joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ea40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x70
xor ebx, ebx
lea r9, [rax + 8]
mov rdi, rcx
mov dword [rax + 8], ebx
mov rcx, qword [rcx + 0x70]
lea rdx, [rax - 0x48]
mov qword [rax - 0x58], rbx
lea r8d, [rbx + 0xc]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 0x2046564e
je 0x14006ea8b
mov eax, 0x8004020c
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp dword [rsp + 0x38], 0x20
mov dword [rsp + 0x58], 0x1f40
jb 0x14006eb01
mov rcx, qword [rdi + 0x70]
lea r9, [rsp + 0x80]
mov r8d, recv
mov dword [rsp + 0x80], ebx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x40], 0x544d4656
jne 0x14006eb01
mov eax, dword [rsp + 0x48]
cmp eax, 0x14
jbe 0x14006eadb
mov eax, socket
mov rcx, qword [rdi + 0x70]
lea r9, [rsp + 0x80]
mov r8d, eax
mov dword [rsp + 0x80], ebx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x38]
lea rdx, [rsp + 0x80]
mov rcx, qword [rdi + 0x70]
add rax, 0xc
mov qword [rdi + 0x290], rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r9d, 0xffffffff
mov dword [rdi + 0x20], 1
test eax, eax
mov dword [rdi + 0x2ac], 4
mov eax, dword [rsp + 0x58]
lea rcx, [rdi + 0x58]
cmovne rbx, qword [rsp + 0x80]
lea r8, [0x140140998]
sub rbx, qword [rdi + 0x290]
lea edx, [r9 + 3]
add rbx, rbx
mov dword [rdi + 0x28], eax
mov qword [rdi + 0x18], rbx
call fcn.140025fb0
mov rbx, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x70
pop rdi
ret

Function at 0x14006ec90
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 4
add rcx, 0x2c8
call fcn.14002eb00
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80
Function at 0x14006ecc0
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x80
xor edx, edx
mov rdi, rcx
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x14006eeaf
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x90], rbx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0xa0], rbp
xor ebx, ebx
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r15
mov r15d, 1
mov dword [rsp + 0x40], 0x544d4656
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], socket
lea r8d, [r15 + 0xb]
mov dword [rsp + 0x50], 0x7d00
mov dword [rsp + 0x54], 0x10000
mov dword [rsp + 0x58], 0x1f40
mov dword [rsp + 0x5c], 0x3e80
mov dword [rsp + 0x60], 0x100002
mov dword [rsp + 0x30], 0x2046564e
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0x38], 0x20
mov dword [rsp + 0x98], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x98]
lea r8d, [r15 + 0xb]
mov dword [rsp + 0x98], ebx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x98]
lea r8d, [r15 + 0x13]
mov dword [rsp + 0x98], ebx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [rdi + 0x260], 0x1f40
je 0x14006ee15
mov ecx, 0x178
call fcn.1400b6058
test rax, rax
je 0x14006ee00
mov edx, 0x1f40
lea r8d, [r15 + 4]
mov rcx, rax
call fcn.14002a530
mov rbx, rax
mov rdx, rbx
mov rcx, rdi
call fcn.140025eb0
xor edx, edx
mov rcx, rdi
call fcn.140024c30
lea rsi, [rdi + 0x298]
mov edx, 4
mov rcx, rsi
call fcn.14002eb90
mov eax, dword [rdi + 0x264]
lea rbp, [rdi + 0x2e0]
lea r8, [rdi + 0x270]
mov rcx, rbp
lea rdx, [rdi + 0x38]
lea r9d, [rax*4 + 7]
shr r9d, 3
call fcn.140022bf0
mov r14, qword [rsp + 0x78]
test al, al
jne 0x14006ee65
mov eax, 0x80040202
jmp 0x14006ee92
mov rcx, rdi
call fcn.1400246e0
mov rcx, rbp
mov edi, eax
call fcn.140023c30
mov rcx, rsi
call fcn.14002ecf0
test rbx, rbx
je 0x14006ee90
mov r8, qword [rbx]
mov edx, r15d
mov rcx, rbx
call qword [r8]
mov eax, edi
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x70]
add rsp, 0x80
pop rdi
ret
Function at 0x14006fe70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x730]
sub rsp, 0x830
mov rdi, rcx
lea r9, [rbp + 0x740]
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov r8d, 0x800
mov dword [rbp + 0x740], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
cmp eax, 0x66617020
je 0x14006fed2
cmp eax, 0x20706166
je 0x14006fed2
mov eax, 0x8004020c
jmp 0x140070062
mov rcx, qword [rdi + 0x70]
lea rdx, [rbp + 0x740]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rbx
cmovne rcx, qword [rbp + 0x740]
cmp rcx, 0x800
ja 0x14006ff03
mov eax, 0x8004020d
jmp 0x140070062
mov ecx, dword [rsp + 0x38]
test ecx, ecx
sete al
test ecx, ecx
mov ecx, dword [rsp + 0x34]
mov byte [rdi + 0x2c1], al
mov byte [rdi + 0x2c8], al
jne 0x14006ff52
mov eax, dword [rsp + 0x3c]
bswap eax
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x40]
bswap eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x44]
bswap eax
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
bswap eax
bswap ecx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x38], ebx
test ecx, ecx
je 0x14006ff60
mov eax, 0x8004020a
jmp 0x140070062
mov rcx, qword [rdi + 0x70]
lea rdx, [rbp + 0x740]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rsp + 0x44]
test eax, eax
mov eax, dword [rsp + 0x3c]
cmovne ebx, dword [rbp + 0x740]
sub ebx, 0x800
mov dword [rdi + 0x28], eax
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x20], ecx
mov qword [rdi + 0x290], 0x800
test eax, eax
je 0x14006ffe1
cmp eax, 1
je 0x14006ffb0
mov eax, 0x80040208
jmp 0x140070062
shr ebx, 5
lea r8, [0x14012f1d8]
xor edx, edx
mov r9d, 0xffffffff
lea eax, [rbx + rbx*4]
add eax, eax
lea rbx, [rdi + 0x58]
div ecx
lea edx, [r9 + 3]
mov ecx, eax
mov qword [rdi + 0x18], rcx
mov rcx, rbx
call fcn.140025fb0
jmp 0x140070014
xor edx, edx
shr ebx, 1
mov eax, ebx
lea r8, [0x14012f1c8]
div ecx
mov r9d, 0xffffffff
lea rbx, [rdi + 0x58]
mov ecx, eax
mov qword [rdi + 0x18], rcx
mov rcx, rbx
lea edx, [r9 + 3]
call fcn.140025fb0
mov rcx, rdi
call fcn.140023ca0
mov eax, dword [rsp + 0x48]
sub eax, 1
je 0x140070047
sub eax, 1
je 0x14007003e
sub eax, 1
je 0x140070035
cmp eax, 2
jne 0x140070060
lea r8, str.From_DSP_Processing
jmp 0x14007004e
lea r8, str.Multi_track_Mixdown
jmp 0x14007004e
lea r8, str.Digital_Transfer
jmp 0x14007004e
lea r8, str.Analog_Recording
mov r9d, 0xffffffff
mov rcx, rbx
lea edx, [r9 + 0x10]
call fcn.140025fb0
xor eax, eax
lea r11, [rsp + 0x830]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400705b0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov edx, 2
add rcx, 0x58
call fcn.140025da0
mov rcx, rax
lea r9, [0x14012dc98]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
movzx r8d, word [rcx + rdx*2 + 2]
cmp r8w, word [r9 + rdx*2 + 2]
jne 0x140070603
add rdx, 2
cmp rdx, 0xb
je 0x140070610
movzx eax, word [rcx + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x1400705e0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80
lea rcx, [rbx + 0x2b0]
cmp qword [rcx], 0
jne 0x140070638
mov r8d, dword [rbx + 0x2c]
mov edx, dword [rbx + 0x20]
call fcn.1400265b0
test al, al
jne 0x140070638
mov eax, 0x80040202
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x298]
xor r9d, r9d
add rdx, qword [rbx + 0x290]
xor r8d, r8d
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rax, qword [rbx + 0x18]
sub rax, qword [rbx + 0x30]
mov qword [rbx + 0x2b8], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140070670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x830
lea rbp, [0x14012bb38]
mov rdi, rcx
mov rdx, rbp
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x140070777
xor eax, eax
mov qword [rsp + 0x840], rbx
xor edx, edx
mov dword [rsp + 0x34], eax
mov r8d, 0x7e8
mov qword [rsp + 0x850], rsi
lea rcx, [rsp + 0x48]
call fcn.1400ba240
mov eax, dword [rdi + 0x260]
lea rcx, [rdi + 0x28]
mov edx, 2
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x30], 0x66617020
mov dword [rsp + 0x38], 1
call fcn.140025da0
mov rbx, 0xffffffffffffffff
mov r8, rax
mov rdx, rbx
nop dword [rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [rbp + rdx*2 + 2]
jne 0x140070723
add rdx, 2
cmp rdx, 0xb
je 0x140070788
movzx eax, word [r8 + rdx*2]
cmp ax, word [rbp + rdx*2]
je 0x140070700
mov edx, 2
lea rcx, [rdi + 0x28]
call fcn.140025da0
mov rdx, rax
lea r8, [0x14012dc98]
nop dword [rax + rax]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r8 + rbx*2 + 2]
jne 0x140070762
add rbx, 2
cmp rbx, 0xb
je 0x1400707a1
movzx eax, word [rdx + rbx*2]
cmp ax, word [r8 + rbx*2]
je 0x140070740
mov eax, 0x80040208
mov rbx, qword [rsp + 0x840]
mov rsi, qword [rsp + 0x850]
mov rbp, qword [rsp + 0x858]
add rsp, 0x830
pop rdi
ret
xor ebx, ebx
mov rcx, rdi
mov dword [rsp + 0x40], ebx
call fcn.140024080
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x1400707ca
jmp 0x140070767
mov r9d, dword [rdi + 0x260]
xor ebx, ebx
mov r8d, dword [rdi + 0x258]
mov rcx, rdi
mov dword [rsp + 0x40], 1
mov dword [rdi + 0xc98], ebx
lea edx, [rbx + 0x18]
call fcn.140024600
mov eax, dword [rdi + 0x258]
lea r9, [rsp + 0x848]
mov rcx, qword [rdi + 0x38]
lea rdx, [rsp + 0x30]
mov r8d, 0x800
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x848], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call fcn.1400246e0
jmp 0x140070767
Function at 0x140070810
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r15
sub rsp, 0x50
xor r15d, r15d
mov rbp, rcx
mov edi, r15d
cmp dword [rcx + 0x258], r15d
jbe 0x1400708da
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r14
nop dword [rax]
mov eax, edi
lea rsi, [rbp + 0x298]
lea rbx, [rsp + 0x30]
mov r14d, 0xa
lea rcx, [rax + rax*4]
lea rsi, [rsi + rcx*8]
nop dword [rax]
mov rcx, qword [rbp + 0x280]
mov edx, edi
movss xmm2, dword [rsi]
mov rax, qword [rcx]
call qword [rax + htons]
mov ecx, eax
mov byte [rbx], al
sar ecx, 8
lea rsi, [rsi + 4]
sar eax, 0x10
mov byte [rbx + 1], cl
mov byte [rbx + 2], al
lea rbx, [rbx + 3]
sub r14, 1
jne 0x140070860
mov rcx, qword [rbp + 0x38]
lea r9, [rsp + 0x70]
lea r8d, [r14 + 0x20]
mov word [rbx], r15w
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, dword [rbp + 0x258]
jb 0x140070840
mov r14, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x1400709c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
add rcx, 0x28
mov edx, 2
mov ebp, r8d
call fcn.140025da0
mov r9, rax
lea rdx, [0x14012dc98]
mov rcx, 0xffffffffffffffff
nop word [rax + rax]
movzx r8d, word [r9 + rcx*2 + 2]
cmp r8w, word [rdx + rcx*2 + 2]
jne 0x140070a23
add rcx, 2
cmp rcx, 0xb
je 0x140070a40
movzx eax, word [r9 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140070a00
mov r8d, ebp
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
jmp fcn.1400250c0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
xor r14d, r14d
mov edi, r14d
test ebp, ebp
je 0x140070af2
mov ecx, dword [rbx + 0xc98]
nop
mov eax, 0xa
mov r10d, ebp
sub eax, ecx
sub r10d, edi
cmp r10d, eax
cmovae r10d, eax
test r10d, r10d
je 0x140070ad3
nop dword [rax]
dec r10d
mov r9d, r14d
cmp dword [rbx + 0x258], r14d
jbe 0x140070abe
mov r11d, edi
mov eax, r9d
inc r9d
mov r8, qword [rsi + rax*8]
lea rcx, [rax + rax*4]
mov eax, dword [rbx + 0xc98]
lea rdx, [rax + rcx*2]
mov eax, dword [r8 + r11*4]
mov dword [rbx + rdx*4 + 0x298], eax
cmp r9d, dword [rbx + 0x258]
jb 0x140070a92
mov ecx, dword [rbx + 0xc98]
inc edi
inc ecx
mov dword [rbx + 0xc98], ecx
test r10d, r10d
jne 0x140070a80
cmp ecx, 0xa
jne 0x140070aea
mov rcx, rbx
call fcn.140070810
mov ecx, r14d
mov dword [rbx + 0xc98], r14d
cmp edi, ebp
jb 0x140070a60
mov r14, qword [rsp + 0x38]
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x140070ce0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
lea r9, [rsp + 0x60]
mov rbx, rcx
mov dword [rsp + 0x60], eax
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8d, [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, recv
lea rdx, [0x140146760]
lea rcx, [rsp + 0x30]
call fcn.1400f4ab4
test eax, eax
je 0x140070d32
mov eax, 0x8004020c
add rsp, 0x50
pop rbx
ret
mov eax, dword [rsp + 0x42]
lea rcx, [rbx + 0x58]
mov r9d, 0xffffffff
lea r8, [0x14012f288]
bswap eax
mov dword [rsp + 0x42], eax
lea edx, [r9 + 3]
call fcn.140025fb0
mov rcx, rbx
call fcn.140023ca0
mov eax, dword [rsp + 0x42]
mov qword [rbx + 0x18], rax
xor eax, eax
mov qword [rbx + 0x290], 0x20
mov dword [rbx + 0x20], 1
mov dword [rbx + 0x28], 0x1f40
add rsp, 0x50
pop rbx
ret

Function at 0x140070f10
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x68]
mov r9d, 0xffffffff
mov rbx, rcx
add rcx, 0x58
mov r8, qword [r8 + 0x30]
lea edx, [r9 + 3]
call fcn.140026280
mov rax, qword [rbx + 0x68]
lea rcx, [rbx + 0x58]
mov edx, dword [rax + 0x20]
mov eax, dword [0x14018f73c]
and edx, 0xf
cmova eax, edx
mov edx, 2
mov dword [rbx + 0x20], eax
call fcn.140025da0
xor esi, esi
movzx ecx, word [rax]
cmp cx, 0x50
je 0x14007100a
cmp cx, 0x46
je 0x14007100a
lea edx, [rsi + 2]
lea rcx, [rbx + 0x58]
call fcn.140025da0
mov edx, esi
lea r8, [0x140130298]
nop
movzx ecx, word [rax + rdx*2]
inc rdx
cmp cx, word [r8 + rdx*2 - 2]
jne 0x140070fb5
cmp rdx, 7
jne 0x140070f90
mov dword [rbx + 0x20], 1
mov dword [rbx + 0x28], 0x1f40
jmp 0x140071013
mov edx, 2
lea rcx, [rbx + 0x58]
call fcn.140025da0
mov rcx, rsi
lea r8, [0x1401302a8]
nop dword [rax]
movzx edx, word [rax + rcx*2]
inc rcx
cmp dx, word [r8 + rcx*2 - 2]
jne 0x140070ff5
cmp rcx, 6
jne 0x140070fd0
mov dword [rbx + 0x20], 1
mov dword [rbx + 0x28], 0x1f40
jmp 0x140071013
mov eax, 0x80040208
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov eax, dword [0x14018f738]
mov dword [rbx + 0x28], eax
mov rcx, qword [rbx + 0x68]
mov eax, dword [rcx + 0x20]
test al, 0x20
je 0x140071027
mov byte [rbx + 0x2c1], 1
jmp 0x140071039
test al, 0x40
movzx eax, byte [0x1401a912d]
cmovne eax, esi
mov byte [rbx + 0x2c1], al
test byte [rcx + 0x20], 0x10
je 0x140071046
mov byte [rbx + 0x2c2], 1
mov rcx, rbx
call fcn.140023ca0
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140071095
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rbx + 0x2ac]
mov rdx, rsi
test eax, eax
mov qword [rbx + 0x290], rsi
cmovne rdx, qword [rsp + 0x30]
imul ecx, dword [rbx + 0x20]
lea rax, [rdx*8]
cqo
idiv rcx
mov qword [rbx + 0x18], rax
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140071830
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
lea rdi, [rdx + 8]
mov r14, r8
mov rsi, rdx
mov rbx, rcx
cmp rdi, r8
jge 0x140071a4c
xor r15d, r15d
mov r12d, 0x300
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0x48]
mov r8d, 8
mov dword [rbp + 0x48], r15d
lea rdx, [rbp - 0x20]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rbp - 0x1c]
mov rax, qword [rbp - 0x20]
lea esi, [r8 + 1]
add rsi, rdi
and rsi, 0xfffffffffffffffe
cmp eax, 0x20746d66
je 0x140071987
cmp eax, 0x46464952
je 0x140071938
cmp eax, 0x61746164
je 0x140071901
cmp eax, 0x74636166
jne 0x140071a3f
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0x48]
mov r8d, 4
mov dword [rbp + 0x48], r15d
lea rdx, [rbp + 0x50]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 0x50]
test eax, eax
je 0x140071a3f
mov qword [rbx + 0x18], rax
jmp 0x140071a3f
mov qword [rbx + 0x290], rdi
cmp qword [rbx + 0x18], r15
jne 0x14007192c
mov ecx, dword [rbx + 0x20]
xor edx, edx
mov rax, r8
div rcx
mov ecx, dword [rbx + 0x2ac]
shl rax, 3
cqo
idiv rcx
mov qword [rbx + 0x18], rax
mov dword [rbx + 0x2d4], r8d
jmp 0x140071a3f
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0x48]
mov r8d, 4
mov dword [rbp + 0x48], r15d
lea rdx, [rbp + 0x58]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x58], 0x45564157
jne 0x140071a3f
lea rdx, [rdi + 4]
mov r8, rsi
mov rcx, rbx
call fcn.140071830
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140071a4e
jmp 0x140071a3f
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0x48]
mov r8d, recv
mov dword [rbp + 0x48], r15d
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [rbp - 0xe]
movzx ecx, word [rbp - 0x10]
mov dword [rbx + 0x20], eax
mov eax, dword [rbp - 0xc]
mov dword [rbx + 0x28], eax
movzx eax, word [rbp - 4]
mov dword [rbx + 0x2cc], eax
mov word [rbx + 0x2c8], cx
cmp cx, r12w
jne 0x140071a85
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0x48]
mov r8d, 8
mov dword [rbp + 0x48], r15d
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, word [rbp - 0x18]
mov dword [rbx + 0x2ac], eax
sub eax, 2
je 0x140071a20
sub eax, 1
je 0x140071a17
cmp eax, 1
jne 0x140071a5d
lea r8, [0x140146ee0]
jmp 0x140071a27
lea r8, [0x140146ec8]
jmp 0x140071a27
lea r8, [0x140146eb0]
mov edx, 2
lea rcx, [rbx + 0x58]
lea r9d, [rdx - 3]
call fcn.140025fb0
cmp dword [rbx + 0x20], 1
jne 0x140071a71
lea rdi, [rsi + 8]
cmp rdi, r14
jl 0x140071861
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0x80040208
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0x80040209
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0x8004020b
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140071aa0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
lea rdx, [rsp + 0x30]
mov dword [rcx + 0x2ac], ebx
mov rdi, rcx
mov qword [rcx + 0x290], rbx
mov qword [rcx + 0x2d4], rbx
mov qword [rcx + 0x18], rbx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rdi
cmovne rbx, qword [rsp + 0x30]
xor edx, edx
mov r8, rbx
call fcn.140071830
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140071b41
cmp dword [rdi + 0x2ac], 0
jne 0x140071b0d
mov eax, 0x8004020d
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x290]
test rcx, rcx
jne 0x140071b29
mov eax, 0x8004020e
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rdi + 0x2d8]
sub dword [rdi + 0x2d4], eax
sub rcx, rax
mov qword [rdi + 0x290], rcx
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140071c80
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x290]
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [rbx + 0x2d4]
mov dword [rbx + 0x2dc], eax
mov eax, 0x300
cmp word [rbx + 0x2c8], ax
jne 0x140071ccc
mov edx, dword [rbx + 0x2ac]
lea rcx, [rbx + 0x2e0]
call fcn.140048f90
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80
Function at 0x140072470
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x68]
mov rbx, rcx
mov dword [rcx + 0x20], 1
mov edx, dword [rax + 0x20]
mov dword [rcx + 0x2c8], edx
cmp edx, 2
jb 0x1400724ba
cmp edx, 4
ja 0x1400724ba
sub edx, 2
je 0x1400724b1
sub edx, 1
je 0x1400724a8
cmp edx, 1
je 0x1400724c4
jmp 0x1400724de
lea r8, [0x140146ec8]
jmp 0x1400724cb
lea r8, [0x140146eb0]
jmp 0x1400724cb
mov dword [rcx + 0x2c8], 4
lea r8, [0x140146ee0]
mov r9d, 0xffffffff
add rcx, 0x58
lea edx, [r9 + 3]
call fcn.140025fb0
mov eax, dword [rbx + 0x2c8]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x70]
mov dword [rbx + 0x2ac], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ecx, ecx
test eax, eax
cmovne rcx, qword [rsp + 0x30]
lea rax, [rcx*8]
mov ecx, dword [rbx + 0x2c8]
cqo
idiv rcx
mov qword [rbx + 0x18], rax
mov eax, dword [0x14018ffd8]
mov dword [rbx + 0x28], eax
xor eax, eax
mov qword [rbx + 0x290], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140072660
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x2cc
mov edx, dword [rbx + 0x2c8]
call fcn.140048f90
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80

Function at 0x140072be0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x68]
mov rbx, 0xffffffffffffffff
mov rdi, rcx
mov r9d, ebx
add rcx, 0x58
mov r8, qword [r8 + 0x30]
lea edx, [rbx + 3]
call fcn.140026280
lea edx, [rbx + 3]
mov byte [rdi + 0x2c8], 0
lea rcx, [rdi + 0x58]
call fcn.140025da0
mov r8, rax
lea r9, [0x140130380]
mov rdx, rbx
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140072c58
add rdx, 2
cmp rdx, 0xb
je 0x140072d11
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140072c30
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
mov r8, rax
lea r9, [0x1401303b8]
mov rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x140072ca4
add rdx, 2
cmp rdx, 0xb
je 0x140072cf7
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140072c80
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
mov rdx, rax
lea r8, [0x140147400]
nop dword [rax]
movzx ecx, word [rdx + rbx*2 + 2]
cmp cx, word [r8 + rbx*2 + 2]
jne 0x140072ce2
add rbx, 2
cmp rbx, 0x11
je 0x140072d03
movzx eax, word [rdx + rbx*2]
cmp ax, word [r8 + rbx*2]
je 0x140072cc0
mov eax, 0x80040208
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov dword [rdi + 0x2ac], socket
jmp 0x140072d1b
mov byte [rdi + 0x2c8], 1
mov dword [rdi + 0x28], 0xbb80
mov dword [rdi + 0x2ac], recv
mov eax, dword [0x14018f73c]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 0x70]
mov dword [rdi + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rdi + 0x2ac]
xor edx, edx
mov rbx, qword [rsp + 0x38]
test eax, eax
mov rsi, qword [rsp + 0x40]
cmovne rdx, qword [rsp + 0x30]
imul ecx, dword [rdi + 0x20]
mov qword [rdi + 0x290], 0
lea rax, [rdx*8]
cqo
idiv rcx
mov qword [rdi + 0x18], rax
xor eax, eax
add rsp, 0x20
pop rdi
ret