joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f610
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x2d0
mov r15, rcx
mov rbx, r8
lea rcx, [rsp + 0x308]
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000f887
mov rax, qword [rsp + 0x308]
xor edx, edx
sub rax, qword [0x14009c1f8]
mov rcx, qword [rbx + 8]
imul rax, rax, 0xf4240
mov qword [rsp + 0x2f0], rbp
div qword [0x14009c1f0]
mov edx, dword [rcx + 0x9c]
mov qword [rsp + 0x2f8], rdi
mov rbp, rax
add rbp, qword [0x14009c200]
shr edx, 0xd
mov qword [rsp + 0x300], r14
movaps xmmword [rsp + 0x2c0], xmm6
test dl, 1
je 0x14000f69c
mov rax, qword [rbx + 0x48]
jmp 0x14000f6a0
lea rax, [rbx + 0x20]
movups xmm6, xmmword [rax]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
movaps xmmword [rsp + 0x50], xmm6
call fcn.14002f5c0
mov rcx, qword [r15 + 0x120]
lea r8, str._s__s_out
add rcx, 0x9c
xor edi, edi
mov eax, edi
mov edx, 0x200
sub eax, dword [rcx]
movsxd r9, dword [rcx]
add r9, rcx
lea rcx, [rsp + 0xc0]
neg eax
sbb rax, rax
and r9, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.140003900
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0xc0]
mov rdx, qword [r15 + 0x1d0]
mov r9, rsi
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
lea r8, [rax + 0x40]
movdqa xmmword [rsp + 0x60], xmm6
mov dword [rsp + 0x20], edi
call fcn.140014750
lea rcx, [rsp + 0x308]
mov r14d, eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14000f894
mov rax, qword [rsp + 0x308]
xor edx, edx
sub rax, qword [0x14009c1f8]
xorps xmm6, xmm6
imul rax, rax, 0xf4240
div qword [0x14009c1f0]
mov rcx, rax
sub rcx, rbp
add rcx, qword [0x14009c200]
js 0x14000f78a
cvtsi2sd xmm6, rcx
jmp 0x14000f79f
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
divsd xmm6, qword [0x14008fed0]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x98]
call fcn.14002f5c0
mov ecx, r14d
test r14d, r14d
je 0x14000f859
sub ecx, 1
je 0x14000f81f
sub ecx, 1
je 0x14000f808
cmp ecx, 1
jne 0x14000f8a1
mov r8, rbx
mov rdx, rsi
mov rcx, r15
call fcn.1400465b0
lea rax, [rsp + 0xc0]
mov r9, rbx
movaps xmm2, xmm6
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r15
call fcn.14003f7e0
mov al, 1
jmp 0x14000f85b
xor r9d, r9d
lea r8, str.cachemiss
mov rdx, rbx
mov rcx, rsi
call fcn.14003e760
jmp 0x14000f859
mov rax, qword [rbx + 8]
lea r8, str._s__CacheRead__s_
add rax, 0xc
mov ecx, 2
cvttsd2si edx, xmm6
movsxd r9, dword [rax]
sub edi, dword [rax]
add r9, rax
neg edi
sbb rax, rax
and r9, rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.14003dcb0
xor al, al
mov r14, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x2f8]
mov rbp, qword [rsp + 0x2f0]
movaps xmm6, xmmword [rsp + 0x2c0]
add rsp, 0x2d0
pop r15
pop rsi
pop rbx
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
mov edx, r14d
lea rcx, str.Unexpected_cache_read_result__d
call fcn.140014e80
int3
Function at 0x140015a60
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140028f20
movups xmm1, xmmword [rax]
movd eax, xmm1
movups xmmword [rsp + 0x20], xmm1
test al, 1
jne 0x140015a8e
mov al, 1
add rsp, 0x70
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400151a0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140015480
mov eax, dword [rsp + 0x20]
lea rcx, [rsp + 0x50]
shr eax, 3
test al, 1
je 0x140015acb
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x140015add
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x68]
cmp eax, 1
sete bl
cmp rdx, 8
jb 0x140015b21
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015b1c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015b2a
mov rcx, r8
call fcn.14004d934
movzx eax, bl
add rsp, 0x70
pop rbx
ret
call fcn.140055668
int3

Function at 0x140015b30
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rdx
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.1400151a0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.1400151a0
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140015480
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140015480
cmp qword [rsp + 0x38], 8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov r8d, 1
cmovae rdx, qword [rsp + 0x20]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rsp + 0x38]
test eax, eax
setne bl
cmp rdx, 8
jb 0x140015bdc
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015bd7
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015c38
mov rcx, r8
call fcn.14004d934
mov rdx, qword [rsp + 0x58]
xor eax, eax
movdqa xmm0, xmmword [0x14008fee0]
mov word [rsp + 0x20], ax
movdqu xmmword [rsp + 0x30], xmm0
cmp rdx, 8
jb 0x140015c2f
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140015c2a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140015c38
mov rcx, r8
call fcn.14004d934
movzx eax, bl
add rsp, 0x60
pop rbx
ret
call fcn.140055668
int3
Function at 0x140016ad0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x4c0
mov r12, r9
mov rbx, r8
mov r15, rcx
call fcn.140017350
cmp eax, 0xffffffff
je 0x140016b3d
movsxd rdx, eax
mov rax, qword [r15 + 0x28]
lea r9, [rax + rdx*4]
test r9, r9
je 0x140016b3d
mov rax, qword [r15 + 0x60]
xor r8d, r8d
add rax, 0x10
sub r8d, dword [rax]
movsxd rdx, dword [rax]
add rdx, rax
neg r8d
sbb rax, rax
and rdx, rax
movsxd rax, dword [r9]
imul rcx, rax, 0xa8
mov al, 1
add rdx, rcx
mov qword [r12], rdx
add rsp, 0x4c0
pop r15
pop r12
pop rbx
ret
mov qword [rsp + 0x4e0], rbp
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x4e8], rsi
mov r8d, 1
mov qword [rsp + 0x4f0], rdi
mov rdx, rbx
mov qword [rsp + 0x4b8], r13
mov qword [rsp + 0x4b0], r14
call fcn.140041d60
mov r13d, 0xffff
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rsp + 0x224]
movzx ecx, word [rsp + 0x226]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x140016cce
add cx, r13w
lea rdx, [rsp + 0x220]
movzx r9d, cx
xor r8d, r8d
mov word [rsp + 0x226], cx
dec r9d
lea rcx, [rsp + 0x20]
call fcn.140042120
movzx edx, byte [rsp + 0x20]
lea r9, [rsp + 0x21]
mov r8d, 0x1505
test edx, edx
je 0x140016c10
nop dword [rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140016bf0
mov edx, dword [r15 + 0x40]
test r8d, r8d
mov edi, 1
cmovne edi, r8d
test edx, edx
je 0x140016b90
mov rsi, qword [r15 + 0x30]
lea ebx, [rdx - 1]
mov r14, qword [r15 + 0x38]
and ebx, edi
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
je 0x140016b90
mov eax, ebx
lea ebp, [rdx - 1]
cmp edi, ecx
jne 0x140016c65
mov rcx, qword [r14 + rax*8]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x140016c77
lea rdx, [rsp + 0x20]
call fcn.140008ed0
test eax, eax
je 0x140016c77
inc ebx
and ebx, ebp
mov eax, ebx
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
jne 0x140016c45
jmp 0x140016b90
cmp ebx, 0xffffffff
je 0x140016b90
mov rax, qword [r15 + 0x58]
movsxd rcx, ebx
lea rdx, [rax + rcx*4]
test rdx, rdx
je 0x140016b90
xor r8d, r8d
cmp dword [rdx], 0xffffffff
je 0x140016cc6
mov rax, qword [r15 + 0x60]
add rax, 0x10
sub r8d, dword [rax]
movsxd rcx, dword [rax]
add rcx, rax
neg r8d
mov r8, rcx
sbb rax, rax
and r8, rax
movsxd rax, dword [rdx]
imul rcx, rax, 0xa8
add r8, rcx
mov qword [r12], r8
mov al, 1
jmp 0x140016cd0
xor al, al
mov r13, qword [rsp + 0x4b8]
mov rdi, qword [rsp + 0x4f0]
mov rsi, qword [rsp + 0x4e8]
mov rbp, qword [rsp + 0x4e0]
mov r14, qword [rsp + 0x4b0]
add rsp, 0x4c0
pop r15
pop r12
pop rbx
ret
Function at 0x14001a9d0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x4d0
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
test r9, r9
je 0x14001aba4
cmp qword [r9 + 8], 0
je 0x14001aba4
mov rdx, qword [rsi + 0x10]
add rcx, 0x18
mov qword [rsp + 0x4f0], rbx
mov r8d, 4
mov ebx, dword [r9 + 8]
call fcn.140008e00
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov dword [rax], ebx
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.140008870
mov rsi, qword [rbp + 8]
xor edi, edi
test rsi, rsi
je 0x14001ab7d
nop
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + rdi*8]
cmp dword [rdx], 4
jne 0x14001aba0
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x240]
mov r8d, 1
call fcn.140041d60
movzx r9d, word [rsp + 0x246]
lea rdx, [rsp + 0x240]
dec r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.140042120
mov eax, dword [r15]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, r14
mov rax, qword [r15 + 0x20]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140008870
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14001aae0
mov rdx, qword [r15 + 0x10]
lea rcx, [r15 + 0x18]
lea r8, [rbx + 1]
call fcn.140008e00
mov rcx, rax
lea r8, [rbx + 1]
lea rdx, [rsp + 0x40]
call fcn.14004fbf0
movzx eax, byte [rsp + 0x40]
lea r9, [rsp + 0x41]
mov r8d, 0x1505
test eax, eax
je 0x14001ab50
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x14001ab30
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
test r8d, r8d
mov ebx, 1
cmovne ebx, r8d
mov r8d, 4
call fcn.140008e00
inc rdi
mov dword [rax], ebx
cmp rdi, rsi
jb 0x14001aa60
mov al, 1
mov rbx, qword [rsp + 0x4f0]
lea r11, [rsp + 0x4d0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xor al, al
jmp 0x14001ab7f
mov rdx, qword [rsi + 0x10]
add rcx, 0x18
mov r8d, 4
call fcn.140008e00
xor edi, edi
lea rcx, [rsi + 0x18]
mov dword [rax], edi
mov rdx, qword [rsi + 0x10]
lea r8d, [rdi + 4]
call fcn.140008e00
mov dword [rax], edi
mov al, 1
jmp 0x14001ab87
Function at 0x14001abe0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
movzx r10d, byte [r8]
lea r11, [r8 + 1]
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov eax, 0x1505
test r10d, r10d
je 0x14001ac25
imul eax, eax, 0x21
lea r11, [r11 + 1]
add eax, r10d
movzx r10d, byte [r11 - 1]
test r10d, r10d
jne 0x14001ac11
test eax, eax
mov esi, 1
mov rcx, rbx
cmovne esi, eax
mov edx, esi
call fcn.1400121a0
cmp eax, 0xffffffff
je 0x14001ac64
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
je 0x14001ac64
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x20]
mov rcx, r15
movaps xmmword [rsp + 0x20], xmm0
call fcn.140008870
jmp 0x14001ad43
mov eax, dword [r14]
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
mov qword [rsp + 0x60], rbp
mov ebp, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
movaps xmmword [rsp + 0x30], xmm6
lea edx, [rbp + 1]
mov qword [rsp + 0x28], rax
shl rdx, 8
shr rdx, cl
cmp rdx, 0x50
jbe 0x14001aca4
mov rcx, rbx
call fcn.14001fbd0
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea eax, [r8 - 1]
and eax, esi
cmp dword [rdx + rax*4], 0
je 0x14001accb
dec r8d
nop word [rax + rax]
inc eax
and eax, r8d
cmp dword [rdx + rax*4], 0
jne 0x14001acc0
movaps xmm6, xmmword [rsp + 0x20]
mov dword [rdx + rax*4], esi
mov rcx, qword [rbx + 8]
mov qword [rcx + rax*8], rdi
lea ecx, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x18], ecx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
add rcx, rcx
mov rbx, 0xffffffffffffffff
movups xmmword [rax + rcx*8], xmm6
nop dword [rax + rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x14001ad00
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
lea r8, [rbx + 1]
call fcn.140008e00
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.14004fbf0
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
mov rcx, r15
call fcn.140008870
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400211e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x80
mov r14, rcx
mov rsi, r9
lea rcx, [rsp + 0x20]
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400213e8
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x60]
sub rax, qword [0x14009c1f8]
xor edx, edx
imul rax, rax, 0xf4240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0xa0], rdi
div qword [0x14009c1f0]
mov qword [rsp + 0xa8], r15
mov r15, rax
mov qword [rsp + 0x60], rbx
add r15, qword [0x14009c200]
mov qword [rsp + 0x78], 0
call fcn.140008c80
lea rcx, [rsp + 0x60]
mov rdi, rax
call fcn.140008c80
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.140008c80
mov ecx, dword [rbx]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
lea rcx, [r14 + 0x70]
mov qword [rsp + 0x30], rbx
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.140021640
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140008e00
lea rcx, [rdi + 0x18]
mov r8d, 4
mov dword [rax], 0x6a683db9
mov rdx, qword [rdi + 0x10]
mov ebx, dword [r14 + 0x88]
call fcn.140008e00
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov rcx, rdi
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rax], ebx
call fcn.140008870
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140008e00
lea rcx, [r14 + 0x50]
mov dword [rax], 0x6a683db9
call fcn.14003d3c0
mov rdx, rsi
mov qword [r14 + 0x10], 0
lea rcx, [rsp + 0x60]
call fcn.140008aa0
mov rdi, qword [rsp + 0xa0]
movzx ebx, al
mov rcx, rsi
test al, al
je 0x140021370
mov rdx, rbp
call fcn.140015b30
movzx ebx, al
test al, al
jne 0x140021375
mov r9, rbp
lea rdx, str.Failed_to_rename___s__to___s_
mov r8, rsi
mov ecx, 1
call fcn.140014f80
jmp 0x140021375
call fcn.140015a60
lea rcx, [rsp + 0x60]
call fcn.140008990
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400213db
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x14009c1f8]
imul rax, rax, 0xf4240
div qword [0x14009c1f0]
sub rax, r15
add rax, qword [0x14009c200]
lock add qword [0x14009bb60], rax
mov r15, qword [rsp + 0xa8]
movzx eax, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
Function at 0x140024530
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
xor eax, eax
mov rbp, rdx
mov rdx, rcx
mov qword [r11 - 0x40], rax
mov rdi, rcx
mov qword [r11 - 0x38], rax
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x30], rax
mov r14, r8
mov qword [r11 - 0x28], rax
call fcn.14003d170
mov rbx, qword [rsp + 0x38]
mov r8, rdi
mov ecx, 8
test rbx, rbx
je 0x14002461e
mov rsi, qword [rsp + 0x40]
lea rdx, str._s:_successfully_mapped_at__p___d_bytes_
mov r9, rbx
mov dword [rsp + 0x20], esi
call fcn.140014f80
cmp rsi, 0x14
jae 0x1400245bf
mov r9d, esi
mov dword [rsp + 0x20], 0x14
mov r8, rdi
lea rdx, str._s:_Bad_mmap_size__d___need_at_least__d_bytes
mov ecx, 2
call fcn.140014f80
jmp 0x14002462a
cmp dword [rbx], 0xe0afb8f1
je 0x1400245e8
mov r9d, dword [rbx]
lea rdx, str._s:_Bad_magic_number__08x___current_is__08x
mov r8, rdi
mov dword [rsp + 0x20], 0xe0afb8f1
mov ecx, 8
call fcn.140014f80
jmp 0x14002462a
cmp dword [rbx + 0x10], 0xe0afb8f1
je 0x140024602
mov r8, rdi
lea rdx, str.Did_not_find_expected_magic_number_marker_at_the_end_of__s._This_most_likely_means_data_writing_code_for_that_file_is_writing_too_much_or_too_little_data
mov ecx, 1
jmp 0x140024625
movups xmm0, xmmword [rsp + 0x38]
mov al, 1
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov qword [r14], rbx
jmp 0x1400246db
lea rdx, str._s:_mmap_failed
call fcn.140014f80
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400246fd
mov rax, qword [rsp + 0x98]
xor edx, edx
sub rax, qword [0x14009c1f8]
imul rax, rax, 0xf4240
div qword [0x14009c1f0]
mov rdi, rax
add rdi, qword [0x14009c200]
test rbx, rbx
je 0x140024695
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x14002470a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1400246f0
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x14009c1f8]
imul rax, rax, 0xf4240
div qword [0x14009c1f0]
sub rax, rdi
add rax, qword [0x14009c200]
lock inc dword [0x14009baf0]
lock add qword [0x14009baf8], rax
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.140014f00
int3
Function at 0x140025590
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp byte [0x14009c248], 0
mov rdi, rcx
movsxd rbx, edx
je 0x140025612
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov esi, r14d
test edx, edx
je 0x1400255f6
nop
mov rcx, qword [0x1400d1370]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov dword [rsp + 0x60], r14d
mov rdx, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400255f6
mov eax, dword [rsp + 0x60]
add esi, eax
add rdi, rax
mov eax, esi
cmp rax, rbx
jb 0x1400255c0
add dword [0x14009bbd8], ebx
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x38
pop rdi
pop rbx
ret
add dword [0x14009bbd8], ebx
test edx, edx
jle 0x140025643
nop dword [rax]
mov r9, qword [0x14009bba8]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.140058e40
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140025620
add rsp, 0x38
pop rdi
pop rbx
ret

Function at 0x140025650
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
push r15
sub rsp, 0x58
mov r14, rcx
xor r11d, r11d
movsxd rcx, dword [rcx + 0x7c]
mov ebx, r8d
mov rdi, rdx
test rcx, rcx
je 0x140025690
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
add r11d, 5
add r11d, dword [r14 + r10*4]
inc r10
cmp r10, rcx
jne 0x140025680
lea eax, [r8 + 0xc]
mov dword [rsp + 0x34], r9d
add eax, r11d
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov edx, 0xc
mov eax, dword [0x14009babc]
mov dword [rsp + 0x38], eax
inc eax
mov dword [0x14009babc], eax
call fcn.140025590
mov edx, ebx
mov rcx, rdi
call fcn.140025590
xor r15d, r15d
cmp dword [r14 + 0x7c], r15d
je 0x140025809
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], r12
lea r12, [r14 + 0x28]
mov qword [rsp + 0x40], r13
lea r13, [r14 + 0x7c]
nop word [rax + rax]
mov eax, dword [r14]
lea rcx, [rsp + 0x98]
mov edx, 4
mov dword [rsp + 0x98], eax
call fcn.140025590
cmp byte [0x14009c248], 0
movsxd rbx, dword [rsp + 0x98]
mov rdi, qword [r12]
je 0x14002578b
xor eax, eax
mov esi, eax
test ebx, ebx
je 0x140025783
nop dword [rax]
mov rcx, qword [0x1400d1370]
lea r9, [rsp + 0x90]
mov r8d, ebx
mov dword [rsp + 0x90], eax
mov rdx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025783
mov eax, dword [rsp + 0x90]
add esi, eax
add rdi, rax
mov eax, esi
cmp rax, rbx
mov eax, 0
jb 0x140025740
add dword [0x14009bbd8], ebx
jmp 0x1400257c3
add dword [0x14009bbd8], ebx
test ebx, ebx
jle 0x1400257c3
nop word [rax + rax]
mov r9, qword [0x14009bba8]
mov edx, 1
movsxd r8, ebx
mov rcx, rdi
call fcn.140058e40
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x1400257a0
mov edx, 1
mov byte [rsp + 0x90], 0
lea rcx, [rsp + 0x90]
call fcn.140025590
inc r15d
add r12, 8
add r14, 4
cmp r15d, dword [r13]
jne 0x140025700
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rbx
ret
Function at 0x140025990
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, qword [0x14009c240]
xor r12d, r12d
cmp byte [0x14009bbec], r12b
mov ebx, r8d
mov edi, edx
je 0x140025a19
lea rax, str.EmitBuildStart
mov dword [rbp - 0x30], r12d
xorps xmm0, xmm0
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x30]
mov dword [rbp - 8], 0x32
movdqu xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140025b8e
mov rax, qword [rbp + 0x30]
xor edx, edx
sub rax, qword [0x14009c1f8]
imul rax, rax, 0xf4240
div qword [0x14009c1f0]
add rax, qword [0x14009c200]
mov qword [rbp - 0x10], rax
cmp qword [0x14009bba8], r12
jne 0x140025a2f
cmp byte [0x14009c248], r12b
je 0x140025b76
lea rcx, [0x14009bbb0]
mov qword [rsp + 0xb8], rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x14009bbd8]
add eax, 0x18
mov dword [rbp - 0x50], edi
mov dword [rbp - 0x4c], ebx
test r15, r15
jne 0x140025a60
mov ebx, r12d
mov eax, r12d
jmp 0x140025a70
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [r15 + rbx], r12b
jne 0x140025a67
mov dword [rbp - 0x48], eax
lea rcx, [rbp - 0x40]
lea eax, [rbx + 0x1d]
mov dword [rbp - 0x3c], 1
mov dword [rbp - 0x40], eax
mov esi, 0xc
mov eax, dword [0x14009babc]
mov edx, esi
mov dword [rbp - 0x38], eax
inc eax
mov dword [0x14009babc], eax
call fcn.140025590
cmp byte [0x14009c248], r12b
je 0x140025b00
mov qword [rsp + 0xc0], r14
mov edi, r12d
lea r14, [rbp - 0x50]
nop dword [rax]
mov rcx, qword [0x1400d1370]
lea r9, [rbp + 0x48]
mov r8d, esi
mov dword [rbp + 0x48], r12d
mov rdx, r14
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025af0
mov eax, dword [rbp + 0x48]
add edi, eax
add r14, rax
cmp edi, esi
jb 0x140025ac0
add dword [0x14009bbd8], esi
mov r14, qword [rsp + 0xc0]
jmp 0x140025b33
add dword [0x14009bbd8], esi
lea rdi, [rbp - 0x50]
nop word [rax + rax]
mov r9, qword [0x14009bba8]
mov edx, 1
mov r8d, esi
mov rcx, rdi
call fcn.140058e40
movsxd rcx, eax
sub esi, eax
add rdi, rcx
test esi, esi
jg 0x140025b10
mov edx, 4
mov dword [rbp + 0x30], ebx
lea rcx, [rbp + 0x30]
call fcn.140025590
mov edx, dword [rbp + 0x30]
mov rcx, r15
call fcn.140025590
mov edx, 1
mov byte [rbp + 0x48], r12b
lea rcx, [rbp + 0x48]
call fcn.140025590
lea rcx, [0x14009bbb0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, qword [rsp + 0xb8]
lea rcx, [rbp - 0x30]
call fcn.140001370
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.140014f00
int3