joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007acc0
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x628]
sub rsp, 0x728
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rbp + 0x610], rax
movups xmm0, xmmword [0x140189ad8]
mov eax, dword [0x140189ae8]
mov r12d, edx
mov r15, rcx
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1f0]
movups xmmword [rsp + 0x40], xmm0
xor esi, esi
mov rdi, r8
mov dword [rsp + 0x50], eax
mov word [r8], si
call fcn.1400748e0
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
jne 0x14007ad4c
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
call fcn.140077e40
xor eax, eax
jmp 0x14007aefb
lea rdx, [0x140189af0]
mov rcx, rax
mov qword [rsp + 0x720], rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14007ad8c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov rdx, rdi
call fcn.140077e40
xor eax, eax
jmp 0x14007aef3
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], si
lea rax, [rax + 1]
jne 0x14007ada5
cmp word [rsp + rax*2 + 0x5e], 0x5c
je 0x14007add3
lea rcx, [rsp + 0x60]
sub rcx, 2
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14007adc1
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea rcx, [rsp + 0x60]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x14007ade0
movups xmm0, xmmword [str.IrfanView.tmp]
movsd xmm1, qword [0x140187878]
mov eax, dword [0x140187880]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x3c]
movzx eax, word [rsp + 0x3e]
movzx r9d, word [rsp + 0x3a]
movzx r8d, word [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x140189b00]
lea rcx, [rbp + 0x170]
call fcn.1400f98c8
lea r8, [rsp + 0x60]
sub r8, 2
nop
cmp word [r8 + 2], si
lea r8, [r8 + 2]
jne 0x14007ae50
lea rcx, [rbp + 0x170]
xor r9d, r9d
nop word [rax + rax]
movzx eax, word [rcx + r9*2]
lea r9, [r9 + 1]
mov word [r8 + r9*2 - 2], ax
test ax, ax
jne 0x14007ae70
lea r9, [rsp + 0x60]
mov r8d, 0x6958
mov edx, r12d
mov rcx, r15
mov qword [rsp + 0x20], rdi
call rbx
mov rcx, r14
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x14007aef0
lea r9, [rbp + 0x1f0]
lea r8, [rbp + 0x400]
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14001a9c0
lea rcx, [rsp + 0x60]
mov rsi, rax
call fcn.1400fa630
lea rdx, [0x140189b20]
mov rcx, rdi
call fcn.1400f9d68
test rax, rax
je 0x14007aef0
xor edx, edx
mov rcx, rsi
call fcn.1400439d0
mov rax, rsi
mov rbx, qword [rsp + 0x720]
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x728
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007bd80
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xca0
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0xc80], rax
mov rbx, rdx
mov rbp, rcx
lea rdx, str.Stub_Plugin.exe
lea rcx, [rsp + 0x240]
mov rdi, r8
call fcn.1400748e0
lea rcx, [rsp + 0x240]
call fcn.1400e7210
test eax, eax
jne 0x140078658
lea r8d, [rax + 1]
lea rdx, [rsp + 0x450]
lea rcx, str.Stub_Plugin.exe
call fcn.140077e40
jmp 0x1400788a9
lea rcx, [0x1401898a0]
call fcn.1400743a0
test eax, eax
je 0x140078687
lea rdx, [rsp + 0x450]
lea rcx, [0x1401898a0]
mov r8d, 1
call fcn.140077e40
jmp 0x1400788a9
xor edx, edx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0xc98], rsi
lea r8d, [rdx + 0x68]
mov dword [0x1401f7250], 9
call fcn.1400f9ab0
xor eax, eax
mov rcx, rdi
lea edx, [rax + 0x7c]
lea r8d, [rax + 0x3b]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xc0], 0x68
call fcn.1400ef610
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0x240]
call fcn.140074980
lea rdx, [rsp + 0x130]
mov rcx, rbx
