joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b32d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
call fcn.1401c3f28
mov byte [rbx], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 1], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 2], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
mov byte [rbx + 3], al
call fcn.140066b70
mov rcx, rdi
mov dword [rbx + 4], eax
call fcn.140066b70
mov edx, 0x1e
mov dword [rbx + 8], eax
mov r9, qword [rdi]
lea rcx, [rbx + 0xc]
lea r8d, [rdx - 0x1d]
call fcn.1401c1e14
mov rcx, rdi
call fcn.140066b70
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov dword [rbx + 0x2c], eax
call fcn.140066960
mov edx, 0x20
movsd xmm0, qword [rsp + 0x30]
cvtpd2ps xmm0, xmm0
lea rcx, [rbx + 0x34]
lea r8d, [rdx - 0x1f]
movss dword [rbx + 0x30], xmm0
mov r9, qword [rdi]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x1400b3390
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140066b70
mov rcx, rdi
mov dword [rbx], eax
call fcn.140066b70
mov edx, 0x64
lea rcx, [rbx + 8]
mov dword [rbx + 4], eax
mov r9, qword [rdi]
lea r8d, [rdx - 0x63]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x6c]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0xc
lea r8d, [rdx - 0xb]
lea rcx, [rbx + 0x78]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rbx + 0x84]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0xc4]
call fcn.1401c1e14
mov r9, qword [rdi]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbx + 0xe4]
call fcn.1401c1e14
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140066960
lea rdx, [rsp + 0x30]
mov rcx, rdi
movsd xmm0, qword [rsp + 0x30]
cvtpd2ps xmm0, xmm0
movss dword [rbx + 0x104], xmm0
call fcn.140066960
movsd xmm0, qword [rsp + 0x30]
lea rdx, [rsp + 0x30]
mov rcx, rdi
cvtpd2ps xmm0, xmm0
movss dword [rbx + 0x108], xmm0
call fcn.140066960
movsd xmm0, qword [rsp + 0x30]
mov edx, 0x28
lea rcx, [rbx + 0x110]
lea r8d, [rdx - 0x27]
cvtpd2ps xmm0, xmm0
movss dword [rbx + 0x10c], xmm0
mov r9, qword [rdi]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x38]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x1400b3eb0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x50
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
lea rcx, str.GS:___s__n
mov r14d, r8d
call fcn.1401bdc60
mov rcx, rbx
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
test rax, rax
je 0x1400b40d4
mov qword [rsp + 0x80], rsi
lea rdx, str.gsapi_new_instance
mov rcx, rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gsapi_init_with_args
mov rcx, r15
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gsapi_run_string
mov rcx, r15
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gsapi_exit
mov rcx, r15
mov rsi, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gsapi_delete_instance
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gsapi_set_stdio
mov rcx, r15
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x1400b40b9
cmp qword [rsp + 0x28], 0
je 0x1400b40b9
test rsi, rsi
je 0x1400b40b9
test r12, r12
je 0x1400b40b9
test r13, r13
je 0x1400b40b9
test rax, rax
je 0x1400b40b9
lea rcx, [rsp + 0x20]
xor esi, esi
xor edx, edx
mov qword [rsp + 0x20], rsi
call rbx
mov ebp, eax
test eax, eax
js 0x1400b40ab
mov ebx, esi
test r14d, r14d
jle 0x1400b401d
nop dword [rax]
mov r8, qword [rdi]
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r8 + rax], 0
jne 0x1400b3ff0
lea rcx, str.ARG__d__s__n
mov edx, ebx
add esi, eax
call fcn.1401bdc60
inc ebx
add rdi, 8
cmp ebx, r14d
jl 0x1400b3fe0
mov rdi, qword [rsp + 0x88]
lea rcx, str.___d__n
mov edx, esi
call fcn.1401bdc60
mov rcx, qword [rsp + 0x20]
lea r9, [0x1400b62d0]
lea r8, [0x1400b6320]
lea rdx, [fcn.1400017d0]
call qword [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8, rdi
mov edx, r14d
call qword [rsp + 0x28]
test eax, eax
jne 0x1400b408b
mov rcx, qword [rsp + 0x20]
lea r9, [rsp + 0x98]
lea rdx, str.systemdict__start_get_exec_n
xor r8d, r8d
call qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
mov ebp, eax
call r12
mov rcx, qword [rsp + 0x20]
call r13
jmp 0x1400b40b9
lea rcx, str.ERROR:__d__n
mov edx, eax
call fcn.1401bdc60
mov rcx, qword [rsp + 0x20]
call r12
mov rcx, qword [rsp + 0x20]
call r13
jmp 0x1400b40b9
lea rcx, str.CANT_START_GS_instance___d_____n
mov edx, eax
call fcn.1401bdc60
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
mov eax, ebp
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400b5f90
Capabilities:
Read file on windows

Disassembly:
test edx, edx
je 0x1400b607f
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x38
xor esi, esi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x30], r15
mov ebp, edx
mov rdi, rcx
lea r14d, [rsi + 0x18]
lea r15d, [rsi + 3]
mov ebx, esi
nop dword [rax + rax]
mov r9, qword [rdi]
mov edx, 2
lea rcx, [rsp + 0x68]
lea r8d, [rdx - 1]
call fcn.1401c1e14
cmp byte [rsp + 0x68], 0x50
jne 0x1400b606d
movzx eax, byte [rsp + 0x69]
cmp al, 0x34
jne 0x1400b5ff1
mov ebx, 1
jmp 0x1400b6002
cmp al, 0x35
jne 0x1400b5ffc
mov ebx, 8
jmp 0x1400b6002
cmp al, 0x36
cmove ebx, r14d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400b6370
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.1400b6370
cmp ebx, 1
je 0x1400b6046
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400b6370
cmp ebx, r14d
mov eax, 1
cmove eax, r15d
imul eax, dword [rsp + 0x78]
imul eax, dword [rsp + 0x70]
jmp 0x1400b6058
mov eax, dword [rsp + 0x70]
add eax, 7
and eax, 0xfffffff8
imul eax, dword [rsp + 0x78]
shr eax, 3
movsxd rdx, eax
mov rcx, rdi
call fcn.140066ff0
inc esi
cmp esi, ebp
jne 0x1400b5fc0
mov r14, qword [rsp + 0x60]
mov r15, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400b6080
Capabilities:
Query or enumerate registry key

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x150
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rdx
mov r14, rcx
mov dword [rdx], 0
mov esi, r8d
lea rdx, str.Software_s
lea rcx, [rsp + 0x40]
mov r8, r9
call fcn.1401bea4c
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b61c8
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
xor edx, edx
mov qword [rsp + 0x180], rdi
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1400b61b8
nop dword [rax + rax]
movzx ecx, byte [rsp + 0x40]
inc edi
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400b6198
xor edx, edx
lea rax, [rsp + 0x40]
test cl, cl
je 0x1400b6160
nop dword [rax]
