joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c220
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x330
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
xor r12d, r12d
movzx esi, r9w
mov rbx, r8
mov r14d, edx
mov r15, rcx
mov ebp, r12d
test edx, edx
jle 0x14008c396
nop word [rax + rax]
mov r9, qword [r15]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x14008c3d4
movzx eax, byte [rsp + 0x20]
movzx edi, al
test al, al
jns 0x14008c32c
and edi, 0x7f
jne 0x14008c2c9
mov r9, qword [r15]
lea edx, [rdi + 2]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
movzx edi, byte [rsp + 0x20]
movzx eax, byte [rsp + 0x21]
shl edi, 8
or edi, eax
jmp 0x14008c2cb
inc edi
add ebp, edi
cmp ebp, r14d
jg 0x14008c3c6
mov r9, qword [r15]
mov edx, 1
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 2]
call fcn.1401c1e14
test edi, edi
jle 0x14008c38d
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x21]
movzx r8d, byte [rsp + 0x20]
mov eax, edi
nop word [rax + rax]
mov byte [rbx], r8b
mov byte [rbx + 1], dl
mov byte [rbx + 2], cl
add rbx, 3
test si, si
je 0x14008c325
inc rbx
dec rax
jne 0x14008c310
jmp 0x14008c38d
mov r9, qword [r15]
and edi, 0x7f
lea rcx, [rsp + 0x20]
inc edi
mov r8d, 3
movsxd rdx, edi
call fcn.1401c1e14
add ebp, edi
cmp ebp, r14d
jg 0x14008c3c6
lea eax, [rdi + rdi*2]
mov rcx, r12
movsxd rdx, eax
test eax, eax
jle 0x14008c38d
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
add rbx, 3
mov byte [rbx - 3], al
movzx eax, byte [rsp + rcx + 0x21]
mov byte [rbx - 2], al
movzx eax, byte [rsp + rcx + 0x22]
mov byte [rbx - 1], al
test si, si
je 0x14008c384
inc rbx
add rcx, 3
cmp rcx, rdx
jl 0x14008c360
cmp ebp, r14d
jl 0x14008c270
movzx eax, r12w
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1401bd600
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, str.ERROR_RLE_n
call fcn.1401bdc60
jmp 0x14008c396
mov eax, 4
jmp 0x14008c39a

Function at 0x14008c3e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov esi, edx
mov r14, rcx
mov edi, ebp
test edx, edx
jle 0x14008c43d
lea rbx, [r8 + 3]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x48]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x14008c453
movzx eax, byte [rsp + 0x48]
inc edi
add rbx, 4
mov byte [rbx - 4], al
cmp edi, esi
jl 0x14008c410
movzx eax, bp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov eax, 4
jmp 0x14008c440
Function at 0x14008c460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
movzx ebp, r9w
mov rbx, r8
mov esi, edx
mov r14, rcx
mov edi, r15d
test edx, edx
jle 0x14008c4d6
nop
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x48]
lea r8d, [rdx + 2]
call fcn.1401c1e14
cmp rax, 3
jne 0x14008c4f3
movzx eax, byte [rsp + 0x48]
add rbx, 3
mov byte [rbx - 3], al
movzx eax, byte [rsp + 0x49]
mov byte [rbx - 2], al
movzx eax, byte [rsp + 0x4a]
mov byte [rbx - 1], al
test bp, bp
je 0x14008c4d0
inc rbx
inc edi
cmp edi, esi
jl 0x14008c490
movzx eax, r15w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 4
jmp 0x14008c4da
Function at 0x14008da10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 4
mov rdi, rcx
lea r8d, [rdx - 3]
mov rcx, rbx
call fcn.1401c1e14
mov eax, dword [rbx]
cmp eax, dword [str.8BPS]
je 0x14008da4e
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rdi
call fcn.140066de0
mov word [rbx + 4], ax
dec ax
cmp ax, 1
ja 0x14008da3e
mov r9, qword [rdi]
mov edx, 6
lea rcx, [rbx + 6]
lea r8d, [rdx - 5]
call fcn.1401c1e14
mov rcx, rdi
call fcn.140066de0
mov rcx, rdi
mov word [rbx + 0xc], ax
call fcn.140066b70
mov rcx, rdi
mov dword [rbx + 0x10], eax
call fcn.140066b70
mov rcx, rdi
mov dword [rbx + 0x14], eax
call fcn.140066de0
mov rcx, rdi
mov word [rbx + 0x18], ax
call fcn.140066de0
mov word [rbx + 0x1a], ax
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x14008dad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov r14, rdx
call fcn.1401c3f28
mov ebx, eax
test eax, eax
jne 0x14008db16
mov rcx, qword [rsi]
call fcn.1401c3f28
mov dword [r14], 2
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
test al, 1
jne 0x14008db26
inc ebx
lea ebp, [rbx + 1]
mov ecx, 1
movsxd rdx, ebp
call fcn.1401be1f8
mov rdi, rax
test rax, rax
je 0x14008db59
mov r9, qword [rsi]
movsxd rbx, ebx
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1401c1e14
mov byte [rbx + rdi], 0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov dword [r14], ebp
mov rbp, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret

Function at 0x14008f350
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movsxd rbx, r8d
mov rsi, rdx
mov rdi, rcx
test r8d, r8d
jle 0x14008f38b
cmp qword [rcx + 0x108], rbx
je 0x14008f391
mov eax, 2
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebx, dword [rcx + 0x108]
mov edx, ebx
mov rcx, rsi
call fcn.14008f2f0
test ax, ax
jne 0x14008f3d0
mov r9, qword [rdi]
mov rcx, qword [rsi]
movsxd rdx, ebx
mov r8d, 1
call fcn.1401c1e14
test rax, rax
jne 0x14008f3ce
mov eax, 4
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14008f8b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x1b8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movsxd rax, r9d
mov rbx, r8
mov rbp, rdx
mov rsi, rcx
cmp qword [rcx + 0x108], rax
je 0x14008f8ea
mov eax, 2
jmp 0x14008f969
mov r9, qword [rcx]
mov qword [rsp + 0x1b0], r15
mov edi, 2
mov r15d, 1
lea rcx, [rsp + 0x20]
mov edx, edi
mov r8d, r15d
call fcn.1401c1e14
test rax, rax
je 0x14008faab
movzx ecx, word [rsp + 0x200]
movzx eax, cl
cmp byte [rsp + 0x20], cl
jne 0x14008faab
shr cx, 8
cmp byte [rsp + 0x21], cl
jne 0x14008faab
mov ecx, 0x1f40
mov qword [rsp + 0x1f0], r14
call fcn.1401bee78
mov r14, rax
test rax, rax
jne 0x14008f985
movzx eax, r15w
mov r14, qword [rsp + 0x1f0]
mov r15, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x1b8
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r9, qword [rsi]
mov r8, r15
mov edx, 0x1f40
mov rcx, rax
call fcn.1401c1e14
test rax, rax
je 0x14008faa3
lea rcx, [rsp + 0x30]
call fcn.140060c40
lea rcx, [rsp + 0x11e]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x14008f9c0
lea rdx, [rsp + 0x30]
mov rcx, rbp
mov dword [rsp + 0x48], 0x140
mov dword [rsp + 0x4c], 0xc8
mov dword [rsp + 0x50], 0x10001
mov dword [rsp + 0x58], 0x28
call fcn.14005ee10
movzx edi, ax
test ax, ax
jne 0x14008fa9b
xor ebx, ebx
cmp dword [rsp + 0x4c], ebx
jle 0x14008fa8b
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov ecx, eax
and eax, 7
sub eax, edx
sar ecx, 3
movsxd r8, eax
lea ecx, [rcx + rcx*4]
shl ecx, 6
movsxd rdx, ecx
lea rax, [r14 + rdx]
add r8, rax
xor eax, eax
nop word [rax + rax]
movzx edx, byte [r8]
mov rcx, qword [rsp + 0x40]
add rax, 2
