joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010060
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [0x14009fcb0]
mov r11d, dword [rsi]
mov rbx, rcx
test r11d, r11d
jne 0x140010098
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140010100
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x140010110
mov esi, dword [0x1400c02e8]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edi, eax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, edi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test rsi, rsi
je 0x140010168
mov rbp, qword [rsi]
cmp rbp, r12
jb 0x1400101b0
sub r12, 1
mov rax, qword [rsi + r12*8 + 8]
test rax, rax
jne 0x140010087
mov rcx, rbx
call dbg.emutls_alloc
mov qword [rsi + r12*8 + 8], rax
jmp 0x140010087
call dbg.emutls_alloc
mov qword [rbx + 0x10], rax
jmp 0x140010087
mov r10d, dword [rsi]
test r10d, r10d
je 0x140010241
mov r9d, dword [global_once]
test r9d, r9d
je 0x140010269
lea rcx, [0x1400c0300]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r12, qword [rbx + 0x10]
test r12, r12
je 0x14001024e
mov eax, dword [rsi]
test eax, eax
je 0x1400100a1
lea rcx, [0x1400c0300]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1400100a1
lea rcx, [r12 + 0x21]
mov edx, 8
call sym.calloc
lea rdi, [r12 + 0x20]
test rax, rax
mov rsi, rax
je 0x1400102a4
mov qword [rax], rdi
mov ecx, dword [0x1400c02e8]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x1400100db
call r13
jmp 0x1400100db
lea rdi, [rbp + rbp]
mov rcx, rsi
lea rax, [r12 + 0x20]
cmp rdi, r12
cmovb rdi, rax
lea rdx, [rdi*8 + 8]
call sym.realloc
test rax, rax
mov rsi, rax
je 0x1400102a4
mov qword [rax], rdi
lea rcx, [rax + rbp*8 + 8]
sub rdi, rbp
xor edx, edx
lea r8, [rdi*8]
call sym.memset
jmp 0x14001018b
lea rcx, [0x1400c0300]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14001029c
lea rdx, [dbg.emutls_destroy]
mov ecx, eax
mov dword [0x1400c02e8], eax
call sym.__mingwthr_key_dtor
test eax, eax
jne 0x1400102a4
mov dword [global_once], 1
mov edx, dword [rsi]
test edx, edx
jne 0x14001012c
mov r12, qword [rbx + 0x10]
test r12, r12
jne 0x1400100a1
mov rax, qword [0x1400c02e0]
lea r12, [rax + 1]
mov qword [0x1400c02e0], r12
mov qword [rbx + 0x10], r12
jmp 0x140010146
lock add dword [0x140099054], 1
je 0x1400101f9
mov r8d, dword [global_once]
lea rdi, [0x140099050]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
test r8d, r8d
jne 0x140010237
nop dword [rax]
xor ecx, ecx
call rbp
mov ecx, dword [rdi]
test ecx, ecx
je 0x140010290
jmp 0x140010237
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140010229
call sym.abort
nop
nop word [rax + rax]
Function at 0x140018a40
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
lea rcx, str.msvcrt.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rsi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.rand_s
mov rcx, rax
call rsi
test rax, rax
je 0x140018a88
mov rcx, rbx
mov qword [sym.init_rand_s], rax
add rsp, 0x28
pop rbx
pop rsi
jmp rax
lea rcx, str.advapi32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.SystemFunction036
mov rcx, rax
call rsi
mov qword [0x1400c0e20], rax
lea rax, [sym.mingw_rand_s]
jmp 0x140018a6e

Function at 0x14001a9b0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x14009af40], 0
jne 0x14001aab6
mov byte [0x14009af40], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x14001aa8c
mov rbx, qword [rax + 8]
lea r9, [rsp + 0x2c]
xor eax, eax
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
mov r8d, 0x30
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x14001aa7d
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x14009b841]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x14001aa78
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x14001aa47
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x14001ab4b
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x14001aab1
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x14001aab1
Function at 0x14007a280
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
test rax, rax
mov rdi, rcx
je 0x14007a2a8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
lea rsi, [rsp + 0x2c]
mov ebx, 4
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x14007a2f0
cdqe
add rsi, rax
sub rbx, rax
jne 0x14007a2c0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14007a2fc
call rbp
cmp dword [rax], 4
je 0x14007a2c0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x140097380
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14009af60]
jmp dbg.__emutls_get_address

Function at 0x140097390
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x14009af60]
jmp dbg.__emutls_get_address
Function at 0x140097b30
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rax, qword [0x14009fcb0]
mov r8d, dword [rax]
test r8d, r8d
jne 0x140097cc8
lea rcx, str.GLIBCXX_TUNABLES
pxor xmm0, xmm0
mov qword [0x140099798], 0
movabs rdi, 0x2e78786362696c67
movups xmmword [0x140099788], xmm0
movabs r12, 0x6c6f6f705f68652e
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
mov dword [rsp + 0x58], 0x100
lea rax, str.obj_size
test rbx, rbx
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
jne 0x140097be5
