + 4]
test edx, edx
je 0x140154c45
mov rcx, qword [rcx + 8]
mov eax, dword [rcx + 4]
cmp dword [rcx], eax
jge 0x140154c7e
cmp edx, 1
je 0x140154c45
sub edx, 2
lea rax, [rcx + 4]
lea rcx, [rcx + rdx*8 + 0xc]
nop dword [rax]
mov edx, dword [rax + 4]
cmp dword [rax], edx
jge 0x140154c4a
cmp edx, dword [rax + 8]
jge 0x140154c64
add rax, 8
cmp rax, rcx
jne 0x140154c30
add rsp, 0x28
ret
mov r8d, 0x68
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_i_1_.end___rs__ranges_i_.start
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x69
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_i_.start___rs__ranges_i_.end
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x65
lea rdx, str.line_log.c
lea rcx, str.rs__ranges_0_.start___rs__ranges_0_.end
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]
sub rsp, 0x28
test rcx, rcx
je 0x140154cfe
cmp dword [rcx + 8], edx
jl 0x140154cfe
mov rax, qword [rcx]
test rax, rax
je 0x140154ce4
mov rax, qword [rax + 0x30]
test rax, rax
je 0x140154ce4
test edx, edx
jne 0x140154cd0
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x10]
movsxd rdx, edx
mov edx, dword [rcx + rdx*4]
lea rax, [rax + rdx + 1]
add rsp, 0x28
ret
mov r8d, 0x22a
lea rdx, str.line_log.c
lea rcx, str.d__spec__d__spec__data
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x229
lea rdx, str.line_log.c
lea rcx, str.d__line___d__lines
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]
Function at 0x140154d20
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, r8
xor r8d, r8d
mov qword [rsp + 0x88], r9
mov r13, rdx
call fcn.14012c3d0
mov ebx, eax
test eax, eax
jne 0x140154e17
mov ecx, 0xc8
call fcn.1400bd0a0
mov r14, qword [r13 + 0x30]
mov dword [rax], 0
mov rcx, rax
mov eax, dword [r13 + 0x40]
test eax, eax
je 0x140154e10
xor ebx, ebx
mov esi, 1
mov edi, 0x32
jmp 0x140154d97
lea edx, [rax - 1]
cmp edx, ebx
je 0x140154da1
add rbx, 1
cmp ebx, eax
jae 0x140154ddc
cmp byte [r14 + rbx], 0xa
mov r15d, ebx
jne 0x140154d88
lea ebp, [rsi + 1]
cmp edi, esi
jg 0x140154dc9
lea eax, [rdi + rdi*2 + 0x30]
mov edi, eax
shr edi, 0x1f
add edi, eax
sar edi, 1
cmp edi, esi
cmovle edi, ebp
movsxd rdx, edi
shl rdx, 2
call fcn.1400bd2c0
mov rcx, rax
mov dword [rcx + rsi*4], r15d
mov eax, dword [r13 + 0x40]
add rbx, 1
movsxd rsi, ebp
cmp ebx, eax
jb 0x140154d97
movsxd rdx, esi
lea ebx, [rsi - 1]
shl rdx, 2
call fcn.1400bd2c0
mov rcx, qword [rsp + 0x88]
mov dword [r12], ebx
mov qword [rcx], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, 4
jmp 0x140154de6
mov rcx, r13
call fcn.140029ec0
lea rcx, str.Cannot_read_blob__s
mov rdx, rax
call fcn.1400b6950
nop
nop

Function at 0x140154e30
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, qword [0x14022c040]
mov rax, qword [rbp]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x14022c410]
mov rdi, rcx
mov rbx, rdx
mov qword [rsp + 0x38], 0
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], rax
test rdx, rdx
je 0x140154e94
nop dword [rax + rax]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.1400944f0
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140154e80
mov rcx, rsi
call fcn.140094920
xor edx, edx
mov rcx, rdi
mov r8d, 2
mov qword [rsp + 0x20], rax
mov rbx, rax
lea r9, [0x1402164b3]
call fcn.140045be0
mov rcx, rbx
call fcn.1400eaf30
mov rax, qword [rsp + 0x48]
sub rax, qword [rbp]
jne 0x140154ed7
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1401d96b0
nop
nop dword [rax]
Function at 0x140154ee0
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov eax, edx
test r8d, r8d
je 0x140154fc0
movsxd r10, r8d
lea rdx, [r10*4]
mov r10d, dword [r9 + r10*4]
add rdx, 4
lea rbp, [rbx + r10 + 1]
cmp r8d, 0xffffffff
jne 0x140154fc8
movsx esi, al
mov rdx, rdi
cmp rbp, rbx
jb 0x140154fe0
call fcn.1401deb18
mov rdx, rdi
mov rcx, r13
sub rbx, rbp
call fcn.1401deb18
mov rdx, rdi
mov ecx, esi
call sub.msvcrt.dll_putc
mov r9, rdi
mov r8, rbx
mov rcx, rbp
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rdi
mov rcx, r12
call fcn.1401deb18
mov rdx, rdi
mov ecx, 0xa
call sub.msvcrt.dll_putc
mov r9, rdi
mov r8d, 0x1c
mov edx, 1
lea rcx, str._No_newline_at_end_of_file_n
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_fwrite
mov rbp, rbx
mov edx, 4
mov edx, dword [r9 + rdx]
movsx esi, al
lea rbx, [rbx + rdx + 1]
mov rdx, rdi
cmp rbp, rbx
jae 0x140154f48
cmp byte [rbx - 1], 0xa
jne 0x140154f48
call fcn.1401deb18
mov rdx, rdi
mov rcx, r13
call fcn.1401deb18
mov rdx, rdi
mov ecx, esi
call sub.msvcrt.dll_putc
lea r8, [rbx - 1]
mov r9, rdi
mov rcx, rbp
sub r8, rbp
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rdx, rdi
mov rcx, r12
call fcn.1401deb18
mov rdx, rdi
mov ecx, 0xa
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sub.msvcrt.dll_putc
Function at 0x14015c460
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
and byte [rcx + 0x124], 0xfd
lea rsi, [rcx + 0x5b8]
mov rbx, rcx
mov rcx, rsi
call fcn.140131380
mov rcx, rsi
call fcn.140130800
test eax, eax
jne 0x14015c4b8
cmp qword [rbx + 0x148], 0
je 0x14015c49f
test byte [rbx + 0x11e], 1
je 0x14015c4e0
mov rcx, rsi
call fcn.1401349a0
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov edi, dword [rbx + 0x6d4]
mov rcx, rsi
mov dword [rbx + 0x6d4], 0x800
call fcn.1401349a0
xor eax, eax
mov dword [rbx + 0x6d4], edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rcx, rbx
call fcn.14015ba60
test dword [rbx + 0x6d4], 0xfffff7ff
je 0x14015c49f
test byte [rbx + 0x11e], 2
je 0x14015c49f
mov ecx, dword [rbx + 0x144]
cmp ecx, 5
je 0x14015c49f
call fcn.140047950
test eax, eax
jne 0x14015c49f
mov rax, qword [rbx + 0x7d0]
test rax, rax
je 0x14015c543
mov rdx, qword [rbx + 0x7d8]
mov rcx, rsi
call rax
mov r9, qword [rbx + 0x778]
mov r8d, 1
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
call sub.msvcrt.dll_fwrite
test byte [rbx + 0x124], 2
jne 0x14015c558
mov eax, dword [rbx + 0x6d4]
not eax
test al, 0x12
je 0x14015c56e
mov rdx, qword [rbx + 0x778]
mov ecx, 0xa
call sub.msvcrt.dll_putc
jmp 0x14015c49f
mov rcx, qword [rbx + 0x778]
lea rdx, [0x1402170d4]
call sub.libintl_8.dll_libintl_fprintf
jmp 0x14015c558
Function at 0x140169e20
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
lea r12, str.merge_ort.c
mov rax, qword [rcx]
mov r13, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rsi, rdx
mov rcx, r12
mov edx, 0x1480
mov rdi, r8
mov rbp, r9
lea r8, [0x1402174e0]
lea r9, str.incore_nonrecursive
call fcn.1400a1480
mov rax, qword [rbx]
mov edx, 0x1482
mov rcx, r12
