joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007a1e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x47e0
mov r13, r9
mov r15, r8
mov rbp, rdx
call fcn.1401bee78
mov r14, rax
test rax, rax
je 0x14007a40c
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, 0x7d08
call fcn.1401c1f88
mov r9, qword [rbx]
mov r12d, 1
mov r8d, r12d
mov edx, 0x47e0
mov rcx, r14
call fcn.1401c1e14
test rax, rax
jne 0x14007a268
mov rcx, r14
lea ebx, [rax + 4]
call fcn.1401be23c
movzx eax, bx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
mov r8d, 0x3c0
mov rcx, r15
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call fcn.1401c0040
or r8d, 0xffffffff
mov r9d, r12d
mov rcx, r13
or edx, r8d
call fcn.1400615b0
movzx esi, r12w
lea rax, [r15 + 1]
xor edx, edx
nop
movzx edi, dx
mov rbx, rax
mov r13d, 0x140
mov r12d, 0x3c
nop dword [rax]
nop word [rax + rax]
movzx r8d, di
movzx edx, si
mov rcx, rbp
call fcn.14007a150
movzx r9d, al
test al, al
je 0x14007a391
movzx ecx, r9w
movzx edx, r9w
movsx r10d, di
shr cx, 1
and dx, 1
movzx r8d, si
movzx eax, cx
shl ax, 2
add cx, ax
add cx, dx
shl cx, 2
add cx, 0x29
movzx eax, cx
cmp r10d, eax
jl 0x14007a351
lea ecx, [r9 - 1]
shl dx, 2
sar ecx, 1
movzx eax, cx
shl ax, 2
add cx, ax
mov eax, 0xd1
shl cx, 2
sub cx, dx
add cx, ax
mov eax, 0xffff
add r9w, ax
movzx eax, cx
mov ecx, 0x1e
cmp r10d, eax
mov eax, 0
cmovl cx, ax
jmp 0x14007a365
movzx r8d, si
movzx ecx, r12w
dec r8w
jne 0x14007a365
mov r8d, 0xc7
lea eax, [r10 + r10*2]
movzx ecx, cx
movsxd rdx, eax
movzx eax, r8w
add rcx, r14
add rdx, r15
imul r8, rax, 0x2e
movzx eax, r9w
add r8, rax
movzx ecx, word [rcx + r8*2 - 0x5c]
call fcn.14007a0c0
jmp 0x14007a39a
mov word [rbx], 0
mov byte [rbx - 1], 0
inc di
add rbx, 3
cmp di, r13w
jl 0x14007a2c0
mov rcx, qword [rsp + 0x68]
or r8d, 0xffffffff
mov r9d, 1
or edx, r8d
call fcn.1400615b0
movzx ebx, ax
test ax, ax
jne 0x14007a3e4
inc si
mov ecx, 0xc8
lea rax, [r15 + 1]
mov edx, 0
cmp si, cx
jl 0x14007a2a0
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rcx, r14
call fcn.1401be23c
movzx eax, bx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov eax, 1
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14007b2f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov ecx, 0x4aa0
mov rdi, r9
mov r15, r8
mov r12, rdx
call fcn.1401bee78
mov r13, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x14007b341
lea eax, [r13 + 1]
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rbx]
xor r8d, r8d
mov edx, 0x7d00
call fcn.1401c1f88
mov r9, qword [rbx]
mov edx, 0x60
lea r8d, [rdx + 0x67]
mov rcx, r13
call fcn.1401c1e14
cmp rax, 0xc7
je 0x14007b38d
mov rcx, r13
call fcn.1401be23c
mov eax, 4
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor edx, edx
mov r8d, 0x3c0
mov rcx, r15
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
call fcn.1401c0040
or r8d, 0xffffffff
mov r14d, 1
mov rcx, rdi
or edx, r8d
mov r9d, r14d
call fcn.1400615b0
mov rbp, r13
mov r13d, 0x777
movzx esi, r14w
xor ecx, ecx
nop
movzx ebx, cx
mov r14d, 0x140
nop dword [rax]
movzx r8d, bx
movzx edx, si
mov rcx, r12
call fcn.14007b280
movzx eax, ax
movzx ecx, word [rax + rbp]
movzx eax, bx
lea edx, [rax + rax*2]
movsxd rdi, edx
add rdi, r15
call fcn.140065fd0
mov rdx, rdi
and ax, r13w
movzx ecx, ax
call fcn.14007b200
inc bx
cmp bx, r14w
jb 0x14007b3e0
mov rcx, qword [rsp + 0x78]
or r8d, 0xffffffff
mov r9d, 1
or edx, r8d
call fcn.1400615b0
movzx ebx, ax
test ax, ax
jne 0x14007b458
inc si
mov eax, 0xc8
add rbp, 0x60
mov ecx, 0
cmp si, ax
jb 0x14007b3d0
mov rcx, qword [rsp + 0x20]
call fcn.1401be23c
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movzx eax, bx
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14007dd90
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rcx, [rsp + 0x20]
mov rbx, rdx
call fcn.14006e770
lea rax, [rsp + 0x20]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x14007ddc0
xor edx, edx
nop dword [rax]
movzx ecx, byte [rbx + rdx]
lea rdx, [rdx + 1]
mov byte [rax + rdx - 1], cl
test cl, cl
jne 0x14007ddd0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
movzx eax, cx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x140
pop rbx
ret

Function at 0x14007ed90
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x340
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
movups xmm0, xmmword [str.Image_Magick__PseudoClass_]
mov r14, rcx
mov rdi, r8
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
movzx r15d, r9w
movups xmmword [r8 + 0xee], xmm0
movsd xmm1, qword [0x140213058]
movsd qword [r8 + 0xfe], xmm1
movzx eax, word [0x140213060]
mov word [r8 + 0x106], ax
movzx eax, byte [0x140213062]
mov byte [r8 + 0x108], al
mov r8d, 0x300
call fcn.1401c0040
test r15w, r15w
je 0x14007ee3a
mov r9, qword [r14]
lea rcx, [rsp + 0x20]
movsx rdx, r15w
mov r8d, 3
call fcn.1401c1e14
cmp rax, 3
je 0x14007ee3a
mov eax, 4
jmp 0x14007eedb
mov rdx, rdi
mov rcx, rbp
call fcn.14005ee10
movzx ebx, ax
test ax, ax
jne 0x14007eed8
mov qword [rsp + 0x338], rsi
xor esi, esi
cmp dword [rdi + 0x1c], esi
jle 0x14007eea8
movsxd rdx, dword [rdi + 0x28]
mov r9, qword [r14]
mov rcx, qword [rdi + 0x10]
mov r8d, 1
call fcn.1401c1e14
cmp rax, 1
jne 0x14007eea3
or r8d, 0xffffffff
mov r9d, eax
mov rcx, rbp
or edx, r8d
call fcn.1400615b0
movzx ebx, ax
test ax, ax
jne 0x14007eea8
inc si
movsx eax, si
cmp eax, dword [rdi + 0x1c]
jl 0x14007ee60
jmp 0x14007eea8
mov ebx, 4
mov rsi, qword [rsp + 0x338]
mov rcx, rbp
test r15w, r15w
je 0x14007eecb
mov edx, 0x100
mov r8d, 8
lea r9, [rsp + 0x20]
jmp 0x14007eed3
xor r8d, r8d
xor edx, edx
xor r9d, r9d
call fcn.14005cb20
movzx eax, bx
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x340
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x14007ef00
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x360
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x330], rax
movups xmm0, xmmword [str.Image_Magick__PseudoClass___RLE_]
mov r12, rcx
mov rsi, r8
mov r15, rdx
lea rcx, [rsp + 0x30]
xor edx, edx
movzx r13d, r9w
movups xmmword [r8 + 0xee], xmm0
movups xmm1, xmmword [0x140213078]
movups xmmword [r8 + 0xfe], xmm1
movzx eax, byte [0x140213088]
mov byte [r8 + 0x10e], al
mov r8d, 0x300
call fcn.1401c0040
test r13w, r13w
je 0x14007ef9c
mov r9, qword [r12]
lea rcx, [rsp + 0x30]
movsx rdx, r13w
mov r8d, 3
call fcn.1401c1e14
cmp rax, 3
je 0x14007ef9c
mov eax, 4
jmp 0x14007f0d4
mov rdx, rsi
mov rcx, r15
call fcn.14005ee10
movzx r14d, ax
test ax, ax
jne 0x14007f0d0
mov qword [rsp + 0x358], rbx
mov qword [rsp + 0x350], rbp
mov qword [rsp + 0x348], rdi
xor edi, edi
movzx ebx, di
movzx ebp, di
cmp dword [rsi + 0x1c], edi
jle 0x14007f090
nop dword [rax]
test r14w, r14w
jne 0x14007f090
mov r9, qword [r12]
mov edx, 2
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 1]
call fcn.1401c1e14
test rax, rax
je 0x14007f08a
movzx eax, byte [rsp + 0x21]
inc eax
test eax, eax
jle 0x14007f077
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsi + 0x10]
movsx rdx, bx
inc bx
mov byte [rdx + rcx], al
movsx eax, bx
cmp eax, dword [rsi + 0x18]
jl 0x14007f066
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r15
or edx, r8d
call fcn.1400615b0
movzx r14d, ax
test ax, ax
jne 0x14007f077
inc bp
xor ebx, ebx
movsx eax, bp
cmp eax, dword [rsi + 0x1c]
jge 0x14007f077
movzx ecx, byte [rsp + 0x21]
inc di
inc ecx
movsx eax, di
cmp eax, ecx
jl 0x14007f020
movsx eax, bp
mov edi, 0
cmp eax, dword [rsi + 0x1c]
jl 0x14007efe0
jmp 0x14007f090
mov r14d, 4
mov rdi, qword [rsp + 0x348]
mov rbp, qword [rsp + 0x350]
mov rbx, qword [rsp + 0x358]
mov rcx, r15
test r13w, r13w
je 0x14007f0c3
mov edx, 0x100
mov r8d, 8
lea r9, [rsp + 0x30]
jmp 0x14007f0cb
xor r8d, r8d
xor edx, edx
xor r9d, r9d
call fcn.14005cb20
movzx eax, r14w
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x360
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14007f100
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp word [r8 + 0x22], 0x18
mov rbx, r8
mov rbp, rdx
mov r14, rcx
jne 0x14007f165
movups xmm0, xmmword [str.Image_Magick__DirectClass_]
movups xmmword [r8 + 0xee], xmm0
movsd xmm1, qword [0x140212fc0]
movsd qword [r8 + 0xfe], xmm1
movzx eax, word [0x140212fc8]
mov word [r8 + 0x106], ax
movzx eax, byte [0x140212fca]
mov byte [r8 + 0x108], al
jmp 0x14007f191
movups xmm0, xmmword [str.Image_Magick__DirectClassAlpha_]
movups xmmword [r8 + 0xee], xmm0
movups xmm1, xmmword [0x140212fe0]
movups xmmword [r8 + 0xfe], xmm1
movzx eax, byte [0x140212ff0]
mov byte [r8 + 0x10e], al
mov rdx, rbx
mov rcx, rbp
call fcn.14005ee10
movzx edi, ax
test ax, ax
jne 0x14007f20d
mov qword [rsp + 0x30], rsi
xor esi, esi
cmp dword [rbx + 0x1c], esi
jle 0x14007f1f8
movsxd rdx, dword [rbx + 0x28]
mov r9, qword [r14]
mov rcx, qword [rbx + 0x10]
mov r8d, 1
call fcn.1401c1e14
cmp rax, 1
jne 0x14007f1f3
or r8d, 0xffffffff
mov r9d, eax
mov rcx, rbp
or edx, r8d
call fcn.1400615b0
movzx edi, ax
test ax, ax
jne 0x14007f1f8
inc si
movsx eax, si
cmp eax, dword [rbx + 0x1c]
jl 0x14007f1b0
jmp 0x14007f1f8
mov edi, 4
xor r8d, r8d
xor edx, edx
xor r9d, r9d
mov rcx, rbp
call fcn.14005cb20
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
movzx eax, di
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140080fd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
xor edi, edi
lea rbx, [rdx + 4]
mov qword [rsp + 0x30], r14
nop dword [rax]
mov rcx, rsi
inc edi
call fcn.140066b70
mov dword [rbx], eax
test eax, eax
je 0x14008106b
mov ecx, eax
cmp rcx, qword [rsi + 0x108]
jge 0x14008106b
call fcn.1401bee78
mov edx, 4
lea rcx, [rbx - 4]
mov qword [rbx + 0xc], rax
mov r9, qword [rsi]
lea r8d, [rdx - 3]
call fcn.1401c1e14
mov eax, dword [rbx]
test eax, eax
je 0x140081043
mov r9, qword [rsi]
mov rcx, qword [rbx + 0xc]
mov edx, eax
mov r8d, 1
call fcn.1401c1e14
mov rcx, rsi
call fcn.140066b70
mov dword [rbx + 4], eax
mov ecx, dword [rbx - 4]
cmp ecx, dword [str.IEND]
je 0x140081067
add rbx, 0x18
cmp edi, 0x20
jl 0x140080ff0
lea eax, [rdi + 1]
jmp 0x14008106e
mov eax, edi
jmp 0x14008106e
lea eax, [rdi - 1]
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140081730
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 8
mov ebp, r8d
mov rsi, rcx
lea r8d, [rdx - 7]
lea rcx, [0x140213170]
call fcn.1401c24f8
test ebp, ebp
jle 0x1400817cf
mov qword [rsp + 0x30], rbx
lea rbx, [rdi + 4]
nop dword [rax]
mov eax, dword [rdi]
cmp eax, dword [str.CgBI]
je 0x1400817bd
mov ecx, dword [rbx]
mov rdx, rsi
call fcn.140067100
mov r9, qword [rsi]
mov edx, 4
lea r8d, [rdx - 3]
mov rcx, rdi
call fcn.1401c24f8
mov eax, dword [rbx]
test eax, eax
je 0x1400817b2
mov r9, qword [rsi]
mov rcx, qword [rbx + 0xc]
mov edx, eax
mov r8d, 1
call fcn.1401c24f8
mov ecx, dword [rbx + 4]
mov rdx, rsi
call fcn.140067100
add rdi, 0x18
add rbx, 0x18
dec rbp
jne 0x140081770
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400822c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x88
mov r15, rcx
mov ecx, 0x1000
mov r14, rdx
call fcn.1401bee78
mov rbp, rax
test rax, rax
jne 0x1400822f7
lea eax, [rbp + 1]
add rsp, 0x88
pop r15
pop r14
pop rbp
pop rbx
ret
mov ecx, 0x1000
mov qword [rsp + 0xb0], rsi
call fcn.1401bee78
mov rsi, rax
test rax, rax
jne 0x140082319
lea eax, [rsi + 1]
jmp 0x14008248c
lea rax, [0x1400e7320]
mov qword [rsp + 0x80], r13
xor r13d, r13d
mov qword [rsp + 0x50], rax
lea rax, [fcn.140169310]
lea rdx, [0x14021128c]
lea r8d, [r13 + 0x58]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x58], rax
call fcn.140150550
test eax, eax
je 0x140082363
movzx eax, r13w
jmp 0x140082484
mov rcx, qword [r15]
mov qword [rsp + 0xb8], rdi
movzx edi, r13w
call fcn.1401c1a94
test eax, eax
jne 0x14008245f
mov qword [rsp + 0xc0], r12
lea ebx, [rax + 1]
lea r12d, [rax + 4]
nop
test di, di
jne 0x140082457
mov r9, qword [r15]
mov r8d, 0x1000
mov rdx, rbx
mov rcx, rbp
call fcn.1401c1e14
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], eax
test eax, eax
je 0x140082447
nop
test di, di
jne 0x140082447
nop dword [rax]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r12
nop word [rax + rax]
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14014ec60
cmp eax, ebx
je 0x14008241e
cmp eax, 0xfffffffd
jne 0x140082408
lea rcx, [rsp + 0x20]
call fcn.140150710
test eax, eax
je 0x140082411
mov edi, r12d
jmp 0x14008241e
cmp eax, 0xfffffffb
je 0x14008241e
test eax, eax
jne 0x14008241a
cmp dword [rsp + 0x38], r13d
ja 0x1400823e0
jmp 0x14008241e
movzx edi, r12w
mov edx, dword [rsp + 0x3c]
mov r9, qword [r14]
mov r8, rbx
mov rcx, rsi
call fcn.1401c24f8
cmp dword [rsp + 0x38], r13d
jne 0x14008243c
test di, di
je 0x1400823d0
cmp dword [rsp + 0x28], r13d
ja 0x1400823c0
mov rcx, qword [r15]
call fcn.1401c1a94
test eax, eax
je 0x140082390
mov r12, qword [rsp + 0xc0]
mov rcx, rbp
call fcn.1401be23c
mov rcx, rsi
call fcn.1401be23c
lea rcx, [rsp + 0x20]
call fcn.140150410
movzx eax, di
mov rdi, qword [rsp + 0xb8]
mov r13, qword [rsp + 0x80]
mov rsi, qword [rsp + 0xb0]
add rsp, 0x88
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x140082860
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0x90]
mov r15, qword [rsp + 0x98]
mov edx, 6
mov rsi, r9
mov r9, qword [rcx]
mov rdi, r8
mov rbx, rcx
lea r8d, [rdx - 5]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
je 0x140082914
mov eax, dword [rsp + 0x20]
cmp eax, dword [str.SIMISA]
jne 0x140082914
movzx eax, word [rsp + 0x24]
cmp ax, word [0x14021339c]
jne 0x140082914
mov edx, 0xa
mov rcx, rbx
call fcn.140066ff0
mov rcx, rbx
call fcn.140066b20
mov rcx, rbx
call fcn.140066b20
mov rcx, rbx
mov dword [r15], eax
call fcn.140066b20
mov rcx, rbx
mov dword [rdi], eax
call fcn.140066b20
mov rcx, rbx
mov dword [rsi], eax
call fcn.140066b20
mov rcx, rbx
call fcn.140066b20
mov dword [r14], eax
xor eax, eax
jmp 0x140082919
mov eax, 2
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140089430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xf30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xf20], rax
mov r9, qword [rcx]
mov rbx, rdx
mov edi, 1
lea rcx, [rsp + 0x20]
mov edx, 0xf00
mov r8d, edi
call fcn.1401c1e14
cmp rax, rdi
je 0x140089475
xor eax, eax
jmp 0x1400894be
lea rdx, str.PCD_OPA
lea rcx, [rsp + 0x20]
mov r8d, 7
call fcn.1401c25f0
test eax, eax
je 0x1400894ae
lea rdx, [0x140219e80]
lea rcx, [rsp + 0x820]
mov r8d, 3
call fcn.1401c25f0
test eax, eax
jne 0x140089471
movzx ecx, byte [rsp + 0xe22]
movzx eax, di
and cl, 3
mov byte [rbx], cl
mov rcx, qword [rsp + 0xf20]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0xf50]
add rsp, 0xf30
pop rdi
ret

Function at 0x14008a530
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, qword [rsp + 0x90]
mov r14d, r9d
mov esi, r8d
mov rcx, r15
mov r13d, edx
xor ebx, ebx
call fcn.140066b70
mov rcx, r15
call fcn.140066b70
mov rcx, qword [r15]
call fcn.1401c2310
mov rcx, r15
call fcn.140066b70
mov rcx, r15
call fcn.140066b70
mov rcx, r15
mov dword [rsp + 0x90], eax
call fcn.140066b70
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.140066b70
mov rcx, r15
mov r12d, eax
call fcn.140066b70
mov rcx, r15
mov ebp, eax
call fcn.140066de0
mov rcx, qword [r15]
movzx edi, ax
call fcn.1401c3f28
mov dword [rsp + 0x28], eax
cmp edi, 8
je 0x14008a5d5
lea eax, [rbx + 2]
jmp 0x14008a6f5
sub ebp, dword [rsp + 0x20]
sub r12d, dword [rsp + 0x90]
mov eax, esi
cmp ebp, esi
mov dword [rsp + 0x90], r12d
cmovg eax, ebp
add eax, 0x400
movsxd rcx, eax
call fcn.1401bee78
mov r12, qword [rsp + 0x98]
mov edi, ebx
mov rsi, rax
cmp dword [rsp + 0x90], ebx
jle 0x14008a6a6
movsxd rax, dword [rsp + 0x28]
mov qword [rsp + 0x28], rax
test rax, rax
jne 0x14008a645
mov r9, qword [r15]
lea r8d, [rax + 1]
movsxd rdx, ebp
mov rcx, rsi
call fcn.1401c1e14
cmp rax, 1
je 0x14008a656
mov eax, 4
jmp 0x14008a653
mov r8d, ebp
mov rdx, rsi
mov rcx, r15
call fcn.1401385b0
movzx ebx, ax
cmp edi, r14d
jge 0x14008a692
movsxd r8, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
call fcn.1401bd6e0
test bx, bx
jne 0x14008a6a6
mov r9d, 1
or r8d, 0xffffffff
mov edx, r13d
mov rcx, r12
call fcn.1400615b0
movzx ebx, ax
test ax, ax
jne 0x14008a6a6
mov rax, qword [rsp + 0x28]
inc edi
cmp edi, dword [rsp + 0x90]
jl 0x14008a621
movsxd r8, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor edx, edx
call fcn.1401c0040
cmp edi, r14d
jge 0x14008a6ea
sub r14d, edi
mov edi, r14d
nop word [rax + rax]
mov r9d, 1
or r8d, 0xffffffff
mov edx, r13d
mov rcx, r12
call fcn.1400615b0
dec rdi
jne 0x14008a6d0
mov rcx, rsi
call fcn.1401be23c
movzx eax, bx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14008beb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, rdx
mov edx, 1
mov rsi, rcx
lea r8d, [rdx + 3]
mov rcx, rdi
call fcn.1401c1e14
cmp byte [rdi], 0x53
je 0x14008befb
cmp byte [rdi + 1], 0x80
je 0x14008befb
movzx eax, byte [rdi + 2]
cmp al, 0xf6
je 0x14008befb
cmp al, 0x34
je 0x14008befb
mov eax, 2
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140066960
test ax, ax
jne 0x14008beeb
movsd xmm0, qword [rsp + 0x30]
mov edx, 1
lea rcx, [rdi + 8]
cvtpd2ps xmm0, xmm0
lea r8d, [rdx + 0x4f]
mov qword [rsp + 0x38], rbx
movss dword [rdi + 4], xmm0
mov r9, qword [rsi]
call fcn.1401c1e14
mov r9, qword [rsi]
mov edx, 1
lea r8d, [rdx + 3]
lea rcx, [rdi + 0x58]
call fcn.1401c1e14
lea rdx, str.PICT
lea rcx, [rdi + 0x58]
mov r8d, 4
call fcn.1401c25f0
mov rbx, qword [rsp + 0x38]
test eax, eax
jne 0x14008beeb
mov rcx, rsi
call fcn.140066de0
mov rcx, rsi
mov word [rdi + 0x5c], ax
call fcn.140066de0
lea rdx, [rsp + 0x30]
mov rcx, rsi
mov word [rdi + 0x5e], ax
call fcn.140066960
test ax, ax
jne 0x14008beeb
movsd xmm0, qword [rsp + 0x30]
mov rcx, rsi
cvtpd2ps xmm0, xmm0
movss dword [rdi + 0x60], xmm0
call fcn.140066de0
mov edx, 1
lea rcx, [rdi + 0x66]
mov word [rdi + 0x64], ax
mov r9, qword [rsi]
lea r8d, [rdx + 1]
call fcn.1401c1e14
mov rcx, qword [rsi]
call fcn.1401c1a94
mov rsi, qword [rsp + 0x40]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x14008bff0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rsp + 0x70]
xor r13d, r13d
mov rsi, r9
mov word [r8], r13w
mov word [r9], r13w
mov rbx, r8
mov word [r14], r13w
mov rdi, rdx
mov r15, rcx
lea ebp, [r13 + 1]
lea r12d, [r13 + 4]
movzx ecx, word [rbx]
test cx, cx
je 0x14008c047
movsx rax, cx
cmp byte [rdi + rax*4 - 4], bpl
jne 0x14008c084
mov r9, qword [r15]
movsx rax, cx
mov r8, rbp
lea rcx, [rdi + rax*4]
mov rdx, r12
call fcn.1401c1e14
test rax, rax
je 0x14008c08a
movsx rax, word [rbx]
test byte [rdi + rax*4 + 3], 0x10
je 0x14008c071
mov word [r14], bp
movsx rax, word [rbx]
test byte [rdi + rax*4 + 2], 2
je 0x14008c07f
mov word [rsi], bp
inc word [rbx]
jmp 0x14008c034
movzx eax, r13w
jmp 0x14008c08e
movzx eax, r12w
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14008c0b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x120], rax
xor r12d, r12d
mov rbx, r8
mov r15d, edx
mov r14, rcx
mov esi, r12d
test edx, edx
jle 0x14008c1df
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
cmp rax, 1
jne 0x14008c20f
movzx eax, byte [rsp + 0x20]
test al, al
jns 0x14008c190
movzx edi, al
and edi, 0x7f
jne 0x14008c155
mov r9, qword [r14]
lea edx, [rdi + 2]
lea r8d, [rdi + 1]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
movzx edi, byte [rsp + 0x20]
movzx eax, byte [rsp + 0x21]
shl edi, 8
or edi, eax
jmp 0x14008c157
inc edi
mov r9, qword [r14]
mov edx, 1
lea rcx, [rsp + 0x20]
mov r8d, edx
call fcn.1401c1e14
test edi, edi
jle 0x14008c18c
movzx ecx, byte [rsp + 0x20]
mov eax, edi
nop word [rax + rax]
mov byte [rbx + 3], cl
add rbx, 4
dec rax
jne 0x14008c180
add esi, edi
jmp 0x14008c1d6
mov r9, qword [r14]
movzx ebp, al
lea rcx, [rsp + 0x20]
and ebp, 0x7f
mov r8d, 1
inc ebp
movsxd rdi, ebp
mov rdx, rdi
call fcn.1401c1e14
mov rcx, r12
test ebp, ebp
jle 0x14008c1d4
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
inc rcx
add rbx, 4
mov byte [rbx - 1], al
cmp rcx, rdi
jl 0x14008c1c0
add esi, ebp
cmp esi, r15d
jl 0x14008c100
movzx eax, r12w
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1401bd600
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov eax, 4
jmp 0x14008c1e3