joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e810
Capabilities:
Check for time delay via queryperformancecounter
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov r13, rdx
mov rbp, r8
mov r12d, r9d
movsxd rbx, ecx
test r14, r14
je 0x43e994
movsxd rax, dword [r14 + 0x4e808]
mov byte [r14 + 0x4e811], 1
lea rcx, [r14 + rax*8 + 0x27708]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdx, r13
mov r9d, r12d
mov r8d, ebp
mov rcx, rbx
mov rdi, qword [sym.imp.WS2_32.dll_send]
call rdi
movsxd r15, eax
movsxd rax, dword [r14 + 0x4e808]
mov rdx, rax
mov qword [r14 + rax*8 + 0x3af88], r15
lea eax, [rax + 1]
cmp edx, 0x2710
mov edx, 0
cmove eax, edx
add qword [r14 + 0x4e820], r15
mov dword [r14 + 0x4e808], eax
test r15, r15
jle 0x43e981
test rsi, rsi
je 0x43e8c2
cmp byte [rsi + 0x13], 0
je 0x43e981
cmp rbp, r15
jle 0x43e9b0
lea rax, [r14 + 0x27708]
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0x38], rax
jmp 0x43e95c
movsxd rax, dword [r14 + 0x4e808]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rdx
lea rcx, [rcx + rax*8]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
mov r9d, r12d
mov r8d, dword [rsp + 0x30]
call rdi
movsxd rdx, dword [r14 + 0x4e808]
cdqe
mov rcx, rdx
mov qword [r14 + rdx*8 + 0x3af88], rax
lea edx, [rdx + 1]
cmp ecx, 0x2710
mov ecx, 0
cmove edx, ecx
add qword [r14 + 0x4e820], rax
test rax, rax
mov dword [r14 + 0x4e808], edx
jle 0x43e981
test rsi, rsi
je 0x43e954
cmp byte [rsi + 0x13], 0
je 0x43e9b0
add r15, rax
cmp r15, rbp
jge 0x43e9b0
mov r8d, dword [rsp + 0x34]
lea rdx, [r13 + r15]
sub r8d, r15d
test r14, r14
jne 0x43e8e0
mov r9d, r12d
mov rcx, rbx
call rdi
cdqe
test rax, rax
jg 0x43e949
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdi, qword [sym.imp.WS2_32.dll_send]
call rdi
movsxd r15, eax
jmp 0x43e8aa
test r14, r14
mov eax, 1
je 0x43e983
mov byte [r14 + 0x4e811], 0
jmp 0x43e983
Function at 0x43eab0
Capabilities:
Check for time delay via queryperformancecounter
Receive data
Receive data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov r14, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xb8]
mov r13, rdx
mov rbp, r8
mov r12d, r9d
movsxd rbx, ecx
test r14, r14
je 0x43ec34
movsxd rax, dword [r14 + 0x27700]
mov byte [r14 + 0x4e810], 1
lea rcx, [r14 + rax*8 + 0x600]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdx, r13
mov r9d, r12d
mov r8d, ebp
mov rcx, rbx
mov rdi, qword [sym.imp.WS2_32.dll_recv]
call rdi
movsxd r15, eax
movsxd rax, dword [r14 + 0x27700]
mov rdx, rax
mov qword [r14 + rax*8 + 0x13e80], r15
lea eax, [rax + 1]
cmp edx, 0x2710
mov edx, 0
cmove eax, edx
add qword [r14 + 0x4e818], r15
mov dword [r14 + 0x27700], eax
test r15, r15
jle 0x43ec21
test rsi, rsi
je 0x43eb62
cmp byte [rsi + 0x13], 0
je 0x43ec21
cmp rbp, r15
jle 0x43ec50