lea r9, str.merge_start
lea r8, [0x1402174e0]
mov qword [rsp + 0x20], rax
call fcn.1400a1480
cmp qword [rbx + 8], 0
je 0x14016a0b0
mov rax, qword [r13 + 0x18]
test rax, rax
je 0x140169f19
cmp qword [rax + 0x608], 0
mov rcx, qword [rax + 0x610]
je 0x140169fb0
test rcx, rcx
je 0x14016a09a
mov r14, qword [rax + 0x618]
test r14, r14
je 0x14016a09a
mov rdx, qword [rsi + 4]
mov r8, qword [rsi + 0xc]
lea r9, [rsi + 4]
xor rdx, qword [r14 + 4]
xor r8, qword [r14 + 0xc]
or rdx, r8
mov r11, qword [r13 + 8]
je 0x140169fe0
mov rdx, qword [rsi + 4]
mov r8, qword [rsi + 0xc]
lea r10, [rcx + 4]
xor rdx, qword [rcx + 4]
xor r8, qword [rcx + 0xc]
or rdx, r8
je 0x14016a040
mov dword [rax + 0x620], 0
mov rdx, r13
mov rcx, rbx
call fcn.14015fdd0
mov rax, qword [rbx + 0x78]
mov rcx, r12
lea r9, str.merge_start
lea r8, [0x1402174e0]
mov edx, 0x148e
mov qword [rax + 0x608], rsi
mov qword [rax + 0x610], rdi
mov qword [rax + 0x618], rbp
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
call fcn.1400a1690
mov qword [rsp + 0x20], r13
mov r9, rbp
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1401652c0
mov rax, qword [rbx]
mov edx, 0x1491
mov rcx, r12
lea r9, str.incore_nonrecursive
lea r8, [0x1402174e0]
mov qword [rsp + 0x90], rax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1400a1690
test rcx, rcx
jne 0x140169fc3
cmp qword [rax + 0x618], 0
je 0x140169f0f
mov r8d, 0x13b1
mov rdx, r12
lea rcx, str._merge_trees_0____merge_trees_1____merge_trees_2_
call qword [sym.imp.msvcrt.dll__assert]
nop dword [rax]
mov rdx, qword [r9 + 0x10]
mov r8, qword [r9 + 0x18]
xor rdx, qword [r14 + 0x14]
xor r8, qword [r14 + 0x1c]
or rdx, r8
jne 0x140169ef2
mov rdx, qword [rdi + 4]
mov r14, qword [rdi + 0xc]
xor rdx, qword [r11 + 4]
xor r14, qword [r11 + 0xc]
or rdx, r14
jne 0x140169ef2
mov rdx, qword [rdi + 0x14]
mov r8, qword [rdi + 0x1c]
xor rdx, qword [r11 + 0x14]
xor r8, qword [r11 + 0x1c]
or rdx, r8
jne 0x140169ef2
mov dword [rax + 0x620], 1
jmp 0x140169f19
mov rdx, qword [r9 + 0x10]
mov rcx, qword [r9 + 0x18]
xor rdx, qword [r10 + 0x10]
xor rcx, qword [r10 + 0x18]
or rdx, rcx
jne 0x140169f0f
mov rdx, qword [rbp + 4]
mov rcx, qword [rbp + 0xc]
xor rdx, qword [r11 + 4]
xor rcx, qword [r11 + 0xc]
or rdx, rcx
jne 0x140169f0f
mov rdx, qword [rbp + 0x14]
mov rcx, qword [rbp + 0x1c]
xor rdx, qword [r11 + 0x14]
xor rcx, qword [r11 + 0x1c]
or rdx, rcx
jne 0x140169f0f
mov dword [rax + 0x620], 2
jmp 0x140169f19
mov r8d, 0x13bb
mov rdx, r12
lea rcx, str.merge_trees_0___merge_trees_1___merge_trees_2_
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0x1483
mov rdx, r12
lea rcx, [0x1402192ac]
call qword [sym.imp.msvcrt.dll__assert]
nop
nop word [rax + rax]
Function at 0x14016a0d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rsi, str.merge_ort.c
mov rax, qword [rcx]
mov rbp, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov r12, rdx
mov r13, r8
mov rdi, r9
mov edx, 0x149a
lea r9, str.incore_recursive
mov rcx, rsi
lea r8, [0x1402174e0]
call fcn.1400a1480
cmp qword [rbx + 8], 0
jne 0x14016a1be
mov rax, qword [rbx]
lea r9, str.merge_start
mov rcx, rsi
mov edx, 0x149f
lea r8, [0x1402174e0]
mov qword [rsp + 0x20], rax
call fcn.1400a1480
mov rdx, rbp
mov rcx, rbx
call fcn.14015fdd0
mov rax, qword [rbx]
mov rcx, rsi
mov edx, 0x14a1
lea r9, str.merge_start
lea r8, [0x1402174e0]
mov qword [rsp + 0x20], rax
call fcn.1400a1690
mov qword [rsp + 0x20], rbp
mov r9, rdi
mov r8, r13
mov rdx, r12
mov rcx, rbx
call fcn.140168df0
mov rax, qword [rbx]
mov edx, 0x14a4
mov rcx, rsi
lea r9, str.incore_recursive
lea r8, [0x1402174e0]
mov qword [rsp + 0x90], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400a1690
mov r8d, 0x149d
mov rdx, rsi
lea rcx, str.opt__ancestor__NULL
call qword [sym.imp.msvcrt.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop
add r8, 0x10
mov rcx, rdx
test r9, r9
mov rdx, r9
cmove rdx, r8
add rcx, 0x10
jmp fcn.1400db320
Function at 0x14016be10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, qword [0x14022c040]
mov rax, qword [rcx + 0x78]
mov rbp, qword [r12]
mov qword [rsp + 0x28], rbp
lea rbp, [rcx + 0x48]
mov rsi, r8
mov r8d, dword [rax]
mov rbx, rcx
mov rdi, rdx
mov edx, 0x20
add r8d, r8d
movsxd r8, r8d
mov rcx, rbp
call fcn.14008f9d0
mov rcx, rsi
call fcn.140118930
test rax, rax
je 0x14016bed8
lea r8, [rax + 8]
lea rdx, str.virtual__s_n
mov rcx, rbp
call fcn.14008fc00
cmp dword [rbx + 0x44], 1
jbe 0x14016be98
mov rax, qword [rsp + 0x28]
sub rax, qword [r12]
jne 0x14016bffe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
cmp qword [rbx + 0x50], 0
je 0x14016be79
mov ecx, 1
call qword [fcn.1401de8b0]
mov rcx, qword [rbx + 0x58]
mov rdx, rax
call fcn.1401deb18
mov rax, qword [rbx + 0x58]
cmp rax, qword [0x14022c910]
mov qword [rbx + 0x50], 0
je 0x14016bff0
mov byte [rax], 0
jmp 0x14016be79
mov rax, qword [0x14022c3a0]
mov rdx, rdi
lea r8, [rsi + 4]
mov rcx, rbp
mov r9d, dword [rax]
call fcn.140036cb0
mov rdx, qword [rbx + 0x48]
test rdx, rdx
jne 0x14016bfb8
mov edx, 1
mov rcx, rbp
call fcn.14008e7e0
mov rax, qword [rbx + 0x50]
mov rdx, qword [rbx + 0x58]
lea rcx, [rax + 1]
xor r8d, r8d
mov qword [rbx + 0x50], rcx
mov rcx, rdi
mov byte [rdx + rax], 0x20
mov rdx, qword [rbx + 0x58]
mov rax, qword [rbx + 0x50]
mov byte [rdx + rax], 0
mov rdx, rsi
call fcn.140116aa0
test eax, eax
je 0x14016bf80
mov rax, qword [str.PF__]
mov r8d, 0xd
lea rsi, str._bad_commit__n
mov eax, dword [rax]
test eax, eax
je 0x14016bf6d
mov rcx, rsi
call fcn.1401d81b8
mov rcx, rax
mov rsi, rax
call sub.msvcrt.dll_strlen
mov r8, rax
mov rdx, rsi
mov rcx, rbp
call fcn.14008f5f0
jmp 0x14016be73
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.140115d60
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r13, rax
call fcn.140116b10
test eax, eax
jne 0x14016bfd0
mov r8, r13
mov rdx, rsi
mov rcx, rdi
call fcn.140115e60
jmp 0x14016be73
mov rax, qword [rbx + 0x50]
sub rdx, rax
cmp rdx, 1
jne 0x14016bf0f
jmp 0x14016befe
mov r9, qword [rsp + 0x20]
mov r8d, eax
lea rdx, [0x1402199a6]
mov rcx, rbp
call fcn.14008fc00
jmp 0x14016bfa2
cmp byte [rax], 0
je 0x14016be79
call fcn.14016a640
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop
Function at 0x140176600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x140
mov rbx, qword [0x14022c040]
mov qword [rsp + 0x28], rdx
mov rsi, r9
mov rdi, rcx
mov rdx, qword [rbx]
mov qword [rsp + 0x138], rdx
lea rdx, [rsp + 0x28]
mov byte [rsp + 0x180], r8b
mov rbp, rsi
lea r8, [rsp + 0x180]
call fcn.140176490
mov r12, rax
and ebp, 3
jne 0x14017685a
mov rcx, qword [rax]
mov rax, rcx
and eax, 3
cmp rax, 2
je 0x140176688
mov rax, qword [rsp + 0x138]
sub rax, qword [rbx]
jne 0x140176874
add rsp, 0x140
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
and rcx, 0xfffffffffffffffc
mov rax, qword [rcx]
mov rdx, qword [rcx + 8]
xor rax, qword [rsi]
xor rdx, qword [rsi + 8]
or rax, rdx
jne 0x140176662
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x18]
xor rax, qword [rsi + 0x10]
xor rdx, qword [rsi + 0x18]
or rax, rdx
jne 0x140176662
movdqu xmm0, xmmword [rcx + 0x24]
movups xmmword [rsi + 0x24], xmm0
movdqu xmm1, xmmword [rcx + 0x34]
movups xmmword [rsi + 0x34], xmm1
mov eax, dword [rcx + 0x44]
mov dword [rsi + 0x44], eax
call fcn.1400eaf30
mov qword [r12], 0
movzx r10d, byte [rsp + 0x180]
test r10b, r10b
je 0x140176662
mov rdx, qword [rdi]
movzx r11d, r10b
mov r8d, 0xfffffffc
lea r9, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop word cs:[rax + rax]
nop dword [rax]
mov eax, ebp
mov ecx, r8d
sub r8d, 4
shr al, 1
and ecx, 4
and eax, 0x7f
movzx eax, byte [rsi + rax]
sar eax, cl
and eax, 0xf
mov rdx, qword [rdx + rax*8]
and rdx, 0xfffffffffffffffc
mov qword [r9 + rbp*8 + 8], rdx
add rbp, 1
cmp rbp, r11
jne 0x140176740
cmp rdx, qword [rsp + 0x28]
jne 0x140176840
movzx edi, r10b
lea rbp, [r9 + rbp*8]
nop word cs:[rax + rax]
nop
mov ecx, edi
sub edi, 1
mov r9, qword [rbp]
mov r11, qword [rbp - 8]
mov eax, edi
shl ecx, 2
sar eax, 1
and ecx, 4
cdqe
movzx r10d, byte [rsi + rax]
sar r10d, cl
and r10d, 0xf
test r9, r9
je 0x140176893
test r11, r11
je 0x140176893
mov rax, qword [r11 + r10*8]
and rax, 0xfffffffffffffffc
cmp r9, rax
jne 0x140176879
mov rax, r9
lea r8, [r9 + 0x80]
xor ecx, ecx
nop word cs:[rax + rax]
nop
mov rdx, qword [rax]
test dl, 3
je 0x140176804
test rcx, rcx
jne 0x140176662
mov rcx, rdx
add rax, 8
cmp rax, r8
jne 0x1401767f0
test rcx, rcx
je 0x140176822
mov rax, rcx
and eax, 3
cmp rax, 2
jne 0x140176662
mov qword [r11 + r10*8], rcx
mov rcx, r9
sub rbp, 8
call fcn.1400eaf30
test dil, dil
jne 0x140176790
jmp 0x140176662
mov r8d, 0xe6
lea rdx, str.notes.c
lea rcx, str.i__n__parent_stack_i___tree
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0xd1
lea rdx, str.notes.c
lea rcx, str.GET_PTR_TYPE_entry___0
call qword [sym.imp.msvcrt.dll__assert]
call fcn.1401d96b0
mov r8d, 0xae
lea rdx, str.notes.c
lea rcx, str.CLR_PTR_TYPE_parent__a_index____tree
call qword [sym.imp.msvcrt.dll__assert]
mov r8d, 0xad
lea rdx, str.notes.c
lea rcx, str.tree__parent
call qword [sym.imp.msvcrt.dll__assert]
nop
nop
Function at 0x140180c30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov qword [rsp + 0x60], r8
lea r8, [0x14021d516]
mov qword [rsp + 0x68], r9
mov r9, rdx
xor edx, edx
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
call fcn.140180780
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140180c7e
add rsp, 0x40
pop rbx
ret
call fcn.1401d96b0
nop
nop word cs:[rax + rax]
nop

Function at 0x140180c90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov qword [rsp + 0x60], r8
lea r8, [0x14021d516]
mov qword [rsp + 0x68], r9
mov r9, rdx
mov edx, 1
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
call fcn.140180780
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
jne 0x140180ce1
add rsp, 0x40
pop rbx
ret
call fcn.1401d96b0
nop
nop word [rax + rax]
Function at 0x140180cf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x14022c910]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.140180850
test eax, eax
jne 0x140180d42
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140180d53
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14021d517]
call fcn.1400b6950
call fcn.1401d96b0
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x140180e26
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.140180200
lea rax, [rdi + 4]
lea rdx, str.0123456789abcdef
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400be850
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180e3a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.140180160
mov rcx, rax
call fcn.1400b6950
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov qword [0x1401e81a8], 0
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401e81b0]
cmp rax, qword [0x14022c910]
je 0x140180ed0
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x14021d516]
lea rcx, [0x1401e81a0]
mov qword [rsp + 0x20], r9
call fcn.140180690
mov r8, qword [0x1401e81a8]
mov rdx, qword [0x1401e81b0]
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180eda
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x140180e82
call fcn.140180180
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.140180200
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400be850
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400be880
Function at 0x140180d60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x14022c040]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x14022c910]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.140180850
test eax, eax
jne 0x140180d42
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x140180d53
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x14021d517]
call fcn.1400b6950
call fcn.1401d96b0
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x140180e26
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.140180200
lea rax, [rdi + 4]
lea rdx, str.0123456789abcdef
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400be850
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180e3a
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.140180160
mov rcx, rax
call fcn.1400b6950
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x14022c040]
mov qword [0x1401e81a8], 0
mov qword [rsp + 0x60], r8
mov rbx, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401e81b0]
cmp rax, qword [0x14022c910]
je 0x140180ed0
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x14021d516]
lea rcx, [0x1401e81a0]
mov qword [rsp + 0x20], r9
call fcn.140180690
mov r8, qword [0x1401e81a8]
mov rdx, qword [0x1401e81b0]
mov rcx, rbx
call fcn.1400be850
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x140180eda
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x140180e82
call fcn.140180180
call fcn.1401d96b0
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.140180200
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400be850
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400be880