joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140077a30
Capabilities:
Check for software breakpoints
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1cb8
call fcn.140388170
sub rsp, rax
movaps xmmword [rsp + 0x1ca0], xmm11
movaps xmmword [rsp + 0x1c90], xmm10
movaps xmmword [rsp + 0x1c80], xmm9
movaps xmmword [rsp + 0x1c70], xmm8
movaps xmmword [rsp + 0x1c60], xmm7
movdqa xmmword [rsp + 0x1c50], xmm6
mov rsi, rdx
mov qword [rsp + 0x100], rcx
movzx eax, byte [r8 + 0x16]
mov byte [rsp + 0x5f], al
mov rax, qword [r8]
mov rcx, qword [r8 + 8]
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x2a0], rax
lea rax, [rax + 8]
mov qword [rsp + 0x290], rax
movzx eax, byte [r8 + 0x15]
mov byte [rsp + 0x5e], al
movzx eax, byte [r8 + 0x13]
mov byte [rsp + 0x47], al
movzx eax, byte [r8 + 0x14]
mov byte [rsp + 0x35], al
movzx eax, byte [r8 + 0x10]
mov byte [rsp + 0x5d], al
movzx eax, byte [r8 + 0x11]
mov byte [rsp + 0x37], al
pxor xmm6, xmm6
movaps xmm7, xmmword [0x140397b00]
movss xmm8, dword [0x140397b10]
movdqa xmm9, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmm10, xmmword [0x140397830]
movdqa xmm11, xmmword [0x140397ce0]
mov qword [rsp + 0x178], rdx
Function at 0x14007cc70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14007cd06
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x140397830]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14005f6c0
test rdi, rdi
je 0x14007cd95
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14007cdae
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14007cea6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14007cf28
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14007ceb3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14007cd70
cmp r9, 8
jae 0x14007cebc
jmp 0x14007cf28
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14005f6c0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14007cf28
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14007cf28
mov r8, rcx
cmp r9, 8
jb 0x14007cf28
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14007cec0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140081840
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
movdqa xmmword [rsp + 0x2b0], xmm15
movdqa xmmword [rsp + 0x2a0], xmm14
movdqa xmmword [rsp + 0x290], xmm13
movdqa xmmword [rsp + 0x280], xmm12
movdqa xmmword [rsp + 0x270], xmm11
movdqa xmmword [rsp + 0x260], xmm10
movdqa xmmword [rsp + 0x250], xmm9
movdqa xmmword [rsp + 0x240], xmm8
movdqa xmmword [rsp + 0x230], xmm7
movaps xmmword [rsp + 0x220], xmm6
mov qword [rsp + 0x200], rcx
mov rax, qword [rsp + 0x338]
mov rcx, qword [rsp + 0x330]
mov qword [rsp + 0x110], r9
mov qword [rcx + 0x10], 0
mov dword [rsp + 0x100], 0
mov qword [rsp + 0xf8], 0
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x1f8], rax
add r8, rdx
xorps xmm6, xmm6
movups xmmword [rsp + 0x15a], xmm6
movzx eax, word [rsp + 0x168]
mov word [rsp + 0xde], ax
movups xmm0, xmmword [rsp + 0x158]
movups xmmword [rsp + 0xce], xmm0
movups xmmword [rsp + 0x11b], xmm6
mov byte [rsp + 0x12b], 0
mov qword [rsp + 0x48], 0
lea r13, [rsp + 0x58]
mov dword [rsp + 0x58], 0
