joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c7460
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x20
xor r12d, r12d
mov r13d, r8d
mov rbx, rdx
mov r15, rcx
mov ebp, r12d
test r8d, r8d
jle 0x1400c75b6
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], r14
lea r14d, [r8 - 1]
mov qword [rsp + 0x58], rdi
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
lea rdx, [rbx + 1]
mov esi, r12d
cmp byte [rbx], al
jne 0x1400c74f3
nop
cmp ebp, r14d
jge 0x1400c74cf
cmp esi, 0xfe
jge 0x1400c74cf
movzx eax, byte [rdx + 1]
mov rbx, rdx
inc rdx
inc esi
inc ebp
cmp byte [rbx], al
je 0x1400c74b0
test esi, esi
je 0x1400c74f3
mov rdx, qword [r15]
lea ecx, [rsi + 1]
call fcn.1401c1ae4
movzx ecx, byte [rbx]
mov rdx, qword [r15]
call fcn.1401c1ae4
inc rbx
inc ebp
jmp 0x1400c759e
cmp ebp, r14d
jne 0x1400c74fc
inc ebp
jmp 0x1400c752c
movzx eax, byte [rbx + 1]
lea rcx, [rbx + 1]
cmp byte [rbx], al
je 0x1400c755d
cmp ebp, r14d
jge 0x1400c7527
cmp esi, 0xfe
jge 0x1400c7527
movzx eax, byte [rcx + 1]
mov rbx, rcx
inc rcx
inc esi
inc ebp
cmp byte [rbx], al
jne 0x1400c7508
cmp esi, 1
jne 0x1400c753f
mov rdx, qword [r15]
mov ecx, 1
call fcn.1401c1ae4
movzx ecx, byte [rbx - 1]
jmp 0x1400c7596
cmp esi, 2
jne 0x1400c755d
mov rdx, qword [r15]
lea ecx, [rsi - 1]
call fcn.1401c1ae4
movzx ecx, byte [rbx - 2]
mov rdx, qword [r15]
call fcn.1401c1ae4
jmp 0x1400c752c
mov rdx, qword [r15]
xor ecx, ecx
call fcn.1401c1ae4
mov rdx, qword [r15]
movsxd rdi, esi
mov ecx, esi
sub rbx, rdi
call fcn.1401c1ae4
mov r9, qword [r15]
mov r8d, 1
mov rdx, rdi
mov rcx, rbx
call fcn.1401c24f8
add rbx, rdi
test sil, 1
je 0x1400c759e
xor ecx, ecx
mov rdx, qword [r15]
call fcn.1401c1ae4
cmp ebp, r13d
jl 0x1400c74a0
mov r14, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov rdx, qword [r15]
xor ecx, ecx
call fcn.1401c1ae4
mov rdx, qword [r15]
xor ecx, ecx
call fcn.1401c1ae4
movzx eax, r12w
add rsp, 0x20
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
Function at 0x1400c7d70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rcx
lea rcx, [rsp + 0x20]
movzx ebx, r8w
mov rbp, rdx
call fcn.140061e90
test bx, bx
je 0x1400c7dc0
mov eax, dword [0x14020d048]
movsd xmm0, qword [str.OS_2_Bitmap]
mov dword [rsp + 0x58], eax
jmp 0x1400c7de9
mov eax, dword [0x14020cfc0]
movsd xmm0, qword [str.Windows_Bitmap]
mov dword [rsp + 0x58], eax
movzx eax, word [0x14020cfc4]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x14020cfc6]
mov byte [rsp + 0x5e], al
movzx ecx, word [rbp + 0x4c]
mov edx, 0x20
mov eax, 8
cmp cx, dx
mov word [rsp + 0x32], cx
movsd qword [rsp + 0x50], xmm0
cmove eax, edx
xor r13d, r13d
cmp cx, 0x18
mov dword [rsp + 0x20], eax
mov eax, 0x10
mov ebx, r13d
setne bl
mov word [rsp + 0x24], ax
mov eax, 1
mov word [rsp + 0x30], ax
add bx, 3
lea rdx, [rsp + 0x20]
movsx eax, bx
mov rcx, rbp
imul eax, dword [rbp + 0x50]
mov dword [rsp + 0x3c], eax
lea r14d, [rax + 3]
and r14w, 0xfffc
sub r14w, ax
call fcn.14005fe70
movzx r15d, ax
test ax, ax
jne 0x1400c7efd
mov qword [rsp + 0x130], rsi
movzx esi, r13w
cmp dword [rbp + 0x54], r13d
jle 0x1400c7eed
mov qword [rsp + 0xe0], r12
mov eax, r13d
movsx r12, bx
nop dword [rax]
nop dword [rax + rax]
mov r8d, 1
mov edx, eax
mov rcx, rbp
call fcn.1400629c0
movsxd rdx, dword [rbp + 0x50]
mov r9, qword [rdi]
mov rcx, qword [rsp + 0x28]
mov r8, r12
call fcn.1401c24f8
cmp rax, r12
jne 0x1400c7edf
cmp r13w, r14w
jge 0x1400c7ed2
movzx ebx, r14w
mov rdx, qword [rdi]
xor ecx, ecx
call fcn.1401c1ae4
dec rbx
jne 0x1400c7ec3
inc si
movsx eax, si
cmp eax, dword [rbp + 0x54]
jl 0x1400c7e90
jmp 0x1400c7ee5
mov r15d, 6
mov r12, qword [rsp + 0xe0]
mov rcx, rbp
call fcn.14005dcb0
mov rsi, qword [rsp + 0x130]
movzx eax, r15w
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0xe8
pop r15
pop r14
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400c7f30
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.140061e90
mov eax, dword [0x14020d028]
xor r12d, r12d
movups xmm0, xmmword [str.Windows_Bitmap_RGB565]
mov dword [rsp + 0x60], eax
movzx eax, word [0x14020d02c]
lea rdx, [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x64], ax
mov eax, 0x10
mov rcx, rdi
mov word [rsp + 0x24], ax
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x20], r12d
add eax, eax
mov dword [rsp + 0x30], 0x180001
lea r13d, [r12 + 1]
lea r14d, [rax + 3]
mov dword [rsp + 0x3c], eax
and r14w, 0xfffc
sub r14w, ax
call fcn.14005fe70
movzx r15d, ax
test ax, ax
jne 0x1400c80e0
mov qword [rsp + 0xe0], rbp
movzx ebp, r12w
cmp dword [rdi + 0x54], r12d
jle 0x1400c80d0
mov qword [rsp + 0x130], rbx
mov eax, r12d
nop word [rax + rax]
mov r8d, r13d
mov edx, eax
mov rcx, rdi
call fcn.1400629c0
mov eax, dword [rdi + 0x50]
mov r10, qword [rsp + 0x28]
lea ecx, [rax + rax*2]
mov r11, r10
movzx r9d, r12w
test ecx, ecx
jle 0x1400c807d
movsx rdx, r9w
add r9w, 3
lea r11, [r11 + 2]
movzx eax, byte [rdx + r10 + 1]
shr al, 2
movzx r8d, al
movzx eax, byte [rdx + r10]
shr al, 3
movzx ecx, al
movzx eax, byte [rdx + r10 + 2]
shl cx, 6
shr al, 3
or r8w, cx
movzx ecx, al
shl r8w, 5
or r8w, cx
mov word [r11 - 2], r8w
mov eax, dword [rdi + 0x50]
mov r10, qword [rsp + 0x28]
lea ecx, [rax + rax*2]
movsx eax, r9w
cmp eax, ecx
jl 0x1400c8023
movsxd rdx, dword [rdi + 0x50]
mov r9, qword [rsi]
mov r8d, 2
mov rcx, r10
call fcn.1401c24f8
cmp rax, 2
jne 0x1400c80c2
cmp r12w, r14w
jge 0x1400c80b1
movzx ebx, r14w
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
dec rbx
jne 0x1400c80a2
inc bp
movsx eax, bp
cmp eax, dword [rdi + 0x54]
jl 0x1400c8000
jmp 0x1400c80c8
mov r15d, 6
mov rbx, qword [rsp + 0x130]
mov rcx, rdi
call fcn.14005dcb0
mov rbp, qword [rsp + 0xe0]
movzx eax, r15w
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400c8330
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov edx, 0x10
mov rdi, r9
mov r9, qword [rcx]
mov r14, r8
mov rbx, rcx
lea r8d, [rdx - 0xf]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x1400c837a
mov eax, 4
jmp 0x1400c842b
lea rdx, [0x14021ddf0]
lea rcx, [rsp + 0x20]
mov r8d, 8
call fcn.1401c25f0
test eax, eax
je 0x1400c839f
mov eax, 2
jmp 0x1400c842b
mov edx, 5
mov rcx, rbx
call fcn.140066ff0
mov r9, qword [rbx]
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
je 0x1400c8370
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x23], 0
call fcn.1401bee6c
mov dword [rdi], eax
mov rcx, qword [rbx]
call fcn.1401c3f28
cmp al, 1
jne 0x1400c8395
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
movzx eax, ax
mov dword [r14], eax
call fcn.140066da0
movzx eax, ax
mov dword [rsi], eax
mov rcx, qword [rbx]
call fcn.1401c2310
mov edx, 0x100
mov rcx, rbx
sub edx, eax
movsxd rdx, edx
call fcn.140066ff0
mov rcx, qword [rbx]
call fcn.1401c1a94
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x48
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400c8590
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.140061e90
mov eax, dword [str.Vista]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14020e16c]
mov dword [rsp + 0x30], 0x180001
mov word [rsp + 0x54], ax
mov eax, 0x10
lea ebp, [rax - 0xf]
mov word [rsp + 0x24], ax
mov eax, dword [rdi + 0x50]
lea ecx, [rax + rax*2]
mov dword [rsp + 0x3c], ecx
mov rcx, rdi
call fcn.14005fe70
movzx esi, ax
test ax, ax
jne 0x1400c866c
mov qword [rsp + 0x110], rbx
xor ebx, ebx
cmp dword [rdi + 0x54], ebx
jle 0x1400c865c
mov eax, ebx
nop dword [rax]
mov r8d, ebp
mov edx, eax
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rdi + 0x50]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x28]
mov r8d, 3
call fcn.1401c24f8
cmp rax, 3
jne 0x1400c8657
inc bx
movsx eax, bx
cmp eax, dword [rdi + 0x54]
jl 0x1400c8620
jmp 0x1400c865c
mov esi, 6
mov rcx, rdi
call fcn.14005dcb0
mov rbx, qword [rsp + 0x110]
movzx eax, si
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
mov rbp, qword [rsp + 0x118]
add rsp, 0xe0
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c86a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14, rcx
lea rcx, [rsp + 0x20]
mov rdi, rdx
call fcn.140061e90
mov eax, dword [str.Vista]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], eax
movzx eax, word [0x14020e16c]
mov rcx, rdi
mov word [rsp + 0x54], ax
mov eax, 0x10
mov dword [rsp + 0x30], 0x200001
lea ebp, [rax - 0xf]
mov word [rsp + 0x24], ax
mov eax, dword [rdi + 0x50]
shl eax, 2
mov dword [rsp + 0x3c], eax
call fcn.14005fe70
movzx esi, ax
test ax, ax
jne 0x1400c877c
mov qword [rsp + 0x110], rbx
xor ebx, ebx
cmp dword [rdi + 0x54], ebx
jle 0x1400c876c
mov eax, ebx
nop dword [rax]
mov r8d, ebp
mov edx, eax
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rdi + 0x50]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x28]
mov r8d, 4
call fcn.1401c24f8
cmp rax, 4
jne 0x1400c8767
inc bx
movsx eax, bx
cmp eax, dword [rdi + 0x54]
jl 0x1400c8730
jmp 0x1400c876c
mov esi, 6
mov rcx, rdi
call fcn.14005dcb0
mov rbx, qword [rsp + 0x110]
movzx eax, si
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
mov rbp, qword [rsp + 0x118]
add rsp, 0xe0
pop r14
pop rdi
pop rsi
ret

Function at 0x1400c87b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov r14, rcx
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140061e90
mov eax, dword [str.Vista]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x60], eax
movzx eax, word [0x14020e16c]
mov rcx, rdi
mov word [rsp + 0x64], ax
mov eax, 0x10
mov dword [rsp + 0x40], 0x80001
lea r15d, [rax - 0xf]
mov word [rsp + 0x34], ax
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x50], 0x80100
mov esi, 0x100
mov dword [rsp + 0x4c], eax
call fcn.14005fe70
movzx ebp, ax
test ax, ax
jne 0x1400c88db
mov qword [rsp + 0x130], rbx
mov rbx, qword [rsp + 0x58]
nop word [rax + rax]
movzx eax, byte [rbx]
mov r9, qword [r14]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x20], al
movzx eax, byte [rbx + 1]
mov r8, r15
mov byte [rsp + 0x21], al
movzx eax, byte [rbx + 2]
mov edx, 3
lea rbx, [rbx + 3]
mov byte [rsp + 0x23], 0
mov byte [rsp + 0x22], al
call fcn.1401c24f8
dec rsi
jne 0x1400c8850
xor ebx, ebx
cmp dword [rdi + 0x54], ebx
jle 0x1400c88cb
mov eax, ebx
mov r8d, r15d
mov edx, eax
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rdi + 0x50]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x38]
mov r8, r15
call fcn.1401c24f8
test rax, rax
je 0x1400c88c6
inc bx
movsx eax, bx
cmp eax, dword [rdi + 0x54]
jl 0x1400c8893
jmp 0x1400c88cb
mov ebp, 6
mov rcx, rdi
call fcn.14005dcb0
mov rbx, qword [rsp + 0x130]
movzx eax, bp
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0xf0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c8bb0
Capabilities:
Write file on windows

Disassembly:
mov word [rsp + 0x20], r9w
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rsp + 0x78]
movsxd r14, r8d
mov r12, rcx
xor edx, edx
mov rcx, r15
mov r8, r14
mov qword [rsp + 0x58], rsi
mov r13, r14
call fcn.1401c0040
xor ebx, ebx
mov eax, 0x55555556
mov rsi, r15
mov r10d, ebx
imul r14d
mov eax, edx
shr eax, 0x1f
add edx, eax
test edx, edx
jle 0x1400c8ca7
mov r11, qword [rsp + 0x70]
mov qword [rsp + 0x50], rbp
xor r13d, r13d
mov qword [rsp + 0x60], rdi
mov ebp, edx
nop word [rax + rax]
movzx ecx, byte [r11 + 1]
movzx r8d, byte [r11 + 2]
movzx edx, byte [r11]
shl r8d, 8
lea r11, [r11 + 3]
mov ebx, 1
or r8d, ecx
mov ecx, r13d
mov edi, r13d
shl r8d, 8
or r8d, edx
nop dword [rax + rax]
mov eax, 0x2aaaaaab
imul edi
add edi, r14d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
movsxd r9, edx
mov edx, ebx
add ebx, ebx
movzx eax, byte [r9 + rsi]
and edx, r8d
shr edx, cl
add al, al
inc ecx
or dl, al
mov byte [r9 + rsi], dl
cmp ecx, 0x18
jl 0x1400c8c50
inc r10d
cmp r10d, 8
jne 0x1400c8c93
mov r10d, r13d
inc rsi
dec rbp
jne 0x1400c8c20
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov r13, r14
xor ebx, ebx
cmp word [rsp + 0x68], 0
mov rsi, qword [rsp + 0x58]
je 0x1400c8cd5
lea r9, [rsp + 0x68]
mov r8d, r14d
mov rdx, r15
mov rcx, r12
call fcn.140138280
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
mov r9, qword [r12]
mov r8, r13
mov edx, 1
mov rcx, r15
call fcn.1401c24f8
movzx eax, bx
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x1400c9580
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
xor ebp, ebp
mov edi, r8d
mov rbx, rdx
mov r14, rcx
test r8d, r8d
jle 0x1400c9617
mov qword [rsp + 0x40], rsi
mov rcx, r14
call fcn.140066da0
mov r9, qword [r14]
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x50]
movzx esi, ax
call fcn.1401c1e14
test rax, rax
je 0x1400c9610
movzx r8d, si
test r8d, r8d
jle 0x1400c95ef
movzx ecx, word [rsp + 0x50]
movzx r9d, byte [rsp + 0x51]
mov edx, r8d
nop
mov byte [rbx], cl
mov byte [rbx + 1], r9b
add rbx, 2
dec rdx
jne 0x1400c95e0
neg r8d
lea edi, [rdi + r8*2]
test edi, edi
jg 0x1400c95a2
movzx eax, bp
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov eax, 4
jmp 0x1400c95fd
movzx eax, bp
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c9be0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r15d, r15d
mov rdi, r9
movzx esi, r8w
mov rbp, rdx
mov r14, rcx
movzx ebx, r15w
cmp r15w, r8w
jge 0x1400c9c4a
movsx edx, bx
mov r8d, 1
mov rcx, rbp
call fcn.1400629c0
movsx r8, word [rdi + 0x10]
movsxd rdx, dword [rdi + 0x1c]
mov r9, qword [r14]
mov rcx, qword [rdi + 8]
call fcn.1401c24f8
movsx rcx, word [rdi + 0x10]
cmp rax, rcx
jne 0x1400c9c67
inc bx
cmp bx, si
jl 0x1400c9c12
movzx eax, r15w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov eax, 6
jmp 0x1400c9c4e

Function at 0x1400ca5b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.140066da0
mov ecx, 0xdcdc
mov word [rdi], ax
cmp ax, cx
je 0x1400ca5e2
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 2], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 4], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 6], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 8], ax
call fcn.140066da0
mov word [rdi + 0xa], ax
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 0xc], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, rbx
mov byte [rdi + 0xd], al
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0xe], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x10], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x12], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x14], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x14], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x18], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x1a], ax
call fcn.140066b20
lea rcx, [rdi + 0x20]
mov dword [rdi + 0x1c], eax
mov r9, qword [rbx]
mov edx, 0x1e0
mov r8d, 1
call fcn.1401c1e14
mov rcx, qword [rbx]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x1400cd060
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x70
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r9, qword [rcx]
mov rdi, rcx
mov rsi, rdx
mov r15d, 4
lea rcx, [rsp + 0x30]
mov r8d, 1
mov edx, r15d
call fcn.1401c1e14
test rax, rax
jne 0x1400cd0a8
movzx eax, r15w
jmp 0x1400cd280
lea rdx, str.SCMI
lea rcx, [rsp + 0x30]
mov r8, r15
mov qword [rsp + 0x60], r14
call fcn.1401c25f0
test eax, eax
je 0x1400cd0cf
mov eax, 2
jmp 0x1400cd27b
mov r9, qword [rdi]
lea rcx, [rsp + 0x38]
mov r8d, 1
mov rdx, r15
call fcn.1401c1e14
test rax, rax
jne 0x1400cd0f3
movzx eax, r15w
jmp 0x1400cd27b
mov qword [rsp + 0xa0], rbx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x68], r12
mov byte [rsp + 0x3c], 0
call fcn.1401bee6c
xor r12d, r12d
mov dword [rsi], eax
mov r14d, 2
mov dword [rsi + 0x10], r12d
mov r9, qword [rdi]
lea r8d, [r12 + 1]
lea rcx, [rsp + 0x30]
mov edx, r14d
call fcn.1401c1e14
test rax, rax
je 0x1400cd262
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi]
mov edx, 8
lea rcx, [rsp + 0x38]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400cd262
lea rcx, [rsp + 0x38]
mov byte [rsp + 0x40], r12b
call fcn.1401bee6c
lea rdx, [0x14021e054]
lea rcx, [rsp + 0x30]
mov r8, r14
mov ebx, eax
call fcn.1401c25f0
test eax, eax
jne 0x1400cd1e8
mov r9, qword [rdi]
lea edx, [rax + 0xc]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x38]
call fcn.1401c1e14
lea rax, [rsi + 0xc]
lea r9, [rsi + 8]
lea r8, [rsi + 4]
lea rdx, str._d__d__d
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x44], r12b
call fcn.1401be96c
cmp ebx, 0xc
jle 0x1400cd243
lea eax, [rbx - 0xc]
mov rcx, rdi
movsxd rdx, eax
call fcn.140066ff0
jmp 0x1400cd243
lea rdx, [0x14021e058]
lea rcx, [rsp + 0x30]
mov r8, r14
call fcn.1401c25f0
test eax, eax
jne 0x1400cd296
mov dword [rsi + 0x10], 1
mov ebp, r12d
cmp dword [rsi + 0xc], r12d
jle 0x1400cd243
lea rbx, [rsi + 0x15]
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx - 1], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx], al
mov rcx, qword [rdi]
call fcn.1401c3f28
inc ebp
lea rbx, [rbx + 3]
mov byte [rbx - 2], al
cmp ebp, dword [rsi + 0xc]
jl 0x1400cd218
mov r9, qword [rdi]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, r14
call fcn.1401c1e14
test rax, rax
jne 0x1400cd150
movzx eax, r15w
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x70
pop r15
pop rdi
pop rsi
ret
lea rdx, [0x14021e05c]
lea rcx, [rsp + 0x30]
mov r8, r14
call fcn.1401c25f0
test eax, eax
jne 0x1400cd2b4
movzx eax, r12w
jmp 0x1400cd266
movzx eax, r14w
jmp 0x1400cd266
Function at 0x1400cd690
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rbp + 0x47], rax
movzx eax, word [0x14021e070]
movss xmm0, dword [0x14021e088]
movups xmm1, xmmword [str.Created_by_Xnview]
mov r9, qword [rcx]
mov word [rbp - 0x11], ax
movzx eax, word [rdx + 0x50]
movss dword [rbp - 0x25], xmm0
movss xmm0, dword [0x140269a84]
movups xmmword [rbp - 0x21], xmm1
mov word [rbp + 0x33], ax
movzx eax, word [rdx + 0x54]
mov edx, 1
movss dword [rbp + 0x37], xmm0
mov rbx, rcx
lea r8d, [rdx + 3]
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x29], 0x34f68053
mov dword [rbp + 0x2f], 0x54434950
mov word [rbp + 0x35], ax
mov dword [rbp + 0x3b], 3
call fcn.1401c24f8
mov rcx, rbx
movss xmm1, dword [rbp - 0x25]
cvtps2pd xmm1, xmm1
call fcn.140067060
test ax, ax
je 0x1400cd739
xor ecx, ecx
jmp 0x1400cd7ba
mov r9, qword [rbx]
mov edx, 1
lea rcx, [rbp - 0x21]
lea r8d, [rdx + 0x4f]
call fcn.1401c24f8
mov r9, qword [rbx]
mov edx, 1
lea r8d, [rdx + 3]
lea rcx, [rbp + 0x2f]
call fcn.1401c24f8
movzx ecx, word [rbp + 0x33]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rbp + 0x35]
mov rdx, rbx
call fcn.1400671a0
mov rcx, rbx
movss xmm1, dword [rbp + 0x37]
cvtps2pd xmm1, xmm1
call fcn.140067060
test ax, ax
jne 0x1400cd732
movzx ecx, word [rbp + 0x3b]
mov rdx, rbx
call fcn.1400671a0
mov r9, qword [rbx]
mov edx, 1
lea r8d, [rdx + 1]
lea rcx, [rbp + 0x3d]
call fcn.1401c24f8
xor ecx, ecx
cmp rax, 2
sete cl
movzx eax, cx
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rbp
ret

Function at 0x1400cd7e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
test r8w, r8w
mov ebp, 1
setne byte [rax + 0x10]
neg dx
mov rsi, rcx
sbb bl, bl
movzx edi, r8w
lea edx, [rbp + 3]
lea rcx, [rax + 0x10]
and bl, 2
mov r8d, ebp
mov byte [rax + 0x11], 8
mov byte [rax + 0x13], 0xe0
mov byte [rax + 0x12], bl
call fcn.1401c24f8
cmp rax, rbp
je 0x1400cd836
xor eax, eax
jmp 0x1400cd868
test di, di
je 0x1400cd865
mov r9, qword [rsi]
lea rcx, [rsp + 0x38]
mov r8, rbp
mov edx, 4
mov word [rsp + 0x38], 0x800
mov byte [rsp + 0x3a], bl
mov byte [rsp + 0x3b], 0x10
call fcn.1401c24f8
cmp rax, rbp
jne 0x1400cd832
movzx eax, bp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400cecc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
sub rsp, 0x38
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rdx
mov edx, 5
mov r14, r9
mov r9, qword [rcx]
mov rsi, r8
mov rdi, rcx
lea r8d, [rdx - 4]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x1400ced0a
mov eax, 4
jmp 0x1400ced97
lea rdx, str.FAX1D
lea rcx, [rsp + 0x20]
mov r8d, 5
call fcn.1401c25f0
test eax, eax
je 0x1400ced2c
mov eax, 2
jmp 0x1400ced97
mov rcx, rdi
call fcn.140066da0
movzx eax, ax
mov dword [rbx], eax
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov ebx, 0xc8
mov dword [rsi], ebx
mov rcx, qword [rdi]
call fcn.1401c3f28
mov ecx, 0x64
test eax, eax
cmove ebx, ecx
mov dword [r14], ebx
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x38
pop r14
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400cef20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov ebx, edx
mov r14, rcx
mov rdx, rcx
mov ecx, 0x20
mov esi, r9d
mov edi, r8d
call fcn.140067100
mov ebp, 1
mov rdx, r14
mov ecx, ebp
call fcn.140067100
mov rdx, r14
mov ecx, ebx
call fcn.140067100
mov rdx, r14
mov ecx, edi
call fcn.140067100
mov rdx, r14
mov ecx, esi
call fcn.140067100
mov rdx, r14
mov ecx, 0x47504154
call fcn.140067100
mov r9, qword [r14]
lea edx, [rbp + 7]
lea rcx, str.Pattern
mov r8d, ebp
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
movzx eax, bp
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret