joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031490
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov ebx, r9d
mov rsi, r8
test r8, r8
je 0x1400314b0
mov qword [rsi], 0
call fcn.140031290
test rax, rax
je 0x1400314eb
mov rdi, rax
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x1400314e2
mov ebp, eax
mov rcx, rdi
xor edx, edx
mov r8d, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
je 0x140031500
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor r14d, r14d
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
cmp eax, 0xffffffff
je 0x1400314e2
mov r14d, eax
xor r15d, r15d
mov rcx, rdi
mov edx, ebp
xor r8d, r8d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
neg eax
sbb r15d, r15d
or r15d, r14d
cmp r15d, 0xffffffff
je 0x1400314e2
movsxd r15, r15d
movsxd r12, ebx
lea rcx, [r15 + r12]
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14003154c
inc dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec338]
test rax, rax
je 0x1400314e2
mov r14, rax
mov edx, 1
mov rcx, rax
mov r8, r15
mov r9, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r15
jne 0x1400315a8
test ebx, ebx
jle 0x14003158e
mov rcx, r14
add rcx, r15
xor edx, edx
mov r8, r12
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400314ee
mov qword [rsi], r15
jmp 0x1400314ee
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14020ab90]
test rax, rax
je 0x1400315c3
dec dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
mov rcx, r14
call qword [0x1401ec340]
jmp 0x1400314eb
Function at 0x140038840
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r9, r8
mov r8, rdx
mov rax, qword [rcx + 0xf8]
movsxd rdx, dword [rcx + 0xf0]
mov eax, dword [rax + rdx*4 - 4]
not eax
test r9, r9
je 0x1400388ce
mov rdx, r9
sub rdx, r8
je 0x1400388ce
mov rdx, r8
not rdx
add rdx, r9
lea r10, [r8 + 2]
lea r11, [0x1401148a0]
mov edi, eax
jmp 0x1400388ae
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, ebx
xor esi, dword [r11 + rdi*4]
inc r10
mov edi, esi
add rdx, 0xffffffffffffffff
jae 0x14003892b
movzx ebx, byte [r10 - 2]
cmp ebx, 0x23
jne 0x140038890
cmp rdx, 2
jb 0x140038890
cmp byte [r10 - 1], 0x23
jne 0x140038890
cmp byte [r10], 0x23
cmove edi, eax
jmp 0x140038890
movzx r11d, byte [r8]
test r11b, r11b
je 0x140038929
lea rdx, [r8 + 2]
lea r10, [0x1401148a0]
mov edi, eax
jmp 0x140038910
movzx r11d, r11b
mov esi, edi
shr esi, 8
movzx edi, dil
xor edi, r11d
xor esi, dword [r10 + rdi*4]
inc rdx
mov r11d, ebx
mov edi, esi
test bl, bl
je 0x14003892b
movzx ebx, byte [rdx - 1]
cmp r11b, 0x23
jne 0x1400388f0
cmp bl, 0x23
jne 0x1400388f0
cmp byte [rdx], 0x23
cmove edi, eax
mov bl, 0x23
jmp 0x1400388f0
mov esi, eax
not esi
mov rax, qword [rcx]
cmp dword [rax + 0x3f40], esi
jne 0x140038944
mov ecx, esi
mov edx, 0xb
call fcn.140039050
mov eax, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400481c0
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov edi, r9d
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x14020ab90]
mov rcx, qword [rax + 0x3ef8]
mov byte [rcx + 0xb8], 1
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebp, dword [rcx + rdx*4 - 4]
movzx r9d, byte [r14]
test r9b, r9b
je 0x140048261
not ebp
lea rcx, [r14 + 2]
lea rdx, [0x1401148a0]
mov r8d, ebp
jmp 0x14004823e
movzx r9d, r9b
movzx r11d, r8b
shr r8d, 8
xor r11d, r9d
xor r8d, dword [rdx + r11*4]
inc rcx
mov r9d, r10d
test r10b, r10b
je 0x14004825b
movzx r10d, byte [rcx - 1]
cmp r9b, 0x23
jne 0x140048220
cmp r10b, 0x23
jne 0x140048220
cmp byte [rcx], 0x23
cmove r8d, ebp
mov r10b, 0x23
jmp 0x140048220
not r8d
mov ebp, r8d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], ebp
jne 0x14004827e
mov ecx, ebp
mov edx, 0xb
mov r8, r14
xor r9d, r9d
call fcn.140039050
mov dword [rsp + 0x20], edi
mov rcx, r14
mov edx, ebp
mov r8, rsi
mov r9d, ebx
call fcn.140047dc0
nop
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400491b0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
test r9b, r9b
je 0x14004920d
add rcx, 2
mov edx, 0xffffffff
lea r8, [0x1401148a0]
mov eax, 0xffffffff
jmp 0x1400491ed
movzx r9d, r9b
movzx r11d, al
shr eax, 8
xor r11d, r9d
xor eax, dword [r8 + r11*4]
inc rcx
mov r9d, r10d
test r10b, r10b
je 0x140049209
movzx r10d, byte [rcx - 1]
cmp r9b, 0x23
jne 0x1400491d0
cmp r10b, 0x23
jne 0x1400491d0
cmp byte [rcx], 0x23
cmove eax, edx
mov r10b, 0x23
jmp 0x1400491d0
not eax
jmp 0x14004920f
xor eax, eax
mov rdx, qword [0x14020ab90]
mov rcx, qword [rdx + 0x3ee0]
movsxd r8, dword [rdx + 0x3ed8]
test r8, r8
je 0x140049267
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x140049248
mov r10, r9
test r9, r9
je 0x14004926d
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x140049240
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x140049240
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x140049282
cmp dword [rdx], eax
jne 0x140049282
mov rax, qword [rdx + 8]
ret
xor eax, eax
ret
Function at 0x14004acd0
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r8, rcx
mov rax, qword [0x14020ab90]
mov rbx, qword [rax + 0x3ef8]
mov rcx, qword [rbx + 0xf8]
movsxd rax, dword [rbx + 0xf0]
mov esi, dword [rcx + rax*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x14004ad61
not esi
lea rcx, [r8 + 2]
lea rdx, [0x1401148a0]
mov r9d, esi
jmp 0x14004ad3e
movzx r10d, r10b
movzx edi, r9b
shr r9d, 8
xor edi, r10d
xor r9d, dword [rdx + rdi*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14004ad5b
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x14004ad20
cmp r11b, 0x23
jne 0x14004ad20
cmp byte [rcx], 0x23
cmove r9d, esi
mov r11b, 0x23
jmp 0x14004ad20
not r9d
mov esi, r9d
mov rcx, qword [rbx]
cmp dword [rcx + 0x3f40], esi
jne 0x14004ad81
mov ecx, esi
mov edx, 0xb
xor r9d, r9d
call fcn.140039050
mov eax, dword [rbx + 0xf0]
cmp eax, dword [rbx + 0xf4]
jne 0x14004ae39
lea ebp, [rax + 1]
test eax, eax
je 0x14004ada1
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14004ada6
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x14004ae39
movsxd rcx, ebp
shl rcx, 2
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004adcc
inc dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec338]
mov rdi, rax
mov rdx, qword [rbx + 0xf8]
test rdx, rdx
je 0x14004ae26
movsxd r8, dword [rbx + 0xf0]
shl r8, 2
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x14004ae19
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004ae19
dec dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec340]
mov qword [rbx + 0xf8], rdi
mov dword [rbx + 0xf4], ebp
mov eax, dword [rbx + 0xf0]
mov rcx, qword [rbx + 0xf8]
cdqe
mov dword [rcx + rax*4], esi
inc dword [rbx + 0xf0]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14004ae60
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [0x14020ab90]
mov rbx, qword [rax + 0x3ef8]
mov r9d, ecx
shr r9d, 8
mov r8d, ecx
shr r8d, 0x10
mov edx, ecx
shr edx, 0x18
mov r10, qword [rbx + 0xf8]
movsxd rax, dword [rbx + 0xf0]
mov r10d, dword [r10 + rax*4 - 4]
not r10d
mov r11d, r10d
shr r11d, 8
xor r10d, ecx
movzx r10d, r10b
lea rdi, [0x1401148a0]
xor r11d, dword [rdi + r10*4]
mov r10d, r11d
shr r10d, 8
xor r11d, r9d
movzx r9d, r11b
xor r10d, dword [rdi + r9*4]
mov esi, r10d
shr esi, 8
xor r10d, r8d
movzx r8d, r10b
xor esi, dword [rdi + r8*4]
movzx r8d, sil
shr esi, 8
xor r8d, edx
xor esi, dword [rdi + r8*4]
mov rdx, qword [rbx]
not esi
cmp dword [rdx + 0x3f40], esi
jne 0x14004af0e
movsxd r8, ecx
mov ecx, esi
mov edx, 4
xor r9d, r9d
call fcn.140039050
mov eax, dword [rbx + 0xf0]
cmp eax, dword [rbx + 0xf4]
jne 0x14004afc6
lea ebp, [rax + 1]
test eax, eax
je 0x14004af2e
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
add ecx, eax
jmp 0x14004af33
mov ecx, 8
cmp ecx, ebp
cmovg ebp, ecx
cmp eax, ebp
jge 0x14004afc6
movsxd rcx, ebp
shl rcx, 2
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004af59
inc dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec338]
mov rdi, rax
mov rdx, qword [rbx + 0xf8]
test rdx, rdx
je 0x14004afb3
movsxd r8, dword [rbx + 0xf0]
shl r8, 2
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0xf8]
test rcx, rcx
je 0x14004afa6
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004afa6
dec dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec340]
mov qword [rbx + 0xf8], rdi
mov dword [rbx + 0xf4], ebp
mov eax, dword [rbx + 0xf0]
mov rcx, qword [rbx + 0xf8]
cdqe
mov dword [rcx + rax*4], esi
inc dword [rbx + 0xf0]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x14004b120
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov r8, rcx
mov rax, qword [0x14020ab90]
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov esi, dword [rcx + rdx*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x14004b1b1
not esi
lea rcx, [r8 + 2]
lea rdx, [0x1401148a0]
mov r9d, esi
jmp 0x14004b18e
movzx r10d, r10b
movzx edi, r9b
shr r9d, 8
xor edi, r10d
xor r9d, dword [rdx + rdi*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14004b1ab
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x14004b170
cmp r11b, 0x23
jne 0x14004b170
cmp byte [rcx], 0x23
cmove r9d, esi
mov r11b, 0x23
jmp 0x14004b170
not r9d
mov esi, r9d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], esi
jne 0x14004b1cb
mov ecx, esi
mov edx, 0xb
xor r9d, r9d
call fcn.140039050
mov eax, esi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14004ca70
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov esi, edx
mov rax, qword [0x140208a80]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, qword [0x14020ab90]
cmp byte [rbx + 0x4a9d], 0
jne 0x14004caa3
mov edi, ecx
cmp byte [rbx + 0x4a9e], 0
je 0x14004cb00
movss xmm0, dword [rbx + 0x389c]
unpcklps xmm0, xmm0
mulps xmm0, xmmword [0x1401147c0]
