joyce8/EMBER2024-capa huggingface dataset:
Function at 0x615e1340
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movss xmm10, dword [rsp + 0xd0]
mov edi, dword [rsp + 0xe0]
movss xmm11, dword [rsp + 0xd8]
mov r12, rcx
mov r13, rdx
movups xmm6, xmm3
mov ebx, r8d
cmp r8d, 2
jbe 0x615e13a2
xorps xmm0, xmm0
comiss xmm0, xmm3
jb 0x615e13e8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r8d, 0x63
lea rdx, str.src_Cairo.cpp
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
lea rcx, str.numSegments___3__size___0.0f
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.615c7800
mov rcx, rdx
cvtss2sd xmm6, xmm6
xorps xmm8, xmm8
cvtss2sd xmm11, xmm11
call fcn.615ebe20
mov rcx, r13
mov r13d, 1
cvtss2sd xmm10, xmm10
movzx esi, word [rax]
call fcn.615ebe30
mov rcx, r12
cvtsi2sd xmm7, esi
movzx eax, word [rax]
cvtsi2sd xmm9, eax
movupd xmm1, xmm7
addsd xmm1, xmm6
movupd xmm2, xmm9
call fcn.61659a10
movupd xmm2, xmm9
movupd xmm1, xmm7
mov rcx, r12
inc r13d
addsd xmm2, xmm8
addsd xmm1, xmm6
call fcn.616583a0
movupd xmm2, xmm11
movupd xmm0, xmm6
movupd xmm1, xmm10
mulsd xmm2, xmm6
mulsd xmm1, xmm8
mulsd xmm0, xmm10
mulsd xmm8, xmm11
movupd xmm6, xmm2
subsd xmm6, xmm1
addsd xmm8, xmm0
cmp ebx, r13d
ja 0x615e1434
addsd xmm7, xmm6
movupd xmm2, xmm9
mov rcx, r12
addsd xmm2, xmm8
movupd xmm1, xmm7
call fcn.616583a0
mov rcx, r12
test dil, dil
je 0x615e14d8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6165d3d0
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.61656de0
Function at 0x615e1510
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebbc0
test al, al
jne 0x615e1565
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebbc0
test al, al
je 0x615e153f
mov rcx, r13
call fcn.615ebb50
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebb40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.61659a10
mov rcx, r15
call fcn.615ebb50
mov rcx, r15
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebb40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.616583a0
mov rcx, r14
call fcn.615ebb50
mov rcx, r14
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebb40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.616583a0
mov rcx, r13
call fcn.615ebb50
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebb40
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e163d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0

Function at 0x615e1650
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebc60
test al, al
jne 0x615e16a5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebc60
test al, al
je 0x615e167f
mov rcx, r13
call fcn.615ebbf0
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebbe0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.61659a10
mov rcx, r15
call fcn.615ebbf0
mov rcx, r15
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebbe0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r14
call fcn.615ebbf0
mov rcx, r14
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebbe0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r13
call fcn.615ebbf0
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebbe0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e177d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0
Function at 0x615e1790
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebce0
test al, al
jne 0x615e17e5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebce0
test al, al
je 0x615e17bf
mov rcx, r13
call fcn.615ebc90
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebc80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.61659a10
mov rcx, r15
call fcn.615ebc90
mov rcx, r15
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebc80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r14
call fcn.615ebc90
mov rcx, r14
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebc80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r13
call fcn.615ebc90
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.615ebc80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e18bd
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0

Function at 0x615e18d0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebd60
test al, al
jne 0x615e1925
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebd60
test al, al
je 0x615e18ff
mov rcx, r13
call fcn.615ebd10
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.61659a10
mov rcx, r15
call fcn.615ebd10
mov rcx, r15
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.616583a0
mov rcx, r14
call fcn.615ebd10
mov rcx, r14
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.616583a0
mov rcx, r13
call fcn.615ebd10
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd00
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e1a15
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0
Function at 0x615e1a30
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebe00
test al, al
jne 0x615e1a85
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebe00
test al, al
je 0x615e1a5f
mov rcx, r13
call fcn.615ebd90
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61659a10
mov rcx, r15
call fcn.615ebd90
mov rcx, r15
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r14
call fcn.615ebd90
mov rcx, r14
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r13
call fcn.615ebd90
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebd80
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e1b75
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0
Function at 0x615e1b90
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.615ebea0
test al, al
jne 0x615e1be5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.615c7800
mov rdx, r14
mov rcx, r13
call fcn.615ebea0
test al, al
je 0x615e1bbf
mov rcx, r13
call fcn.615ebe30
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebe20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.61659a10
mov rcx, r15
call fcn.615ebe30
mov rcx, r15
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebe20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r14
call fcn.615ebe30
mov rcx, r14
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebe20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r13
call fcn.615ebe30
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.615ebe20
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.616583a0
mov rcx, r12
test bl, bl
je 0x615e1cd5
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6165d3d0
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.61656de0

Function at 0x615e1cf0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
shr eax, 0xe
and eax, 2
or ebx, eax
call rsi
mov ecx, 0x5b
shr eax, 0xd
and eax, 4
or ebx, eax
call rsi
mov ecx, 0x5c
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x90
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x91
shl eax, 4
and eax, 0x10
or ebx, eax
call rsi
mov ecx, 0x14
shl eax, 5
and eax, 0x20
or ebx, eax
call rsi
shl eax, 6
and eax, 0x40
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x615e2480
Capabilities:
Query environment variable

Disassembly:
xorps xmm1, xmm1
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax + 0xd8]
comisd xmm0, xmm1
ja 0x615d2f3a
jmp fcn.615e2d80
ret
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.DPF_SCALE_FACTOR
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x615e24ac
call sub.msvcrt.dll_atof
maxsd xmm0, qword [0x61758e38]
jmp 0x615e24c7
test r12, r12
je 0x615e24bf
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x615d2f20
movsd xmm0, qword [0x61758e38]
add rsp, 0x20
pop r12
ret

Function at 0x615e26c0
Capabilities:
Query environment variable

Disassembly:
lea rcx, str.Window::PrivateData::renderToPicture
jmp 0x615e26c0
mov rdx, rcx
lea rcx, str.cairo_function_not_implemented:__s
jmp fcn.615c8820
Function at 0x615e5f50
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movups xmmword [rsp + 0x60], xmm6
movups xmmword [rsp + 0x70], xmm7
movups xmmword [rsp + 0x80], xmm8
mov r13, qword [0x6173f750]
movsd xmm7, qword [0x61758530]
movq xmm8, qword [0x61758520]
movsd xmm6, qword [r13 + 0x38]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
mov rdi, rcx
mov ebx, edx
mov esi, r8d
jae 0x615e6092
lea rcx, [0x617584ca]
mov r15, qword [r13 + 0x40]
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x615e5fdc
call sub.msvcrt.dll_atof
movsd xmm6, qword [0x61758518]
maxsd xmm6, xmm0
jmp 0x615e6092
lea rcx, [0x617584db]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsd xmm6, qword [0x61758518]
mov r12, rax
test rax, rax
je 0x615e6092
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x617584e6]
mov rcx, rax
call rbp
lea rdx, [0x617584fd]
mov rcx, r12
mov r14, rax
call rbp
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0x64
mov rbp, rax
test r14, r14
je 0x615e6078
test rax, rax
je 0x615e6078
xor ecx, ecx
lea rdx, [rsp + 0x58]
call r14
test eax, eax
jne 0x615e6078
cmp dword [rsp + 0x58], 0
je 0x615e6078
mov edx, 1
test r15, r15
je 0x615e6066
mov rcx, r15
call qword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x615e606e
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x5c]
call rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x5c]
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x61758538]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x615e60d2
movupd xmm0, xmm6
subsd xmm0, qword [0x61758518]
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x615e60d2
cvtsi2sd xmm0, rbx
mulsd xmm0, xmm6
cvttsd2si rbx, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, xmm6
cvttsd2si rsi, xmm0
movq r9, xmm6
mov r8d, esi
movupd xmm3, xmm6
mov edx, ebx
lea rcx, str.createNextWindow__u__u__f
call fcn.615c7f50
mov ecx, 0x20
call fcn.615f6e70
mov r8, qword [r13 + 0x40]
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov dword [rsp + 0x48], 0
mov rdx, r13
mov rcx, rax
mov r12, rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
movsd qword [rsp + 0x28], xmm6
call fcn.615dc030
mov rcx, qword [r12 + 8]
lea rax, str._Da
mov qword [r12 + 0x10], rdi
mov qword [r12], rax
cmp qword [rcx + 0x20], 0
mov word [r12 + 0x18], 1
je 0x615e6170
call fcn.615dab80
test al, al
je 0x615e6170
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x20]
call fcn.615d1ec0
mov rcx, qword [r13 + 0x10]
cmp r12, rcx
jne 0x615e6188
jmp 0x615e6197
mov qword [r13 + 0x10], r12
test rcx, rcx
je 0x615e6197
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [r13 + 0x58], 0
mov rax, qword [r13 + 0x10]
jne 0x615e61c0
mov rdx, qword [rax + 8]
mov byte [rdx + 0x71], 1
jmp 0x615e61c0
movups xmm6, xmmword [rsp + 0x60]
movups xmm7, xmmword [rsp + 0x70]
movups xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x615e7370
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x615e7398
mov r9d, 0xf2
lea r8, [0x6175727c]
lea rdx, [0x6175729f]
lea rcx, [0x617572b2]
jmp fcn.615c8270
cmp byte [rcx + 0x10], 0
je 0x615e73a6
mov rcx, r8
jmp sub.msvcrt.dll_free
ret

Function at 0x615e73e0
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x615e7408
mov r9d, 0xf2
lea r8, str.src_.._.._distrho_extra_String.hpp
lea rdx, str.fBuffer___nullptr
lea rcx, [0x617593f1]
jmp fcn.615c8960
cmp byte [rcx + 0x10], 0
je 0x615e7416
mov rcx, r8
jmp sub.msvcrt.dll_free
ret
Function at 0x61611510
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
test rcx, rcx
je 0x61611532
movsx edx, byte [rcx]
test dl, dl
je 0x61611532
mov r8d, eax
inc rcx
shl r8d, 5
add edx, r8d
add eax, edx
jmp 0x61611515
ret

Function at 0x61620b50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov rdx, rcx
mov ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x38]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x61620b60
xor eax, eax
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x68]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x61620b7a
call fcn.61636ce0
lea rcx, [rdx + 0x98]
mov rsi, qword [rdx + 0x28]
mov ebx, eax
call fcn.61657200
xor ebx, eax
mov ecx, ebx
xor ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.61636ce0

Function at 0x61631850
Capabilities:
Check os version

Disassembly:
push r13
push r12
sub rsp, 0xc8
mov rax, qword [0x61766000]
cmp dword [rax], 0
jne 0x6163186c
call fcn.61615e80
mov r12, qword [0x6173f970]
mov rcx, r12
test r12, r12
jne 0x61631920
mov ecx, 0x70
call sub.msvcrt.dll_malloc
lea rdx, [0x6176e1a0]
mov rcx, rax
mov r13, rax
call fcn.61609fd0
call fcn.616331b0
mov qword [r13 + 0x58], 0
lea rcx, [rsp + 0x2c]
mov qword [r13 + 0x60], rax
mov dword [rsp + 0x2c], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x3c], 1
jne 0x616318d4
cmp dword [rsp + 0x30], 4
jne 0x616318d4
cmp dword [rsp + 0x34], 0xa
je 0x61631900
lea rcx, str.msimg32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r13 + 0x58], rax
mov r12, rax
test rax, rax
je 0x61631900
lea rdx, str.AlphaBlend
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
xor eax, eax
mov qword [r13 + 0x68], r12
lock cmpxchg qword [0x6173f970], r13
mov rcx, r13
je 0x61631920
call sub.msvcrt.dll_free
mov rcx, qword [0x6173f970]
call fcn.61656c90
add rsp, 0xc8
pop r12
pop r13
ret

Function at 0x61636d00
Capabilities:
Check os version

Disassembly:
push r12
sub rsp, 0xc0
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r12d, eax
test eax, eax
jne 0x61636d31
lea rcx, str._have_cleartype_quality
call fcn.61633590
jmp 0x61636d52
cmp dword [rsp + 0x30], 5
mov r12d, 1
ja 0x61636d52
mov r12d, 0
jne 0x61636d52
xor r12d, r12d
cmp dword [rsp + 0x34], 0
setne r12b
mov eax, r12d
add rsp, 0xc0
pop r12
ret
Function at 0x61638e40
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
lea rcx, str.PIXMAN_DISABLE
call sub.msvcrt.dll_getenv
mov r14, rax
xor eax, eax
test r14, r14
je 0x61638eeb
or rcx, 0xffffffffffffffff
mov rdi, r12
or rbp, 0xffffffffffffffff
xor r13d, r13d
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
mov edx, 0x20
mov rcx, r14
call sub.msvcrt.dll_strchr
mov rbx, rax
test rax, rax
je 0x61638e9c
sub ebx, r14d
jmp 0x61638ead
mov rcx, rbp
mov rdi, r14
mov eax, r13d
repne scasb al, byte [rdi]
not rcx
lea ebx, [rcx - 1]
movsxd rbx, ebx
cmp rsi, rbx
jne 0x61638edd
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x61638edd
mov rdx, r12
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.61704150
mov eax, 1
jmp 0x61638eeb
add rbx, r14
cmp byte [rbx], 0
lea r14, [rbx + 1]
jne 0x61638e82
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x140364560]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x140364570]
mov dword [rax], 1
mov rax, qword [0x140364580]
mov dword [rax], 1
mov rax, qword [0x140364510]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140364550]
mov dword [0x14039f00c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x140364620]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x140364600]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1403644c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x1400865d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140086660
cmp r11, r10
ja 0x1400866d6
cmp r10, rdx
ja 0x1400866e8
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x140086662
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140086640
jmp 0x1400866c4
ja 0x14008666a
mov r11, r10
cmp rax, r8
jne 0x140086604
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400866a0
mov rdi, r8
sub ecx, edx
jns 0x1400866bb
jmp 0x1400866c6
cmp r8, rsi
je 0x1400866f7
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x1400866c6
xor al, 1
cmp rdi, rsi
jne 0x140086680
jmp 0x1400866c6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call dbg.slice_index_order_fail
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call dbg.slice_end_index_len_fail
lea rcx, str.librarycore_srcunicodeprintable.rs
call dbg.unwrap_failed
int3

Function at 0x14008bef3
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140273038]
test ecx, ecx
je 0x14008bf0c
dec ecx
add rsp, 0x28
jmp fcn.1401c03bc
lea rcx, sym.std::sys::thread_local::os_local::destroy_value::ha2fdd821c3b999c2
call dbg.init
mov ecx, eax
jmp 0x14008bf03

Function at 0x14008bf1c
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14008bf3d
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.1401c03b4
mov rcx, rax
call dbg.init
mov ecx, eax
jmp 0x14008bf30

Function at 0x14008bf49
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rdi, qword [rcx]
mov edx, 1
mov rcx, rdi
call sym.std::sys::pal::windows::thread_local_key::StaticKey::set::h080abc5c6b923c1e
lea rcx, [rsi + 8]
call sym._ZN4core3ptr130drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT_core..option..Option_LT_env_logger..fmt..Format
mov edx, 8
mov rcx, rsi
call sym.__rust_dealloc
mov rcx, rdi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp sym.std::sys::pal::windows::thread_local_key::StaticKey::set::h080abc5c6b923c1e