jmp 0x140097c92
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
test rax, rax
mov rbx, rax
je 0x140097c40
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x140097bd0
cmp qword [rbx + 7], r12
jne 0x140097bd0
cmp byte [rbx + 0xf], 0x2e
jne 0x140097bd0
lea rbp, [rsp + 0x30]
add rbx, 0x10
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x140097c2b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x140097c35
cmp byte [rbx + rsi], 0x3d
je 0x140097cd9
add rbp, 0x18
cmp rbp, r13
jne 0x140097c0f
jmp 0x140097bd0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
test rbx, rbx
mov qword [0x140099798], rbx
jne 0x140097ca2
lea rcx, [sym.__tcf_0_1]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x140099798], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
test rax, rax
mov qword [0x140099790], rax
je 0x140097d10
xor edx, edx
mov qword [0x140099788], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x140097c7a
lea rcx, [0x140099760]
call dbg.__gthr_win32_mutex_init_function
jmp 0x140097b4f
lea rdx, [rsp + 0x28]
xor r8d, r8d
lea rcx, [rbx + rsi + 1]
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x140097d00
test dl, dl
jne 0x140097bd0
test eax, eax
js 0x140097bd0
mov dword [rbp + 0x10], eax
jmp 0x140097bd0
xor ecx, ecx
mov qword [0x140099798], rcx
jmp 0x140097c7a
Function at 0x140003150
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x1400031ad
lea rbx, [0x140044bf0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003194
cmp r10, 2
jb 0x140003194
cmp byte [r9], r8b
jne 0x140003194
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003170
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400031ef
lea rbx, [0x140044bf0]
cmp r8b, 0x23
jne 0x1400031d3
cmp byte [r9], r8b
jne 0x1400031d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x1400031c0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400033b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1400033df
mov r8d, 0x78d
lea rdx, str.C:UsersZIPDownloadsLoader_mainLoader_mainimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rsi, rsi
je 0x1400033eb
mov qword [rsi], 0
lea rdx, [0x140044438]
mov rcx, rbx
call fcn.140003200
mov rbx, rax
test rax, rax
jne 0x14000340d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400034f8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400034f8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400034f8
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400034f8
cmp rdi, 0xffffffffffffffff
je 0x1400034f8
mov rax, qword [0x145e8bab0]
test rax, rax
je 0x140003489
inc dword [rax + 0xf4]
mov rdx, qword [0x145e8baa0]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbp, rax
test rax, rax
je 0x1400034f8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400034e5
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x145e8bab0]
test rax, rax
je 0x1400034d4
dec dword [rax + 0xf4]
mov rdx, qword [0x145e8baa0]
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140003501
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x1400034f3
mov qword [rsi], rdi
mov rax, rbp
jmp 0x140003503
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140006410
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0xe8]
mov rbx, rcx
movsxd rdi, edx
test eax, eax
jg 0x14000644e
mov r8d, 0x704
lea rdx, str.C:UsersZIPDownloadsLoader_mainLoader_mainimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0xe8]
movsxd rcx, eax
lea rdx, [0x140044bf0]
mov rax, qword [rbx + 0xf0]
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dil
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x39]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [rdx + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [rdx + rcx*4]
mov rcx, qword [0x145e8bab0]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x1400064c8
mov r8, rdi
mov edx, 4
mov ecx, ebx
call fcn.14001ba00
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140014ac0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x145e8bab0]
mov edi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140014b12
cmp byte [rbx + 0x4a5e], 0
jne 0x140014b12
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002fe0
test dil, 1
je 0x140014c38
jmp 0x140014b9b
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14004be04]
xor eax, eax
mulss xmm1, dword [0x14004bdf4]
addss xmm0, dword [rbx + 0xdfc]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0xe00]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mulss xmm0, dword [0x14004bd88]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.140002fe0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140014bf0
lea r11, [0x140044bf0]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x140014bd3
cmp byte [r8], r9b
jne 0x140014bd3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140014bc0
not ecx
call fcn.14000a880
test rax, rax
je 0x140014c38
cmp byte [rax + 0xae], 0
je 0x140014c38
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, 0x10
movsx r9d, word [rbx + 0x5b5a]
call fcn.140002fe0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d310
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14001a070
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c40], 0
lea rbx, [rcx + 0x5c48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001a117
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001a0ca
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001c7c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003890
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c40]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c50]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x145e8baa8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001a11f
mov rcx, rbx
call fcn.140003890
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a7e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x145e8bab0]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001a844
lea r10, [0x140044bf0]
cmp r8b, 0x23
jne 0x14001a827
cmp byte [rdx], r8b
jne 0x14001a827
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001a814
mov eax, dword [r14 + 0x5bb8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001a8a5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001a86a
cmp edi, eax
jl 0x14001a884
mov r8d, 0x6fb
lea rdx, str.C:UsersZIPDownloadsLoader_mainLoader_mainimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5bc0]
cmp dword [rdx + rbp + 8], ebx
je 0x14001a8c2
mov eax, dword [r14 + 0x5bb8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001a861
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001a8cf
cmp edi, dword [r14 + 0x5bb8]
jl 0x14001a8f0
mov r8d, 0x6fb
lea rdx, str.C:UsersZIPDownloadsLoader_mainLoader_mainimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rdx, qword [r14 + 0x5bc0]
movsxd rax, edi
lea rcx, [rax + rax*8]
lea rax, [rdx + rcx*8]
jmp 0x14001a8a7
Function at 0x14003a760
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
mov r8, rcx
mov dword [rsp + 0x28], 1
xor ecx, ecx
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
add rsp, 0x38
ret

Function at 0x14003a790
Capabilities:
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
movsxd rdi, dword [0x145e8bb54]
lea rax, [0x143a2d680]
mov qword [rbp + 0x17], rax
lea rax, [0x14224f9e0]
mov qword [rbp + 0x1f], rax
lea rax, [0x14007c1a0]
mov qword [rbp + 0x27], rax
lea rax, [0x141c4f3e0]
mov qword [rbp + 0x2f], rax
lea rax, [0x140049250]
mov qword [rbp + 0x37], rax
lea rax, [0x144330930]
mov qword [rbp + 0x3f], rax
lea rax, [0x1417dcfa0]
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x14004bfd0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x20
mov dword [rbp - 0x15], 0x1b5a400
mov dword [rbp - 0x11], 0x44a600
lea eax, [rdi - 1]
cmp eax, 6
ja 0x14003a96c
xor eax, eax
mov qword [rbp - 9], rax
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], al
lea r8d, [rax + 0xe]
lea rdx, str..productsion_
lea rcx, [rbp - 9]
call fcn.14003cde0
nop
mov rcx, qword [rbp + 7]
mov rdx, qword [rbp + 0xf]
mov rax, rdx
sub rax, rcx
cmp rax, 0xb
jb 0x14003a89a
lea rax, [rcx + 0xb]
mov qword [rbp + 7], rax
lea rbx, [rbp - 9]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 9]
add rbx, rcx
mov r8d, 0xb
lea rdx, str.dowload.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xb], 0
jmp 0x14003a8b1
mov qword [rsp + 0x20], 0xb
mov edx, 0xb
lea rcx, [rbp - 9]
call fcn.14003cf40
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 0x10
cmovae rcx, qword [rbp - 9]
lea rdx, [0x14004bb2c]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov rbx, rax
test rax, rax
je 0x14003a90f
movsxd r8, dword [rbp + rdi*4 - 0x2d]
mov r9, rax
mov edx, 1
mov rcx, qword [rbp + rdi*8 + 0xf]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp - 9]
call fcn.14003cd70
mov rcx, rax
call fcn.14003a760
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_write_the_file_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14003a988
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a965
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a965
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003d198
jmp 0x14003a988
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Invalid_product_number_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140002b20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
movsxd rdx, dword [rdx]
mov rcx, qword [rdi + 0x18]
mov rcx, qword [rcx + 0x40]
call fcn.14003d540
mov rdx, rax
mov rcx, qword [rdi + 0x10]
test byte [rax + 8], 0xf
jne 0x140002b50
mov byte [rcx + 8], 0
jmp 0x140002b5d
mov rax, qword [rax]
mov qword [rcx], rax
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
add qword [rdi + 0x10], 0x10
mov edx, 0xffffffff
mov rcx, rdi
call fcn.1400115a0
mov rbx, rax
mov edx, 0xfffffffe
mov rcx, rdi
call fcn.140010fd0
nop
movzx r8d, bl
movabs rax, 0xcbf29ce484222325
xor r8, rax
movabs r9, 0x100000001b3
imul r8, r9
mov rcx, rbx
shr rcx, 8
movzx edx, cl
xor r8, rdx
imul r8, r9
mov rax, rbx
shr rax, 0x10
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x18
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x20
movzx ecx, al
xor r8, rcx
imul r8, r9
mov rax, rbx
shr rax, 0x28
movzx eax, al
xor rax, r8
imul rax, r9
mov rcx, rbx
shr rcx, 0x30
movzx edx, cl
xor rax, rdx
imul rax, r9
shr rbx, 0x38
xor rax, rbx
imul rax, r9
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret