joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002d670
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, dword [rdx]
mov r9, rcx
movabs r11, 0x100000001b3
movzx r8d, r10b
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, r10d
imul r8, r11
shr eax, 8
movzx edx, al
mov eax, r10d
xor r8, rdx
shr eax, 0x10
imul r8, r11
movzx ecx, al
mov eax, r10d
xor r8, rcx
shr rax, 0x18
mov rcx, qword [r9 + 0x30]
imul r8, r11
xor r8, rax
imul r8, r11
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r9 + 8]
je 0x14002d708
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x14002d6ff
nop dword [rax]
cmp rax, rcx
je 0x14002d708
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x14002d6f0
add rax, 0x18
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3

Function at 0x14002d720
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov r10d, dword [rdx]
mov r9, rcx
movabs r11, 0x100000001b3
movzx r8d, r10b
movabs rax, 0xcbf29ce484222325
xor r8, rax
mov eax, r10d
imul r8, r11
shr eax, 8
movzx edx, al
mov eax, r10d
xor r8, rdx
shr eax, 0x10
imul r8, r11
movzx ecx, al
mov eax, r10d
xor r8, rcx
shr rax, 0x18
mov rcx, qword [r9 + 0x30]
imul r8, r11
xor r8, rax
imul r8, r11
and rcx, r8
shl rcx, 4
add rcx, qword [r9 + 0x18]
mov rax, qword [rcx + 8]
cmp rax, qword [r9 + 8]
je 0x14002d7b8
mov rcx, qword [rcx]
cmp r10d, dword [rax + 0x10]
je 0x14002d7af
nop dword [rax]
cmp rax, rcx
je 0x14002d7b8
mov rax, qword [rax + 8]
cmp r10d, dword [rax + 0x10]
jne 0x14002d7a0
add rax, 0x14
add rsp, 0x28
ret
lea rcx, str.invalid_unordered_map_K__T__key
call sub.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_
int3
Function at 0x1400304e0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
cmp qword [rcx + 0x10], 0
jne 0x140030511
xor al, al
jmp 0x1400306dd
cmp qword [rcx + 0x18], 0xf
jbe 0x14003051b
mov rcx, qword [rcx]
test rcx, rcx
je 0x140030539
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140030539
shr eax, 4
test al, 1
je 0x140030539
mov al, 1
jmp 0x1400306dd
mov edi, 0xffffffff
cmp qword [rbx + 0x18], 0xf
jbe 0x140030548
mov rbx, qword [rbx]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], reloc.portaudio.dll_Ordinal_15
mov byte [rbp - 0x30], al
mov qword [rbp - 0x38], rax
lea r8, [rbp - 0x38]
mov rdx, qword [0x1401a6018]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
je 0x140030696
nop word [rax + rax]
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rcx + rdi], 0
jne 0x140030597
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
mov rax, r8
sub rax, rdx
cmp rdi, rax
ja 0x1400305df
lea rax, [rdx + rdi]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp r8, 0xf
cmova rbx, qword [rbp - 0x30]
add rbx, rdx
mov r8, rdi
mov rdx, rcx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x1400305f6
mov qword [rsp + 0x20], rdi
mov r9, rcx
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.14000d4f0
mov r9, qword [0x1401a6018]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140030604
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
mov rax, rdx
sub rax, rcx
cmp rbx, rax
ja 0x14003064d
lea rax, [rbx + rcx]
mov qword [rbp - 0x20], rax
lea rdi, [rbp - 0x30]
cmp rdx, 0xf
cmova rdi, qword [rbp - 0x30]
add rdi, rcx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x140030661
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.14000d4f0
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rcx, qword [rbp - 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov edi, eax
lea r8, [rbp - 0x38]
mov rdx, qword [0x1401a6018]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok_s]
mov rcx, rax
test rax, rax
jne 0x140030590
cmp edi, 0xffffffff
setne bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x1400306da
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400306d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400306d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fcffc
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400fd350
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400312e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rax, r8
mov rdi, rcx
test r8, r8
jne 0x140031336
mov rcx, qword [rcx + 0x80]
lea r9, str.toFile
mov edx, ebx
lea r8, [rcx + 0xa0]
call fcn.140027ba0
test al, al
je 0x1400313f6
mov rcx, qword [rdi + 0x80]
mov edx, ebx
call fcn.1400310c0
test rax, rax
je 0x1400313f6
lea rcx, [rax + 0x10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
movabs rcx, 0x100000001b3
movzx edx, bl
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movzx eax, byte [rsp + 0x39]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3a]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x3b]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [rdi + 0x270]
and rcx, rdx
mov rdx, qword [rdi + 0x248]
shl rcx, 4
add rcx, qword [rdi + 0x258]
mov rax, qword [rcx + 8]
cmp rax, rdx
je 0x1400313c0
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x1400313c2
nop
cmp rax, rcx
je 0x1400313c0
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x1400313b0
jmp 0x1400313c2
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x1400313d5
mov dword [rax + 0x14], 0
mov r8, qword [0x1401ac660]
test r8, r8
je 0x1400313f6
mov rcx, qword [rdi + 0x80]
add r8, 0xe8
mov edx, ebx
call fcn.140037b70
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140031410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, rdx
mov rdi, rcx
call qword [rax + 0x58]
cmp qword [rbx + 0x18], 0xf
mov rdx, rbx
mov r8, qword [rbx + 0x10]
mov rsi, rax
jbe 0x14003143f
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140031473
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x140031460
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000bb60
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x140031490
mov rbx, qword [rsi + 8]
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x58]
cmp rbx, qword [rax + 8]
jne 0x1400314b1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140031bd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
lea rdi, [0x1401ac688]
mov rsi, r8
mov rbx, rcx
xor ebp, ebp
mov rdx, rdi
mov rcx, rax
lea r8d, [rbp + 0x32]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rbp
test rdi, rdi
je 0x140031c3e
cmp byte [rdi], bpl
je 0x140031c3e
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
nop dword [rax]
inc r8
cmp byte [rdi + r8], bpl
jne 0x140031c30
mov rdx, rdi
jmp 0x140031c61
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
inc r8
cmp byte [rsi + r8], bpl
jne 0x140031c55
mov rdx, rsi
mov rcx, rbx
call fcn.14000a280
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140031f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rbp, rcx
call fcn.140032100
mov rdx, qword [rsi]
mov rax, qword [rdx + 0x58]
mov edx, dword [rdx]
mov rcx, qword [rax + 0x80]
call fcn.140031150
mov r10, rax
mov r8, qword [rax + 0x10]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140031fcf
mov rdx, qword [rax]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140032003
movabs r11, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r8
jb 0x140031ff0
mov r8, r10
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x60]
call fcn.14000bb60
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x140032021
mov rbx, qword [rbp + 0x68]
mov rbx, qword [rbx + 0x30]
mov qword [rsp + 0x20], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x1400320f3
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x1400320e3
mov qword [rbp + 0xf0], rsi
mov r8, qword [rsi]
mov rax, qword [r8 + 0x58]
mov rcx, qword [rax + 0x290]
mov rax, qword [rcx]
cmp dword [rsi + 8], 2
sete r9b
lea rdx, [rsp + 0x38]
call qword [rax + reloc.portaudio.dll_Ordinal_8]
nop
mov rdx, rax
mov rcx, rbp
call fcn.140030b90
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400320be
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400320b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400320b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fcffc
nop
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_unlock
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140032100
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rdi, rdx
mov r15, rcx
lea rbx, [rcx + 0xa0]
mov qword [rsp + 0x28], rbx
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_lock
test eax, eax
jne 0x140032364
mov eax, dword [rbx + 0x4c]
cmp eax, 0x7fffffff
je 0x140032354
mov rdx, qword [rdi]
mov rax, qword [rdx + 0x58]
mov edx, dword [rdx]
mov rcx, qword [rax + 0x80]
call fcn.140031150
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140012450
nop
lea r13, [r15 + 0x60]
lea r8, [rsp + 0x40]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x1400321d4
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x1400321c0
mov rcx, qword [r15 + 0x90]
and rcx, rdx
add rcx, rcx
mov rax, qword [r15 + 0x78]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r15 + 0x68]
cmp rdi, r12
je 0x14003223f
mov r15, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140032212
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x140032230
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14003223b
cmp rdi, r15
je 0x14003223f
mov rdi, qword [rdi + 8]
jmp 0x140032200
xor esi, esi
jmp 0x140032243
xor esi, esi
mov edi, esi
mov rax, r12
test rdi, rdi
cmovne rax, rdi
cmp rax, r12
jne 0x1400322e6
mov ecx, 0x50
call fcn.1400fcfc0
mov rdi, rax
test rax, rax
je 0x14003229a
mov dword [rax], esi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
vpxor xmm0, xmm0, xmm0
vmovups ymmword [rax + 0x18], ymm0
vmovups xmmword [rax + 0x38], xmm0
mov qword [rax + 0x48], 0
mov edx, 0x102
mov rcx, rax
vzeroupper
call sub.MSVCP140.dll__Mtx_init_in_situ
jmp 0x14003229d
mov rdi, rsi
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140012450
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x80], rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.140026320
nop
lea rcx, [rsp + 0x60]
call fcn.14002b020
nop
mov r14, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x40]
cmp r14, 0xf
jbe 0x140032321
lea rdx, [r14 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140032318
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032318
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.1400fcffc
nop
mov rcx, rbx
call sub.MSVCP140.dll__Mtx_unlock
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
dec eax
mov dword [rbx + 0x4c], eax
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
mov ecx, 5
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140032f90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x140032fbd
xor eax, eax
jmp 0x140033126
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140032ffd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140032ffd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14003311e
cmp qword [rdi + 0x80], 0
je 0x140033119
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140033037
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140033062
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14003311e
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400330d1
sub eax, 1
je 0x1400330d1
cmp eax, 2
jne 0x140033119
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14003311e
mov rbx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1400330ff
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140033119
lea rax, [rsp + 0x40]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14003311e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400fd350
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140035990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401a6c00]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
lea rdi, [0x1401ac688]
mov rdx, rdi
lea rcx, str.TERM
lea r8d, [rbx + 0x32]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
cmove rdi, rbx
test rdi, rdi
je 0x140035a17
cmp byte [rdi], bl
je 0x140035a17
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rbx
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x40], rbx
inc r8
cmp byte [rdi + r8], bl
jne 0x1400359f5
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.14000a280
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
jmp 0x140035a34
vpxor xmm0, xmm0, xmm0
mov edi, reloc.portaudio.dll_Ordinal_15
mov qword [rsp + 0x38], rbx
vmovups xmmword [rsp + 0x28], xmm0
mov byte [rsp + 0x28], bl
mov qword [rsp + 0x40], rdi
mov rsi, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
cmp rdi, 0xf
cmova rcx, rsi
cmp rbx, 5
jne 0x140035a63
mov r8, rbx
lea rdx, str.xterm
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xb
jne 0x140035a8d
mov r8, rbx
lea rdx, str.xterm_color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xe
jne 0x140035ab7
mov r8, rbx
lea rdx, str.xterm_256color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 6
jne 0x140035add
mov r8, rbx
lea rdx, str.screen
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 5
jne 0x140035b03
mov r8, rbx
lea rdx, str.linux
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 6
jne 0x140035b29
mov r8, rbx
lea rdx, str.cygwin
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140035b4f
cmp rdi, 0xf
lea rcx, [rsp + 0x28]
cmova rcx, rsi
cmp rbx, 0xf
jne 0x140035b53
mov r8, rbx
lea rdx, str.screen_256color
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140035b53
mov bl, 1
jmp 0x140035b55
xor bl, bl
cmp rdi, 0xf
jbe 0x140035b8f
lea rdx, [rdi + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140035b87
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140035b87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400fcffc
movzx eax, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400fd350
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400365b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140031410
mov rsi, rax
test rax, rax
je 0x1400366c0
mov r8, qword [rbx]
mov rcx, rbx
mov qword [rsp + 0x40], rbp
call qword [r8 + 0x58]
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
mov r8, qword [rdi + 0x10]
mov rbp, rax
jbe 0x1400365f9
mov rdx, qword [rdi]
xor ecx, ecx
movabs rbx, 0xcbf29ce484222325
test r8, r8
je 0x140036633
movabs r9, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor rbx, rax
imul rbx, r9
cmp rcx, r8
jb 0x140036620
mov r9, rbx
lea rdx, [rsp + 0x20]
mov r8, rdi
mov rcx, rbp
call fcn.14000bb60
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400366ad
mov r8, qword [rbp + 0x30]
and r8, rbx
shl r8, 4
add r8, qword [rbp + 0x18]
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x140036683
cmp rax, rdx
jne 0x140036679
mov rax, qword [rbp + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x14003668e
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
jmp 0x14003668e
cmp rax, rdx
jne 0x14003668e
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
lea rcx, [rbp + 8]
dec qword [rcx + 8]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.140025760
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + 0x18]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140037c00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x140037c31
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x140037c4f
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x30], rbx
mov rbx, rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x140037c99
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x140037d11
mov rcx, rbp
call fcn.14002d340
cmp rbx, 0xfff
jbe 0x140037cf1
nop word [rax + rax]
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140037d32
cmp rbx, rax
ja 0x140037cc0
test rdi, rdi
je 0x140037d11
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
sub rsi, rbx
jmp 0x140037d14