joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400cf790
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x38
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x90]
mov rsi, rcx
mov rcx, qword [rcx]
mov rdi, r9
mov r14, r8
mov rbp, rdx
call fcn.1401c3f28
cmp eax, 1
je 0x1400cf7d7
mov eax, 2
jmp 0x1400cf8c4
mov rcx, qword [rsi]
call fcn.1401c3f28
test eax, eax
jne 0x1400cf7cd
mov rcx, qword [rsi]
mov qword [rsp + 0x30], r12
call fcn.1401c3f28
mov r12d, 1
mov ebx, 2
cmp eax, r12d
jne 0x1400cf806
mov word [rdi], r12w
jmp 0x1400cf809
mov word [rdi], bx
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r12
mov edx, 3
call fcn.1401c1e14
test rax, rax
jne 0x1400cf82d
mov eax, 4
jmp 0x1400cf8bf
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x23], 0
call fcn.1401bee6c
mov edi, 4
lea rcx, [rsp + 0x20]
mov dword [r15], eax
mov r9, qword [rsi]
mov r8, r12
mov edx, edi
call fcn.1401c1e14
test rax, rax
je 0x1400cf885
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x24], 0
call fcn.1401bee6c
lea edx, [rdi + 1]
lea rcx, [rsp + 0x20]
mov dword [rbp], eax
mov r9, qword [rsi]
mov r8, r12
call fcn.1401c1e14
test rax, rax
jne 0x1400cf88a
movzx eax, di
jmp 0x1400cf8bf
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x25], 0
call fcn.1401bee6c
mov dword [r14], eax
mov rcx, qword [rsi]
call fcn.1401c3f28
mov rcx, qword [rsi]
call fcn.1401c3f28
mov rcx, qword [rsi]
call fcn.1401c3f28
cmp eax, ebx
je 0x1400cf8bd
movzx eax, bx
jmp 0x1400cf8bf
xor eax, eax
mov r12, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400d0170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 6
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 5]
call fcn.1401c1e14
test rax, rax
jne 0x1400d01b4
mov eax, 4
jmp 0x1400d0250
lea rdx, str.mhwanh
lea rcx, [rsp + 0x20]
mov r8d, 6
call fcn.1401c25f0
test eax, eax
je 0x1400d01d6
mov eax, 2
jmp 0x1400d0250
mov rcx, rbx
call fcn.140066de0
mov rcx, rbx
mov word [rdi], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 2], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 4], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 6], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 8], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 0xa], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 0xc], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 0xe], ax
call fcn.140066de0
mov edx, 8
mov rcx, rbx
mov word [rdi + 0x10], ax
call fcn.140066ff0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d0310
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov r14, rcx
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.140061e90
mov eax, dword [0x14021e178]
xor ebx, ebx
movups xmm0, xmmword [str.Palm_Pilot_Bitmap_file]
cmp word [rdi + 0x48], 2
mov dword [rsp + 0x70], eax
movzx eax, word [0x14021e17c]
movaps xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x74], ax
movzx eax, byte [0x14021e17e]
mov edx, 0x10000
mov byte [rsp + 0x76], al
mov eax, ebx
lea ebp, [rbx + 4]
cmove eax, edx
lea r15d, [rbx + 1]
mov dword [rsp + 0x30], eax
jne 0x1400d039b
cmp word [rdi + 0x58], bp
mov eax, 2
cmovg ax, bp
jmp 0x1400d039f
movzx eax, r15w
mov rcx, qword [r14 + 0x100]
mov word [rsp + 0x42], ax
cwde
imul eax, dword [rdi + 0x50]
add eax, 7
mov word [rsp + 0x40], r15w
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [rsp + 0x4c], eax
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400d03d0
lea rdx, [rsp + 0xe0]
mov rcx, r14
call fcn.1400d0510
test ax, ax
jne 0x1400d04e4
mov rcx, r14
call fcn.1400d07b0
test ax, ax
jne 0x1400d04e4
movzx r9d, word [rsp + 0x42]
mov r8d, dword [rdi + 0x54]
mov edx, dword [rdi + 0x50]
lea rax, [rsp + 0xe0]
mov rcx, r14
mov qword [rsp + 0x28], rax
mov word [rsp + 0x20], bx
call fcn.1400d0660
test ax, ax
jne 0x1400d04e4
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x330], rsi
call fcn.14005fe70
movzx esi, ax
test ax, ax
jne 0x1400d04d9
cmp word [rdi + 0x48], 2
jne 0x1400d0494
cmp dword [rdi + 0x54], ebx
jle 0x1400d04d1
mov r8d, r15d
mov edx, ebx
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rsp + 0x4c]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x38]
mov r8, r15
call fcn.1401c24f8
cmp rax, r15
je 0x1400d048b
mov esi, ebp
inc ebx
cmp ebx, dword [rdi + 0x54]
jl 0x1400d0462
jmp 0x1400d04d1
cmp dword [rdi + 0x54], ebx
jle 0x1400d04d1
nop dword [rax]
mov r8d, r15d
mov edx, ebx
mov rcx, rdi
call fcn.1400629c0
movsxd rdx, dword [rsp + 0x4c]
mov r9, qword [r14]
mov rcx, qword [rsp + 0x38]
mov r8, r15
call fcn.1401c24f8
cmp rax, r15
je 0x1400d04ca
movzx esi, bp
inc ebx
cmp ebx, dword [rdi + 0x54]
jl 0x1400d04a0
mov rcx, rdi
call fcn.14005dcb0
movzx eax, si
mov rsi, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x2f0
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400d0510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
lea rdx, str.test.pdb
lea rcx, [rsp + 0x20]
mov r8d, 0x1f
call fcn.1401beb90
mov r9, qword [rbx]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x3f], 0
call fcn.1401c24f8
cmp rax, 1
je 0x1400d056e
mov eax, 4
jmp 0x1400d063a
xor ecx, ecx
mov rdx, rbx
call fcn.1400671a0
xor ecx, ecx
mov rdx, rbx
call fcn.1400671a0
xor ecx, ecx
call fcn.1401bf51c
mov rdx, rbx
lea ecx, [rax + 0x7c25b080]
call fcn.140067100
xor ecx, ecx
call fcn.1401bf51c
mov rdx, rbx
lea ecx, [rax + 0x7c25b080]
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov r9, qword [rbx]
mov edi, 4
lea r8d, [rdi - 3]
lea rcx, str.vIMG
mov edx, edi
call fcn.1401c24f8
cmp rax, 1
je 0x1400d05f9
movzx eax, di
jmp 0x1400d063a
mov r9, qword [rbx]
lea rcx, str.View
mov r8d, 1
mov rdx, rdi
call fcn.1401c24f8
cmp rax, 1
jne 0x1400d05f4
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov ecx, 1
mov rdx, rbx
call fcn.1400671a0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x1400d0660
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x58
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ebp, edx
mov rbx, rcx
mov r14d, r8d
lea rdx, str.test.pdb
lea rcx, [rsp + 0x20]
mov r8d, 0x1f
movzx esi, r9w
call fcn.1401beb90
mov r9, qword [rbx]
mov edx, 0x20
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x3f], 0
lea r8d, [rdx - 0x1f]
call fcn.1401c24f8
cmp rax, 1
je 0x1400d06c7
mov eax, 4
jmp 0x1400d0768
mov rdx, qword [rbx]
mov qword [rsp + 0x50], rdi
xor edi, edi
mov ecx, edi
cmp si, 4
jne 0x1400d077f
cmp word [rsp + 0xa0], cx
setne cl
add ecx, 8
call fcn.1401c1ae4
mov ecx, 2
mov rdx, qword [rbx]
call fcn.1401c1ae4
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
xor ecx, ecx
mov rdx, rbx
call fcn.1400671a0
xor ecx, ecx
mov rdx, rbx
call fcn.1400671a0
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov ecx, 0xffff
mov rdx, rbx
call fcn.1400671a0
mov ecx, 0xffff
mov rdx, rbx
call fcn.1400671a0
mov rdx, rbx
movzx ecx, bp
call fcn.1400671a0
mov rdx, rbx
movzx ecx, r14w
call fcn.1400671a0
movzx eax, di
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x58
pop r14
pop rsi
pop rbp
pop rbx
ret
cmp word [rsp + 0xa0], cx
setne cl
call fcn.1401c1ae4
cmp si, 1
jne 0x1400d079f
mov ecx, 0xff
jmp 0x1400d06f5
cmp si, 2
jne 0x1400d06f0
xor ecx, ecx
jmp 0x1400d06f5
Function at 0x1400d0ff0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov ebp, r8d
mov r8d, dword [rsp + 0x90]
mov esi, edx
mov rdi, rcx
lea rdx, str.HPHP_d_E
lea rcx, [rsp + 0x20]
mov rbx, r9
call fcn.1401bea4c
mov r9, qword [rdi]
mov edx, 8
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c24f8
cmp rax, 1
je 0x1400d1052
mov eax, 6
jmp 0x1400d111c
mov eax, esi
cdq
and edx, 3
add eax, edx
mov ecx, eax
and eax, 3
sar ecx, 2
mov dword [rbx], ecx
cmp eax, edx
je 0x1400d106d
lea eax, [rcx + 1]
mov dword [rbx], eax
mov eax, dword [rbx]
test al, 1
je 0x1400d1077
inc eax
mov dword [rbx], eax
mov ebx, dword [rbx]
mov rdx, qword [rdi]
mov ecx, 0x1e
imul ebx, ebp
add ebx, 0xf
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov ecx, 0x2b
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov ecx, ebx
and ecx, 0xf
shl ecx, 4
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov eax, ebx
sar eax, 4
movzx ecx, al
call fcn.1401c1ae4
mov rdx, qword [rdi]
sar ebx, 0xc
movzx ecx, bl
call fcn.1401c1ae4
mov rdx, qword [rdi]
movzx ecx, bpl
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov eax, ebp
sar eax, 8
movzx ecx, al
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov ecx, esi
shl ecx, 4
sar ebp, 0xc
or ecx, ebp
and ecx, 0xf0
call fcn.1401c1ae4
mov rdx, qword [rdi]
mov eax, esi
sar eax, 4
movzx ecx, al
call fcn.1401c1ae4
mov rdx, qword [rdi]
sar esi, 0xc
movzx ecx, sil
call fcn.1401c1ae4
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400d30a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rbx, rcx
call fcn.140066da0
test ax, ax
je 0x1400d30d3
mov eax, 2
jmp 0x1400d31e8
mov r9, qword [rbx]
mov edx, 0xc
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 0xb]
mov qword [rsp + 0x60], rdi
call fcn.1401c1e14
test rax, rax
jne 0x1400d30fd
mov eax, 4
jmp 0x1400d31e3
lea rdx, str.Xionics_F
lea rcx, [rsp + 0x20]
mov r8d, 9
call fcn.1401c25f0
test eax, eax
jne 0x1400d31de
cmp byte [rsp + 0x29], 0x1b
jne 0x1400d31de
cmp byte [rsp + 0x2a], 0x7f
jne 0x1400d31de
cmp byte [rsp + 0x2b], al
jne 0x1400d31de
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
mov word [rsi], ax
call fcn.140066da0
mov rcx, rbx
mov word [rsi + 2], ax
call fcn.140066da0
mov word [rsi + 4], ax
cmp ax, 1
jne 0x1400d31de
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
mov word [rsi + 6], ax
call fcn.140066da0
mov edi, 4
mov word [rsi + 8], ax
mov r9, qword [rbx]
lea rcx, [rsi + 0xa]
lea r8d, [rdi - 3]
mov edx, edi
call fcn.1401c1e14
test rax, rax
jne 0x1400d319e
movzx eax, di
jmp 0x1400d31e3
mov rcx, rbx
call fcn.140066da0
mov word [rsi + 0xe], ax
mov rcx, qword [rbx]
call fcn.1401c3f28
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
mov word [rsi + 0x10], ax
call fcn.140066da0
mov rcx, rbx
mov word [rsi + 0x12], ax
call fcn.140066b20
mov rcx, rbx
call fcn.140066b20
xor eax, eax
jmp 0x1400d31e3
mov eax, 2
mov rdi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret
Function at 0x1400d3890
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 8
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
jne 0x1400d38d4
mov eax, 4
jmp 0x1400d3b43
lea rcx, [rsp + 0x20]
call fcn.1401bee6c
cmp eax, 0x120
je 0x1400d38ef
mov eax, 2
jmp 0x1400d3b43
mov r9, qword [rbx]
mov edx, 0x50
mov rcx, rdi
lea r8d, [rdx - 0x4f]
call fcn.1401c1e14
test rax, rax
je 0x1400d38ca
mov r9, qword [rbx]
mov edx, 0x1a
lea rcx, [rdi + 0x50]
lea r8d, [rdx - 0x19]
call fcn.1401c1e14
test rax, rax
je 0x1400d38ca
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x6a]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d38ca
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x72]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d38ca
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x7a]
lea r8d, [rdx - 7]
mov qword [rsp + 0x50], rsi
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
lea rcx, [rdi + 0x7a]
call fcn.1401bee6c
cmp eax, 1
je 0x1400d39a3
lea rcx, [rdi + 0x7a]
call fcn.1401bee6c
cmp eax, 8
je 0x1400d39a3
mov eax, 2
jmp 0x1400d3b3e
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x82]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x8a]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x92]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x9a]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0xa2]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 0xaa], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov edx, 8
lea rcx, [rdi + 0xac]
mov byte [rdi + 0xab], al
mov r9, qword [rbx]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0xb4]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 0xbc], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 0xbd], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 0xbe], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov edx, 0x50
lea rcx, [rdi + 0xc0]
mov byte [rdi + 0xbf], al
mov r9, qword [rbx]
lea r8d, [rdx - 0x4f]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x110]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
je 0x1400d3b35
mov r9, qword [rbx]
mov edx, 8
lea rcx, [rdi + 0x118]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
jne 0x1400d3b3c
mov eax, 4
jmp 0x1400d3b3e
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400d4bb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 8
mov rbx, rcx
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c1e14
test rax, rax
jne 0x1400d4bf4
mov eax, 4
jmp 0x1400d4c85
lea rdx, str.srisunim
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x28], 0
call fcn.1401c3380
test eax, eax
je 0x1400d4c15
mov eax, 2
jmp 0x1400d4c85
mov rcx, qword [rbx]
call fcn.1401c3f28
test eax, eax
jne 0x1400d4c0e
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 1], al
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rdi + 2], al
cmp al, 2
jne 0x1400d4c0e
mov rcx, rbx
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 4], ax
call fcn.140066de0
mov rcx, rbx
mov word [rdi + 6], ax
call fcn.140066de0
mov word [rdi + 8], ax
mov rcx, qword [rbx]
call fcn.1401c2310
mov edx, 0x100
mov rcx, rbx
sub edx, eax
movsxd rdx, edx
call fcn.140066ff0
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400d5200
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rdx, rcx
mov ecx, dword [rbx]
call fcn.140067100
mov ecx, dword [rbx + 4]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 8]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 0xc]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 0x10]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 0x14]
mov rdx, rdi
call fcn.140067100
mov r9, qword [rdi]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rbx + 0x18]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rbx + 0x20]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x84]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x90]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x24
lea r8d, [rdx - 0x23]
lea rcx, [rbx + 0x9c]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400d52d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
movzx ecx, byte [rdx]
mov rbx, rdx
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 1]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 2]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 3]
mov rdx, qword [rdi]
call fcn.1401c1ae4
mov ecx, dword [rbx + 4]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 8]
mov rdx, rdi
call fcn.140067100
mov r9, qword [rdi]
mov edx, 0x14
lea r8d, [rdx - 0x13]
lea rcx, [rbx + 0xc]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5350
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
movzx ecx, byte [rdx]
mov rsi, rdx
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 1]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 2]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rsi + 3]
mov rdx, qword [rbx]
call fcn.1401c1ae4
lea rdi, [rsi + 7]
lea rbp, [rsi + 4]
mov r14d, 8
nop dword [rax]
mov r9, qword [rbx]
mov edx, 2
mov rcx, rbp
lea r8d, [rdx - 1]
call fcn.1401c24f8
movzx ecx, byte [rdi - 1]
mov rdx, qword [rbx]
call fcn.1401c1ae4
movzx ecx, byte [rdi]
mov rdx, qword [rbx]
call fcn.1401c1ae4
mov ecx, dword [rdi + 1]
mov rdx, rbx
call fcn.140067100
mov ecx, dword [rdi + 5]
mov rdx, rbx
call fcn.140067100
mov rcx, rbx
movss xmm1, dword [rdi + 9]
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rdi + 0xd]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rdi + 0x11]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rdi + 0x15]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
add rbp, 0x1c
lea rdi, [rdi + 0x1c]
dec r14
jne 0x1400d53b0
movss xmm1, dword [rsi + 0xe4]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xe8]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xec]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xf0]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xf4]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xf8]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0xfc]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rsi + 0x100]
mov rcx, rbx
cvtps2pd xmm1, xmm1
call fcn.140067060
mov r9, qword [rbx]
lea rcx, [rsi + 0x104]
lea r8d, [r14 + 1]
mov edx, 0xc8
call fcn.1401c24f8
mov r9, qword [rbx]
lea rcx, [rsi + 0x1cc]
lea edx, [r14 + 0x1c]
lea r8d, [r14 + 1]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
ret
Function at 0x1400d5530
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rdx, rcx
mov ecx, dword [rbx]
call fcn.140067100
mov ecx, dword [rbx + 4]
mov rdx, rdi
call fcn.140067100
mov r9, qword [rdi]
mov edx, 0x64
lea r8d, [rdx - 0x63]
lea rcx, [rbx + 8]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x6c]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x78]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbx + 0x84]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0xc4]
call fcn.1401c24f8
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0xe4]
call fcn.1401c24f8
mov rcx, rdi
movss xmm1, dword [rbx + 0x104]
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rbx + 0x108]
mov rcx, rdi
cvtps2pd xmm1, xmm1
call fcn.140067060
movss xmm1, dword [rbx + 0x10c]
mov rcx, rdi
cvtps2pd xmm1, xmm1
call fcn.140067060
mov r9, qword [rdi]
mov edx, 0x28
lea r8d, [rdx - 0x27]
lea rcx, [rbx + 0x110]
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400d5640
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
movzx ecx, byte [rdx]
mov rbx, rdx
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 1]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 2]
mov rdx, qword [rdi]
call fcn.1401c1ae4
movzx ecx, byte [rbx + 3]
mov rdx, qword [rdi]
call fcn.1401c1ae4
mov ecx, dword [rbx + 4]
mov rdx, rdi
call fcn.140067100
mov ecx, dword [rbx + 8]
mov rdx, rdi
call fcn.140067100
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0xc]
call fcn.1401c24f8
mov ecx, dword [rbx + 0x2c]
mov rdx, rdi
call fcn.140067100
mov rcx, rdi
movss xmm1, dword [rbx + 0x30]
cvtps2pd xmm1, xmm1
call fcn.140067060
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0x34]
call fcn.1401c24f8
mov r9, qword [rdi]
lea rcx, [rbx + 0x54]
mov edx, 0xc8
mov r8d, 1
call fcn.1401c24f8
mov r9, qword [rdi]
lea rcx, [rbx + 0x11c]
mov edx, 0x2e4
mov r8d, 1
call fcn.1401c24f8
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400d5c20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, word [rcx + 0x48]
xor r15d, r15d
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov r13d, 0x7f0
cmp ax, 1
jne 0x1400d5c5e
lea edi, [r15 + 2]
jmp 0x1400d5c6b
mov edi, 0x100
cmp ax, r13w
cmove edi, r15d
movsxd rbx, edi
mov r12d, 1
lea rdx, [rbx*4 + 0x28]
mov ecx, r12d
call fcn.1401be1f8
mov rcx, rax
test rax, rax
jne 0x1400d5c95
movzx eax, r12w
jmp 0x1400d5d74
mov qword [rsi], rax
lea rsi, [rax + 0x28]
mov dword [rax], 0x28
mov eax, dword [rbp + 0x50]
mov dword [rcx + 4], eax
mov eax, dword [rbp + 0x54]
mov word [rcx + 0xc], r12w
mov dword [rcx + 8], eax
movzx eax, word [rbp + 0x48]
cmp ax, r12w
jne 0x1400d5cc4
mov word [rcx + 0xe], r12w
jmp 0x1400d5cd8
cmp ax, r13w
mov eax, 0x18
je 0x1400d5cd4
mov eax, 8
mov word [rcx + 0xe], ax
cmp word [rcx + 0xe], 8
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], r15
mov dword [rcx + 0x20], edi
mov dword [rcx + 0x24], r15d
ja 0x1400d5d70
lea r8, [rbx*4]
xor edx, edx
mov rcx, rsi
call fcn.1401c0040
test r14, r14
je 0x1400d5d44
test edi, edi
jle 0x1400d5d70
lea rcx, [rsi + 2]
lea rdx, [r14 + 2]
nop word [rax + rax]
movzx eax, byte [rdx - 2]
lea rcx, [rcx + 4]
lea rdx, [rdx + 3]
mov byte [rcx - 6], al
movzx eax, byte [rdx - 4]
mov byte [rcx - 5], al
movzx eax, byte [rdx - 3]
mov byte [rcx - 4], al
dec rbx
jne 0x1400d5d20
jmp 0x1400d5d70
test edi, edi
jle 0x1400d5d70
dec edi
mov r8d, r15d
lea rcx, [rsi + 1]
mov eax, r8d
add r8d, 0xff
lea rcx, [rcx + 4]
cdq
idiv edi
mov byte [rcx - 3], al
mov byte [rcx - 4], al
mov byte [rcx - 5], al
dec rbx
jne 0x1400d5d51
movzx eax, r15w
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret