joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400169a0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
mov r8d, r9d
mov rcx, rdx
mov rdx, rsi
mov edi, r9d
call fcn.14004a480
test eax, eax
je 0x140016980
movsxd rcx, dword [rbx + 8]
mov eax, dword [rbx + 0x34]
cmp ecx, eax
jl 0x140016970
lea eax, [rax + rax*2 + 0x30]
mov edx, eax
shr edx, 0x1f
add edx, eax
lea eax, [rcx + 1]
sar edx, 1
cmp ecx, edx
cmovl eax, edx
mov dword [rbx + 0x34], eax
cdqe
mov rdx, rax
shr rdx, 0x3d
jne 0x14001698a
mov rcx, qword [rbx + 0x18]
lea rdx, [rax*8]
call fcn.1400a61c0
movsxd rcx, dword [rbx + 8]
mov qword [rbx + 0x18], rax
lea edx, [rcx + 1]
mov dword [rbx + 8], edx
lea rbx, [rax + rcx*8]
mov edx, edi
mov rcx, rsi
call fcn.140012750
mov qword [rbx], rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, qword [rbx + 0x18]
jmp 0x140016949
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rax
mov edx, 8
lea rcx, [0x1401cc098]
call fcn.1400a08a0
nop
nop
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rsp + 0xa8]
mov rbp, qword [rsp + 0x90]
mov r13d, dword [rsp + 0x98]
mov r14, qword [rsp + 0xa0]
mov rbx, rcx
mov r12, rdx
mov rsi, r8
mov rdi, r9
cmp eax, 2
je 0x140016a40
cmp eax, 3
je 0x140016a00
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test byte [rcx], 1
jne 0x1400169e5
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x10]
mov rdx, rdi
call fcn.1400127c0
cmp qword [rsi], 0
je 0x1400169e5
movsxd rdx, r13d
mov rcx, r12
add rdx, qword [rbp + 0x10]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.140012050
mov eax, dword [rcx]
test al, 1
jne 0x140016b08
test al, 0x20
jne 0x140016ade
test al, 0x10
je 0x1400169e5
mov r15, qword [rbp + 8]
mov r12, qword [rbp + 0x10]
test r14, r14
je 0x1400169e5
mov eax, dword [r14]
test eax, eax
je 0x1400169e5
mov r9d, dword [r14 + 8]
cmp r9d, 0x3f
ja 0x140016b44
xor esi, esi
movsxd r13, r15d
test eax, eax
jg 0x140016aad
jmp 0x1400169e5
jge 0x140016aa0
mov rcx, qword [rax]
cmp byte [rcx + r13], 0x2f
je 0x140016b30
add rsi, 1
cmp dword [r14], esi
jle 0x1400169e5
mov rdx, qword [r14 + 0x10]
lea rax, [rsi*8]
sub rax, rsi
lea rax, [rdx + rax*8]
cmp r15d, dword [rax + 0x1c]
jne 0x140016a90
mov rcx, qword [rax]
mov r8, r13
mov rdx, r12
test byte [rax + 0x10], 0x10
jne 0x140016b3c
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x140016aa0
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x10]
mov rdx, rdi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x1400168e0
mov r9d, dword [rbp + 8]
mov r8, qword [rbp + 0x10]
mov rdx, rdi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400127c0
mov r8, r13
mov rdx, r12
test byte [rax + 0x10], 0x10
je 0x140016ad5
call qword [sym.imp.msvcrt.dll__strnicmp]
jmp 0x140016ada
and r9d, 0xffffffc0
lea r8, [0x1401cc040]
mov edx, 0x8ab
lea rcx, str.dir.c
call fcn.1400a0ca0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x14001b8d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r14, qword [0x140207460]
lea rbp, [rsp + 0x20]
mov r13, rdx
mov r12, rcx
mov rdx, rcx
mov rax, qword [r14]
mov qword [rsp + 0x98], rax
xor eax, eax
mov rcx, rbp
lea rdi, [rsp + 0x60]
mov rsi, r8
call fcn.14001bed0
mov rdx, r13
mov rcx, rdi
call fcn.14001bed0
mov eax, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
nop dword [rax + rax]
add edx, eax
je 0x14001ba98
movsxd r8, dword [rsp + 0x8c]
mov ecx, r8d
add ecx, dword [rsp + 0x88]
jne 0x14001b9b7
jmp 0x14001ba4e
cmp eax, r8d
jl 0x14001b9c0
movsxd r8, eax
mov rbx, rbp
mov rcx, rdi
mov eax, dword [rbx + 0x34]
xor r15d, r15d
mov rdx, rsi
test eax, eax
setne r15b
mov r9d, r15d
call fcn.14001c000
movsxd rdx, dword [rbx + 0x2c]
mov r8, rdx
sub r8, rax
je 0x14001b9a3
mov rax, r8
mov edx, r15d
mov rcx, rsi
shl rax, 6
add qword [rsi + 0x18], rax
call fcn.14001b080
movsxd rdx, dword [rbx + 0x2c]
mov rcx, rbx
call fcn.14001bf40
mov eax, dword [rsp + 0x4c]
movsxd r8, dword [rsp + 0x8c]
test eax, eax
jg 0x14001b958
test r8d, r8d
jle 0x14001b9d0
mov rbx, rdi
mov rcx, rbp
jmp 0x14001b966
movsxd rcx, dword [rsp + 0x48]
movsxd r8, dword [rsp + 0x88]
mov rbx, rcx
cmp r8, rcx
mov rdx, rcx
cmovbe rbx, r8
test rbx, rbx
je 0x14001b930
xor r15d, r15d
nop word cs:[rax + rax]
mov rdx, qword [rsp + 0x38]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rdx, r15
mov rdx, qword [rax + rdx*8]
mov rax, qword [rsp + 0x60]
add rcx, r15
add r15, 1
xor rdx, qword [rax + rcx*8]
mov rcx, rsi
call fcn.14001b440
cmp r15, rbx
jb 0x14001ba00
mov rdx, rbx
mov rcx, rbp
call fcn.14001bf40
mov rdx, rbx
mov rcx, rdi
call fcn.14001bf40
jmp 0x14001b920
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rsi
mov rcx, rbp
call fcn.14001c000
mov rax, qword [r13 + 0x18]
mov rdx, qword [r12 + 0x18]
cmp rax, rdx
cmovb rax, rdx
mov qword [rsi + 0x18], rax
mov rax, qword [rsp + 0x98]
sub rax, qword [r14]
jne 0x14001baaf
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
mov r8, 0xffffffffffffffff
mov rdx, rsi
mov rcx, rdi
call fcn.14001c000
jmp 0x14001ba63
call fcn.1401be670
nop
nop word cs:[rax + rax]
Function at 0x14001c0f0
Capabilities:
Set environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rbx, qword [0x140207460]
mov r12, qword [sym.imp.msvcrt.dll__wpgmptr]
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x140207c90]
mov rsi, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [r12]
mov rcx, qword [rax]
call sub.msvcrt.dll_wcslen
mov rcx, rdi
lea ebp, [rax + rax*2 + 1]
movsxd rbp, ebp
mov rdx, rbp
call fcn.14007da40
mov rax, qword [r12]
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400bb580
test eax, eax
js 0x14001c254
cdqe
add qword [rsp + 0x38], rax
mov rbp, qword [0x140207d40]
mov rcx, rdi
call fcn.140038b40
test eax, eax
jne 0x14001c2f4
mov r8, qword [rsp + 0x40]
lea rsi, str.exec_cmd.c
mov edx, 0xdb
mov rcx, rsi
call fcn.14008ed40
xor edx, edx
mov rcx, rdi
call fcn.14007d860
xor r9d, r9d
movzx edx, byte [rax]
mov rcx, rax
test dl, dl
jne 0x14001c1d4
jmp 0x14001c1fb
movzx edx, byte [rcx + 1]
add rcx, 1
test dl, dl
je 0x14001c1f2
movsx r8d, dl
cmp dl, 0x5c
je 0x14001c1e3
cmp r8d, 0x2f
jne 0x14001c1c8
mov r9, rcx
movzx edx, byte [rcx + 1]
add rcx, 1
test dl, dl
jne 0x14001c1d4
test r9, r9
je 0x14001c1fb
mov byte [r9], 0
movabs rdx, 0x1ffffffff
and rdx, qword [rbp + 8]
movabs rcx, 0x100000000
mov qword [0x14022c6f0], rax
cmp rdx, rcx
je 0x14001c23b
mov qword [rsp + 0x20], rax
mov r8, rbp
mov edx, 0xf4
mov rcx, rsi
lea r9, str.trace:_resolved_executable_dir:__s_n
call fcn.14008dc10
mov rax, qword [rsp + 0x48]
sub rax, qword [rbx]
jne 0x14001c389
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test rsi, rsi
je 0x14001c380
movzx eax, byte [rsi]
test al, al
je 0x14001c380
mov rdx, rsi
xor r8d, r8d
jmp 0x14001c27c
movzx eax, byte [rdx + 1]
add rdx, 1
test al, al
je 0x14001c297
movsx ecx, al
cmp al, 0x5c
je 0x14001c288
cmp ecx, 0x2f
jne 0x14001c270
mov r8, rdx
movzx eax, byte [rdx + 1]
add rdx, 1
test al, al
jne 0x14001c27c
mov rbp, qword [0x140207d40]
movabs rax, 0x1ffffffff
and rax, qword [rbp + 8]
test r8, r8
je 0x14001c336
movabs rdx, 0x100000000
cmp rax, rdx
je 0x14001c2e4
mov qword [rsp + 0x20], rsi
lea r9, str.trace:_resolved_executable_path_from_argv0:__s_n
mov r8, rbp
mov edx, 0x50
lea rcx, str.exec_cmd.c
call fcn.14008dc10
mov rdx, rsi
mov rcx, rdi
call fcn.1400de560
jmp 0x14001c180
movabs rax, 0x1ffffffff
and rax, qword [rbp + 8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x14001c373
mov rax, qword [rsp + 0x40]
lea r9, str.trace:_could_not_normalize_path:__s_n
mov r8, rbp
mov edx, 0xd7
lea rcx, str.exec_cmd.c
mov qword [rsp + 0x20], rax
call fcn.14008dc10
movabs rax, 0x1ffffffff
and rax, qword [rbp + 8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x14001c373
mov qword [rsp + 0x20], rsi
lea r9, str.trace:_could_not_determine_executable_path_from:__s_n
mov r8, rbp
mov edx, 0xe7
lea rcx, str.exec_cmd.c
call fcn.14008dc10
mov rcx, rdi
call fcn.14007d7e0
jmp 0x14001c23b
mov rbp, qword [0x140207d40]
jmp 0x14001c336
call fcn.1401be670
nop
nop
Function at 0x14001c390
Capabilities:
Set environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x140207c90]
mov rbx, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
movsx eax, byte [rcx]
cmp eax, 0x2f
je 0x14001c3d6
cmp eax, 0x5c
jne 0x14001c3f8
mov rcx, rbx
call fcn.1400a5f80
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsi]
jne 0x14001c55c
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.1400c3650
test eax, eax
jne 0x14001c3d6
mov rcx, qword [0x14022c6f0]
test rcx, rcx
je 0x14001c561
movsx eax, byte [rcx]
cmp eax, 0x2f
je 0x14001c430
cmp eax, 0x5c
je 0x14001c430
call fcn.1400c3650
test eax, eax
je 0x14001c468
nop word [rax + rax]
mov r8, qword [0x14022c6e0]
test r8, r8
je 0x14001c488
lea rdi, [rsp + 0x30]
mov r9, rbx
lea rdx, [0x1401cce37]
mov rcx, rdi
call fcn.14007ed40
xor edx, edx
mov rcx, rdi
call fcn.14007d860
jmp 0x14001c3de
mov r8d, 0x34
lea rdx, str.exec_cmd.c
lea rcx, str.is_absolute_path_executable_dirname_
call qword [sym.imp.msvcrt.dll__assert]
nop word [rax + rax]
mov rcx, qword [0x14022c6f0]
lea rdx, str.libexec_git_core
call fcn.140038d40
mov qword [0x14022c6e0], rax
mov r8, rax
test rax, rax
jne 0x14001c43c
mov rcx, qword [0x14022c6f0]
lea rdx, [0x1401ccdd6]
call fcn.140038d40
mov qword [0x14022c6e0], rax
mov r8, rax
test rax, rax
jne 0x14001c43c
mov rcx, qword [0x14022c6f0]
lea rdx, [0x1401ccdda]
call fcn.140038d40
mov r8, rax
test rax, rax
je 0x14001c4f7
mov qword [0x14022c6e0], rax
jmp 0x14001c43c
mov rcx, qword [0x140207d40]
lea rax, str._mingw64
movabs rdx, 0x1ffffffff
mov qword [0x14022c6e0], rax
mov r8, rax
movabs rax, 0x100000000
and rdx, qword [rcx + 8]
cmp rdx, rax
je 0x14001c43c
mov qword [rsp + 0x20], r8
lea r9, str.RUNTIME_PREFIX_requested__but_prefix_computation_failed.__Using_static_fallback__s._n
mov r8, rcx
mov edx, 0x3b
lea rcx, str.exec_cmd.c
call fcn.14008dc10
mov r8, qword [0x14022c6e0]
jmp 0x14001c43c
call fcn.1401be670
mov r8d, 0x33
lea rdx, str.exec_cmd.c
lea rcx, str.executable_dirname
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]
mov r8d, 1
mov qword [0x14022c6e8], rcx
mov rdx, rcx
lea rcx, str.GIT_EXEC_PATH
jmp fcn.1400c6200
Function at 0x14001c580
Capabilities:
Set environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
mov rax, qword [0x140207c90]
mov rbx, rcx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], rax
movsx eax, byte [rcx]
cmp eax, 0x2f
je 0x14001c3d6
cmp eax, 0x5c
jne 0x14001c3f8
mov rcx, rbx
call fcn.1400a5f80
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsi]
jne 0x14001c55c
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.1400c3650
test eax, eax
jne 0x14001c3d6
mov rcx, qword [0x14022c6f0]
test rcx, rcx
je 0x14001c561
movsx eax, byte [rcx]
cmp eax, 0x2f
je 0x14001c430
cmp eax, 0x5c
je 0x14001c430
call fcn.1400c3650
test eax, eax
je 0x14001c468
nop word [rax + rax]
mov r8, qword [0x14022c6e0]
test r8, r8
je 0x14001c488
lea rdi, [rsp + 0x30]
mov r9, rbx
lea rdx, [0x1401cce37]
mov rcx, rdi
call fcn.14007ed40
xor edx, edx
mov rcx, rdi
call fcn.14007d860
jmp 0x14001c3de
mov r8d, 0x34
lea rdx, str.exec_cmd.c
lea rcx, str.is_absolute_path_executable_dirname_
call qword [sym.imp.msvcrt.dll__assert]
nop word [rax + rax]
mov rcx, qword [0x14022c6f0]
lea rdx, str.libexec_git_core
call fcn.140038d40
mov qword [0x14022c6e0], rax
mov r8, rax
test rax, rax
jne 0x14001c43c
mov rcx, qword [0x14022c6f0]
lea rdx, [0x1401ccdd6]
call fcn.140038d40
mov qword [0x14022c6e0], rax
mov r8, rax
test rax, rax
jne 0x14001c43c
mov rcx, qword [0x14022c6f0]
lea rdx, [0x1401ccdda]
call fcn.140038d40
mov r8, rax
test rax, rax
je 0x14001c4f7
mov qword [0x14022c6e0], rax
jmp 0x14001c43c
mov rcx, qword [0x140207d40]
lea rax, str._mingw64
movabs rdx, 0x1ffffffff
mov qword [0x14022c6e0], rax
mov r8, rax
movabs rax, 0x100000000
and rdx, qword [rcx + 8]
cmp rdx, rax
je 0x14001c43c
mov qword [rsp + 0x20], r8
lea r9, str.RUNTIME_PREFIX_requested__but_prefix_computation_failed.__Using_static_fallback__s._n
mov r8, rcx
mov edx, 0x3b
lea rcx, str.exec_cmd.c
call fcn.14008dc10
mov r8, qword [0x14022c6e0]
jmp 0x14001c43c
call fcn.1401be670
mov r8d, 0x33
lea rdx, str.exec_cmd.c
lea rcx, str.executable_dirname
call qword [sym.imp.msvcrt.dll__assert]
nop
nop dword [rax]
mov r8d, 1
mov qword [0x14022c6e8], rcx
mov rdx, rcx
lea rcx, str.GIT_EXEC_PATH
jmp fcn.1400c6200

Function at 0x14001f750
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x811c9dc5
movzx edx, byte [rcx]
lea r8, [rcx + 1]
test edx, edx
je 0x14001f775
imul eax, eax, 0x1000193
add r8, 1
xor eax, edx
movzx edx, byte [r8 - 1]
test edx, edx
jne 0x14001f760
ret

Function at 0x14001f780
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, 0x811c9dc5
movzx edx, byte [rcx]
lea r8, [rcx + 1]
test edx, edx
je 0x14001f7b3
lea r9d, [rdx - 0x61]
lea ecx, [rdx - 0x20]
cmp r9d, 0x1a
cmovb edx, ecx
imul eax, eax, 0x1000193
add r8, 1
xor eax, edx
movzx edx, byte [r8 - 1]
test edx, edx
jne 0x14001f790
ret
Function at 0x14001f7c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
test rdx, rdx
je 0x14001f7f0
add rdx, rcx
mov eax, 0x811c9dc5
nop dword [rax]
imul eax, eax, 0x1000193
movzx r8d, byte [rcx]
add rcx, 1
xor eax, r8d
cmp rcx, rdx
jne 0x14001f7d0
ret
mov eax, 0x811c9dc5
ret

Function at 0x14001f800
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
test rdx, rdx
je 0x14001f840
add rdx, rcx
mov eax, 0x811c9dc5
nop dword [rax]
movzx r8d, byte [rcx]
add rcx, 1
lea r10d, [r8 - 0x61]
lea r9d, [r8 - 0x20]
cmp r10d, 0x1a
cmovb r8d, r9d
imul eax, eax, 0x1000193
xor eax, r8d
cmp rdx, rcx
jne 0x14001f810
ret
mov eax, 0x811c9dc5
ret

Function at 0x14001f850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov eax, ecx
test r8, r8
je 0x14001f886
add r8, rdx
nop word [rax + rax]
movzx r9d, byte [rdx]
add rdx, 1
lea r10d, [r9 - 0x61]
lea ecx, [r9 - 0x20]
cmp r10d, 0x1a
cmovb r9d, ecx
imul eax, eax, 0x1000193
xor eax, r9d
cmp r8, rdx
jne 0x14001f860
ret

Function at 0x14001fda0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, qword [0x140207460]
lea rdi, [0x14022c720]
mov rax, qword [rsi]
mov qword [rsp + 0x38], rax
xor eax, eax
mov eax, dword [0x14022c73c]
mov r12, rcx
mov rbx, rdx
test eax, eax
je 0x14001fe50
test rbx, rbx
je 0x14001fe6e
lea r10, [r12 + rbx]
mov rcx, r12
mov eax, 0x811c9dc5
nop dword [rax]
imul eax, eax, 0x1000193
movzx r9d, byte [rcx]
add rcx, 1
xor eax, r9d
cmp rcx, r10
jne 0x14001fdf0
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rdi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], rbx
call fcn.14001fa30
lea r13, [rax + 0x18]
test rax, rax
je 0x14001fea8
mov rax, qword [rsp + 0x38]
sub rax, qword [rsi]
jne 0x14001ff0a
mov rax, r13
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001f690]
mov rcx, rdi
call fcn.14001f8a0
test rbx, rbx
jne 0x14001fddd
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rdi
mov dword [rsp + 0x28], 0x811c9dc5
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x30], 0
call fcn.14001fa30
lea r13, [rax + 0x18]
test rax, rax
jne 0x14001fe31
jmp 0x14001feb0
cmp rbx, 0xffffffffffffffe7
ja 0x14001fef6
je 0x14001ff0f
lea rdx, [rbx + 0x19]
mov ecx, 1
call fcn.1400a6220
mov rdx, r12
mov r8, rbx
lea r13, [rax + 0x18]
mov rbp, rax
mov rcx, r13
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x28]
mov qword [rbp + 0x10], rbx
mov rdx, rbp
mov qword [rbp], 0
mov rcx, rdi
mov dword [rbp + 8], eax
call fcn.14001fb20
jmp 0x14001fe31
mov r8, rbx
mov edx, 0x18
lea rcx, [0x1401cd850]
call fcn.1400a08a0
call fcn.1401be670
mov r8d, 1
or rdx, 0xffffffffffffffff
lea rcx, [0x1401cd850]
call fcn.1400a08a0
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140027360
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, edx
mov edx, dword [0x1401c04f8]
mov rdi, rcx
or edx, esi
call fcn.1400c0420
cmp byte [0x1401c04f8], 0
mov ebx, eax
jns 0x140027388
test eax, eax
js 0x140027398
mov eax, ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0x16
jne 0x140027388
mov eax, dword [0x1401c04f8]
mov rcx, rdi
and al, 0x7f
or esi, eax
mov dword [0x1401c04f8], eax
mov edx, esi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400c0420
Function at 0x14002e320
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb8
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov rbx, rdx
mov rbp, rcx
lea rdx, [0x1401cf775]
mov rcx, rbx
mov rsi, r8
call sub.msvcrt.dll_strstr
mov r15, rax
test rax, rax
je 0x14002e4d0
cmp rbx, rax
je 0x14002e498
mov r12, rax
lea r13, [rsp + 0x30]
lea r14, [rsp + 0x50]
sub r12, rbx
mov rcx, r13
mov rdx, r12
call fcn.14007dae0
mov r8, r12
mov rdx, rbx
mov rcx, r13
call fcn.14007e800
mov qword [rsp + 0x28], r14
mov rcx, rbp
xor r9d, r9d
lea r12, [rsp + 0x80]
mov rdx, qword [rsp + 0x40]
mov r8d, 4
mov qword [rsp + 0x20], r12
call fcn.14002dcf0
mov rcx, r13
mov ebx, eax
call fcn.14007d7e0
test ebx, ebx
je 0x14002e400
mov rax, qword [rsp + 0xa8]
sub rax, qword [rdi]
jne 0x14002e52a
mov eax, ebx
add rsp, 0xb8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.1400f5550
mov r13, rax
test rax, rax
je 0x14002e520
cmp byte [r15 + 3], 0
lea rdx, [0x1401cf080]
je 0x14002e42c
lea rdx, [r15 + 3]
mov qword [rsp + 0x28], r14
xor r9d, r9d
mov r8d, 4
mov rcx, rbp
mov qword [rsp + 0x20], r12
call fcn.14002dcf0
mov ebx, eax
test eax, eax
jne 0x14002e520
xor r8d, r8d
mov rdx, r12
mov rcx, rbp
call fcn.1400f5550
mov r8, rax
test rax, rax
je 0x14002e520
mov rcx, rbp
mov rdx, r13
call fcn.1400f36a0
mov rcx, rax
test rax, rax
je 0x14002e485
cmp qword [rax + 8], 0
je 0x14002e500
mov ebx, 0xffffffff
call fcn.1400f6e60
jmp 0x14002e3d3
lea r14, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, rbp
lea r12, [rsp + 0x80]
mov qword [rsp + 0x28], r14
lea rdx, [0x1401cf080]
mov qword [rsp + 0x20], r12
call fcn.14002dcf0
mov ebx, eax
jmp 0x14002e3cf
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rsi
mov rdx, rbx
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, rbp
call fcn.14002dcf0
mov ebx, eax
jmp 0x14002e3d3
mov rax, qword [rax]
movdqu xmm0, xmmword [rax + 4]
movups xmmword [rsi], xmm0
movdqu xmm1, xmmword [rax + 0x14]
movups xmmword [rsi + 0x10], xmm1
mov eax, dword [rax + 0x24]
mov dword [rsi + 0x20], eax
jmp 0x14002e48a
mov ebx, 0xffffffff
jmp 0x14002e3d3
call fcn.1401be670
nop
Function at 0x140033d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x288
mov rdi, qword [0x140207460]
mov r12, qword [rsp + 0x2f0]
mov rax, qword [rdi]
mov qword [rsp + 0x278], rax
xor eax, eax
lea eax, [r9 - 6]
mov qword [rsp + 0x58], rcx
mov rbp, rdx
mov r14, r8
mov r13d, r9d
cmp eax, 1
ja 0x140033f97
lea rax, [rsp + 0x70]
xor ebx, ebx
mov esi, 0x40
mov r13, r8
mov qword [rsp + 0x50], rax
mov rdi, rax
lea rax, [rsp + 0x68]
lea r15, [rsp + 0x2f8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x48], rax
nop word [rax + rax]
lea r14, [rbx*8]
cmp esi, ebx
jg 0x140033e0a
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x2e8], r9d
cmp rdi, rcx
je 0x140033f08
lea esi, [rsi + rsi*2 + 0x30]
lea edx, [rbx + 1]
mov rcx, rdi
sar esi, 1
cmp esi, ebx
cmovle esi, edx
movsxd rdx, esi
shl rdx, 3
call fcn.1400a61c0
mov r9d, dword [rsp + 0x2e8]
mov rdi, rax
mov qword [rdi + r14], r13
mov r8, r15
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x20], r13
call fcn.140033c40
mov r13, rax
test rax, rax
je 0x140033f40
mov r9, qword [rsp + 0x38]
mov r8, rax
mov rdx, r12
mov rcx, rbp
mov qword [rsp + 0x2f8], rax
call fcn.140031f40
mov r9, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x68]
mov rcx, rax
call fcn.1400333c0
test eax, eax
jne 0x140033ec0
mov rcx, qword [rsp + 0x58]
mov r8, r13
mov rdx, rbp
call fcn.1400339f0
mov esi, eax
test eax, eax
jle 0x140033f40
mov rax, qword [rsp + 0x50]
cmp rdi, rax
je 0x140033e8e
mov rcx, rdi
call fcn.1400d2670
mov rdi, qword [0x140207460]
mov rax, qword [rsp + 0x278]
sub rax, qword [rdi]
jne 0x140033fe7
mov eax, esi
add rsp, 0x288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, eax
mov r9d, dword [rsp + 0x6c]
add rax, r13
mov qword [rsp + 0x2f8], rax
test r9d, r9d
jle 0x140033e62
lea eax, [r9 - 6]
add rbx, 1
cmp eax, 1
jbe 0x140033dc0
lea eax, [r9 - 1]
mov r14, r13
mov r13d, r9d
cmp eax, 3
ja 0x140033fc4
mov esi, r9d
jmp 0x140033e7c
lea esi, [rbx + rbx*2 + 0x30]
sar esi, 1
movsxd rcx, esi
shl rcx, 3
call fcn.1400a5fa0
mov rdx, qword [rsp + 0x50]
mov r8, r14
mov rcx, rax
mov rdi, rax
call sub.msvcrt.dll_memcpy
mov r9d, dword [rsp + 0x2e8]
jmp 0x140033e0a
add ebx, 1
movsxd rax, ebx
mov ebx, ebx
lea r13, [rdi + rax*8]
shl rbx, 3
mov r12, r13
sub r12, rbx
mov rbx, qword [rsp + 0x58]
jmp 0x140033f77
mov r8, qword [r13 - 8]
mov rdx, rbp
mov rcx, rbx
sub r13, 8
call fcn.1400339f0
test eax, eax
jg 0x140033f90
cmp r13, r12
jne 0x140033f60
mov esi, 0xffffffff
jmp 0x140033e7c
mov esi, eax
jmp 0x140033e7c
mov esi, 0xffffffff
cmp r9d, 0xffffffff
je 0x140033e8e
lea eax, [r9 - 1]
cmp eax, 3
ja 0x140033fb7
mov esi, r9d
jmp 0x140033e8e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rdi, rax
lea r9, [rbp + 0xf0]
mov r8, r14
mov edx, r13d
mov esi, 0xffffffff
lea rcx, str.unknown_object_type__i_at_offset__I64u_in__s
call fcn.1400a0b40
jmp 0x140033e7c
call fcn.1401be670
nop
nop dword [rax]
Function at 0x140035c80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
call fcn.14011b200
test eax, eax
je 0x140035d20
mov ebx, dword [0x14022cc60]
test ebx, ebx
je 0x140035cc8
mov ecx, 2
call qword [fcn.1401bee20]
lea r9, [0x1401d044e]
mov r8d, ebx
lea rdx, str._r_s_r
mov rcx, rax
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fprintf
lea rcx, str.COLUMNS
mov dword [0x14022cc60], 0x50
mov dword [0x14022cc64], 1
call fcn.1400bbaa0
test rax, rax
je 0x140035d10
mov rcx, rax
call sub.msvcrt.dll_atoi
mov ebx, eax
test eax, eax
jle 0x140035d10
mov dword [0x14022cc60], eax
mov dword [0x14022cc64], 0
jmp 0x140035c9c
mov ebx, dword [0x14022cc60]
jmp 0x140035c9c
mov ecx, 2
call qword [fcn.1401bee20]
mov r8d, 4
mov edx, 1
lea rcx, str._re_K
mov r9, rax
add rsp, 0x20
pop rbx
jmp sub.msvcrt.dll_fwrite

Function at 0x14003bbd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov qword [rsp + 0x60], r8
lea r8, [0x1401d0f96]
mov qword [rsp + 0x68], r9
mov r9, rdx
xor edx, edx
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
call fcn.14003b720
mov rax, qword [rsp + 0x38]
sub rax, qword [rbx]
jne 0x14003bc20
add rsp, 0x40
pop rbx
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]

Function at 0x14003bc30
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, qword [0x140207460]
mov qword [rsp + 0x60], r8
lea r8, [0x1401d0f96]
mov qword [rsp + 0x68], r9
mov r9, rdx
mov edx, 1
mov rax, qword [rbx]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
call fcn.14003b720
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbx]
jne 0x14003bc83
add rsp, 0x40
pop rbx
ret
call fcn.1401be670
nop
nop dword [rax]