joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019dc
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
sub rsp, 0x20
lea rcx, str.winmm.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x0041a220], rax
mov rcx, rax
test rax, rax
jne 0x401a06
lea rcx, str.WinMM_not_available._n
jmp 0x401a29
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.midiOutGetNumDevs
call rbx
mov qword [0x0041a218], rax
test rax, rax
jne 0x401a35
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutGetNumDevs._n
call fcn.0040157c
xor eax, eax
jmp 0x401b24
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutGetDevCapsW
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutGetDevCapsW._n
mov qword [0x0041a210], rax
test rax, rax
je 0x401a29
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutOpen
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutOpen._n
mov qword [0x0041a208], rax
test rax, rax
je 0x401a29
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutShortMsg
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutShortMsg._n
mov qword [0x0041a200], rax
test rax, rax
je 0x401a29
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutLongMsg
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutLongMsg._n
mov qword [0x0041a1f8], rax
test rax, rax
je 0x401a29
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutPrepareHeader
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutPrepareHeader._n
mov qword [0x0041a1f0], rax
test rax, rax
je 0x401a29
mov rcx, qword [0x0041a220]
lea rdx, str.midiOutUnprepareHeader
call rbx
lea rcx, str.GetProcAddress_failed_for_WinMM_midiOutUnprepareHeader._n
mov qword [0x0041a1e8], rax
test rax, rax
je 0x401a29
lea rcx, str.WinMM_FUNCTIONAL_n
call fcn.0040157c
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x401d86
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
lea rdx, [0x004166a0]
mov dword [0x0041a188], r8d
mov qword [0x0041a168], rcx
call sub.msvcrt.dll_fopen
mov qword [0x0041a1a0], rax
test rax, rax
jne 0x401dc0
lea rcx, str.Could_not_open_file_path
add rsp, 0x38
jmp 0x413de8
mov r8d, dword [0x0041a188]
mov qword [rsp + 0x28], rax
mov rcx, r8
mov qword [rsp + 0x20], r8
call sub.msvcrt.dll_malloc
mov r9, qword [rsp + 0x28]
mov r8, qword [rsp + 0x20]
mov edx, 1
mov rcx, rax
mov qword [0x0041a198], rax
call sub.msvcrt.dll_fread
mov rdx, qword [0x0041a170]
add rdx, qword [0x0041a178]
add rdx, rax
mov qword [0x0041a190], rax
mov qword [0x0041a170], rdx
mov edx, dword [0x0041a188]
cmp rdx, rax
setne al
movzx eax, al
mov dword [0x0041a160], eax
add rsp, 0x38
ret
jmp qword [sym.imp.msvcrt.dll_perror]
Function at 0x401e30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
cmp dword [0x0041a160], 0
jne 0x401ec3
mov rdx, qword [0x0041a180]
mov rcx, qword [0x0041a1a0]
mov r8d, 1
add rdx, qword [0x0041a178]
mov qword [0x0041a178], rdx
sub edx, dword [0x0041a170]
call fcn.00404290
mov r9, qword [0x0041a1a0]
mov edx, 1
mov r8d, dword [0x0041a188]
mov rcx, qword [0x0041a198]
call sub.msvcrt.dll_fread
mov rdx, qword [0x0041a178]
mov qword [0x0041a190], rax
add rdx, rax
mov qword [0x0041a170], rdx
mov edx, dword [0x0041a188]
cmp rdx, rax
setne al
movzx eax, al
mov dword [0x0041a160], eax
xor eax, eax
mov qword [0x0041a180], rax
add rsp, 0x28
ret

Function at 0x401ec8
Capabilities:
Read file on windows

Disassembly:
sub rcx, qword [0x0041a178]
cmp rcx, qword [0x0041a190]
mov qword [0x0041a180], rcx
jb 0x401ee4
jmp fcn.00401e30
ret

Function at 0x401f2f
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
mov dword [0x0041a188], ecx
mov rcx, qword [0x0041a198]
call sub.msvcrt.dll_free
mov ecx, ebx
call sub.msvcrt.dll_malloc
mov qword [0x0041a198], rax
add rsp, 0x20
pop rbx
jmp fcn.00401e30

Function at 0x4022bf
Capabilities:
Set console window title

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x170
movaps xmmword [rsp + 0x160], xmm6
call fcn.00401783
movaps xmm6, xmm0
subsd xmm0, qword [0x0041a0f8]
cvttsd2si eax, xmm0
cmp eax, 0xf
jle 0x402435
movaps xmm2, xmm6
subsd xmm2, qword [0x0041a0f0]
cvttsd2si eax, xmm2
cmp eax, 0x3e7
jle 0x40237e
mov eax, dword [0x0041a100]
cvtsd2ss xmm2, xmm2
divss xmm2, dword [0x00416a20]
movss xmm1, dword [0x00416a24]
cmp dword [0x00415028], 0
cvtsi2ss xmm0, rax
divss xmm2, xmm0
divss xmm1, xmm2
je 0x402349
cvtss2sd xmm3, xmm1
lea rcx, str._nFPS:__.10g
movq rdx, xmm3
movaps xmm1, xmm3
jmp 0x402369
movss xmm0, dword [0x00416a28]
comiss xmm0, xmm1
jbe 0x40236e
cvtss2sd xmm4, xmm1
lea rcx, str._nLag_detected__FPS:__.10g
movq rdx, xmm4
movaps xmm1, xmm4
call fcn.0040157c
xor eax, eax
movsd qword [0x0041a0f0], xmm6
mov dword [0x0041a100], eax
lea rbx, [rsp + 0x60]
mov rdx, qword [0x0041a138]
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x40
movsd qword [0x0041a0f8], xmm6
lea rsi, [rsp + 0x2c]
rep stosd dword [rdi], eax
mov rcx, rbx
call sub.msvcrt.dll_strcat
lea rdx, str.__Played_events:
mov rcx, rbx
call sub.msvcrt.dll_strcat
mov r8, qword [0x0041a108]
lea rdx, str._llu
mov rcx, rsi
call fcn.0040164e
mov rcx, rsi
call fcn.0040223d
mov rcx, rbx
mov rsi, rax
mov rdx, rax
call sub.msvcrt.dll_strcat
mov rcx, rsi
lea rsi, [rsp + 0x40]
call sub.msvcrt.dll_free
lea rdx, str.__BPM:
mov rcx, rbx
call sub.msvcrt.dll_strcat
movsd xmm2, qword [0x00415070]
lea rdx, str._.10g
mov rcx, rsi
movq r8, xmm2
call fcn.0040164e
mov rcx, rbx
mov rdx, rsi
call sub.msvcrt.dll_strcat
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
nop
movaps xmm6, xmmword [rsp + 0x160]
add rsp, 0x170
pop rbx
pop rsi
pop rdi
ret
Function at 0x403290
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00413770
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00413770
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x403300
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x0041a304]
test esi, esi
mov rbx, rcx
jle 0x403430
mov rax, qword [0x0041a308]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x40334b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x4033d5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x403330
mov rcx, rbx
call fcn.00403d80
test rax, rax
mov rdi, rax
je 0x403452
mov rax, qword [0x0041a308]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.00403ec0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x0041a308]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x403437
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4033ce
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x4033e0
add dword [0x0041a304], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov r8d, 0x40
mov eax, 4
mov rcx, qword [rsp + 0x20]
cmove r8d, eax
mov rdx, qword [rsp + 0x38]
add rbx, qword [0x0041a308]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4033ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00403290
nop dword [rax]
xor esi, esi
jmp 0x403358
mov rax, qword [0x0041a308]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [rdi + 8]
mov r8, qword [rax + rbx + 0x18]
call fcn.00403290
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00403290
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x4039f0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x0041a360]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0041a340]
test rbx, rbx
je 0x403a4c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x403a43
test eax, eax
jne 0x403a43
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x403a28
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x403d80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x004177e0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x403da0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x403da8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x403da0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x403dfd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403df4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x403da0
add rax, 0x28
cmp rax, r9
jne 0x403de0
xor eax, eax
ret

Function at 0x403e00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004177e0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x403e1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x403e28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x403e1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x403ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x004177e0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x403edf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x403ee8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x180002a40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180002a76
xor eax, eax
lea r8, [0x180002790]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180002a76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140040f80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
lea rdi, [rcx + 0x20]
movups xmm0, xmmword [rdx + 0x40]
movaps xmmword [rbp - 0x20], xmm0
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movups xmm2, xmmword [rdx + 0x20]
movups xmm3, xmmword [rdx + 0x30]
movaps xmmword [rbp - 0x30], xmm3
movaps xmmword [rbp - 0x40], xmm2
movaps xmmword [rbp - 0x50], xmm1
movaps xmmword [rbp - 0x60], xmm0
lea rsi, [rbp - 0x30]
mov qword [rbp - 8], 2
lea r14, [rbp + 1]
mov qword [rbp + 0x20], rcx
lea rbx, [rcx + 0x38]
xor r12d, r12d
jmp 0x14004101e
mov rdx, qword [rbp + 0x20]
mov rax, qword [rdx + 0x40]
mov rcx, r12
shl rcx, 5
movups xmm0, xmmword [rbp]
movups xmm1, xmmword [rbp + 0x10]
movups xmmword [rax + rcx + 0x10], xmm1
movups xmmword [rax + rcx], xmm0
inc r12
mov qword [rdx + 0x48], r12
add rsi, 0x28
mov r12, r15
cmp r12, 2
je 0x1400410db
lea r15, [r12 + 1]
mov qword [rbp - 0x10], r15
lea rcx, [r12 + r12*4]
movzx eax, byte [rbp + rcx*8 - 0x58]
cmp al, 7
je 0x1400410ab
lea rdx, [rcx*8 - 0x60]
add rdx, rbp
movzx r12d, byte [rbp + rcx*8 - 0x60]
mov byte [rbp], al
movups xmm0, xmmword [rdx + 9]
movups xmm1, xmmword [rdx + 0x18]
movups xmmword [r14 + 0xf], xmm1
movups xmmword [r14], xmm0
mov rax, qword [rbp + 0x20]
mov r13, qword [rax + 0x30]
cmp r13, qword [rax + 0x20]
jne 0x14004107d
mov byte [rbp + 0x2f], 1
mov rcx, rdi
call fcn.14000bc40
mov rcx, qword [rbp + 0x20]
mov rax, qword [rcx + 0x28]
mov byte [rax + r13], r12b
inc r13
mov qword [rcx + 0x30], r13
mov r12, qword [rcx + 0x48]
cmp r12, qword [rcx + 0x38]
jne 0x140040ff0
mov rcx, rbx
call fcn.14000b910
jmp 0x140040ff0
cmp r15, 2
je 0x1400410db
mov edi, 1
nop word cs:[rax + rax]
mov rcx, rsi
call fcn.140024940
mov rax, rdi
xor rax, r12
add rsi, 0x28
inc rdi
cmp rax, 1
jne 0x1400410c0
mov rax, qword [rbp + 0x20]
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x140056f50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x3f8
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x360], xmm6
mov qword [rbp + 0x358], 0xfffffffffffffffe
mov rdi, rdx
mov qword [rbp + 0x318], rcx
mov r14, qword [rcx + 0x18]
mov qword [rbp + 0x160], 0
mov qword [rbp + 0x168], 8
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], 8
mov qword [rbp + 0x188], 0
mov rbx, qword [r8 + 0x48]
mov rax, qword [r8 + 0x50]
mov qword [rbp + 0x2d0], rax
shl rax, 4
mov qword [rbp - 0x40], rax
add rax, rbx
mov qword [rbp + 0x2c8], rax
mov r12, qword [r8 + 0x60]
mov qword [rbp + 0x58], r8
mov rax, qword [r8 + 0x68]
mov qword [rbp + 0x2d8], rax
imul rax, rax, 0x68
mov qword [rbp - 0x38], rax
add rax, r12
mov qword [rbp + 0x150], rax
xor r13d, r13d
mov qword [rbp + 0x300], r12
mov qword [rbp + 0x340], rbx
Function at 0x140092570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r10, qword [rdx + 0x20]
mov rdi, qword [rdx + 0x28]
lea rsi, [rdi + 1]
mov qword [rdx + 0x28], rsi
cmp rsi, r10
jae 0x140092753
mov byte [rsp + 0x2f], r8b
mov r8d, dword [rsp + 0xb0]
movabs rbx, 0x1999999999999998
lea ebp, [rdi + 1]
mov eax, ebp
sub eax, r10d
add rsi, qword [rdx + 0x18]
mov r15, rdi
sub r15, r10
inc r15
xor r14d, r14d
lea r12, [rbx + 1]
jmp 0x1400925f3
movzx r11d, r11b
lea r13, [rdi + r14]
add r13, 2
mov qword [rdx + 0x28], r13
lea r9, [r9 + r9*4]
lea r9, [r11 + r9*2]
inc r14
mov r11, r15
add r11, r14
je 0x140092657
movzx r13d, byte [rsi + r14]
lea r11d, [r13 - 0x30]
cmp r11b, 0xa
jae 0x14009262a
cmp r9, rbx
jbe 0x1400925d0
cmp r9, r12
jne 0x140092612
cmp r11b, 5
jbe 0x1400925d0
sub r8d, r14d
mov dword [rsp + 0x20], r8d
movzx r8d, byte [rsp + 0x2f]
call fcn.1400f2540
jmp 0x14009272e
test r14d, r14d
je 0x14009274c
mov eax, r8d
sub rax, r14
or r13d, 0x20
cmp r13d, 0x65
jne 0x140092663
mov dword [rsp + 0x20], eax
movzx r8d, byte [rsp + 0x2f]
call fcn.140092d10
jmp 0x14009272e
cmp ebp, r10d
je 0x140092763
add eax, r8d
movq xmm1, r9
punpckldq xmm1, xmmword [0x1400fc330]
subpd xmm1, xmmword [0x1400fc340]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov r9d, eax
neg r9d
cmovs r9d, eax
cmp r9d, 0x135
jb 0x1400926dc
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400fe430]
nop word cs:[rax + rax]
ucomisd xmm0, xmm1
jne 0x1400926b8
jnp 0x140092715
test eax, eax
jns 0x14009278c
divsd xmm0, xmm2
add eax, 0x134
mov r9d, eax
neg r9d
cmovs r9d, eax
cmp r9d, 0x135
jae 0x1400926b0
mov r8d, r9d
mov r9, qword [section..data]
movsd xmm1, qword [r9 + r8*8]
test eax, eax
js 0x14009273f
mulsd xmm0, xmm1
movq rax, xmm0
movabs r8, 0x7fffffffffffffff
and r8, rax
movabs rax, 0x7ff0000000000000
cmp r8, rax
je 0x14009278c
cmp byte [rsp + 0x2f], 0
jne 0x140092724
xorpd xmm0, xmmword [0x1400fe440]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
divsd xmm0, xmm1
cmp byte [rsp + 0x2f], 0
je 0x14009271c
jmp 0x140092724
lea rsi, [rdi + r14]
inc rsi
cmp rsi, r10
jae 0x140092763
mov qword [rsp + 0x30], 0xd
jmp 0x14009276c
mov qword [rsp + 0x30], 5
lea rax, [rsp + 0x30]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1400f2050
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x14009272e
mov qword [rsp + 0x30], 0xe
lea rax, [rsp + 0x30]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1400f2730
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
jmp 0x14009272e
Function at 0x140092d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, qword [rdx + 0x20]
mov r11, qword [rdx + 0x28]
lea r10, [r11 + 1]
mov qword [rdx + 0x28], r10
mov al, 1
cmp r10, rsi
jae 0x140092d50
mov rax, qword [rdx + 0x18]
movzx edi, byte [rax + r10]
mov al, 1
cmp edi, 0x2b
je 0x140092d45
cmp edi, 0x2d
jne 0x140092d50
xor eax, eax
add r11, 2
mov qword [rdx + 0x28], r11
mov r10, r11
cmp r10, rsi
jae 0x140092eef
mov rdi, qword [rdx + 0x18]
movzx r11d, byte [rdi + r10]
lea rbx, [r10 + 1]
mov qword [rdx + 0x28], rbx
add r11b, 0xd0
cmp r11b, 0xa
jae 0x140092efa
movzx r11d, r11b
cmp rbx, rsi
jae 0x140092ded
add r10, 2
mov ebx, 1
sub rbx, rsi
jmp 0x140092dac
movzx esi, sil
lea r11d, [r11 + r11*4]
lea r11d, [rsi + r11*2]
lea rsi, [rbx + r10]
inc rsi
inc r10
cmp rsi, 2
je 0x140092ded
movzx esi, byte [rdi + r10 - 1]
add sil, 0xd0
cmp sil, 0xa
jae 0x140092ded
mov qword [rdx + 0x28], r10
cmp r11d, 0xccccccb
jle 0x140092d90
cmp r11d, 0xccccccc
jne 0x140092dd8
cmp sil, 7
jbe 0x140092d90
test r9, r9
sete r9b
mov byte [rsp + 0x20], al
call fcn.1400f2690
jmp 0x140092edc
mov r10d, dword [rsp + 0x80]
test al, al
je 0x140092e0a
lea eax, [r10 + r11]
sar eax, 0x1f
add eax, 0x80000000
add r10d, r11d
jmp 0x140092e1a
xor eax, eax
cmp r10d, r11d
setns al
add eax, 0x7fffffff
sub r10d, r11d
cmovo r10d, eax
movq xmm1, r9
punpckldq xmm1, xmmword [0x1400fc330]
subpd xmm1, xmmword [0x1400fc340]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jb 0x140092e8c
xorpd xmm1, xmm1
movsd xmm2, qword [0x1400fe430]
nop dword [rax + rax]
ucomisd xmm0, xmm1
jne 0x140092e68
jnp 0x140092ec5
test r10d, r10d
jns 0x140092f23
divsd xmm0, xmm2
add r10d, 0x134
mov eax, r10d
neg eax
cmovs eax, r10d
cmp eax, 0x135
jae 0x140092e60
mov eax, eax
mov r9, qword [section..data]
movsd xmm1, qword [r9 + rax*8]
test r10d, r10d
js 0x140092ee4
mulsd xmm0, xmm1
movq rax, xmm0
movabs r9, 0x7fffffffffffffff
and r9, rax
movabs rax, 0x7ff0000000000000
cmp r9, rax
je 0x140092f23
test r8b, r8b
jne 0x140092ed2
xorpd xmm0, xmmword [0x1400fe440]
movsd qword [rcx + 8], xmm0
xor eax, eax
mov qword [rcx], rax
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
divsd xmm0, xmm1
test r8b, r8b
je 0x140092eca
jmp 0x140092ed2
mov qword [rsp + 0x28], 5
jmp 0x140092f03
mov qword [rsp + 0x28], 0xd
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1400f2730
mov qword [rsi + 8], rax
mov qword [rsi], 1
jmp 0x140092edc
mov qword [rsp + 0x28], 0xe
lea rax, [rsp + 0x28]
mov rsi, rcx
mov rcx, rdx
mov rdx, rax
call fcn.1400f2730
mov rcx, rsi
mov qword [rsi + 8], rax
mov eax, 1
jmp 0x140092ed9
Function at 0x1400b8d00
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x1400b8da0
jmp 0x1400b8d8f
jae 0x1400b8e6e
cmp r8, 0x201
jae 0x1400b8da0
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x1400b8e06
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x1400b8dde
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1400f35c0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400b8e2f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400b8eda
mov r8d, r13d
cmp r12, r8
jne 0x1400b8d80
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400b8f0e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400b8d8f
jmp 0x1400b8da0
cmp r14, r8
jb 0x1400b8f28
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.1400bd0a0
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x1400b8ec3
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400227d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x1400b8eae
jmp 0x1400b8ec3
lea rcx, [0x140105078]
lea r8, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400f4850
jmp 0x1400b8f3d
lea rax, str.std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.1400f4c20
ud2
Function at 0x1400c1220
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x10c8
call fcn.1400e31c0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1030], xmm6
mov qword [rbp + 0x1028], 0xfffffffffffffffe
mov rsi, rdx
mov qword [rbp + 0x1020], rcx
mov qword [rbp + 0xfd8], rcx
mov qword [rbp + 0xfe0], rdx
lea rcx, [rbp - 0x50]
mov r8d, 0x1000
xor edx, edx
call fcn.1400f1600
xorps xmm6, xmm6
lea rbx, [0x1400c7ce0]
lea r12, [rbp + 0xfb0]
mov rdi, qword [sym.imp.KERNEL32.dll_WriteFileEx]
mov r15, qword [sym.imp.KERNEL32.dll_SleepEx]
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
mov r8d, 0x1000
lea rcx, [rbp + 0xfd8]
lea rdx, [rbp - 0x50]
call fcn.1400c7c00
mov r14, rdx
test rax, rax
jne 0x1400c13bc
test r14, r14
je 0x1400c138c
cmp r14, 0x1000
ja 0x1400c1460
xor r13d, r13d
nop dword [rax + rax]
cmp r13, r14
ja 0x1400c1437
mov r8d, r14d
sub r8d, r13d
lea rdx, [r13 - 0x50]
add rdx, rbp
mov dword [rbp + 0xff4], 0
movaps xmmword [rbp + 0xfb0], xmm6
mov qword [rbp + 0xfc0], 0
lea rax, [rbp + 0xff4]
mov qword [rbp + 0xfc8], rax
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov r9, r12
call rdi
test eax, eax
je 0x1400c1386
nop word cs:[rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r15
cmp dword [rbp + 0xff4], 1
jne 0x1400c1350
cmp dword [rbp + 0xff8], 0
jne 0x1400c138c
mov eax, dword [rbp + 0xffc]
add r13, rax
cmp r13, r14
jne 0x1400c12f0
jmp 0x1400c129b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1020]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1030]
add rsp, 0x10c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, r14d
and eax, 3
cmp eax, 1
jne 0x1400c138c
mov rax, r14
dec rax
mov qword [rbp + 0xfe8], rax
mov rax, qword [r14 - 1]
mov qword [rbp + 0x1000], rax
mov rax, qword [r14 + 7]
mov qword [rbp + 0x1008], rax
mov rax, qword [rax]
test rax, rax
je 0x1400c13fb
mov rcx, qword [rbp + 0x1000]
call rax
mov rcx, qword [rbp + 0x1000]
mov rax, qword [rbp + 0x1008]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400c141b
mov r8, qword [rax + 0x10]
call fcn.1400227d0
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp + 0xfe8]
call fcn.1400227d0
jmp 0x1400c138c
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov rcx, r13
mov rdx, r14
call fcn.1400f4c90
jmp 0x1400c1489
mov qword [rbp + 0x1018], rsi
mov rax, qword [rbp + 0x1020]
mov qword [rbp + 0x1010], rax
lea r8, str.std_src_syspalwindowspipe.rs
mov edx, 0x1000
mov rcx, r14
call fcn.1400f4c20
ud2