joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003c44
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
movups xmm0, xmmword [rdx]
xor eax, eax
mov rbx, qword [0x18001b7d8]
movsd xmm1, qword [rdx + 0x10]
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x19], rax
movups xmm0, xmmword [r8]
mov rax, qword [0x18001b970]
movsd qword [rbp - 0x39], xmm1
movsd xmm1, qword [r8 + 0x10]
xor r8d, r8d
movsd qword [rbp - 0x21], xmm1
movups xmmword [rbp - 0x31], xmm0
test rax, rax
jne 0x180003d2f
movaps xmm0, xmmword [str.rSHQXJr_5]
lea r9, [rbp - 9]
movaps xmm1, xmmword [0x180014630]
mov eax, dword [0x180014660]
movaps xmmword [rbp - 9], xmm0
movaps xmm0, xmmword [0x180014640]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x180014650]
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x37], eax
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x39
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x22
jl 0x180003ce1
mov rax, qword [0x180017a40]
lea r8, [rbp - 9]
add rax, 0x17a803c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001b970], rax
mov r9, qword [rbx]
lea r8, [rbp - 0x49]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
movsd xmm0, qword [rbp - 0x19]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180011050
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rbp
ret
Function at 0x180003d68
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x37], rax
movups xmm0, xmmword [r8]
mov rbx, rdx
mov rax, qword [0x18001b9e0]
movsd xmm1, qword [r8 + 0x10]
xor r8d, r8d
mov rdi, qword [0x18001b7d8]
movaps xmmword [rbp - 0x69], xmm0
movsd qword [rbp - 0x59], xmm1
movsd xmm1, qword [r9 + 0x10]
movsd qword [rbp - 0x41], xmm1
xorps xmm1, xmm1
movsd qword [rbp - 0x29], xmm1
movups xmm0, xmmword [r9]
movups xmmword [rbp - 0x51], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp - 0x39], xmm0
test rax, rax
jne 0x180003e6e
movaps xmm0, xmmword [0x180013ce0]
lea r9, [rbp - 0x19]
movaps xmm1, xmmword [0x180013cf0]
movzx eax, word [0x180013d28]
movaps xmmword [rbp - 0x19], xmm0
movaps xmm0, xmmword [0x180013d00]
movaps xmmword [rbp + 7], xmm0
movsd xmm0, qword [0x180013d20]
movaps xmmword [rbp - 9], xmm1
movaps xmm1, xmmword [0x180013d10]
movsd qword [rbp + 0x27], xmm0
movaps xmmword [rbp + 0x17], xmm1
mov word [rbp + 0x2f], ax
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x39
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x25
jl 0x180003e20
mov rax, qword [0x180017a40]
lea r8, [rbp - 0x19]
add rax, 0x17a803c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x18001b9e0], rax
mov r9, qword [rdi]
lea r8, [rbp - 0x69]
mov rdx, rax
mov rcx, rdi
call qword [r9 + 0x268]
movaps xmm0, xmmword [rbp - 0x39]
mov rax, rbx
movsd xmm1, qword [rbp - 0x29]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180011050
add rsp, 0xd0
pop rdi
pop rbx
pop rbp
ret
Function at 0x1800055ec
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rcx, dword [r9 + 0x3c]
mov r10d, dword [rcx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x180005672
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x180005672
mov ebx, dword [r10 + 0x20]
dec r8d
mov r11d, 0x6c6760b8
lea rcx, [rbx + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x18000566d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x18000564e
cmp r11d, 0xcbb989e8
je 0x180005677
test r8d, r8d
jne 0x180005631
mov rax, qword [rax]
jmp 0x18000560c
mov edx, dword [r10 + 0x24]
mov ecx, 1
add rdx, r9
movzx r8d, word [rdx + r8*2]
mov edx, dword [r10 + 0x1c]
add rdx, r9
mov eax, dword [rdx + r8*4]
add rax, r9
call rax
mov rbx, qword [rsp + 0x30]
test ax, ax
mov rsi, qword [rsp + 0x38]
setne byte [0x180017828]
add rsp, 0x20
pop rdi
ret
Function at 0x180005720
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r11d, dword [rdx + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1800057ac
mov r10d, dword [r11 + 0x18]
test r10d, r10d
je 0x1800057ac
mov ebx, dword [r11 + 0x20]
dec r10d
lea rdx, [rbx + r10*4]
mov r8d, dword [rdx + r9]
mov edx, 0x58a9be2b
add r8, r9
mov cl, byte [r8]
inc r8
test cl, cl
je 0x1800057a7
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x18000578a
cmp edx, 0xa0a70a99
je 0x1800057b1
test r10d, r10d
jne 0x18000576d
mov rax, qword [rax]
jmp 0x180005748
mov ecx, dword [r11 + 0x24]
mov edx, dword [r11 + 0x1c]
add rcx, r9
add rdx, r9
movzx ecx, word [rcx + r10*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r9
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.180011350
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r8, qword [rcx + 0x30]
movsxd rdx, dword [r8 + 0x3c]
mov r10d, dword [rdx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x180005866
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x180005866
mov ebx, dword [r10 + 0x20]
dec r11d
lea rdx, [rbx + r11*4]
mov r9d, dword [rdx + r8]
mov edx, 0xe1af1304
add r9, r8
mov al, byte [r9]
inc r9
test al, al
je 0x180005861
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [r9]
inc r9
test al, al
jne 0x180005844
cmp edx, 0x40c9fb20
je 0x18000586b
test r11d, r11d
jne 0x180005827
mov rcx, qword [rcx]
jmp 0x180005802
mov ecx, dword [r10 + 0x24]
mov rdx, rbp
add rcx, r8
movzx r9d, word [rcx + r11*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r8
mov r8, rsi
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800058a8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x180005931
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x180005931
mov edi, dword [r10 + 0x20]
dec r8d
mov r11d, 0xdd7a1638
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r9]
add rdx, r9
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x18000592c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x18000590d
cmp r11d, 0x97f59f1c
je 0x180005936
test r8d, r8d
jne 0x1800058f0
mov rax, qword [rax]
jmp 0x1800058cb
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r9
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rbx
movd xmm2, dword [rsp + 0x34]
mov rsi, qword [rsp + 0x40]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rbx], xmm1
movsd qword [rbx + 8], xmm0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800059ec
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rax, qword gs:[0x60]
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov r9d, dword [r9 + r10 + 0x88]
add r9, r10
cmp r9, r10
je 0x180005a92
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x180005a92
mov edi, dword [r9 + 0x20]
dec r8d
mov r11d, 0x3265aad2
lea rcx, [rdi + r8*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x180005a8d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x180005a6e
cmp r11d, 0x10359c7c
je 0x180005a97
test r8d, r8d
jne 0x180005a51
mov rax, qword [rax]
jmp 0x180005a2c
mov ecx, dword [r9 + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r14
add rax, r10
call rax
movups xmm0, xmmword [0x180013578]
mov rcx, r14
movups xmm1, xmmword [rsi]
movdqa xmmword [rbp - 9], xmm0
addpd xmm1, xmmword [0x180014ed0]
movups xmm0, xmmword [0x18001b250]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [r15]
movdqu xmmword [rbp + 0x17], xmm1
movaps xmm1, xmmword [rsi]
movdqa xmmword [rbp + 7], xmm0
movaps xmm0, xmmword [0x180014ec0]
movdqu xmmword [rbp + 0x37], xmm1
movaps xmmword [rbp + 0x27], xmm0
call fcn.180005720
mov rdx, rax
cmp word [rax], r12w
je 0x180005b24
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x180005b0d
mov rax, r12
add ecx, 1
je 0x180005b2a
mov rax, rdx
jmp 0x180005b2a
mov ecx, r12d
mov rax, r12
mov qword [rbp - 0x29], rax
lea r9, [rbp + 0x37]
lea rax, [rbp - 9]
mov dword [rbp - 0x21], ecx
mov qword [rsp + 0x60], rax
lea r8, [rbp - 0x29]
mov byte [rsp + 0x50], 1
lea rax, [rbp - 0x19]
mov byte [rsp + 0x48], r12b
xorps xmm0, xmm0
mov qword [rsp + 0x40], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x17]
movss dword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
mov dword [rbp - 0x1d], ecx
mov rcx, qword [0x180017820]
mov qword [rsp + 0x20], rax
call fcn.180001384
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180005bac
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov rax, qword gs:[0x60]
mov r12, r8
mov r14, rdx
mov r15, rcx
xor ebx, ebx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov r9d, dword [r9 + r10 + 0x88]
add r9, r10
cmp r9, r10
je 0x180005c51
mov r8d, dword [r9 + 0x18]
test r8d, r8d
je 0x180005c51
mov esi, dword [r9 + 0x20]
dec r8d
mov r11d, 0x10897b33
lea rcx, [rsi + r8*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x180005c4c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x180005c2d
cmp r11d, 0x1199e41
je 0x180005c56
test r8d, r8d
jne 0x180005c10
mov rax, qword [rax]
jmp 0x180005beb
mov ecx, dword [r9 + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, r15
add rax, r10
call rax
movups xmm0, xmmword [0x180013578]
mov rcx, r15
movups xmm1, xmmword [r14]
movdqa xmmword [rbp - 9], xmm0
addpd xmm1, xmmword [0x180014ed0]
movups xmm0, xmmword [0x18001b250]
movaps xmmword [rbp - 0x19], xmm1
movaps xmm1, xmmword [r12]
movdqu xmmword [rbp + 0x17], xmm1
movaps xmm1, xmmword [r14]
movdqa xmmword [rbp + 7], xmm0
movaps xmm0, xmmword [0x180014ec0]
movdqu xmmword [rbp + 0x37], xmm1
movaps xmmword [rbp + 0x27], xmm0
call fcn.180005720
cmp word [rax], bx
je 0x180005cde
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x180005ccb
add ecx, 1
je 0x180005ce0
mov rbx, rax
jmp 0x180005ce0
mov ecx, ebx
lea rax, [rbp - 9]
mov dword [rbp - 0x21], ecx
mov qword [rsp + 0x60], rax
lea r9, [rbp + 0x37]
mov byte [rsp + 0x50], 1
lea rax, [rbp - 0x19]
mov byte [rsp + 0x48], 1
lea r8, [rbp - 0x29]
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
lea rax, [rbp + 7]
mov dword [rbp - 0x1d], ecx
mov rcx, qword [0x180017820]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x17]
movss dword [rsp + 0x30], xmm0
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x27]
mov qword [rsp + 0x20], rax
mov qword [rbp - 0x29], rbx
call fcn.180001384
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180010b18
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x47], rax
movaps xmm0, xmmword [0x1800140f0]
lea r9, [rbp - 9]
movaps xmm1, xmmword [0x180014100]
xor r14d, r14d
mov eax, dword [0x180014130]
mov r8d, r14d
movaps xmmword [rbp - 9], xmm0
mov ebx, 0x51eb851f
movaps xmm0, xmmword [str.__x_]
movaps xmmword [rbp + 7], xmm1
movaps xmm1, xmmword [0x180014120]
movaps xmmword [rbp + 0x17], xmm0
movaps xmmword [rbp + 0x27], xmm1
mov dword [rbp + 0x37], eax
mov eax, ebx
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x39
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0x22
jl 0x180010b89
mov rax, qword gs:[0x60]
test rax, rax
je 0x180010d0c
mov r11, qword [rax + 0x18]
add r11, 0x20
mov r8, qword [r11]
jmp 0x180010d03
mov r9, qword [r8 + 0x50]
test r9, r9
je 0x180010d00
mov rax, r9
mov ecx, r14d
cmp word [r9], r14w
je 0x180010bfa
inc ecx
lea rax, [rax + 2]
cmp word [rax], r14w
jne 0x180010bee
lea rax, [rbp - 9]
mov edx, r14d
cmp word [rbp - 9], r14w
je 0x180010c14
inc edx
lea rax, [rax + 2]
cmp word [rax], r14w
jne 0x180010c08
cmp ecx, edx
jne 0x180010d00
movsxd r10, ecx
mov rdx, r14
test ecx, ecx
je 0x180010c49
movzx ecx, word [r9 + rdx*2]
movzx eax, word [rbp + rdx*2 - 9]
or cx, 0x20
or ax, 0x20
cmp cx, ax
jne 0x180010d00
inc rdx
cmp rdx, r10
jb 0x180010c26
mov rax, qword [r8 + 0x20]
mov qword [0x180017a40], rax
test rax, rax
je 0x180010d13
call fcn.180003eb0
movups xmm0, xmmword [0x180014860]
movzx eax, word [0x180014870]
lea r9, [rbp - 0x29]
mov word [rbp - 0x19], ax
mov r8d, r14d
movups xmmword [rbp - 0x29], xmm0
mov eax, ebx
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x39
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 9
jl 0x180010c7f
mov rax, qword [0x180017a40]
lea r8, [rbp - 0x29]
add rax, 0x17a803c
or rdx, 0xffffffffffffffff
xor ecx, ecx
call rax
mov rdi, rax
test rax, rax
je 0x180010d13
mov rdx, rax
call fcn.180002c28
mov rsi, rax
lea rcx, [rax + 0x38]
test rcx, rcx
je 0x180010ce6
movups xmm0, xmmword [rcx]
movdqu xmmword [rbp - 0x39], xmm0
mov rcx, qword [rbp - 0x39]
mov rdx, rdi
mov rbx, qword [rcx]
call fcn.180002d1c
add rbx, 0x78
je 0x180010d3c
mov rbx, qword [rbx]
jmp 0x180010d40
mov r8, qword [r8]
cmp r8, r11
jne 0x180010bd5
mov qword [0x180017a40], r14
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180011050
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rbx, qword [rbp - 0x39]
mov rdx, rsi
call fcn.180003058
add rax, 0x70
je 0x180010d53
mov rcx, qword [rax]
jmp 0x180010d57
mov rcx, qword [rbp - 0x39]
mov qword [0x1800177b8], rcx
mov rcx, rbx
call fcn.180010f88
mov qword [0x180017818], rax
jmp 0x180010d13
Function at 0x140001120
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebp, r8d
mov esi, edx
mov edi, ecx
cmp ecx, edx
je 0x1400011ff
mov ecx, 1
mov qword [rsp + 0x40], rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, 1
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test ebx, ebx
jne 0x1400011a9
test eax, eax
jne 0x1400011a9
lea ecx, [rbx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ferror]
mov ecx, 2
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
jne 0x1400011a5
test ebx, ebx
je 0x1400011fa
mov edi, esi
jmp 0x1400011fa
mov edi, esi
test ebp, ebp
je 0x1400011fa
test eax, eax
je 0x1400011c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rbx, rax
jmp 0x1400011cd
lea rbx, str.Unknown_error
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x14002f150]
lea r9, str.Writing_to_standard_output_failed
mov rcx, rax
mov qword [rsp + 0x20], rbx
lea rdx, str._s:__s:__s_n
call fcn.1400010d0
mov rbx, qword [rsp + 0x40]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140001460
Capabilities:
Query environment variable

Disassembly:
push r12
push r13
push r14
sub rsp, 0x30
mov r13, rcx
mov r14, r8
mov rcx, r8
mov r12, rdx
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400015a3
mov qword [rsp + 0x50], rbx
mov rcx, rax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r15
call fcn.1400082a0
mov ebp, 1
mov r15, rax
mov edi, ebp
movzx ebx, dil
movzx edx, byte [rax]
test dl, dl
je 0x1400014fd
mov rsi, rax
nop
movzx ecx, dl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x1400014d3
movzx ebx, bpl
jmp 0x1400014f2
test bl, bl
je 0x1400014f2
xor bl, bl
inc edi
cmp edi, 0x7fffffff
jne 0x1400014f2
mov rdx, r14
lea rcx, str.The_environment_variable__s_contains_too_many_arguments
call fcn.140005e00
movzx edx, byte [rsi + 1]
inc rsi
test dl, dl
jne 0x1400014c0
movsxd rax, edi
xor ecx, ecx
lea rbx, [rax*8]
lea rdx, [rbx + 8]
call fcn.140008240
mov r14, rax
movzx edi, bpl
mov qword [rax], r12
xor r12d, r12d
mov qword [rbx + rax], r12
movzx ecx, byte [r15]
test cl, cl
je 0x140001564
mov rbx, r15
lea rsi, [rax + 8]
movzx ecx, cl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
test eax, eax
je 0x140001548
mov dil, 1
mov byte [rbx], r12b
jmp 0x140001559
test dil, dil
je 0x140001559
xor dil, dil
mov qword [rsi], rbx
inc ebp
add rsi, 8
movzx ecx, byte [rbx + 1]
inc rbx
test cl, cl
jne 0x140001533
mov r8, r14
mov edx, ebp
mov rcx, r13
call fcn.1400015b0
mov rcx, r14
mov dword [0x14002f104], r12d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop r13
pop r12
ret
Function at 0x140003430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
xor r8d, r8d
mov ecx, dword [rcx + 0x10]
mov edx, r9d
mov ebx, r9d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__lseek]
cmp eax, ebx
je 0x14000348a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, qword [rdi]
lea rcx, str._s:_Error_seeking_the_file:__s
mov r8, rax
call fcn.140005dc0
mov al, 1
jmp 0x14000353c
xor ebx, ebx
test rsi, rsi
je 0x140003522
nop word [rax + rax]
mov ecx, dword [rdi + 0x10]
lea rdx, [rbx + rbp]
mov r8d, esi
sub r8d, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rcx, eax
test eax, eax
je 0x140003514
cmp rcx, 0xffffffffffffffff
jne 0x1400034d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x1400034f0
mov eax, dword [0x140033578]
test eax, eax
jne 0x140003483
jmp 0x1400034e9
add rbx, rcx
cmp byte [rdi + 0x19], 0
jne 0x1400034e9
mov byte [rdi + 0x19], 1
call fcn.140007360
cmp rbx, rsi
jb 0x1400034a0
jmp 0x140003518
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, qword [rdi]
lea rcx, str._s:_Read_error:__s
mov r8, rax
call fcn.140005dc0
mov al, 1
jmp 0x14000353c
mov byte [rdi + 0x18], 1
cmp rbx, 0xffffffffffffffff
je 0x140003483
cmp rbx, rsi
je 0x14000353a
mov rdx, qword [rdi]
lea rcx, str._s:_Unexpected_end_of_file
call fcn.140005dc0
mov al, 1
jmp 0x14000353c
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140003560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
test r8, r8
je 0x14000360d
nop dword [rax + rax]
mov ecx, dword [rdi + 0x10]
lea rdx, [rbx + rbp]
mov r8d, esi
sub r8d, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
movsxd rcx, eax
test eax, eax
je 0x140003609
cmp rcx, 0xffffffffffffffff
jne 0x1400035c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 4
jne 0x1400035e0
mov eax, dword [0x140033578]
test eax, eax
jne 0x140003600
jmp 0x1400035d9
add rbx, rcx
cmp byte [rdi + 0x19], 0
jne 0x1400035d9
mov byte [rdi + 0x19], 1
call fcn.140007360
cmp rbx, rsi
jb 0x140003590
jmp 0x14000360d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov rdx, qword [rdi]
lea rcx, str._s:_Read_error:__s
mov r8, rax
call fcn.140005dc0
mov rax, 0xffffffffffffffff
jmp 0x140003610
mov byte [rdi + 0x18], 1
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400038c0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x14002f15b], 0
mov rdx, qword [0x140033360]
je 0x1400038f0
mov r9, qword [0x140033358]
lea rcx, str._llu_t_llu_t_llu_n
mov r8, qword [0x140033350]
call fcn.140003a20
jmp 0x140003922
lea rcx, str.Total_amount_of_physical_memory__RAM_:
call fcn.140003990
mov rdx, qword [0x140033350]
lea rcx, str.Memory_usage_limit_for_compression:
call fcn.140003990
mov rdx, qword [0x140033358]
lea rcx, str.Memory_usage_limit_for_decompression:
call fcn.140003990
call fcn.140006850
xor r8d, r8d
mov edx, 1
test eax, eax
setne r8b
xor ecx, ecx
add rsp, 0x28
jmp fcn.140001120
Function at 0x140006880
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
cmp byte [0x14002f15b], 0
je 0x1400068a8
call fcn.1400098e0
mov r8d, eax
lea rcx, str.XZ_VERSION_u_nLIBLZMA_VERSION_u_n
mov edx, 0x2fb3ede
call fcn.140003a20
jmp 0x1400068c8
lea rcx, str.xz__XZ_Utils__5.2.6_n
call fcn.140003a20
call fcn.1400098f0
mov rdx, rax
lea rcx, str.liblzma__s_n
call fcn.140003a20
xor r8d, r8d
mov edx, 1
cmp dword [0x14002f100], r8d
setne r8b
xor ecx, ecx
add rsp, 0x28
jmp fcn.140001120