joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006a514
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 8], 0
jne 0x140069c2a
xor eax, eax
add rsp, 0x28
ret
call fcn.140069c48
mov rcx, rax
add rsp, 0x28
jmp 0x14006a514
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x14023e150]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x14006a55f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x14006a568
call fcn.1400059cc
test eax, eax
je 0x14006a584
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14006a58c
xor eax, eax
jmp 0x14006a5e9
test rbx, rbx
jne 0x14006a5ac
lea rcx, str.ImageList_Destroy
call fcn.140014a64
mov rbx, rax
test rax, rax
je 0x14006a5b7
mov qword [0x14023e150], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14006a5cc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14006a5ce
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006a5e7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14006a600
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x50
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov r13, rcx
xor esi, esi
mov qword [rax - 0x20], rsi
mov rbx, qword [0x14023e158]
and qword [rax - 0x28], rsi
xor edi, edi
mov eax, dword [0x140239084]
test eax, eax
je 0x14006a65d
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x14006a666
call fcn.1400059cc
test eax, eax
je 0x14006a682
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne edi, ecx
test edi, edi
jne 0x14006a68d
xor eax, eax
jmp 0x14006a718
test rbx, rbx
jne 0x14006a6ad
lea rcx, str.ImageList_LoadImageA
call fcn.140014a64
mov rbx, rax
test rax, rax
je 0x14006a6e4
mov qword [0x14023e158], rax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, r15d
mov rdx, r12
mov rcx, r13
call rbx
mov rsi, rax
mov qword [rsp + 0x48], rax
xor ebx, ebx
test rsi, rsi
sete bl
test ebx, ebx
je 0x14006a6fa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x14006a6fc
xor edi, edi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14006a715
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
Function at 0x1400ef418
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140240928]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x1400ef463
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x1400ef46c
call fcn.1400059cc
test eax, eax
je 0x1400ef488
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400ef490
xor eax, eax
jmp 0x1400ef4ed
test rbx, rbx
jne 0x1400ef4b0
lea rcx, str.ChooseColorA
call fcn.140016a74
mov rbx, rax
test rax, rax
je 0x1400ef4bb
mov qword [0x140240928], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400ef4d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400ef4d2
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400ef4eb
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400f61ac
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140240b20]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x1400f61f7
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x1400f6200
call fcn.1400059cc
test eax, eax
je 0x1400f621c
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x1400f6224
xor eax, eax
jmp 0x1400f6281
test rbx, rbx
jne 0x1400f6244
lea rcx, str.PrintDlgA
call fcn.140016a74
mov rbx, rax
test rax, rax
je 0x1400f624f
mov qword [0x140240b20], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x1400f6264
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x1400f6266
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x1400f627f
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1400fca10
Capabilities:
Delete registry value

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1400fcb4c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x38
mov rcx, qword [rcx + 8]
lea rax, [r11 + 8]
lea r9, [r11 + 0x20]
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], r8
xor r8d, r8d
mov dword [rsp + 0x40], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edx, edx
test eax, eax
jne 0x1400fcb8e
mov ecx, dword [rsp + 0x58]
sub ecx, 4
neg ecx
sbb eax, eax
and eax, 0xd
test eax, eax
sete dl
mov eax, edx
add rsp, 0x38
ret

Function at 0x1400fcf7c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
test rdx, rdx
je 0x1400fd04e
test rbx, rbx
je 0x1400fd054
test r9, r9
je 0x1400fd05a
and qword [r8], 0
and dword [r9], 0
mov rcx, qword [rcx + 8]
mov qword [rax - 0x10], r9
and qword [rax - 0x18], 0
lea r9, [rax + 0x10]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400fd037
cmp dword [rsp + 0x48], 3
jne 0x1400fd037
test eax, eax
jne 0x1400fd037
cmp dword [rdi], eax
je 0x1400fd037
mov ecx, dword [rdi]
call fcn.140005900
lea r9, [rsp + 0x48]
xor r8d, r8d
mov qword [rbx], rax
mov rcx, qword [rbp + 8]
mov rdx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400fd02b
cmp dword [rsp + 0x48], 3
jne 0x1400fd02b
test eax, eax
jne 0x1400fd02b
mov eax, 1
jmp 0x1400fd039
mov rcx, qword [rbx]
call fcn.140005944
and qword [rbx], 0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
call fcn.140005bd0
int3
call fcn.140005bd0
int3
call fcn.140005bd0
int3

Function at 0x1400fd314
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400fd325
xor eax, eax
jmp 0x1400fd353
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], r8d
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret

Function at 0x1400fd35c
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
cmp dword [rcx + 0x28], ebx
je 0x1400fd36d
xor eax, eax
jmp 0x1400fd391
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], r8
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x14014f2a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test byte [rdx + 4], 1
mov esi, r8d
mov rbx, rdx
mov rbp, rcx
je 0x14014f2cd
mov rdi, qword [rdx + 0x10]
jmp 0x14014f31e
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rbx + 8]
mov r8d, 5
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
jne 0x14014f2ee
call fcn.140018ab0
mov rcx, qword [rbx + 8]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
jne 0x14014f308
call fcn.140018ab0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
jne 0x14014f31e
call fcn.140018ab0
call fcn.1400069c4
cmp qword [rax + 0x68], 0
je 0x14014f338
mov rdx, rdi
mov rcx, rbp
call fcn.14014e904
mov rdi, rax
mov edx, esi
mov rcx, rdi
call fcn.14014f59c
mov rcx, qword [rbp + 0xe8]
mov rsi, rax
test rcx, rcx
je 0x14014f35f
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rbp + 0xe8], 0
test rsi, rsi
je 0x14014f36e
mov rdi, rsi
mov qword [rbp + 0xe8], rsi
or dword [rbx + 4], 1
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14014f70c
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
mov qword [rax - 0x18], rbx
mov r14, qword [0x140241b38]
and qword [rax + 8], rbx
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x14014f758
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x14014f761
call fcn.1400059cc
test eax, eax
je 0x14014f77d
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14014f788
xor eax, eax
jmp 0x14014f80c
test r14, r14
jne 0x14014f7a5
lea rcx, str.CreatePropertySheetPageA
call fcn.14014fa08
test rax, rax
je 0x14014f7d7
mov qword [0x140241b38], rax
mov eax, dword [rdi + 4]
mov ecx, 0x4000
test ecx, eax
jne 0x14014f7c6
cmp dword [rdi], 0x60
jb 0x14014f7c6
or eax, ecx
mov dword [rdi + 4], eax
mov rax, qword [0x140231040]
mov qword [rdi + 0x58], rax
mov rcx, rdi
call qword [0x140241b38]
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edi, edi
test rbx, rbx
sete dil
test edi, edi
je 0x14014f7ee
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14014f7f0
xor esi, esi
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test edi, edi
je 0x14014f809
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14014f824
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
xor edi, edi
mov dword [rax - 0x18], edi
mov rbx, qword [0x140241b40]
and qword [rax + 0x10], rdi
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x14014f86f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x14014f878
call fcn.1400059cc
test eax, eax
je 0x14014f894
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14014f89c
xor eax, eax
jmp 0x14014f8f9
test rbx, rbx
jne 0x14014f8bc
lea rcx, str.DestroyPropertySheetPage
call fcn.14014fa08
mov rbx, rax
test rax, rax
je 0x14014f8c7
mov qword [0x140241b40], rax
mov rcx, r14
call rbx
mov edi, eax
mov dword [rsp + 0x20], eax
xor ebx, ebx
test edi, edi
sete bl
test ebx, ebx
je 0x14014f8dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14014f8de
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14014f8f7
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14014f910
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, rcx
or rdi, 0xffffffffffffffff
mov qword [rax - 0x18], rdi
mov rbx, qword [0x140241b48]
and qword [rax + 0x10], 0
xor esi, esi
mov eax, dword [0x140239084]
test eax, eax
je 0x14014f95f
lea rcx, str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x140239084]
test eax, eax
jne 0x14014f968
call fcn.1400059cc
test eax, eax
je 0x14014f984
lea rdx, [rsp + 0x48]
mov rcx, qword [0x140231040]
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
mov ecx, 1
test eax, eax
cmovne esi, ecx
test esi, esi
jne 0x14014f98e
or rax, 0xffffffffffffffff
jmp 0x14014f9f0
test rbx, rbx
jne 0x14014f9ae
lea rcx, str.PropertySheetA
call fcn.14014fa08
mov rbx, rax
test rax, rax
je 0x14014f9bb
mov qword [0x140241b48], rax
mov rcx, r14
call rbx
mov rdi, rax
mov qword [rsp + 0x20], rax
xor ebx, ebx
cmp rdi, 0xffffffffffffffff
sete bl
test ebx, ebx
je 0x14014f9d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x14014f9d4
xor esi, esi
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeactivateActCtx]
test ebx, ebx
je 0x14014f9ed
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x14017a2a0
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14017a108
Function at 0x1400024d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000252d
lea rbx, [0x14004fd00]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002514
cmp r10, 2
jb 0x140002514
cmp byte [r9], r8b
jne 0x140002514
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400024f0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000256f
lea rbx, [0x14004fd00]
cmp r8b, 0x23
jne 0x140002553
cmp byte [r9], r8b
jne 0x140002553
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002540
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x14000275f
mov r8d, 0x600
lea rdx, str.D:ProJectData1ShopExternal_Guiimguiimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x14000276b
mov qword [rdi], 0
lea rdx, [0x14004f910]
mov rcx, rbx
call fcn.140002580
mov rbx, rax
test rax, rax
jne 0x14000278d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140002864
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002864
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002864
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002864
cmp rsi, 0xffffffffffffffff
je 0x140002864
mov rax, qword [0x1400a72c0]
test rax, rax
je 0x140002801
inc dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x140002864
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x140002851
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400a72c0]
test rax, rax
je 0x140002846
dec dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000286d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x14000285f
mov qword [rdi], rsi
mov rax, rbp
jmp 0x14000286f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004da0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc8], 0
mov rbx, rcx
mov edi, edx
jg 0x140004dd6
mov r8d, 0x67f
lea rdx, str.D:ProJectData1ShopExternal_Guiimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc8]
mov rax, qword [rbx + 0xd0]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x14004fd00]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1400a72c0]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1b30], edx
jne 0x140004e50
mov dword [rax + 0x1b34], edx
cmp dword [rax + 0x1b70], edx
jne 0x140004e5f
mov byte [rax + 0x1b74], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x14000fcd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400a72c0]
mov rsi, rcx
mov rbx, qword [rax + 0x1ae0]
add rbx, 0xc8
cmp dword [rbx], 0
jg 0x14000fd1b
mov r8d, 0x67f
lea rdx, str.D:ProJectData1ShopExternal_Guiimguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x14004fd00]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14000fdfa
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14000fde6
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000fdeb
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400186d0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140011160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1400a72c0]
mov edi, edx
cmp byte [rbx + 0x1e25], 0
jne 0x1400111b1
cmp byte [rbx + 0x1e26], 0
jne 0x1400111b1
mov r9d, dword [rbx + 0x2ec8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002450
test dil, 1
je 0x1400112d6
jmp 0x140011239
movss xmm1, dword [rbx + 0x1614]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400887b8]
xor eax, eax
mulss xmm1, dword [0x1400887a4]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1ba0], rax
mov dword [rbx + 0x1b8c], 1
movss dword [rbx + 0x1b98], xmm0
movss dword [rbx + 0x1b9c], xmm1
movss xmm0, dword [rbx + 0x1670]
mulss xmm0, dword [0x140088734]
or dword [rbx + 0x1b88], 0x41
movss dword [rbx + 0x1be8], xmm0
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002450
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140011290
lea r11, [0x14004fd00]
nop dword [rax]
cmp r9b, 0x23
jne 0x140011273
cmp byte [r8], r9b
jne 0x140011273
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140011260
not ecx
call fcn.140009fc0
test rax, rax
je 0x1400112d6
cmp byte [rax + 0x8e], 0
je 0x1400112d6
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xac], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2ec8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2ec8]
call fcn.140002450
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c710
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140016240
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1400a72c0]
cmp byte [rbx + 0x2f5c], 0
je 0x14001632c
cmp qword [rbx + 0x2f68], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x2f70]
je 0x140016314
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x1400162bb
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018450
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140002c90
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x2f68]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x2f78]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400a72b8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140002c90
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret