joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140016010
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ae010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400aef60]
mov edi, edx
cmp byte [rbx + 0x1f85], 0
jne 0x140016070
cmp byte [rbx + 0x1f86], 0
jne 0x140016070
mov r9d, dword [rbx + 0x2fc8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004a70
test dil, 1
je 0x1400161a7
jmp 0x1400160ff
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400a1ffc]
xor eax, eax
mulss xmm1, dword [0x1400a1fe8]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1cec], rax
mov dword [rbx + 0x1cd4], 1
movss dword [rbx + 0x1ce4], xmm0
mov byte [rbx + 0x1d0c], 1
movss dword [rbx + 0x1ce8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400a1e64]
or dword [rbx + 0x1cd0], 0x41
movss dword [rbx + 0x1d30], xmm0
mov r9d, dword [rbx + 0x2fc8]
call fcn.140004a70
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140016150
lea r11, [0x1400962a0]
nop
cmp r9b, 0x23
jne 0x140016133
cmp byte [r8], r9b
jne 0x140016133
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140016120
mov rcx, qword [0x1400aef60]
not edx
add rcx, 0x1c08
call fcn.140005260
test rax, rax
je 0x1400161a7
cmp byte [rax + 0xbf], 0
je 0x1400161a7
mov byte [rax + 0xc6], 1
lea r8, str.Tooltip__02d
mov dword [rax + 0xdc], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x2fc8]
mov edx, 0x10
mov r9d, dword [rbx + 0x2fc8]
call fcn.140004a70
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140010180
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008c3a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001b850
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1400aef60]
cmp byte [rbx + 0x3090], 0
je 0x14001b93c
cmp qword [rbx + 0x3098], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x30a0]
je 0x14001b924
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001b8cb
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140029bd0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140005570
mov eax, dword [rdi]
lea rcx, [0x1400aef58]
mov r9, qword [rbx + 0x3098]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rbx + 0x30a8]
cmove edx, ebp
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140005570
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret

Function at 0x14001bde0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x14001be36
lea r11, [0x1400962a0]
cmp r9b, 0x23
jne 0x14001be19
cmp byte [r8], r9b
jne 0x14001be19
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001be06
not ecx
call fcn.14001bcf0
test rax, rax
jne 0x14001be4f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14001bc00
add rsp, 0x20
pop rbx
ret
Function at 0x140020530
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140020729
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400ae010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400962a0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x1400206f1
mov rcx, rbp
call fcn.14001f810
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x1400205ae
lea rcx, [rbp + 0x3010]
call fcn.140005260
mov rcx, rax
jmp 0x1400205b0
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
and dword [rbx + 0xb0], 0xfffffe49
or dword [rbx + 0xb0], 0x49
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140020641
cmp qword [rcx + 0x18], 0
jne 0x140020636
mov qword [rcx + 0x18], rbx
jmp 0x140020641
cmp qword [rcx + 0x20], 0
jne 0x140020641
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xc]
mov rcx, rbx
mov dword [rbx + 0xa8], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 4]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14002067c
nop dword [rax + rax]
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140020670
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.140004a70
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x1400206d8
cmp r9b, 0x23
jne 0x1400206bb
cmp byte [r8], r9b
jne 0x1400206bb
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x1400206a8
mov rcx, qword [0x1400aef60]
not edx
add rcx, 0x1c08
call fcn.140005260
mov qword [rbx + 0x78], rax
add rdi, 0x24
sub rsi, 1
jne 0x140020580
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14008c3a0
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140041a50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test edx, edx
lea rax, str.SCROLLX
lea rdi, str.SCROLLY
mov rbx, rcx
cmove rdi, rax
mov eax, dword [rcx + 0x108]
test eax, eax
jg 0x140041a9b
mov r8d, 0x5d2
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov eax, dword [rbx + 0x108]
movsxd rdx, eax
mov rcx, rdi
mov rax, qword [rbx + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140004b80
Function at 0x14004de70
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test r8, r8
je 0x14004df1e
test dword [rcx + 0x10], 0x100000
jne 0x14004dea5
mov r8d, 0x1dd9
lea rdx, str.C:UsersNameDesktopFreeScript1imguiimgui_widgets.cpp
lea rcx, str.tab_bar__Flags__ImGuiTabBarFlags_DockNode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14004def2
lea r11, [0x1400962a0]
cmp r9b, 0x23
jne 0x14004ded5
cmp byte [r8], r9b
jne 0x14004ded5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14004dec2
mov rcx, qword [0x1400aef60]
not eax
cmp dword [rcx + 0x1c78], eax
jne 0x14004df09
mov dword [rcx + 0x1c7c], eax
cmp dword [rcx + 0x1cb8], eax
jne 0x14004df36
mov byte [rcx + 0x1cbc], 1
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x1400aef60]
mov rcx, qword [rax + 0x1c20]
add rsp, 0x20
pop rbx
jmp fcn.140007500
add rsp, 0x20
pop rbx
ret
Function at 0x1400582c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
push rbp
push r13
push r14
sub rsp, 0x60
xor ecx, ecx
movaps xmmword [rax - 0x48], xmm6
cvttsd2si ebp, xmm1
mov r13d, r9d
mov dword [rsp + 0x80], ecx
xor r9d, r9d
mov r14d, 1
movaps xmm6, xmm0
cmp ebp, r14d
jl 0x1400583a4
mov qword [rax + 0x10], rbx
mov qword [rax - 0x20], rsi
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r12
mov r12d, r8d
mov qword [rax - 0x38], r15
mov r15d, r13d
nop dword [rax]
nop word [rax + rax]
mov eax, r12d
mov qword [rsp + 0x20], 0
cdq
idiv ebp
mov esi, eax
mov eax, r15d
cdq
idiv ebp
mov edi, eax
mov eax, ebp
imul eax, r14d
mov r8d, edi
sub r8d, r9d
xor r9d, r9d
cdq
idiv ebp
mov edx, esi
sub edx, ecx
mov ebx, eax
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, ebx
sub ecx, dword [rsp + 0x80]
call fcn.140058480
add r12d, dword [rsp + 0x90]
inc r14d
add r15d, r13d
mov dword [rsp + 0x80], ebx
mov ecx, esi
mov r9d, edi
cmp r14d, ebp
jle 0x140058320
mov r15, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x88]
cvttsd2si ecx, xmm6
sub ecx, ebp
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x60
pop r14
pop r13
pop rbp
jmp fcn.140058480

Function at 0x140058480
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400ae010]
xor rax, rsp
mov qword [rsp + 0x30], rax
movsxd rdi, ecx
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
movabs rax, 0x20c49ba5e353f7cf
lea rcx, [rsp + 0x20]
imul qword [rsp + 0x28]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [rsp + 0x28], rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
mov qword [rsp + 0x20], 0
idiv qword [rsp + 0x28]
add rdi, rax
test rdi, rdi
jle 0x140058512
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
cqo
idiv qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
cmp rax, rdi
jl 0x1400584f1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008c3a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140058530
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
movaps xmmword [rax - 0x38], xmm7
cvttsd2si ebp, xmm0
mov r14d, 1
mov ecx, r12d
mov r9d, r12d
mov r15d, r12d
movaps xmmword [rax - 0x48], xmm8
movaps xmm7, xmm2
movaps xmm8, xmm1
cmp ebp, r14d
jl 0x140058612
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
movaps xmmword [rax - 0x28], xmm6
movd xmm6, ebp
cvtdq2ps xmm6, xmm6
nop word [rax + rax]
movd xmm1, r14d
mov eax, ebp
cvtdq2ps xmm1, xmm1
mov qword [rsp + 0x20], r12
imul eax, r14d
movaps xmm0, xmm1
mulss xmm1, xmm7
mulss xmm0, xmm8
cdq
idiv ebp
divss xmm1, xmm6
mov ebx, eax
divss xmm0, xmm6
cvttss2si edi, xmm1
cvttss2si esi, xmm0
mov r8d, edi
sub r8d, r9d
xor r9d, r9d
mov edx, esi
sub edx, ecx
lea ecx, [r9 + 1]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, ebx
sub ecx, r15d
call fcn.140058480
inc r14d
mov ecx, esi
mov r9d, edi
mov r15d, ebx
cmp r14d, ebp
jle 0x140058590
movaps xmm6, xmmword [rsp + 0x50]
mov rdi, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov ecx, ebp
mov rbp, qword [rsp + 0x98]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
add rsp, 0x60
pop r15
pop r14
pop r12
jmp fcn.140058480
Function at 0x14008a250
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x14008a287
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14008a2a8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14008a2aa
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14008a303
test ecx, ecx
jle 0x14008a2e3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14008a303
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14008a303
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14008a330
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14008a352
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14008a368
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14008a384
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14008a386
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x14008a3c0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14008a467
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14008a3fb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14008a441
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14008a480
cmp rbx, rax
ja 0x14008a410
mov r8, rdi
test rdi, rdi
je 0x14008a467
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14008a46a
Function at 0x14008a880
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400ae010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14008a8ad
xor eax, eax
jmp 0x14008aa02
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x14008a8d8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x14008a8d8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x14008aa02
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14008a9f5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14008a91b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14008a946
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14008a9fa
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14008a9b5
sub eax, 1
je 0x14008a9b5
cmp eax, 2
jne 0x14008a9f5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14008a9fa
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14008a9e3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14008a9f5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14008a9fa
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14008c3a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14008b070
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400ae010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14008b143
cmp byte [rcx + 0x71], 0
je 0x14008b143
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14008b13f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14008b104
sub eax, 1
je 0x14008b108
cmp eax, 2
jne 0x14008b13f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008c3a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14008b136
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14008b13f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14008b0ec
xor al, al
jmp 0x14008b0ec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14008c3a0
add rsp, 0x60
pop rbx
ret
Function at 0x1409ae3c8
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1409ae54f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1409ae3f9
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ae3df
add dl, dl
jne 0x1409ae406
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ae466
xor eax, eax
add dl, dl
jne 0x1409ae415
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409ae51d
add dl, dl
jne 0x1409ae426
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ae433
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ae440
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ae44d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409ae45a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1409ae3ee
mov eax, 1
add dl, dl
jne 0x1409ae476
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409ae483
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ae46b
sub eax, ebx
mov ebx, 1
jne 0x1409ae4bc
mov ecx, 1
add dl, dl
jne 0x1409ae49e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409ae4ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ae493
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ae3ee
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1409ae4d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1409ae4e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409ae4cd
cmp eax, 0x7d00
jae 0x1409ae50b
cmp eax, 0x500
jb 0x1409ae506
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ae3ee
cmp eax, 0x7f
ja 0x1409ae50e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1409ae3ee
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409ae542
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1409ae3ee
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x414c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x414deb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432200
xorps xmm15, xmm15
mov r14, qword [0x005f1fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x414cc5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x414cd4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x414cf3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x414d03
cmp rbx, 0x1000
jae 0x414ccb
jmp 0x414d6d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x414d15
xor edx, edx
jmp 0x414d64
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432200
xorps xmm15, xmm15
mov r14, qword [0x005f1fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x414cf9
jmp 0x414ce8
call fcn.00462ac0
xorps xmm15, xmm15
mov r14, qword [0x005f1fd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436600
lea rax, [0x004e2329]
mov ebx, 0x18
nop dword [rax]
call fcn.00436e80
mov rax, qword [rsp + 0x38]
call fcn.00436bc0
lea rax, [0x004e29d2]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436e80
mov rax, qword [rsp + 0x30]
call fcn.00436bc0
call fcn.00436840
call fcn.00436660
lea rax, [0x004e5254]
mov ebx, 0x21
call fcn.00434c60
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00414c60