joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051f70
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x30
cmp dword [rcx + 0x308], 0
mov r15, rdx
mov esi, r8d
mov rdi, rcx
je 0x140052036
test r8d, r8d
je 0x140052024
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r12
mov r12d, esi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop word [rax + rax]
mov rcx, qword [rdi + 0x2d0]
xor edx, edx
mov rax, qword [r15]
movzx ebx, byte [rdi + 0x2c9]
mov r9, qword [rcx]
movss xmm2, dword [r14 + rax]
call qword [r9 + htons]
mov edx, eax
lea rcx, [rdi + 0x298]
call qword [rdi + 0x2d8]
movzx edx, al
mov r8d, ebx
lea rcx, [rdi + 0x2e0]
call fcn.140024810
lea r14, [r14 + 4]
sub r12, 1
jne 0x140051fc0
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add qword [rdi + 0x268], rsi
xor eax, eax
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret
mov r8d, esi
add rsp, 0x30
pop r15
pop rdi
pop rsi
jmp fcn.1400250c0
Function at 0x140052360
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor esi, esi
mov rdi, rcx
mov dword [rcx + 0x28c], esi
mov byte [rcx + 0x2e0], sil
movzx ecx, word [rcx + 0x2c8]
sub ecx, 0x50
je 0x14005250c
sub ecx, 0xaf
je 0x140052489
sub ecx, 0x1f01
je 0x1400523ff
cmp ecx, 1
jne 0x14005255d
lea ecx, [rsi + 0x38]
call fcn.1400b6058
test rax, rax
je 0x1400525ab
mov rcx, rax
call fcn.140044b90
mov qword [rdi + 0x2e8], rax
test rax, rax
je 0x1400525b2
lea ecx, [rsi + 0x28]
call fcn.1400b6058
test rax, rax
je 0x140052594
mov rcx, qword [rdi + 0x2e8]
mov qword [rax + 0x20], rcx
mov ecx, 0x1000
mov dword [rdi + 0x300], 0x1000
jmp 0x140052457
mov ecx, 0x38
call fcn.1400b6058
test rax, rax
je 0x1400525ab
mov rcx, rax
call fcn.140044b90
mov qword [rdi + 0x2e8], rax
test rax, rax
je 0x1400525b2
mov ecx, 0x28
call fcn.1400b6058
test rax, rax
je 0x140052594
mov rcx, qword [rdi + 0x2e8]
mov qword [rax + 0x20], rcx
mov ecx, 0xf00
mov dword [rdi + 0x300], 0xf00
mov qword [rdi + 0x2f0], rax
call fcn.1400b609c
mov qword [rdi + 0x2f8], rax
mov dword [rdi + 0x304], esi
test rax, rax
jne 0x14005255d
mov eax, 0x80040202
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov rdx, qword [rdi + 0x2f0]
test rdx, rdx
je 0x14005255d
mov ecx, dword [rdi + 0x2f8]
cmp ecx, 2
jge 0x1400524b4
mov eax, 0x8004020d
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
movzx eax, byte [rdi + 0x2fc]
mov byte [rsp + 0x30], al
mov eax, reloc.WSOCK32.dll_recv
cmp ecx, eax
mov qword [rsp + 0x68], rbx
cmovl eax, ecx
lea rcx, [rsp + 0x31]
mov r8d, eax
mov ebx, eax
call fcn.1400b9e30
mov rcx, qword [rdi + 0x10]
lea r8d, [rbx + 1]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rbx, qword [rsp + 0x68]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x14005255d
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov ecx, 0x38
call fcn.1400b6058
test rax, rax
je 0x1400525ab
mov rcx, rax
call fcn.140044b90
mov qword [rdi + 0x2e8], rax
test rax, rax
je 0x1400525b2
mov ecx, 0x9600
call fcn.1400b6058
test rax, rax
je 0x140052594
mov rdx, qword [rdi + 0x2e8]
