joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140237258
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x5510e70d
pushf
not eax
add eax, 0x88156a8e
xor eax, 0xa18dc6bb
rol eax, 0xac
popf
pushf
not eax
add eax, 0x87af869d
xor eax, 0xf35bcd74
rol eax, 0xd
popf
cmp eax, 4
jne 0x140237295
popf
pop rax
jmp 0x1402374cb
cmp eax, 0
jne 0x1402372a4
popf
pop rax
jmp 0x1402372d1
cmp eax, 3
jne 0x1402372b3
popf
pop rax
jmp 0x140237483
cmp eax, 1
jne 0x1402372c2
popf
pop rax
jmp 0x140237383
cmp eax, 2
jne 0x1402372d1
popf
pop rax
jmp 0x140237427
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, edx
mov rdi, rcx
cmp edx, 1
jne 0x14023732b
push rax
pushf
mov eax, 0x5ecde337
pushf
not eax
add eax, 0x8596e554
xor eax, 0x823d0867
rol eax, 0x70
popf
pushf
not eax
add eax, 0x8ccb0dc4
xor eax, 0xf1017ac1
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xe6f6a8be
xor eax, 0xa5a83efb
rol eax, 0xe9
popf
jmp 0x140237286
push rax
pushf
mov eax, 0x7ea11d5d
pushf
not eax
add eax, 0x97032c88
xor eax, 0x9ae51abb
rol eax, 1
popf
pushf
not eax
add eax, 0xf79a5d3f
xor eax, 0x9c6314e5
rol eax, 0x68
popf
pushf
not eax
add eax, 0xa55261a5
xor eax, 0xc117877f
rol eax, 0x86
popf
pushf
not eax
add eax, 0x8b7d1a7c
xor eax, 0xbc44099e
rol eax, 0x39
popf
jmp 0x140237286
test rcx, rcx
je 0x1402373e1
push rax
pushf
mov eax, 0x8ba860b
pushf
not eax
add eax, 0xd1e0d1e4
xor eax, 0xad6856cf
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xb51889a4
xor eax, 0xdb643ce0
rol eax, 0x47
popf
pushf
not eax
add eax, 0xb8235c7a
xor eax, 0xbc01b481
rol eax, 0xc
popf
pushf
not eax
add eax, 0x95bcbf25
xor eax, 0xe14248e3
rol eax, 0x69
popf
jmp 0x140237286
push rax
pushf
mov eax, 0xa38a3b80
pushf
not eax
add eax, 0x9d2f0f6c
xor eax, 0xf34a24cb
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xa2ffdc97
xor eax, 0xc13eb5ee
rol eax, 0x60
popf
pushf
not eax
add eax, 0x8af4e200
xor eax, 0x850f7328
rol eax, 0x2a
popf
jmp 0x140237286
call fcn.140205c38
mov r8, rax
movabs rax, 0xf7d1d152d2b13ded
pushf
not rax
add rax, 0x44052b28
xor rax, 0x5a87cfae
rol rax, 0xa4
popf
pushf
not rax
add rax, 0x45d86e6f
xor rax, 0x562066e6
rol rax, 0x10
popf
mul r8
shr rdx, 0x17
imul ecx, edx, 0x989680
mov qword [rdi], rdx
sub r8d, ecx
imul eax, r8d, 0x64
mov dword [rdi + 8], eax
jmp 0x1402374cb
xor ebx, ebx
push rax
pushf
mov eax, 0x14633b2
pushf
not eax
add eax, 0xaa5876e8
xor eax, 0xa2fac037
rol eax, 0xf
popf
pushf
not eax
add eax, 0xc4d16edb
xor eax, 0xb8b171da
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xa2620176
xor eax, 0xaa1bb26f
rol eax, 0xff
popf
jmp 0x140237286
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14033db7b
Capabilities:
Delete file

Disassembly:
push rax
pushf
mov eax, 0x952d2e28
pushf
not eax
add eax, 0xa4a9e844
xor eax, 0x86267cac
rol eax, 0x50
popf
pushf
not eax
add eax, 0xf080b9f2
xor eax, 0x9743f9b1
rol eax, 0x22
popf
pushf
not eax
add eax, 0xb3326144
xor eax, 0xe4c55599
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xfae61401
xor eax, 0xf1415289
rol eax, 0xd7
popf
cmp eax, 2
jne 0x14033dbde
popf
pop rax
jmp 0x14033dcb9
cmp eax, 0
jne 0x14033dbed
popf
pop rax
jmp 0x14033dc0b
cmp eax, 3
jne 0x14033dbfc
popf
pop rax
jmp 0x14033dd01
cmp eax, 1
jne 0x14033dc0b
popf
pop rax
jmp 0x14033dca7
sub rsp, 0x28
jmp 0x14033dc10
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14033dc60
push rax
pushf
mov eax, 0xd941c57b
pushf
not eax
add eax, 0xa3e3e793
xor eax, 0xde6f2738
rol eax, 0xac
popf
pushf
not eax
add eax, 0xf8d264e3
xor eax, 0xb47e5ed5
rol eax, 0x40
popf
pushf
not eax
add eax, 0x99851f0a
xor eax, 0xfd83f1d6
rol eax, 0x7c
popf
jmp 0x14033dbcf
push rax
pushf
mov eax, 0x8a0166e1
pushf
not eax
add eax, 0xade165c8
xor eax, 0xd9c20114
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xc35df2cd
xor eax, 0xbcd293a3
rol eax, 0xce
popf
pushf
not eax
add eax, 0xd3233dc7
xor eax, 0xaac7c796
rol eax, 0x40
popf
jmp 0x14033dbcf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140231f91
or eax, 0xffffffff
jmp 0x14033dd01
xor eax, eax
push rax
pushf
mov eax, 0x72c17c1f
pushf
not eax
add eax, 0xc4202d56
xor eax, 0xd0de720d
rol eax, 0x70
popf
pushf
not eax
add eax, 0xc0016bd7
xor eax, 0xf543c009
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xd9d4e9bb
xor eax, 0xcd802b97
rol eax, 0x3c
popf
jmp 0x14033dbcf
add rsp, 0x28
ret
Function at 0x1403d24e1
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x1403d25a0
mov dword [rsp + 0x20], 0x6544302e
mov byte [rsp + 0x24], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x28], xmm2
movsd qword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x38], xmm0
test dl, dl
je 0x1403d2588
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x28]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x1403d2588
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x1403d2571
cmp dl, byte [rcx]
lea rdx, [rsp + 0x28]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x1403d2533
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax
Function at 0x141627028
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1416271af
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141627059
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14162703f
add dl, dl
jne 0x141627066
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1416270c6
xor eax, eax
add dl, dl
jne 0x141627075
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14162717d
add dl, dl
jne 0x141627086
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141627093
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270a0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1416270ba
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14162704e
mov eax, 1
add dl, dl
jne 0x1416270d6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1416270e3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416270cb
sub eax, ebx
mov ebx, 1
jne 0x14162711c
mov ecx, 1
add dl, dl
jne 0x1416270fe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14162710b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1416270f3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162704e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141627138
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141627145
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14162712d
cmp eax, 0x7d00
jae 0x14162716b
cmp eax, 0x500
jb 0x141627166
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162704e
cmp eax, 0x7f
ja 0x14162716e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14162704e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1416271a2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14162704e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007890
Capabilities:
Enumerate process modules

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x480
mov rax, qword [0x14014b040]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x28], 0
mov edx, dword [rsp + 0x498]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x438
rep stosb byte [rdi], al
mov dword [rsp + 0x30], 0x438
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14000794f
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x490]
sub rcx, rax
movzx edx, word [rax]
cmp dx, word [rax + rcx]
jne 0x140007926
add rax, 2
test dx, dx
jne 0x140007910
xor eax, eax
jmp 0x14000792b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x14000793b
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x14000794f
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140007900
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.140094ec0
add rsp, 0x480
pop rdi
ret
Function at 0x1400195f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x14014b040]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x80], 0
jg 0x140019624
xor eax, eax
jmp 0x1400197d0
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x68], 0
je 0x14001964c
mov r8, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
call fcn.14001a260
jmp 0x1400197d0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x70]
call fcn.14001af60
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x1400196e8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x40]
call fcn.14000f8c0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x70]
call fcn.14001b120
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x78]
call fcn.14000bfa0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call fcn.14001b080
mov rax, qword [rsp + 0x70]
cmp qword [rax + 0x80], 0
je 0x1400197c0
mov rcx, qword [rsp + 0x70]
call fcn.14001aae0
mov qword [rsp + 0x38], 0xfff
cmp qword [rsp + 0x40], 0xfff
jbe 0x140019788
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400a9dfc
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x78]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140019786
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x1400197d0
jmp 0x14001970e
cmp qword [rsp + 0x40], 0
jbe 0x1400197c0
mov rax, qword [rsp + 0x70]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x40]
mov edx, 1
mov rcx, qword [rsp + 0x78]
call fcn.1400a9dfc
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140094ec0
add rsp, 0x68
ret
Function at 0x14001cfb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 2
xor edx, edx
mov rcx, qword [rsp + 0x88]
call fcn.1400a702c
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14001cfe8
mov eax, 0xfffffffd
jmp 0x14001d13a
mov rcx, qword [rsp + 0x88]
call fcn.1400a25f4
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jge 0x14001d00a
mov eax, 0xfffffffd
jmp 0x14001d13a
cmp dword [rsp + 0x20], 0
jne 0x14001d018
xor eax, eax
jmp 0x14001d13a
mov eax, dword [rsp + 0x20]
inc eax
cdqe
lea rdx, [0x1400d1290]
mov rcx, rax
call fcn.140095554
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14001d050
mov eax, 0xfffffffe
jmp 0x14001d13a
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax], 0
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x88]
call fcn.1400a702c
movsxd rax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x88]
mov r8, rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400a9dfc
mov qword [rsp + 0x40], rax
movsxd rax, dword [rsp + 0x20]
cmp qword [rsp + 0x40], rax
je 0x14001d0e1
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140094ee0
cmp qword [rsp + 0x38], 0
jne 0x14001d0c7
mov qword [rsp + 0x58], 0
jmp 0x14001d0da
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov eax, 0xfffffffd
jmp 0x14001d13a
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
call fcn.14001f440
mov dword [rsp + 0x34], eax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.140094ee0
cmp qword [rsp + 0x48], 0
jne 0x14001d123
mov qword [rsp + 0x60], 0
jmp 0x14001d136
mov qword [rsp + 0x28], 0x8123
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x34]
add rsp, 0x78
ret
Function at 0x140029dd0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400f1770]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x140029e56
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
jmp 0x140029e02
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x140029e60
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x1400f1770]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140029f5b
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140029f56
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 1], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140029f2b
cmp qword [rsp + 0x38], 2
jb 0x140029f2b
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140029f2b
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140029f2b
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140029ea7
jmp 0x140029fe4
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp]
test eax, eax
je 0x140029fe4
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140029fba
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140029fba
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140029fba
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140029f5b
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x14002a220
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9, qword [rsp + 0x48]
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.1400a9dfc
add rsp, 0x28
ret
Function at 0x140041c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.140010360
mov eax, dword [rsp + 0x78]
and eax, 1
test eax, eax
je 0x140041d3a
mov edx, dword [rsp + 0x80]
mov ecx, 0x14
call fcn.140041a40
movss dword [rsp + 0x20], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x13
call fcn.140041a40
movss xmm1, dword [rsp + 0x20]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x28], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x12
call fcn.140041a40
movss dword [rsp + 0x24], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0x11
call fcn.140041a40
movss xmm1, dword [rsp + 0x24]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x28]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x44]
call fcn.140010360
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140025ac0
mov eax, dword [rsp + 0x78]
and eax, 2
test eax, eax
je 0x140041ddc
mov edx, dword [rsp + 0x80]
mov ecx, 7
call fcn.140041a40
movss dword [rsp + 0x2c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 6
call fcn.140041a40
movss xmm1, dword [rsp + 0x2c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x34], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 5
call fcn.140041a40
movss dword [rsp + 0x30], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 4
call fcn.140041a40
movss xmm1, dword [rsp + 0x30]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x34]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x4c]
call fcn.140010360
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140025ac0
mov eax, dword [rsp + 0x78]
and eax, 4
test eax, eax
je 0x140041e7e
mov edx, dword [rsp + 0x80]
mov ecx, 0xb
call fcn.140041a40
movss dword [rsp + 0x38], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 0xa
call fcn.140041a40
movss xmm1, dword [rsp + 0x38]
subss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 9
call fcn.140041a40
movss dword [rsp + 0x3c], xmm0
mov edx, dword [rsp + 0x80]
mov ecx, 8
call fcn.140041a40
movss xmm1, dword [rsp + 0x3c]
subss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x40]
movaps xmm2, xmm1
movaps xmm1, xmm0
lea rcx, [rsp + 0x54]
call fcn.140010360
mov rdx, rax
mov rcx, qword [rsp + 0x70]
call fcn.140025ac0
movss xmm0, dword [rsp + 0x88]
ucomiss xmm0, dword [0x14013d6f4]
jp 0x140041e92
je 0x140041eb6
mov ecx, 0xe
call fcn.140028660
movzx eax, al
test eax, eax
je 0x140041eb6
movss xmm1, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
call fcn.140025a70
movss xmm0, dword [rsp + 0x90]
ucomiss xmm0, dword [0x14013d6f4]
jp 0x140041eca
je 0x140041eee
mov ecx, 0xf
call fcn.140028660
movzx eax, al
test eax, eax
je 0x140041eee
movss xmm1, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x70]
call fcn.140025a70
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x140050770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14014b040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x5c], 0
xorps xmm0, xmm0
movss dword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x64], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x6c], xmm0
mov dword [rsp + 0x70], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x24], 0
xorps xmm0, xmm0
movss dword [rsp + 0x28], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x30], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x34], xmm0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x3c], 0
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x44], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x50], 0
lea r8, [rsp + 0x58]
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.14004f360
test eax, eax
je 0x140050908
movsxd rax, dword [rsp + 0x88]
imul rax, rax, 0xe
mov rcx, rax
call fcn.14002e610
mov rcx, qword [rsp + 0xc0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x20]
mov edx, dword [rsp + 0xb8]
mov rcx, qword [rsp + 0xb0]
call fcn.14004f360
test eax, eax
je 0x140050908
mov eax, dword [rsp + 0x88]
cmp dword [rsp + 0x50], eax
je 0x1400508fc
mov r8d, 0x8c6
lea rdx, [0x1401020f0]
lea rcx, str.output_ctx.num_vertices__count_ctx.num_vertices
call fcn.1400aa824
xor eax, eax
xor eax, eax
test eax, eax
jne 0x1400508d4
mov eax, dword [rsp + 0x50]
jmp 0x140050919
mov rax, qword [rsp + 0xc0]
mov qword [rax], 0
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140094ec0
add rsp, 0xa8
ret