joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d360500
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movss xmm10, dword [rsp + 0xd0]
mov edi, dword [rsp + 0xe0]
movss xmm11, dword [rsp + 0xd8]
mov r12, rcx
mov r13, rdx
movups xmm6, xmm3
mov ebx, r8d
cmp r8d, 2
jbe 0x6d360562
xorps xmm0, xmm0
comiss xmm0, xmm3
jb 0x6d3605a8
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r8d, 0x63
lea rdx, str.src_Cairo.cpp
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
lea rcx, str.numSegments___3__size___0.0f
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d347800
mov rcx, rdx
cvtss2sd xmm6, xmm6
xorps xmm8, xmm8
cvtss2sd xmm11, xmm11
call fcn.6d369f50
mov rcx, r13
mov r13d, 1
cvtss2sd xmm10, xmm10
movsx esi, word [rax]
call fcn.6d369f60
mov rcx, r12
cvtsi2sd xmm7, esi
movsx eax, word [rax]
cvtsi2sd xmm9, eax
movupd xmm1, xmm7
addsd xmm1, xmm6
movupd xmm2, xmm9
call fcn.6d3d7ba0
movupd xmm2, xmm9
movupd xmm1, xmm7
mov rcx, r12
inc r13d
addsd xmm2, xmm8
addsd xmm1, xmm6
call fcn.6d3d6530
movupd xmm2, xmm11
movupd xmm0, xmm6
movupd xmm1, xmm10
mulsd xmm2, xmm6
mulsd xmm1, xmm8
mulsd xmm0, xmm10
mulsd xmm8, xmm11
movupd xmm6, xmm2
subsd xmm6, xmm1
addsd xmm8, xmm0
cmp ebx, r13d
ja 0x6d3605f4
addsd xmm7, xmm6
movupd xmm2, xmm9
mov rcx, r12
addsd xmm2, xmm8
movupd xmm1, xmm7
call fcn.6d3d6530
mov rcx, r12
test dil, dil
je 0x6d360698
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d3db560
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d3d4f70
Function at 0x6d3606d0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
movups xmmword [rsp + 0x20], xmm6
movups xmmword [rsp + 0x30], xmm7
movups xmmword [rsp + 0x40], xmm8
movups xmmword [rsp + 0x50], xmm9
movups xmmword [rsp + 0x60], xmm10
movups xmmword [rsp + 0x70], xmm11
movss xmm10, dword [rsp + 0xd0]
mov edi, dword [rsp + 0xe0]
movss xmm11, dword [rsp + 0xd8]
mov r12, rcx
mov r13, rdx
movups xmm6, xmm3
mov ebx, r8d
cmp r8d, 2
jbe 0x6d360732
xorps xmm0, xmm0
comiss xmm0, xmm3
jb 0x6d360778
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
mov r8d, 0x63
lea rdx, str.src_Cairo.cpp
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
lea rcx, str.numSegments___3__size___0.0f
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d347800
mov rcx, rdx
cvtss2sd xmm6, xmm6
xorps xmm8, xmm8
cvtss2sd xmm11, xmm11
call fcn.6d369ff0
mov rcx, r13
mov r13d, 1
cvtss2sd xmm10, xmm10
movzx esi, word [rax]
call fcn.6d36a000
mov rcx, r12
cvtsi2sd xmm7, esi
movzx eax, word [rax]
cvtsi2sd xmm9, eax
movupd xmm1, xmm7
addsd xmm1, xmm6
movupd xmm2, xmm9
call fcn.6d3d7ba0
movupd xmm2, xmm9
movupd xmm1, xmm7
mov rcx, r12
inc r13d
addsd xmm2, xmm8
addsd xmm1, xmm6
call fcn.6d3d6530
movupd xmm2, xmm11
movupd xmm0, xmm6
movupd xmm1, xmm10
mulsd xmm2, xmm6
mulsd xmm1, xmm8
mulsd xmm0, xmm10
mulsd xmm8, xmm11
movupd xmm6, xmm2
subsd xmm6, xmm1
addsd xmm8, xmm0
cmp ebx, r13d
ja 0x6d3607c4
addsd xmm7, xmm6
movupd xmm2, xmm9
mov rcx, r12
addsd xmm2, xmm8
movupd xmm1, xmm7
call fcn.6d3d6530
mov rcx, r12
test dil, dil
je 0x6d360868
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d3db560
movups xmm6, xmmword [rsp + 0x20]
movups xmm7, xmmword [rsp + 0x30]
movups xmm8, xmmword [rsp + 0x40]
movups xmm9, xmmword [rsp + 0x50]
movups xmm10, xmmword [rsp + 0x60]
movups xmm11, xmmword [rsp + 0x70]
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.6d3d4f70
Function at 0x6d3608a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d369d90
test al, al
jne 0x6d3608f5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d369d90
test al, al
je 0x6d3608cf
mov rcx, r13
call fcn.6d369d20
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369d10
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d369d20
mov rcx, r15
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369d10
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.6d3d6530
mov rcx, r14
call fcn.6d369d20
mov rcx, r14
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369d10
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.6d3d6530
mov rcx, r13
call fcn.6d369d20
mov rcx, r13
movsd xmm2, qword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369d10
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsd xmm1, qword [rax]
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d3609cd
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70

Function at 0x6d3609e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d369e30
test al, al
jne 0x6d360a35
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d369e30
test al, al
je 0x6d360a0f
mov rcx, r13
call fcn.6d369dc0
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369db0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d369dc0
mov rcx, r15
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369db0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r14
call fcn.6d369dc0
mov rcx, r14
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369db0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r13
call fcn.6d369dc0
mov rcx, r13
cvtss2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369db0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtss2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d360b0d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70
Function at 0x6d360b20
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d369eb0
test al, al
jne 0x6d360b75
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d369eb0
test al, al
je 0x6d360b4f
mov rcx, r13
call fcn.6d369e60
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369e50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d369e60
mov rcx, r15
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369e50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r14
call fcn.6d369e60
mov rcx, r14
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369e50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r13
call fcn.6d369e60
mov rcx, r13
cvtsi2sd xmm2, dword [rax]
movsd qword [rsp + 0x28], xmm2
call fcn.6d369e50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
cvtsi2sd xmm1, dword [rax]
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d360c4d
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70

Function at 0x6d360c60
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d369f30
test al, al
jne 0x6d360cb5
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d369f30
test al, al
je 0x6d360c8f
mov rcx, r13
call fcn.6d369ee0
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ed0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d369ee0
mov rcx, r15
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ed0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.6d3d6530
mov rcx, r14
call fcn.6d369ee0
mov rcx, r14
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ed0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.6d3d6530
mov rcx, r13
call fcn.6d369ee0
mov rcx, r13
mov eax, dword [rax]
cvtsi2sd xmm2, rax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ed0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
mov eax, dword [rax]
cvtsi2sd xmm1, rax
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d360da5
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70
Function at 0x6d360dc0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d369fd0
test al, al
jne 0x6d360e15
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d369fd0
test al, al
je 0x6d360def
mov rcx, r13
call fcn.6d369f60
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369f50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d369f60
mov rcx, r15
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369f50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r14
call fcn.6d369f60
mov rcx, r14
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369f50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r13
call fcn.6d369f60
mov rcx, r13
movsx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369f50
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movsx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d360f05
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70
Function at 0x6d360f20
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbx
sub rsp, 0x30
mov ebx, dword [rsp + 0x80]
mov r13, rdx
mov r12, rcx
mov rdx, r8
mov r15, r8
mov rcx, r13
mov r14, r9
call fcn.6d36a070
test al, al
jne 0x6d360f75
mov r8d, 0xb1
lea rdx, str.src_Cairo.cpp
lea rcx, str.pos1___pos2__pos1___pos3
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d347800
mov rdx, r14
mov rcx, r13
call fcn.6d36a070
test al, al
je 0x6d360f4f
mov rcx, r13
call fcn.6d36a000
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ff0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d7ba0
mov rcx, r15
call fcn.6d36a000
mov rcx, r15
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ff0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r14
call fcn.6d36a000
mov rcx, r14
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ff0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r13
call fcn.6d36a000
mov rcx, r13
movzx eax, word [rax]
cvtsi2sd xmm2, eax
movsd qword [rsp + 0x28], xmm2
call fcn.6d369ff0
movsd xmm2, qword [rsp + 0x28]
mov rcx, r12
movzx eax, word [rax]
cvtsi2sd xmm1, eax
call fcn.6d3d6530
mov rcx, r12
test bl, bl
je 0x6d361065
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3db560
add rsp, 0x30
pop rbx
pop r12
pop r13
pop r14
pop r15
jmp fcn.6d3d4f70

Function at 0x6d361080
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x10
call rsi
mov ecx, 0x11
movsx ebx, ax
call rsi
shr ebx, 0x1f
mov ecx, 0x12
shr eax, 0xe
and eax, 2
or ebx, eax
call rsi
mov ecx, 0x5b
shr eax, 0xd
and eax, 4
or ebx, eax
call rsi
mov ecx, 0x5c
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x90
shr eax, 0xc
and eax, 8
or ebx, eax
call rsi
mov ecx, 0x91
shl eax, 4
and eax, 0x10
or ebx, eax
call rsi
mov ecx, 0x14
shl eax, 5
and eax, 0x20
or ebx, eax
call rsi
shl eax, 6
and eax, 0x40
or eax, ebx
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x6d361810
Capabilities:
Query environment variable

Disassembly:
xorps xmm1, xmm1
mov rax, qword [rcx + 0x10]
movsd xmm0, qword [rax + 0xd8]
comisd xmm0, xmm1
ja 0x6d3521ba
jmp fcn.6d362110
ret
push r12
sub rsp, 0x20
mov r12, rcx
lea rcx, str.DPF_SCALE_FACTOR
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x6d36183c
call sub.msvcrt.dll_atof
maxsd xmm0, qword [0x6d4e4b98]
jmp 0x6d361857
test r12, r12
je 0x6d36184f
mov rcx, r12
add rsp, 0x20
pop r12
jmp 0x6d3521a0
movsd xmm0, qword [0x6d4e4b98]
add rsp, 0x20
pop r12
ret

Function at 0x6d361a50
Capabilities:
Query environment variable

Disassembly:
lea rcx, str.Window::PrivateData::renderToPicture
jmp 0x6d361a50
mov rdx, rcx
lea rcx, str.cairo_function_not_implemented:__s
jmp fcn.6d348820
Function at 0x6d3646e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
movups xmmword [rsp + 0x60], xmm6
movups xmmword [rsp + 0x70], xmm7
movups xmmword [rsp + 0x80], xmm8
mov r13, qword [0x6d4bd750]
movsd xmm7, qword [0x6d4e4290]
movq xmm8, qword [0x6d4e4280]
movsd xmm6, qword [r13 + 0x38]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
mov rdi, rcx
mov ebx, edx
mov esi, r8d
jae 0x6d364822
lea rcx, [0x6d4e422a]
mov r15, qword [r13 + 0x40]
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x6d36476c
call sub.msvcrt.dll_atof
movsd xmm6, qword [0x6d4e4278]
maxsd xmm6, xmm0
jmp 0x6d364822
lea rcx, [0x6d4e423b]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movsd xmm6, qword [0x6d4e4278]
mov r12, rax
test rax, rax
je 0x6d364822
mov rbp, qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x6d4e4246]
mov rcx, rax
call rbp
lea rdx, [0x6d4e425d]
mov rcx, r12
mov r14, rax
call rbp
mov dword [rsp + 0x58], 0
mov dword [rsp + 0x5c], 0x64
mov rbp, rax
test r14, r14
je 0x6d364808
test rax, rax
je 0x6d364808
xor ecx, ecx
lea rdx, [rsp + 0x58]
call r14
test eax, eax
jne 0x6d364808
cmp dword [rsp + 0x58], 0
je 0x6d364808
mov edx, 1
test r15, r15
je 0x6d3647f6
mov rcx, r15
call qword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x6d3647fe
xor ecx, ecx
call qword [sym.imp.USER32.dll_MonitorFromPoint]
mov rcx, rax
lea rdx, [rsp + 0x5c]
call rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [rsp + 0x5c]
cvtsi2sd xmm6, rax
mulsd xmm6, qword [0x6d4e4298]
movupd xmm0, xmm6
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x6d364862
movupd xmm0, xmm6
subsd xmm0, qword [0x6d4e4278]
andps xmm0, xmm8
comisd xmm0, xmm7
jb 0x6d364862
cvtsi2sd xmm0, rbx
mulsd xmm0, xmm6
cvttsd2si rbx, xmm0
cvtsi2sd xmm0, rsi
mulsd xmm0, xmm6
cvttsd2si rsi, xmm0
movq r9, xmm6
mov r8d, esi
movupd xmm3, xmm6
mov edx, ebx
lea rcx, str.createNextWindow__u__u__f
call fcn.6d347f50
mov ecx, 0x20
call fcn.6d375000
mov r8, qword [r13 + 0x40]
mov dword [rsp + 0x20], esi
mov r9d, ebx
mov dword [rsp + 0x48], 0
mov rdx, r13
mov rcx, rax
mov r12, rax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
movsd qword [rsp + 0x28], xmm6
call fcn.6d35b2b0
mov rcx, qword [r12 + 8]
lea rax, fcn.6d362840
mov qword [r12 + 0x10], rdi
mov qword [r12], rax
cmp qword [rcx + 0x20], 0
mov word [r12 + 0x18], 1
je 0x6d364900
call fcn.6d359e00
test al, al
je 0x6d364900
mov rax, qword [r12 + 8]
mov rcx, qword [rax + 0x20]
call fcn.6d351140
mov rcx, qword [r13 + 0x10]
cmp r12, rcx
jne 0x6d364918
jmp 0x6d364927
mov qword [r13 + 0x10], r12
test rcx, rcx
je 0x6d364927
mov rax, qword [rcx]
call qword [rax + 8]
cmp qword [r13 + 0x58], 0
mov rax, qword [r13 + 0x10]
jne 0x6d364950
mov rdx, qword [rax + 8]
mov byte [rdx + 0x71], 1
jmp 0x6d364950
movups xmm6, xmmword [rsp + 0x60]
movups xmm7, xmmword [rsp + 0x70]
movups xmm8, xmmword [rsp + 0x80]
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x6d365b00
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6d365b28
mov r9d, 0xf2
lea r8, [0x6d4e32ca]
lea rdx, [0x6d4e32ed]
lea rcx, [0x6d4e3300]
jmp fcn.6d348270
cmp byte [rcx + 0x10], 0
je 0x6d365b36
mov rcx, r8
jmp sub.msvcrt.dll_free
ret

Function at 0x6d365b70
Capabilities:
Query environment variable

Disassembly:
mov r8, qword [rcx]
test r8, r8
jne 0x6d365b98
mov r9d, 0xf2
lea r8, str.src_.._.._distrho_extra_String.hpp
lea rdx, str.fBuffer___nullptr
lea rcx, [0x6d4e5151]
jmp fcn.6d348960
cmp byte [rcx + 0x10], 0
je 0x6d365ba6
mov rcx, r8
jmp sub.msvcrt.dll_free
ret
Function at 0x6d38f6a0
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
test rcx, rcx
je 0x6d38f6c2
movsx edx, byte [rcx]
test dl, dl
je 0x6d38f6c2
mov r8d, eax
inc rcx
shl r8d, 5
add edx, r8d
add eax, edx
jmp 0x6d38f6a5
ret

Function at 0x6d39ece0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor eax, eax
mov rdx, rcx
mov ecx, 0x811c9dc5
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x38]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x6d39ecf0
xor eax, eax
imul ecx, ecx, 0x1000193
movzx r8d, byte [rdx + rax + 0x68]
inc rax
xor ecx, r8d
cmp rax, 0x30
jne 0x6d39ed0a
call fcn.6d3b4e70
lea rcx, [rdx + 0x98]
mov rsi, qword [rdx + 0x28]
mov ebx, eax
call fcn.6d3d5390
xor ebx, eax
mov ecx, ebx
xor ecx, esi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.6d3b4e70

Function at 0x6d3af9e0
Capabilities:
Check os version

Disassembly:
push r13
push r12
sub rsp, 0xc8
mov rax, qword [0x6d4f1d60]
cmp dword [rax], 0
jne 0x6d3af9fc
call fcn.6d394010
mov r12, qword [0x6d4bd970]
mov rcx, r12
test r12, r12
jne 0x6d3afab0
mov ecx, 0x70
call sub.msvcrt.dll_malloc
lea rdx, [0x6d4f98e0]
mov rcx, rax
mov r13, rax
call fcn.6d388160
call fcn.6d3b1340
mov qword [r13 + 0x58], 0
lea rcx, [rsp + 0x2c]
mov qword [r13 + 0x60], rax
mov dword [rsp + 0x2c], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x3c], 1
jne 0x6d3afa64
cmp dword [rsp + 0x30], 4
jne 0x6d3afa64
cmp dword [rsp + 0x34], 0xa
je 0x6d3afa90
lea rcx, str.msimg32
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [r13 + 0x58], rax
mov r12, rax
test rax, rax
je 0x6d3afa90
lea rdx, str.AlphaBlend
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
xor eax, eax
mov qword [r13 + 0x68], r12
lock cmpxchg qword [0x6d4bd970], r13
mov rcx, r13
je 0x6d3afab0
call sub.msvcrt.dll_free
mov rcx, qword [0x6d4bd970]
call fcn.6d3d4e20
add rsp, 0xc8
pop r12
pop r13
ret

Function at 0x6d3b4e90
Capabilities:
Check os version

Disassembly:
push r12
sub rsp, 0xc0
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov r12d, eax
test eax, eax
jne 0x6d3b4ec1
lea rcx, str._have_cleartype_quality
call fcn.6d3b1720
jmp 0x6d3b4ee2
cmp dword [rsp + 0x30], 5
mov r12d, 1
ja 0x6d3b4ee2
mov r12d, 0
jne 0x6d3b4ee2
xor r12d, r12d
cmp dword [rsp + 0x34], 0
setne r12b
mov eax, r12d
add rsp, 0xc0
pop r12
ret
Function at 0x6d3b6fd0
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
lea rcx, str.PIXMAN_DISABLE
call sub.msvcrt.dll_getenv
mov r14, rax
xor eax, eax
test r14, r14
je 0x6d3b707b
or rcx, 0xffffffffffffffff
mov rdi, r12
or rbp, 0xffffffffffffffff
xor r13d, r13d
repne scasb al, byte [rdi]
not rcx
lea rsi, [rcx - 1]
mov edx, 0x20
mov rcx, r14
call sub.msvcrt.dll_strchr
mov rbx, rax
test rax, rax
je 0x6d3b702c
sub ebx, r14d
jmp 0x6d3b703d
mov rcx, rbp
mov rdi, r14
mov eax, r13d
repne scasb al, byte [rdi]
not rcx
lea ebx, [rcx - 1]
movsxd rbx, ebx
cmp rsi, rbx
jne 0x6d3b706d
mov r8, rsi
mov rdx, r14
mov rcx, r12
call sub.msvcrt.dll_strncmp
test eax, eax
jne 0x6d3b706d
mov rdx, r12
lea rcx, str.pixman:_Disabled__s_implementation_n
call fcn.6d4822e0
mov eax, 1
jmp 0x6d3b707b
add rbx, r14
cmp byte [rbx], 0
lea r14, [rbx + 1]
jne 0x6d3b7012
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x140001000
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
sub rsp, 0x448
mov r8, rcx
lea r9, [rax + 0x10]
lea rcx, [rsp + 0x40]
mov edx, 0x200
call qword [sym.imp.ntdll.dll__vsnwprintf]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0x40]
mov rax, qword gs:[0x30]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rax + 0x60]
mov rcx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
add rsp, 0x448
ret