mov rcx, rax
call fcn.14003f2a0
mov qword [rdi + 0x2f0], rax
test rax, rax
je 0x1400525b2
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r9b, 1
mov byte [rsp + 0x20], 1
test eax, eax
mov rcx, rdi
cmovne rsi, qword [rsp + 0x60]
xor edx, edx
mov r8, rsi
call fcn.140053360
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rdi + 0x2f0], rsi
mov eax, 0x80040202
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
mov qword [rdi + 0x2e8], rsi
mov rsi, qword [rsp + 0x70]
mov eax, 0x80040202
add rsp, 0x50
pop rdi
ret
Function at 0x140053dc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
lea rbx, [r8 + 8]
mov rsi, r9
mov r13, r8
mov ebp, edx
mov r15, rcx
cmp rbx, r9
jge 0x140053f93
movzx r12d, byte [rsp + 0xa0]
nop word [rax + rax]
mov rcx, qword [r15 + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r15 + 0x70]
lea r9, [rsp + 0x90]
mov r8d, 8
mov dword [rsp + 0x90], 0
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x30]
lea r13d, [rdx + 1]
add r13, rbx
and r13, 0xfffffffffffffffe
cmp eax, 0x5453494c
jne 0x140053e7a
lea r8, [rbx + 4]
mov byte [rsp + 0x20], r12b
mov r9, r13
mov edx, ebp
mov rcx, r15
call fcn.140053dc0
jmp 0x140053f7d
cmp ax, 0x7869
jne 0x140053f59
mov rcx, rdx
call fcn.1400b609c
mov rbx, rax
test rax, rax
je 0x140053f86
mov edi, dword [rsp + 0x34]
lea r9, [rsp + 0x90]
mov rcx, qword [r15 + 0x70]
mov r8d, edi
mov rdx, rax
mov dword [rsp + 0x90], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140053f4f
cmp dword [rsp + 0x90], edi
jne 0x140053f4f
cmp byte [rbx + 3], 1
lea rsi, [rbx + 0x18]
jne 0x140053f47
cmp word [rbx], 2
jb 0x140053f47
mov ecx, dword [rbx + 8]
mov eax, ecx
and eax, 0xffff0000
cmp eax, 0x62770000
jne 0x140053f47
cmp ecx, ebp
je 0x140053f02
test ebp, ebp
jne 0x140053f47
xor edi, edi
cmp dword [rbx + 4], edi
jbe 0x140053f47
nop dword [rax]
mov r8d, dword [rsi]
mov edx, ebp
add r8, qword [rbx + 0xc]
mov rcx, r15
mov r9d, dword [rsi + 4]
add r9, r8
mov byte [rsp + 0x20], r12b
call fcn.140053dc0
mov ecx, eax
mov r14d, eax
shr ecx, 0x1f
test cl, cl
jne 0x140053fad
movzx eax, word [rbx]
inc edi
lea rsi, [rsi + rax*4]
cmp edi, dword [rbx + 4]
jb 0x140053f10
mov rsi, qword [rsp + 0x98]
mov rcx, rbx
call fcn.1400b60a4
jmp 0x140053f86
mov ecx, eax
and ecx, 0xffff0000
cmp ecx, 0x62770000
jne 0x140053f86
cmp eax, ebp
je 0x140053f71
test ebp, ebp
jne 0x140053f86
movzx r8d, r12b
mov rcx, r15
call fcn.1400525d0
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140053f95
lea rbx, [r13 + 8]
cmp rbx, rsi
jl 0x140053e00
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.1400b60a4
mov eax, r14d
jmp 0x140053f95
Function at 0x140054020
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor ebx, ebx
lea rdx, [rsp + 0x60]
mov dword [rcx + 0x28c], ebx
mov rdi, rcx
mov dword [rcx + 0x2ac], ebx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x2d8], rbx
mov word [rcx + 0x2c8], bx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, rdi
mov byte [rsp + 0x20], 0
test eax, eax
cmovne rbx, qword [rsp + 0x60]
xor r9d, r9d
mov r8, rbx
xor edx, edx
call fcn.140053360
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400540f3
mov eax, dword [rdi + 0x28c]
test eax, eax
je 0x1400540ee
mov rcx, qword [rdi + 0x18]
test rcx, rcx
je 0x1400540ee
cmp rcx, 1
jne 0x1400540a9
movabs rcx, 0x7fffffffffffffff
mov qword [rdi + 0x18], rcx
cmp eax, 1
jle 0x1400540e1
mov r8d, dword [rdi + 0x288]
lea rdx, str.Audio_track__d
inc r8d
lea rcx, [rsp + 0x30]
call fcn.1400100f0
mov r9d, 0xffffffff
lea rcx, [rdi + 0x58]
lea r8, [rsp + 0x30]
lea edx, [r9 + 5]
call fcn.140025fb0
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov eax, 0x8004020e
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140054100
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rdx, [rsp + 0x40]
xor edi, edi
mov dword [rcx + 0x28c], edi
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8d, edi
mov byte [rsp + 0x20], dil
test eax, eax
mov r9b, 1
mov rcx, rbx
cmovne r8, qword [rsp + 0x40]
xor edx, edx
call fcn.140053360
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400542f2
cmp byte [rbx + 0x2e0], dil
je 0x140054219
mov eax, dword [rbx + 0x2c]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x2b0]
lea r8, [rsp + 0x48]
mov rcx, qword [rbx + 0x2e8]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], edi
call fcn.14002bdd0
mov ecx, eax
mov edx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14005420c
mov r8d, dword [rsp + 0x48]
test r8d, r8d
je 0x1400541cb
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400542f2
jmp 0x1400541d5
cmp dword [rsp + 0x40], edi
je 0x1400542e8
mov eax, dword [rbx + 0x2c]
lea r9, [rsp + 0x50]
mov rdx, qword [rbx + 0x2b0]
lea r8, [rsp + 0x48]
mov rcx, qword [rbx + 0x2e8]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.14002bdd0
mov edx, eax
shr eax, 0x1f
test al, al
je 0x1400541a1
mov eax, edx
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
movzx eax, word [rbx + 0x2c8]
cmp ax, 2
je 0x1400542dc
cmp ax, 0x11
je 0x1400542ce
cmp ax, 0x50
je 0x140054259
mov ecx, 0xff
cmp ax, cx
jne 0x1400542e8
mov rcx, qword [rbx + 0x2e8]
call fcn.14003eae0
jmp 0x1400542e8
mov rdx, qword [rbx + 0x2f8]
test rdx, rdx
je 0x1400542e8
mov r8d, dword [rbx + 0x304]
cmp r8d, 7
jbe 0x1400542e8
mov rcx, qword [rbx + 0x2e8]
call fcn.140045ba0
mov r8d, dword [rbx + 0x20]
xor r9d, r9d
mov rdx, qword [rbx + 0x2b0]
mov rcx, qword [rbx + 0x2f0]
mov qword [rsp + 0x20], rdi
call fcn.14003f330
test eax, eax
je 0x1400542e8
mov rcx, qword [rbx + 0x10]
mov r8d, eax
mov rdx, qword [rbx + 0x2b0]
mov r9, qword [rcx]
call qword [r9 + reloc.WSOCK32.dll_recv]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x1400542e8
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [rbx + 0x2e8]
call fcn.14003dc70
jmp 0x1400542e8
lea rcx, [rbx + 0x2e8]
call fcn.140046b90
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140054600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rbx, rcx
lea r9, [rbp + 0x67]
mov rcx, qword [rcx + 0x70]
lea rdx, [rbp - 0x49]
xor edi, edi
mov r8d, pe_nt_image_headers64
mov dword [rbp + 0x67], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x49]
cmp eax, dword [str.2BIT]
je 0x140054651
mov eax, 0x8004020c
jmp 0x1400547ca
mov ecx, dword [rbp - 0x2f]
mov eax, dword [rbp - 0x2b]
movzx r8d, word [rbp - 0x3b]
ror word [rbp - 0x35], 8
mov edx, dword [rbp - 0x33]
bswap eax
mov dword [rbp - 0x2b], eax
mov eax, dword [rbp - 0x27]
ror r8w, 8
cmp word [rbp - 0x3d], di
bswap eax
setne dil
mov dword [rbp - 0x27], eax
bswap edx
inc edi
mov word [rbp - 0x3b], r8w
mov eax, edx
mov dword [rbp - 0x33], edx
bswap ecx
mov ecx, ecx
and eax, 0xff000000
mov dword [rbp - 0x2f], ecx
mov qword [rbx + 0x290], pe_nt_image_headers64
mov qword [rbx + 0x18], rcx
mov dword [rbx + 0x20], edi
cmp eax, 0xff000000
jne 0x1400546bc
and edx, 0xffffff
mov dword [rbx + 0x28], edx
jmp 0x1400546d5
shr edx, 0x18
mov dword [rbp - 0x33], edx
cmp edx, 8
jae 0x1400546d5
lea rcx, [0x140140df0]
movzx eax, word [rcx + rdx*2]
mov dword [rbx + 0x28], eax
mov byte [rbx + 0x2c1], 1
cmp r8w, 8
je 0x1400546fd
cmp r8w, 0x10
je 0x1400546f4
mov eax, 0x80040208
jmp 0x1400547ca
lea r8, [0x14012f1c8]
jmp 0x140054704
lea r8, [0x14012f1f8]
mov edx, 2
lea rcx, [rbx + 0x58]
lea r9d, [rdx - 3]
call fcn.140025fb0
cmp word [rbp - 0x39], 0
jne 0x140054724
mov byte [rbx + 0x2c2], 1
mov rcx, rbx
call fcn.140023ca0
mov rax, qword [rbp - 0x45]
mov qword [rbp + 0x37], rax
shr rax, 0x38
test al, al
je 0x14005474a
movups xmm0, xmmword [rbp - 0x1d]
mov eax, dword [rbp - 0xd]
mov dword [rbp + 0x4f], eax
movups xmmword [rbp + 0x3f], xmm0
cmp byte [rbp - 0x45], 0
je 0x140054767
mov r9d, 0x1c
lea r8, [rbp + 0x37]
lea rcx, [rbx + 0x58]
lea edx, [r9 - 0x19]
call fcn.140025fb0
cmp byte [rbp - 9], 0
je 0x140054784
mov r9d, 0x40
lea r8, [rbp - 9]
lea rcx, [rbx + 0x58]
lea edx, [r9 - 0x31]
call fcn.140025fb0
cmp word [rbp - 0x35], 0x7f
ja 0x140054796
movzx eax, byte [rbp - 0x35]
mov byte [rbx + 0x3d], al
mov byte [rbx + 0x38], 1
movzx eax, word [rbp - 0x37]
mov ecx, dword [rbp - 0x27]
mov edx, dword [rbp - 0x2b]
test ax, ax
jne 0x1400547ae
test edx, edx
jne 0x1400547ae
cmp ecx, dword [rbp - 0x2f]
jae 0x1400547c8
mov r8d, 0xffff
mov byte [rbx + 0x38], 1
cmp ax, r8w
mov dword [rbx + 0x48], edx
mov dword [rbx + 0x4c], ecx
sete al
mov byte [rbx + 0x44], al
xor eax, eax
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140054b60
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp byte [rcx + 0x2c0], 0
mov rbx, rcx
je 0x140054b7c
add rsp, 0x50
pop rbx
jmp method.awReaderFilter.virtual_56
mov eax, dword [rcx + 0x2c8]
cmp eax, 0x20636161
je 0x140054bb0
cmp eax, 0x31706d2e
je 0x140054bb0
cmp eax, 0x32706d2e
je 0x140054bb0
cmp eax, 0x33706d2e
je 0x140054bb0
cmp eax, 0x6134706d
je 0x140054bb0
mov eax, 0x80040200
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rcx + 0x410]
mov qword [rsp + 0x68], rbp
xor ebp, ebp
mov qword [rsp + 0x78], rdi
test rdx, rdx
je 0x140054bfa
mov r9, qword [rbx + 0x400]
mov r8d, ebp
mov ecx, ebp
test r9, r9
jle 0x140054c00
nop dword [rax]
mov eax, dword [rdx]
lea rdx, [rdx + 4]
cmp eax, ecx
cmovbe eax, ecx
inc r8d
mov ecx, eax
movsxd rax, r8d
cmp rax, r9
jl 0x140054be0
jmp 0x140054c00
mov ecx, dword [rcx + 0x408]
mov rdi, qword [rbx + 0x2a0]
call fcn.1400b609c
mov qword [rbx + 0x2a0], rax
test rdi, rdi
je 0x140054c20
mov rcx, rdi
call fcn.1400b60a4
cmp qword [rbx + 0x2a0], rbp
jne 0x140054c3e
mov rbp, qword [rsp + 0x68]
mov eax, 0x80040202
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbx
ret
mov rdx, qword [rbx + 0x290]
xor r9d, r9d
mov rcx, qword [rbx + 0x70]
xor r8d, r8d
mov qword [rsp + 0x70], rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rax, qword [rbx + 0x2d0]
mov qword [rbx + 0x2d8], rax
mov eax, dword [rbx + 0x2c8]
cmp eax, 0x20636161
je 0x140054cbb
cmp eax, 0x31706d2e
je 0x140054cb4
cmp eax, 0x32706d2e
je 0x140054cad
cmp eax, 0x33706d2e
je 0x140054c97
cmp eax, 0x6134706d
je 0x140054cbb
mov esi, dword [rsp + 0x60]
jmp 0x140054d13
cmp dword [rbx + 0x28], 0x7d00
mov esi, 0x480
mov eax, 0x240
cmovb esi, eax
jmp 0x140054d13
mov esi, 0x480
jmp 0x140054d13
mov esi, 0x180
jmp 0x140054d13
mov rdx, qword [rbx + 0x3f0]
mov esi, 0x400
test rdx, rdx
je 0x140054d13
mov eax, dword [rbx + 0x3f8]
test eax, eax
je 0x140054d13
mov ecx, reloc.WSOCK32.dll_recv
mov byte [rsp + 0x30], bpl
cmp eax, ecx
cmova eax, ecx
lea rcx, [rsp + 0x31]
mov r8d, eax
mov edi, eax
call fcn.1400b9e30
mov rcx, qword [rbx + 0x10]
lea r8d, [rdi + 1]
xor r9d, r9d
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140054d80
mov rax, qword [rbx + 0x410]
test rax, rax
je 0x140054d34
movsxd rcx, dword [rbx + 0x2e8]
cmp rcx, qword [rbx + 0x400]
jge 0x140054d7e
mov edi, dword [rax + rcx*4]
jmp 0x140054d3a
mov edi, dword [rbx + 0x408]
mov rdx, qword [rbx + 0x2a0]
lea r9, [rsp + 0x60]
mov rcx, qword [rbx + 0x70]
mov r8d, edi
mov dword [rsp + 0x60], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rbx + 0x10]
mov r9d, esi
mov rdx, qword [rbx + 0x2a0]
mov r8d, edi
mov eax, edi
sub qword [rbx + 0x2d8], rax
mov rax, qword [rcx]
call qword [rax + 0x20]
jmp 0x140054d13
xor eax, eax
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop rbx
ret
Function at 0x140056c60
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
push r13
sub rsp, 0x58
cmp dword [rcx + 0x298], 0x34616d69
mov r13, rdx
mov rdi, rcx
jne 0x140056e30
mov ecx, dword [rcx + 0x258]
xor esi, esi
mov ebx, dword [rdi + 0x2ac]
imul eax, ecx, 0x22
add eax, ebx
cmp eax, dword [rdi + 0x2a8]
jbe 0x140056ce0
mov rdx, qword [rdi + 0x2a0]
lea r9, [r11 + 8]
mov rcx, qword [rdi + 0x38]
mov r8d, ebx
mov dword [r11 + 8], esi
mov qword [r11 - 0x58], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140056d57
cmp dword [rsp + 0x80], ebx
jne 0x140056d57
mov ecx, dword [rdi + 0x258]
mov ebx, esi
mov dword [rdi + 0x2ac], esi
mov qword [rsp + 0x88], rbp
mov ebp, esi
mov qword [rsp + 0x98], r14
mov r14d, ebx
add r14, qword [rdi + 0x2a0]
test ecx, ecx
je 0x140056e19
mov qword [rsp + 0x90], r12
mov eax, 0x7fff
mov qword [rsp + 0x50], r15
movaps xmmword [rsp + 0x40], xmm6
movss xmm6, dword [0x14013012c]
movaps xmmword [rsp + 0x30], xmm7
movss xmm7, dword [0x14012bc68]
mov edx, ebp
mov r15, qword [r13 + rdx*8]
movss xmm0, dword [r15]
mulss xmm0, xmm6
subss xmm0, xmm7
cvttss2si ecx, xmm0
cmp ecx, 0xffff8000
jge 0x140056d66
mov ecx, 0xffff8000
jmp 0x140056d6b
mov eax, 0x80040206
add rsp, 0x58
pop r13
pop rdi
pop rsi
pop rbx
ret
cmp ecx, eax
cmovg ecx, eax
and cx, 0xff80
cmp byte [rdi + 0x3d8], 0
je 0x140056d89
movsx eax, cx
mov dword [rdi + rdx*8 + 0x2c8], eax
mov dword [rdi + rdx*8 + 0x2cc], esi
movzx eax, word [rdi + rdx*8 + 0x2cc]
or ax, cx
ror ax, 8
mov word [r14], ax
add r14, 2
mov eax, esi
lea rcx, [rdi + 0x2c8]
mov edx, ebp
movss xmm2, dword [r15 + rax*4]
call fcn.14003db40
inc esi
mov edx, ebp
mov ecx, esi
movzx ebx, al
inc esi
movss xmm2, dword [r15 + rcx*4]
lea rcx, [rdi + 0x2c8]
call fcn.14003db40
shl al, 4
or al, bl
mov byte [r14], al
inc r14
cmp esi, 0x40
jb 0x140056da0
add dword [rdi + 0x2ac], 0x22
inc ebp
mov esi, 0
mov eax, 0x7fff
cmp ebp, dword [rdi + 0x258]
jb 0x140056d30
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x88]
mov byte [rdi + 0x3d8], 0
mov eax, dword [rdi + 0x2c0]
add qword [rdi + 0x268], rax
xor eax, eax
add rsp, 0x58
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x140057010
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x30
cmp byte [rcx + 0x288], 0
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
je 0x140057045
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
jmp fcn.1400250c0
mov edx, dword [rcx + 0x2c4]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r14
xor r14d, r14d
mov esi, r14d
test edx, edx
je 0x1400570bb
mov esi, dword [rcx + 0x2c0]
mov r8, rbp
mov rcx, qword [rcx + 0x2b0]
sub esi, edx
cmp edi, esi
cmovb esi, edi
xor r9d, r9d
mov dword [rsp + 0x20], esi
call fcn.140027780
add dword [rbx + 0x2c4], esi
mov eax, dword [rbx + 0x2c4]
cmp eax, dword [rbx + 0x2c0]
jne 0x1400570b9
mov rdx, qword [rbx + 0x2b0]
mov rcx, rbx
call fcn.140056c60
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140057161
mov dword [rbx + 0x2c4], r14d
sub edi, esi
cmp edi, dword [rbx + 0x2c0]
jb 0x14005713d
mov r8d, r14d
cmp dword [rbx + 0x258], r14d
jbe 0x140057109
mov eax, esi
lea r9, [rax*4]
nop dword [rax]
mov eax, r8d
inc r8d
lea rdx, [rax*8]
mov rax, qword [rbx + 0x2b8]
mov rcx, qword [rdx + rbp]
add rcx, r9
mov qword [rdx + rax], rcx
cmp r8d, dword [rbx + 0x258]
jb 0x1400570e0
mov rax, qword [rbx + 0x2b8]
mov ecx, r8d
mov qword [rax + rcx*8], r14
mov rcx, rbx
mov rdx, qword [rbx + 0x2b8]
call fcn.140056c60
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140057161
mov eax, dword [rbx + 0x2c0]
add esi, eax
sub edi, eax
cmp edi, eax
jae 0x1400570c3
test edi, edi
je 0x14005715f
mov rcx, qword [rbx + 0x2b0]
mov r9d, esi
mov r8, rbp
mov dword [rsp + 0x20], edi
xor edx, edx
call fcn.140027780
mov dword [rbx + 0x2c4], edi
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140057180
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov dword [rsp + 0x30], edx
mov rax, r8
mov dword [rsp + 0x58], ebp
mov rbx, r9
mov qword [r11 - 0x28], rbp
mov rdi, r8
lea r9, [r11 + 0x10]
mov rsi, rcx
lea r8d, [rbp + 0xc]
mov rcx, qword [rcx + 0x38]
lea rdx, [r11 - 0x18]
bswap rax
mov qword [r11 - 0x14], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x1400571ee
mov rcx, qword [rsi + 0x38]
lea r9, [rsp + 0x58]
mov r8d, edi
mov dword [rsp + 0x58], ebp
mov rdx, rbx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140057cb0
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x90
mov rdi, rcx
mov rcx, qword [rcx + 0x70]
cmp rcx, 0xffffffffffffffff
jne 0x140057cd1
xor eax, eax
add rsp, 0x90
pop rdi
ret
mov qword [rsp + 0xb0], rbx
lea r9, [rsp + 0xa0]
xor ebx, ebx
mov qword [rsp + 0xb8], rbp
mov ebp, recv
mov dword [rsp + 0xa0], ebx
mov r8d, ebp
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140057f3c
cmp dword [rsp + 0xa0], ebp
jne 0x140057f3c
cmp dword [rsp + 0x30], 0x46464952
jne 0x140057f35
cmp dword [rsp + 0x38], 0x41444443
jne 0x140057f35
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0xa0]
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r14d, ebx
lea esi, [rbx - 1]
test eax, eax
cmovne r14d, dword [rsp + 0xa0]
cmp r14d, ebp
jbe 0x140057f2e
mov r12d, dword [rsp + 0xa0]
mov r15d, dword [rsp + 0xa0]
mov rcx, qword [rdi + 0x70]
lea r9, [rsp + 0xa0]
mov r8d, 8
mov dword [rsp + 0xa0], ebx
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0xa8], 0x20746d66
jne 0x140057e2e
mov rcx, qword [rdi + 0x70]
lea r9, [rsp + 0xa0]
mov r8d, socket
mov dword [rsp + 0xa0], ebx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx esi, word [rsp + 0x52]
lea rdx, str.Track__d
mov r12d, dword [rsp + 0x58]
lea rcx, [rsp + 0x40]
mov r15d, dword [rsp + 0x5c]
mov r8d, esi
call fcn.1400100f0
mov r9d, 0xffffffff
lea rcx, [rdi + 0x58]
lea r8, [rsp + 0x40]
lea edx, [r9 + 4]
call fcn.140025fb0
mov eax, dword [rsp + 0xac]
add eax, 8
add ebp, eax
cmp ebp, r14d
jb 0x140057d91
test esi, esi
js 0x140057f2e
mov r8, qword [rdi + 0x2c8]
mov eax, dword [r8 + 0x68]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140057ec8
cmp dword [r8 + 0x80], ebx
jle 0x140057ec3
movsxd r14, esi
nop dword [rax + rax]
mov edx, ebx
mov rcx, r8
call fcn.140002d20
test al, al
je 0x140057eb1
mov rcx, qword [rdi + 0x2c8]
cmp esi, dword [rcx + 0x540]
jl 0x140057eb1
cmp esi, dword [rcx + 0x544]
jg 0x140057eb1
lea rax, [r14 + r14*2]
cmp dword [rcx + rax*4 + 0x84], r12d
jne 0x140057eb1
lea rax, [r14 + r14*2]
cmp dword [rcx + rax*4 + 0x88], r15d
je 0x140057efb
mov r8, qword [rdi + 0x2c8]
inc ebx
cmp ebx, dword [r8 + 0x80]
jl 0x140057e70
mov eax, 0x80040205
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
mov edx, esi
mov rcx, rdi
call fcn.140057610
mov rcx, qword [rdi + 0x2c8]
mov r8d, 0xffffffff
mov edx, esi
call fcn.140003710
mov rcx, qword [rdi + 0x2c8]
lea rdx, [rdi + 0x18]
mov rax, qword [rcx]
call qword [rax + htons]
xor eax, eax
jmp 0x140057ec8
mov eax, 0x8004020d
jmp 0x140057ec8
mov eax, 0x8004020c
jmp 0x140057ee2
mov eax, 0x80040205
jmp 0x140057ee2