movsd xmm1, qword [rbx + 0xe08]
addps xmm1, xmm0
movlps qword [rbx + 0x47e0], xmm1
mov qword [rbx + 0x47e8], 0
mov dword [rbx + 0x47d4], 1
movss xmm0, dword [rbx + 0x3904]
or byte [rbx + 0x47d0], 0x41
mulss xmm0, dword [0x140114810]
movss dword [rbx + 0x4830], xmm0
mov edi, 1
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.140030f10
test dil, 1
je 0x14004cc4e
movzx r9d, byte [rsp + 0x20]
test r9b, r9b
je 0x14004cb8d
mov ecx, 0xffffffff
lea rdx, [rsp + 0x22]
lea r8, [0x1401148a0]
mov eax, 0xffffffff
jmp 0x14004cb6d
movzx r9d, r9b
movzx r11d, al
shr eax, 8
xor r11d, r9d
xor eax, dword [r8 + r11*4]
inc rdx
mov r9d, r10d
test r10b, r10b
je 0x14004cb89
movzx r10d, byte [rdx - 1]
cmp r9b, 0x23
jne 0x14004cb50
cmp r10b, 0x23
jne 0x14004cb50
cmp byte [rdx], 0x23
cmove eax, ecx
mov r10b, 0x23
jmp 0x14004cb50
not eax
jmp 0x14004cb8f
xor eax, eax
mov rdx, qword [0x14020ab90]
mov rcx, qword [rdx + 0x3ee0]
movsxd r8, dword [rdx + 0x3ed8]
test r8, r8
je 0x14004cbe7
mov rdx, rcx
mov r10, r8
mov r9, r8
jmp 0x14004cbc8
mov r10, r9
test r9, r9
je 0x14004cbed
shr r9, 1
mov r11, r9
shl r11, 4
cmp dword [rdx + r11], eax
jae 0x14004cbc0
not r9
add r9, r10
add rdx, r11
add rdx, 0x10
jmp 0x14004cbc0
xor r8d, r8d
mov rdx, rcx
shl r8, 4
add rcx, r8
cmp rdx, rcx
je 0x14004cc4e
cmp dword [rdx], eax
jne 0x14004cc4e
mov rax, qword [rdx + 8]
test rax, rax
je 0x14004cc4e
cmp byte [rax + 0xb6], 0
je 0x14004cc4e
mov byte [rax + 0xbb], 1
mov byte [rax + 0xbd], 1
mov byte [rax + 0xd8], 1
movzx eax, word [rbx + 0x5bc2]
inc eax
mov word [rbx + 0x5bc2], ax
movsx r9d, ax
lea r8, str.Tooltip__02d
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.140030f10
or esi, 0x20c0347
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.140040eb0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14010bb50
mov al, 1
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004cc90
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov esi, edx
mov rdi, rcx
mov r14, qword [0x14020ab90]
mov rax, qword [r14 + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov ebx, dword [rcx + rdx*4 - 4]
movzx r9d, byte [rdi]
test r9b, r9b
je 0x14004cd21
not ebx
lea rcx, [rdi + 2]
lea rdx, [0x1401148a0]
mov r8d, ebx
jmp 0x14004ccfe
movzx r9d, r9b
movzx r11d, r8b
shr r8d, 8
xor r11d, r9d
xor r8d, dword [rdx + r11*4]
inc rcx
mov r9d, r10d
test r10b, r10b
je 0x14004cd1b
movzx r10d, byte [rcx - 1]
cmp r9b, 0x23
jne 0x14004cce0
cmp r10b, 0x23
jne 0x14004cce0
cmp byte [rcx], 0x23
cmove r8d, ebx
mov r10b, 0x23
jmp 0x14004cce0
not r8d
mov ebx, r8d
mov rax, qword [rax]
cmp dword [rax + 0x3f40], ebx
jne 0x14004cd3e
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140039050
test byte [r14 + 0x5ce4], 4
je 0x14004cd5a
lea rcx, str._popup__OpenPopup___s_____0x_08X__n
mov rdx, rdi
mov r8d, ebx
call fcn.140032940
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14004cd70
Function at 0x14004d570
Capabilities:
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r9d, ecx
mov rax, qword [0x140208a80]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x14020ab90]
movsxd rcx, dword [rax + 0x48b0]
cmp dword [rax + 0x48a0], ecx
jle 0x14004d442
mov esi, edx
mov rdx, qword [rax + 0x48a8]
imul rcx, rcx, 0x38
cmp dword [rdx + rcx], r9d
jne 0x14004d442
test esi, 0x10000000
jne 0x14004d464
lea r8, str.Popup__08x
jmp 0x14004d472
mov dword [rax + 0x47d0], 0
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010bb50
mov eax, esi
add rsp, 0x48
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x48c0]
lea r8, str.Menu__02d
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.140030f10
or esi, 0x4000000
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, esi
call fcn.140040eb0
mov esi, eax
test al, al
jne 0x14004d44e
mov rdi, qword [0x14020ab90]
mov rax, qword [rdi + 0x3ef8]
cmp qword [rdi + 0x48d8], rax
je 0x14004d4ce
test byte [rax + 0x17], 1
je 0x14004d4c0
mov byte [rdi + 0x3e5e], 1
call fcn.140046d60
mov byte [rdi + 0x3e5e], 0
jmp 0x14004d44e
cmp byte [rdi + 0x4951], 0
je 0x14004d4b3
cmp dword [rdi + 0x4910], 0
jne 0x14004d4b3
mov ecx, dword [rdi + 0x4954]
and ecx, 0xfffffff0
or ecx, 2
mov dword [rdi + 0x4954], ecx
jmp 0x14004d4b3
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r8, rcx
mov rax, qword [0x14020ab90]
mov ecx, dword [rax + 0x48a0]
cmp ecx, dword [rax + 0x48b0]
jle 0x14004d60b
mov esi, edx
mov rax, qword [rax + 0x3ef8]
mov rcx, qword [rax + 0xf8]
movsxd rdx, dword [rax + 0xf0]
mov edi, dword [rcx + rdx*4 - 4]
movzx r10d, byte [r8]
test r10b, r10b
je 0x14004d625
not edi
lea rcx, [r8 + 2]
lea rdx, [0x1401148a0]
mov r9d, edi
jmp 0x14004d5ee
movzx r10d, r10b
movzx ebx, r9b
shr r9d, 8
xor ebx, r10d
xor r9d, dword [rdx + rbx*4]
inc rcx
mov r10d, r11d
test r11b, r11b
je 0x14004d61f
movzx r11d, byte [rcx - 1]
cmp r10b, 0x23
jne 0x14004d5d0
cmp r11b, 0x23
jne 0x14004d5d0
cmp byte [rcx], 0x23
cmove r9d, edi
mov r11b, 0x23
jmp 0x14004d5d0
mov dword [rax + 0x47d0], 0
xor eax, eax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
not r9d
mov edi, r9d
or esi, 0x141
mov rax, qword [rax]
cmp dword [rax + 0x3f40], edi
jne 0x14004d645
mov ecx, edi
mov edx, 0xb
xor r9d, r9d
call fcn.140039050
mov ecx, edi
mov edx, esi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp 0x14004d3f0
Function at 0x14004d660
Capabilities:
Hash data with crc32

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, qword [0x14020ab90]
mov eax, edx
and eax, 0x1f
cmp byte [rbx + rax + 0x3766], 0
je 0x14004d729
mov esi, edx
mov rdi, rcx
mov r14, qword [rbx + 0x3ef8]
cmp eax, 0xa
ja 0x14004d6ab
add eax, 0x81
lea rax, [rax + rax*2]
cmp byte [rbx + rax*4 + 0x3fa8], 0
jne 0x14004d729
mov ecx, 0x20
call fcn.140039a50
test al, al
je 0x14004d729
test rdi, rdi
je 0x14004d756
mov rax, qword [r14 + 0xf8]
movsxd rcx, dword [r14 + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
movzx r8d, byte [rdi]
test r8b, r8b
je 0x14004d737
not ebx
lea rax, [rdi + 2]
lea rcx, [0x1401148a0]
mov edx, ebx
jmp 0x14004d70d
movzx r8d, r8b
movzx r10d, dl
shr edx, 8
xor r10d, r8d
xor edx, dword [rcx + r10*4]
inc rax
mov r8d, r9d
test r9b, r9b
je 0x14004d733
movzx r9d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14004d6f0
cmp r9b, 0x23
jne 0x14004d6f0
cmp byte [rax], 0x23
cmove edx, ebx
mov r9b, 0x23
jmp 0x14004d6f0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
not edx
mov ebx, edx
mov rax, qword [r14]
cmp dword [rax + 0x3f40], ebx
jne 0x14004d75c
mov ecx, ebx
mov edx, 0xb
mov r8, rdi
xor r9d, r9d
call fcn.140039050
jmp 0x14004d75c
mov ebx, dword [rbx + 0x4794]
mov ecx, ebx
mov edx, esi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14004cd70
Function at 0x14004f060
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
lea r14, [rcx + 0x5cb0]
cmp qword [rcx + 0x5ca8], 0
je 0x14004f169
mov rsi, rcx
cmp dword [rcx + 0x5cb4], 0
jns 0x14004f10d
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004f0a4
inc dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
xor ecx, ecx
call qword [0x1401ec338]
mov r15, rax
mov rdx, qword [rsi + 0x5cb8]
test rdx, rdx
je 0x14004f0fc
movsxd r8, dword [rsi + 0x5cb0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rsi + 0x5cb8]
test rcx, rcx
je 0x14004f0ef
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004f0ef
dec dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec340]
mov qword [rsi + 0x5cb8], r15
mov dword [rsi + 0x5cb4], 0
mov dword [rsi + 0x5cb0], 0
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.140032090
mov r9, qword [rsi + 0x5ca8]
mov eax, dword [rsi + 0x5cb0]
xor ecx, ecx
sub eax, 1
cmovb eax, ecx
movsxd r8, eax
mov rax, qword [rsi + 0x5cb8]
test rax, rax
lea rcx, [0x14020ab98]
cmovne rcx, rax
mov edx, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, r14
mov rdx, rbx
mov r8, rdi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140032090
Function at 0x14004f740
Capabilities:
Hash data with crc32

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r14, qword [0x14020ab90]
lea rdx, [0x140115ff9]
call sub.VCRUNTIME140.dll_strstr
mov rsi, rax
test rax, rax
cmove rsi, rdi
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rdi, rax
movsxd r15, dword [r14 + 0x5c30]
and eax, 0xfffffffc
lea r12d, [rax + r15]
add r12d, 0x18
mov ebp, eax
add ebp, 0x18
mov eax, dword [r14 + 0x5c34]
cmp eax, r12d
jge 0x14004f838
test eax, eax
je 0x14004f7b8
mov r13d, eax
shr r13d, 0x1f
add r13d, eax
sar r13d, 1
add r13d, eax
jmp 0x14004f7be
mov r13d, 8
cmp r13d, r12d
cmovle r13d, r12d
cmp eax, r13d
jge 0x14004f838
movsxd rcx, r13d
inc dword [r14 + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec338]
mov rbx, rax
mov rdx, qword [r14 + 0x5c38]
test rdx, rdx
je 0x14004f82a
movsxd r8, dword [r14 + 0x5c30]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [r14 + 0x5c38]
test rcx, rcx
je 0x14004f81d
mov rax, qword [0x14020ab90]
test rax, rax
je 0x14004f81d
dec dword [rax + 0xf4]
mov rdx, qword [0x14020aba0]
call qword [0x1401ec340]
mov qword [r14 + 0x5c38], rbx
mov dword [r14 + 0x5c34], r13d
mov dword [r14 + 0x5c30], r12d
mov rax, qword [r14 + 0x5c38]
mov dword [rax + r15], ebp
mov rax, qword [r14 + 0x5c38]
lea rbx, [rax + r15]
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rax + r15 + 4], xmm0
test rdi, rdi
je 0x14004f8d2
lea rax, [rdi - 1]
lea rcx, [rsi + 2]
mov edx, 0xffffffff
lea r8, [0x1401148a0]
mov r10d, 0xffffffff
jmp 0x14004f8b2
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r11d
xor r9d, dword [r8 + r10*4]
inc rcx
mov r10d, r9d
add rax, 0xffffffffffffffff
jae 0x14004f947
movzx r11d, byte [rcx - 2]
cmp r11d, 0x23
jne 0x14004f890
cmp rax, 2
jb 0x14004f890
cmp byte [rcx - 1], 0x23
jne 0x14004f890
cmp byte [rcx], 0x23
cmove r10d, edx
jmp 0x14004f890
movzx r8d, byte [rsi]
test r8b, r8b
je 0x14004f941
lea rax, [rsi + 2]
mov ecx, 0xffffffff
lea rdx, [0x1401148a0]
mov r10d, 0xffffffff
jmp 0x14004f924
movzx r8d, r8b
mov r9d, r10d
shr r9d, 8
movzx r10d, r10b
xor r10d, r8d
xor r9d, dword [rdx + r10*4]
inc rax
mov r8d, r11d
mov r10d, r9d
test r11b, r11b
je 0x14004f947
movzx r11d, byte [rax - 1]
cmp r8b, 0x23
jne 0x14004f900
cmp r11b, 0x23
jne 0x14004f900
cmp byte [rax], 0x23
cmove r10d, ecx
mov r11b, 0x23
jmp 0x14004f900
mov r9d, 0xffffffff
not r9d
mov dword [rbx], r9d
lea rcx, [rbx + 0x10]
inc rdi
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140064160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
movaps xmm6, xmm2
mov rsi, rdx
movzx eax, word [rsp + 0x88]
movsxd rdx, dword [rcx + 0x18]
cmp rax, rdx
jae 0x140064198
mov rdx, qword [rcx + 0x20]
movzx eax, word [rdx + rax*2]
cmp rax, 0xffff
jne 0x1400641a6
mov rbx, qword [rcx + 0x38]
test rbx, rbx
jne 0x1400641bb
jmp 0x14006430f
lea rbx, [rax + rax*4]
shl rbx, 3
add rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x14006430f
mov eax, dword [rbx]
test al, 2
je 0x14006430f
mov edx, dword [rsp + 0x80]
mov edi, edx
or edi, 0xffffff
test al, 1
cmove edi, edx
xorps xmm0, xmm0
ucomiss xmm6, xmm0
jae 0x1400641eb
movss xmm6, dword [0x140110e30]
jmp 0x1400641f0
divss xmm6, dword [rcx + 0x14]
movsd xmm0, qword [r9]
cvttps2dq xmm0, xmm0
cvtdq2ps xmm7, xmm0
mov rcx, rsi
mov edx, 6
mov r8d, 4
call fcn.1400532a0
mov eax, dword [rbx + 0x24]
mov edx, dword [rbx + 0x20]
mov r8d, dword [rbx + 0x1c]
mov ecx, dword [rbx + 0x18]
shufps xmm6, xmm6, 0
movsd xmm1, qword [rbx + 8]
movsd xmm0, qword [rbx + 0x10]
mulps xmm1, xmm6
addps xmm1, xmm7
mov r9d, dword [rsi + 0x34]
mov r10, qword [rsi + 0x50]
lea r11d, [r9 + 1]
lea ebx, [r9 + 2]
mov word [r10], r9w
mov r10, qword [rsi + 0x50]
mov word [r10 + 2], r11w
mov r10, qword [rsi + 0x50]
mov word [r10 + 4], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 6], r9w
add r9d, 3
movaps xmm2, xmm1
shufps xmm2, xmm1, 0x55
mulps xmm0, xmm6
addps xmm0, xmm7
mov r10, qword [rsi + 0x50]
mov word [r10 + 8], bx
mov r10, qword [rsi + 0x50]
mov word [r10 + 0xa], r9w
mov r9, qword [rsi + 0x48]
movlps qword [r9], xmm1
mov r9, qword [rsi + 0x48]
mov dword [r9 + 8], ecx
mov dword [r9 + 0xc], r8d
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x10], edi
mov r9, qword [rsi + 0x48]
movss dword [r9 + 0x14], xmm0
movss dword [r9 + 0x18], xmm2
mov r9, qword [rsi + 0x48]
mov dword [r9 + 0x1c], edx
mov dword [r9 + 0x20], r8d
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x24], edi
mov r8, qword [rsi + 0x48]
movlps qword [r8 + 0x28], xmm0
mov r8, qword [rsi + 0x48]
mov dword [r8 + 0x30], edx
mov dword [r8 + 0x34], eax
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x38], edi
mov rdx, qword [rsi + 0x48]
movss dword [rdx + 0x3c], xmm1
shufps xmm0, xmm0, 0x55
movss dword [rdx + 0x40], xmm0
mov rdx, qword [rsi + 0x48]
mov dword [rdx + 0x44], ecx
mov dword [rdx + 0x48], eax
mov rax, qword [rsi + 0x48]
mov dword [rax + 0x4c], edi
add qword [rsi + 0x48], 0x50
add dword [rsi + 0x34], 4
add qword [rsi + 0x50], 0xc
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret