joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c05f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0x30
movsxd r15, r9d
mov r14d, r8d
mov rsi, rdx
mov r11, rcx
mov rbx, r15
test r8d, r8d
je 0x1400c07b1
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r13
mov r13, rbx
neg r13
xor r12d, r12d
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov rbp, rsi
mov rdi, rsi
xor r10b, r10b
add rsi, rbx
mov edx, r12d
test r15d, r15d
jle 0x1400c067a
mov r8, rdi
mov r9, rsi
mov rcx, rsi
sub r8, rsi
neg r9
movzx eax, byte [rcx]
cmp byte [r8 + rcx], al
jne 0x1400c067a
inc rcx
inc edx
lea rax, [r9 + rcx]
cmp rax, rbx
jl 0x1400c0663
mov r8, rsi
cmp edx, r15d
jne 0x1400c070f
sub r14d, r15d
neg r8
nop dword [rax]
test r14d, r14d
je 0x1400c06d2
mov edx, r12d
test r15d, r15d
jle 0x1400c06bb
mov rax, rsi
lea r9, [r8 + rbp]
movzx ecx, byte [rax]
cmp byte [r9 + rax], cl
jne 0x1400c06bb
inc rax
inc edx
lea rcx, [r8 + rax]
cmp rcx, rbx
jl 0x1400c06a4
cmp edx, r15d
jne 0x1400c06d2
inc r10b
add rsi, rbx
add r8, r13
sub r14d, r15d
cmp r10b, 0x7f
jb 0x1400c0690
mov rdx, qword [r11]
movzx ecx, r10b
bts ecx, 7
call fcn.1401c1ae4
mov rdi, r12
test r15d, r15d
jle 0x1400c0783
mov r13, qword [rsp + 0x60]
movzx ecx, byte [rdi + rbp]
mov rdx, qword [r13]
call fcn.1401c1ae4
inc rdi
cmp rdi, rbx
jl 0x1400c06f3
mov r13, qword [rsp + 0x20]
jmp 0x1400c0783
neg r8
test r14d, r14d
je 0x1400c0755
mov edx, r12d
test r15d, r15d
jle 0x1400c073b
mov rcx, rsi
sub rbp, rsi
movzx eax, byte [rcx]
cmp byte [rcx + rbp], al
jne 0x1400c073b
inc rcx
inc edx
lea rax, [r8 + rcx]
cmp rax, rbx
jl 0x1400c0725
cmp edx, r15d
je 0x1400c0755
inc r10b
mov rbp, rsi
add r8, r13
add rsi, rbx
sub r14d, r15d
cmp r10b, 0x7f
jb 0x1400c0712
mov rdx, qword [r11]
dec r10b
sub rsi, rbx
movzx ecx, r10b
call fcn.1401c1ae4
mov rax, qword [rsp + 0x60]
mov rdx, rsi
mov r9, qword [rax]
sub rdx, rdi
mov r8d, 1
mov rcx, rdi
call fcn.1401c24f8
mov r11, qword [rsp + 0x60]
test r14d, r14d
jne 0x1400c0640
mov r13, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
movzx eax, r12w
add rsp, 0x30
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
xor r12d, r12d
movzx eax, r12w
add rsp, 0x30
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
Function at 0x1400c0b00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov rcx, qword [rdx + 0x78]
or rdi, 0xffffffffffffffff
mov rbx, rdx
test rcx, rcx
je 0x1400c0b64
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400c0b40
cmp rax, 0xff
jae 0x1400c0b64
mov rax, rdi
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400c0b54
lea ecx, [rax + 1]
jmp 0x1400c0b66
xor ecx, ecx
mov rdx, qword [rsi]
call fcn.1401c1ae4
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
cmp word [rbx + 0x138], 0
mov rdx, qword [rsi]
mov ecx, 0xa
jne 0x1400c0b8f
mov ecx, 2
call fcn.1401c1ae4
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
movzx ecx, word [rbx + 0x50]
mov rdx, rsi
call fcn.140067160
movzx ecx, word [rbx + 0x54]
mov rdx, rsi
call fcn.140067160
mov rdx, qword [rsi]
mov r15d, 0x18
mov ecx, r15d
call fcn.1401c1ae4
mov rdx, qword [rsi]
xor ebp, ebp
cmp byte [rbx + 0x14b], bpl
mov ecx, 0x20
cmovne ecx, ebp
call fcn.1401c1ae4
mov rcx, qword [rbx + 0x78]
lea r14d, [r15 - 0x17]
test rcx, rcx
je 0x1400c0c4b
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bpl
jne 0x1400c0c20
cmp rax, 0xff
jae 0x1400c0c4b
inc rdi
cmp byte [rcx + rdi], bpl
jne 0x1400c0c31
mov r9, qword [rsi]
inc rdi
mov r8, r14
mov rdx, rdi
call fcn.1401c24f8
lea rcx, [rsp + 0x20]
call fcn.140061e90
cmp word [rbx + 0x138], bp
lea rax, str.Targa_RLE
lea rcx, str.Targa
lea rdx, [rsp + 0x50]
cmovne rcx, rax
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400c0c80
movzx eax, byte [rbx + 0x14b]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 8
neg al
mov eax, dword [rbx + 0x50]
mov dword [rsp + 0x30], 0x180001
sbb cx, cx
and cx, 0x10
mov word [rsp + 0x24], cx
lea ecx, [rax + rax*2]
mov dword [rsp + 0x3c], ecx
mov rcx, rbx
call fcn.14005fe70
movzx edi, ax
test ax, ax
jne 0x1400c0d4d
cmp dword [rbx + 0x54], ebp
jle 0x1400c0d45
mov eax, ebp
nop word [rax + rax]
mov r8d, r14d
mov edx, eax
mov rcx, rbx
call fcn.1400629c0
cmp word [rbx + 0x138], 0
je 0x1400c0d16
mov eax, dword [rbx + 0x50]
mov rdx, qword [rsp + 0x28]
mov r9d, 3
lea r8d, [rax + rax*2]
mov rcx, rsi
call fcn.1400c05f0
movzx edi, ax
jmp 0x1400c0d33
movsxd rdx, dword [rbx + 0x50]
mov r9, qword [rsi]
mov rcx, qword [rsp + 0x28]
mov r8d, 3
call fcn.1401c24f8
cmp rax, 3
jne 0x1400c0d40
inc bp
movsx eax, bp
cmp eax, dword [rbx + 0x54]
jl 0x1400c0ce0
jmp 0x1400c0d45
mov edi, 6
mov rcx, rbx
call fcn.14005dcb0
movzx eax, di
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c0d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rsi, rcx
mov rcx, qword [rdx + 0x78]
or rdi, 0xffffffffffffffff
mov rbx, rdx
test rcx, rcx
je 0x1400c0de4
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400c0dc0
cmp rax, 0xff
jae 0x1400c0de4
mov rax, rdi
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400c0dd4
lea ecx, [rax + 1]
jmp 0x1400c0de6
xor ecx, ecx
mov rdx, qword [rsi]
call fcn.1401c1ae4
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
cmp word [rbx + 0x138], 0
mov rdx, qword [rsi]
mov ecx, 0xa
jne 0x1400c0e0f
mov ecx, 2
call fcn.1401c1ae4
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
mov rdx, qword [rsi]
xor ecx, ecx
call fcn.1401c1ae4
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
xor ecx, ecx
mov rdx, rsi
call fcn.140067160
movzx ecx, word [rbx + 0x50]
mov rdx, rsi
call fcn.140067160
movzx ecx, word [rbx + 0x54]
mov rdx, rsi
call fcn.140067160
mov rdx, qword [rsi]
mov r15d, 0x20
mov ecx, r15d
call fcn.1401c1ae4
mov rdx, qword [rsi]
xor ebp, ebp
cmp byte [rbx + 0x14b], bpl
mov ecx, r15d
cmovne ecx, ebp
call fcn.1401c1ae4
mov rcx, qword [rbx + 0x78]
lea r14d, [r15 - 0x1f]
test rcx, rcx
je 0x1400c0ec1
mov rax, rdi
inc rax
cmp byte [rcx + rax], bpl
jne 0x1400c0e96
cmp rax, 0xff
jae 0x1400c0ec1
inc rdi
cmp byte [rcx + rdi], bpl
jne 0x1400c0ea7
mov r9, qword [rsi]
inc rdi
mov r8, r14
mov rdx, rdi
call fcn.1401c24f8
lea rcx, [rsp + 0x20]
call fcn.140061e90
cmp word [rbx + 0x138], bp
lea rax, str.Targa_RLE
lea rcx, str.Targa
lea rdx, [rsp + 0x50]
cmovne rcx, rax
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
mov byte [rdx + rcx - 1], al
test al, al
jne 0x1400c0ef0
mov eax, dword [rbx + 0x50]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r15d
shl eax, 2
mov dword [rsp + 0x30], 0x200001
mov dword [rsp + 0x3c], eax
movzx eax, byte [rbx + 0x14b]
neg al
sbb cx, cx
and cx, 0x10
mov word [rsp + 0x24], cx
mov rcx, rbx
call fcn.14005fe70
movzx edi, ax
test ax, ax
jne 0x1400c0fbe
cmp dword [rbx + 0x54], ebp
jle 0x1400c0fb6
mov eax, ebp
nop word [rax + rax]
mov r8d, r14d
mov edx, eax
mov rcx, rbx
call fcn.1400629c0
cmp word [rbx + 0x138], 0
je 0x1400c0f87
mov r8d, dword [rbx + 0x50]
mov rdx, qword [rsp + 0x28]
mov r9d, 4
shl r8d, 2
mov rcx, rsi
call fcn.1400c05f0
movzx edi, ax
jmp 0x1400c0fa4
movsxd rdx, dword [rbx + 0x50]
mov r9, qword [rsi]
mov rcx, qword [rsp + 0x28]
mov r8d, 4
call fcn.1401c24f8
cmp rax, 4
jne 0x1400c0fb1
inc bp
movsx eax, bp
cmp eax, dword [rbx + 0x54]
jl 0x1400c0f50
jmp 0x1400c0fb6
mov edi, 6
mov rcx, rbx
call fcn.14005dcb0
movzx eax, di
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400c15f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
call fcn.140066da0
mov ecx, 0x908
mov word [rsi], ax
cmp ax, cx
je 0x1400c1622
mov eax, 2
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rcx, rbx
call fcn.140066da0
mov ecx, 0xfe
mov word [rsi + 2], ax
cmp ax, cx
jl 0x1400c1612
mov rcx, rbx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
call fcn.140066da0
mov rcx, rbx
mov word [rsi + 4], ax
call fcn.140066da0
mov edx, 8
mov word [rsi + 6], ax
mov r9, qword [rbx]
lea rcx, [rsi + 8]
lea r8d, [rdx - 7]
call fcn.1401c1e14
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsi + 0x10]
call fcn.1401c1e14
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsi + 0x18]
call fcn.1401c1e14
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsi + 0x20]
call fcn.1401c1e14
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsi + 0x28]
call fcn.1401c1e14
mov r9, qword [rbx]
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsi + 0x30]
call fcn.1401c1e14
lea rdi, [rsi + 0x38]
mov ebp, 0x10
mov r9, qword [rbx]
mov edx, 8
mov rcx, rdi
lea r8d, [rdx - 7]
call fcn.1401c1e14
add rdi, 8
dec rbp
jne 0x1400c16e1
mov rcx, rbx
call fcn.140066b20
mov rcx, rbx
mov dword [rsi + 0xb8], eax
call fcn.140066b20
mov rcx, rbx
mov dword [rsi + 0xbc], eax
call fcn.140066da0
mov word [rsi + 0xc0], ax
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rsi + 0xc2], al
mov rcx, qword [rbx]
call fcn.1401c3f28
lea rcx, [rsi + 0xc8]
lea edx, [rbp + 8]
mov byte [rsi + 0xc3], al
mov r9, qword [rbx]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0xd0]
lea edx, [rbp + 8]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov rcx, rbx
call fcn.140066da0
lea rcx, [rsi + 0xda]
lea edx, [rbp + 0x42]
mov word [rsi + 0xd8], ax
mov r9, qword [rbx]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x11c]
lea edx, [rbp + 0x42]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x15e]
lea edx, [rbp + 0x42]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x1a0]
lea edx, [rbp + 0x50]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x1f0]
lea edx, [rbp + 8]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x1f8]
lea edx, [rbp + 8]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov r9, qword [rbx]
lea rcx, [rsi + 0x200]
lea edx, [rbp + 3]
lea r8d, [rbp + 1]
call fcn.1401c1e14
mov rcx, qword [rbx]
call fcn.1401c3f28
mov byte [rsi + 0x203], al
mov rcx, qword [rbx]
call fcn.1401c1a94
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rsi
ret
Function at 0x1400c1850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
call fcn.1401c3f28
mov byte [rbx], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 1], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 2], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 3], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 4], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
mov byte [rbx + 5], al
call fcn.140066da0
mov edx, 8
mov word [rbx + 6], ax
mov r9, qword [rdi]
lea rcx, [rbx + 8]
lea r8d, [rdx - 7]
call fcn.1401c1e14
mov rcx, rdi
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x10], eax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0x14], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0x16], ax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x18], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 0x1c], eax
call fcn.140066b20
mov edx, 0x1dc
mov dword [rbx + 0x20], eax
mov rcx, qword [rdi]
mov r8d, 1
call fcn.1401c1f88
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x1400c2d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [r8 + 0x10], 0x1000
mov rbx, r8
movzx edi, cl
jl 0x1400c2d58
mov r9, qword [rdx]
lea rcx, [r8 + 0x14]
mov edx, 0x1000
mov r8d, 1
call fcn.1401c24f8
mov dword [rbx + 0x10], 0
movsxd rax, dword [rbx + 0x10]
mov byte [rax + rbx + 0x14], dil
inc dword [rbx + 0x10]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c2ef0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx + 0x10]
mov r10, r8
mov rbx, rcx
lea eax, [r9 + 1]
mov dword [rcx + 0x10], eax
cmp r9d, dword [rcx + 0x14]
jl 0x140063de8
mov eax, 7
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call fcn.140061f50
test r10, r10
je 0x140063e0a
mov rcx, qword [rbx]
mov rdx, r10
call fcn.140061ed0
mov rdi, qword [rbx]
lea rcx, str.tiff
movsx esi, word [rdi + 0x80]
call fcn.140064760
cmp esi, eax
jne 0x140063e42
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x1400c2ef0
lea rcx, [0x1401fc6d0]
call fcn.140064760
cmp esi, eax
jne 0x140063e70
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400d13d0
lea rcx, [0x14020d41c]
call fcn.140064760
cmp esi, eax
jne 0x140063e9e
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e85b0
lea rcx, [0x1401f89fc]
call fcn.140064760
cmp esi, eax
jne 0x140063ecc
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e5d50
lea rcx, [0x1401fc6cc]
call fcn.140064760
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
cmp esi, eax
jne 0x140063efa
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e1cc0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400df9c0
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400c30e0
test ax, ax
jne 0x1400c2fd6
mov qword [rsp + 0x110], rsi
cmp word [rbx + 0x32], ax
jne 0x1400c2f9c
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov rcx, qword [rcx]
lea r8d, [rdx + 2]
call fcn.1401c1f88
mov rcx, qword [rbx + 0x38]
mov rcx, qword [rcx]
call fcn.1401c2310
mov rcx, qword [rbx + 0x38]
mov edx, dword [rbx + 0x28]
mov dword [rsp + 0x30], eax
mov rcx, qword [rcx]
xor r8d, r8d
call fcn.1401c1f88
mov r9, qword [rbx + 0x38]
mov edx, 1
mov r9, qword [r9]
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x30]
call fcn.1401c24f8
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov rcx, qword [rcx]
lea r8d, [rdx + 2]
call fcn.1401c1f88
mov rcx, qword [rbx + 0x38]
xor esi, esi
mov word [rbx + 0x32], si
mov rcx, qword [rcx]
call fcn.1401c2310
mov rcx, qword [rbx + 0x38]
lea r8, [rsp + 0x40]
mov r9, rbx
mov rdx, rdi
mov dword [rsp + 0x20], eax
call fcn.1400c3630
test ax, ax
jne 0x1400c2fce
movzx eax, si
mov rsi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
ret
Function at 0x1400c4010
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx]
mov edx, 2
mov rbx, rcx
mov eax, 0x4949
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 1]
mov word [rsp + 0x30], ax
call fcn.1401c24f8
mov r9, qword [rbx]
mov eax, 0x2a
lea rcx, [rsp + 0x38]
lea edx, [rax - 0x28]
lea r8d, [rax - 0x29]
mov word [rsp + 0x38], ax
call fcn.1401c24f8
mov r9, qword [rbx]
mov edx, 4
lea r8d, [rdx - 3]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 8
call fcn.1401c24f8
add rsp, 0x20
pop rbx
ret

Function at 0x1400c4080
Capabilities:
Write file on windows

Disassembly:
mov word [rsp + 0x20], r9w
mov dword [rsp + 0x18], r8d
push rbx
push rdi
push r14
sub rsp, 0x40
mov rdi, qword [rsp + 0x88]
xor ebx, ebx
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r13
mov r14, rcx
mov dword [rdi + 0x10], ebx
mov qword [rsp + 0x20], r15
mov r15, qword [rsp + 0x80]
mov dword [r15], ebx
mov rcx, rdi
movzx r12d, r9w
mov r13, rdx
movzx ebp, bx
mov byte [rdi + 0xc], bl
mov word [rdi + 0xa], bx
call fcn.1400c2cd0
mov edx, 0x100
mov r9, rdi
mov r8, r15
mov rcx, r14
call fcn.1400c3c70
mov eax, 0xffff
mov word [rsp + 0x88], ax
test r12w, r12w
je 0x1400c420a
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x38], rsi
mov edx, ecx
mov qword [rsp + 0x80], rcx
nop dword [rax + rax]
mov rbx, r13
mov esi, ecx
test ecx, ecx
je 0x1400c41ec
mov r12d, 0xffd
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rbx]
lea rcx, [rsp + 0x88]
mov r8, rdi
call fcn.1400c2e80
test ax, ax
je 0x1400c41c4
mov r9, rdi
mov r8, r15
movzx edx, bp
mov rcx, r14
call fcn.1400c3c70
movzx edx, byte [rbx]
mov r8, rdi
movzx ecx, bp
call fcn.1400c28d0
movzx eax, byte [rbx]
mov word [rsp + 0x88], ax
cmp word [rdi + 8], r12w
jne 0x1400c41cc
mov r9, rdi
mov r8, r15
movzx edx, ax
mov rcx, r14
call fcn.1400c3c70
mov edx, 0x100
mov r9, rdi
mov r8, r15
mov rcx, r14
call fcn.1400c3c70
mov rcx, rdi
call fcn.1400c2cd0
mov eax, 0xffff
mov word [rsp + 0x88], ax
jmp 0x1400c41cc
movzx eax, word [rsp + 0x88]
inc rbx
movzx ebp, ax
dec esi
jne 0x1400c4140
movzx r12d, word [rsp + 0x78]
mov ecx, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
dec r12w
add r13, rdx
mov word [rsp + 0x78], r12w
test r12w, r12w
jne 0x1400c4120
mov rsi, qword [rsp + 0x38]
xor ebx, ebx
mov r9, rdi
mov r8, r15
movzx edx, ax
mov rcx, r14
call fcn.1400c3c70
inc word [rdi + 8]
mov edx, 0x101
mov r9, rdi
mov r8, r15
mov rcx, r14
call fcn.1400c3c70
cmp word [rdi + 0xa], 0
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
je 0x1400c4258
xor edx, edx
mov r9, rdi
mov r8, r15
mov rcx, r14
call fcn.1400c3c70
movsxd rcx, dword [rdi + 0x10]
mov r15, qword [rsp + 0x20]
test ecx, ecx
je 0x1400c427a
mov r9, qword [r14]
mov rdx, rcx
lea rcx, [rdi + 0x14]
mov r8d, 1
call fcn.1401c24f8
movzx eax, bx
add rsp, 0x40
pop r14
pop rdi
pop rbx
ret
Function at 0x1400c61b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov esi, 4
mov rdi, rcx
lea r8d, [rsi - 3]
mov edx, esi
mov rcx, rbx
call fcn.1401c1e14
test rax, rax
jne 0x1400c61f3
movzx eax, si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.TBMP
mov r8, rsi
mov rcx, rbx
call fcn.1401c25f0
test eax, eax
je 0x1400c622c
lea rdx, str.PMAP
mov r8, rsi
mov rcx, rbx
call fcn.1401c25f0
test eax, eax
je 0x1400c622c
mov rcx, rdi
call fcn.140066b70
mov dword [rbx + 4], eax
jmp 0x1400c6233
mov dword [rbx + 4], 0
mov rcx, qword [rdi]
call fcn.1401c2310
mov edx, dword [rbx + 4]
add edx, 3
add edx, eax
and edx, 0xfffffffc
mov dword [rbx + 8], edx
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
neg eax
sbb ecx, ecx
and ecx, esi
mov rsi, qword [rsp + 0x38]
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x1400c6600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov ebx, r8d
mov rbp, rdx
mov r14, rcx
test r8d, r8d
jle 0x1400c669c
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [r14]
call fcn.1401c3f28
movzx edx, al
and dl, 0x7f
inc dl
movzx esi, dl
cmp esi, ebx
jg 0x1400c667f
test al, al
jns 0x1400c6660
mov rcx, qword [r14]
call fcn.1401c3f28
test esi, esi
jle 0x1400c6679
mov rdi, rbp
movzx eax, al
mov ecx, esi
mov edx, esi
add rbp, rsi
rep stosb byte [rdi], al
jmp 0x1400c6679
mov r9, qword [r14]
movzx edi, dl
mov r8d, 1
mov edx, edi
mov rcx, rbp
call fcn.1401c1e14
add rbp, rdi
sub ebx, esi
test ebx, ebx
jg 0x1400c6628
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop r14
ret
Function at 0x1400c6a30
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rdx, rcx
movzx ecx, word [rdi]
call fcn.1400671a0
movzx ecx, word [rdi + 2]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 4]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 6]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 8]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0xa]
mov rdx, rbx
call fcn.1400671a0
mov ecx, dword [rdi + 0xc]
mov rdx, rbx
call fcn.140067100
mov ecx, dword [rdi + 0x10]
mov rdx, rbx
call fcn.140067100
mov ecx, dword [rdi + 0x14]
mov rdx, rbx
call fcn.140067100
mov r9, qword [rbx]
mov edx, 0x50
lea r8d, [rdx - 0x4f]
lea rcx, [rdi + 0x18]
call fcn.1401c24f8
cmp rax, 1
je 0x1400c6ad3
mov eax, 6
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rdi + 0x68]
mov rdx, rbx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
movzx ecx, word [rdi + 0x78]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0x7a]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0x7c]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0x7e]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0x80]
mov rdx, rbx
call fcn.1400671a0
movzx ecx, word [rdi + 0x82]
mov rdx, rbx
call fcn.1400671a0
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov ecx, dword [rdi + 0xa0]
mov rdx, rbx
call fcn.140067100
mov ecx, dword [rdi + 0xa4]
mov rdx, rbx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov rdx, rbx
xor ecx, ecx
call fcn.140067100
mov r9, qword [rbx]
lea rcx, [rdi + 0xb8]
mov edx, 0x168
mov r8d, 1
call fcn.1401c24f8
cmp rax, 1
jne 0x1400c6ac3
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c6bc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, 0xff00
mov ebx, r9d
mov r10, r8
mov rdi, rdx
mov rsi, rcx
test word [rdx + 2], ax
jne 0x1400c6c63
movzx r8d, word [rdi + 6]
mov edx, dword [rdx + 0xc]
mov r9d, dword [rdi + 0x10]
mov r11, qword [rdi + 0x98]
test r8d, r8d
je 0x1400c6c21
nop
movzx eax, byte [r10]
lea r10, [r10 + 1]
lea r11, [r11 + 1]
cmp eax, r9d
mov byte [r11 - 1], al
cmova r9d, eax
cmp eax, edx
cmovb edx, eax
dec r8d
jne 0x1400c6c00
movzx eax, word [rdi + 6]
mov dword [rdi + 0xc], edx
mov dword [rdi + 0x10], r9d
mov r9, qword [rcx]
mov ebx, eax
mov r8d, eax
mov rcx, qword [rdi + 0x98]
mov edx, 1
call fcn.1401c24f8
cmp rax, rbx
je 0x1400c6d24
mov eax, 6
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rdx + 0xc]
mov edx, dword [rdx + 0x10]
mov r11, r8
movzx r8d, word [rdi + 6]
mov r9d, r8d
test r8d, r8d
je 0x1400c6c97
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
cmp eax, edx
cmova edx, eax
cmp eax, ecx
cmovb ecx, eax
dec r9d
jne 0x1400c6c80
mov dword [rdi + 0x10], edx
mov rdx, qword [rdi + 0x98]
mov dword [rdi + 0xc], ecx
mov rcx, r10
call fcn.1400c6780
cmp word [rdi + 4], 2
mov r9, qword [rdi + 0xb0]
movsxd r10, eax
jne 0x1400c6cdb
mov rdx, qword [rdi + 0xa8]
mov ecx, dword [rdi + 0xa4]
lea r8, [rbx*4]
mov dword [r8 + rdx], ecx
add r9, r8
jmp 0x1400c6d01
movzx eax, word [rdi + 8]
mov rcx, qword [rdi + 0xa8]
imul eax, dword [rsp + 0x50]
add eax, ebx
lea rdx, [rax*4]
mov eax, dword [rdi + 0xa4]
mov dword [rdx + rcx], eax
add r9, rdx
mov eax, dword [r9]
cmp eax, 0xffffffff
je 0x1400c6d0c
add dword [rdi + 0x14], eax
mov dword [r9], r10d
add dword [rdi + 0xa4], r10d
mov r9, qword [rsi]
mov rbx, r10
mov r8, r10
jmp 0x1400c6c34
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret