joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 0x10
mov rbx, rcx
lea r8d, [rdx - 0xf]
mov rcx, rdi
call fcn.1401c1e14
test rax, rax
jne 0x1400d62c9
mov eax, 4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140066b70
mov dword [rdi + 0x10], eax
cmp eax, 1
je 0x1400d62e9
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx]
mov edx, 0x10
lea rcx, [rdi + 0x14]
lea r8d, [rdx - 0xf]
call fcn.1401c1e14
test rax, rax
je 0x1400d62b9
mov rcx, rbx
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x24], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x28], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x2c], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x30], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x34], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x38], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x3c], eax
call fcn.140066b70
mov dword [rdi + 0x40], eax
add eax, 0xfffffff8
test eax, 0xffffffef
jne 0x1400d62d9
mov rcx, rbx
call fcn.140066b70
mov dword [rdi + 0x44], eax
cmp eax, 1
je 0x1400d6382
cmp eax, 8
jne 0x1400d62d9
mov rcx, rbx
call fcn.140066b70
mov dword [rdi + 0x48], eax
dec eax
test eax, 0xfffffffd
jne 0x1400d62d9
mov rcx, rbx
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x4c], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x50], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rdi + 0x54], eax
call fcn.140066b70
mov edx, 0x64
mov dword [rdi + 0x58], eax
mov r9, qword [rbx]
lea rcx, [rdi + 0x5c]
lea r8d, [rdx - 0x63]
call fcn.1401c1e14
test rax, rax
je 0x1400d62b9
mov r9, qword [rbx]
mov edx, 0x40
lea rcx, [rdi + 0xc0]
lea r8d, [rdx - 0x3f]
call fcn.1401c1e14
test rax, rax
je 0x1400d62b9
mov rcx, qword [rbx]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x1400d6b80
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xf0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r15, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.140061e90
movzx eax, byte [0x14021b690]
movzx ecx, word [rdi + 0x48]
movsd xmm0, qword [str.Raw_Grey]
movsd qword [rsp + 0x50], xmm0
mov r13d, 1
mov byte [rsp + 0x58], al
lea eax, [rcx - 1]
xor esi, esi
mov word [rsp + 0x30], r13w
cmp ax, r13w
jbe 0x1400d6c11
cmp cx, 4
jne 0x1400d6bf6
mov dword [rsp + 0x40], 0x80100
jmp 0x1400d6c16
mov eax, 0x18
mov word [rsp + 0x40], si
mov word [rsp + 0x32], ax
mov eax, dword [rdi + 0x50]
lea ecx, [rax + rax*2]
mov dword [rsp + 0x3c], ecx
jmp 0x1400d6c27
mov word [rsp + 0x40], si
mov eax, dword [rdi + 0x50]
mov ecx, 8
mov dword [rsp + 0x3c], eax
mov word [rsp + 0x32], cx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14005fe70
movzx r12d, ax
test ax, ax
jne 0x1400d6dd6
movzx ecx, word [rdi + 0x48]
mov qword [rsp + 0x130], rbx
mov qword [rsp + 0xe8], rbp
lea eax, [rcx - 1]
mov qword [rsp + 0xe0], r14
cmp ax, r13w
jbe 0x1400d6d7a
cmp cx, 4
jne 0x1400d6cfc
mov ebx, esi
cmp dword [rdi + 0x54], ebx
jle 0x1400d6db6
nop
mov r8d, r13d
mov edx, ebx
mov rcx, rdi
call fcn.1400629c0
mov ebp, esi
mov r14, rsi
cmp dword [rdi + 0x50], esi
jle 0x1400d6cf0
nop word [rax + rax]
mov rax, qword [rsp + 0x28]
mov r8, qword [rsp + 0x48]
movzx ecx, byte [r14 + rax]
lea r9d, [rcx + rcx*2]
lea eax, [r9 + 1]
movzx eax, byte [rax + r8]
imul ecx, eax, 0x96
lea eax, [r9 + 2]
movzx eax, byte [rax + r8]
imul edx, eax, 0x1d
add ecx, edx
movzx edx, byte [r9 + r8]
imul eax, edx, 0x4d
mov rdx, qword [r15]
add ecx, eax
sar ecx, 8
call fcn.1401c1ae4
inc ebp
lea r14, [r14 + 1]
cmp ebp, dword [rdi + 0x50]
jl 0x1400d6ca0
inc ebx
cmp ebx, dword [rdi + 0x54]
jl 0x1400d6c80
jmp 0x1400d6db6
mov r14d, esi
cmp dword [rdi + 0x54], esi
jle 0x1400d6db6
nop dword [rax + rax]
mov r8d, r13d
mov edx, r14d
mov rcx, rdi
call fcn.1400629c0
mov rbx, rsi
mov ebp, esi
cmp dword [rdi + 0x50], ebx
jle 0x1400d6d6f
nop dword [rax + rax]
mov rcx, qword [rsp + 0x28]
lea rbx, [rbx + 3]
movzx edx, byte [rbx + rcx - 1]
movzx r8d, byte [rbx + rcx - 3]
movzx eax, byte [rbx + rcx - 2]
imul edx, edx, 0x1d
imul ecx, eax, 0x96
add ecx, edx
mov eax, r8d
imul edx, r8d, 0x4d
add ecx, edx
mov rdx, qword [r15]
sar ecx, 8
call fcn.1401c1ae4
inc ebp
cmp ebp, dword [rdi + 0x50]
jl 0x1400d6d30
inc r14d
cmp r14d, dword [rdi + 0x54]
jl 0x1400d6d10
jmp 0x1400d6db6
cmp dword [rdi + 0x54], esi
jle 0x1400d6db6
nop
mov r8d, r13d
mov edx, esi
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rsp + 0x3c]
mov r9, qword [r15]
mov rcx, qword [rsp + 0x28]
mov r8, r13
call fcn.1401c24f8
test rax, rax
je 0x1400d6db0
inc esi
cmp esi, dword [rdi + 0x54]
jl 0x1400d6d80
jmp 0x1400d6db6
mov r12d, 6
mov rcx, rdi
call fcn.14005dcb0
mov r14, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x130]
movzx eax, r12w
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0xf0
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400d7840
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r11d, r11d
mov rdi, rcx
lea r9, [rsp + 0x20]
lea ebx, [r11 + 1]
lea r8d, [r11 + 4]
lea r10d, [r11 + 5]
lea ecx, [rbx + 0x1b]
mov eax, edx
shr eax, cl
and al, 0x7f
test r11d, r11d
jne 0x1400d788b
test al, al
je 0x1400d788b
mov r11d, 1
mov ebx, r10d
test r8, r8
je 0x1400d789b
test r11d, r11d
jne 0x1400d7899
test al, al
je 0x1400d789b
or al, 0x80
mov byte [r9], al
inc r9
sub ecx, 7
dec r10d
dec r8
jns 0x1400d7873
mov r9, qword [rdi]
movsxd rdx, ebx
lea rcx, [rsp + 0x25]
sub rcx, rdx
mov r8d, 1
call fcn.1401c24f8
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d8050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x18], r8d
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov rsi, r9
mov r13d, r8d
mov r14, rdx
mov r15, rcx
mov r12d, ebp
cmp dword [r9 + 8], ebp
jbe 0x1400d820f
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rdi
movzx eax, word [rsi + 2]
cmp ax, 4
jg 0x1400d815c
mov edx, dword [rsi + 4]
mov r9, qword [r14]
movsx edi, ax
movsx r8, ax
mov rcx, r15
imul edi, edx
call fcn.1401c1e14
mov rax, qword [rsp + 0x70]
lea rcx, [fcn.140066de0]
cmp qword [rax + 8], rcx
jne 0x1400d81bb
cmp word [rbx + 0x1e8], 0
je 0x1400d8110
mov eax, edi
mov rbx, rbp
cdq
and edx, 3
add eax, edx
sar eax, 2
movsxd rdi, eax
test eax, eax
jle 0x1400d8106
nop dword [rax]
mov ecx, dword [r15 + rbx*4]
call fcn.140065fb0
inc rbx
mov dword [r15 + rbx*4 - 4], eax
cmp rbx, rdi
jl 0x1400d80f0
mov rbx, qword [rsp + 0x78]
jmp 0x1400d81bb
cmp word [rsi + 2], 3
jne 0x1400d81bb
movsxd rcx, edi
test edi, edi
jle 0x1400d81bb
dec rcx
movabs rax, 0xaaaaaaaaaaaaaaab
lea r8, [r15 + 2]
mul rcx
shr rdx, 1
inc rdx
movzx ecx, byte [r8 - 2]