mov byte [rax + rcx - 2], dl
movzx edx, byte [r8 + 8]
mov rcx, qword [rsp + 0x40]
mov byte [rax + rcx - 1], dl
lea r8, [r8 + 0x10]
cmp rax, 0x28
jl 0x14008fa40
or r8d, 0xffffffff
mov r9d, r15d
mov rcx, rbp
or edx, r8d
call fcn.1400615b0
movzx edi, ax
test ax, ax
jne 0x14008fa8b
inc ebx
cmp ebx, dword [rsp + 0x4c]
jl 0x14008fa10
xor r8d, r8d
xor edx, edx
xor r9d, r9d
mov rcx, rbp
call fcn.14005cb20
mov rcx, r14
call fcn.1401be23c
movzx eax, di
jmp 0x14008f959
movzx eax, di
jmp 0x14008f961
Function at 0x1400913e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push r14
sub rsp, 0x20
xor ebp, ebp
mov ebx, r8d
mov rsi, rdx
mov r14, rcx
test r8d, r8d
jle 0x1400914b9
mov qword [rsp + 0x40], rdi
nop word [rax + rax]
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x140091461
movzx eax, byte [rsp + 0x50]
test al, al
jns 0x140091479
movsx ecx, al
neg cx
movsx eax, cx
sub ebx, eax
jns 0x140091444
add cx, bx
mov r9, qword [r14]
movsx rdi, cx
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1401c1e14
test rax, rax
jne 0x1400914a9
mov eax, 4
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret
movsx edi, al
inc di
movsx eax, di
sub ebx, eax
jns 0x140091489
add di, bx
mov rcx, qword [r14]
call fcn.1401c3f28
cmp ax, 0xffff
je 0x140091461
movsx rdi, di
movsx edx, ax
mov rcx, rsi
mov r8, rdi
call fcn.1401c0040
add rsi, rdi
test ebx, ebx
jg 0x140091410
movzx eax, bp
jmp 0x140091466
movzx eax, bp
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rsi
pop rbp
ret

Function at 0x140091660
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, rcx
xor ecx, ecx
mov r13d, r9d
mov r15, r8
mov r12, rdx
mov rdi, r8
movzx r14d, cx
mov ebp, ecx
mov ebx, ecx
cmp dword [rsp + 0x80], ecx
jle 0x1400917c5
mov qword [rsp + 0x78], rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rax]
mov edx, 1
lea rcx, [rsp + 0x70]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x1400917be
movzx eax, byte [rsp + 0x70]
movsx esi, al
test al, al
jns 0x140091738
neg si
test si, si
jle 0x140091793
nop word [rax + rax]
mov rcx, qword [rsp + 0x60]
dec si
call fcn.140066da0
inc ebx
add rdi, 2
mov word [rdi - 2], ax
cmp ebx, r13d
jl 0x140091731
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r12
or edx, r8d
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x140091793
xor ebx, ebx
mov rdi, r15
inc ebp
test si, si
jg 0x1400916f0
jmp 0x140091793
mov rcx, qword [rsp + 0x60]
inc si
call fcn.140066da0
movzx r12d, ax
test si, si
jle 0x14009178e
nop
inc ebx
mov word [rdi], r12w
dec si
add rdi, 2
cmp ebx, r13d
jl 0x140091789
mov rcx, qword [rsp + 0x68]
or r8d, 0xffffffff
mov r9d, 1
or edx, r8d
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x14009178e
xor ebx, ebx
mov rdi, r15
inc ebp
test si, si
jg 0x140091750
mov r12, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
cmp ebp, dword [rsp + 0x80]
jl 0x1400916b0
movzx eax, r14w
mov rsi, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, 4
jmp 0x1400917a9
movzx eax, r14w
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400917e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, rdx
xor r14d, r14d
lea eax, [r9 + 1]
lea eax, [rax + rax*2]
mov rbp, r8
mov r13, rcx
cdq
mov rbx, r8
mov edi, r14d
and edx, 3
add eax, edx
sar eax, 2
mov r15d, eax
shl r15d, 2
mov dword [rsp + 0x20], r15d
cmp dword [rsp + 0x90], r14d
