joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fca0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14000fec3
add rax, rcx
movzx r8d, word [rax + 6]
test r8, r8
je 0x14000fec3
mov r9d, dword [rax + 0x88]
movzx r10d, word [rax + 0x14]
add rax, r10
add rax, 0x18
shl r8, 3
lea r11, [r8 + r8*4]
mov r10, rax
jmp 0x14000fd0e
add r10, 0x28
add r11, 0xffffffffffffffd8
je 0x14000fec3
mov edi, dword [r10 + 0xc]
mov esi, r9d
sub esi, edi
jb 0x14000fd00
add edi, dword [r10 + 8]
cmp edi, r9d
jbe 0x14000fd00
add esi, dword [r10 + 0x14]
mov r9d, dword [rcx + rsi + 0x18]
mov r11d, dword [rcx + rsi + 0x1c]
lea rdi, [r8 + r8*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14000fd4a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x14000fd66
mov r10d, dword [rbx + 0xc]
mov r14d, r11d
sub r14d, r10d
jb 0x14000fd40
add r10d, dword [rbx + 8]
cmp r10d, r11d
jbe 0x14000fd40
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r8 + r8*4]
xor r11d, r11d
mov r14, rax
jmp 0x14000fd8a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000fda6
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x14000fd80
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x14000fd80
add r15d, dword [r14 + 0x14]
mov r11, r15
add r11, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r8 + r8*4]
xor esi, esi
mov r14, rax
jmp 0x14000fdca
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x14000fde6
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x14000fdc0
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x14000fdc0
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r9d, r9d
je 0x14000fec3
mov qword [rsp], r11
mov qword [rsp + 8], r12
add rsi, rcx
lea rbx, [r8 + r8*4]
xor edi, edi
movabs r14, 0x6f72507465477350
jmp 0x14000fe1c
inc rdi
cmp rdi, r9
je 0x14000fec3
mov r10d, dword [rsi + rdi*4]
mov r13, rbx
mov r15, rax
jmp 0x14000fe3a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x14000fe56
mov r11d, dword [r15 + 0xc]
mov r12d, r10d
sub r12d, r11d
jb 0x14000fe30
add r11d, dword [r15 + 8]
cmp r11d, r10d
jbe 0x14000fe30
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r10d, ebp
lea r15, [rcx + r10]
cmp byte [rcx + r10], 0
mov r10, r15
je 0x14000fe7e
mov r11, r15
nop word [rax + rax]
lea r10, [r11 + 1]
cmp byte [r11 + 1], 0
mov r11, r10
jne 0x14000fe70
sub r10, r15
cmp r10, 0xe
jne 0x14000fe10
cmp qword [r15], r14
jne 0x14000fe10
cmp dword [r15 + 8], 0x73736563
jne 0x14000fe10
movzx r10d, word [r15 + 0xc]
cmp r10d, 0x6449
jne 0x14000fe10
mov rcx, qword [rsp]
movzx ecx, word [rcx + rdi*2]
mov r9, qword [rsp + 8]
mov r9d, dword [r9 + rcx*4]
lea r8, [r8 + r8*4]
jmp 0x14000fee5
xor ecx, ecx
mov byte [rdx + 4], cl
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0x28
xor ecx, ecx
add r8, 0xffffffffffffffd8
je 0x14000fec5
mov r10d, dword [rax + 0xc]
mov ecx, r9d
sub ecx, r10d
jb 0x14000fed9
add r10d, dword [rax + 8]
cmp r10d, r9d
jbe 0x14000fed9
add ecx, dword [rax + 0x14]
mov dword [rdx], ecx
mov cl, 1
jmp 0x14000fec5
Function at 0x140013f20
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x14001414f
add rax, rcx
movzx r11d, word [rax + 6]
test r11, r11
je 0x14001414f
mov r8d, dword [rax + 0x88]
movzx r9d, word [rax + 0x14]
add rax, r9
add rax, 0x18
shl r11, 3
lea r10, [r11 + r11*4]
mov r9, rax
jmp 0x140013f8e
add r9, 0x28
add r10, 0xffffffffffffffd8
je 0x14001414f
mov edi, dword [r9 + 0xc]
mov esi, r8d
sub esi, edi
jb 0x140013f80
add edi, dword [r9 + 8]
cmp edi, r8d
jbe 0x140013f80
add esi, dword [r9 + 0x14]
mov r8d, dword [rcx + rsi + 0x18]
mov r10d, dword [rcx + rsi + 0x1c]
lea rdi, [r11 + r11*4]
xor r12d, r12d
mov rbx, rax
jmp 0x140013fca
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x140013fe6
mov r9d, dword [rbx + 0xc]
mov r14d, r10d
sub r14d, r9d
jb 0x140013fc0
add r9d, dword [rbx + 8]
cmp r9d, r10d
jbe 0x140013fc0
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r11 + r11*4]
xor r10d, r10d
mov r14, rax
jmp 0x14001400a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140014026
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014000
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014000
add r15d, dword [r14 + 0x14]
mov r10, r15
add r10, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r11 + r11*4]
xor esi, esi
mov r14, rax
jmp 0x14001404a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140014066
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014040
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014040
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r8d, r8d
je 0x14001414f
mov qword [rsp], r10
mov qword [rsp + 8], r12
add rsi, rcx
lea rdi, [r11 + r11*4]
xor r11d, r11d
movabs rbx, 0x646564616f4c7350
movabs r14, 0x694c656c75646f4d
jmp 0x1400140ac
inc r11
cmp r11, r8
je 0x14001414f
mov r9d, dword [rsi + r11*4]
mov r13, rdi
mov r15, rax
jmp 0x1400140ca
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x1400140e6
mov r10d, dword [r15 + 0xc]
mov r12d, r9d
sub r12d, r10d
jb 0x1400140c0
add r10d, dword [r15 + 8]
cmp r10d, r9d
jbe 0x1400140c0
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r9d, ebp
lea r15, [rcx + r9]
cmp byte [rcx + r9], 0
mov r9, r15
je 0x14001410e
mov r10, r15
nop word [rax + rax]
lea r9, [r10 + 1]
cmp byte [r10 + 1], 0
mov r10, r9
jne 0x140014100
sub r9, r15
cmp r9, 0x12
jne 0x1400140a0
cmp qword [r15], rbx
jne 0x1400140a0
cmp qword [r15 + 8], r14
jne 0x1400140a0
movzx r9d, word [r15 + 0x10]
cmp r9d, 0x7473
jne 0x1400140a0
mov rax, qword [rsp]
movzx eax, word [rax + r11*2]
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax*4]
mov dword [rdx], eax
mov al, 1
jmp 0x140014151
xor eax, eax
mov byte [rdx + 4], al
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140014170
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x1400143ad
add rax, rcx
movzx r11d, word [rax + 6]
test r11, r11
je 0x1400143ad
mov r8d, dword [rax + 0x88]
movzx r9d, word [rax + 0x14]
add rax, r9
add rax, 0x18
shl r11, 3
lea r10, [r11 + r11*4]
mov r9, rax
jmp 0x1400141de
add r9, 0x28
add r10, 0xffffffffffffffd8
je 0x1400143ad
mov edi, dword [r9 + 0xc]
mov esi, r8d
sub esi, edi
jb 0x1400141d0
add edi, dword [r9 + 8]
cmp edi, r8d
jbe 0x1400141d0
add esi, dword [r9 + 0x14]
mov r8d, dword [rcx + rsi + 0x18]
mov r10d, dword [rcx + rsi + 0x1c]
lea rdi, [r11 + r11*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14001421a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x140014236
mov r9d, dword [rbx + 0xc]
mov r14d, r10d
sub r14d, r9d
jb 0x140014210
add r9d, dword [rbx + 8]
cmp r9d, r10d
jbe 0x140014210
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r11 + r11*4]
xor r10d, r10d
mov r14, rax
jmp 0x14001425a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140014276
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014250
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014250
add r15d, dword [r14 + 0x14]
mov r10, r15
add r10, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r11 + r11*4]
xor esi, esi
mov r14, rax
jmp 0x14001429a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x1400142b6
mov r9d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r9d
jb 0x140014290
add r9d, dword [r14 + 8]
cmp r9d, edi
jbe 0x140014290
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r8d, r8d
je 0x1400143ad
mov qword [rsp], r10
mov qword [rsp + 8], r12
add rsi, rcx
lea rdi, [r11 + r11*4]
xor r11d, r11d
movabs rbx, 0x616974696e497350
movabs r14, 0x506d65747379536c
jmp 0x1400142fc
inc r11
cmp r11, r8
je 0x1400143ad
mov r9d, dword [rsi + r11*4]
mov r13, rdi
mov r15, rax
jmp 0x14001431a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x140014336
mov r10d, dword [r15 + 0xc]
mov r12d, r9d
sub r12d, r10d
jb 0x140014310
add r10d, dword [r15 + 8]
cmp r10d, r9d
jbe 0x140014310
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r9d, ebp
lea r15, [rcx + r9]
cmp byte [rcx + r9], 0
mov r9, r15
je 0x14001435e
mov r10, r15
nop word [rax + rax]
lea r9, [r10 + 1]
cmp byte [r10 + 1], 0
mov r10, r9
jne 0x140014350
sub r9, r15
cmp r9, 0x16
jne 0x1400142f0
cmp qword [r15], rbx
jne 0x1400142f0
cmp qword [r15 + 8], r14
jne 0x1400142f0
cmp dword [r15 + 0x10], 0x65636f72
jne 0x1400142f0
movzx r9d, word [r15 + 0x14]
cmp r9d, 0x7373
jne 0x1400142f0
mov rax, qword [rsp]
movzx eax, word [rax + r11*2]
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax*4]
mov dword [rdx], eax
mov al, 1
jmp 0x1400143af
xor eax, eax
mov byte [rdx + 4], al
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015580
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x10
mov eax, dword [rcx + 0x3c]
cmp dword [rcx + rax + 0x8c], 0
je 0x1400157ae
add rax, rcx
movzx r8d, word [rax + 6]
test r8, r8
je 0x1400157ae
mov r9d, dword [rax + 0x88]
movzx r10d, word [rax + 0x14]
add rax, r10
add rax, 0x18
shl r8, 3
lea r11, [r8 + r8*4]
mov r10, rax
jmp 0x1400155ee
add r10, 0x28
add r11, 0xffffffffffffffd8
je 0x1400157ae
mov edi, dword [r10 + 0xc]
mov esi, r9d
sub esi, edi
jb 0x1400155e0
add edi, dword [r10 + 8]
cmp edi, r9d
jbe 0x1400155e0
add esi, dword [r10 + 0x14]
mov r9d, dword [rcx + rsi + 0x18]
mov r11d, dword [rcx + rsi + 0x1c]
lea rdi, [r8 + r8*4]
xor r12d, r12d
mov rbx, rax
jmp 0x14001562a
add rbx, 0x28
add rdi, 0xffffffffffffffd8
je 0x140015646
mov r10d, dword [rbx + 0xc]
mov r14d, r11d
sub r14d, r10d
jb 0x140015620
add r10d, dword [rbx + 8]
cmp r10d, r11d
jbe 0x140015620
add r14d, dword [rbx + 0x14]
mov r12, r14
add r12, rcx
mov edi, dword [rcx + rsi + 0x24]
lea rbx, [r8 + r8*4]
xor r11d, r11d
mov r14, rax
jmp 0x14001566a
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x140015686
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x140015660
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x140015660
add r15d, dword [r14 + 0x14]
mov r11, r15
add r11, rcx
mov edi, dword [rcx + rsi + 0x20]
lea rbx, [r8 + r8*4]
xor esi, esi
mov r14, rax
jmp 0x1400156aa
add r14, 0x28
add rbx, 0xffffffffffffffd8
je 0x1400156c6
mov r10d, dword [r14 + 0xc]
mov r15d, edi
sub r15d, r10d
jb 0x1400156a0
add r10d, dword [r14 + 8]
cmp r10d, edi
jbe 0x1400156a0
add r15d, dword [r14 + 0x14]
mov rsi, r15
test r9d, r9d
je 0x1400157ae
mov qword [rsp], r11
mov qword [rsp + 8], r12
add rsi, rcx
lea rbx, [r8 + r8*4]
xor edi, edi
movabs r14, 0x6f72507465477350
jmp 0x1400156fc
inc rdi
cmp rdi, r9
je 0x1400157ae
mov r10d, dword [rsi + rdi*4]
mov r13, rbx
mov r15, rax
jmp 0x14001571a
add r15, 0x28
add r13, 0xffffffffffffffd8
je 0x140015736
mov r11d, dword [r15 + 0xc]
mov r12d, r10d
sub r12d, r11d
jb 0x140015710
add r11d, dword [r15 + 8]
cmp r11d, r10d
jbe 0x140015710
add r12d, dword [r15 + 0x14]
mov ebp, r12d
mov r10d, ebp
lea r15, [rcx + r10]
cmp byte [rcx + r10], 0
mov r10, r15
je 0x14001575e
mov r11, r15
nop word [rax + rax]
lea r10, [r11 + 1]
cmp byte [r11 + 1], 0
mov r11, r10
jne 0x140015750
sub r10, r15
cmp r10, 0xf
jne 0x1400156f0
cmp qword [r15], r14
jne 0x1400156f0
cmp dword [r15 + 8], 0x73736563
jne 0x1400156f0
movzx r10d, word [r15 + 0xc]
cmp r10d, 0x6f4a
jne 0x1400156f0
cmp byte [r15 + 0xe], 0x62
jne 0x1400156f0
mov rcx, qword [rsp]
movzx ecx, word [rcx + rdi*2]
mov r9, qword [rsp + 8]
mov r9d, dword [r9 + rcx*4]
lea r8, [r8 + r8*4]
jmp 0x1400157d0
xor ecx, ecx
mov byte [rdx + 4], cl
add rsp, 0x10
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
add rax, 0x28
xor ecx, ecx
add r8, 0xffffffffffffffd8
je 0x1400157b0
mov r10d, dword [rax + 0xc]
mov ecx, r9d
sub ecx, r10d
jb 0x1400157c4
add r10d, dword [rax + 8]
cmp r10d, r9d
jbe 0x1400157c4
add ecx, dword [rax + 0x14]
mov dword [rdx], ecx