movzx eax, byte [r8]
lea r8, [r8 + 3]
mov byte [r8 - 5], al
mov byte [r8 - 3], cl
dec rdx
jne 0x1400d8140
jmp 0x1400d81bb
cmp dword [rsi + 4], 0
mov rdi, r15
jbe 0x1400d81b9
xor r13d, r13d
nop dword [rax + rax]
mov ebx, r13d
cmp r13w, word [rsi + 2]
jge 0x1400d819c
nop word [rax + rax]
mov rcx, qword [r14]
call fcn.1401c3f28
cmp ebx, 4
jg 0x1400d8192
mov byte [rdi], al
inc rdi
movsx eax, word [rsi + 2]
inc ebx
cmp ebx, eax
jl 0x1400d8180
mov rcx, qword [r14]
call fcn.1401c1a94
test eax, eax
jne 0x1400d81af
inc ebp
cmp ebp, dword [rsi + 4]
jb 0x1400d8170
mov r13d, dword [rsp + 0x60]
mov rbx, qword [rsp + 0x78]
xor ebp, ebp
test r13d, r13d
je 0x1400d81cb
movsxd rdx, r13d
mov rcx, r14
call fcn.140066ff0
or r8d, 0xffffffff
mov r9d, 1
mov rcx, rbx
or edx, r8d
call fcn.1400615b0
test ax, ax
jne 0x1400d81f2
inc r12d
cmp r12d, dword [rsi + 8]
jb 0x1400d8091
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
movzx eax, bp
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x1400d96d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140066b70
mov dword [rbx + 0x18], eax
cmp eax, 0x53445058
je 0x1400d9724
cmp eax, 0x58504453
je 0x1400d9706
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rax, [fcn.140066da0]
mov qword [rbx + 8], rax
lea rax, [fcn.140066b20]
mov qword [rbx], rax
lea rax, [fcn.140066900]
jmp 0x1400d9740
lea rax, [fcn.140066de0]
mov qword [rbx + 8], rax
lea rax, [fcn.140066b70]
mov qword [rbx], rax
lea rax, [fcn.140066960]
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [rbx]
mov eax, eax
mov dword [rbx + 0x1c], eax
cmp rax, qword [rdi + 0x108]
jge 0x1400d96f6
mov r9, qword [rdi]
mov edx, 8
lea rcx, [rbx + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c1e14
mov rcx, rdi
call qword [rbx]
mov rcx, rdi
mov dword [rbx + 0x28], eax
call qword [rbx]
mov rcx, rdi
mov dword [rbx + 0x2c], eax
call qword [rbx]
mov rcx, rdi
mov dword [rbx + 0x30], eax
call qword [rbx]
mov rcx, rdi
mov dword [rbx + 0x34], eax
call qword [rbx]
mov edx, 0x64
mov dword [rbx + 0x38], eax
mov r9, qword [rdi]
lea rcx, [rbx + 0x3c]
lea r8d, [rdx - 0x63]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x18
lea r8d, [rdx - 0x17]
lea rcx, [rbx + 0xa0]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rbx + 0xb8]
call fcn.1401c1e14
mov r9, qword [rdi]
lea rcx, [rbx + 0x11c]
mov edx, 0xc8
mov r8d, 1
call fcn.1401c1e14
mov r9, qword [rdi]
lea rcx, [rbx + 0x1e4]
mov edx, 0xc8
mov r8d, 1
call fcn.1401c1e14
mov rcx, rdi
call qword [rbx]
mov edx, 0x68
lea rcx, [rbx + 0x2b0]
mov dword [rbx + 0x2ac], eax
mov r9, qword [rdi]
lea r8d, [rdx - 0x67]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x1400d9850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, r8
mov rdi, rdx
mov rbx, rcx
call qword [rdx + 8]
mov rcx, rbx
mov word [r14], ax
call qword [rdi + 8]
mov rcx, rbx
mov word [r14 + 2], ax
call qword [rdi]
mov rcx, rbx
mov dword [r14 + 4], eax
call qword [rdi]
lea rsi, [r14 + 0x10]
lea rbp, [r14 + 0x34]
mov r15d, 8
mov dword [r14 + 8], eax
mov rcx, rbx
call qword [rdi]
mov rcx, rbx
mov dword [rsi - 4], eax
call qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsi], eax
call qword [rdi + 0x10]
mov rcx, rbx
movsd xmm0, qword [rsp + 0x40]
cvtpd2ps xmm0, xmm0
movss dword [rsi + 4], xmm0
call qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov dword [rsi + 8], eax
call qword [rdi + 0x10]
movsd xmm0, qword [rsp + 0x40]
cvtpd2ps xmm0, xmm0
movss dword [rsi + 0xc], xmm0
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rsi + 0x10], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rsi + 0x11], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rsi + 0x12], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, rbx
mov byte [rsi + 0x13], al
call qword [rdi + 8]
mov rcx, rbx
mov word [rsi + 0x14], ax
call qword [rdi + 8]
mov rcx, rbx
mov word [rsi + 0x16], ax
call qword [rdi]
mov rcx, rbx
mov dword [rsi + 0x18], eax
call qword [rdi]
mov rcx, rbx
mov dword [rsi + 0x1c], eax
call qword [rdi]
mov edx, 0x20
mov dword [rsi + 0x20], eax
mov r9, qword [rbx]
lea r8d, [rdx - 0x1f]
mov rcx, rbp
call fcn.1401c1e14
add rbp, 0x48
lea rsi, [rsi + 0x48]
dec r15
jne 0x1400d98a3
mov r9, qword [rbx]
lea rcx, [r14 + 0x24c]
lea edx, [r15 + 0x34]
lea r8d, [r15 + 1]
call fcn.1401c1e14
mov rcx, qword [rbx]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400d99b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, r8
mov rbp, rdx
mov rdi, rcx
call qword [rdx]
mov rcx, rdi
mov dword [r14], eax
call qword [rbp]
lea rdx, [rsp + 0x40]
mov rcx, rdi
mov dword [r14 + 4], eax
call qword [rbp + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
movsd xmm0, qword [rsp + 0x40]
cvtpd2ps xmm0, xmm0
movss dword [r14 + 8], xmm0
call qword [rbp + 0x10]
movsd xmm0, qword [rsp + 0x40]
mov rcx, rdi
cvtpd2ps xmm0, xmm0
movss dword [r14 + 0xc], xmm0
call qword [rbp]
mov rcx, rdi
mov dword [r14 + 0x10], eax
call qword [rbp]
mov edx, 0x64
mov dword [r14 + 0x14], eax
mov r9, qword [rdi]
lea rcx, [r14 + 0x18]
lea r8d, [rdx - 0x63]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x18
lea r8d, [rdx - 0x17]
lea rcx, [r14 + 0x7c]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [r14 + 0x94]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [r14 + 0xb4]
call fcn.1401c1e14
lea rbx, [r14 + 0xd4]
mov esi, 4
nop word [rax + rax]
mov rcx, rdi
call qword [rbp + 8]
lea rbx, [rbx + 2]
mov word [rbx - 2], ax
dec rsi
jne 0x1400d9a90
lea rbx, [r14 + 0xdc]
mov esi, 2
nop
mov rcx, rdi
call qword [rbp]
lea rbx, [rbx + 4]
mov dword [rbx - 4], eax
dec rsi
jne 0x1400d9ab0
mov r9, qword [rdi]
lea rcx, [r14 + 0xe4]
lea edx, [rsi + 0x1c]
lea r8d, [rsi + 1]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d9b00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, r8
mov rbx, rdx
mov edx, 2
mov rsi, rcx
mov rcx, rdi
lea r8d, [rdx - 1]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rdi + 2]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rdi + 4]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 6
lea r8d, [rdx - 5]
lea rcx, [rdi + 6]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rdi + 0xc]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rdi + 0x10]
call fcn.1401c1e14
mov rcx, rsi
call qword [rbx]
mov rcx, rsi
mov dword [rdi + 0x30], eax
call qword [rbx]
mov rcx, rsi
mov dword [rdi + 0x34], eax
call qword [rbx]
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov dword [rdi + 0x38], eax
call qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
movsd xmm0, qword [rsp + 0x30]
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x3c], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
mov edx, 0x20
lea rcx, [rdi + 0x44]
lea r8d, [rdx - 0x1f]
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x40], xmm0
mov r9, qword [rsi]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rdi + 0x64]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 0x38
lea r8d, [rdx - 0x37]
lea rcx, [rdi + 0xc8]
call fcn.1401c1e14
mov rcx, qword [rsi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x1400d9c50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
call qword [rdx]
mov rcx, rsi
mov dword [rdi], eax
call qword [rbx]
mov dword [rdi + 4], eax
mov rcx, qword [rsi]
call fcn.1401c3f28
mov byte [rdi + 8], al
mov rcx, qword [rsi]
call fcn.1401c3f28
mov byte [rdi + 9], al
mov rcx, qword [rsi]
call fcn.1401c3f28
mov byte [rdi + 0xa], al
mov rcx, qword [rsi]
call fcn.1401c3f28
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov byte [rdi + 0xb], al
call qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x30]
cvtpd2ps xmm0, xmm0
mov rcx, rsi
movss dword [rdi + 0xc], xmm0
call qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
movsd xmm0, qword [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x10], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x14], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x18], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x1c], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x20], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x24], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x28], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x2c], xmm0
call qword [rbx + 0x10]
movsd xmm0, qword [rsp + 0x30]
lea rcx, [rdi + 0x34]
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x30], xmm0
mov r9, qword [rsi]
mov edx, 0x4c
lea r8d, [rdx - 0x4b]
call fcn.1401c1e14
mov rcx, qword [rsi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x1400da720
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov esi, r8d
mov rbp, rdx
mov r14, rcx
mov ebx, r15d
test r8d, r8d
jle 0x1400da78a
nop dword [rax]
mov rdx, qword [r14]
mov eax, esi
mov edi, 0xff
sub eax, ebx
cmp eax, edi
cmovl edi, eax
mov ecx, edi
call fcn.1401c1ae4
mov r9, qword [r14]
movsxd rcx, ebx
add rcx, rbp
movsxd rdx, edi
mov r8d, 1
call fcn.1401c24f8
test rax, rax
je 0x1400da7b1
add ebx, edi
cmp ebx, esi
jl 0x1400da750
mov rdx, qword [r14]
xor ecx, ecx
call fcn.1401c1ae4
movzx eax, r15w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 6
jmp 0x1400da798
Function at 0x1400da820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 6
mov rdi, rcx
lea r8d, [rdx - 5]
mov rcx, rbx
call fcn.1401c24f8
movzx ecx, word [rbx + 6]
mov rdx, rdi
call fcn.140067160
movzx ecx, word [rbx + 8]
mov rdx, rdi
call fcn.140067160
movzx ecx, byte [rbx + 0xc]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 0x10]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 0x11]
mov rdx, qword [rdi]
call fcn.1401c1ae4
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400dd8b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
mov edx, 6
mov r14, r9
mov r9, qword [rcx]
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx - 5]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x1400dd908
mov eax, 4
jmp 0x1400dda02
mov eax, dword [rsp + 0x20]
cmp eax, dword [str.HEADER]
jne 0x1400dd9fd
movzx eax, word [rsp + 0x24]
cmp ax, word [0x14021ea10]
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066de0
test ax, ax
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066de0
cmp ax, 1
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066de0
test ax, ax
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066de0
mov ecx, 0xd00
cmp ax, cx
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
movzx eax, ax
mov dword [rdi], eax
call fcn.140066de0
test ax, ax
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066de0
mov ecx, 0x100
cmp ax, cx
jne 0x1400dd9fd
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
movzx eax, ax
mov dword [rsi], eax
call fcn.140066da0
mov edx, 0x15
movzx eax, ax
mov rcx, rbx
mov dword [r14], eax
call fcn.140066ff0
mov r9, qword [rbx]
mov edx, 0x63
mov rcx, rbp
lea r8d, [rdx - 0x62]
call fcn.1401c1e14
mov edx, 0x70
mov rcx, rbx
call fcn.140066ff0
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
jmp 0x1400dda02
mov eax, 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400de180
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0xc0]
mov rdi, rdx
mov edx, 9
mov rsi, r9
mov r9, qword [rcx]
mov r15, r8
mov r14, rcx
lea r8d, [rdx - 8]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
je 0x1400de30a
nop
cmp byte [rsp + 0x20], 0x5a
jne 0x1400de36b
lea rcx, [rsp + 0x21]
call fcn.1400ddcd0
movzx ecx, word [rsp + 0x23]
cmp cx, word [0x14021ea48]
lea ebx, [rax - 8]
movzx eax, byte [rsp + 0x25]
jne 0x1400de207
cmp al, byte [0x14021ea4a]
je 0x1400de2db
cmp cx, word [0x14021ea4c]
jne 0x1400de21c
cmp al, byte [0x14021ea4e]
je 0x1400de2db
cmp cx, word [0x14021ea50]
jne 0x1400de231
cmp al, byte [0x14021ea52]
je 0x1400de2db
cmp cx, word [0x14021ea54]
jne 0x1400de246
cmp al, byte [0x14021ea56]
je 0x1400de2db
cmp cx, word [0x14021ea58]
jne 0x1400de329
cmp al, byte [0x14021ea5a]
jne 0x1400de329
mov r9, qword [r14]
mov edx, 0x24
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 0x23]
call fcn.1401c1e14
test rax, rax
je 0x1400de30a
lea rcx, [rsp + 0x42]
sub ebx, 0x24
call fcn.1400ddcd0
lea rcx, [rsp + 0x44]
mov dword [rdi], eax
call fcn.1400ddcd0
mov dword [r15], eax
test byte [rdi], 7
jne 0x1400de36b
lea rcx, [rsp + 0x4c]
call fcn.1400ddcd0
lea rcx, [rsp + 0x4e]
mov dword [rsi], eax
call fcn.1400ddcd0
mov dword [rbp], eax
mov ecx, dword [rsi]
test ecx, ecx
jne 0x1400de2d2
test eax, eax
jne 0x1400de2d2
mov eax, dword [rdi]
mov dword [rsi], eax
mov eax, dword [r15]
mov dword [rbp], eax
jmp 0x1400de2db
test cl, 7
jne 0x1400de36b
mov rcx, qword [r14]
mov r8d, 1
mov edx, ebx
call fcn.1401c1f88
mov r9, qword [r14]
mov edx, 9
lea r8d, [rdx - 8]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x1400de1d0
mov eax, 4
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
cmp cx, word [0x14021ea5c]
jne 0x1400de33a
cmp al, byte [0x14021ea5e]
je 0x1400de34b
cmp cx, word [0x14021ea60]
jne 0x1400de36b
cmp al, byte [0x14021ea62]
jne 0x1400de36b
mov rcx, qword [r14]
mov edx, 0xfffffff7
lea r8d, [rdx + 0xa]
call fcn.1401c1f88
xor ecx, ecx
cmp dword [rdi], 0xffffffff
mov eax, 2
cmovne eax, ecx
jmp 0x1400de30f
mov eax, 2
jmp 0x1400de30f