lea rax, [r14 + 0x600]
mov dword [rsp + 0x34], ebp
mov qword [rsp + 0x38], rax
jmp 0x43ebfc
movsxd rax, dword [r14 + 0x27700]
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x28], rdx
lea rcx, [rcx + rax*8]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
mov r9d, r12d
mov r8d, dword [rsp + 0x30]
call rdi
movsxd rdx, dword [r14 + 0x27700]
cdqe
mov rcx, rdx
mov qword [r14 + rdx*8 + 0x13e80], rax
lea edx, [rdx + 1]
cmp ecx, 0x2710
mov ecx, 0
cmove edx, ecx
add qword [r14 + 0x4e818], rax
test rax, rax
mov dword [r14 + 0x27700], edx
jle 0x43ec21
test rsi, rsi
je 0x43ebf4
cmp byte [rsi + 0x13], 0
je 0x43ec50
add r15, rax
cmp r15, rbp
jge 0x43ec50
mov r8d, dword [rsp + 0x34]
lea rdx, [r13 + r15]
sub r8d, r15d
test r14, r14
jne 0x43eb80
mov r9d, r12d
mov rcx, rbx
call rdi
cdqe
test rax, rax
jg 0x43ebe9
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdi, qword [sym.imp.WS2_32.dll_recv]
call rdi
movsxd r15, eax
jmp 0x43eb4a
test r14, r14
mov eax, 1
je 0x43ec23
mov byte [r14 + 0x4e810], 0
jmp 0x43ec23
Function at 0x442e70
Capabilities:
Encode data using xor

Disassembly:
push r12
xor r9d, r9d
mov r10, rdx
mov rax, qword [rcx + r9]
mov rdx, qword [rcx + r9 + 8]
xor rax, qword [r10 + r9]
xor rdx, qword [r10 + r9 + 8]
add r9, 0x10
mul rdx
xor rax, rdx
add r8, rax
cmp r9, 0x40
jne 0x442e78
mov rax, r8
shr rax, 0x25
xor r8, rax
movabs rax, 0x165667919e3779f9
imul r8, rax
mov rax, r8
shr rax, 0x20
xor rax, r8
pop r12
ret
Function at 0x4430b0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movabs rbx, 0x9e3779b185ebca87
mov rdi, qword [rsp + 0x90]
lea eax, [r8 + 0x1f]
test r8d, r8d
lea rsi, [rdx + 0x80]
mov qword [rsp + 0x70], rcx
mov r12, rdx
mov rcx, r9
cmovns eax, r8d
mov r15, rdx
xor r14d, r14d
imul rbx, r8
sar eax, 5
mov dword [rsp + 0x1c], eax
mov rax, qword [rcx]
mov r10, qword [r15]
add r15, 0x20
mov r11, qword [r15 - 0x18]
mov r13, qword [r15 - 0x10]
add rcx, 0x20
add rax, rdi
xor rax, r10
mov rbp, rax
mov rax, qword [rcx - 0x18]
sub rax, rdi
xor rax, r11
mul rbp
mov rbp, qword [r15 - 8]
mov qword [rsp], rax
mov rax, qword [rsp]
xor rax, rdx
add rax, rbx
lea rbx, [r13 + rbp]
xor rbx, rax
mov rax, qword [rcx - 0x10]
add rax, rdi
xor r13, rax
mov rax, qword [rcx - 8]
sub rax, rdi
xor rbp, rax
mov rax, rbp
mul r13
mov qword [rsp], rax
mov rax, qword [rsp]
mov qword [rsp + 8], rdx
xor rax, rdx
add rax, r14
lea r14, [r10 + r11]
xor r14, rax
cmp rsi, r15
jne 0x443100
mov rax, rbx
movabs r11, 0x165667919e3779f9
mov r13, r14
shr rax, 0x25
shr r13, 0x25
xor rbx, rax
xor r14, r13
imul rbx, r11
imul r14, r11
mov rax, rbx
shr rax, 0x20
mov r11, r14
xor rbx, rax
mov eax, dword [rsp + 0x1c]
shr r11, 0x20
xor r11, r14
cmp eax, 4
jle 0x443257
sub eax, 5
lea rbp, [r9 + 3]
shl rax, 5
lea r13, [r12 + rax + 0xa0]
nop dword [rax]
mov rax, qword [rbp]
mov rcx, qword [rsi]
add rsi, 0x20
mov r10, qword [rsi - 0x18]
mov r14, qword [rsi - 8]
add rbp, 0x20
add rax, rdi
xor rax, rcx
mov r15, rax
mov rax, qword [rbp - 0x18]
sub rax, rdi
xor rax, r10
mul r15
mov r15, qword [rsi - 0x10]
mov qword [rsp], rax
mov rax, qword [rsp]
mov qword [rsp + 8], rdx
xor rax, rdx
add rax, rbx
lea rbx, [r15 + r14]
xor rbx, rax
mov rax, qword [rbp - 0x10]
add rax, rdi
xor r15, rax
mov rax, qword [rbp - 8]
sub rax, rdi
xor r14, rax
mov rax, r14
mul r15
xor rax, rdx
add rax, r11
lea r11, [rcx + r10]
xor r11, rax
cmp r13, rsi
jne 0x4431e0
lea rax, [r12 + r8 - 0x10]
mov rdx, qword [r9 + 0x6f]
lea r10, [r12 + r8 - 0x20]
sub r8, rdi
mov rcx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, qword [r9 + 0x67]
add rdx, rdi
mov rbp, qword [r10]
mov r10, qword [r10 + 8]
xor rdx, rsi
sub rax, rdi
xor rax, rcx
mul rdx
xor rax, rdx
mov rdx, qword [r9 + 0x7f]
add rax, rbx
lea rbx, [rbp + r10]
xor rbx, rax
mov rax, qword [r9 + 0x77]
add rdx, rdi
xor r10, rdx
sub rax, rdi
xor rax, rbp
mul r10
xor rax, rdx
movabs rdx, 0x9e3779b185ebca87
add rax, r11
lea r11, [rcx + rsi]
xor rax, r11
movabs r11, 0x85ebca77c2b2ae63
lea rcx, [rbx + rax]
imul rbx, rdx
movabs rdx, 0xc2b2ae3d27d4eb4f
imul rax, r11
imul r8, rdx
mov rdx, rcx
shr rdx, 0x25
xor rdx, rcx
add rax, rbx
movabs rbx, 0x165667919e3779f9
imul rdx, rbx
add r8, rax
mov rax, r8
shr rax, 0x25
xor r8, rax
mov rax, rdx
imul r8, rbx
shr rax, 0x20
xor rdx, rax
mov rax, qword [rsp + 0x70]
mov qword [rax], rdx
mov rax, r8
shr rax, 0x20
xor r8, rax
mov rax, qword [rsp + 0x70]
neg r8
mov qword [rax + 8], r8
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x443630
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov eax, 0xc2b2ae3d
mov qword [rsp + 0x20], rax
movabs rax, 0x9e3779b185ebca87
lea r12, [r8 - 1]
mov qword [rsp + 0x28], rax
movabs rax, 0xc2b2ae3d27d4eb4f
mov rsi, rcx
mov qword [rsp + 0x30], rax
movabs rax, 0x165667b19e3779f9
mov rbx, r8
mov qword [rsp + 0x38], rax
movabs rax, 0x85ebca77c2b2ae63
lea r11, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov eax, 0x85ebca77
mov qword [rsp + 0x48], rax
movabs rax, 0x27d4eb2f165667c5
mov qword [rsp + 0x50], rax
mov eax, 0x9e3779b1
mov qword [rsp + 0x58], rax
mov rax, r12
shr rax, 0xa
test rax, rax
je 0x443790
lea rdi, [rdx + 0x180]
shl rax, 0xa
lea r10, [0x00543c00]
lea r11, [rsp + 0x20]
movdqa xmm3, xmmword [0x00543c40]
lea rbp, [rdi + rax]
lea rcx, [0x00543b80]
mov r9, rdi
nop
lea r8, [r9 - 0x180]
xor eax, eax
prefetcht0 byte [r9]
movdqu xmm1, xmmword [r8 + rax]
movdqu xmm0, xmmword [rcx + rax]
pxor xmm0, xmm1
pshufd xmm1, xmm1, 0x4e
pshufd xmm2, xmm0, 0x31
pmuludq xmm0, xmm2
paddq xmm0, xmm1
paddq xmm0, xmmword [r11 + rax]
movaps xmmword [r11 + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x4436fd
add rcx, 8
add r9, 0x40
cmp r10, rcx
jne 0x4436f0
xor eax, eax
movdqa xmm0, xmmword [r11 + rax]
movdqa xmm1, xmm0
pxor xmm0, xmmword [r10 + rax]
psrlq xmm1, 0x2f
pxor xmm0, xmm1
pshufd xmm1, xmm0, 0x31
pmuludq xmm0, xmm3
pmuludq xmm1, xmm3
psllq xmm1, 0x20
paddq xmm0, xmm1
movaps xmmword [r11 + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x443742
add rdi, 0x400
cmp rbp, rdi
jne 0x4436e5
mov rax, r12
and rax, 0xfffffffffffffc00
sub r12, rax
shr r12, 6
test r12, r12
je 0x443810
lea rcx, [0x00543b80]
lea r9, [rdx + rax + 0x180]
lea r10, [rcx + r12*8]
nop dword [rax + rax]
lea r8, [r9 - 0x180]
xor eax, eax
prefetcht0 byte [r9]
movdqu xmm1, xmmword [r8 + rax]
movdqu xmm0, xmmword [rcx + rax]
pxor xmm0, xmm1
pshufd xmm1, xmm1, 0x4e
pshufd xmm2, xmm0, 0x31
pmuludq xmm0, xmm2
paddq xmm0, xmm1
paddq xmm0, xmmword [r11 + rax]
movaps xmmword [r11 + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x4437cd
add rcx, 8
add r9, 0x40
cmp r10, rcx
jne 0x4437c0
lea rcx, [rdx + rbx]
lea rdx, [0x00543bf9]
xor eax, eax
movdqu xmm1, xmmword [rcx + rax - 0x40]
movdqu xmm0, xmmword [rdx + rax]
pxor xmm0, xmm1
pshufd xmm1, xmm1, 0x4e
pshufd xmm2, xmm0, 0x31
pmuludq xmm0, xmm2
paddq xmm0, xmm1
paddq xmm0, xmmword [r11 + rax]
movaps xmmword [r11 + rax], xmm0
add rax, 0x10
cmp rax, 0x40
jne 0x44381d
movabs r8, 0x9e3779b185ebca87
lea rdx, [0x00543b8b]
mov rcx, r11
imul r8, rbx
call fcn.00442e70
movabs r8, 0xc2b2ae3d27d4eb4f
lea rdx, [0x00543bf5]
mov rdi, rax
imul r8, rbx
not r8
call fcn.00442e70
mov qword [rsi + 8], rax
mov rax, rsi
mov qword [rsi], rdi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x467f40
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
xor esi, esi
test r8, r8
mov r12, rcx
mov qword [rsp + 0x88], rdx
mov r13, r8
mov rdi, rdx
je 0x468053
nop dword [rax]
lea rax, [rsi + 1]
movzx ecx, byte [rdi]
cmp rax, r13
jae 0x468080
movzx r15d, byte [rdi + 1]
lea rax, [rsi + 2]
and r15d, 0x7f
cmp r13, rax
jbe 0x468090
movzx ebx, byte [rdi + 2]
and ebx, 0x7f
lea rax, [rsi + 3]
cmp rax, r13
jae 0x468070
movzx r14d, byte [rdi + 3]
and r14d, 0x7f
mov qword [rsp + 0x28], r9
and ecx, 0x7f
add rsi, 4
call r12
mov ecx, r15d
mov ebp, eax
add rdi, 4
call r12
mov r15d, eax
mov ecx, ebx
shl ebp, 2
call r12
mov ecx, r14d
mov ebx, eax
call r12
mov edx, r15d
mov r9, qword [rsp + 0x28]
shl r15d, 4
shr dl, 4
and eax, 0x3f
and edx, 3
or ebp, edx
mov edx, ebx
shl ebx, 6
shr dl, 2
or ebx, eax
mov byte [r9], bpl
and edx, 0xf
mov byte [r9 + 2], bl
add r9, 3
or r15d, edx
mov byte [r9 - 2], r15b
cmp r13, rsi
ja 0x467f70
mov rdi, qword [rsp + 0x88]
xor eax, eax
cmp byte [rdi], 0x3d
je 0x468053
add rax, 1
cmp r13, rax
je 0x4680a0
mov rsi, qword [rsp + 0x88]
cmp byte [rsi + rax], 0x3d
jne 0x46802f
lea rax, [rax + rax*2]
add rax, rax
shr rax, 3
jmp 0x468055
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r14d, r14d
jmp 0x467fb3
lea rax, [rsi + 2]
xor r15d, r15d
cmp r13, rax
ja 0x467f96
xor ebx, ebx
jmp 0x467f9d
lea rax, [r13 + r13*2]
add rax, rax
shr rax, 3
jmp 0x468055
Function at 0x4680b0
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test r8, r8
mov rbp, rcx
mov r15, rdx
mov r13, r8
mov qword [rsp + 0x98], r9
je 0x468222
mov rdx, r9
xor esi, esi
nop
lea rax, [rsi + 1]
movzx ebx, byte [r15 + rsi]
cmp r13, rax
jbe 0x468230
movzx r9d, byte [r15 + rsi + 1]
lea rax, [rsi + 2]
mov r14d, r9d
shl r9d, 2
shr r14b, 4
and r9d, 0x3c
cmp r13, rax
jbe 0x468243
movzx edi, byte [r15 + rsi + 2]
mov eax, edi
and edi, 0x3f
shr al, 6
or r9d, eax
mov ecx, ebx
shl ebx, 4
mov qword [rsp + 0x20], rdx
shr cl, 2
mov byte [rsp + 0x2f], r9b
add rsi, 3
movzx ecx, cl
call rbp
mov ecx, ebx
mov r12d, eax
and ecx, 0x30
and r12d, 0x7f
or r14d, ecx
movsx ecx, r14b
call rbp
movsx ecx, byte [rsp + 0x2f]
mov r14d, eax
call rbp
mov ecx, edi
mov ebx, eax
and r14d, 0x7f
call rbp
mov rdx, qword [rsp + 0x20]
and ebx, 0x7f
and eax, 0x7f
mov byte [rdx], r12b
mov byte [rdx + 1], r14b
add rdx, 4
mov byte [rdx - 2], bl
mov byte [rdx - 1], al
cmp r13, rsi
ja 0x4680e0
test r13, r13
js 0x468200
pxor xmm0, xmm0
cvtsi2sd xmm0, r13
addsd xmm0, qword [0x005464b0]
mulsd xmm0, qword [0x005464b8]
divsd xmm0, qword [0x005464c8]
cvttsd2si eax, xmm0
test al, 3
je 0x4681e4
add eax, 1
movsxd rdx, eax
mov rax, qword [rsp + 0x98]
lea r8, [rax - 1]
nop
mov ecx, edx
mov byte [r8 + rdx], 0x3d
mov eax, edx
and ecx, 3
add rdx, 1
test ecx, ecx
jne 0x4681d0
cdqe
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rax, r13
mov r8, r13
pxor xmm0, xmm0
shr rax, 1
and r8d, 1
or rax, r8
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
jmp 0x46819c
xor eax, eax
jmp 0x4681e4
lea rax, [rsi + 2]
xor r9d, r9d
xor r14d, r14d
cmp r13, rax
ja 0x468114
xor edi, edi
jmp 0x468125

Function at 0x468540
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rcx + 0x40], 0
mov rsi, rcx
mov rbx, rdx
je 0x4685f5
test r8d, r8d
je 0x468600
movzx eax, byte [rdx]
lea edx, [rax - 0x20]
cmp dl, 0x5f
ja 0x468620
cmp al, 0x3a
je 0x468620
lea edx, [r8 - 1]
lea rax, [rbx + 1]
lea r9, [rbx + rdx + 1]
mov rdi, rdx
nop dword [rax + rax]
cmp rax, r9
je 0x468600
movzx ecx, byte [rax]
lea r10d, [rcx - 0x20]
cmp r10b, 0x5f
ja 0x4685ab
add rax, 1
cmp cl, 0x3a
jne 0x468590
lea rdx, str._HEX_
lea rbp, [rbx + rdi + 1]
lea rdi, [0x005464d0]
mov rcx, rsi
call fcn.004773c0
movzx r8d, byte [rbx]
mov rdx, rdi
mov rcx, rsi
add rbx, 1
call fcn.004773c0
cmp rbp, rbx
jne 0x4685c6
lea rdx, [0x005464d5]
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.004773c0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov edx, r8d
mov r9, rsi
mov r8d, 1
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.00476c60
lea edi, [r8 - 1]
jmp 0x4685ab
Function at 0x468630
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, qword [rcx + 0x20]
mov r12d, dword [rsp + 0xa0]
mov r10, rdx
mov edi, r8d
mov rsi, rcx
mov rbp, r9
mov rdx, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xb0]
cmp byte [rbx + 0x40], 0
je 0x4686d0
mov r15d, dword [rbx + 0x50]
mov r14, qword [rcx + 0xc0]
mov r13, qword [rcx + 0xd0]
lea eax, [r15 - 2]
cmp eax, 3
jbe 0x4686e1
mov edx, edi
mov r9, rbx
mov r8d, 1
mov rcx, r10
call fcn.00476c60
lea eax, [r15 - 4]
cmp eax, 1
jbe 0x468713
lea rcx, [0x005464ef]
mov r9, rbx
mov r8d, 1
mov edx, 2
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.00476c60
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov qword [rsp + 0x28], r10
call fcn.00468540
lea eax, [r15 - 3]
mov r10, qword [rsp + 0x28]
cmp eax, 2
ja 0x468689
mov rdx, rbx
mov ecx, 0x3a
call fcn.00476fd0
mov r10, qword [rsp + 0x28]
jmp 0x468689
mov rdx, rbx
mov ecx, 0x3a
call fcn.00476fd0
mov rcx, qword [rsi + 0x20]
mov r8d, r12d
mov rdx, rbp
call fcn.00468540
cmp r15d, 5
jne 0x4686a5
mov rdx, rbx
mov ecx, 0x3a
call fcn.00476fd0
mov eax, dword [r13 + 0xc]
cmp eax, 2
je 0x468784
cmp eax, 1
je 0x468770
lea rdx, str._none_
mov rcx, rbx
call fcn.004773c0
jmp 0x4686a5
lea rdx, str._stdin_
mov rcx, rbx
call fcn.004773c0
jmp 0x4686a5
mov r8, qword [r14 + 0x28]
lea rdx, [0x005464dd]
mov rcx, rbx
call fcn.004773c0
jmp 0x4686a5
Function at 0x472dd0
Capabilities:
Link many functions at runtime

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x88]
mov rsi, rcx
lea rcx, str.hiprtc.dll
mov rbx, qword [rax + 0x38]
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0
mov qword [rbx + 0x40], 0
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
mov rcx, rax
mov qword [rbx], rax
je 0x472f30
lea rdx, str.hiprtcCompileProgram
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 8], rax
je 0x472f6d
mov rcx, qword [rbx]
lea rdx, str.hiprtcCreateProgram
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x10], rax
je 0x472f91
mov rcx, qword [rbx]
lea rdx, str.hiprtcDestroyProgram
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x18], rax
je 0x472fb8
mov rcx, qword [rbx]
lea rdx, str.hiprtcGetCode
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x20], rax
je 0x473006
mov rcx, qword [rbx]
lea rdx, str.hiprtcGetCodeSize
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x28], rax
je 0x472fdf
mov rcx, qword [rbx]
lea rdx, str.hiprtcGetProgramLog
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x30], rax
je 0x47302d
mov rcx, qword [rbx]
lea rdx, str.hiprtcGetProgramLogSize
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x38], rax
je 0x473054
mov rcx, qword [rbx]
lea rdx, str.hiprtcGetErrorString
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
mov qword [rbx + 0x40], rax
je 0x47307b
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.contrib_bin_win64_hiprtc0503.dll
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
mov rcx, rax
mov qword [rbx], rax
jne 0x472e46
lea rcx, str.amdhip64.dll
call sub.KERNEL32.dll_LoadLibraryA
mov rcx, rax
mov qword [rbx], rax
mov eax, 0xffffffff
test rcx, rcx
jne 0x472e46
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcCompileProgram
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcCreateProgram
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcDestroyProgram
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcGetCodeSize
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcGetCode
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcGetProgramLog
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcGetProgramLogSize
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
lea r9, str.HIPRTC
lea r8, str.hiprtcGetErrorString
lea rdx, [0x00548890]
mov rcx, rsi
call fcn.00403390
mov eax, 0xffffffff
jmp 0x472f25
Function at 0x476150
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov r13, r9
mov r9, qword [r9 + 8]
mov rbx, rcx
mov rdi, rdx
mov rsi, r8
test r9, r9
je 0x4761e5
mov rbp, rdx
xor r12d, r12d
mov r14d, 0x400000
imul rbp, r8
cmp rbp, 0x400000
ja 0x4761a2
call sub.msvcrt.dll_fread
jmp 0x4761d4
test rbp, rbp
je 0x476260
mov r9, qword [r13 + 8]
cmp rbp, 0x400000
mov r15, r14
lea rcx, [rbx + r12]
cmovbe r15, rbp
mov edx, 1
mov r8, r15
call sub.msvcrt.dll_fread
add r12, rax
sub rbp, rax
cmp r15, rax
je 0x476195
mov rax, r12
xor edx, edx
div rdi
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r9, qword [r13 + 0x10]
test r9, r9
jne 0x476270
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x476280
mov rbp, rdx
xor r12d, r12d
mov r14d, 0x7fffffff
imul rbp, r8
jmp 0x476228
movsxd rdx, eax
add r12, rdx
sub rbp, rdx
cmp r15d, eax
jne 0x4761cc
test rbp, rbp
je 0x476260
mov rcx, qword [r13 + 0x18]
cmp rbp, 0x7fffffff
mov r15, r14
lea rdx, [rbx + r12]
cmovbe r15, rbp
mov r8d, r15d
call fcn.0051aa90
test eax, eax
jns 0x476211
mov rax, 0xffffffffffffffff
jmp 0x4761d4
mov rsi, qword [rsp + 0xd0]
nop word [rax + rax]
mov rax, rsi
jmp 0x4761d4
call fcn.00517660
jmp 0x4761d4
mov r15, qword [r13 + 0x20]
test r15, r15
je 0x476246
lea rcx, [r15 + 0x40]
mov rbp, rdx
lea rax, [r15 + 0x88]
lea r12, [rsp + 0x60]
lea rdx, [rsp + 0x68]
xor r14d, r14d
mov qword [rsp + 0x40], rcx
lea rcx, [r15 + 0x58]
mov qword [rsp + 0xc8], rdi
imul rbp, r8
mov qword [rsp + 0xd0], rsi
mov r8, qword [r15 + 0x48]
mov rsi, r14
lea r13, [rsp + 0x5c]
mov r14, r15
mov qword [rsp + 0x48], rcx
mov r15, r12
mov rdi, rdx
mov r12, rbx
mov rbx, rax
jmp 0x476370
sub rax, r8
mov rdx, rbp
lea r9, [rcx + r8]
sub rdx, rsi
test rax, rax
mov qword [rsp + 0x60], rax
sete al
mov qword [rsp + 0x68], rdx
lea rdx, [r12 + rsi]
movzx eax, al
mov r8, rdi
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov rcx, rbx
mov qword [rsp + 0x20], r15
call fcn.00514670
mov rdx, qword [rsp + 0x60]
mov r8, qword [r14 + 0x48]
add qword [r14 + 0x50], rdx
add r8, rdx
test eax, eax
mov qword [r14 + 0x48], r8
jne 0x476246
test rdx, rdx
mov rax, qword [rsp + 0x68]
jne 0x476360
test rax, rax
je 0x4763d0
add rsi, rax
add qword [r14 + 0x78], rax
cmp rbp, rsi
jbe 0x47624f
mov rax, qword [r14 + 0x40]
mov rcx, qword [r14 + 0x30]
cmp rax, r8
jne 0x4762f0
cmp byte [r14 + 0x38], 0
jne 0x4763c8
mov rdx, rcx
mov qword [r14 + 0x48], 0
mov qword [r14 + 0x40], 0x40000
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [r14 + 0x58]
test eax, eax
mov rax, qword [r14 + 0x40]
jne 0x4763b6
test rax, rax
jne 0x4763bb
mov byte [r14 + 0x38], 1
mov r8, qword [r14 + 0x48]
mov rcx, qword [r14 + 0x30]
jmp 0x4762f0
mov rax, r8
jmp 0x4762f0
mov rdi, qword [rsp + 0xc8]
mov rax, rsi
xor edx, edx
div rdi
jmp 0x4761d4
Function at 0x476c30
Capabilities:
Read file on windows

Disassembly:
test rcx, rcx
je 0x476c53
test r9, r9
je 0x476c53
test rdx, rdx
je 0x476c50
test r8, r8
je 0x476c50
jmp fcn.00476150
xor eax, eax
ret
mov rax, 0xffffffffffffffff
ret

Function at 0x476c60
Capabilities:
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov r12, rcx
mov rbp, r8
mov r13, r9
je 0x476d03
test r9, r9
je 0x476d03
test rdx, rdx
je 0x476d20
test r8, r8
je 0x476d20
mov r9, qword [r9 + 8]
test r9, r9
je 0x476d31
mov rbx, rdx
xor esi, esi
mov r14d, 0x400000
imul rbx, r8
cmp rbx, 0x400000
ja 0x476cd9
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_fwrite
test rbx, rbx
je 0x476d50
mov r9, qword [r13 + 8]
cmp rbx, 0x400000
mov rdi, r14
lea rcx, [r12 + rsi]
cmovbe rdi, rbx
mov edx, 1
mov r8, rdi
call sub.msvcrt.dll_fwrite
add rsi, rax
sub rbx, rax
cmp rdi, rax
je 0x476cd0
mov rax, 0xffffffffffffffff
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov r9, qword [r13 + 0x10]
test r9, r9
je 0x476d03
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp 0x518040
mov rax, rbp
jmp 0x476d22
push rbx
sub rsp, 0x20
xor r10d, r10d
test r9, r9
mov rbx, rdx
je 0x51805a
cmp dword [r9 + 0x18], 0x79b1
je 0x518063
mov rax, r10
add rsp, 0x20
pop rbx
ret
mov eax, dword [r9 + 0x64]
test eax, eax
jne 0x51805a
test rdx, rdx
je 0x51805a
mov r10, r8
imul r10, rdx
xor edx, edx
mov rax, r10
div rbx
cmp rax, r8
jne 0x5180a1
test r10, r10
je 0x51805a
mov rdx, rcx
mov r8, r10
mov rcx, r9
call fcn.00517e60
xor edx, edx
div rbx
mov r10, rax
jmp 0x51805a
lea r8, str.request_does_not_fit_in_a_size_t
mov edx, 0xfffffffe
mov rcx, r9
call fcn.00518760
xor r10d, r10d
jmp 0x51805a