joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038030
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x168
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
mov edx, 0x36
lea rcx, [rsp + 0xd0]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x40
mov edx, 0x5c
lea rcx, [rsp + 0x110]
call sub.VCRUNTIME140.dll_memset
cmp qword [rsp + 0x178], 0x40
jbe 0x1400380cd
mov r9d, 0x40
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
call fcn.140038230
nop
jmp 0x1400380e8
mov r8, qword [rsp + 0x178]
mov rdx, qword [rsp + 0x170]
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
nop
mov dword [rsp + 0x30], 0
jmp 0x1400380fc
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0x40
jge 0x14003814f
movsxd rax, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x30]
movzx ecx, byte [rsp + rcx + 0x50]
movzx eax, byte [rsp + rax + 0xd0]
xor eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov byte [rsp + rcx + 0xd0], al
movsxd rax, dword [rsp + 0x30]
movsxd rcx, dword [rsp + 0x30]
movzx ecx, byte [rsp + rcx + 0x50]
movzx eax, byte [rsp + rax + 0x110]
xor eax, ecx
movsxd rcx, dword [rsp + 0x30]
mov byte [rsp + rcx + 0x110], al
jmp 0x1400380f2
mov qword [rsp + 0x28], 0x20
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x188]
mov r8, qword [rsp + 0x180]
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.140037f80
mov qword [rsp + 0x28], 0x20
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x90]
mov edx, 0x40
lea rcx, [rsp + 0x110]
call fcn.140037f80
cmp qword [rsp + 0x198], 0x20
jbe 0x1400381d3
mov qword [rsp + 0x38], 0x20
jmp 0x1400381e0
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov r8, qword [rsp + 0x40]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x190]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0x168
ret

Function at 0x140038620
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov dword [rax + 0x28], 0
mov rax, qword [rsp + 8]
mov qword [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x3c6ef372
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0xa54ff53a
mov eax, 4
imul rax, rax, 4
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x510e527f
mov eax, 4
imul rax, rax, 5
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x9b05688c
mov eax, 4
imul rax, rax, 6
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x1f83d9ab
mov eax, 4
imul rax, rax, 7
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 8], 0x5be0cd19
ret
Function at 0x140039be0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x68]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x140039c47
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jae 0x140039ce1
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140039cdc
mov rax, qword [rsp + 0x28]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
cmp qword [rsp + 0x38], rax
jne 0x140039cdc
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0xc], 0
jne 0x140039cb0
xor eax, eax
jmp 0x140039ce3
cmp qword [rsp + 0x70], 0
je 0x140039cc7
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 8]
mov dword [rax], ecx
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x68]
add rcx, rax
mov rax, rcx
jmp 0x140039ce3
jmp 0x140039c3d
xor eax, eax
add rsp, 0x58
ret

Function at 0x140039cf0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x250
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x20a
rep stosb byte [rdi], al
lea rdx, [rsp + 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
je 0x140039d4d
cmp dword [rsp + 0x24], 0x105
jbe 0x140039d76
lea rdx, [0x1400d4d18]
mov rcx, qword [rsp + 0x260]
call fcn.1400394e0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x260]
jmp 0x140039de4
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
movzx eax, word [rsp + rax*2 + 0x2e]
cmp eax, 0x5c
jne 0x140039dbf
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea rax, [rax + rax - 2]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0x20a
jae 0x140039dad
jmp 0x140039db3
call fcn.1400ca354
nop
xor eax, eax
mov rcx, qword [rsp + 0x28]
mov word [rsp + rcx + 0x30], ax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x260]
call fcn.1400394e0
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0x250
pop rdi
ret
Function at 0x140039e00
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x60], 0
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0xc0000004
jne 0x140039eb0
cmp qword [rsp + 0x28], 0
je 0x140039e72
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov eax, dword [rsp + 0x60]
mov r9d, 4
mov r8d, 0x3000
mov edx, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
mov r8d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x28]
mov ecx, 0xb
call sub.ntdll.dll_NtQuerySystemInformation
mov dword [rsp + 0x30], eax
jmp 0x140039e4c
cmp dword [rsp + 0x30], 0
jge 0x140039eda
cmp qword [rsp + 0x28], 0
je 0x140039ed3
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
xor eax, eax
jmp 0x140039ff8
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140039ef3
xor eax, eax
jmp 0x140039ff8
mov dword [rsp + 0x20], 0
jmp 0x140039f07
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp dword [rsp + 0x20], eax
jae 0x140039fe3
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 8]
mov ecx, dword [rsp + 0x20]
imul rcx, rcx, 0x128
mov rdx, qword [rsp + 0x38]
movzx ecx, word [rdx + rcx + 0x2e]
lea rax, [rax + rcx + 0x28]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140018360
nop
mov rcx, qword [rsp + 0xa0]
call fcn.140023110
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x68]
call fcn.140023110
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140039fd3
mov eax, dword [rsp + 0x20]
imul rax, rax, 0x128
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x68]
call fcn.14001a790
mov rax, qword [rsp + 0x58]
jmp 0x140039ff8
lea rcx, [rsp + 0x68]
call fcn.14001a790
nop
jmp 0x140039efd
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0x98
ret
Function at 0x14003a0c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14003a0fd
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003a104
mov al, 1
jmp 0x14003a25c
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.140029fb0
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.140029fb0
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14002a000
movzx eax, al
test eax, eax
je 0x14003a159
xor al, al
jmp 0x14003a25c
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14003a1c9
cmp dword [rsp + 0x30], 1
je 0x14003a1d5
cmp dword [rsp + 0x30], 3
je 0x14003a24a
jmp 0x14003a25a
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14003a221
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14003a221
xor al, al
jmp 0x14003a25c
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003a23b
mov dword [rsp + 0x34], 1
jmp 0x14003a243
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14003a25c
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14003a25c
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0xa8
ret
Function at 0x14003b830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x140122940]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x14003b864
xor eax, eax
jmp 0x14003ba61
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14003b896
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14003ba61
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14003b948
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.140013810
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140023d50
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
nop
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14003ba51
mov rcx, qword [rsp + 0x80]
call fcn.14003a580
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14003b9fe
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14003b9f9
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14003ba61
jmp 0x14003b974
cmp qword [rsp + 0x50], 0
jbe 0x14003ba51
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400ca200
add rsp, 0x78
ret
Function at 0x14003ba80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14003bab9
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14003bba8
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14003bb50
cmp qword [rsp + 0x20], 0
jle 0x14003bb50
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14003baf9
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140023d50
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
nop
cmp qword [rsp + 0x50], 0
jle 0x14003bb98
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14003bb98
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14004abf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
sub rsp, 0x78
mov rax, qword [0x1401239e0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x88]
test eax, eax
je 0x14004ad09
mov rax, qword [rsp + 0x40]
add rax, 0x3220
mov rcx, rax
call fcn.140072ae0
mov qword [rsp + 0x28], rax
jmp 0x14004ac60
mov rax, qword [rsp + 0x40]
add rax, 0x3220
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
call fcn.140073080
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14004ad09
cmp dword [rsp + 0x80], 0
je 0x14004ac91
mov rax, qword [rsp + 0x28]
mov ecx, dword [rsp + 0x80]
cmp dword [rax + 0x14], ecx
je 0x14004ac91
mov dword [rsp + 0x38], 0
jmp 0x14004ac99
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14004acef
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x14], 0
je 0x14004acef
mov rax, qword [rsp + 0x28]
mov edx, dword [rax + 0x14]
mov rcx, qword [rsp + 0x48]
call fcn.14004b4c0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14004acef
mov rcx, qword [rsp + 0x50]
call fcn.14004e120
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
jne 0x14004acef
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x14004ad04
mov rax, qword [rsp + 0x28]
mov dword [rax + 0x14], 0
jmp 0x14004ac3c
mov dword [rsp + 0x24], 0
jmp 0x14004ad1d
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x1cb8]
cmp dword [rsp + 0x24], eax
jge 0x14004ae0c
mov rax, qword [rsp + 0x40]
add rax, 0x1cb8
mov qword [rsp + 0x68], rax
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
call fcn.140040040
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
cmp dword [rsp + 0x80], 0
je 0x14004adbd
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x448], 0
je 0x14004ad8d
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x448]
call fcn.14004e120
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x14004adbd
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x450], 0
je 0x14004adb3
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x450]
mov ecx, dword [rsp + 0x80]
cmp dword [rax], ecx
je 0x14004adbd
mov dword [rsp + 0x3c], 0
jmp 0x14004adc5
mov dword [rsp + 0x3c], 1
movzx eax, byte [rsp + 0x3c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
test eax, eax
je 0x14004ae07
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x458]
mov dword [rsp + 0x58], eax
movzx r8d, byte [rsp + 0x88]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
call fcn.14004c1f0
nop
movzx eax, byte [rsp + 0x88]
jmp 0x14004ad13
add rsp, 0x78
ret
Function at 0x14005aa30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x80]
call fcn.14003f4f0
nop
mov eax, dword [rsp + 0x88]
and eax, 1
test eax, eax
je 0x14005ab0b
mov edx, dword [rsp + 0x90]
mov ecx, 0x14
call fcn.14005acf0
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x13
call fcn.14005acf0
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x12
call fcn.14005acf0
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0x11
call fcn.14005acf0
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x2c], xmm0
movss xmm2, dword [rsp + 0x28]
movss xmm1, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.14003f4f0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140040430
nop
mov eax, dword [rsp + 0x88]
and eax, 2
test eax, eax
je 0x14005abba
mov edx, dword [rsp + 0x90]
mov ecx, 7
call fcn.14005acf0
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 6
call fcn.14005acf0
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 5
call fcn.14005acf0
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 4
call fcn.14005acf0
movss xmm1, dword [rsp + 0x34]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x3c], xmm0
movss xmm2, dword [rsp + 0x38]
movss xmm1, dword [rsp + 0x3c]
lea rcx, [rsp + 0x58]
call fcn.14003f4f0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140040430
nop
mov eax, dword [rsp + 0x88]
and eax, 4
test eax, eax
je 0x14005ac69
mov edx, dword [rsp + 0x90]
mov ecx, 0xb
call fcn.14005acf0
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 0xa
call fcn.14005acf0
movss xmm1, dword [rsp + 0x40]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x48], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 9
call fcn.14005acf0
movss dword [rsp + 0x44], xmm0
mov edx, dword [rsp + 0x90]
mov ecx, 8
call fcn.14005acf0
movss xmm1, dword [rsp + 0x44]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x4c], xmm0
movss xmm2, dword [rsp + 0x48]
movss xmm1, dword [rsp + 0x4c]
lea rcx, [rsp + 0x60]
call fcn.14003f4f0
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call fcn.140040430
nop
movss xmm0, dword [rsp + 0x98]
ucomiss xmm0, dword [0x1400d7cec]
jp 0x14005ac7d
je 0x14005aca5
mov ecx, 0xe
call fcn.14005e3d0
movzx eax, al
test eax, eax
je 0x14005aca5
movss xmm1, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
call fcn.1400403e0
nop
movss xmm0, dword [rsp + 0xa0]
ucomiss xmm0, dword [0x1400d7cec]
jp 0x14005acb9
je 0x14005ace1
mov ecx, 0xf
call fcn.14005e3d0
movzx eax, al
test eax, eax
je 0x14005ace1
movss xmm1, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x80]
call fcn.1400403e0
nop
mov rax, qword [rsp + 0x80]
add rsp, 0x78
ret