cmp cl, 0x2e
je 0x1400b6165
movsx ecx, cl
inc rax
sub ecx, 0x30
lea ecx, [rcx + rcx*4]
lea edx, [rdx + rcx*2]
movzx ecx, byte [rax]
lea edx, [rdx + rdx*4]
add edx, edx
test cl, cl
jne 0x1400b6140
cmp byte [rax], 0x2e
jne 0x1400b6168
inc rax
movzx ecx, byte [rax]
test cl, cl
je 0x1400b618b
movsx ecx, cl
sub ecx, 0x30
lea ecx, [rcx + rcx*4]
lea edx, [rdx + rcx*2]
movzx ecx, byte [rax + 1]
test cl, cl
je 0x1400b618b
movsx eax, cl
add edx, 0xffffffd0
add edx, eax
movsxd rax, dword [rbx]
cmp eax, esi
jge 0x1400b6198
mov dword [r14 + rax*4], edx
inc dword [rbx]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x40]
mov r9d, 0x100
mov edx, edi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1400b6120
cmp dword [rbx], 0
mov rdi, qword [rsp + 0x180]
setne al
jmp 0x1400b61ca
xor al, al
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x150
pop r14
pop rsi
pop rbx
ret
Function at 0x1400b61f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
lea rax, [rsp + 0x38]
mov rdi, r9
mov rsi, r8
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400b62b4
mov rbx, qword [rsp + 0x70]
lea rcx, [rsp + 0x30]
test rdi, rdi
mov eax, dword [rbx]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x34]
cmovne rax, rdi
mov rdx, rsi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 1
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400b6293
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
cmp edi, 0xea
jne 0x1400b62b4
mov eax, dword [rsp + 0x30]
mov dword [rbx], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x40
pop rdi
ret

Function at 0x1400b8fa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov esi, 2
mov rdi, rcx
mov rbx, rdx
lea rcx, [rsp + 0x30]
lea r8d, [rsi - 1]
mov edx, esi
call fcn.1401c1e14
cmp rax, 1
jne 0x1400b9066
cmp byte [rsp + 0x30], 0x4d
jne 0x1400b9066
cmp byte [rsp + 0x31], 0x4d
jne 0x1400b9066
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, 0x226
call fcn.1401c1f88
mov rcx, rdi
call fcn.140066de0
movzx eax, ax
cmp eax, 0x1ed
jne 0x1400b9021
mov dword [rbx], 0x200
mov dword [rbx + 0xc], 0xa
mov dword [rbx + 0x18], 0x3e40
jmp 0x1400b903c
cmp eax, 0x140
jne 0x1400b9066
mov dword [rbx], 0x100
mov dword [rbx + 0xc], 8
mov dword [rbx + 0x18], 0x3d40
mov dword [rbx + 0x14], 1
mov dword [rbx + 0x10], 1
mov dword [rbx + 8], esi
mov dword [rbx + 4], 0xf3
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
movzx eax, si
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b94a0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x30]
call fcn.1401c1e14
cmp rax, 1
je 0x1400b94d0
mov eax, 2
add rsp, 0x20
pop rbx
ret
lea rdx, str.COMET
lea rcx, [rsp + 0x30]
mov r8d, 4
call fcn.1401c25f0
test eax, eax
mov eax, 2
jne 0x1400b951e
mov dword [rbx + 8], eax
mov dword [rbx], 0x200
mov dword [rbx + 4], 0xf3
xor eax, eax
mov dword [rbx + 0xc], 0xa
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x14], 1
mov dword [rbx + 0x18], 0x280
add rsp, 0x20
pop rbx
ret

Function at 0x1400b9d00
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
test r9, r9
je 0x1400b9d1e
mov r8d, edx
mov rdx, rcx
mov rcx, r9
call fcn.140160790
cdqe
add rsp, 0x28
ret
mov r9, qword [r8]
mov r8, rdx
mov edx, 1
add rsp, 0x28
jmp fcn.1401c1e14
Function at 0x1400b9d40
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rax, rdx
test rdx, rdx
je 0x1400b9d6d
lea rdx, [rsp + 0x38]
mov r8d, 4
mov rcx, rax
call fcn.140160790
mov ecx, dword [rsp + 0x38]
call fcn.140065fa0
add rsp, 0x28
ret
add rsp, 0x28
jmp fcn.140066b20

Function at 0x1400ba290
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rbp - 0x18], rax
mov r9, qword [rcx]
mov rdi, rcx
mov r15, r8
mov r14, rdx
mov r12d, 4
lea rcx, [rbp - 0x20]
mov edx, r12d
mov r8d, 1
call fcn.1401c1e14
test rax, rax
jne 0x1400ba2e1
mov eax, 2
jmp 0x1400ba41d
cmp byte [rbp - 0x20], 0x52
jne 0x1400ba2d7
cmp byte [rbp - 0x1f], 0x49
jne 0x1400ba2d7
cmp byte [rbp - 0x1e], 0x46
jne 0x1400ba2d7
cmp byte [rbp - 0x1d], 0x46
jne 0x1400ba2d7
mov rcx, rdi
call fcn.140066b20
mov r9, qword [rdi]
lea rcx, [rbp - 0x20]
mov r8d, 1
mov rdx, r12
call fcn.1401c1e14
test rax, rax
je 0x1400ba2d7
cmp byte [rbp - 0x20], 0x41
jne 0x1400ba2d7
cmp byte [rbp - 0x1f], 0x43
jne 0x1400ba2d7
cmp byte [rbp - 0x1e], 0x4f
jne 0x1400ba2d7
cmp byte [rbp - 0x1d], 0x4e
jne 0x1400ba2d7
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
xor esi, esi
mov dword [r14], esi
mov rcx, qword [rdi]
call fcn.1401c1a94
test eax, eax
jne 0x1400ba405
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
lea rcx, [rbp - 0x20]
mov r8d, 1
mov rdx, r12
call fcn.1401c1e14
test rax, rax
je 0x1400ba4a4
mov rax, qword [rbp - 0x20]
cmp al, 0x49
jne 0x1400ba398
cmp byte [rbp - 0x1f], 0x4e
jne 0x1400ba3b2
cmp byte [rbp - 0x1e], 0x46
jne 0x1400ba3b2
cmp byte [rbp - 0x1d], 0x4f
jmp 0x1400ba3ac
cmp al, 0x66
jne 0x1400ba3b2
cmp byte [rbp - 0x1f], 0x72
jne 0x1400ba3b2
cmp byte [rbp - 0x1e], 0x61
jne 0x1400ba3b2
cmp byte [rbp - 0x1d], 0x6d
je 0x1400ba48f
mov rcx, rdi
call fcn.140066b20
mov ecx, eax
mov ebx, eax
and ecx, 0x80000001
jge 0x1400ba3cd
dec ecx
or ecx, 0xfffffffe
inc ecx
test ecx, ecx
je 0x1400ba3dc
inc eax
cdq
sub eax, edx
sar eax, 1
mov ebx, eax
add ebx, ebx
mov rax, qword [rbp - 0x20]
cmp al, 0x69
jne 0x1400ba436
cmp byte [rbp - 0x1f], 0x63
jne 0x1400ba484
cmp byte [rbp - 0x1e], 0x6f
jne 0x1400ba484
cmp byte [rbp - 0x1d], 0x6e
jne 0x1400ba484
mov dword [r15], ebx
cmp dword [r14], esi
mov eax, 2
cmove esi, eax
movzx eax, si
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
cmp al, 0x61
jne 0x1400ba46e
cmp byte [rbp - 0x1f], 0x6e
jne 0x1400ba484
cmp byte [rbp - 0x1e], 0x69
jne 0x1400ba484
cmp byte [rbp - 0x1d], 0x68
jne 0x1400ba484
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
mov dword [r14], eax
call fcn.140066b20
mov rax, qword [rbp - 0x20]
sub ebx, 0xc
cmp al, 0x4c
jne 0x1400ba484
cmp byte [rbp - 0x1f], 0x49
jne 0x1400ba484
cmp byte [rbp - 0x1e], 0x53
jne 0x1400ba484
cmp byte [rbp - 0x1d], 0x54
je 0x1400ba48f
movsxd rdx, ebx
mov rcx, rdi
call fcn.140066ff0
mov rcx, qword [rdi]
call fcn.1401c1a94
test eax, eax
je 0x1400ba360
jmp 0x1400ba405
movzx eax, r12w
jmp 0x1400ba413
Function at 0x1400ba7f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov edx, 7
mov rsi, r9
mov r9, qword [rcx]
mov r14, r8
mov rdi, rcx
lea r8d, [rdx - 6]
lea rcx, [0x1402acdd8]
call fcn.1401c1e14
test rax, rax
jne 0x1400ba83b
mov eax, 4
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
xor ebp, ebp
mov ebx, ebp
nop dword [rax]
mov rcx, qword [rdi]
call fcn.1401c3f28
cmp byte [0x1402acdd8], 0x70
mov ecx, eax
mov byte [0x1402acddf], al
jne 0x1400ba8a3
cmp byte [0x1402acdd9], bpl
jne 0x1400ba8a3
cmp byte [0x1402acdda], 0x91
jne 0x1400ba8a3
cmp byte [0x1402acddb], 1
jne 0x1400ba8a3
cmp byte [0x1402acddc], 0xff
jne 0x1400ba8a3
cmp byte [0x1402acddd], 0x94
jne 0x1400ba8a3
cmp byte [0x1402acdde], 9
jne 0x1400ba8a3
test al, al
je 0x1400ba8cd
mov eax, dword [0x1402acdd9]
inc ebx
mov dword [0x1402acdd8], eax
movzx eax, word [0x1402acddd]
mov byte [0x1402acdde], cl
mov word [0x1402acddc], ax
cmp ebx, 0x100
jl 0x1400ba850
cmp ebx, 0x100
je 0x1400ba973
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
call fcn.140066de0
mov rcx, rdi
movzx eax, ax
mov dword [r15], eax
call fcn.140066de0
movzx eax, ax
mov dword [r14], eax
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rsi], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov ebx, ebp
mov byte [0x1402acdd8], al
nop
mov rcx, qword [rdi]
call fcn.1401c3f28
cmp byte [0x1402acdd8], 0xfe
mov byte [0x1402acdd9], al
jne 0x1400ba95b
cmp al, 0x92
je 0x1400ba96b
inc ebx
mov byte [0x1402acdd8], al
cmp ebx, 0x80
jl 0x1400ba940
cmp ebx, 0x80
jne 0x1400ba97a
mov eax, 2
jmp 0x1400ba98d
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, qword [rdi]
call fcn.1401c3f28
movzx eax, bp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400bae20
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r12
push r15
sub rsp, 0x130
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r15, rcx
mov esi, 0x3e8
xor r12d, r12d
mov ecx, esi
mov rbx, rdx
mov dword [rdx], r12d
call fcn.1401bee78
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400bae6c
lea eax, [r12 + 1]
jmp 0x1400baf01
mov rcx, qword [r15]
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x178], r14
call fcn.1401c3f28
mov edi, eax
test eax, eax
jle 0x1400baeed
mov ebp, 1
nop
mov r9, qword [r15]
movsxd r14, edi
lea rcx, [rsp + 0x20]
mov rdx, r14
mov r8, rbp
call fcn.1401c1e14
mov eax, dword [rbx]
add eax, edi
cmp eax, esi
jle 0x1400baec9
mov rcx, qword [rbx + 8]
lea eax, [rsi + rsi]
movsxd rsi, eax
mov rdx, rsi
call fcn.1401bef30
mov qword [rbx + 8], rax
test rax, rax
je 0x1400baf20
movsxd rcx, dword [rbx]
lea rdx, [rsp + 0x20]
mov r8, r14
add rcx, qword [rbx + 8]
call fcn.1401bd6e0
add dword [rbx], edi
mov rcx, qword [r15]
call fcn.1401c3f28
mov edi, eax
test eax, eax
jg 0x1400bae90
movzx eax, r12w
mov rdi, qword [rsp + 0x170]
mov r14, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x130
pop r15
pop r12
pop rsi
pop rbp
pop rbx
ret
movzx eax, bp
jmp 0x1400baef1

Function at 0x1400baf30
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx]
mov rax, r8
movsxd rdx, edx
mov rcx, rax
mov r8d, 3
call fcn.1401c1e14
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400bdaf0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor ebx, ebx
mov r15, r9
mov rsi, r8
mov dword [r8], ebx
mov dword [rdx], ebx
mov r9, qword [rcx]
mov rbp, rcx
mov r14, rdx
lea r8d, [rbx + 1]
lea rcx, [rsp + 0x30]
mov edx, 0x80
call fcn.1401c1e14
test rax, rax
jne 0x1400bdb49
mov eax, 2
jmp 0x1400bdc4b
mov rcx, qword [rsp + 0x30]
cmp rcx, qword [str.srcdocid:]
jne 0x1400bdb65
movzx eax, word [rsp + 0x38]
cmp ax, word [0x14021d7e8]
je 0x1400bdb7a
cmp rcx, qword [str.specversion:]
jne 0x1400bdb3f
mov eax, dword [rsp + 0x38]
cmp eax, dword [0x14021d7f8]
jne 0x1400bdb3f
mov qword [rsp + 0xc8], rdi
mov edi, 1
nop word [rax + rax]
mov r9, qword [rbp]
mov edx, 0x80
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 0x7f]
call fcn.1401c1e14
test rax, rax
je 0x1400bdc3e
lea r8, [rsp + 0x20]
lea rdx, str.rtype:__d
lea rcx, [rsp + 0x30]
call fcn.1401be96c
cmp eax, 1
jne 0x1400bdbd1
cmp dword [rsp + 0x20], eax
jne 0x1400bdc3e
lea r8, [rsp + 0x20]
lea rdx, str.rdensity:__d
lea rcx, [rsp + 0x30]
call fcn.1401be96c
cmp eax, 1
jne 0x1400bdbf3
mov eax, dword [rsp + 0x20]
mov dword [r15], eax
lea r9, [rsp + 0x24]
lea r8, [rsp + 0x20]
lea rdx, str.rpelcnt:__d__d
lea rcx, [rsp + 0x30]
call fcn.1401be96c
cmp eax, 2
jne 0x1400bdc20
mov eax, dword [rsp + 0x20]
mov dword [r14], eax
mov eax, dword [rsp + 0x24]
mov dword [rsi], eax
inc edi
cmp edi, 0x10
jl 0x1400bdb90
cmp dword [r14], ebx
je 0x1400bdc34
cmp dword [rsi], ebx
jne 0x1400bdc39
mov ebx, 2
movzx eax, bx
jmp 0x1400bdc43
mov eax, 2
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0xd0
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret

Function at 0x1400bed50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 8
mov rdi, rcx
lea r8d, [rdx - 7]
mov rcx, rbx
call fcn.1401c1e14
cmp rax, 1
je 0x1400bed8a
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx]
cmp rax, qword [str.DFIMAG00]
jne 0x1400bed7a
mov rcx, rdi
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 8], ax
call fcn.140066da0
mov edx, 0x14
mov word [rbx + 0xa], ax
mov r9, qword [rdi]
lea rcx, [rbx + 0xc]
lea r8d, [rdx - 0x13]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x1400bf510
Capabilities:
Read file on windows

Disassembly:
movsxd rcx, ecx
movsxd r8, edx
mov edx, 1
mov r9, qword [rcx]
mov rcx, qword [rcx + 8]
mov r9, qword [r9]
jmp fcn.1401c1e14
Function at 0x1400c0290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r9, qword [rcx]
mov esi, 1
mov rbx, rdx
lea edx, [rsi + 0xd]
lea rcx, [rsp + 0x20]
mov r8d, esi
call fcn.1401c1e14
cmp rax, rsi
je 0x1400c02d1
lea eax, [rsi + 1]
jmp 0x1400c03a3
lea rdx, str.NJPL1I00PDS
lea rcx, [rsp + 0x20]
mov r8d, 0xb
mov qword [rsp + 0x70], rdi
call fcn.1401c25f0
xor edi, edi
test eax, eax
jne 0x1400c02fe
mov word [rbx], di
movzx eax, di
jmp 0x1400c039e
lea rdx, str.NJPL1I00PDS
lea rcx, [rsp + 0x22]
mov r8d, 0xb
call fcn.1401c25f0
test eax, eax
jne 0x1400c0321
mov word [rbx], si
movzx eax, di
jmp 0x1400c039e
lea rdx, str.CCSD3Z
lea rcx, [rsp + 0x20]
mov r8d, 6
call fcn.1401c25f0
test eax, eax
jne 0x1400c0349
mov eax, 2
mov word [rbx], ax
movzx eax, di
jmp 0x1400c039e
lea rdx, str.CCSD3Z
lea rcx, [rsp + 0x22]
mov r8d, 6
call fcn.1401c25f0
test eax, eax
jne 0x1400c0371
mov eax, 3
mov word [rbx], ax
movzx eax, di
jmp 0x1400c039e
lea rdx, str.PDS_VERSION_ID
lea rcx, [rsp + 0x20]
mov r8d, 0xe
call fcn.1401c25f0
test eax, eax
jne 0x1400c0399
mov ecx, 4
movzx eax, di
mov word [rbx], cx
jmp 0x1400c039e
mov eax, 2
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rsi
ret