joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d5a20
Capabilities:
Get system information on windows
Link many functions at runtime

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rsi, qword [0x140207460]
mov byte [0x1401c5c01], 0
mov rax, qword [rsi]
mov qword [rsp + 0x58], rax
xor eax, eax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
test eax, eax
je 0x1400d5a5a
mov qword [0x1401c5c08], rax
mov rdi, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.kernelbase.dll
call rdi
mov rbx, rax
test rax, rax
je 0x1400d5a9e
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.VirtualAlloc2FromApp
mov rcx, rax
call rbp
mov qword [0x14024b430], rax
test rax, rax
je 0x1400d5b88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.ntdll.dll
call rdi
mov rbx, rax
test rax, rax
je 0x1400d5acf
mov rcx, rax
lea rdx, str.NtAllocateVirtualMemoryEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rbx
mov qword [0x14024b428], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, str.kernel32.dll
call rdi
mov rbx, rax
test rax, rax
je 0x1400d5b3c
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetCurrentProcessorNumberEx
mov rcx, rax
call rdi
lea rdx, str.GetNumaProcessorNodeEx
mov rcx, rbx
mov qword [0x14024b420], rax
call rdi
lea rdx, str.GetNumaNodeProcessorMaskEx
mov rcx, rbx
mov qword [0x14024b418], rax
call rdi
mov rcx, rbx
lea rdx, str.GetNumaProcessorNode
mov qword [0x14024b410], rax
call rdi
mov rcx, rbx
mov qword [0x14024b408], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 6
call fcn.1400d4f40
test al, al
jne 0x1400d5b70
mov ecx, 7
call fcn.1400d4f40
test al, al
jne 0x1400d5b70
mov rax, qword [rsp + 0x58]
sub rax, qword [rsi]
jne 0x1400d5ba0
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp qword [0x14024b438], 0
jne 0x1400d5b58
call fcn.1400d57e0
jmp 0x1400d5b58
lea rdx, str.VirtualAlloc2
mov rcx, rbx
call rbp
mov qword [0x14024b430], rax
jmp 0x1400d5a95
call fcn.1401be670
nop
nop word cs:[rax + rax]

Function at 0x1400d8390
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rax, [fcn.1400d8390]
xor ecx, ecx
xor rax, qword [rsp + 0x20]
movabs r11, 0x302b8631721c51be
xor rax, rsi
movabs r10, 0xbf58476d1ce4e5b9
movabs r9, 0x94d049bb133111eb
mov r8, rax
shr r8, 0x11
xor r8, rax
and r8d, 0xf
jmp 0x1400d842a
mov rdx, rax
shr rdx, 0x1e
xor rax, rdx
imul rax, r10
mov rdx, rax
shr rdx, 0x1b
xor rdx, rax
imul rdx, r9
mov rax, rdx
shr rax, 0x1f
xor rax, rdx
lea rdx, [rcx + 1]
cmp r8, rcx
je 0x1400d843b
mov rcx, rdx
test rax, rax
jne 0x1400d83f8
mov rax, r11
lea rdx, [rcx + 1]
cmp r8, rcx
jne 0x1400d8427
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rbx]
jne 0x1400d844c
add rsp, 0x38
pop rbx
pop rsi
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x1400d8ce0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov edx, 1
jmp fcn.1400d8460

Function at 0x1400d8cf0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x140207460]
mov dword [0x14023dfe0], 0
mov qword [rsp + 0x68], r9
mov rbx, r8
mov rsi, qword [rax]
mov qword [rsp + 0x28], rsi
xor esi, esi
lea rsi, [rsp + 0x68]
mov r9, rsi
mov qword [rsp + 0x20], rsi
call fcn.1400a0500
mov eax, dword [0x14023dfe8]
test eax, eax
jne 0x1401bf8e0
mov r8, rbx
mov r9, rsi
lea rbx, str.usage.c
mov edx, 0x13d
mov dword [0x14023dfe8], 1
mov rcx, rbx
call fcn.14008ecd0
mov r8d, dword [0x14023dfe4]
test r8d, r8d
je 0x1401bf8e0
mov rcx, rbx
mov edx, 0x140
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
nop
nop word cs:[rax + rax]
nop dword [rax]
cmp byte [rcx + 0x84], 0
jne 0x1400d8d00
ret
xor edx, edx
jmp fcn.1400d8460
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call sub.msvcrt.dll_abort
nop
lea rdx, str.out_of_memory_in_new
mov ecx, 0xc
call fcn.1400d4fa0
call sub.msvcrt.dll_abort
nop
lea rdx, str.out_of_memory_in_new
mov ecx, 0xc
call fcn.1400d4fa0
call sub.msvcrt.dll_abort
nop
lea rdx, str.out_of_memory_in_new
mov ecx, 0xc
call fcn.1400d4fa0
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
push rbx
sub rsp, 0x20
cmp qword [0x1401c5190], 0
je 0x1401bf9e0
lea rcx, [0x1400d3860]
mov byte [0x1401c4640], 0
call fcn.140001410
call fcn.1400d4e50
cmp byte [0x140243282], 0
jne 0x1401bf9ca
lea rcx, [0x1400d3a80]
mov byte [0x140243282], 1
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
lea rcx, [0x1401c4620]
mov ebx, eax
mov dword [0x1401c4650], eax
call fcn.1401be440
lea rdx, [0x1401c4660]
mov ecx, ebx
mov qword [rax], rdx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
call fcn.1400d3e70
lea rcx, [0x1401c51a8]
add rsp, 0x20
pop rbx
jmp 0x1400d8cf0
call fcn.1400d37f0
jmp 0x1401bf96f
Function at 0x1400dc3b0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rbp, [0x1400dc5b0]
mov r12, qword [rsp + 0x70]
mov rbx, r9
mov rsi, rcx
mov r9, rdx
mov rcx, rbp
mov rdi, r8
mov rdx, rbx
lea r8, str._10s:
call fcn.1400d46d0
mov rcx, qword [rsi + 0x10]
xor r9d, r9d
mov r8, rbx
cmp rdi, 1
je 0x1400dc4b0
mov rdx, 0xffffffffffffffff
call fcn.1400dc1b0
mov rcx, qword [rsi]
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffffffffffff
call fcn.1400dc1b0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffffffffffff
call fcn.1400dc1b0
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
mov r8, rbx
mov rdx, 0xffffffffffffffff
call fcn.1400dc1b0
cmp rdi, 0xffffffffffffffff
je 0x1400dc460
xor r9d, r9d
mov r8, rbx
mov edx, 1
xor ecx, ecx
call fcn.1400dc1b0
ud2
lea r8, str._22s
lea r9, [0x1401e4624]
mov rdx, rbx
mov rcx, rbp
call fcn.1400d46d0
mov rax, qword [rsi + 8]
lea r8, str.__not_all_freed__n
cmp qword [rsi], rax
jle 0x1400dc4a0
mov rdx, rbx
mov rcx, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.1400d46d0
lea r8, str.__ok_n
jmp 0x1400dc489
mov edx, 1
call fcn.1400dc1b0
mov rcx, qword [rsi]
xor r9d, r9d
mov r8, rbx
mov edx, 1
call fcn.1400dc1b0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8, rbx
mov edx, 1
call fcn.1400dc1b0
mov rcx, qword [rsi + 0x18]
xor r9d, r9d
mov r8, rbx
mov edx, 1
call fcn.1400dc1b0
xor r9d, r9d
mov r8, rbx
mov edx, 1
mov ecx, 1
call fcn.1400dc1b0
lea r9, [0x1401e4620]
mov rdx, rbx
mov rcx, rbp
lea r8, [0x1401e462d]
call fcn.1400d46d0
mov rax, qword [rsi + 8]
cmp qword [rsi], rax
jle 0x1400dc4a0
lea r8, [0x1401e4663]
mov rdx, rbx
mov rcx, rbp
call fcn.1400d46d0
test r12, r12
mov rdx, rbx
mov rcx, rbp
lea r8, str.not_all_freed_
cmovne r8, r12
call fcn.1400d46d0
lea r8, [0x1401e4666]
jmp 0x1400dc489

Function at 0x1400dd2e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [0x140287680]
mov rbx, qword [rsp + 0x28]
test rcx, rcx
je 0x1400dd338
mov rax, rbx
cqo
idiv rcx
mov rbx, rax
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x1400dd387
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov r8, qword [rsp + 0x30]
movabs rax, 0x20c49ba5e353f7cf
imul r8
sar r8, 0x3f
mov rcx, rdx
sar rcx, 7
sub rcx, r8
je 0x1400dd380
mov rax, rbx
cqo
idiv rcx
mov rbx, rax
mov qword [0x140287680], rcx
jmp 0x1400dd31e
mov ecx, 1
jmp 0x1400dd370
call fcn.1401be670
nop
nop dword [rax]
Function at 0x1400e2410
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rbx
mov r11, r8
mov r10, rdx
shr r11, 2
test r11d, r11d
jle 0x1400e2473
lea eax, [r11 - 1]
lea r9, [rdx + rax*4 + 4]
nop dword [rax]
movsx eax, byte [rdx + 1]
movsx ebx, byte [rdx + 2]
add rdx, 4
shl ebx, 0x10
shl eax, 8
or eax, ebx
movsx ebx, byte [rdx - 4]
or eax, ebx
movsx ebx, byte [rdx - 1]
shl ebx, 0x18
or eax, ebx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, ecx
rol eax, 0xd
lea ecx, [rax + rax*4 - 0x19ab949c]
cmp rdx, r9
jne 0x1400e2430
mov rax, r8
movsxd r11, r11d
and eax, 3
lea r9, [r10 + r11*4]
cmp rax, 2
je 0x1400e24f0
cmp rax, 3
je 0x1400e24d8
cmp rax, 1
jne 0x1400e24ab
xor edx, edx
movsx eax, byte [r9]
xor eax, edx
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor ecx, eax
xor ecx, r8d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
pop rbx
ret
movsx eax, byte [r9 + 2]
shl eax, 0x10
movsx edx, byte [r9 + 1]
shl edx, 8
xor edx, eax
jmp 0x1400e2494
xor eax, eax
jmp 0x1400e24e0
Function at 0x1400e8320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, qword [0x140207460]
mov r13, qword [rsp + 0xb0]
mov r14, qword [rsp + 0xb8]
mov rax, qword [r12]
mov qword [rsp + 0x48], rax
mov eax, r8d
mov rbp, rcx
mov rbx, rdx
mov esi, r8d
mov rdi, r9
and eax, 0xf000
cmp eax, 0xe000
je 0x1400e8470
call fcn.140025cb0
movsxd rdx, dword [rbx + 0x20]
test edx, edx
je 0x1400e8420
lea rcx, [rdx + rdx*2]
lea rcx, [rdx + rcx*4]
mov rdx, qword [0x1402079b0]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x10], 0x20
mov rdx, qword [rbx]
je 0x1400e843f
mov rcx, qword [rbx + 8]
xor rdx, qword [rax]
xor rcx, qword [rax + 8]
or rdx, rcx
je 0x1400e84c8
test r13, r13
je 0x1400e8508
mov rcx, r14
call fcn.14010a870
movzx r9d, si
mov r8d, 1
mov rdx, rbx
mov r14, rax
mov rcx, rax
call fcn.14010a8f0
lea r9, [rsp + 0x30]
mov r8, r14
mov rdx, r13
mov rcx, rbp
call fcn.140110260
mov rcx, r14
mov dword [rdi], eax
call fcn.14010a8c0
mov rax, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
sub rdx, qword [r12]
jne 0x1400e8542
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdx, qword [0x140207cf0]
mov rdx, qword [rdx]
mov rdx, qword [rdx + 0x100]
cmp qword [rdx + 0x10], 0x20
mov rdx, qword [rbx]
jne 0x1400e839f
mov rcx, qword [rbx + 8]
xor rdx, qword [rax]
xor rcx, qword [rax + 8]
or rdx, rcx
jne 0x1400e83b3
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
xor rdx, qword [rax + 0x10]
xor rcx, qword [rax + 0x18]
or rdx, rcx
jne 0x1400e83b3
jmp 0x1400e84d4
mov rax, qword [0x140207c90]
mov rcx, rdx
lea rbx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
call fcn.1400202e0
mov rcx, rbx
lea rdx, [0x1401e6647]
mov r8, rax
call fcn.14007ed40
mov rax, qword [rsp + 0x38]
xor edx, edx
mov rcx, rbx
mov dword [rdi], eax
call fcn.14007d860
jmp 0x1400e83fe
mov eax, dword [rax + 0x10]
cmp dword [rbx + 0x10], eax
jne 0x1400e83b3
mov dword [rdi], 0
mov rax, qword [rsp + 0x48]
sub rax, qword [r12]
jne 0x1400e8542
mov edx, 1
mov ecx, 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.1400a6220
mov r9, rdi
lea r8, [rsp + 0x2c]
mov rdx, rbx
mov rcx, rbp
call fcn.14002a2f0
cmp dword [rsp + 0x2c], 3
mov qword [rsp + 0x30], rax
je 0x1400e83fe
mov rcx, rbx
call fcn.1400202e0
lea rcx, str.object__s_is_not_a_blob_
mov rdx, rax
call fcn.1400a08a0
call fcn.1401be670
nop
nop dword [rax + rax]
Function at 0x1400eaba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [r8 + 0x6d4]
test eax, 0x301
jne 0x1400eabd0
test al, 0x10
jne 0x1400eabb8
ret
mov r9, r8
mov r8d, 1
jmp fcn.1400e8d50
jmp fcn.1400e7fd0
Function at 0x1400f9810
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov esi, ecx
lea rcx, [0x1401e7ff6]
mov rbx, rdx
call fcn.1400f9710
test eax, eax
jne 0x1400f9878
lea rdx, [rsp + 0x20]
lea rcx, [0x1401e8005]
call fcn.1400f97a0
test eax, eax
jne 0x1400f9890
mov rax, qword [0x1402079b0]
add rax, 0x68
mov qword [rbx + 0x48], rax
mov rax, qword [rsp + 0x28]
sub rax, qword [rdi]
jne 0x1400f98dd
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.1400a2f00
lea rdx, [0x1401e7ffc]
mov ecx, esi
mov r8, rax
call fcn.14003bbd0
jmp 0x1400f983e
mov rbp, qword [rsp + 0x20]
mov rcx, rbp
call fcn.140025d30
test eax, eax
je 0x1400f98e2
cdqe
lea rdx, [rax + rax*2]
lea rdx, [rax + rdx*4]
mov rax, qword [0x1402079b0]
lea rax, [rax + rdx*8]
mov qword [rbx + 0x48], rax
mov rdx, qword [rsp + 0x28]
sub rdx, qword [rdi]
jne 0x1400f98dd
mov r8, qword [rax]
lea rdx, [0x1401e8047]
mov ecx, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.14003bbd0
call fcn.1401be670
lea rcx, str.unknown_object_format__s_specified_by_server
call fcn.1400f9010
mov rdx, rbp
mov rcx, rax
call fcn.1400a08a0
nop
nop word [rax + rax]
Function at 0x1401032d0
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 0x230]
mov eax, dword [rsi + 8]
mov rdi, rdx
mov edx, dword [rsi + 0xc]
mov rbx, rcx
cmp eax, edx
jl 0x14010332b
lea edx, [rdx + rdx*2 + 0x30]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [rax + 1]
sar ecx, 1
cmp eax, ecx
cmovl edx, ecx
mov dword [rsi + 0xc], edx
movsxd rdx, edx
mov rax, rdx
shr rax, 0x3b
jne 0x14010336a
mov rcx, qword [rsi]
shl rdx, 5
call fcn.1400a61c0
mov qword [rsi], rax
mov rsi, qword [rbx + 0x230]
mov eax, dword [rsi + 8]
lea edx, [rax + 1]
movsxd rbx, eax
mov dword [rsi + 8], edx
movdqu xmm0, xmmword [rdi]
shl rbx, 5
add rbx, qword [rsi]
movups xmmword [rbx], xmm0
movdqu xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14010335f
movsxd rdx, dword [rdi + 8]
call fcn.1400a60d0
mov rcx, rax
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rdx
lea rcx, [0x1401e92c0]
mov edx, 0x20
call fcn.1400a08a0
nop
nop
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
test r8d, r8d
jne 0x140103429
mov eax, dword [rbx + 0x168]
mov rdx, qword [rbx + 0x178]
and ah, 0x3f
lea rcx, [rdx + 1]
or ah, 0x40
mov dword [rbx + 0x168], eax
mov rax, qword [rbx + 0x180]
cmp rax, rcx
jae 0x140103420
lea rdx, [rax + rax*2 + 0x30]
shr rdx, 1
cmp rdx, rcx
cmovb rdx, rcx
mov rax, rdx
mov qword [rbx + 0x180], rdx
shr rax, 0x3d
jne 0x140103441
mov rcx, qword [rbx + 0x170]
shl rdx, 3
call fcn.1400a61c0
mov rdx, qword [rbx + 0x178]
mov qword [rbx + 0x170], rax
lea rcx, [rdx + 1]
mov qword [rbx + 0x178], rcx
mov rcx, rsi
lea rbx, [rax + rdx*8]
call fcn.1400a5f80
mov qword [rbx], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [rbx + 0x170]
jmp 0x140103400
lea r8, [0x1401e92e0]
mov edx, 0x13cc
lea rcx, str.diff.c
call fcn.1400a0ca0
mov r8, rdx
lea rcx, [0x1401e92c0]
mov edx, 8
call fcn.1400a08a0
nop
nop word cs:[rax + rax]
Function at 0x140103380
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx + 0x230]
mov eax, dword [rsi + 8]
mov rdi, rdx
mov edx, dword [rsi + 0xc]
mov rbx, rcx
cmp eax, edx
jl 0x14010332b
lea edx, [rdx + rdx*2 + 0x30]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
lea edx, [rax + 1]
sar ecx, 1
cmp eax, ecx
cmovl edx, ecx
mov dword [rsi + 0xc], edx
movsxd rdx, edx
mov rax, rdx
shr rax, 0x3b
jne 0x14010336a
mov rcx, qword [rsi]
shl rdx, 5
call fcn.1400a61c0
mov qword [rsi], rax
mov rsi, qword [rbx + 0x230]
mov eax, dword [rsi + 8]
lea edx, [rax + 1]
movsxd rbx, eax
mov dword [rsi + 8], edx
movdqu xmm0, xmmword [rdi]
shl rbx, 5
add rbx, qword [rsi]
movups xmmword [rbx], xmm0
movdqu xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14010335f
movsxd rdx, dword [rdi + 8]
call fcn.1400a60d0
mov rcx, rax
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rdx
lea rcx, [0x1401e92c0]
mov edx, 0x20
call fcn.1400a08a0
nop
nop
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rcx + 0x10]
mov rsi, rdx
test r8d, r8d
jne 0x140103429
mov eax, dword [rbx + 0x168]
mov rdx, qword [rbx + 0x178]
and ah, 0x3f
lea rcx, [rdx + 1]
or ah, 0x40
mov dword [rbx + 0x168], eax
mov rax, qword [rbx + 0x180]
cmp rax, rcx
jae 0x140103420
lea rdx, [rax + rax*2 + 0x30]
shr rdx, 1
cmp rdx, rcx
cmovb rdx, rcx
mov rax, rdx
mov qword [rbx + 0x180], rdx
shr rax, 0x3d
jne 0x140103441
mov rcx, qword [rbx + 0x170]
shl rdx, 3
call fcn.1400a61c0
mov rdx, qword [rbx + 0x178]
mov qword [rbx + 0x170], rax
lea rcx, [rdx + 1]
mov qword [rbx + 0x178], rcx
mov rcx, rsi
lea rbx, [rax + rdx*8]
call fcn.1400a5f80
mov qword [rbx], rax
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [rbx + 0x170]
jmp 0x140103400
lea r8, [0x1401e92e0]
mov edx, 0x13cc
lea rcx, str.diff.c
call fcn.1400a0ca0
mov r8, rdx
lea rcx, [0x1401e92c0]
mov edx, 8
call fcn.1400a08a0
nop
nop word cs:[rax + rax]

Function at 0x140105a50
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
cmp qword [rcx + 0x10], 0
mov rbx, rcx
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
je 0x140105aa8
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x140105b05
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
mov rcx, qword [rcx + 8]
test byte [rbx + 0x20], 4
je 0x140105af0
lea rdi, [rsp + 0x20]
mov rdx, qword [rbx]
mov r8, rcx
mov rcx, rdi
call fcn.140105720
mov r8, qword [rbx + 0x18]
test r8, r8
je 0x140105add
lea rdx, [0x1401e9794]
mov rcx, rdi
call fcn.14007ed40
xor edx, edx
mov rcx, rdi
call fcn.14007d860
mov qword [rbx + 0x10], rax
jmp 0x140105a90
lea rdi, [rsp + 0x20]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.1400437c0
jmp 0x140105ac5
call fcn.1401be670
nop
nop dword [rax + rax]
Function at 0x140105b10
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rax, qword [rsp + 0xb0]
mov rsi, qword [rcx + 0x1c0]
mov r12d, dword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov ebx, dword [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov rax, qword [rcx + 0x218]
mov rbp, rcx
mov rdi, rdx
mov qword [rsp + 0x28], r8
lea rcx, [0x1401e94e2]
mov dword [rsp + 0x34], r9d
test rax, rax
je 0x140105b7e
mov rcx, rbp
mov rdx, qword [rbp + 0x220]
call rax
mov rcx, qword [rax + 0x10]
mov rdx, rsi
call fcn.1401bf070
test ebx, ebx
jle 0x140105d40
movsxd rdx, ebx
xor r14d, r14d
movzx eax, byte [r13 + rdx - 1]
cmp al, 0xa
je 0x140105ce0
xor r15d, r15d
cmp al, 0xd
je 0x140105cc0
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x140105c70
test rdi, rdi
je 0x140105c50
mov rdx, rsi
mov rcx, rdi
call fcn.1401bf070
test r12d, r12d
jne 0x140105d80
test ebx, ebx
je 0x140105c17
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x140105c03
cmp rdi, rax
je 0x140105bf6
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1401bf070
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.1401bf070
movsxd rdx, ebx
mov r9, rsi
mov r8d, 1
mov rcx, r13
call sub.msvcrt.dll_fwrite
mov rcx, qword [rsp + 0x38]
mov rdx, rsi
call fcn.1401bf070
test r15d, r15d
jne 0x140105d08
test r14d, r14d
jne 0x140105d1e
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r12d, r12d
jne 0x140105d68
test ebx, ebx
je 0x140105c24
cmp qword [rsp + 0x28], 0
jne 0x140105bf6
jmp 0x140105c03
xor r15d, r15d
mov r14d, 1
mov edx, dword [rbp + 0xfc]
mov ecx, 1
call fcn.1400e6d60
test eax, eax
je 0x140105bb9
mov r9, rsi
mov r8d, 4
mov edx, 1
lea rcx, str.e_7m
call sub.msvcrt.dll_fwrite
test rdi, rdi
jne 0x140105bc2
test r12d, r12d
jne 0x140105dd0
test ebx, ebx
jne 0x140105c5d
jmp 0x140105c17
sub ebx, 1
mov eax, ebx
or eax, r12d
je 0x140105d08
mov eax, dword [rsp + 0x34]
mov r15d, 1
test eax, eax
je 0x140105bb9
jmp 0x140105c70
sub ebx, 1
je 0x140105d90
movzx eax, byte [r13 + rdx - 2]
mov r14d, 1
xor r15d, r15d
cmp al, 0xd
jne 0x140105bad
jmp 0x140105cc0
mov rdx, rsi
mov ecx, 0xd
call sub.msvcrt.dll_fputc
test r14d, r14d
je 0x140105c36
mov rdx, rsi
mov ecx, 0xa
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sub.msvcrt.dll_fputc
mov eax, ebx
xor r15d, r15d
xor r14d, r14d
or eax, r12d
je 0x140105c36
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x140105bb9
jmp 0x140105c70
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll_fputc
jmp 0x140105c59
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll_fputc
jmp 0x140105bd6
test r12d, r12d
je 0x140105d1e
mov edx, dword [rsp + 0x34]
test edx, edx
jne 0x140105c67
test rdi, rdi
je 0x140105de0
mov rdx, rsi
mov rcx, rdi
xor r15d, r15d
mov r14d, 1
call fcn.1401bf070
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll_fputc
jmp 0x140105c17
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll_fputc
jmp 0x140105cb4
mov rdx, rsi
mov ecx, r12d
call sub.msvcrt.dll_fputc
jmp 0x140105d1e
Function at 0x140105df0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
movsxd rax, dword [rsp + 0xc0]
mov ebp, dword [rsp + 0xd8]
mov r13, qword [rsp + 0xc8]
mov r14d, dword [rsp + 0xd0]
movsx r15d, byte [rcx + rax + 0x1cc]
mov eax, ebp
and eax, dword [rcx + 0x148]
mov r12, r8
mov rbx, rcx
mov rsi, rdx
mov rdi, r9
mov r8d, dword [rsp + 0xe0]
jne 0x140105e98
test rsi, rsi
je 0x140105f50
mov dword [rsp + 0xd8], r14d
mov r8, r12
mov rdx, rsi
mov r9d, 1
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0xc8], r15d
mov qword [rsp + 0xc0], rdi
mov rcx, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140105b10
mov edx, dword [rcx + 0xfc]
mov ecx, 1
mov dword [rsp + 0x4c], r8d
call fcn.1400e6d60
mov r8d, dword [rsp + 0x4c]
test eax, eax
je 0x140105e46
cmp byte [str.e_41m], 0
je 0x140105e46
test r8d, r8d
jne 0x140105f80
test rsi, rsi
lea rax, [0x1401e94e2]
mov dword [rsp + 0x28], r15d
mov rcx, rbx
cmove rsi, r12
mov qword [rsp + 0x30], rax
setne r9b
xor r8d, r8d
mov dword [rsp + 0x38], 0
movzx r9d, r9b
mov qword [rsp + 0x20], rdi
mov rdx, rsi
call fcn.140105b10
mov r8d, ebp
mov edx, r14d
mov rcx, r13
lea rax, str.e_41m
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xc0], r12
mov r9, qword [rbx + 0x1c0]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400a8030
mov dword [rsp + 0xd8], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0xc8], r15d
mov qword [rsp + 0xc0], rdi
jmp 0x140105e7b
mov dword [rsp + 0xd8], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.e_41m
mov qword [rsp + 0xd0], r13
mov dword [rsp + 0xc8], r15d
mov qword [rsp + 0xc0], rdi
jmp 0x140105e7b