jle 0x14009198d
mov qword [rsp + 0x70], rsi
mov r9, qword [r13]
mov edx, 1
lea rcx, [rsp + 0x88]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x140091986
movzx eax, byte [rsp + 0x88]
movsx esi, al
test al, al
jns 0x1400918d8
neg si
test si, si
jle 0x140091960
movsxd r15, r15d
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r13]
mov edx, 3
mov rcx, rbx
lea r8d, [rdx - 2]
dec si
call fcn.1401c1e14
add rbx, 3
mov rax, rbx
sub rax, rbp
cmp rax, r15
jl 0x1400918ce
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r12
or edx, r8d
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x14009195b
inc edi
mov rbx, rbp
test si, si
jg 0x140091880
jmp 0x14009195b
mov r9, qword [r13]
mov edx, 3
lea rcx, [rsp + 0x80]
lea r8d, [rdx - 2]
inc si
call fcn.1401c1e14
test si, si
jle 0x140091960
movsxd r15, r15d
nop dword [rax]
movzx eax, byte [rsp + 0x80]
add rbx, 3
dec si
mov byte [rbx - 3], al
movzx eax, byte [rsp + 0x81]
mov byte [rbx - 2], al
movzx eax, byte [rsp + 0x82]
mov byte [rbx - 1], al
mov rax, rbx
sub rax, rbp
cmp rax, r15
jl 0x140091956
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r12
or edx, r8d
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x14009195b
inc edi
mov rbx, rbp
test si, si
jg 0x140091900
mov r15d, dword [rsp + 0x20]
cmp edi, dword [rsp + 0x90]
jl 0x140091831
movzx eax, r14w
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
mov eax, 4
jmp 0x140091971
movzx eax, r14w
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret

Function at 0x140091b10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov edx, 4
mov r14, r9
mov r9, qword [rcx]
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x30]
call fcn.1401c1e14
cmp rax, 1
jne 0x140091bc6
cmp byte [rsp + 0x30], 0x52
jne 0x140091bc6
cmp byte [rsp + 0x31], 0x49
jne 0x140091bc6
cmp byte [rsp + 0x32], 0x58
jne 0x140091bc6
cmp byte [rsp + 0x33], 0x33
jne 0x140091bc6
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
movzx eax, ax
mov dword [rdi], eax
call fcn.140066da0
movzx ecx, ax
mov dword [rsi], ecx
mov eax, dword [rdi]
dec eax
cmp eax, 0x3e7f
ja 0x140091bc6
lea eax, [rcx - 1]
cmp eax, 0x3e7f
ja 0x140091bc6
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [r14], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, qword [rsp + 0x50]
mov byte [rcx], al
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
jmp 0x140091bcb
mov eax, 2
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140093190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r9
mov ebp, r8d
mov rbx, rdx
mov r15, rcx
call fcn.140066da0
test ebp, ebp
js 0x14009327e
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r15]
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x140093299
movzx eax, byte [rsp + 0x50]
test al, al
je 0x14009327e
mov r9, qword [r15]
movzx esi, al
and esi, 0x7f
test al, al
jns 0x140093241
mov edx, 1
lea rcx, [rsp + 0x50]
mov r8d, edx
call fcn.1401c1e14
movzx eax, byte [rsp + 0x50]
cmp al, byte [rdi]
jbe 0x140093226
mov byte [rdi], al
test esi, esi
jle 0x140093274
mov ecx, esi
nop dword [rax]
mov byte [rbx], al
inc rbx
dec rcx
je 0x140093274
movzx eax, byte [rsp + 0x50]
jmp 0x140093230
movsxd r14, esi
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.1401c1e14
test esi, esi
jle 0x140093271
mov rax, rbx
mov rdx, r14
nop
movzx ecx, byte [rax]
cmp cl, byte [rdi]
jbe 0x140093269
mov byte [rdi], cl
inc rax
dec rdx
jne 0x140093260
add rbx, r14
sub ebp, esi
test ebp, ebp
jns 0x1400931d0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 4
jmp 0x140093280
Function at 0x140093730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r9
mov rsi, r8
mov r14, rdx
mov rdi, rcx
call fcn.140066da0
mov ecx, 0x1234
cmp ax, cx
je 0x14009376a
mov eax, 2
jmp 0x140093949
mov rcx, rdi
mov qword [rsp + 0x30], rbp
call fcn.140066da0
mov rcx, rdi
movzx eax, ax
mov dword [r14], eax
call fcn.140066da0
mov rcx, rdi
movzx eax, ax
mov dword [rsi], eax
call fcn.140066da0
mov rcx, rdi
call fcn.140066da0
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rdx, qword [rsp + 0x50]
mov ebp, 1
movzx ecx, al
movzx eax, al
dec eax
mov word [rbx], cx
mov word [rdx], bp
cmp eax, 0x30
ja case.0x1400937e3.3
lea r8, [0x140000000]
cdqe
lea esi, [rbp + 1]
movzx eax, byte [r8 + rax + 0x93988]
mov ecx, dword [r8 + rax*4 + 0x93960]
add rcx, r8
jmp rcx
mov word [rbx], bp
mov word [rdx], bp
jmp 0x14009384b
mov word [rbx], si
mov word [rdx], bp
jmp 0x14009384b
mov eax, 4
mov word [rbx], ax
mov word [rdx], bp
jmp 0x14009384b
mov word [rbx], bp
mov word [rdx], si
jmp 0x14009384b
mov word [rbx], bp
mov eax, 4
jmp 0x140093848
mov eax, 8
mov word [rbx], ax
mov word [rdx], bp
jmp 0x14009384b
mov eax, 0x10
mov word [rbx], ax
mov word [rdx], bp
jmp 0x14009384b
mov eax, 0x18
mov word [rbx], ax
mov word [rdx], bp
jmp 0x14009384b
mov eax, 8
mov word [rbx], ax
mov eax, 3
mov word [rdx], ax
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
call fcn.140066da0
mov rcx, qword [rsp + 0x60]
mov word [rcx], ax
cmp ax, 5
ja 0x14009393a
mov rcx, rdi
call fcn.140066da0
movzx ebx, ax
test ax, ax
je 0x140093926
mov rsi, qword [rsp + 0x58]
mov r9, qword [rdi]
movsx rdx, ax
mov rcx, rsi
mov r8, rbp
call fcn.1401c1e14
movsx ecx, bx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
movsxd r9, edx
test edx, edx
jle 0x140093926
lea r8, [rsi + 2]
nop dword [rax]
movzx eax, byte [r8 - 2]
lea r8, [r8 + 3]
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
movzx eax, byte [r8 - 4]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [r8 - 5], cl
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
movzx eax, byte [r8 - 3]
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [r8 - 4], cl
imul ecx, eax, 0xff
mov eax, 0x4104105
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov byte [r8 - 3], cl
dec r9
jne 0x1400938c0
mov rcx, qword [rdi]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
jmp 0x140093944
movzx eax, si
jmp 0x140093944
mov eax, 2
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140093b30
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 6
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx - 5]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
cmp rax, 1
jne 0x140093bb4
mov eax, dword [rsp + 0x20]
cmp eax, dword [str.BW256]
jne 0x140093bb4
movzx eax, word [rsp + 0x24]
cmp ax, word [0x14021a6b8]
jne 0x140093bb4
mov rcx, rbx
call fcn.140066de0
mov rcx, rbx
movzx eax, ax
mov dword [rdi], eax
call fcn.140066de0
movzx eax, ax
mov dword [rsi], eax
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
jmp 0x140093bb9
mov eax, 2
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x140093df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebx, r8d
mov rbp, rdx
mov r14, rcx
test r8d, r8d
jle 0x140093e6b
mov rcx, qword [r14]
call fcn.1401c3f28
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140093e88
test eax, eax
je 0x140093e42
mov r9, qword [r14]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.1401c1e14
jmp 0x140093e62
mov rcx, qword [r14]
call fcn.1401c3f28
mov rcx, qword [r14]
mov esi, eax
call fcn.1401c3f28
test esi, esi
jle 0x140093e65
movzx eax, al
mov rdi, rbp
mov ecx, esi
rep stosb byte [rdi], al
add rbp, rsi
sub ebx, esi
test ebx, ebx
jg 0x140093e18
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, 4
jmp 0x140093e6d

Function at 0x1400946e0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov edx, 0xa
mov r14, r9
mov r9, qword [rcx]
mov rsi, r8
mov rbx, rcx
lea r8d, [rdx - 9]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
cmp rax, 1
jne 0x1400947b9
mov rax, qword [rsp + 0x20]
cmp rax, qword [str.CALAMUSCRG]
jne 0x1400947b9
movzx eax, word [rsp + 0x28]
cmp ax, word [0x14021a6c8]
jne 0x1400947b9
mov r9, qword [rbx]
mov edx, 0xa
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 9]
call fcn.1401c1e14
cmp rax, 1
jne 0x1400947b9
mov rcx, rbx
call fcn.140066b70
mov rcx, rbx
mov dword [rdi], eax
call fcn.140066b70
mov rcx, rbx
mov dword [rsi], eax
call fcn.140066b70
mov rcx, qword [rbx]
call fcn.1401c3f28
mov edx, 9
lea rcx, [rsp + 0x20]
mov word [r14], ax
mov r9, qword [rbx]
lea r8d, [rdx - 8]
call fcn.1401c1e14
cmp rax, 1
jne 0x1400947b9
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
jmp 0x1400947be
mov eax, 2
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400947e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x28
mov r14d, dword [rsp + 0x80]
lea r13d, [r9 + 0xf]
xor r12d, r12d
shr r13d, 3
mov rbp, r8
mov rdi, rcx
and r13d, 0x1ffffffe
mov qword [rsp + 0x70], r8
mov ebx, r13d
test r14d, r14d
je 0x140094935
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x20], r15
mov rcx, qword [rdi]
call fcn.1401c3f28
movzx r15d, al
test al, al
jns 0x1400948ba
mov rcx, qword [rdi]
and r15d, 0x7f
inc r15d
call fcn.1401c3f28
movzx eax, al
mov dword [rsp + 0x80], eax
nop dword [rax + rax]
mov esi, ebx
cmp r15d, ebx
mov edx, eax
cmovl esi, r15d
mov rcx, rbp
movsxd rdi, esi
mov r8, rdi
call fcn.1401c0040
sub r15d, esi
add rbp, rdi
sub ebx, esi
jne 0x1400948ac
mov rcx, qword [rsp + 0x68]
or r8d, 0xffffffff
lea r9d, [rbx + 1]
or edx, r8d
call fcn.1400615b0
movzx r12d, ax
test ax, ax
jne 0x14009491d
mov rbp, qword [rsp + 0x70]
mov ebx, r13d
dec r14d
mov eax, dword [rsp + 0x80]
test r15d, r15d
jne 0x140094860
jmp 0x14009491d
inc r15d
nop dword [rax]
mov rax, qword [rsp + 0x60]
mov esi, ebx
cmp r15d, ebx
mov r9, qword [rax]
cmovl esi, r15d
mov r8d, 1
movsxd rdi, esi
mov rcx, rbp
mov rdx, rdi
call fcn.1401c1e14
sub r15d, esi
add rbp, rdi
sub ebx, esi
jne 0x140094918
mov rcx, qword [rsp + 0x68]
or r8d, 0xffffffff
lea r9d, [rbx + 1]
or edx, r8d
call fcn.1400615b0
movzx r12d, ax
test ax, ax
jne 0x14009491d
mov rbp, qword [rsp + 0x70]
mov ebx, r13d
dec r14d
test r15d, r15d
jne 0x1400948c0
mov rdi, qword [rsp + 0x60]
test r14d, r14d
jne 0x140094832
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x78]
movzx eax, r12w
add rsp, 0x28
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret