joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4c30
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor edx, edx
test rax, rax
je 0x1400c4c51
mov eax, dword [rax]
test eax, eax
jg 0x1400c4c60
mov eax, edx
add rsp, 0x20
pop rbx
ret
movsx eax, byte [rbx]
cmp eax, 0x2f
je 0x1400c4c80
cmp eax, 0x5c
je 0x1400c4c80
mov rcx, rbx
call fcn.1400c3650
xor edx, edx
test eax, eax
sete dl
jmp 0x1400c4c51
xor edx, edx
mov eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400c4c90
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov edx, 0xffffffff
mov rbx, rcx
lea rcx, str.GIT_TEST_FSCACHE
call fcn.140009e90
cmp eax, 0xffffffff
je 0x1400c4db0
mov rdx, qword [0x140207740]
mov dword [rdx], eax
test eax, eax
jne 0x1400c4cd0
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [0x140242fa0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x140242fcc]
test eax, eax
jne 0x1400c4d2b
mov eax, dword [0x140242fc8]
test eax, eax
je 0x1400c4dc0
mov rax, qword [0x140207ac0]
lea rdx, [0x1400c4930]
mov qword [rax], rdx
mov rax, qword [0x140207a10]
lea rdx, [0x1400c46b0]
mov qword [rax], rdx
mov rax, qword [0x140207e20]
lea rdx, [0x1400c4a80]
mov qword [rax], rdx
mov eax, dword [0x140242fcc]
mov rcx, rsi
add eax, 1
mov dword [0x140242fcc], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400c4de8
mov edx, dword [rax]
add edx, 1
mov dword [rax], edx
movabs rax, 0x1ffffffff
movabs rdx, 0x100000000
and rax, qword [0x1401c45d8]
cmp rax, rdx
je 0x1400c4cc0
lea r9, str.fscache:_enable_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x20a
lea rcx, str.compat_win32_fscache.c
call fcn.14008dc10
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rax, qword [0x140207740]
mov eax, dword [rax]
jmp 0x1400c4cbc
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x140242fc8], eax
cmp eax, 0xffffffff
jne 0x1400c4cf8
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400c4cc0
mov edx, 0x10060
mov ecx, 1
call fcn.1400a6220
xor r8d, r8d
lea r9, [rbx*4]
lea rdx, [fcn.1400c3cc0]
mov dword [rax], 1
mov rsi, rax
lea rcx, [rax + 8]
call fcn.14001f8a0
xor edx, edx
lea rcx, [rsi + 0x38]
call fcn.140134d10
mov ecx, dword [0x140242fc8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400c4d5f
lea r8, str.TlsSetValue_error
mov edx, 0x207
lea rcx, str.compat_win32_fscache.c
call fcn.1400a0ca0
nop
nop word cs:[rax + rax]
Function at 0x1400c4e60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140207740]
mov eax, dword [rax]
test eax, eax
jne 0x1400c4e80
add rsp, 0x40
pop rbx
ret
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400c5009
mov eax, dword [rax]
test eax, eax
je 0x1400c4ff1
mov eax, dword [rbx]
sub eax, 1
mov dword [rbx], eax
mov eax, dword [rbx]
test eax, eax
je 0x1400c4f60
lea rbx, [0x140242fa0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x140242fcc]
sub eax, 1
mov dword [0x140242fcc], eax
mov eax, dword [0x140242fcc]
test eax, eax
jne 0x1400c4f0f
mov rax, qword [0x140207ac0]
mov rdx, qword [0x1402077d0]
mov qword [rax], rdx
mov rax, qword [0x140207a10]
mov rdx, qword [fcn.1400c16c0]
mov qword [rax], rdx
mov rax, qword [0x140207e20]
mov rdx, qword [fcn.1400bf3a0]
mov qword [rax], rdx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movabs rax, 0x1ffffffff
and rax, qword [0x1401c45d8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x1400c4e72
lea r9, str.fscache:_disable_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x235
lea rcx, str.compat_win32_fscache.c
add rsp, 0x40
pop rbx
jmp fcn.14008dc10
xor edx, edx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movabs rax, 0x1ffffffff
and rax, qword [0x1401c45d8]
movabs rdx, 0x100000000
cmp rax, rdx
je 0x1400c4fc9
mov eax, dword [rbx + 0x5c]
lea r9, str.fscache_disable:_lstat__u__opendir__u__total_requests_misses__u__u_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x221
lea rcx, str.compat_win32_fscache.c
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx + 0x50]
mov dword [rsp + 0x20], eax
call fcn.14008dc10
lea rcx, [rbx + 0x38]
xor edx, edx
call fcn.140134de0
lea rcx, [rbx + 8]
mov rdx, 0xffffffffffffffff
call fcn.14001f9e0
mov rcx, rbx
call fcn.1400d2670
jmp 0x1400c4eb3
lea r8, str.fscache_disable___called_on_an_fscache_that_is_already_disabled
mov edx, 0x21d
lea rcx, str.compat_win32_fscache.c
call fcn.1400a0ca0
lea r8, str.fscache_disable___called_on_a_thread_where_fscache_has_not_been_initialized
mov edx, 0x21b
lea rcx, str.compat_win32_fscache.c
call fcn.1400a0ca0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400c5030
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x1400c5050
mov eax, dword [rax]
test eax, eax
jne 0x1400c5060
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
xor edx, edx
mov rcx, rsi
call fcn.140134de0
xor edx, edx
mov rcx, rsi
lea rsi, [rbx + 8]
call fcn.140134d10
mov rcx, rsi
mov rdx, 0xffffffffffffffff
call fcn.14001f9e0
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea rdx, [fcn.1400c3cc0]
call fcn.14001f8a0
pxor xmm0, xmm0
movups xmmword [rbx + 0x50], xmm0
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x1400c50c0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r12, qword [0x140207460]
mov rax, qword [r12]
mov qword [rsp + 0x58], rax
xor eax, eax
mov rbp, rcx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rbp, rbp
je 0x1400c5210
test rax, rax
je 0x1400c5233
xor edx, edx
mov ecx, dword [0x140242fc8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
movabs rax, 0x1ffffffff
and rax, qword [0x1401c45d8]
movabs rdx, 0x100000000
cmp rax, rdx
jne 0x1400c51d0
lea r13, [0x140242fa0]
lea rbx, [rsp + 0x40]
mov rcx, r13
lea rdi, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsi + 8]
mov rdx, rbx
call fcn.14001fd30
jmp 0x1400c5168
mov rcx, rdi
call fcn.14001fb20
mov rcx, rbx
call fcn.14001fd50
mov rdx, rax
test rax, rax
jne 0x1400c5160
lea rdx, [rsi + 0x38]
lea rcx, [rbp + 0x38]
call fcn.140135100
movdqu xmm0, xmmword [rbp + 0x50]
movdqu xmm1, xmmword [rsi + 0x50]
mov rcx, r13
mov eax, dword [0x140242fcc]
paddd xmm0, xmm1
sub eax, 1
movups xmmword [rbp + 0x50], xmm0
mov dword [0x140242fcc], eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rsi
call fcn.1400d2670
mov rax, qword [rsp + 0x58]
sub rax, qword [r12]
jne 0x1400c522e
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, dword [rsi + 0x5c]
lea r9, str.fscache_merge:_lstat__u__opendir__u__total_requests_misses__u__u_n
lea r8, str.GIT_TRACE_FSCACHE
mov edx, 0x2ff
lea rcx, str.compat_win32_fscache.c
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 0x58]
mov dword [rsp + 0x30], eax
mov eax, dword [rsi + 0x54]
mov dword [rsp + 0x28], eax
mov eax, dword [rsi + 0x50]
mov dword [rsp + 0x20], eax
call fcn.14008dc10
jmp 0x1400c5134
mov rax, qword [rsp + 0x58]
sub rax, qword [r12]
jne 0x1400c522e
xor ecx, ecx
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400c4c90
call fcn.1401be670
lea r8, str.fscache_merge___called_on_a_thread_where_fscache_has_not_been_initialized
mov edx, 0x2fc
lea rcx, str.compat_win32_fscache.c
call fcn.1400a0ca0
nop
nop
nop
nop
nop
Function at 0x1400c52d0
Capabilities:
Get file attributes

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
sub rsp, 0xc0
lea rbp, [rsp + 0xc0]
mov r12, qword [0x140207460]
mov rax, qword [r12]
mov qword [rbp - 8], rax
xor eax, eax
mov rdi, r8
test rdx, rdx
js 0x1400c5335
lea rbx, [rdx + rdx + 2]
lea rax, [rbx + 0xf]
and rax, 0xfffffffffffffff0
call fcn.1401be370
sub rsp, rax
mov rdx, rcx
lea r8, [rbx - 2]
lea r9, [rsp + 0x40]
mov rcx, r9
call sub.msvcrt.dll_memcpy
mov r9, rax
xor eax, eax
mov word [r9 + rbx - 2], ax
mov rcx, r9
mov dword [rsp + 0x28], 0x2200000
xor r9d, r9d
mov r8d, 7
mov edx, 0x100008
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400c53d0
mov dword [rsp + 0x20], 0x46
lea rdx, [rbp - 0x80]
lea r8, [rbp - 0x70]
mov rcx, rax
mov r9d, 0x60
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
mov esi, eax
test eax, eax
jne 0x1400c53c0
test byte [rbp - 0x28], 4
jne 0x1400c53b8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp - 8]
sub rax, qword [r12]
jne 0x1400c53d7
mov eax, esi
mov rsp, rbp
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
mov eax, dword [rbp - 0x1c]
mov word [rdi], ax
jmp 0x1400c5396
mov esi, 0xffffffff
jmp 0x1400c5396
mov esi, 0xffffffff
jmp 0x1400c539f
call fcn.1401be670
nop
nop dword [rax]

Function at 0x1400c53e0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rsi, qword [0x140207460]
mov rax, qword [rsi]
mov qword [rsp + 0x48], rax
xor eax, eax
movzx edi, dx
and dx, 0xf000
mov rbx, rcx
sub dx, 0x4000
test dx, 0xb000
jne 0x1400c546e
lea rcx, [rsp + 0x38]
mov r8d, 7
movabs rax, 0x4060000000000
lea rdx, str._LXMOD
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1400c6190
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, rbx
mov dword [rsp + 0x3f], edi
mov r9d, 0x14
mov byte [rsp + 0x43], 0
call qword [sym.imp.ntdll.dll_NtSetEaFile]
mov rdx, qword [rsp + 0x48]
sub rdx, qword [rsi]
jne 0x1400c5488
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x75
lea rdx, str.compat_win32_wsl.c
lea rcx, str.S_ISREG_mode___S_ISDIR_mode_
call qword [sym.imp.msvcrt.dll__assert]
call fcn.1401be670
nop
nop

Function at 0x1400c5490
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xb8
mov rsi, qword [0x140207460]
mov r9d, 0x60
mov rax, qword [rsi]
mov qword [rsp + 0xa8], rax
xor eax, eax
mov rbx, rdx
lea r8, [rsp + 0x40]
mov dword [rsp + 0x20], 0x46
lea rdx, [rsp + 0x30]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
test eax, eax
jne 0x1400c5508
test byte [rsp + 0x88], 4
jne 0x1400c54f8
mov rdx, qword [rsp + 0xa8]
sub rdx, qword [rsi]
jne 0x1400c550f
add rsp, 0xb8
pop rbx
pop rsi
ret
mov edx, dword [rsp + 0x94]
mov word [rbx], dx
jmp 0x1400c54dc
mov eax, 0xffffffff
jmp 0x1400c54dc
call fcn.1401be670
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400c6200
Capabilities:
Set environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov esi, r8d
test rcx, rcx
je 0x1400c62d0
mov edx, 0x3d
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x1400c62d0
test rdi, rdi
je 0x1400c62d0
test esi, esi
jne 0x1400c6260
mov rcx, rbx
call fcn.1400bbaa0
xor edx, edx
test rax, rax
je 0x1400c6260
mov eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, rdi
mov rbp, rax
call sub.msvcrt.dll_strlen
lea r13, [rbp + rax]
mov r12, rax
lea rcx, [r13 + 2]
call fcn.1400d2260
mov rsi, rax
test rax, rax
je 0x1400c62e4
mov r8, rbp
mov rdx, rbx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov byte [rsi + rbp], 0x3d
mov r8, r12
mov rdx, rdi
lea rcx, [rsi + rbp + 1]
call sub.msvcrt.dll_memcpy
mov rcx, rsi
mov byte [rsi + r13 + 1], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.1400bb4b0
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
or edx, 0xffffffff
jmp 0x1400c624d
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0xc
jmp 0x1400c62dc
Function at 0x1400c6340
Capabilities:
Get file size

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r12, qword [0x140207460]
mov rdi, qword [rsp + 0xb8]
mov r13, rdi
shr r13, 0x20
mov rax, qword [r12]
mov qword [rsp + 0x38], rax
xor eax, eax
mov rsi, rdx
mov rbp, rcx
mov r14d, r8d
mov ecx, dword [rsp + 0xb0]
mov r15d, r9d
call qword [sym.imp.msvcrt.dll__get_osfhandle]
lea rdx, [rsp + 0x30]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400c650f
mov rax, qword [rsp + 0x30]
lea rdx, [rdi + rsi]
cmp rax, rdx
jb 0x1400c6460
and r15d, 1
je 0x1400c64fe
cmp r14d, 1
je 0x1400c6478
mov rcx, rbx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x1400c64f0
mov edx, 1
mov qword [rsp + 0x20], rsi
mov rcx, rbx
mov r9d, edi
mov r8d, r13d
mov qword [rsp + 0x28], rbp
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400c64b0
test rsi, rsi
je 0x1400c64c5
mov rax, qword [rsp + 0x38]
sub rax, qword [r12]
jne 0x1400c650a
mov rax, rsi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
sub rax, rdi
js 0x1400c651b
mov rsi, rax
jmp 0x1400c63b5
mov rcx, rbx
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov r8d, 2
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x1400c64f0
mov edx, 4
jmp 0x1400c63ff
lea rcx, str.unable_to_close_file_mapping_handle
call fcn.1400a0c10
test rsi, rsi
jne 0x1400c6435
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x5af
sete bl
call qword [sym.imp.msvcrt.dll__errno]
lea ebx, [rbx + rbx*4 + 0x16]
mov dword [rax], ebx
mov rsi, 0xffffffffffffffff
jmp 0x1400c6435
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x16
jmp 0x1400c64e1
lea rcx, str.Invalid_usage_of_mmap_when_built_with_USE_WIN32_MMAP
call fcn.1400a08a0
call fcn.1401be670
lea rcx, str.mmap:_could_not_determine_filesize
call fcn.1400a08a0
lea rcx, [0x1401e21c3]
call fcn.1400a08a0
nop
nop dword [rax + rax]
Function at 0x1400cd8d0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rdi, qword [rsp + 0xd8]
mov r12d, dword [rsp + 0xd0]
mov r14, qword [rdx]
mov rsi, rcx
mov rcx, qword [0x140207460]
mov qword [rsp + 0x38], rdx
mov rbx, r8
mov dword [rsp + 0xc8], r9d
mov rax, qword [rcx]
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x28], rdi
mov rcx, rsi
mov dword [rsp + 0x20], r12d
call fcn.1400cd780
mov edx, dword [rdi]
mov rbp, rax
test edx, edx
je 0x1400cd93b
test rax, rax
je 0x1400cd9e6
mov r13d, dword [rsp + 0xc8]
lea r15, [rsp + 0x40]
or r13d, 0x400000
jmp 0x1400cd9ac
cmp al, 9
jne 0x1400cd961
test r12d, r12d
jne 0x1400cd9d1
mov qword [rsp + 0x28], rdi
mov rdx, qword [rsp + 0x38]
mov r8, rbx
mov rcx, rsi
mov dword [rsp + 0x20], r12d
mov r9d, dword [rsp + 0xc8]
call fcn.1400cd780
mov r8, rax
mov eax, dword [rdi]
test eax, eax
je 0x1400cd991
test r8, r8
je 0x1400cd9e6
mov rdx, rbp
mov r9, r15
mov rcx, r14
mov byte [rsp + 0x48], 0xa
call fcn.1400c7240
mov rbp, rax
test rax, rax
je 0x1400cd9e0
cmp byte [rbx + 8], 0xa
jne 0x1400cd9e8
mov rdx, rsi
mov r8d, r13d
mov rcx, rbx
call fcn.1400c8970
add dword [rsi + 0x20], eax
movzx eax, byte [rbx + 8]
mov edx, eax
and edx, 0xfffffff7
cmp dl, 2
jne 0x1400cd958
xor r8d, r8d
jmp 0x1400cd991
mov dword [rdi], 0xc
xor ebp, ebp
mov rdi, qword [0x140207460]
mov rax, qword [rsp + 0x58]
sub rax, qword [rdi]
jne 0x1400cda0d
mov rax, rbp
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1401be670
nop
nop word cs:[rax + rax]
nop
Function at 0x1400d2060
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
lea rax, [rdx + 7]
shr rax, 3
mov rax, qword [rcx + rax*8 + 8]
mov r8, qword [rax + 0x10]
test r8, r8
je 0x1400d2088
add dword [rax + 0x18], 1
mov rdx, qword [r8]
mov qword [rax + 0x10], rdx
mov rax, r8
ret
xor r9d, r9d
jmp fcn.1400d81f0
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rcx, qword [0x1402073a0]
mov rsi, rdx
call fcn.1401be440
mov rcx, qword [rax]
lea rax, [rsi - 1]
test rax, rsi
jne 0x140188190
lea rax, [rbx - 1]
test rax, rbx
jne 0x1401881a0
cmp rbx, rsi
jb 0x1401881a0
cmp rbx, 0x400
ja 0x1401881a0
mov rdx, rbx
add rsp, 0x38
pop rbx
pop rsi
jmp 0x1400d2060
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
ret
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rsi
mov rdx, rbx
call fcn.140187d70
add rsp, 0x38
pop rbx
pop rsi
ret

Function at 0x1400d20f0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rdi
sub rsp, 0x20
cmp rdx, 0x400
ja 0x1400d2130
lea rax, [rdx + 7]
shr rax, 3
mov rax, qword [rcx + rax*8 + 8]
mov r9, qword [rax + 0x10]
test r9, r9
je 0x1400d2130
mov rdx, qword [r9]
add dword [rax + 0x18], 1
mov qword [rax + 0x10], rdx
test r8b, r8b
jne 0x1400d2140
mov rax, r9
add rsp, 0x20
pop rdi
ret
movzx r8d, r8b
add rsp, 0x20
pop rdi
jmp fcn.1400d81f0
mov ecx, 8
test byte [rax + 0xf], 1
je 0x1400d2160
mov rax, qword [0x140207500]
cmp byte [rax], 0
je 0x1400d2168
mov rdi, r9
xor eax, eax
rep stosb byte [rdi], al
jmp 0x1400d2124
mov ecx, dword [rax + 0x1c]
jmp 0x1400d214b
mov r8, rcx
xor edx, edx
mov rcx, r9
call sub.msvcrt.dll_memset
mov r9, rax
jmp 0x1400d2124
Function at 0x1400d2220
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
cmp rdx, 0x400
ja 0x1400d2250
lea rax, [rdx + 7]
shr rax, 3
mov rax, qword [rcx + rax*8 + 8]
mov r8, qword [rax + 0x10]
test r8, r8
je 0x1400d2250
add dword [rax + 0x18], 1
mov rdx, qword [r8]
mov qword [rax + 0x10], rdx
mov rax, r8
ret
xor r9d, r9d
xor r8d, r8d
jmp fcn.1400d81f0

Function at 0x1400d2950
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [0x1402073a0]
mov rbx, rdx
call fcn.1401be440
mov rcx, qword [rax]
cmp rsi, 1
je 0x1400d297d
mov rax, rsi
mul rbx
mov rbx, rax
jo 0x1400d29f0
cmp rbx, 0x400
ja 0x1400d29d0
lea rax, [rbx + 7]
shr rax, 3
mov rax, qword [rcx + rax*8 + 8]
mov r9, qword [rax + 0x10]
test r9, r9
je 0x1400d29d3
mov rdx, qword [r9]
add dword [rax + 0x18], 1
mov ecx, 8
mov qword [rax + 0x10], rdx
test byte [rax + 0xf], 1
jne 0x1400d29b8
mov ecx, dword [rax + 0x1c]
nop dword [rax]
mov rax, qword [0x140207500]
cmp byte [rax], 0
je 0x1400d2a00
mov rdi, r9
xor eax, eax
rep stosb byte [rdi], al
jmp 0x1400d29f3
xor r9d, r9d
mov r8d, 1
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp fcn.1400d81f0
xor r9d, r9d
mov rax, r9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov r8, rcx
xor edx, edx
mov rcx, r9
call sub.msvcrt.dll_memset
mov r9, rax
jmp 0x1400d29f3

Function at 0x1400d4550
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x230
mov rbp, qword [0x140207460]
mov rdi, r8
lea r12, [rsp + 0x20]
mov r8, r9
mov rbx, rcx
mov rax, qword [rbp]
mov qword [rsp + 0x228], rax
xor eax, eax
mov r9, qword [rsp + 0x280]
mov rcx, r12
mov rsi, rdx
mov edx, 0x1ff
call fcn.1401be940
call fcn.1400d4240
mov r9, r12
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1400d4490
mov rax, qword [rsp + 0x228]
sub rax, qword [rbp]
jne 0x1400d45ca
add rsp, 0x230
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1401be670
nop

Function at 0x1400d45d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x280
mov rdi, qword [0x140207460]
mov rax, qword [rdi]
mov qword [rsp + 0x278], rax
xor eax, eax
mov rbx, rcx
mov rsi, rdx
mov rbp, r8
call sub.msvcrt.dll_strlen
cmp rax, 0x20
jbe 0x1400d4650
test rsi, rsi
je 0x1400d4613
call fcn.1400d4260
test al, al
jne 0x1400d4638
mov rax, qword [rsp + 0x278]
sub rax, qword [rdi]
jne 0x1400d46c2
add rsp, 0x280
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rsp + 0x20], rbp
mov r9, rsi
mov r8, rbx
xor edx, edx
xor ecx, ecx
call fcn.1400d4550
jmp 0x1400d4613
call fcn.1400d3d80
test al, al
jne 0x1400d4605
mov rax, qword gs:[0x30]
mov qword [rsp + 0x20], rax
lea r12, [rsp + 0x30]
mov r9, rbx
lea r8, str._sthread_0x_llx:
mov edx, 0x40
mov rcx, r12
call fcn.1400d4290
test rsi, rsi
je 0x1400d4613
call fcn.1400d4260
test al, al
je 0x1400d4613
lea rbx, [rsp + 0x70]
mov r9, rbp
mov r8, rsi
mov edx, 0x1ff
mov rcx, rbx
call fcn.1401be940
call fcn.1400d4240
mov r9, rbx
mov r8, r12
xor edx, edx
xor ecx, ecx
call fcn.1400d4490
jmp 0x1400d4613
call fcn.1401be670
nop
nop dword [rax + rax]
Function at 0x1400d46d0
Capabilities:
Query environment variable

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, qword [0x140207460]
mov qword [rsp + 0x88], r9
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
lea r12, [rsp + 0x88]
mov qword [rsp + 0x30], r12
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
xor eax, eax
test r8, r8
je 0x1400d4718
call fcn.1400d4260
test al, al
jne 0x1400d4730
mov rax, qword [rsp + 0x38]
sub rax, qword [rbp]
jne 0x1400d4748
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov qword [rsp + 0x20], r12
mov r9, rbx
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call fcn.1400d4550
jmp 0x1400d4718
call fcn.1401be670
nop
nop

Function at 0x1400d4750
Capabilities:
Query environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, qword [0x140207460]
mov qword [rsp + 0x68], r9
mov r9d, dword [0x1401c58e4]
mov rbx, rcx
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
xor eax, eax
test r9d, r9d
je 0x1400d4810
mov r8d, dword [0x1401c58e0]
test r8d, r8d
jne 0x1400d47b3
mov ecx, dword [0x1401c58a4]
test ecx, ecx
je 0x1400d4800
mov edx, dword [0x1401c58a0]
test edx, edx
je 0x1400d47cc
mov eax, dword [0x1401c5be0]
test eax, eax
jns 0x1400d47e0
lea r8, [rsp + 0x58]
mov rdx, rbx
lea rcx, str.mimalloc:_warning:
mov qword [rsp + 0x20], r8
call fcn.1400d45d0
mov rax, qword [rsp + 0x28]
sub rax, qword [rsi]
jne 0x1400d4821
add rsp, 0x38
pop rbx
pop rsi
ret
mov eax, 1
lock xadd qword [0x140243318], rax
cmp dword [0x1401c5be0], eax
jge 0x1400d47b3
jmp 0x1400d47cc
lea rcx, [0x1401c58a0]
call fcn.1400d4830
jmp 0x1400d479f
lea rcx, [0x1401c58e0]
call fcn.1400d4830
jmp 0x1400d4789
call fcn.1401be670
nop
nop word [rax + rax]