joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x1400da3e0]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x1400da3f0]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call sym._amsg_exit
jmp 0x14000123c
mov rax, qword [0x1400da3f0]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x1400da3f0]
mov dword [rax], 1
mov rax, qword [0x1400da450]
mov rdx, rax
mov rax, qword [0x1400da440]
mov rcx, rax
call sym._initterm
jmp 0x14000123c
mov dword [0x1400eb024], 1
mov rax, qword [0x1400da3f0]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x1400da430]
mov rdx, rax
mov rax, qword [0x1400da420]
mov rcx, rax
call sym._initterm
mov rax, qword [0x1400da3f0]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x1400da3e0]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x1400da320]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x1400da320]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call sym._pei386_runtime_relocator
mov rax, qword [sym._gnu_exception_handler]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x1400da3d0]
mov qword [rdx], rax
lea rax, [sym.__mingw_invalidParameterHandler]
mov rcx, rax
call sym._set_invalid_parameter_handler
call sym._fpreset
mov eax, dword [0x1400eb004]
lea rdx, [0x1400eb008]
mov ecx, eax
call sym.duplicate_ppstrings
call sym.__main
mov rax, qword [0x1400da360]
mov rax, qword [rax]
mov rdx, qword [0x1400eb010]
mov qword [rax], rdx
mov rcx, qword [0x1400eb010]
mov rdx, qword [0x1400eb008]
mov eax, dword [0x1400eb004]
mov r8, rcx
mov ecx, eax
call sym.main
mov dword [0x1400eb01c], eax
mov eax, dword [0x1400eb020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x1400eb01c]
mov ecx, eax
call sym.exit
mov eax, dword [0x1400eb024]
test eax, eax
jne 0x14000136c
call sym._cexit
mov eax, dword [0x1400eb01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x1400da390]
mov dword [rax], 1
mov rax, qword [0x1400da3a0]
mov dword [rax], 1
mov rax, qword [0x1400da3b0]
mov dword [rax], 1
mov rax, qword [0x1400da350]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016d0
Capabilities:
Get common file path

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x140
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 0x1c
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x1400017a6
lea rdx, str._breakdancer.conf
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathAppendA]
mov rcx, rsi
call sym.strlen
lea rbx, [rax + 1]
mov rcx, rbx
call sym.malloc
cmp ebx, 8
jae 0x140001750
test bl, 4
jne 0x140001780
test ebx, ebx
je 0x14000173d
movzx edx, byte [rsp + 0x30]
mov byte [rax], dl
test bl, 2
jne 0x140001798
add rsp, 0x140
pop rbx
pop rsi
pop rdi
ret
mov edx, ebx
mov rdi, rax
mov rcx, qword [rsi + rdx - 8]
mov qword [rax + rdx - 8], rcx
lea ecx, [rbx - 1]
mov ebx, ecx
shr ebx, 3
mov ecx, ebx
rep movsq qword [rdi], qword [rsi]
add rsp, 0x140
pop rbx
pop rsi
pop rdi
ret