call fcn.140074980
or rbx, 0xffffffffffffffff
mov rcx, rbx
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140078710
inc rcx
mov edx, 1
call fcn.1400f97a4
mov rsi, rax
test rax, rax
jne 0x14007874c
lea r8d, [rax + 1]
lea rdx, [rsp + 0x450]
lea rcx, str.Stub_Plugin.exe
call fcn.140077e40
jmp 0x1400788a1
mov qword [rsp + 0xc90], r14
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x140078760
xor r14d, r14d
mov r9d, ebx
mov r8, rdi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
inc rbx
cmp byte [rsi + rbx], r14b
jne 0x140078790
mov qword [rsp + 0x98], rsi
lea rax, [0x140188451]
lea r8, [rsp + 0x660]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], rbx
lea rax, [rsp + 0x130]
lea rdx, [0x140189730]
lea rcx, [rsp + 0x870]
mov qword [rsp + 0x48], rax
mov eax, dword [0x1401f7250]
mov r9d, 1
mov dword [rsp + 0x40], eax
mov eax, dword [0x1401fbb88]
mov qword [rsp + 0x38], r14
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], InitCommonControls
call fcn.1400f9828
lea rax, [rsp + 0xa0]
lea rdx, [rsp + 0x870]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov r14, qword [rsp + 0xc90]
test eax, eax
je 0x1400788a1
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0xc98]
xor eax, eax
mov rcx, qword [rsp + 0xc80]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0xca0
pop rdi
pop rbp
pop rbx
ret
jmp 0x1400785f0
Function at 0x14007d430
Capabilities:
Get common file path
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x130
mov rax, qword [0x1401f7280]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rdi, rcx
mov ecx, 0x104
mov rsi, r9
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14007d470
cmp word [rbx + rax*2 - 2], 0x5c
je 0x14007d4a3
lea rcx, [rbx - 2]
nop dword [rax + rax]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14007d490
mov eax, dword [0x140181e84]
mov dword [rcx], eax
lea rcx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rcx, [rbx - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14007d4b5
movups xmm0, xmmword [0x140189dc0]
movzx r9d, word [rsp + 0x92]
movzx r8d, word [rsp + 0x90]
lea rdx, str.Z_:M
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x140189dd0]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x140189dd8]
mov dword [rcx + 0x18], eax
movzx ecx, word [rsp + 0x94]
movzx eax, word [rsp + 0x96]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0xa0]
call fcn.1400f98c8
lea rcx, [rbx - 2]
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x14007d522
lea r8, [rsp + 0xa0]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
lea rdx, [rdx + 1]
mov word [rcx + rdx*2 - 2], ax
test ax, ax
jne 0x14007d540
xor r14d, r14d
lea r9, [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call fcn.1400eb570
mov rcx, rdi
call fcn.1400ed4c0
cmp dword [rsp + 0x80], 1
jne 0x14007d590
lea rdx, [0x140189e08]
jmp 0x14007d5a3
lea rdx, [0x140189e18]
cmp eax, 1
je 0x14007d5a3
lea rdx, [0x140189e30]
lea rcx, [0x140183078]
mov r9, rbp
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, eax
cmp eax, 1
jbe 0x14007d68f
cmp dword [rsp + 0x80], 1
jne 0x14007d604
cmp eax, 2
jne 0x14007d604
lea rax, [0x140181e34]
lea r9d, [rcx + 0x49]
lea r8d, [rcx + 2]
mov qword [rsp + 0x30], rax
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 1
call fcn.1400d4fe0
jmp 0x14007d6bc
mov qword [rsp + 0x78], r14
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x68], r14
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x50], r14d
mov qword [rsp + 0x48], r14
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov rdx, rdi
sub ecx, 2
je 0x14007d67f
sub ecx, 2
je 0x14007d66f
dec ecx
mov rcx, rbx
je 0x14007d662
lea r8d, [r9 + 0x50]
call fcn.140055460
jmp 0x14007d6bc
mov r8d, 0x28
call fcn.140055460
jmp 0x14007d6bc
mov r8d, 0x41
mov rcx, rbx
call fcn.140055460
jmp 0x14007d6bc
mov r8d, 0x5f
mov rcx, rbx
call fcn.140055460
jmp 0x14007d6bc
neg ecx
mov dword [rsp + 0x30], r14d
mov rdx, rdi
sbb r8d, r8d
mov rcx, rbx
or r9d, 0xffffffff
and r8d, 6
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
call fcn.140080940
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400f9a80
add rsp, 0x130
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14007fe80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14, qword [rsp + 0xa0]
xor eax, eax
mov r13d, edx
lea rdx, [0x140183378]
mov r15, r9
mov r12d, r8d
mov word [r14], ax
mov rbp, rcx
mov esi, eax
call fcn.1400fafe4
mov rdi, rax
test rax, rax
je 0x14007ff95
mov edx, 1
mov ecx, 0x8040
mov qword [rsp + 0x80], rbx
call fcn.1400f97a4
mov rbx, rax
test rax, rax
je 0x14007ff8d
mov r9, rdi
mov edx, 1
mov r8d, 0x8000
mov rcx, rax
call fcn.1400fabdc
mov rcx, rdi
call fcn.1400fa904
xor edi, edi
mov byte [rbx + 0x7fff], sil
mov ecx, edi
mov eax, edi
nop dword [rax]
cmp byte [rax + rbx], 0x89
jne 0x14007ff3b
cmp byte [rax + rbx + 1], 0x50
jne 0x14007ff3b
cmp byte [rax + rbx + 2], 0x4e
jne 0x14007ff3b
cmp byte [rax + rbx + 3], 0x47
je 0x14007ff4a
inc rax
inc ecx
cmp rax, 0x7ffb
jl 0x14007ff20
jmp 0x14007ff4c
mov esi, ecx
mov rcx, rbx
call fcn.1400f97e8
movsxd rax, esi
mov r9, r15
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa8]
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
mov r8d, r12d
mov edx, r13d
mov rcx, rbp
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rdi
call fcn.14007ffb0
mov rbx, qword [rsp + 0x80]
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400810a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x38
xor r12d, r12d
mov rsi, r8
mov rdi, rcx
mov qword [rsp + 0x88], r12
call fcn.1400ff110
lea r8d, [r12 + 2]
xor edx, edx
mov rcx, rdi
mov rbx, rax
call fcn.1400fe870
mov rcx, rdi
call fcn.1400ff110
xor r8d, r8d
mov rdx, rbx
mov rbp, rax
mov rcx, rdi
sub rbp, rbx
call fcn.1400fe870
mov rcx, rbp
call fcn.1400fa250
mov r15, rax
test rax, rax
jne 0x140081112
add rsp, 0x38
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, rdi
mov r8, rbp
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x30], r14
call fcn.1400fabdc
mov r8, qword [rsp + 0x78]
xor dil, dil
mov eax, dword [r8 + 8]
mov ecx, dword [r8 + 4]
xor r13d, r13d
imul eax, dword [r8]
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
movsxd rdx, eax
lea eax, [rcx - 1]
movsxd r14, eax
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x88], rax
lea ebx, [rax + 8]
imul r14, rdx
add r14, rsi
test ecx, ecx
jle 0x140081210
xor esi, esi
cmp rax, rbp
jae 0x140081210
nop word [rax + rax]
lea rdx, [rsp + 0x88]
mov r8, rbp
mov rcx, r15
call fcn.140083780
cmp al, 0x20
je 0x140081190
cmp al, 9
je 0x140081190
cmp al, 0xa
je 0x140081190
cmp al, 0xd
je 0x140081190
cmp al, 0x31
sete dl
inc r12d
dec ebx
mov ecx, ebx
shl dl, cl
or dil, dl
test ebx, ebx
jne 0x1400811d5
mov byte [rsi + r14], dil
inc rsi
lea ebx, [rcx + 8]
xor dil, dil
mov r8, qword [rsp + 0x78]
cmp r12d, dword [r8]
jne 0x1400811fd
cmp ebx, 8
je 0x1400811e8
mov byte [rsi + r14], dil
sub r14, qword [rsp + 0x20]
xor esi, esi
xor dil, dil
xor r12d, r12d
mov ebx, 8
inc r13d
cmp r13d, dword [r8 + 4]
jge 0x140081210
mov rax, qword [rsp + 0x88]
jmp 0x140081181
mov rcx, r15
call fcn.1400f97e8
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x38
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140081240
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r9d, dword [rdx]
mov r10, rdx
mov r14, rcx
mov edi, dword [r10 + 4]
lea eax, [r9 + 7]
cdq
dec edi
and edx, 7
movsxd rbx, edi
add eax, edx
sar eax, 3
movsxd r11, eax
mov eax, dword [r10 + 8]
imul eax, r9d
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
movsxd rbp, eax
imul rbx, rbp
add rbx, r8
test edi, edi
js 0x1400812cf
mov qword [rsp + 0x30], rsi
mov rsi, r11
nop dword [rax]
nop dword [rax + rax]
mov r9, r14
mov r8, rsi
mov edx, 1
mov rcx, rbx
call fcn.1400fabdc
sub rbx, rbp
dec edi
jns 0x1400812b0
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x20
pop r14
ret
Function at 0x140081fd0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r13
sub rsp, 0x38
xor edi, edi
mov r13, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x68], rdi
cmp dword [rdx + 0x10], edi
jne 0x140081ffb
xor eax, eax
add rsp, 0x38
pop r13
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x30], r15
call fcn.1400ff110
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 2]
mov rbx, rax
call fcn.1400fe870
mov rcx, rbp
call fcn.1400ff110
xor r8d, r8d
mov rdx, rbx
mov r14, rax
mov rcx, rbp
sub r14, rbx
call fcn.1400fe870
mov rcx, r14
call fcn.1400fa250
mov r15, rax
test rax, rax
je 0x140082126
mov r9, rbp
mov r8, r14
mov edx, 1
mov rcx, rax
mov qword [rsp + 0x70], r12
call fcn.1400fabdc
mov eax, dword [rsi + 8]
mov ecx, dword [rsi + 4]
imul eax, dword [rsi]
add eax, 0x1f
xor ebp, ebp
cdq
and edx, 0x1f
lea r12d, [rdx + rax]
lea eax, [rcx - 1]
sar r12d, 5
movsxd rbx, eax
xor eax, eax
shl r12d, 2
mov qword [rsp + 0x68], rax
imul rbx, r12
add rbx, r13
test ecx, ecx
jle 0x140082114
movaps xmmword [rsp + 0x20], xmm6
movss xmm6, dword [0x14018a2a0]
nop dword [rax + rax]
cmp rax, r14
jae 0x14008210f
lea rdx, [rsp + 0x68]
mov r8, r14
mov rcx, r15
call fcn.1400837c0
mov ecx, dword [rsi + 0x10]
cmp ecx, 0xff
jne 0x1400820d5
mov byte [rdi + rbx], al
jmp 0x1400820f6
xorps xmm1, xmm1
movd xmm0, ecx
mov eax, eax
cvtsi2ss xmm1, rax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rcx, xmm1
mov byte [rdi + rbx], cl
inc edi
cmp edi, dword [rsi]
jne 0x140082103
sub rbx, r12
xor edi, edi
inc ebp
cmp ebp, dword [rsi + 4]
jge 0x14008210f
mov rax, qword [rsp + 0x68]
jmp 0x1400820b0
movaps xmm6, xmmword [rsp + 0x20]
mov rcx, r15
call fcn.1400f97e8
mov r12, qword [rsp + 0x70]
mov eax, 1
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x140082140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov edi, dword [rdx]
mov r14d, dword [rdx + 4]
mov eax, dword [rdx + 0x10]
dec r14d
lea r9d, [rdi + 3]
mov rbx, rdx
and r9d, 0xfffffffc
movsxd rsi, r14d
mov r13, rcx
movsxd r12, r9d
imul rsi, r12
add rsi, r8
test eax, eax
jne 0x14008218e
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
movaps xmmword [rsp + 0x20], xmm6
cmp eax, 0xff
jg 0x140082219
test r14d, r14d
js 0x1400822cb
movss xmm6, dword [0x14018a2a0]
nop dword [rax + rax]
movsxd r8, dword [rbx]
mov r9, r13
mov edx, 1
mov rcx, rsi
call fcn.1400fabdc
cmp dword [rbx + 0x10], 0xff
jge 0x14008220c
xor edx, edx
cmp dword [rbx], edx
jle 0x14008220c
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
movd xmm0, dword [rbx + 0x10]
inc edx
movd xmm1, eax
lea rcx, [rcx + 1]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rax, xmm1
mov byte [rcx - 1], al
cmp edx, dword [rbx]
jl 0x1400821e0
sub rsi, r12
dec r14d
jns 0x1400821b0
jmp 0x1400822cb
add edi, edi
mov qword [rsp + 0x68], r15
movsxd rcx, edi
call fcn.1400fa250
mov r15, rax
test r14d, r14d
js 0x1400822be
movss xmm6, dword [0x14018a2a0]
mov qword [rsp + 0x60], rbp
xor ebp, ebp
movsxd r8, edi
mov r9, r13
lea edx, [rbp + 1]
mov rcx, r15
call fcn.1400fabdc
mov edi, dword [rbx]
xor r8d, r8d
add edi, edi
test edi, edi
jle 0x1400822b1
lea rdx, [r15 + 1]
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx - 1]
movzx eax, byte [rdx]
movd xmm0, dword [rbx + 0x10]
shl ecx, 8
xorps xmm1, xmm1
add r8d, 2
or eax, ecx
cvtdq2ps xmm0, xmm0
lea rdx, [rdx + 2]
cvtsi2ss xmm1, rax
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rcx, xmm1
mov byte [rbp + rsi], cl
mov edi, dword [rbx]
lea ebp, [rbp + 1]
add edi, edi
cmp r8d, edi
jl 0x140082270
sub rsi, r12
dec r14d
jns 0x140082241
mov rbp, qword [rsp + 0x60]
mov rcx, r15
call fcn.1400f97e8
mov r15, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x20]
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140082bc0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
sub rsp, 0x58
mov rbp, rcx
mov ecx, dword [rdx + 0x10]
xor edi, edi
mov r12, r8
mov rsi, rdx
test ecx, ecx
jne 0x140082be8
xor eax, eax
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 0xff
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], r14
cdq
mov qword [rsp + 0x40], r15
idiv ecx
mov rcx, rbp
mov dword [rsp + 0x98], eax
call fcn.1400ff110
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rbp
mov rbx, rax
call fcn.1400fe870
mov rcx, rbp
call fcn.1400ff110
xor r8d, r8d
mov rdx, rbx
mov r14, rax
mov rcx, rbp
sub r14, rbx
call fcn.1400fe870
lea rcx, [r14 + 0x40]
call fcn.1400fa250
mov r15, rax
test rax, rax
je 0x140082dcc
mov r9, rbp
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.1400fabdc
mov eax, dword [rsi]
mov ecx, dword [rsi + 4]
inc eax
xor ebp, ebp
lea r8d, [rax + rax*2]
lea eax, [rcx - 1]
and r8d, 0xfffffffc
movsxd rbx, eax
xor eax, eax
mov edx, r8d
mov dword [rsp + 0x88], r8d
mov qword [rsp + 0x20], rax
imul rbx, rdx
add rbx, r12
test ecx, ecx
jle 0x140082dbf
movaps xmmword [rsp + 0x30], xmm6
movss xmm6, dword [0x14018a2a0]
mov qword [rsp + 0x50], r13
cmp rax, r14
jae 0x140082db5
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, r15
call fcn.1400837c0
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, r15
mov r12d, eax
call fcn.1400837c0
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, r15
mov r13d, eax
call fcn.1400837c0
mov r8d, dword [rsp + 0x88]
cmp edi, r8d
jae 0x140082d96
mov ecx, dword [rsi + 0x10]
cmp ecx, 0xff
jne 0x140082d2f
mov edx, dword [rsp + 0x98]
imul dl
mov byte [rdi + rbx], al
inc edi
movzx eax, dl
imul r13b
mov byte [rdi + rbx], al
inc edi
movzx eax, dl
imul r12b
mov byte [rdi + rbx], al
jmp 0x140082d94
xorps xmm1, xmm1
movd xmm0, ecx
mov eax, eax
cvtsi2ss xmm1, rax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rcx, xmm1
xorps xmm1, xmm1
cvtsi2ss xmm1, r13
mov byte [rdi + rbx], cl
movd xmm0, dword [rsi + 0x10]
inc edi
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rcx, xmm1
xorps xmm1, xmm1
cvtsi2ss xmm1, r12
mov byte [rdi + rbx], cl
movd xmm0, dword [rsi + 0x10]
inc edi
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
mulss xmm1, xmm6
cvttss2si rcx, xmm1
mov byte [rdi + rbx], cl
inc edi
mov eax, dword [rsi]
lea ecx, [rax + rax*2]
cmp edi, ecx
jne 0x140082da6
sub rbx, r8
xor edi, edi
inc ebp
cmp ebp, dword [rsi + 4]
jge 0x140082db5
mov rax, qword [rsp + 0x20]
jmp 0x140082cb0
mov r13, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov rcx, r15
call fcn.1400f97e8
mov eax, 1
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x58
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140082df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push r14
sub rsp, 0x38
mov r9d, dword [rdx + 0x10]
mov rsi, rdx
mov r14, rcx
test r9d, r9d
jne 0x140082e15
xor eax, eax
add rsp, 0x38
pop r14
pop rsi
ret
mov edx, dword [rdx]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov ebp, dword [rsi + 4]
lea eax, [rdx + 1]
mov qword [rsp + 0x28], r13
dec ebp
lea ecx, [rax + rax*2]
and ecx, 0xfffffffc
movsxd rbx, ebp
movsxd r13, ecx
imul rbx, r13
add rbx, r8
cmp r9d, 0xff
jg 0x140082e96
test ebp, ebp
js 0x140082fbe
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rsi]
mov r9, r14
mov edx, 1
lea ecx, [rax + rax*2]
movsxd r8, ecx
mov rcx, rbx
call fcn.1400fabdc
mov r9d, dword [rsi + 0x10]
mov r8d, dword [rsi]
mov rdx, rbx
mov rcx, rbx
call fcn.140083ae0
sub rbx, r13
dec ebp
jns 0x140082e60
jmp 0x140082fbe
lea eax, [rdx + rdx*2]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x30], r12
lea edi, [rax + rax]
lea eax, [rdi + 6]
movsxd rcx, eax
call fcn.1400fa250
mov r12, rax
test ebp, ebp
js 0x140082fac
mov qword [rsp + 0x20], r15
movsxd r8, edi
mov r9, r14
mov edx, 1
mov rcx, r12
call fcn.1400fabdc
mov eax, dword [rsi]
lea edi, [rax + rax*2]
add edi, edi
je 0x140082f9c
mov r14, rbx
mov r15d, 3
nop word [rax + rax]
mov r11d, dword [rsi + 0x10]
lea r14, [r14 + 3]
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
lea eax, [r15 - 1]
movzx edx, byte [rax + r12]
mov eax, r15d
movzx ecx, byte [rax + r12]
shl edx, 8
or edx, ecx
imul eax, edx, 0xff
add eax, r10d
cdq
idiv r11d
mov r9d, eax
lea eax, [r15 - 3]
movzx edx, byte [rax + r12]
lea eax, [r15 - 2]
movzx eax, byte [rax + r12]
shl edx, 8
or edx, eax
imul eax, edx, 0xff
add eax, r10d
cdq
idiv r11d
mov r8d, eax
lea eax, [r15 + 1]
movzx edx, byte [rax + r12]
lea eax, [r15 + 2]
add r15d, 6
movzx eax, byte [rax + r12]
shl edx, 8
or edx, eax
imul eax, edx, 0xff
add eax, r10d
cdq
idiv r11d
mov byte [r14 - 3], al
mov byte [r14 - 2], r9b
mov byte [r14 - 1], r8b
mov eax, dword [rsi]
lea edi, [rax + rax*2]
lea eax, [r15 - 3]
add edi, edi
cmp eax, edi
jb 0x140082ef0
mov r14, qword [rsp + 0x50]
sub rbx, r13
dec ebp
jns 0x140082ec1
mov r15, qword [rsp + 0x20]
mov rcx, r12
call fcn.1400f97e8
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov r13, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x38
pop r14
pop rsi
ret
Function at 0x140082fe0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rdx
xor r8d, r8d
xor edx, edx
mov rbx, rcx
call fcn.1400fad50
mov edx, 1
lea rcx, [rsp + 0x50]
mov r9, rbx
mov r8d, edx
mov byte [rsp + 0x50], 0
call fcn.1400fabdc
mov edx, 1
lea rcx, [rsp + 0x48]
mov r8d, edx
mov r9, rbx
mov byte [rsp + 0x48], 0
call fcn.1400fabdc
movzx r14d, byte [rsp + 0x48]
mov rcx, rbx
call fcn.140083890
mov rcx, rbx
mov esi, eax
call fcn.140083890
mov rcx, rbx
mov ebp, eax
call fcn.140083890
cmp byte [rsp + 0x50], 0x50
mov dword [rdi + 0xc], 0
jne 0x14008309c
cmp r14d, 0x36
je 0x140083079
cmp r14d, 0x33
jne 0x14008309c
mov dword [rdi + 0xc], 1
test esi, esi
jle 0x14008309c
test ebp, ebp
jle 0x14008309c
cmp eax, 1
jle 0x14008309c
mov dword [rdi + 0x10], eax
mov dword [rdi], esi
mov dword [rdi + 4], ebp
mov eax, 1
mov dword [rdi + 8], 0x18
jmp 0x14008309e
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret