joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459a0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x00645fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x464f20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00645d6a], 0
je 0x464f2e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x464f40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00645d6a], 0
je 0x464f55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x464f60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00645d6a], 0
je 0x464f95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00646320]
aesenc xmm0, xmmword [0x00646330]
aesenc xmm0, xmmword [0x00646340]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x464fa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x00645d6a], 0
je 0x464fd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00646320]
aesenc xmm0, xmmword [0x00646330]
aesenc xmm0, xmmword [0x00646340]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x4668c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x466cc0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x466cf4
mov rcx, 0x28
jmp 0x466cff
shl rcx, 3
add rcx, 0x1480
mov qword [0x00645fa0], rcx
pop rbp
ret
Function at 0x47f780
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f9bb
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x47f81a
mov qword [rsp + 0x88], rax
lea rbx, [0x0050b7c0]
mov rcx, rax
lea rax, [0x005f2e60]
call sym.sync._Map_.Load
test cl, cl
jne 0x47f803
mov rax, qword [rsp + 0x88]
call sym.reflect._rtype_.String
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x0053c700]
call sym.runtime.concatstring2
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call sym.reflect.typesByString
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x47f837
lea rdx, [0x00508ee0]
cmp rax, rdx
jne 0x47f825
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call sym.reflect.resolveTypeOff
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004f27e0]
call sym.runtime.panicdottypeE
inc rdx
cmp rbx, rdx
jle 0x47f881
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x47f834
lea rax, [0x005f2e60]
lea rbx, [0x0050b7c0]
lea rdi, [0x00508ee0]
nop dword [rax + rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x00508ee0]
cmp rax, rdx
jne 0x47f9ab
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004eb540]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004f78c0]
call sym.runtime.newobject
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00645ff0], 0
nop
je 0x47f8db
mov rbx, rax
lea rax, [0x004f78c0]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call sym.internal_abi.NewName
call sym.reflect.addReflectOff
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47f942
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x47f934
mov dword [rsi + 0x10], edx
cmp dword [0x00645ff0], 0
je 0x47f963
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x005f2e60]
lea rbx, [0x0050b7c0]
lea rdi, [0x00508ee0]
nop dword [rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x00508ee0]
cmp rax, rdx
jne 0x47f99c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004f27e0]
call sym.runtime.panicdottypeE
mov rbx, rdx
lea rcx, [0x004f27e0]
call sym.runtime.panicdottypeE
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._rtype_.ptrTo
Function at 0x48e5a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48e66a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x00645fa0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48e64f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004eec00]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48e63e
mov edi, 1
lea rsi, [0x004eec00]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0053dff8]
lea rsi, [0x0053d4e8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4d8f80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4d8f97
inc rax
cmp rax, 4
jge 0x4d8faf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4d8f94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4d8fc0
inc rax
cmp rax, 4
jge 0x4d8fce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4d8ff7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4d8fdb
jmp 0x4d8fbd
Function at 0x1400087bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140008808
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140008800
cmp dword [rcx + 0x3c], edx
jl 0x140008800
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140008800
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140008808
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140e3f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140e3f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140e3f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e3f06f
add dl, dl
jne 0x140e3f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e3f0f6
xor eax, eax
add dl, dl
jne 0x140e3f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140e3f1ad
add dl, dl
jne 0x140e3f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e3f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e3f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e3f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140e3f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140e3f07e
mov eax, 1
add dl, dl
jne 0x140e3f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140e3f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e3f0fb
sub eax, ebx
mov ebx, 1
jne 0x140e3f14c
mov ecx, 1
add dl, dl
jne 0x140e3f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e3f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e3f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e3f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140e3f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140e3f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140e3f15d
cmp eax, 0x7d00
jae 0x140e3f19b
cmp eax, 0x500
jb 0x140e3f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e3f07e
cmp eax, 0x7f
ja 0x140e3f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140e3f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140e3f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140e3f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001f90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x468
xor esi, esi
mov r13, rcx
lea rcx, str.AVCONV_DATADIR
mov rdi, rdx
mov r12, r8
lea rbp, [rsp + 0x50]
call sub.msvcrt.dll_getenv
lea rcx, [0x1403b93b2]
mov rbx, rax
mov qword [rsp + 0x50], rax
mov r15, rbx
call sub.msvcrt.dll_getenv
mov rcx, qword [0x140444fa0]
mov qword [rsp + 0x58], rax
lea rax, [0x1403b93b7]
mov qword [rsp + 0x60], rax
mov eax, 0xffffffff
mov qword [rsp + 0x48], rcx
mov r14, rcx
test r15, r15
je 0x1400020d7
test rdi, rdi
je 0x140002080
cmp esi, 1
je 0x140002100
lea rbx, [rsp + 0x70]
lea rax, [0x1403b9399]
lea r8, str._s_s__s__s.avpreset
mov r9, r15
mov edx, 0x3e8
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140001f70
mov qword [rsp + 0x20], 0
mov r9, r14
mov r8d, 1
mov rdx, rbx
mov rcx, r12
call fcn.140042130
test eax, eax
js 0x14000208e
add rsp, 0x468
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp esi, 1
lea rbx, [rsp + 0x70]
je 0x140002159
lea rax, [0x1403b9399]
lea r8, str._s_s__s.avpreset
mov r9, r15
mov edx, 0x3e8
mov rcx, rbx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call fcn.140001f70
mov r9, qword [0x140444fa0]
mov qword [rsp + 0x20], 0
mov r8d, 1
mov rdx, rbx
mov rcx, r12
call fcn.140042130
add esi, 1
add rbp, 8
cmp esi, 2
ja 0x140002065
mov edx, eax
shr edx, 0x1f
test dl, dl
je 0x140002065
mov r15, qword [rbp]
jmp 0x140001ffb
lea rbx, [rsp + 0x70]
lea rax, str._.avconv
lea r8, str._s_s__s__s.avpreset
mov r9, r15
mov edx, 0x3e8
mov qword [rsp + 0x30], r13
mov rcx, rbx
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140001f70
mov r9, qword [rsp + 0x48]
mov qword [rsp + 0x20], 0
mov r8d, 1
mov rdx, rbx
mov rcx, r12
call fcn.140042130
test eax, eax
jns 0x140002065
lea rax, str._.avconv
jmp 0x140002095
Function at 0x140010080
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov dword [0x14046d0a8], 0
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rdx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rdx, [0x14046d0a8]
mov rcx, rax
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
mov eax, dword [0x14046d0a8]
test eax, eax
jle 0x14001020b
test r13, r13
je 0x14001020b
mov rdi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbp, r13
xor esi, esi
xor ebx, ebx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, qword [rbp]
mov ecx, 0xfde9
add ebx, 1
call rdi
add esi, eax
mov eax, dword [0x14046d0a8]
add rbp, 8
cmp ebx, eax
jl 0x1400100e2
add eax, 1
movsxd rdx, esi
cdqe
lea rcx, [rdx + rax*8]
call fcn.14036dc50
mov rbp, rax
mov qword [0x14046d0b0], rax
mov eax, dword [0x14046d0a8]
lea r12d, [rax + 1]
movsxd r12, r12d
shl r12, 3
test rbp, rbp
je 0x140010221
test eax, eax
jle 0x14001021c
mov rdx, rbp
xor r15d, r15d
xor ebx, ebx
xor r14d, r14d
jmp 0x14001017c
mov rdx, qword [0x14046d0b0]
movsxd rax, ebx
mov r9d, 0xffffffff
mov ecx, 0xfde9
add rax, r12
add r14d, 1
add rax, rbp
mov qword [rdx + r15], rax
mov edx, esi
mov r8, qword [r13 + r15]
sub edx, ebx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
xor edx, edx
add r15, 8
call rdi
add ebx, eax
cmp r14d, dword [0x14046d0a8]
jl 0x140010175
mov rbp, qword [0x14046d0b0]
movsxd r11, r14d
shl r11, 3
mov qword [rbp + r11], 0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x14046d0a8]
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov dword [rdi], eax
mov rax, qword [0x14046d0b0]
mov qword [rsi], rax
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r11d, r11d
jmp 0x1400101dd
mov rcx, r13
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_LocalFree]
Function at 0x140013c10
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea r9, str.loglevel
mov r13, r8
mov r14d, ecx
mov rdi, rdx
call fcn.140012740
cmp qword [r13], 0
je 0x140013c5e
mov rdx, r13
nop
mov ecx, dword [rdx + 8]
test ch, 0x20
je 0x140013c54
and ecx, 0xc0000
je 0x140013e6a
add rdx, 0x28
cmp qword [rdx], 0
jne 0x140013c40
test eax, eax
je 0x140013e48
cdqe
mov r8, qword [rdi + rax*8 + 8]
test r8, r8
je 0x140013c80
lea rdx, str.loglevel
xor ecx, ecx
call fcn.140013910
lea r9, str.report
mov r8, r13
mov rdx, rdi
mov ecx, r14d
call fcn.140012740
lea rcx, str.FFREPORT
mov ebx, eax
call sub.msvcrt.dll_getenv
test rax, rax
jne 0x140013ce0
test ebx, ebx
jne 0x140013ce0
lea r9, str.hide_banner
mov r8, r13
mov rdx, rdi
mov ecx, r14d
call fcn.140012740
test eax, eax
je 0x140013ccf
mov dword [0x14046d0a0], 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
call fcn.140010430
mov rcx, qword [0x14046d0c0]
test rcx, rcx
je 0x140013cac
lea rdx, str.Command_line:_n
call fcn.14000fd00
test r14d, r14d
jle 0x140013d90
lea ebp, [r14 - 1]
xor esi, esi
movabs rbx, 0x10ffffffe0ffff
mov r12, rbp
add rbp, 1
mov r15, qword [rdi + rsi*8]
movzx eax, byte [r15]
test al, al
je 0x140013d5c
mov rdx, r15
jmp 0x140013d43
sub eax, 0x61
cmp al, 0x19
ja 0x140013da1
add rdx, 1
movzx eax, byte [rdx]
test al, al
je 0x140013d5c
lea ecx, [rax - 0x2b]
cmp cl, 0x34
ja 0x140013d31
bt rbx, rcx
jae 0x140013d31
add rdx, 1
movzx eax, byte [rdx]
test al, al
jne 0x140013d43
mov rdx, qword [0x14046d0c0]
mov rcx, r15
call sub.msvcrt.dll_fputs
mov rdx, qword [0x14046d0c0]
cmp r12d, esi
mov eax, 0x20
mov ecx, 0xa
cmovg ecx, eax
add rsi, 1
call sub.msvcrt.dll_fputc
cmp rbp, rsi
jne 0x140013d20
mov rcx, qword [0x14046d0c0]
call sub.msvcrt.dll_fflush
jmp 0x140013cac
mov rdx, qword [0x14046d0c0]
mov ecx, 0x22
call sub.msvcrt.dll_fputc
movzx r8d, byte [r15]
test r8b, r8b
jne 0x140013de0
jmp 0x140013e15
mov rcx, qword [0x14046d0c0]
lea rdx, [0x1403c0d3d]
call fcn.14000fd00
add r15, 1
movzx r8d, byte [r15]
test r8b, r8b
je 0x140013e15
lea eax, [r8 - 0x22]
test al, 0xfd
je 0x140013e30
lea eax, [r8 - 0x5c]
test al, 0xfb
je 0x140013e30
lea eax, [r8 - 0x20]
cmp al, 0x5e
ja 0x140013dc0
mov rdx, qword [0x14046d0c0]
movzx ecx, r8b
add r15, 1
call sub.msvcrt.dll_fputc
movzx r8d, byte [r15]
test r8b, r8b
jne 0x140013de0
mov rdx, qword [0x14046d0c0]
mov ecx, 0x22
call sub.msvcrt.dll_fputc
jmp 0x140013d6b
mov rcx, qword [0x14046d0c0]
lea rdx, [0x1403c0d39]
call fcn.14000fd00
jmp 0x140013dd3
lea r9, [0x1403c0d18]
mov r8, r13
mov rdx, rdi
mov ecx, r14d
call fcn.140012740
test eax, eax
je 0x140013c80
jmp 0x140013c66
lea rax, str.fftools_cmdutils.c
lea r9, str.po__flags___0x40000__0x80000_
lea r8, [0x1403bfe28]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x1f5
mov qword [rsp + 0x20], rax
call fcn.14036cf30
call sub.msvcrt.dll_abort
nop
nop dword [rax + rax]
xor ecx, ecx
jmp fcn.140010430
Function at 0x140016d70
Capabilities:
Create thread

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp dword [0x14046d100], 1
mov rax, qword [0x14046d108]
movsxd rcx, ecx
lea rax, [rax + rcx*8]
je 0x140016e0d
mov rbx, qword [rax]
mov rdx, qword [rbx]
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x140016e60
mov eax, dword [rax + 0x88]
test eax, eax
sete al
test al, al
jne 0x140016e20
lea rsi, [rbx + 0x68]
mov edx, dword [rbx + 0x98]
mov r8d, 0x58
mov rcx, rsi
call fcn.14037e580
test eax, eax
js 0x140016e0f
lea rax, [0x140016c50]
mov qword [rbx + 0x80], rbx
xor edx, edx
xor ecx, ecx
lea r9, [rbx + 0x70]
lea r8, [0x1400169e0]
mov qword [rbx + 0x78], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rbx + 0x70], rax
je 0x140016e30
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov dword [rbx + 0x90], 1
jmp 0x140016db0
mov ecx, 1
call sub.msvcrt.dll_strerror
lea r8, str.pthread_create_failed:__s._Try_to_increase__ulimit__v__or_decrease__ulimit__s_._n
mov r9, rax
mov edx, 0x10
xor ecx, ecx
call fcn.14036cf30
mov rcx, rsi
call fcn.14037e630
mov eax, 0xffffffff
jmp 0x140016e0f
mov rax, qword [rdx + 8]
lea rdi, str.lavfi
mov ecx, 6
mov rsi, qword [rax]
repe cmpsb byte [rsi], byte [rdi]
setne al
jmp 0x140016dac
Function at 0x140081bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, qword [rsp + 0xb0]
mov rbp, r9
mov rbx, rcx
mov esi, edx
cmp r8, rbp
mov r12, r8
mov r9d, dword [rsp + 0xb8]
jg 0x140081de0
cmp rbp, r14
jg 0x140081de0
cmp edx, 0xffffffff
jl 0x140081ca5
cmp edx, dword [rcx + 0x2c]
jge 0x140081ca5
mov edx, dword [rcx + 0x524]
mov eax, r9d
or eax, 4
test edx, edx
cmovg r9d, eax
mov rax, qword [rcx + 8]
mov edi, r9d
and edi, 0xfffffffe
cmp qword [rax + 0x88], 0
je 0x140081d40
call fcn.14007ec20
cmp esi, 0xffffffff
je 0x140081cc0
mov rax, qword [rbx + 8]
mov dword [rsp + 0x28], edi
mov r9, rbp
mov qword [rsp + 0x20], r14
mov r8, r12
mov edx, esi
mov rcx, rbx
call qword [rax + 0x88]
test eax, eax
js 0x140081caa
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.14007c090
mov eax, 0xffffffea
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp dword [rbx + 0x2c], 1
jne 0x140081c6b
mov rax, qword [rbx + 0x30]
mov rcx, rbp
movabs rdx, 0xf424000000001
mov rax, qword [rax]
mov r8d, dword [rax + 0x18]
movsxd r13, dword [rax + 0x1c]
mov rsi, r8
mov rax, r13
movsxd rsi, esi
shl rax, 0x20
imul rsi, rsi, 0xf4240
or r8, rax
call fcn.14036d480
mov rcx, r12
mov r9d, 0x2003
mov rdx, r13
mov rbp, rax
mov r8, rsi
call fcn.14036d230
mov r8, rsi
mov rcx, r14
mov r9d, 0x2002
mov rdx, r13
mov r12, rax
xor esi, esi
call fcn.14036d230
mov r14, rax
jmp 0x140081c6b
mov r15, rbp
mov rax, r14
xor r13d, r13d
sub rax, rbp
sub r15, r8
mov edx, esi
cmp r15, rax
mov r8, rbp
mov qword [rsp + 0x38], rax
seta r13b
or r13d, edi
mov r9d, r13d
call fcn.140081df0
cmp r12, rbp
setne cl
cmp rbp, r14
setne dl
test cl, dl
je 0x140081caa
mov edx, eax
shr edx, 0x1f
test dl, dl
je 0x140081caa
cmp r15, qword [rsp + 0x38]
mov r8, r14
mov r9d, r13d
mov edx, esi
mov rcx, rbx
cmovbe r8, r12
call fcn.140081df0
test eax, eax
js 0x140081caa
xor r9d, r9d
cmp r15, qword [rsp + 0x38]
mov r8, rbp
mov edx, esi
mov rcx, rbx
setbe r9b
or r9d, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140081df0
mov eax, 0xffffffff
jmp 0x140081caa
Function at 0x1400c44b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
mov r9d, dword [rcx + 0x2168]
mov eax, dword [rcx + 0x216c]
mov r8, rcx
sub eax, r9d
cmp eax, 0x1f
jle 0x1400c4690
mov r10, qword [rcx + 0x2158]
mov eax, r9d
mov ecx, r9d
shr eax, 3
and ecx, 7
lea r11d, [r9 + 0x20]
mov edx, dword [r10 + rax]
lea eax, [r9 + 0x10]
mov dword [r8 + 0x2168], eax
shr eax, 3
mov eax, dword [r10 + rax]
bswap edx
mov dword [r8 + 0x2168], r11d
shl edx, cl
shr edx, 0xf0
bswap eax
shl edx, 0x10
shl eax, cl
shr eax, 0xf0
or eax, edx
cmp eax, 0x1b7
jne 0x1400c4690
mov ebx, dword [r8 + 0x2d4]
mov eax, dword [r8 + 0x2d8]
mov r9d, 0x20
imul eax, ebx
or eax, 1
bsr eax, eax
xor eax, 0x1f
sub r9d, eax
mov eax, r11d
shr eax, 3
mov edx, r9d
add r9d, r11d
mov eax, dword [r10 + rax]
neg edx
mov dword [r8 + 0x2168], r9d
bswap eax
shl eax, cl
mov ecx, edx
shr eax, cl
movzx eax, ax
cmp eax, dword [r8 + 0x2ec]
jge 0x1400c4690
cdq
idiv ebx
cmp dword [r8 + 0x2a1c], 2
mov dword [r8 + 0x1a2c], edx
mov dword [r8 + 0x1a30], eax
je 0x1400c45d2
mov eax, r9d
mov ecx, r9d
add r9d, 5
shr eax, 3
and ecx, 7
mov eax, dword [r10 + rax]
mov dword [r8 + 0x2168], r9d
bswap eax
shl eax, cl
mov ecx, dword [r8 + 0x21b8]
shr eax, 0xfb
lea edx, [rax + rax]
test ecx, ecx
je 0x1400c45cb
mov rdx, qword [0x140442ee0]
cdqe
movzx edx, byte [rdx + rax]
mov dword [r8 + 0xa60], edx
mov eax, r9d
mov ecx, r9d
shr eax, 3
and ecx, 7
movzx eax, byte [r10 + rax]
shl eax, cl
test al, al
jns 0x1400c4643
lea eax, [r9 + 9]
add r9d, 0xa
mov edx, eax
mov dword [r8 + 0x2168], eax
mov ecx, eax
shr edx, 3
and ecx, 7
movzx edx, byte [r10 + rdx]
mov dword [r8 + 0x2168], r9d
shl edx, cl
test dl, dl
jns 0x1400c464e
lea edx, [rax + 9]
add eax, 0xa
mov ecx, edx
mov dword [r8 + 0x2168], edx
shr ecx, 3
movzx r9d, byte [r10 + rcx]
mov ecx, edx
mov dword [r8 + 0x2168], eax
and ecx, 7
mov eax, edx
shl r9d, cl
test r9b, r9b
js 0x1400c4614
jmp 0x1400c464e
add r9d, 1
mov dword [r8 + 0x2168], r9d
mov rax, qword [r8 + 0x268]
mov ecx, dword [r8 + 0x200c]
add ecx, dword [rax + 0x2fc]
mov eax, 1
add ecx, dword [r8 + 0x21a8]
sub ecx, 1
shl eax, cl
mov dword [r8 + 0x9a8], eax
mov dword [r8 + 0x9a4], eax
mov dword [r8 + 0x9a0], eax
xor eax, eax
pop rbx
ret
mov eax, 0xbebbb1b7
pop rbx
ret