mov cl, 1
jmp 0x1400157b0
Function at 0x14001fc90
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [rcx + 0x3c]
movzx r9d, word [rcx + rax + 6]
test r9, r9
je 0x14001fcec
lea r10, [rcx + rax]
movzx eax, word [rcx + rax + 0x14]
add rax, r10
add rax, 0x18
shl r9, 3
lea rcx, [r9 + r9*4]
jmp 0x14001fcca
add rax, 0x28
add rcx, 0xffffffffffffffd8
je 0x14001fcec
mov r10d, dword [rax + 0xc]
mov r9d, r8d
sub r9d, r10d
jb 0x14001fcc0
add r10d, dword [rax + 8]
cmp r10d, r8d
jbe 0x14001fcc0
add r9d, dword [rax + 0x14]
mov dword [rdx], r9d
mov al, 1
mov byte [rdx + 4], al
ret
xor eax, eax
mov byte [rdx + 4], al
ret
Function at 0x1400cb1b0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
mov r8d, edx
shr r8d, 0x10
mov eax, edx
shr eax, 0x18
movzx r9d, dl
movabs r10, 0xcbf29ce484222325
xor r10, r9
movabs r9, 0x100000001b3
imul r10, r9
movzx esi, dh
xor rsi, r10
imul rsi, r9
movzx r8d, r8b
xor r8, rsi
imul r8, r9
xor rax, r8
imul rax, r9
and rax, qword [0x1401221a0]
mov r10, qword [0x140122188]
mov r8, rax
shl r8, 4
mov r8, qword [r10 + r8 + 8]
mov r9, qword [0x140122178]
cmp r8, r9
je 0x1400cb24f
cmp dword [r8 + 0x10], edx
je 0x1400cb23f
add rax, rax
mov rax, qword [r10 + rax*8]
nop dword [rax + rax]
cmp r8, rax
je 0x1400cb24f
mov r8, qword [r8 + 8]
cmp dword [r8 + 0x10], edx
jne 0x1400cb230
cmp r8, r9
je 0x1400cb24f
mov rax, qword [r8 + 0x18]
mov qword [rcx], rax
mov al, 1
jmp 0x1400cb251
xor eax, eax
mov byte [rcx + 8], al
pop rsi
ret
Function at 0x140056390
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400563e2
lea r11, [0x1400d92b0]
cmp r9b, 0x23
jne 0x1400563c5
cmp byte [r8], r9b
jne 0x1400563c5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400563b2
mov r11, qword [0x1406167b0]
mov r10, qword [r11 + 0x3078]
test r10, r10
je 0x140056429
lea r9, [r10 + 4]
test r9, r9
je 0x140056429
not eax
cmp dword [r9], eax
je 0x140056432
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3070]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140056400
mov rcx, rbx
pop rbx
jmp fcn.1400538b0
mov rax, r9
pop rbx
ret

Function at 0x1400569a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400569fd
lea rbx, [0x1400d92b0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400569e4
cmp r10, 2
jb 0x1400569e4
cmp byte [r9], r8b
jne 0x1400569e4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400569c0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140056a3f
lea rbx, [0x1400d92b0]
cmp r8b, 0x23
jne 0x140056a23
cmp byte [r9], r8b
jne 0x140056a23
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140056a10
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140056a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x1406161a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rcx
xor r12d, r12d
mov dword [rbp - 0x2d], r12d
mov qword [rbp - 0x21], r12
mov qword [rbp + 7], r12
lea rax, str.Window
mov qword [rbp - 0x39], rax
mov r15d, 0xffffffff
mov edx, r15d
lea r8, [0x1400d9801]
mov r9b, 0x57
lea r13, [0x1400d92b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140056ad3
cmp byte [r8], r9b
jne 0x140056ad3
cmp byte [r8 + 1], r9b
cmove edx, r15d
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140056ac0
not edx
mov dword [rbp - 0x31], edx
lea rax, [0x140057a60]
mov qword [rbp - 0x29], rax
lea rax, [0x140057c90]
mov qword [rbp - 0x19], rax
lea rax, [0x140057af0]
mov qword [rbp - 0x11], rax
lea rax, [0x140057970]
mov qword [rbp - 9], rax
lea rax, [0x140057cd0]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rcx, [rsi + 0x3060]
call fcn.140058340
mov rax, qword [0x1406167b0]
test rax, rax
je 0x140056b4f
inc dword [rax + 0x3b0]
mov rdx, qword [0x1406167c0]
mov ecx, 0x138
call qword [section..data]
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x49]
mov qword [rbp + 0x17], rcx
mov qword [rbp + 0x1f], rax
test rax, rax
je 0x140056b80
mov rcx, rax
call fcn.140052650
jmp 0x140056b83
mov rax, r12
mov qword [rbp - 0x41], rax
mov dword [rax], 0x11111111
mov dword [rax + 0x68], r12d
mov byte [rax + 0x92], 1
lea rcx, [rsi + 0x1dc8]
lea rdx, [rbp - 0x41]
call fcn.140058260
mov rcx, qword [rsi + 0x1dd0]
mov rax, qword [rcx]
mov qword [rsi + 0x1628], rax
lea rbx, [rsi + 0x1630]
mov rdi, qword [rcx]
mov r8d, dword [rbx + 4]
mov ecx, dword [rbx]
cmp ecx, r8d
jne 0x140056bf6
inc ecx
test r8d, r8d
je 0x140056be2
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140056be7
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400585a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov qword [rax + rcx*8], rdi
inc dword [rbx]
mov dword [rbp - 0x2d], r12d
mov qword [rbp + 7], r12
lea rax, str.Docking
mov qword [rbp - 0x39], rax
mov edx, r15d
lea r8, [0x1400d9971]
mov r9b, 0x44
cmp r9b, 0x23
jne 0x140056c36
cmp byte [r8], r9b
jne 0x140056c36
cmp byte [r8 + 1], r9b
cmove edx, r15d
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r13 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140056c23
not edx
mov dword [rbp - 0x31], edx
lea rax, [0x140055880]
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
lea rax, [0x140055fb0]
mov qword [rbp - 0x19], rax
lea rax, [0x140055b60]
mov qword [rbp - 0x11], rax
lea rax, [0x140055840]
mov qword [rbp - 9], rax
lea rax, [0x140055fe0]
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x39]
lea rcx, [rsi + 0x3060]
call fcn.140058340
mov byte [rsi], 1
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400d3580
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140056d60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1406167b0]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x304c], ecx
test rbx, rbx
je 0x140056dcf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140056de0
lea rdx, [0x1400d981c]
mov rcx, rbx
mov rdi, rax
call fcn.1400567d0
mov rbx, rax
test rax, rax
je 0x140056dca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x140062640
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1406161a8]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140062713
cmp byte [rcx + 0x71], 0
je 0x140062713
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14006270f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400626d4
sub eax, 1
je 0x1400626d8
cmp eax, 2
jne 0x14006270f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d3580
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140062706
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14006270f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400626bc
xor al, al
jmp 0x1400626bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d3580
add rsp, 0x60
pop rbx
ret
Function at 0x1400629b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1406161a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x1400629dd
xor eax, eax
jmp 0x140062b46
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x140062a1d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x140062a1d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x140062b3e
cmp qword [rdi + 0x80], 0
je 0x140062b39
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x140062a57
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x140062a82
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140062b3e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140062af1
sub eax, 1
je 0x140062af1
cmp eax, 2
jne 0x140062b39
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x140062b3e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x140062b1f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x140062b39
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x140062b3e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d3580
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret