joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401293e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140066b20
mov rcx, rdi
mov dword [rbx], eax
call fcn.140066b20
mov rcx, rdi
mov dword [rbx + 4], eax
call fcn.140066b20
mov dword [rbx + 8], eax
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 0xc], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
mov byte [rbx + 0xd], al
call fcn.140066da0
mov edx, 0x10
mov word [rbx + 0xe], ax
mov r9, qword [rdi]
lea rcx, [rbx + 0x10]
lea r8d, [rdx - 0xf]
call fcn.1401c1e14
mov rbx, qword [rsp + 0x30]
xor edx, edx
test rax, rax
mov ecx, 4
cmovne ecx, edx
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x140129560
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rdi, rdx
mov esi, 2
mov rbx, rcx
lea edx, [rsi + 2]
mov r8d, esi
mov rcx, rdi
call fcn.1401c1e14
mov rcx, rbx
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 8], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0xa], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0xc], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0xe], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x10], ax
call fcn.140066da0
mov rcx, rbx
mov word [rdi + 0x12], ax
call fcn.140066b20
mov dword [rdi + 0x14], eax
cmp eax, 0x48434749
je 0x1401295f8
movzx eax, si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rbx]
lea rcx, [rdi + 0x18]
mov r8, rsi
mov edx, 6
call fcn.1401c1e14
mov rcx, qword [rbx]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
neg eax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
add rsp, 0x20
pop rdi
ret
Function at 0x140129790
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x4c8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov r14, rcx
lea rcx, [rsp + 0x30]
mov r15, r9
mov qword [rsp + 0x28], r9
movsx ebp, r8w
movsx r12d, dx
call fcn.140060c40
mov eax, dword [str.Vista]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x11e], eax
movzx eax, word [0x14020e16c]
mov rcx, r15
mov word [rsp + 0x122], ax
mov eax, 0x10
mov dword [rsp + 0x50], 0x80001
lea r13d, [rax - 0xf]
mov word [rsp + 0x34], ax
lea eax, [r12 + r12*2]
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x58], eax
call fcn.14005ee10
movzx esi, ax
test ax, ax
jne 0x14012991e
mov qword [rsp + 0x4c0], rbx
mov qword [rsp + 0x4b8], rdi
xor edi, edi
movzx ebx, di
mov r15d, 0x300
nop dword [rax + rax]
mov r9, qword [r14]
lea rcx, [rsp + 0x20]
mov r8, r13
mov edx, 3
call fcn.1401c1e14
movzx eax, byte [rsp + 0x20]
movsx rcx, bx
mov byte [rsp + rcx + 0x1a0], al
movzx eax, byte [rsp + 0x21]
inc bx
movsx rcx, bx
inc bx
mov byte [rsp + rcx + 0x1a0], al
movzx eax, byte [rsp + 0x22]
movsx rcx, bx
inc bx
mov byte [rsp + rcx + 0x1a0], al
cmp bx, r15w
jl 0x140129850
mov r15, qword [rsp + 0x28]
cmp di, bp
jge 0x1401298f3
movsx rbx, r12w
mov r9, qword [r14]
mov rcx, qword [rsp + 0x40]
mov r8, r13
mov rdx, rbx
call fcn.1401c1e14
test rax, rax
je 0x1401298ee
or r8d, 0xffffffff
mov r9d, r13d
