joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400035c0
Capabilities:
Create service
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x298
lea rdx, str.ServicesActive
xor ecx, ecx
mov r8d, 2
call qword [sym.imp.advapi32.dll_OpenSCManagerW]
test rax, rax
je 0x14000367b
mov rsi, rax
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov edx, 0x104
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov eax, eax
movups xmm0, xmmword [str.msiexec__V]
movups xmmword [rsp + rax*2 + 0x70], xmm0
movabs rcx, 0x56002f0020
mov qword [rsp + rax*2 + 0x80], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0x20
lea rdx, [0x1400058e8]
mov rcx, rsi
mov r8, rdx
mov r9d, 0x10000000
call qword [sym.imp.advapi32.dll_CreateServiceW]
test rax, rax
je 0x14000368e
mov rcx, rax
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
xor edi, edi
jmp 0x1400036b3
lea rcx, str.Failed_to_open_the_service_control_manager._n
call sym.report_error
mov edi, 1
jmp 0x1400036bc
mov rax, qword gs:[0x30]
xor edi, edi
cmp dword [rax + 0x68], 0x431
je 0x1400036b3
lea rcx, str.Failed_to_create_MSI_service_n
call sym.report_error
mov edi, 1
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, edi
add rsp, 0x298
pop rdi
pop rsi
ret

Function at 0x1400036d0
Capabilities:
Delete service

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rdx, str.ServicesActive
mov edi, 1
xor ecx, ecx
mov r8d, 1
call qword [sym.imp.advapi32.dll_OpenSCManagerW]
test rax, rax
je 0x140003742
mov rsi, rax
lea rdx, [0x1400058e8]
mov rcx, rax
mov r8d, 0x10000
call qword [sym.imp.advapi32.dll_OpenServiceW]
test rax, rax
je 0x140003750
mov rbx, rax
mov rcx, rax
call qword [sym.imp.advapi32.dll_DeleteService]
xor edi, edi
test eax, eax
jne 0x140003737
lea rcx, str.Failed_to_delete_MSI_service_n
call sym.report_error
mov edi, 1
mov rcx, rbx
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
jmp 0x140003775
lea rcx, str.Failed_to_open_service_control_manager_n
call sym.report_error
jmp 0x14000377e
mov rax, qword gs:[0x30]
xor edi, edi
cmp dword [rax + 0x68], 0x424
je 0x140003775
lea rcx, str.Failed_to_open_MSI_service_n
call sym.report_error
mov edi, 1
mov rcx, rsi
call qword [sym.imp.advapi32.dll_CloseServiceHandle]
mov eax, edi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140003a40
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov r8d, 8
call qword [sym.imp.kernel32.dll_LoadLibraryExW]
mov qword [rsi], rax
test rax, rax
je 0x140003a7f
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x140003aa1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov rcx, rbx
call sym.wine_dbgstr_w
lea rcx, str.Unable_to_load_dll__s_n
mov rdx, rax
call sym.report_error
mov ecx, 1
call qword [sym.imp.kernel32.dll_ExitProcess]
mov rcx, rbx
call sym.wine_dbgstr_w
lea rcx, str.Dll__s_does_not_implement_function__s_n
mov rdx, rax
mov r8, rdi
call sym.report_error
mov rcx, qword [rsi]
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov ecx, 1
call qword [sym.imp.kernel32.dll_ExitProcess]
Function at 0x140003b50
Capabilities:
Create thread

Disassembly:
push rsi
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
lea rcx, str.MSIServer
lea rdx, [sym.ServiceCtrlHandler]
call qword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerA]
mov qword [0x140007050], rax
test rax, rax
je 0x140003ccd
movabs rcx, 0x200000010
mov qword [rsp + 0x34], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], 0
lea rsi, [rsp + 0x34]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.advapi32.dll_SetServiceStatus]
test eax, eax
jne 0x140003be7
lea rcx, str.Failed_to_set_service_status_n
call sym.report_error
test byte [0x140007010], 8
je 0x140003bda
lea r8, str.KillService
lea r9, str.Killing_service_n
call sym.wine_dbg_log_1
mov rcx, qword [0x140007058]
call qword [sym.imp.kernel32.dll_SetEvent]
xor ecx, ecx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateEventW]
mov qword [0x140007058], rax
test rax, rax
je 0x140003cde
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
lea r8, [sym.ServiceExecutionThread]
xor ecx, ecx
xor edx, edx
xor r9d, r9d
call qword [sym.imp.kernel32.dll_CreateThread]
mov qword [0x140007060], rax
test rax, rax
je 0x140003ce7
movabs rax, 0x400000010
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x3c], 7
xorps xmm6, xmm6
movups xmmword [rsp + 0x40], xmm6
mov rcx, qword [0x140007050]
lea rdx, [rsp + 0x34]
call qword [sym.imp.advapi32.dll_SetServiceStatus]
test eax, eax
jne 0x140003ca5
lea rcx, str.Failed_to_set_service_status_n
call sym.report_error
test byte [0x140007010], 8
je 0x140003c98
lea r8, str.KillService
lea r9, str.Killing_service_n
call sym.wine_dbg_log_1
mov rcx, qword [0x140007058]
call qword [sym.imp.kernel32.dll_SetEvent]
mov rcx, qword [0x140007060]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
movabs rax, 0x100000010
mov qword [rsp + 0x34], rax
movups xmmword [rsp + 0x3c], xmm6
jmp 0x140003d33
lea rcx, str.Failed_to_register_service_ctrl_handler_n
call sym.report_error
jmp 0x140003d86
lea rcx, str.Failed_to_create_event_n
jmp 0x140003cee
lea rcx, str.Failed_to_create_thread_n
call sym.report_error
test byte [0x140007010], 8
je 0x140003d0f
lea r8, str.KillService
lea r9, str.Killing_service_n
call sym.wine_dbg_log_1
mov rcx, qword [0x140007058]
call qword [sym.imp.kernel32.dll_SetEvent]
movabs rax, 0x100000010
mov qword [rsp + 0x34], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], 0
mov rcx, qword [0x140007050]
lea rdx, [rsp + 0x34]
call qword [sym.imp.advapi32.dll_SetServiceStatus]
test eax, eax
jne 0x140003d86
lea rcx, str.Failed_to_set_service_status_n
call sym.report_error
test byte [0x140007010], 8
je 0x140003d79
lea r8, str.KillService
lea r9, str.Killing_service_n
call sym.wine_dbg_log_1
mov rcx, qword [0x140007058]
call qword [sym.imp.kernel32.dll_SetEvent]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rsi
ret
Function at 0x1400040c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
call qword [sym.imp.ucrtbase.dll_strlen]
test rax, rax
je 0x140004113
mov rdi, rax
xor eax, eax
cmp byte [rsi + rdi - 1], 0xa
je 0x1400040ec
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x48]
xchg dword [0x140007194], eax
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov edx, 1
mov rcx, rsi
mov r8, rdi
mov r9, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
jmp 0x140004115
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140004620
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x100
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
mov rax, qword [0x140007080]
test rax, rax
jne 0x140004692
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x68]
lea rcx, [0x140005b24]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rdx, str.__wine_dbg_get_channel_flags
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
lea rcx, [sym.fallback__wine_dbg_get_channel_flags]
cmovne rcx, rax
xchg qword [0x140007080], rcx
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], ebp
mov rax, qword [0x140007080]
mov rcx, rdi
call rax
movzx eax, al
bt eax, ebx
jae 0x140004899
mov ecx, dword [0x140007194]
mov rdx, qword gs:[0x30]
xor eax, eax
cmp ecx, dword [rdx + 0x48]
je 0x14000489e
lea r14, [rsp + 0x30]
test byte [0x140007025], 8
je 0x140004773
mov rax, qword [0x140007080]
test rax, rax
jne 0x14000472c
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x68]
lea rcx, [0x140005b24]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rdx, str.__wine_dbg_get_channel_flags
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
lea rcx, [sym.fallback__wine_dbg_get_channel_flags]
cmovne rcx, rax
xchg qword [0x140007080], rcx
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], ebp
mov rax, qword [0x140007080]
lea rcx, [0x140007025]
call rax
test al, 8
je 0x140004773
call qword [sym.imp.kernel32.dll_GetTickCount]
mov ecx, eax
imul r8, rcx, 0x10624dd3
shr r8, 0x26
imul ecx, r8d, 0x3e8
sub eax, ecx
lea rdx, str._3u._03u:
lea rcx, [rsp + 0x30]
mov r9d, eax
call sym.sprintf
cdqe
lea r14, [rsp + rax]
add r14, 0x30
test byte [0x140007035], 8
je 0x14000480b
mov rax, qword [0x140007080]
test rax, rax
jne 0x1400047dd
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x68]
lea rcx, [0x140005b24]
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
lea rdx, str.__wine_dbg_get_channel_flags
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
lea rcx, [sym.fallback__wine_dbg_get_channel_flags]
cmovne rcx, rax
xchg qword [0x140007080], rcx
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], ebp
mov rax, qword [0x140007080]
lea rcx, [0x140007035]
call rax
test al, 8
je 0x14000480b
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x40]
lea rdx, str._04x:
mov rcx, r14
call sym.sprintf
cdqe
add r14, rax
mov rax, qword gs:[0x30]
mov r8d, dword [rax + 0x48]
lea rdx, str._04x:
mov rcx, r14
call sym.sprintf
cmp ebx, 3
ja 0x140004867
test rsi, rsi
je 0x140004867
mov ecx, ebx
cdqe
add r14, rax
inc rdi
lea rax, str.fixme
mov r9, qword [rax + rcx*8]
lea rdx, [rsp + 0x30]
sub rdx, r14
add rdx, 0xc8
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
call sym.snprintf
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov rsi, rax
lea rdi, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_strlen]
mov edx, 1
mov rcx, rdi
mov r8, rax
mov r9, rsi
call qword [sym.imp.ucrtbase.dll_fwrite]
jmp 0x14000489e
mov eax, 0xffffffff
add rsp, 0x100
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x140004910
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov ecx, 1
call sym._configure_narrow_argv
call sym._initialize_narrow_environment
call sym.__p___argc
mov esi, dword [rax]
call sym.__p___argv
mov rdi, qword [rax]
call sym._get_initial_narrow_environment
mov rbx, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x10]
mov edx, dword [rax + 0x3c]
xor ecx, ecx
cmp word [rax + rdx + 0x5c], 2
sete cl
inc ecx
call sym._set_app_type
mov ecx, esi
mov rdx, rdi
mov r8, rbx
call sym.main
mov ecx, eax
call sym.exit
int3

Function at 0x140004980
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push rdi
sub rsp, 0x88
xor edi, edi
call qword [sym.imp.kernel32.dll_GetCommandLineA]
mov rsi, rax
xor eax, eax
jmp 0x1400049ab
xor edx, edx
test eax, eax
je 0x1400049f7
inc rsi
mov edi, edx
movzx ecx, byte [rsi]
cmp ecx, 9
je 0x1400049a0
test ecx, ecx
je 0x1400049f7
cmp cl, 0x20
jne 0x1400049c0
test eax, eax
je 0x1400049f7
xor edx, edx
cmp ecx, 0x22
je 0x1400049d2
cmp ecx, 0x5c
jne 0x1400049a6
inc edi
mov edx, edi
jmp 0x1400049a6
xor ecx, ecx
test eax, eax
sete cl
test dil, 1
cmove eax, ecx
jmp 0x1400049a6
movzx ecx, byte [rsi + 1]
inc rsi
cmp cl, 0x20
je 0x1400049f0
movzx eax, cl
cmp eax, 9
je 0x1400049f0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [rsp + 0x5c], 1
jne 0x140004a24
mov word [rsp + 0x60], 1
mov edi, 1
jmp 0x140004a29
movzx edi, word [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
mov r8, rsi
mov r9d, edi
call sym.WinMain
nop
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1400041b0
Capabilities:
Create thread

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x98
mov rax, qword [0x1400ac040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140003520]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400045d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [0x1400aef10], 0x280
jge 0x14000428d
cmp dword [0x1400aef14], 0x1e0
jge 0x14000428d
lea rdx, str.Rust
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1400aef08], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [0x1400aef08]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [0x1400aef10], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [0x1400aef14], eax
jmp 0x140004227
lea rdx, [0x1400aef2c]
mov rcx, qword [0x1400aef08]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [0x1400aef2c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1400aef20], rax
mov rcx, qword [rsp + 0xa0]
call fcn.140004400
mov qword [0x1400aef00], rax
cmp qword [0x1400aef00], 0
jne 0x1400042e4
mov ecx, 1
call fcn.140066b30
mov edx, 5
mov rcx, qword [0x1400aef00]
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [0x1400aef34], 1
cmp dword [0x1400aef30], 0
jne 0x1400043a6
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1400aef00]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140004347
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_DispatchMessageA]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_TranslateMessage]
cmp dword [0x1400aef30], 0
je 0x1400043a1
lea rdx, str.Info
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1400043a1
mov dword [rsp + 0x30], 3
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140003690
mov rcx, rax
call fcn.140004840
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x140004300
mov rcx, qword [0x1400aef00]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rdx, qword [rsp + 0xa0]
lea rcx, [0x140098610]
call qword [sym.imp.USER32.dll_UnregisterClassA]
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
Function at 0x14001d0f0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov eax, 4
imul rax, rax, 1
lea rcx, [0x1400b3460]
cmp dword [rcx + rax], 0
jne 0x14001d192
mov dword [rsp + 0x2c], 0xedb88320
mov dword [rsp + 0xc], 0
jmp 0x14001d134
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
cmp dword [rsp + 0xc], 0x100
jae 0x14001d192
mov eax, dword [rsp + 0xc]
mov dword [rsp + 0x10], eax
mov dword [rsp + 0x20], 0
jmp 0x14001d15a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 8
jae 0x14001d17e
mov eax, dword [rsp + 0x10]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp + 0x10], eax
jmp 0x14001d150
mov eax, dword [rsp + 0xc]
lea rcx, [0x1400b3460]
mov edx, dword [rsp + 0x10]
mov dword [rcx + rax*4], edx
jmp 0x14001d12a
mov eax, dword [rsp + 0x50]
not eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x18], rax
cmp dword [rsp + 0x48], 0
jle 0x14001d215
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x48]
dec eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x24], 0
je 0x14001d210
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
mov rdx, qword [rsp + 0x18]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x1400b3460]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
mov eax, dword [rsp + 0x28]
mov dword [rsp + 4], eax
jmp 0x14001d1b5
jmp 0x14001d2a9
mov rax, qword [rsp + 0x18]
movzx eax, byte [rax]
mov byte [rsp + 8], al
mov rax, qword [rsp + 0x18]
inc rax
mov qword [rsp + 0x18], rax
movzx eax, byte [rsp + 8]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x14001d2a9
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x14001d27d
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x18]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001d27d
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 0x18]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14001d27d
mov eax, dword [rsp + 0x50]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
lea rdx, [0x1400b3460]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14001d215
mov eax, dword [rsp + 4]
not eax
add rsp, 0x38
ret
Function at 0x14001e4c0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
cmp qword [rsp + 0x60], 0
je 0x14001e4ec
mov rax, qword [rsp + 0x60]
mov dword [rax], 0
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.14001e390
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001e50f
xor eax, eax
jmp 0x14001e627
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.14006b188
test eax, eax
jne 0x14001e54d
mov rcx, qword [rsp + 0x28]
call fcn.14006a2f8
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0xffffffff
je 0x14001e54d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x28]
call fcn.14006b188
test eax, eax
je 0x14001e55e
mov rcx, qword [rsp + 0x28]
call fcn.14006ade8
xor eax, eax
jmp 0x14001e627
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x20]
add ecx, eax
mov eax, ecx
cdqe
mov rcx, rax
call fcn.140020280
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x14001e59a
mov rcx, qword [rsp + 0x28]
call fcn.14006ade8
xor eax, eax
jmp 0x14001e627
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x30]
call fcn.14006bf00
movsxd rcx, dword [rsp + 0x20]
cmp rax, rcx
je 0x14001e5d8
mov rcx, qword [rsp + 0x28]
call fcn.14006ade8
mov rcx, qword [rsp + 0x30]
call fcn.1400202d0
xor eax, eax
jmp 0x14001e627
cmp dword [rsp + 0x68], 0
jle 0x14001e605
movsxd rax, dword [rsp + 0x68]
mov qword [rsp + 0x38], rax
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
add rdx, rcx
mov rcx, rdx
mov rdi, rcx
xor eax, eax
mov rcx, qword [rsp + 0x38]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x28]
call fcn.14006ade8
cmp qword [rsp + 0x60], 0
je 0x14001e622
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x20]
mov dword [rax], ecx
mov rax, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x1400338b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400acc90]
mov rax, qword [rax + 0x1768]
mov qword [rsp + 0x48], rax
mov rax, qword [0x1400acc90]
movss xmm0, dword [rax + 0x1770]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140008800
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x80]
cmp qword [rsp + 0x30], rax
jae 0x1400339f5
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400339b7
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.140019b00
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1400339b2
jmp 0x1400339f5
jmp 0x140033928
cmp dword [rsp + 0x28], 0xd
jne 0x1400339c3
jmp 0x140033928
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
call fcn.1400194b0
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x140033928
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x140033a14
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x90], 0
je 0x140033a50
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140008800
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x1400a3d20]
ja 0x140033a74
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
ucomiss xmm0, dword [0x1400a3d20]
jp 0x140033a8e
jne 0x140033a8e
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x88], 0
je 0x140033aa9
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400559f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1400ac040]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x50]
call fcn.1400197f0
lea rcx, [rsp + 0x50]
call fcn.140019fb0
movss xmm1, dword [0x1400a3e6c]
divss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x34], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
jmp 0x140055a6a
mov rax, qword [rsp + 0x28]
add rax, 0x14
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x28], rax
jae 0x140055b88
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x44]
call fcn.1400197f0
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140044230
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x30]
mulss xmm0, dword [rsp + 0x34]
movss xmm2, dword [0x1400a3e6c]
xorps xmm1, xmm1
call fcn.140019c70
movss dword [rsp + 0x20], xmm0
mov eax, dword [rsp + 0x98]
and eax, 0xff
mov ecx, dword [rsp + 0x90]
and ecx, 0xff
movss xmm2, dword [rsp + 0x20]
mov edx, eax
call fcn.140019e10
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x98]
shr eax, 8
and eax, 0xff
mov ecx, dword [rsp + 0x90]
shr ecx, 8
and ecx, 0xff
movss xmm2, dword [rsp + 0x20]
mov edx, eax
call fcn.140019e10
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x98]
shr eax, 0x10
and eax, 0xff
mov ecx, dword [rsp + 0x90]
shr ecx, 0x10
and ecx, 0xff
movss xmm2, dword [rsp + 0x20]
mov edx, eax
call fcn.140019e10
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x38]
shl eax, 8
mov ecx, dword [rsp + 0x3c]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x40]
shl ecx, 0x10
or eax, ecx
mov rcx, qword [rsp + 0x28]
mov ecx, dword [rcx + 0x10]
and ecx, 0xff000000
or eax, ecx
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0x10], eax
jmp 0x140055a5c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005f9e0
add rsp, 0x68
ret