joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003bc90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.14003b7f0
test eax, eax
jne 0x14003bce2
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14003bcf3
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1401d0f97]
call fcn.1400a08a0
call fcn.1401be670
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x14003bdc6
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.14003b1a0
lea rax, [rdi + 4]
lea rdx, [0x1401d1090]
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400a7700
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14003bdda
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.14003b100
mov rcx, rax
call fcn.1400a08a0
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov qword [0x1401c08c8], 0
mov qword [rsp + 0x60], r8
mov rsi, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401c08d0]
cmp rax, qword [0x140207c90]
je 0x14003be70
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x1401d0f96]
lea rcx, [0x1401c08c0]
mov qword [rsp + 0x20], r9
call fcn.14003b630
mov r8, qword [0x1401c08c8]
mov rdx, qword [0x1401c08d0]
mov rcx, rsi
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x14003be7a
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x14003be22
call fcn.14003b120
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.14003b1a0
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400a7700
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400a7730
Function at 0x14003bd00
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.14003b7f0
test eax, eax
jne 0x14003bce2
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14003bcf3
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1401d0f97]
call fcn.1400a08a0
call fcn.1401be670
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x14003bdc6
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.14003b1a0
lea rax, [rdi + 4]
lea rdx, [0x1401d1090]
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400a7700
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14003bdda
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.14003b100
mov rcx, rax
call fcn.1400a08a0
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov qword [0x1401c08c8], 0
mov qword [rsp + 0x60], r8
mov rsi, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401c08d0]
cmp rax, qword [0x140207c90]
je 0x14003be70
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x1401d0f96]
lea rcx, [0x1401c08c0]
mov qword [rsp + 0x20], r9
call fcn.14003b630
mov r8, qword [0x1401c08c8]
mov rdx, qword [0x1401c08d0]
mov rcx, rsi
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x14003be7a
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x14003be22
call fcn.14003b120
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.14003b1a0
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400a7700
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400a7730
Function at 0x14003bde0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.14003b7f0
test eax, eax
jne 0x14003bce2
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14003bcf3
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1401d0f97]
call fcn.1400a08a0
call fcn.1401be670
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x14003bdc6
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.14003b1a0
lea rax, [rdi + 4]
lea rdx, [0x1401d1090]
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400a7700
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14003bdda
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.14003b100
mov rcx, rax
call fcn.1400a08a0
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov qword [0x1401c08c8], 0
mov qword [rsp + 0x60], r8
mov rsi, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401c08d0]
cmp rax, qword [0x140207c90]
je 0x14003be70
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x1401d0f96]
lea rcx, [0x1401c08c0]
mov qword [rsp + 0x20], r9
call fcn.14003b630
mov r8, qword [0x1401c08c8]
mov rdx, qword [0x1401c08d0]
mov rcx, rsi
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x14003be7a
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x14003be22
call fcn.14003b120
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.14003b1a0
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400a7700
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400a7730
Function at 0x14003be80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rax, qword [0x140207c90]
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call fcn.14003b7f0
test eax, eax
jne 0x14003bce2
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14003bcf3
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rsp + 0x30]
lea rcx, [0x1401d0f97]
call fcn.1400a08a0
call fcn.1401be670
nop
nop dword [rax]
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
cmp r8, 0xffec
ja 0x14003bdc6
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.14003b1a0
lea rax, [rdi + 4]
lea rdx, [0x1401d1090]
mov r9d, eax
mov ecx, eax
mov r8d, eax
and eax, 0xf
sar r9d, 4
movzx eax, byte [rdx + rax]
sar r8d, 8
and r9d, 0xf
and r8d, 0xf
sar ecx, 0xc
movzx r9d, byte [rdx + r9]
shl eax, 8
movzx r8d, byte [rdx + r8]
movsxd rcx, ecx
movzx edx, byte [rdx + rcx]
mov rcx, rbx
or eax, r9d
shl eax, 8
or eax, r8d
mov r8d, 4
shl eax, 8
or eax, edx
lea rdx, [rsp + 0x24]
mov dword [rsp + 0x24], eax
call fcn.1400a7700
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x14003bdda
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.packet_write_failed___data_exceeds_max_packet_size
call fcn.14003b100
mov rcx, rax
call fcn.1400a08a0
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [0x140207460]
mov qword [0x1401c08c8], 0
mov qword [rsp + 0x60], r8
mov rsi, rcx
mov qword [rsp + 0x68], r9
mov rax, qword [rbx]
mov qword [rsp + 0x28], rax
xor eax, eax
mov rax, qword [0x1401c08d0]
cmp rax, qword [0x140207c90]
je 0x14003be70
mov byte [rax], 0
mov r8, rdx
lea r9, [rsp + 0x60]
lea rdx, [0x1401d0f96]
lea rcx, [0x1401c08c0]
mov qword [rsp + 0x20], r9
call fcn.14003b630
mov r8, qword [0x1401c08c8]
mov rdx, qword [0x1401c08d0]
mov rcx, rsi
call fcn.1400a7700
mov rax, qword [rsp + 0x28]
sub rax, qword [rbx]
jne 0x14003be7a
add rsp, 0x38
pop rbx
pop rsi
ret
cmp byte [rax], 0
je 0x14003be22
call fcn.14003b120
call fcn.1401be670
nop
push rsi
push rbx
sub rsp, 0x28
lea rsi, str.0000
mov r8d, 1
mov edx, 4
mov rbx, rcx
mov rcx, rsi
call fcn.14003b1a0
mov rcx, rbx
mov r8d, 4
mov rdx, rsi
call fcn.1400a7700
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400a7730
Function at 0x14003dfb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor edi, edi
mov rsi, rcx
mov rcx, qword [rcx + 0x20]
mov rbp, rdx
test rcx, rcx
je 0x14003dfe0
cmp qword [rsi + 0x28], 0
je 0x14003dfe0
mov r8d, 0xa
xor edx, edx
call fcn.1400c61e0
mov rdi, rax
mov rcx, rdi
call fcn.140011ea0
mov ebx, eax
test eax, eax
jne 0x14003e030
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x14003e017
cmp qword [rsi + 0x38], 0
je 0x14003e017
xor edx, edx
mov r8d, 0xa
call sub.msvcrt.dll_strtol
lea edx, [rax + 0x7fffffff]
cmp edx, 0xfffffffd
cmovbe ebx, eax
mov r8, rbp
mov edx, ebx
mov rcx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140010000
xor ebx, ebx
xor edi, edi
jmp 0x14003e017
Function at 0x140047f60
Capabilities:
Inspect section memory permissions

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r13d, r9d
mov r12d, r9d
mov r14d, r9d
mov rdi, rcx
mov rsi, rdx
mov rbp, r8
mov ebx, r9d
and r13d, 1
and r12d, 4
and r14d, 0x20
je 0x140048038
mov eax, dword [rdx + 0x38]
test r12d, r12d
jne 0x140048010
test eax, 0x40000000
jne 0x140048020
test r13d, r13d
je 0x140048051
nop dword [rax]
test eax, 0x20000000
jne 0x140048060
mov rdx, rbp
mov rcx, rsi
call fcn.140045750
test eax, eax
jne 0x140048022
mov edx, dword [rsi + 0x34]
and edx, 0xf000
cmp edx, 0xe000
je 0x140048022
mov edx, dword [rdi + 0x30]
test edx, edx
je 0x140048022
cmp dword [rsi + 0x18], edx
jb 0x140048022
and ebx, 2
mov eax, 0x20
jne 0x140048022
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp fcn.140045920
test r13d, r13d
jne 0x140047fb0
test ah, 0x80
je 0x140047fb0
nop word [rax + rax]
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call fcn.14001d1b0
mov eax, dword [rsi + 0x38]
test r12d, r12d
jne 0x140048078
test eax, 0x40000000
jne 0x140048020
test r13d, r13d
jne 0x140048088
test ah, 0x80
jne 0x140048020
test r14d, r14d
je 0x140048088
jmp 0x140047fb0
mov eax, 0x68
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test r13d, r13d
jne 0x140048088
test ah, 0x80
jne 0x140048020
nop word [rax + rax]
test eax, 0x200000
je 0x140047fb0
xor eax, eax
jmp 0x140048022
Function at 0x14004a290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rbp, qword [0x140207460]
mov rbx, qword [rcx + 0xf0]
mov rax, qword [rbp]
mov qword [rsp + 0x98], rax
xor eax, eax
mov eax, dword [rbx + 0x14]
mov rsi, rcx
mov rdi, rdx
test eax, eax
jne 0x14004a2f8
mov eax, dword [rbx + 0xc]
test eax, eax
jle 0x14004a302
mov rdx, qword [rbx]
sub eax, 1
lea r8, [rdx + rax*8 + 8]
mov rcx, qword [rdx]
mov eax, dword [rcx + 0x34]
and eax, 0xf000
cmp eax, 0xe000
je 0x14004a330
mov eax, dword [rbx + 0x30]
test eax, eax
je 0x14004a330
cmp dword [rcx + 0x18], eax
jb 0x14004a330
mov rcx, qword [rsi + 0x78]
test byte [rbx + 0x38], 2
jne 0x14004a340
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x14004a46d
mov rcx, rdi
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.14008c560
add rdx, 8
cmp r8, rdx
jne 0x14004a2da
jmp 0x14004a302
xor edx, edx
call fcn.1400c0420
mov r12d, eax
test eax, eax
js 0x14004a302
lea rdx, [rsp + 0x20]
mov ecx, eax
call fcn.1400c1f90
test eax, eax
jne 0x14004a460
mov r13, qword [0x140207cf0]
mov r9, qword [rsp + 0x38]
mov rax, qword [r13]
mov rax, qword [rax + 0x100]
mov r8, qword [rax + 0x10]
lea rax, [r8 + 0xc]
cmp r9, rax
jb 0x14004a460
lea rdx, [rsp + 0x70]
sub r9, r8
mov ecx, r12d
call fcn.1400a6700
mov rdx, rax
mov rax, qword [r13]
mov rax, qword [rax + 0x100]
mov rax, qword [rax + 0x10]
cmp rax, rdx
jne 0x14004a460
cmp rax, 0x20
lea rcx, [rbx + 0xa0]
mov rax, qword [rbx + 0xa0]
je 0x14004a429
mov rdx, qword [rbx + 0xa8]
xor rax, qword [rsp + 0x70]
xor rdx, qword [rsp + 0x78]
or rax, rdx
jne 0x14004a460
mov eax, dword [rsp + 0x80]
cmp dword [rcx + 0x10], eax
jne 0x14004a460
mov ecx, r12d
call sub.msvcrt.dll__close
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x14004a46d
mov rcx, qword [rsi + 0xf0]
mov r8d, 1
mov rdx, rdi
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.140049b30
mov rdx, qword [rbx + 0xa8]
xor rax, qword [rsp + 0x70]
xor rdx, qword [rsp + 0x78]
or rax, rdx
jne 0x14004a460
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x18]
xor rax, qword [rsp + 0x80]
xor rdx, qword [rsp + 0x88]
or rax, rdx
je 0x14004a3ef
nop dword [rax]
mov ecx, r12d
call sub.msvcrt.dll__close
jmp 0x14004a302
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop
Function at 0x14004f820
Capabilities:
Encode data using base64

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov r12, qword [0x140207460]
mov rax, qword [r12]
mov qword [rsp + 0xb8], rax
xor eax, eax
mov rbx, rcx
lea rdi, [rsp + 0x38]
mov ecx, 0xc
mov qword [rsp + 0x34], 0
mov rsi, rdx
lea r13, [rsp + 0x20]
mov ebp, r8d
mov qword [rsp + 0x90], 0
mov edx, dword [rsp + 0x120]
rep stosq qword [rdi], rax
mov qword [rsp + 0x28], r9
mov r9, r13
mov qword [rsp + 0x20], rsi
mov rax, qword [rsp + 0x130]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
test edx, edx
je 0x14004f980
mov rcx, rbx
lea r8, [0x14004e360]
mov rdx, rsi
call qword [rax + 0x90]
mov ecx, dword [rsp + 0x34]
test ecx, ecx
je 0x14004f950
mov eax, dword [rsp + 0x40]
test eax, eax
jne 0x14004f993
mov rax, qword [rbx]
mov r9, r13
lea r8, [0x14004dcc0]
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x88]
mov eax, 1
mov rdx, qword [rsp + 0xb8]
sub rdx, qword [r12]
jne 0x14004f9be
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
and ebp, 1
jne 0x14004f9a0
mov rax, qword [0x1402078f0]
lea rcx, str.log_for__s_is_empty
mov edx, dword [rax]
test edx, edx
je 0x14004f971
call sub.libintl_8.dll_libintl_gettext
mov rcx, rax
mov rdx, rsi
call fcn.1400a08a0
nop dword [rax]
lea r8, [0x14004dc30]
mov rdx, rsi
mov rcx, rbx
call qword [rax + 0x90]
xor eax, eax
jmp 0x14004f929
lea rcx, str.refs.c
mov r8d, pe_nt_image_headers64
mov edx, 0x45d
call fcn.140003470
mov ecx, eax
call sub.msvcrt.dll_exit
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop

Function at 0x14004f9d0
Capabilities:
Encode data using base64

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rdx, rdx
je 0x14004f9f5
mov edx, 0x30
mov ecx, 1
call fcn.1400a6220
mov qword [rax], rbx
add rsp, 0x20
pop rbx
ret
mov r8d, 0x46d
lea rdx, str.refs.c
lea rcx, [0x1401d2aff]
call qword [sym.imp.msvcrt.dll__assert]
nop

Function at 0x14004fa10
Capabilities:
Encode data using base64

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [0x140207cf0]
mov rsi, qword [rax]
mov rbx, qword [rsi + 0x20]
mov rdi, rcx
test rbx, rbx
je 0x14004fa50
test rdi, rdi
je 0x14004fa7e
mov edx, 0x30
mov ecx, 1
call fcn.1400a6220
mov qword [rax], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rdx, qword [rsi]
test rdx, rdx
je 0x14004fa98
mov r8d, 0xf
mov rcx, rsi
call fcn.14004daf0
mov rcx, qword [rsi]
mov qword [rsi + 0x20], rax
mov rdx, rax
call fcn.140055070
mov qword [rsi + 0x20], rax
mov rbx, rax
jmp 0x14004fa2d
mov r8d, 0x46d
lea rdx, str.refs.c
lea rcx, [0x1401d2aff]
call qword [sym.imp.msvcrt.dll__assert]
lea r8, str.attempting_to_get_main_ref_store_outside_of_repository
mov edx, 0x801
lea rcx, str.refs.c
call fcn.1400a0ca0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14004fac0
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
test rcx, rcx
je 0x14004fb50
mov eax, dword [rcx + 0x20]
cmp eax, 1
je 0x14004fb57
and eax, 0xfffffffd
je 0x14004fb00
lea r8, str.unexpected_reference_transaction_state
mov edx, 0x489
lea rcx, str.refs.c
call fcn.1400a0ca0
nop word [rax + rax]
xor ebx, ebx
cmp qword [rcx + 0x18], 0
je 0x14004fb38
nop dword [rax]
mov rax, qword [rsi + 8]
mov rax, qword [rax + rbx*8]
mov rcx, qword [rax + 0x60]
call fcn.1400d2670
mov rax, qword [rsi + 8]
mov rcx, qword [rax + rbx*8]
add rbx, 1
call fcn.1400d2670
cmp rbx, qword [rsi + 0x18]
jb 0x14004fb10
mov rcx, qword [rsi + 8]
call fcn.1400d2670
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.1400d2670
add rsp, 0x28
pop rbx
pop rsi
ret
lea r8, str.free_called_on_a_prepared_reference_transaction
mov edx, 0x486
lea rcx, str.refs.c
call fcn.1400a0ca0
nop

Function at 0x14005fa80
Capabilities:
Encode data using base64

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov r12, qword [0x140207460]
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0x20], rdx
mov rdx, r8
mov rcx, rdi
add rsi, 0x40
mov dword [rsp + 0x28], r8d
mov rbp, r8
mov rax, qword [r12]
mov qword [rsp + 0x48], rax
xor eax, eax
call fcn.14001f7c0
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x20]
mov rcx, rsi
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], 0
call fcn.14001fa30
mov rbx, rax
test rax, rax
je 0x14005fb08
mov rax, qword [rsp + 0x48]
sub rax, qword [r12]
jne 0x14005fb79
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov edx, 0x50
mov ecx, 1
call fcn.1400a6220
mov rdx, rbp
mov rcx, rdi
mov rbx, rax
call fcn.1400a6120
lea rcx, [0x1401d4fa2]
mov qword [rbx + 0x10], rax
mov rdx, rax
call fcn.140080b50
mov rdx, rbp
mov rcx, rdi
mov qword [rbx + 0x18], rax
call fcn.14001f7c0
mov qword [rbx], 0
mov rdx, rbx
mov rcx, rsi
mov dword [rbx + 8], eax
call fcn.14001fc90
test rax, rax
je 0x14005fae5
lea r8, str.hashmap_put_overwrote_entry_after_hashmap_get_returned_NULL
mov edx, 0xf1
lea rcx, str.remote.c
call fcn.1400a0ca0
call fcn.1401be670
nop
nop
Function at 0x14005fb80
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rdx, qword [0x140207460]
mov rsi, qword [rcx + 0xf8]
mov r9d, dword [rsi + 0xa0]
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rbx, rcx
test r9d, r9d
jne 0x14005fcf6
mov rax, qword [0x140207c50]
mov qword [rsi + 0x70], 0
mov dword [rsi + 0xa0], 1
mov rax, qword [rax]
mov r8d, dword [rax]
test r8d, r8d
jne 0x14005fd1c
mov rcx, rbx
mov r8, rsi
lea rdx, [0x1400603e0]
call fcn.14000bab0
mov rdi, qword [rbx + 0xf8]
mov ecx, dword [rdi + 0xc]
test ecx, ecx
jle 0x14005fcf6
lea rdx, [rdi + 0x90]
mov rax, qword [rdi]
xor r12d, r12d
lea rbp, [rdi + 0x80]
mov qword [rsp + 0x38], rdx
mov rbx, qword [rax + r12*8]
lea rsi, [r12*8]
test rbx, rbx
je 0x14005fce8
mov r13d, dword [rbx + 0x40]
test r13d, r13d
jle 0x14005fc72
xor r15d, r15d
nop dword [rax]
mov rax, qword [rbx + 0x38]
mov rdx, rbp
lea rbx, [rax + r15*8]
add r15, 1
mov rcx, qword [rbx]
call fcn.14005f1f0
mov qword [rbx], rax
mov rax, qword [rdi]
mov rbx, qword [rax + rsi]
mov r13d, dword [rbx + 0x40]
cmp r13d, r15d
jg 0x14005fc48
mov edx, dword [rbx + 0x30]
test edx, edx
jle 0x14005fce8
xor r14d, r14d
jmp 0x14005fca7
mov rax, qword [rax + rsi]
mov rdx, rbp
add r14, 1
add r15, qword [rax + 0x28]
mov rcx, qword [r15]
call fcn.14005f1f0
mov qword [r15], rax
mov rax, qword [rdi]
mov rbx, qword [rax + rsi]
cmp dword [rbx + 0x30], r14d
jle 0x14005fce8
lea r15, [r14*8]
test r13d, r13d
jne 0x14005fc80
mov rax, qword [rbx + 0x28]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rax + r14*8]
mov qword [rsp + 0x30], rcx
call fcn.14005f1f0
mov rcx, qword [rsp + 0x30]
cmp rcx, rax
je 0x14005fce0
mov rdx, rax
mov rcx, rbx
call fcn.14005eec0
mov rax, qword [rdi]
jmp 0x14005fc80
add r12, 1
cmp dword [rdi + 0xc], r12d
jg 0x14005fc20
mov rdi, qword [0x140207460]
mov rax, qword [rsp + 0x48]
sub rax, qword [rdi]
jne 0x14005fdae
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.140051470
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1401d4fb0]
mov rcx, rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.140050d80
mov rsi, qword [rbx + 0xf8]
mov rdi, rax
test rax, rax
je 0x14005fbe3
test byte [rsp + 0x44], 1
je 0x14005fbe3
lea rax, [0x1401d4f96]
jmp 0x14005fd81
add rdi, 1
add rax, 1
cmp dl, byte [rdi - 1]
jne 0x14005fbe3
movzx edx, byte [rax]
test dl, dl
jne 0x14005fd70
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov rdx, rdi
mov r8, rax
call fcn.14005fa80
mov qword [rsi + 0x70], rax
mov rsi, qword [rbx + 0xf8]
jmp 0x14005fbe3
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop
Function at 0x14005fdc0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [0x140207460]
mov rsi, rdx
mov edx, 0x2a
mov rdi, rcx
mov r12, r8
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
mov r14, r9
call sub.msvcrt.dll_strchr
test rax, rax
je 0x14005ff1e
lea rbx, [rax + 1]
mov r15, rax
mov rcx, rbx
sub r15, rdi
call sub.msvcrt.dll_strlen
mov rcx, rsi
mov r13, rax
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov r8, r15
mov rcx, rsi
mov rbp, rax
call sub.msvcrt.dll_strncmp
mov edi, eax
test eax, eax
je 0x14005fe60
xor edi, edi
mov rsi, qword [0x140207460]
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x14005ff19
mov eax, edi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [r15 + r13]
cmp rbp, rax
jb 0x14005fe36
mov rcx, rbp
mov r8, r13
mov rdx, rbx
sub rcx, r13
add rcx, rsi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14005fe36
test r12, r12
je 0x14005ff0f
mov rax, qword [0x140207c90]
mov edx, 0x2a
mov rcx, r12
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], rax
call sub.msvcrt.dll_strchr
mov rdi, rax
test rax, rax
je 0x14005ff35
lea rbx, [rsp + 0x20]
mov r8, rax
mov rdx, r12
add rdi, 1
sub r8, r12
mov rcx, rbx
call fcn.14007e800
mov r8, rbp
lea rdx, [rsi + r15]
mov rcx, rbx
sub r8, r15
sub r8, r13
call fcn.14007e800
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rdx, rdi
mov rcx, rbx
mov r8, rax
call fcn.14007e800
xor edx, edx
mov rcx, rbx
call fcn.14007d860
mov qword [r14], rax
mov edi, 1
jmp 0x14005fe36
call fcn.1401be670
lea rcx, str.key__s_of_pattern_had_no_
call fcn.14005f460
mov rdx, rdi
mov rcx, rax
call fcn.1400a08a0
lea rcx, str.value__s_of_pattern_has_no_
call fcn.14005f460
mov rdx, r12
mov rcx, rax
call fcn.1400a08a0
nop
nop dword [rax]