mov rcx, r15
or edx, r8d
call fcn.1400615b0
movzx esi, ax
test ax, ax
jne 0x1401298f3
inc di
cmp di, bp
jl 0x1401298b2
jmp 0x1401298f3
mov esi, 4
lea r9, [rsp + 0x1a0]
mov edx, 0x100
mov r8d, 8
mov rcx, r15
call fcn.14005cb20
mov rdi, qword [rsp + 0x4b8]
mov rbx, qword [rsp + 0x4c0]
movzx eax, si
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x4c8
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x14012d250
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push r15
sub rsp, 0x48
xor ebx, ebx
mov r15, r8
mov rsi, rcx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], ebx
call qword [r8 + 0x40]
movzx ebp, ax
test ebp, ebp
jne 0x14012d284
xor eax, eax
add rsp, 0x48
pop r15
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
lea rbx, [0x1402a1db8]
nop
mov rcx, rsi
call qword [r15 + 0x40]
mov rcx, rsi
mov word [rsp + 0x80], ax
call qword [r15 + 0x40]
movzx r14d, ax
cmp ax, 0x34
jae 0x14012d3ef
mov rcx, rsi
call qword [r15 + 0x48]
mov r13d, eax
movzx eax, r14w
mov edi, dword [rbx + rax*4]
imul edi, r13d
test edi, edi
je 0x14012d3ef
cmp r14w, 0xd
ja 0x14012d3ef
movsxd r12, edi
cmp r12, qword [rsi + 0x108]
jge 0x14012d3e5
mov rcx, rsi
call qword [r15 + 0x48]
cmp edi, 4
jle 0x14012d30e
mov dword [rsp + 0x24], eax
jmp 0x14012d312
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi]
call fcn.1401c1a94
test eax, eax
jne 0x14012d3ef
mov rcx, qword [rsp + 0x90]
call fcn.14005ab00
mov rbx, rax
test rax, rax
je 0x14012d3de
movzx eax, word [rsp + 0x80]
mov ecx, 0x927c
cmp ax, cx
je 0x14012d3de
mov word [rbx], ax
mov eax, dword [rsp + 0x78]
mov word [rbx + 2], r14w
mov dword [rbx + 8], r13d
mov dword [rbx + 4], eax
cmp edi, 4
jle 0x14012d3ba
mov rcx, r12
mov dword [rbx + 0x10], edi
call fcn.1401bee78
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14012d3de
mov rcx, qword [rsi]
call fcn.1401c2310
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsi]
xor r8d, r8d
mov edi, eax
call fcn.1401c1f88
mov r9, qword [rsi]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov rdx, r12
call fcn.1401c1e14
mov rcx, qword [rsi]
xor r8d, r8d
mov edx, edi
call fcn.1401c1f88
jmp 0x14012d3de
cmp r14w, 3
jne 0x14012d3d7
lea rax, [fcn.140065fd0]
cmp qword [r15 + 0x50], rax
jne 0x14012d3d7
mov eax, dword [rsp + 0x20]
shr eax, 0x10
jmp 0x14012d3db
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0xc], eax
lea rbx, [0x1402a1db8]
dec ebp
test ebp, ebp
jne 0x14012d2a0
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x48
pop r15
pop rsi
pop rbp
pop rbx
ret
jmp 0x14012d250
Function at 0x14012d420
Capabilities:
Read file on windows

Disassembly:
test r8d, r8d
je 0x14012d4ed
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov ebp, r9d
mov esi, r8d
mov r14, rcx
test r9d, r9d
je 0x14012d4dd
cmp rsi, qword [rcx + 0x108]
jge 0x14012d4dd
mov rcx, rdx
mov qword [rsp + 0x38], rdi
call fcn.14005ab00
mov rdi, rax
test rax, rax
je 0x14012d4d8
mov rcx, qword [r14]
mov qword [rsp + 0x30], rbx
call fcn.1401c2310
mov rcx, qword [r14]
xor r8d, r8d
mov edx, esi
mov ebx, eax
call fcn.1401c1f88
movzx ecx, word [rsp + 0x50]
mov eax, 2
mov word [rdi], cx
movsxd rcx, ebp
mov dword [rdi + 4], 1
mov word [rdi + 2], ax
mov dword [rdi + 0x10], ebp
mov dword [rdi + 8], ebp
call fcn.1401bee78
mov edx, ebp
mov r8d, 1
mov qword [rdi + 0x18], rax
mov r9, qword [r14]
mov rcx, rax
call fcn.1401c1e14
mov rcx, qword [r14]
xor r8d, r8d
mov edx, ebx
call fcn.1401c1f88
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14012d4f0
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push r15
sub rsp, 0x48
xor ebx, ebx
mov r15, r8
mov rsi, rcx
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x24], ebx
call qword [r8 + 0x40]
movzx ebp, ax
test ebp, ebp
jne 0x14012d284
xor eax, eax
add rsp, 0x48
pop r15
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
lea rbx, [0x1402a1db8]
nop
mov rcx, rsi
call qword [r15 + 0x40]
mov rcx, rsi
mov word [rsp + 0x80], ax
call qword [r15 + 0x40]
movzx r14d, ax
cmp ax, 0x34
jae 0x14012d3ef
mov rcx, rsi
call qword [r15 + 0x48]
mov r13d, eax
movzx eax, r14w
mov edi, dword [rbx + rax*4]
imul edi, r13d
test edi, edi
je 0x14012d3ef
cmp r14w, 0xd
ja 0x14012d3ef
movsxd r12, edi
cmp r12, qword [rsi + 0x108]
jge 0x14012d3e5
mov rcx, rsi
call qword [r15 + 0x48]
cmp edi, 4
jle 0x14012d30e
mov dword [rsp + 0x24], eax
jmp 0x14012d312
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi]
call fcn.1401c1a94
test eax, eax
jne 0x14012d3ef
mov rcx, qword [rsp + 0x90]
call fcn.14005ab00
mov rbx, rax
test rax, rax
je 0x14012d3de
movzx eax, word [rsp + 0x80]
mov ecx, 0x927c
cmp ax, cx
je 0x14012d3de
mov word [rbx], ax
mov eax, dword [rsp + 0x78]
mov word [rbx + 2], r14w
mov dword [rbx + 8], r13d
mov dword [rbx + 4], eax
cmp edi, 4
jle 0x14012d3ba
mov rcx, r12
mov dword [rbx + 0x10], edi
call fcn.1401bee78
mov qword [rbx + 0x18], rax
test rax, rax
je 0x14012d3de
mov rcx, qword [rsi]
call fcn.1401c2310
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsi]
xor r8d, r8d
mov edi, eax
call fcn.1401c1f88
mov r9, qword [rsi]
mov rcx, qword [rbx + 0x18]
mov r8d, 1
mov rdx, r12
call fcn.1401c1e14
mov rcx, qword [rsi]
xor r8d, r8d
mov edx, edi
call fcn.1401c1f88
jmp 0x14012d3de
cmp r14w, 3
jne 0x14012d3d7
lea rax, [fcn.140065fd0]
cmp qword [r15 + 0x50], rax
jne 0x14012d3d7
mov eax, dword [rsp + 0x20]
shr eax, 0x10
jmp 0x14012d3db
mov eax, dword [rsp + 0x20]
mov dword [rbx + 0xc], eax
lea rbx, [0x1402a1db8]
dec ebp
test ebp, ebp
jne 0x14012d2a0
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x48
pop r15
pop rsi
pop rbp
pop rbx
ret
jmp 0x14012d250

Function at 0x14012d5d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov rbp, r8
xor r8d, r8d
mov rdi, r9
call fcn.1401c1f88
xor ebx, ebx
nop word [rax + rax]
mov r9, qword [rsi]
mov edx, 8
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 7]
call fcn.1401c1e14
mov ecx, dword [rsp + 0x30]
call rdi
mov ecx, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
call rdi
inc rbx
movd xmm1, dword [rsp + 0x30]
movd xmm0, eax
mov dword [rsp + 0x34], eax
cvtdq2ps xmm1, xmm1
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
movss dword [rbp + rbx*4 - 4], xmm1
cmp rbx, 3
jl 0x14012d600
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14012e6a0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov r14d, r9d
mov ebp, r8d
mov rdi, rdx
mov r15, rcx
test r8d, r8d
jle 0x14012e7c5
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], r12
lea r12, [0x14020bdd0]
mov qword [rsp + 0x58], rsi
nop dword [rax + rax]
mov rcx, qword [r15]
call fcn.1401c3f28
mov ebx, eax
cmp ax, 0xffff
je 0x14012e7be
test r14d, r14d
je 0x14012e701
movzx eax, bl
movzx ebx, byte [rax + r12]
cmp bx, 0x7f
jg 0x14012e759
mov r9, qword [r15]
inc bx
mov r8d, 1
movsx eax, bx
movsx rsi, bx
mov rcx, rdi
mov rdx, rsi
sub ebp, eax
call fcn.1401c1e14
test rax, rax
je 0x14012e7be
test r14d, r14d
je 0x14012e754
cmp r13w, bx
jge 0x14012e754
mov rax, rdi
movzx edx, bx
movzx ecx, byte [rax]
inc rax
movzx ecx, byte [rcx + r12]
mov byte [rax - 1], cl
dec rdx
jne 0x14012e741
add rdi, rsi
jmp 0x14012e796
mov rcx, qword [r15]
mov esi, 0x101
sub si, bx
movsx eax, si
sub ebp, eax
call fcn.1401c3f28
cmp ax, 0xffff
je 0x14012e7be
test r14d, r14d
je 0x14012e781
movzx eax, al
movzx eax, byte [rax + r12]
movsx rbx, si
movsx edx, ax
mov rcx, rdi
mov r8, rbx
call fcn.1401c0040
add rdi, rbx
test ebp, ebp
jg 0x14012e6e0
movzx eax, r13w
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov eax, 4
jmp 0x14012e7a2
movzx eax, r13w
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x140132750
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp dword [r8 + 0x1c], ebx
jle 0x1401327cc
nop word [rax + rax]
movsx eax, word [rdi + 0x20]
mov r9, qword [r14]
mov rcx, qword [rdi + 0x10]
imul eax, dword [rdi + 0x28]
movsxd rdx, eax
mov r8d, 1
call fcn.1401c1e14
test rax, rax
je 0x1401327c5
or r8d, 0xffffffff
mov r9d, 1
mov rcx, rsi
or edx, r8d
call fcn.1400615b0
test ax, ax
jne 0x1401327cf
inc ebx
cmp ebx, dword [rdi + 0x1c]
jl 0x140132780
jmp 0x1401327cf
mov eax, 4
jmp 0x1401327cf
movzx eax, bx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140132b20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, qword [rcx]
mov rbx, rdx
call fcn.1401c3f28
mov byte [rbx], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 1], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 2], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
mov byte [rbx + 3], al
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 4], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 6], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 8], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0xa], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0xc], ax
call fcn.140066da0
mov edx, 0x30
mov word [rbx + 0xe], ax
mov r9, qword [rdi]
lea rcx, [rbx + 0x10]
lea r8d, [rdx - 0x2f]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c3f28
mov byte [rbx + 0x40], al
mov rcx, qword [rdi]
call fcn.1401c3f28
mov rcx, rdi
mov byte [rbx + 0x41], al
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0x42], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0x44], ax
call fcn.140066da0
mov rcx, rdi
mov word [rbx + 0x46], ax
call fcn.140066da0
mov edx, 0x36
mov word [rbx + 0x48], ax
mov r9, qword [rdi]
lea rcx, [rbx + 0x4a]
lea r8d, [rdx - 0x35]
call fcn.1401c1e14
mov rcx, qword [rdi]
call fcn.1401c1a94
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
test eax, eax
sete cl
movzx eax, cx
add rsp, 0x20
pop rdi
ret

Function at 0x140133100
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 6
mov rdi, rcx
lea r8d, [rdx - 5]
mov rcx, rbx
call fcn.1401c1e14
cmp byte [rbx], 0
jne 0x14013318a
cmp byte [rbx + 1], 0x43
jne 0x14013318a
cmp byte [rbx + 2], 0
jne 0x14013318a
cmp byte [rbx + 3], 0x50
jne 0x14013318a
cmp byte [rbx + 4], 0
jne 0x14013318a
cmp byte [rbx + 5], 0x38
jne 0x14013318a
mov rcx, rdi
call fcn.140066de0
mov rcx, rdi
mov word [rbx + 6], ax
call fcn.140066de0
mov edx, 6
mov word [rbx + 8], ax
mov r9, qword [rdi]
lea rcx, [rbx + 0xa]
lea r8d, [rdx - 5]
call fcn.1401c1e14
neg rax
sbb ecx, ecx
and ecx, 4
movzx eax, cx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401331a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov word [rsp + 0x20], r9w
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsx eax, r8w
xor r13d, r13d
mov r15, rcx
mov dword [rsp + 0x24], eax
add eax, 0x3e8
movzx ebp, r9w
movsxd rcx, eax
movzx esi, r13w
mov word [rsp + 0x20], r13w
xor dil, dil
movzx ebx, r13w
call fcn.1401bee78
mov r14, rax
test rax, rax
je 0x140133457
cmp r13w, bp
jge 0x140133449
lea r12d, [r13 + 1]
nop
mov rcx, qword [r15]
call fcn.1401c3f28
movzx ecx, al
and cl, 0x3f
movzx ebp, cl
jne 0x140133228
mov ebp, 0x40
movzx ecx, al
and ecx, 0xc0
je 0x1401333b3
sub ecx, 0x40
je 0x140133344
sub ecx, 0x40
je 0x14013326f
cmp ecx, 0x40
jne 0x1401333dc
mov rcx, qword [r15]
call fcn.1401c3f28
movzx ecx, bx
movzx r8d, bp
movzx edx, al
add rcx, r14
mov edi, eax
call fcn.1401c0040
jmp 0x1401333d9
test bp, bp
je 0x1401333dc
mov rcx, qword [r15]
call fcn.1401c3f28
movzx ecx, al
mov r8d, eax
and cl, 2
neg cl
movzx ecx, al
sbb dl, dl
and cl, 3
and dl, 0xfc
or dl, cl
movzx ecx, bx
inc bx
add dil, dl
mov edx, 0xffff
mov byte [rcx + r14], dil
add bp, dx
je 0x1401333dc
shr r8b, 2
movzx eax, r8b
and al, 2
neg al
movzx eax, r8b
sbb cl, cl
and al, 3
and cl, 0xfc
or cl, al
movzx eax, bx
inc bx
add dil, cl
mov byte [rax + r14], dil
add bp, dx
je 0x1401333dc
shr r8b, 2
movzx eax, r8b
and al, 2
neg al
movzx eax, r8b
sbb cl, cl
and al, 3
and cl, 0xfc
or cl, al
movzx eax, bx
inc bx
add dil, cl
mov byte [rax + r14], dil
add bp, dx
je 0x1401333dc
shr r8b, 2
movzx eax, r8b
and al, 2
neg al
movzx eax, bx
sbb cl, cl
and r8b, 3
inc bx
and cl, 0xfc
or cl, r8b
add dil, cl
mov byte [rax + r14], dil
add bp, dx
jne 0x140133278
jmp 0x1401333dc
test bp, bp
je 0x1401333dc
nop dword [rax]
mov rcx, qword [r15]
call fcn.1401c3f28
movzx ecx, al
mov r8d, eax
and cl, 8
neg cl
movzx ecx, al
sbb dl, dl
and cl, 0xf
and dl, 0xf0
or dl, cl
movzx ecx, bx
inc bx
add dil, dl
mov edx, 0xffff
mov byte [rcx + r14], dil
add bp, dx
je 0x1401333dc
shr r8b, 4
movzx eax, r8b
and al, 8
neg al
movzx eax, bx
sbb cl, cl
and r8b, 0xf
inc bx
and cl, 0xf0
or cl, r8b
add dil, cl
mov byte [rax + r14], dil
add bp, dx
jne 0x140133350
jmp 0x1401333dc
mov r9, qword [r15]
movzx edi, bx
movzx esi, bp
lea rcx, [rdi + r14]
mov r8, r12
mov edx, esi
call fcn.1401c1e14
lea rax, [rdi + rsi]
movzx esi, word [rsp + 0x20]
movzx edi, byte [rax + r14 - 1]
add bx, bp
movzx eax, bx
cmp eax, dword [rsp + 0x24]
jl 0x14013343b
movsx rbp, word [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
inc si
mov rdx, r14
mov r8, rbp
mov word [rsp + 0x20], si
call fcn.1401bd6e0
mov rcx, qword [rsp + 0x90]
or r8d, 0xffffffff
or edx, r8d
mov r9d, r12d
call fcn.1400615b0
movzx r13d, ax
test ax, ax
jne 0x140133449
sub bx, bp
je 0x14013343b
movzx r8d, bx
mov rcx, r14
lea rdx, [r8 + r14]
call fcn.1401bd6e0
cmp si, word [rsp + 0x88]
jl 0x140133210
mov rcx, r14
call fcn.1401be23c
movzx eax, r13w
jmp 0x14013345c
mov eax, 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140133960
Capabilities:
Read file on windows

Disassembly:
test r8w, r8w
jle 0x140133a80
mov qword [rsp + 0x20], rbx
push rbp
push r12
push r15
sub rsp, 0x20
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
movzx r15d, r9w
mov qword [rsp + 0x50], r14
movzx ebp, r8w
mov rbx, rdx
mov r12, rcx
mov rcx, qword [r12]
call fcn.1401c3f28
test al, al
je 0x1401339f8
cmp al, 0x80
je 0x1401339ce
movzx ecx, al
and al, 0x80
and cl, 0x7f
neg al
movzx esi, cl
sbb edx, edx
mov rcx, rbx
movzx edx, dl
mov r8d, esi
call fcn.1401c0040
add rbx, rsi
sub bp, si
jmp 0x140133a5a
mov rcx, qword [r12]
call fcn.1401c3f28
mov r9, qword [r12]
mov edx, 1
movzx ecx, al
sub bp, cx
mov edi, ecx
mov r8d, ecx
mov rcx, rbx
call fcn.1401c1e14
add rbx, rdi
jmp 0x140133a5a
mov rcx, qword [r12]
call fcn.1401c3f28
mov r9, qword [r12]
movsx r14, r15w
movzx esi, al
mov r8, r14
mov edx, 1
mov rcx, rbx
mov edi, eax
dec si
call fcn.1401c1e14
test dil, dil
je 0x140133a5a
mov rdi, rbx
sub bp, r15w
add rbx, r14
test si, si
je 0x140133a5a
nop word [rax + rax]
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1401bd6e0
add rbx, r14
sub bp, r15w
dec si
jne 0x140133a40
test bp, bp
jg 0x140133995
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rbp
ret

Function at 0x140133af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
lea r15d, [r8 + 0x32]
mov rbx, rdx
mov rsi, rcx
mov ebp, r12d
test r15d, r15d
jle 0x140133c3b
mov rcx, qword [rsi]
call fcn.1401c3f28
mov edi, eax
cmp eax, 0xffffffff
je 0x140133c5e
mov rcx, qword [rsi]
test eax, eax
jne 0x140133bf4
call fcn.1401c3f28
movsxd rdi, eax
cmp edi, 3
jge 0x140133b70
cmp edi, 2
jne 0x140133c3b
mov rcx, qword [rsi]
call fcn.1401c3f28
mov rcx, qword [rsi]
call fcn.1401c3f28
jmp 0x140133c32
test bpl, 1
je 0x140133bbc
mov eax, edi
sar eax, 1
test eax, eax
jle 0x140133ba2
mov r14d, eax
mov rcx, qword [rsi]
call fcn.1401c3f28
and byte [rbx], 0xf0
inc rbx
movzx ecx, al
shl al, 4
shr cl, 4
or byte [rbx - 1], cl
mov byte [rbx], al
dec r14
jne 0x140133b81
test dil, 1
je 0x140133bb8
mov rcx, qword [rsi]
call fcn.1401c3f28
shr al, 4
or byte [rbx], al
inc rbx
add ebp, edi
jmp 0x140133be0
mov r9, qword [rsi]
lea eax, [rdi + 1]
mov r8d, 1
sar eax, 1
mov rcx, rbx
movsxd rdx, eax
call fcn.1401c1e14
mov rax, rdi
add ebp, edi
sar rax, 1
add rbx, rax
and edi, 3
dec edi
cmp edi, 1
ja 0x140133c32
mov rcx, qword [rsi]
call fcn.1401c3f28
jmp 0x140133c32
call fcn.1401c3f28
mov edx, eax
test bpl, 1
je 0x140133c14
and byte [rbx], 0xf0
movzx ecx, al
inc rbx
shr cl, 4
dec edi
or byte [rbx - 1], cl
inc ebp
lea eax, [rdi + 1]
movzx edx, dl
mov rcx, rbx
sar eax, 1
movsxd r8, eax
call fcn.1401c0040
movsxd rax, edi
add ebp, edi
sar rax, 1
add rbx, rax
cmp ebp, r15d
jl 0x140133b27
movzx eax, r12w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, 4
jmp 0x140133c3f
Function at 0x140133c70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
xor ecx, ecx
mov rbx, rdx
movsxd r15, r8d
mov rax, rdx
mov r12d, ecx
mov edi, ecx
movzx r13d, cx
mov rcx, rbx
mov r8, r15
xor edx, edx
call fcn.1401c0040
cmp dword [rsp + 0x78], edi
jle 0x140133dcc
nop dword [rax]
mov rcx, qword [r14]
call fcn.1401c3f28
mov esi, eax
cmp eax, 0xffffffff
je 0x140133e0a
mov rcx, qword [r14]
test eax, eax
je 0x140133d08
call fcn.1401c3f28
mov edx, eax
test esi, esi
jle 0x140133dc1
mov ecx, esi
nop dword [rax + rax]
mov eax, edi
inc edi
cmp eax, r15d
jge 0x140133cfe
mov byte [rbx], dl
inc rbx
dec rcx
jne 0x140133cf0
jmp 0x140133dc1
call fcn.1401c3f28
mov ebp, eax
cmp eax, 1
je 0x140133dcc
cmp ebp, 2
jne 0x140133d45
mov r9, qword [r14]
lea r8d, [rbp - 1]
lea rcx, [rsp + 0x70]
mov edx, ebp
call fcn.1401c1e14
movzx eax, word [rsp + 0x70]
movzx ecx, al
add edi, ecx
movzx ecx, al
add rbx, rcx
jmp 0x140133dc1
test eax, eax
jne 0x140133d88
mov rcx, qword [rsp + 0x80]
or r8d, 0xffffffff
lea r9d, [rax + 1]
or edx, r8d
xor edi, edi
call fcn.1400615b0
movzx r13d, ax
test ax, ax
jne 0x140133dcc
mov rcx, qword [rsp + 0x68]
mov r8, r15
xor edx, edx
mov rax, r15
call fcn.1401c0040
mov rbx, qword [rsp + 0x68]
inc r12d
jmp 0x140133dc1
test ebp, ebp
jle 0x140133db3
mov rsi, rbp
nop
mov rcx, qword [r14]
mov eax, edi
inc edi
cmp eax, r15d
jl 0x140133da3
call fcn.1401c3f28
jmp 0x140133dae
call fcn.1401c3f28
inc rbx
mov byte [rbx - 1], al
dec rsi
jne 0x140133d90
test bpl, 1
je 0x140133dc1
mov rcx, qword [r14]
call fcn.1401c3f28
cmp r12d, dword [rsp + 0x78]
jl 0x140133cc0
cmp r12d, dword [rsp + 0x78]
je 0x140133df1
mov rcx, qword [rsp + 0x80]
or r8d, 0xffffffff
mov r9d, 1
or edx, r8d
call fcn.1400615b0
movzx r13d, ax
movzx eax, r13w
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, 4
jmp 0x140133df5