mov edx, dword [rsp + 0x30]
mov ebx, ebx
mov dword [rax], edx
mov edx, dword [rsi + rbx - 4]
mov dword [rax + rbx - 4], edx
jmp 0x14000173d
mov ebx, ebx
movzx edx, word [rsi + rbx - 2]
mov word [rax + rbx - 2], dx
jmp 0x14000173d
mov r8d, 0x19
lea rdx, str.src_configparser.c
lea rcx, [0x1400a3075]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x140001800
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov qword [rsp + 0x28], rcx
mov rcx, rdx
lea rdx, [0x1400a307b]
call sym.fopen
mov r8d, 2
xor edx, edx
mov rbx, rax
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
mov rcx, rbx
movsxd rsi, eax
call sym.rewind
mov rcx, rsi
call sym.malloc
mov r9, rbx
mov r8, rsi
mov edx, 1
mov r14, rax
mov rcx, rax
call sym.fread
lea r12, [r14 + rsi]
mov rcx, rbx
mov rdi, r14
call sym.fclose
mov r13, r14
mov rbp, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
lea r15, [r14 + rsi - 1]
cmp r14, r12
jb 0x1400018a2
jmp 0x14000199f
cmp rdi, r15
je 0x1400018a7
add rdi, 1
cmp rdi, r12
jae 0x14000199f
cmp byte [rdi], 0xa
jne 0x140001890
movzx eax, byte [r13]
cmp al, 0x23
je 0x140001895
cmp al, 0x2f
jne 0x1400018bb
cmp byte [r13 + 1], 0x2f
je 0x140001895
mov rax, r13
jmp 0x1400018c6
cmp byte [rbx + 1], 0x3d
je 0x1400018d2
mov rbx, rax
lea rax, [rax + 1]
cmp rax, r12
jb 0x1400018c0
mov rsi, rbx
jmp 0x1400018e4
sub rsi, 1
movsx ecx, byte [rsi]
call rbp
test eax, eax
jne 0x1400018e0
lea rax, [rdi - 1]
add rbx, 2
mov qword [rsp + 0x20], rax
jmp 0x140001904
add rbx, 1
movsx ecx, byte [rbx]
call rbp
test eax, eax
jne 0x140001900
movsx ecx, byte [rdi - 1]
call rbp
test eax, eax
je 0x140001920
jmp 0x140001917
sub rsi, r13
mov r8d, 8
mov rdx, r13
cmp rsi, r8
lea rcx, str.db_path
cmovbe r8, rsi
call sym.strncmp
test eax, eax
je 0x1400019c0
mov r8d, 0x12
mov rdx, r13
lea rcx, str.songs_folder_path
cmp rsi, r8
cmovbe r8, rsi
call sym.strncmp
test eax, eax
je 0x140001a00
mov r8d, 0x14
mov rdx, r13
lea rcx, str.replays_folder_path
cmp rsi, r8
cmovbe r8, rsi
call sym.strncmp
test eax, eax
je 0x140001a40
add rdi, 1
mov r13, rdi
add rdi, 1
cmp rdi, r12
jb 0x1400018a2
mov rcx, r14
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp sym.free
mov r13, qword [rsp + 0x20]
sub r13, rbx
lea rcx, [r13 + 2]
lea rsi, [r13 + 1]
call sym.malloc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sym.memcpy
mov rcx, rax
mov byte [rax + r13 + 1], 0
mov rax, qword [rsp + 0x28]
mov qword [rax], rcx
jmp 0x14000198b
mov r13, qword [rsp + 0x20]
sub r13, rbx
lea rcx, [r13 + 2]
lea rsi, [r13 + 1]
call sym.malloc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sym.memcpy
mov rcx, rax
mov byte [rax + r13 + 1], 0
mov rax, qword [rsp + 0x28]
mov qword [rax + 8], rcx
jmp 0x14000198b
mov r13, qword [rsp + 0x20]
sub r13, rbx
lea rcx, [r13 + 2]
lea rsi, [r13 + 1]
call sym.malloc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sym.memcpy
mov rcx, rax
mov byte [rax + r13 + 1], 0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x10], rcx
jmp 0x14000198b
Function at 0x1400097e0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
movaps xmmword [rsp + 0x20], xmm6
movaps xmmword [rsp + 0x30], xmm7
cmp byte [rcx + 0x2d2], 0
mov rbx, rcx
mov rsi, rdx
jne 0x140009a15
lea rbp, [rcx + 0x450]
mov ecx, 0x2f
mov rdi, rbp
rep movsq qword [rdi], qword [rsi]
mov byte [rbx + 0x2d2], 1
test r8b, 0x10
jne 0x140009a08
and r8d, 2
jne 0x1400099c8
mov rcx, rbp
call sym.beatmap_stack
mov rdi, qword [rbx + 0x5a8]
mov rsi, qword [rbx + 0x5b0]
mov rdx, rdi
mov rcx, rsi
call sym.beatmap_override_hitobj_positions_with_stacked_positions
movsd xmm1, qword [0x1400a3b08]
mulsd xmm1, qword [rbx + 0x528]
movsd xmm0, qword [0x1400a3b10]
subsd xmm0, xmm1
mulsd xmm0, qword [0x1400a3b18]
movsd xmm1, qword [0x1400a3bb0]
mulsd xmm0, qword [rbx + 0x668]
mulsd xmm1, xmm0
unpcklpd xmm0, xmm1
movsd xmm1, qword [rbx + 0x538]
movups xmmword [rbx + 0x678], xmm0
movsd xmm0, qword [0x1400a3b60]
comisd xmm0, xmm1
ja 0x1400099d8
ucomisd xmm1, xmm0
jp 0x140009990
jne 0x140009990
movapd xmm0, xmmword [0x1400a3ba0]
movsd xmm6, qword [rbx + 0x530]
movsd xmm1, qword [0x1400a3ad8]
movups xmmword [rbx + 0x688], xmm0
movsd xmm0, qword [0x1400a3ae0]
mulsd xmm1, xmm6
subsd xmm0, xmm1
call sym.round
movsd xmm1, qword [0x1400a3ae8]
movapd xmm7, xmm0
movsd xmm0, qword [0x1400a3af0]
mulsd xmm1, xmm6
subsd xmm0, xmm1
call sym.round
mulsd xmm6, qword [0x1400a3af8]
movapd xmm1, xmm0
movapd xmm0, xmm7
unpcklpd xmm0, xmm1
movups xmmword [rbx + 0x630], xmm0
movsd xmm0, qword [0x1400a3b00]
subsd xmm0, xmm6
call sym.round
lea rax, [rdi + rdi*4]
movsd qword [rbx + 0x640], xmm0
movsd xmm0, qword [rsi + 0x20]
lea rax, [rdi + rax*2]
unpcklpd xmm0, xmm0
movups xmmword [rbx + 0x650], xmm0
movsd xmm0, qword [rsi + rax*8 - 0x30]
mov qword [rbx + 0x620], 0
movsd qword [rbx + 0x660], xmm0
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
subsd xmm1, xmm0
movsd xmm0, qword [0x1400a3b60]
unpcklpd xmm0, xmm0
unpcklpd xmm1, xmm1
mulpd xmm1, xmmword [0x1400a3bd0]
divpd xmm1, xmm0
movapd xmm0, xmmword [0x1400a3ba0]
subpd xmm0, xmm1
jmp 0x1400098c8
mov rcx, rbp
call sym.beatmap_apply_ez
jmp 0x140009832
subsd xmm0, xmm1
movsd xmm1, qword [0x1400a3b60]
unpcklpd xmm1, xmm1
unpcklpd xmm0, xmm0
mulpd xmm0, xmmword [0x1400a3bc0]
divpd xmm0, xmm1
addpd xmm0, xmmword [0x1400a3ba0]
jmp 0x1400098c8
mov rcx, rbp
call sym.beatmap_apply_hardrock
jmp 0x140009832
mov r8d, 0x136
lea rdx, str.src_main.c
lea rcx, str.s__beatmap_set__false
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
Function at 0x14000d680
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1a0
mov rbp, rcx
mov rcx, rdx
lea rdx, [0x1400a3379]
call sym.fopen
mov rbx, rax
test rax, rax
je 0x14000d72b
xor edx, edx
mov r8d, 2
lea rsi, [rsp + 0x20]
mov rcx, rax
call sym.fseek
mov rcx, rbx
call sym.ftell
mov rcx, rbx
movsxd r12, eax
call sym.rewind
mov rcx, r12
call sym.malloc
mov r9, rbx
mov r8, r12
mov edx, 1
mov rdi, rax
mov rcx, rax
call sym.fread
mov rdx, rdi
mov r8, r12
mov rcx, rsi
call sym.beatmap_parse
mov rcx, rdi
mov rdi, rbp
call sym.free
mov rcx, rbx
call sym.fclose
mov ecx, 0x2f
mov rax, rbp
rep movsq qword [rdi], qword [rsi]
add rsp, 0x1a0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8d, 0x7f6
lea rdx, str.src_beatmap.h
lea rcx, str.file___NULL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop word cs:[rax + rax]

Function at 0x14000dc40
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rcx, rdx
lea rdx, [0x1400a3c90]
call sym.fopen
mov rdi, rax
test rax, rax
je 0x14000dddb
mov r8d, 2
xor edx, edx
mov rcx, rax
call sym.fseek
mov rcx, rdi
call sym.ftell
mov rcx, rdi
movsxd rbp, eax
call sym.rewind
mov rcx, rbp
call sym.malloc
mov r8, rbp
mov r9, rdi
mov edx, 1
mov rcx, rax
mov rbx, rax
call sym.fread
xor eax, eax
xor r8d, r8d
movzx edx, byte [rbx + rax]
lea ecx, [rax*8]
add rax, 1
shl rdx, cl
add r8, rdx
cmp rax, 4
jne 0x14000dcb0
movzx eax, byte [rbx + 5]
movzx edx, byte [rbx + 4]
mov dword [rsi], r8d
shl rax, 8
add rax, rdx
movzx edx, byte [rbx + 6]
shl rdx, 0x10
add rdx, rax
movzx eax, byte [rbx + 7]
shl rax, 0x18
add rax, rdx
cmp byte [rbx + 8], 0
setne byte [rsi + 8]
xor r8d, r8d
mov dword [rsi + 4], eax
xor eax, eax
nop dword [rax + rax]
movzx edx, byte [rbx + rax + 9]
lea ecx, [rax*8]
add rax, 1
shl rdx, cl
add r8, rdx
cmp rax, 8
jne 0x14000dd08
mov qword [rsi + 0x10], r8
lea rbp, [rsi + 0x38]
lea r12, [rsp + 0x28]
xor r9d, r9d
mov r8, r12
mov rdx, rbx
mov rcx, rbp
mov qword [rsp + 0x28], 0x11
call sym.osudb_parse_str
mov r10, qword [rsp + 0x28]
xor r8d, r8d
mov qword [rsi + 0x18], rax
xor eax, eax
lea r9, [rbx + r10]
nop dword [rax]
movzx edx, byte [r9 + rax]
lea ecx, [rax*8]
add rax, 1
shl rdx, cl
add r8, rdx
cmp rax, 4
jne 0x14000dd60
movsxd r13, r8d
add r10, 4
mov rcx, rbp
xor ebp, ebp
mov rdx, r13
mov qword [rsp + 0x28], r10
shl rdx, 5
call sym.arena_alloc
mov qword [rsi + 0x28], rax
test r13, r13
je 0x14000ddbf
nop word [rax + rax]
mov r8, r12
mov rdx, rbx
mov rcx, rsi
add rbp, 1
call sym.osudb_parse_beatmap
cmp r13, rbp
jne 0x14000dda8
mov rcx, rbx
call sym.free
mov rcx, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.fclose
mov r8d, 0x86
lea rdx, str.src_osudb.c
lea rcx, [0x1400a3c9f]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14002b2e7
Capabilities:
Execute command

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov edx, 0x27
call sym.strchr
test rax, rax
je 0x14002b318
lea rdx, str.SYSTEM:_Provided_URL_could_be_potentially_malicious__avoid____character
mov ecx, 4
call sym.TraceLog
nop
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call sym.strlen
lea rcx, [rax + 0x20]
mov edx, 1
call sym.calloc
mov rsi, rax
mov r8, rbx
lea rdx, str.explorer___s_
mov rcx, rax
call sym.sprintf
mov rcx, rsi
call sym.system
cmp eax, 0xffffffff
je 0x14002b35a
mov rcx, rsi
call sym.free
jmp 0x14002b311
lea rdx, str.OpenURL___child_process_could_not_be_created
mov ecx, 4
call sym.TraceLog
jmp 0x14002b350

Function at 0x1400309c3
Capabilities:
Encode data using base64

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov ebx, edx
mov rdi, r8
lea eax, [rdx + 2]
movsxd rcx, eax
imul rcx, rcx, 0x55555556
shr rcx, 0x20
sar eax, 0x1f
sub ecx, eax
shl ecx, 2
mov dword [r8], ecx
movsxd rcx, ecx
call sym.malloc
mov r9, rax
test rax, rax
je 0x140030b0f
test ebx, ebx
jle 0x140030abe
mov rdx, rax
mov ecx, 0
mov r11d, 0
lea r8, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
jmp 0x140030a84
mov ecx, r10d
mov r10d, r11d
mov ebp, r11d
shl eax, 0x10
add eax, ebp
shl r10d, 8
add eax, r10d
mov r10d, eax
shr r10d, 0x12
mov r10d, r10d
movzx r10d, byte [r8 + r10]
mov byte [rdx], r10b
mov r10d, eax
shr r10d, 0xc
and r10d, 0x3f
movzx r10d, byte [r8 + r10]
mov byte [rdx + 1], r10b
mov r10d, eax
shr r10d, 6
and r10d, 0x3f
movzx r10d, byte [r8 + r10]
mov byte [rdx + 2], r10b
and eax, 0x3f
movzx eax, byte [r8 + rax]
mov byte [rdx + 3], al
add rdx, 4
cmp ecx, ebx
jge 0x140030abe
lea r10d, [rcx + 1]
movsxd rax, ecx
movzx eax, byte [rsi + rax]
cmp ebx, r10d
jle 0x140030a22
lea ebp, [rcx + 2]
movsxd r10, r10d
movzx r10d, byte [rsi + r10]
cmp ebx, ebp
jle 0x140030ab2
add ecx, 3
movsxd rbp, ebp
movzx ebp, byte [rsi + rbp]
jmp 0x140030a2b
mov ecx, ebp
mov ebp, 0
jmp 0x140030a2b
movsxd rax, ebx
imul rax, rax, 0x55555556
shr rax, 0x20
mov edx, ebx
sar edx, 0x1f
sub eax, edx
lea eax, [rax + rax*2]
sub ebx, eax
movsxd rbx, ebx
lea rax, [0x1400b2360]
mov ecx, dword [rax + rbx*4]
test ecx, ecx
jle 0x140030b0f
mov edx, dword [rdi]
lea eax, [rdx - 1]
cdqe
add rax, r9
movsxd rdx, edx
sub rdx, 1
movsxd rcx, ecx
sub rdx, rcx
add rdx, r9
mov byte [rax], 0x3d
sub rax, 1
cmp rax, rdx
jne 0x140030b03
mov rax, r9
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x140039fbc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
mov r11, qword [rcx]
movsxd rcx, edx
mov rax, 0xfffffffffffffffc
sub rax, rcx
cmp edx, 0xfffffffd
jl 0x14003a031
lea rcx, [r11 + rax]
lea r8, [r11 + rax + 1]
lea eax, [rdx + 3]
add r8, rax
mov eax, 0xffffffff
lea r10, [0x1400b57a0]
mov edx, eax
shr edx, 8
xor al, byte [rcx]
movzx eax, al
xor edx, dword [r10 + rax*4]
mov eax, edx
add rcx, 1
cmp rcx, r8
jne 0x140039fef
not eax
mov edx, eax
shr edx, 0x18
mov byte [r11], dl
mov rdx, qword [r9]
mov ecx, eax
shr ecx, 0x10
mov byte [rdx + 1], cl
mov rdx, qword [r9]
movzx ecx, ah
mov byte [rdx + 2], cl
mov rdx, qword [r9]
mov byte [rdx + 3], al
add qword [r9], 4
ret
mov eax, 0xffffffff
jmp 0x14003a008

Function at 0x14003faa8
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, rcx
mov rcx, rdx
movsxd r8, r8d
mov edx, 1
call sym.fread
add rsp, 0x28
ret

Function at 0x140040e75
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
mov r9, rcx
mov rcx, rdx
movsxd r8, r8d
mov edx, 1
call sym.fwrite
nop
add rsp, 0x28
ret
Function at 0x14005ad3e
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov r9d, r8d
mov r8d, edx
mov edx, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call sym.stbi_write_png_to_mem
mov rbx, rax
mov eax, 0
test rbx, rbx
je 0x14005adbe
lea rdx, [0x1400b31a2]
mov rcx, rsi
call sym.fopen
mov rsi, rax
test rax, rax
je 0x14005adc5
mov r9, rax
movsxd r8, dword [rsp + 0x3c]
mov edx, 1
mov rcx, rbx
call sym.fwrite
mov rcx, rsi
call sym.fclose
mov rcx, rbx
call sym.free
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
ret
mov rcx, rbx
call sym.free
mov eax, 0
jmp 0x14005adbe
Function at 0x14006e6a3
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov ebx, ecx
mov rsi, rdx
mov qword [rsp + 0x170], r8
mov qword [rsp + 0x178], r9
cmp dword [0x1400a1bd0], ecx
jle 0x14006e6d7
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rax, [rsp + 0x170]
mov qword [rsp + 0x128], rax
mov rax, qword [0x1400f6f60]
test rax, rax
je 0x14006e6ff
mov r8, qword [rsp + 0x128]
call rax
jmp 0x14006e6cb
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
cmp ecx, 6
ja case.0x14006e870.0
mov eax, ecx
lea rdx, [0x1400b7a90]
movsxd rax, dword [rdx + rax*4]
add rax, rdx
jmp rax
movabs rax, 0x203a4543415254
mov qword [rsp + 0x20], rax
mov rcx, rsi
call sym.strlen
mov rdi, rax
lea rbp, [rsp + 0x20]
mov rcx, rbp
call sym.strlen
lea rdx, [rbp + rax]
mov eax, 0xf4
cmp edi, eax
cmovbe eax, edi
mov ecx, eax
cmp eax, 8
jae 0x14006e95b
test al, 4
jne 0x14006e94b
test eax, eax
je 0x14006e986
movzx eax, byte [rsi]
mov byte [rdx], al
test cl, 2
je 0x14006e986
mov ecx, ecx
movzx eax, word [rsi + rcx - 2]
mov word [rdx + rcx - 2], ax
jmp 0x14006e986
movabs rax, 0x203a4755424544
mov qword [rsp + 0x20], rax
jmp case.0x14006e870.0
mov dword [rsp + 0x20], 0x4f464e49
mov dword [rsp + 0x23], 0x203a4f
jmp case.0x14006e870.0
movabs rax, 0x3a474e494e524157
mov qword [rsp + 0x20], rax
mov word [rsp + 0x28], 0x20
jmp case.0x14006e870.0
movabs rax, 0x203a524f525245
mov qword [rsp + 0x20], rax
jmp case.0x14006e870.0
movabs rax, 0x203a4c41544146
mov qword [rsp + 0x20], rax
jmp case.0x14006e870.0
mov eax, dword [rsi]
mov dword [rdx], eax
mov ecx, ecx
mov eax, dword [rsi + rcx - 4]
mov dword [rdx + rcx - 4], eax
jmp 0x14006e986
mov rcx, qword [rsi]
mov qword [rdx], rcx
mov ecx, eax
mov r8, qword [rsi + rcx - 8]
mov qword [rdx + rcx - 8], r8
lea rdi, [rdx + 8]
and rdi, 0xfffffffffffffff8
sub rdx, rdi
sub rsi, rdx
lea ecx, [rax + rdx]
shr ecx, 3
mov ecx, ecx
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x20]
mov rcx, rsi
call sym.strlen
mov word [rsi + rax], 0xa
mov rbp, qword [rsp + 0x128]
mov ecx, 1
mov rdi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
call rdi
mov rcx, rax
mov r8, rbp
mov rdx, rsi
call sym.__mingw_vfprintf
mov ecx, 1
call rdi
mov rcx, rax
call sym.fflush
cmp ebx, 6
jne 0x14006e6cb
mov ecx, 1
call sym.exit
nop
Function at 0x14006ea14
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
mov dword [rdx], 0
test rcx, rcx
je 0x14006eb8c
mov rax, qword [0x1400f6f58]
test rax, rax
je 0x14006ea56
call rax
mov rdi, rax
mov rax, rdi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [0x1400b7aac]
call sym.fopen
mov rbp, rax
test rax, rax
je 0x14006eb70
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rcx, rbp
call sym.ftell
mov r12d, eax
mov r8d, 0
mov edx, 0
mov rcx, rbp
call sym.fseek
test r12d, r12d
jle 0x14006eb4a
movsxd r13, r12d
mov rcx, r13
call sym.malloc
mov rdi, rax
test rax, rax
je 0x14006eb34
mov r9, rbp
mov r8, r13
mov edx, 1
mov rcx, rax
call sym.fread
cmp rax, 0x7fffffff
ja 0x14006eafb
mov dword [rsi], eax
cmp eax, r12d
je 0x14006eb1e
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rbx
lea rdx, str.FILEIO:___s__File_partially_loaded___i_bytes_out_of__i_
mov ecx, 4
call sym.TraceLog
jmp 0x14006eb63
mov r8, rbx
lea rdx, str.FILEIO:___s__File_is_bigger_than_2147483647_bytes__avoid_using_LoadFileData__
mov ecx, 4
call sym.TraceLog
mov rcx, rdi
call sym.free
mov edi, 0
jmp 0x14006eb63
mov r8, rbx
lea rdx, str.FILEIO:___s__File_loaded_successfully
mov ecx, 3
call sym.TraceLog
jmp 0x14006eb63
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_allocated_memory_for_file_reading
mov ecx, 4
call sym.TraceLog
jmp 0x14006eb63
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_read_file
mov ecx, 4
call sym.TraceLog
mov edi, 0
mov rcx, rbp
call sym.fclose
jmp 0x14006ea46
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_open_file
mov ecx, 4
call sym.TraceLog
mov rdi, rbp
jmp 0x14006ea46
lea rdx, str.FILEIO:_File_name_provided_is_not_valid
mov ecx, 4
call sym.TraceLog
mov rdi, rbx
jmp 0x14006ea46

Function at 0x14006ebb4
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rsi, rdx
mov edi, r8d
test rcx, rcx
je 0x14006ec81
mov rax, qword [0x1400f6f50]
test rax, rax
je 0x14006ebe5
call rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x1400b7c18]
call sym.fopen
mov rbp, rax
test rax, rax
je 0x14006ec63
mov r9, rax
movsxd r8, edi
mov edx, 1
mov rcx, rsi
call sym.fwrite
test eax, eax
je 0x14006ec37
cmp edi, eax
je 0x14006ec4d
mov r8, rbx
lea rdx, str.FILEIO:___s__File_partially_written
mov ecx, 4
call sym.TraceLog
mov rcx, rbp
call sym.fclose
test eax, eax
sete al
jmp 0x14006ebdc
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_write_file
mov ecx, 4
call sym.TraceLog
jmp 0x14006ec28
mov r8, rbx
lea rdx, str.FILEIO:___s__File_saved_successfully
mov ecx, 3
call sym.TraceLog
jmp 0x14006ec28
mov r8, rbx
lea rdx, str.FILEIO:___s__Failed_to_open_file
mov ecx, 4
call sym.TraceLog
mov eax, 0
jmp 0x14006ebdc
lea rdx, str.FILEIO:_File_name_provided_is_not_valid
mov ecx, 4
call sym.TraceLog
mov eax, 0
jmp 0x14006ebdc