mov word [rsp + 0x5c], 0
add dh, al
and al, 0x60
add bh, al
and al, 0x64
add byte [rax], al
add byte [rax], al
Function at 0x14009a100
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r14, rcx
mov rax, qword [rcx]
test byte [rax + 0x71], 1
jne 0x14009a156
lea rax, [r14 + 8]
mov qword [rsp + 0x80], rax
mov rax, qword [r14 + 8]
lea rdi, [rax + 0x48]
lea rbx, [rax + 0x58]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rax + 0x58]
sub rcx, rdx
cmp rcx, 0xc
jb 0x14009af1a
mov rax, qword [rdi]
mov esi, 0xc
jmp 0x14009a1ad
mov rax, qword [rax + 0x178]
mov rax, qword [rax + 0x160]
lea rax, [rax + rax*2]
lea rsi, [rax*2 + 0xc]
lea rax, [r14 + 8]
mov qword [rsp + 0x80], rax
mov rax, qword [r14 + 8]
lea rdi, [rax + 0x48]
lea rbx, [rax + 0x58]
mov rcx, qword [rax + 0x50]
mov rdx, qword [rax + 0x58]
sub rcx, rdx
cmp rcx, rsi
jb 0x14009af1f
test rsi, rsi
je 0x14009a1ff
mov rax, qword [rdi]
mov rcx, rsi
cmp rsi, 8
jb 0x14009a1f0
mov r8, rsi
and r8, 0xfffffffffffffff8
mov ecx, esi
and ecx, 7
lea r9, [rax + rdx*4]
add r9, 0x10
add rdx, r8
xor r10d, r10d
movaps xmm0, xmmword [0x140397aa0]
nop
movups xmmword [r9 + r10*4 - 0x10], xmm0
movups xmmword [r9 + r10*4], xmm0
add r10, 8
cmp r8, r10
jne 0x14009a1d0
cmp rsi, r8
je 0x14009a1ff
nop dword [rax]
mov dword [rax + rdx*4], 0x80000000
inc rdx
dec rcx
jne 0x14009a1f0
mov qword [rbx], rdx
call fcn.1400998f0
lock inc qword [rax]
jle 0x14009af54
mov rbx, rax
mov rdi, rdx
mov r12, qword [r14]
mov r15, qword [r14 + 8]
mov rax, qword [r15 + 0x58]
mov rdx, qword [r15 + 0x70]
mov r8, rdx
shl r8, 4
mov rcx, qword [r15 + 0x90]
lea r9, [rcx + rcx*4]
add rax, qword [r15 + 0x40]
add rax, qword [r15 + 0xb8]
add rax, qword [r15 + 0xd0]
add rax, qword [r15 + 0xf0]
add rax, qword [r15 + 0x108]
movzx ecx, byte [r12 + 0x180]
mov r10d, 4
shl r10, cl
add rax, qword [r15 + 0x120]
lea rcx, [rdi + r8]
add rcx, 0x24
lea rcx, [rcx + r9*4]
add rcx, qword [r15 + 0x138]
add rcx, qword [r15 + 0x148]
lea rax, [rcx + rax*4]
add rax, r10
cmp rax, qword [r12 + 0x2a8]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rbx
jbe 0x14009a318
cmp dword [r12 + 0x38], 1
jne 0x14009a310
mov rax, qword [r15 + 0x150]
cmp rax, qword [r12 + 0x40]
mov esi, 0xc
mov rcx, rdi
mov r8, rsi
call fcn.14038e990
mov rdx, qword [rbx]
mov rax, qword [rdi]
mov rcx, rsi
cmp rsi, 8
jb 0x14009a1f0
jmp 0x14009a1ad
Function at 0x14009d900
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov r12, r9
mov rbx, r8
mov r10, rdx
mov r13, rcx
mov rdi, qword [r9 + 0x18]
test rdi, rdi
je 0x14009d9d0
lea rax, [rdi - 1]
cmp qword [r12 + 0x10], rax
jbe 0x14009d9d0
mov rcx, qword [r12 + 8]
test rcx, rcx
je 0x14009d9d0
movzx eax, byte [rcx + rax]
movzx r15d, al
mov edx, dword [r12]
mov r8d, dword [r12 + 4]
mov rax, qword [r10 + 0x290]
or rax, qword [r10 + 0x2a0]
mov rcx, qword [r10 + 0x288]
or rcx, qword [r10 + 0x298]
or rcx, rax
je 0x14009d9e6
lea rax, [r10 + 0x288]
mov r9d, r15d
shr r9d, 7
shl r9, 4
mov rsi, r10
mov r10d, 1
xor r11d, r11d
mov ecx, r15d
shld r11, r10, cl
shl r10, cl
xor ecx, ecx
test r15b, 0x40
cmovne r11, r10
cmovne r10, rcx
and r11, qword [rax + r9 + 8]
and r10, qword [rax + r9]
or r10, r11
mov r10, rsi
je 0x14009d9e6
shl r15, 0x20
mov esi, 4
jmp 0x14009dcf6
mov edx, dword [r12]
mov r8d, dword [r12 + 4]
mov r9b, 2
movzx ecx, r9b
test edx, edx
jne 0x14009d9f4
jmp 0x14009da01
movzx r9d, byte [r10 + r15 + 0x78]
movzx ecx, r9b
test edx, edx
je 0x14009da01
cmp edx, 1
jne 0x14009dcdf
add rcx, 6
mov rax, qword [rbx + 0x58]
cmp rcx, rax
jae 0x14009de6f
mov rax, qword [rbx + 0x48]
mov r15d, dword [rax + rcx*4]
shl r15, 0x20
js 0x14009df24
mov qword [rsp + 0x30], r13
shr r15, 0x20
mov r11, qword [r12 + 0x10]
mov r13, qword [r12 + 0x20]
cmp rdi, r13
jae 0x14009dbf2
mov rsi, qword [r12 + 8]
mov rax, qword [r10 + 0x178]
mov qword [rsp + 0xa0], rax
mov rax, qword [r10 + 0x180]
and eax, 0x3f
mov qword [rsp + 0x98], rax
movzx eax, byte [r12 + 0x28]
mov byte [rsp + 0x2f], al
xor ebp, ebp
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r11
jmp 0x14009da8c
xor ebp, ebp
cmp r13, r11
jae 0x14009dd80
test byte [r10 + 0x71], 1
mov r15d, r8d
jne 0x14009de42
invalid
shl r15, 0x20
mov rax, qword [r10 + 0x178]
cmp qword [rax + 0x160], r15
jbe 0x14009def6
lea rax, [r15 + r15*2]
lea rcx, [rcx + rax*2]
add rcx, 0xc
mov rax, qword [rbx + 0x58]
cmp rcx, rax
jb 0x14009da0e
lea r8, str.C:Users_rosesxrq.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srchybriddfa.rs
mov rdx, rax
call fcn.1403897b0
ud2
mov rcx, qword [r10 + 0x180]
and ecx, 0x3f
mov r15d, 1
shl r15, cl
cmp rcx, 0x1b
jae 0x14009e262
or r15d, 0x40000000
shl r15, 0x20
jns 0x14009da20
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x40]
mov rsi, r10
call fcn.14038db30
mov r10, rsi
movabs r15, 0xffffffff00000000
and r15, rax
mov esi, eax
cmp rsi, 5
je 0x14009da20
jmp 0x14009dcf6

Function at 0x1400b2440
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
push rdi
ror byte [rdi], 0x29
and al, 0x20
Function at 0x1400b6740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rsp + 0x168]
mov rdx, qword [rsp + 0x160]
movzx ecx, byte [rdi + 0x15]
xor eax, eax
cmp cl, 3
cmovne eax, ecx
sar dword [r9 + rax], 0xf
test byte [rcx + 1], bl
add byte [rax], al
test ebx, ebx
je 0x1400b6794
Function at 0x1400bd3a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xd8
mov r15, rdx
mov rdi, rcx
mov rbp, qword [rdx + 8]
mov rbx, qword [r8]
mov r14, qword [r8 + 0x10]
test r14, r14
je 0x1400bd552
lea rcx, [r14*8]
movabs rax, 0xcbf29ce484222325
xor edx, edx
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx r10d, byte [rbx + rdx + 4]
xor r10, rax
imul r10, r9
movzx r11d, byte [rbx + rdx + 5]
xor r11, r10
imul r11, r9
mov eax, dword [rbx + rdx]
xor rax, r11
imul rax, r9
add rdx, 8
cmp rcx, rdx
jne 0x1400bd3f0
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x1400bd569
xor edx, edx
div rcx
mov rax, qword [rbp]
mov rsi, rdx
shl rsi, 5
movzx ecx, word [rax + rsi + 0x1c]
cmp cx, word [rbp + 0x20]
jne 0x1400bd4d9
lea rcx, [rax + rsi]
cmp qword [rcx + 0x10], r14
jne 0x1400bd4d9
test r14, r14
je 0x1400bd4bc
mov rcx, qword [rcx]
movzx r9d, byte [rcx + 4]
cmp r9b, byte [rbx + 4]
jne 0x1400bd6ed
mov r9d, 1
xor r12d, r12d
nop word [rax + rax]
movzx r10d, byte [rcx + r9*8 - 3]
cmp r10b, byte [rbx + r9*8 - 3]
jne 0x1400bd4b6
mov r10d, dword [rcx + r9*8 - 8]
cmp r10d, dword [rbx + r9*8 - 8]
jne 0x1400bd4b6
cmp r9, r14
setae r12b
je 0x1400bd4b6
movzx r10d, byte [rcx + r9*8 + 4]
lea r11, [r9 + 1]
cmp r10b, byte [rbx + r9*8 + 4]
mov r9, r11
je 0x1400bd480
test r12b, 1
je 0x1400bd4d9
mov eax, dword [rax + rsi + 0x18]
mov dword [rdi + 4], eax
mov dword [rdi], 0x2a
cmp qword [r8 + 8], 0
jne 0x1400bd6b2
jmp 0x1400bd6d8
mov r15, qword [r15]
test r14, r14
je 0x1400bd583
mov rax, r14
shr rax, 0x3c
jne 0x1400bd6fd
lea r12, [r14*8]
test r12, r12
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rdx
je 0x1400bd595
movzx eax, byte [0x1404a3530]
mov rcx, qword [0x1404a3498]
test rcx, rcx
jne 0x1400bd539
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400bd712
mov rcx, rax
mov qword [0x1404a3498], rax
invalid
xor edx, edx
mov r8, r12
movabs rax, 0xcbf29ce484222325
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jne 0x1400bd42a
lea rcx, str.attempt_to_calculate_the_remainder_with_a_divisor_of_zerocannot_build_lazy_DFAs_for_regexes_with_Unicode_word_boundaries__switch_to_ASCII_word_boundaries__or_heuristically_enable_Unicode_word_boundaries_or_use_a_different_regex_engineC:Users_rosesxrq.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_srcmetalimited.rs
lea r8, str.C:Users_rosesxrq.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_automata_0.4.3_src_nfa_thompsonmap.rs
mov edx, 0x39
call fcn.1403898b0
ud2
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea r12, [r14*8]
mov r13d, 4
mov r15, qword [r15]
mov rax, r14
shr rax, 0x3c
cmp al, 0xf
test ch, dh
std
invalid
invalid
call fcn.14004e290
ud2
Function at 0x1400c4cc0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rsi, qword [r9 + 0x18]
mov r14, qword [r9 + 0x20]
cmp rsi, r14
jbe 0x1400c4cec
mov qword [rcx], 0
jmp 0x1400c5f43
mov r13, r9
mov rdi, r8
mov rbx, rdx
cmp byte [r9 + 0x28], 0
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x30], ecx
Function at 0x1400f4300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x710
mov r9, r8
mov r8, rdx
mov rsi, rcx
xor eax, eax
cmp r9, 0x1f5
adc al, 1
add dword [rax - 0x39], ecx
test byte [rax + rbx*4], ah
add byte [rax], al
add byte [rbx], al
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + rdx*4], ah
add byte [rax], al
add byte [rdx], al
add byte [rax], al
add dh, al
test byte [rax + rbp*4], ah
add byte [rax], al
add byte [rcx], al

Function at 0x1400f64a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1c0
movaps xmmword [rsp + 0x1b0], xmm6
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400f5980
mov dword [rsp + 0x130], eax
cmp eax, 0x5c
jne 0x1400f6fdb
mov r15, qword [rdi]
lea r14, [r15 + 0xa0]
mov rax, qword [r15 + 0xb0]
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [r15 + 0xa0]
movaps xmmword [rsp + 0x20], xmm0
mov rcx, rdi
call fcn.1400f6370
test al, al
je 0x1400f6590
mov rcx, rdi
call fcn.1400f5980
mov ebx, eax
and eax, 0x1ffff8
cmp eax, 0x30
jne 0x1400f6627
cmp byte [r15 + 0xc1], 0
je 0x1400f6783
push rsi
add al, byte [rax]
invalid
lea rcx, [rsp + 0xb0]
mov rdx, rdi
call fcn.140101130
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xc0], rax
and al, 0xc0
add byte [rax], al
add byte [rdi], cl
sub byte [rsp + 0x20], al
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0xd8], rax
movups xmm0, xmmword [r14]
mov eax, ebx
and eax, 0x1ffffe
cmp eax, 0x38
jne 0x1400f66f6
cmp byte [r15 + 0xc1], 0
je 0x1400f68d9
lea eax, [rbx - 0x44]
cmp eax, 0x34
xor al, 0xf
xchg dword [rbx - 1], eax
invalid
invalid
movabs rcx, 0x8800100088001
bt rcx, rax
bt ecx, eax
lea rcx, [rsp + 0xb0]
mov rdx, rdi
call fcn.1400f6280
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x140], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x130], xmm0
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x158], rax
movups xmm0, xmmword [rsp + 0xc8]
movups xmmword [rsp + 0x148], xmm0
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x10]
test rdi, rdi
je 0x1400f693d
js 0x1400f6936
lea rcx, [rsp + 0xb0]
mov rdx, rdi
call fcn.1400f6280
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x140], eax
mov qword [rsp + 0xb0], 0
lea rdx, [0x1404364d8]
lea r9, str.C:Users_rosesxrq.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_syntax_0.8.2_src_astparse.rs
lea rcx, [rsp + 0x130]
lea r8, [rsp + 0xb0]
call fcn.140390550
ud2
Function at 0x1400fa7c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov r15, qword [rdx]
cmp qword [r15 + 0x80], 0
jne case.0x1400f898a.50
mov rbx, rdx
mov rsi, rcx
mov qword [r15 + 0x80], 0xffffffffffffffff
lea rax, [r15 + 0x88]
mov qword [rsp + 0x20], rax
mov qword [r15 + 0x98], 0
mov rdi, qword [rdx + 0x10]
lea r14, [r15 + 0xa0]
cmp qword [r15 + 0xa0], rdi
jne 0x1400fa85d
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0x70], rax
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x60], xmm0
jmp 0x1400fa8d6
movzx eax, al
lea rcx, [0x140435400]
test byte [rax + rcx], 1
je 0x1400fa8b8
nop word [rax + rax]
mov rcx, rbx
call fcn.1400f6370
cmp qword [r14], rdi
je 0x1400fa8b8
mov rcx, rbx
call fcn.1400f5980
lea ecx, [rax - 9]
cmp ecx, 5
stc
invalid
jb 0x1400fa850
cmp eax, 0x20
je 0x1400fa850
cmp eax, 0x80
jb 0x1400fa8b8
mov ecx, eax
shr ecx, 8
cmp ecx, 0x1f
jg 0x1400fa895
test ecx, ecx
je 0x1400fa837
cmp ecx, 0x16
jne 0x1400fa8b8
cmp eax, 0x1680
je 0x1400fa850
jmp 0x1400fa8b8
cmp ecx, 0x20
je 0x1400fa8a8
cmp ecx, 0x30
jne 0x1400fa8b8
invalid
cmp eax, 0x3000
je 0x1400fa850
jmp 0x1400fa8b8
movzx eax, al
lea rcx, [0x140435400]
test byte [rax + rcx], 2
jne 0x1400fa850
mov rax, qword [r14]
mov rcx, qword [r14 + 0x10]
mov qword [rsp + 0x70], rcx
movups xmm0, xmmword [r14]
movaps xmmword [rsp + 0x60], xmm0
cmp rax, rdi
jne 0x1400fa959
mov rax, qword [r14 + 0x10]
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [r14]
movups xmmword [rsp + 0x98], xmm0
movaps xmm0, xmmword [rsp + 0x60]
movaps xmmword [rsp + 0x80], xmm0
test byte [rax + rax*4], ah
add byte [rax], al
add byte [rax - 0x75], cl
and al, 0x70
mov qword [rsp + 0x90], rax

Function at 0x1400fd6e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400f5980
cmp eax, 0x5c
jne 0x1400fd70c
mov rcx, rsi
mov rdx, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.1400f64a0
lea rcx, [rsi + 8]
mov rdx, rdi
call fcn.1400f6280
mov rcx, rdi
call fcn.1400f5980
mov ebx, eax
mov rcx, rdi
call fcn.1400f6370
mov dword [rsi + 0x38], ebx
mov byte [rsi + 0x3c], 0
mov byte [rsi + 0x70], 2
mov dword [rsi], 0x22
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret

Function at 0x1400fdc30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x208
mov r14, rdx
mov rsi, rcx
mov rcx, rdx
call fcn.1400f5980
mov dword [rsp + 0xf0], eax
cmp eax, 0x28
jne 0x1400fe701
lea rcx, [rsp + 0xc0]
mov rdx, r14
call fcn.1400f6280
mov rcx, r14
call fcn.1400f6370
mov rcx, r14
call fcn.1400f5600
mov r15, qword [r14]
mov rbx, qword [r14 + 8]
mov rdi, qword [r14 + 0x10]
mov r8, qword [r15 + 0xa0]
add byte [rax], al
mov qword [rsp + 0x30], 0
lea rdx, [0x1403d2570]
lea r9, str.C:Users_rosesxrq.cargo_registry_srcindex.crates.io_6f17d22bba15001f_regex_syntax_0.8.2_src_astparse.rs
lea rcx, [rsp + 0xf0]
lea r8, [rsp + 0x30]
call fcn.140390550
ud2
Function at 0x1400ffa50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rdx
mov rsi, rcx
mov esi, ecx
Function at 0x14002943c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001cb04
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001cb04
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14002958c
cmp rax, 0xffffffffffffffff
je 0x14002958c
xor edi, edi
test rbp, rbp
jle 0x140029537
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001f430
mov rbx, rax
test rax, rax
jne 0x1400294c4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14002952d
mov edx, 0x8000
mov ecx, r14d
call fcn.14001a438
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001d7e0
cmp eax, 0xffffffff
je 0x14002950d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400294d4
mov edx, r15d
mov ecx, r14d
call fcn.14001a438
jmp 0x14002952d
cmp byte [rsi + 0x38], dil
je 0x140029524
cmp dword [rsi + 0x34], 5
jne 0x140029524
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14002952d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001b1cc
jmp 0x1400295a0
jns 0x1400295a0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001cb04
cmp rax, 0xffffffffffffffff
jne 0x140029558
cmp byte [rsi + 0x30], dil
je 0x1400295a0
mov edi, dword [rsi + 0x2c]
jmp 0x1400295a0
mov ecx, r14d
call fcn.1400188f4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400295a0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400295a0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140029599
mov eax, dword [rsi + 0x2c]
jmp 0x14002959e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001cb04
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001f18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001f62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001f62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001f62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001f62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001f62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001f64
xor al, al
add rsp, 0x28
ret
Function at 0x140003b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140003b94
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140003b80
ret