joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140062e30
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov byte [rcx + 0x2cd], 1
mov word [rcx + 0x2d0], 0
xor ebx, ebx
mov rcx, qword [rcx + 0x70]
mov edx, ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rdi
cmovne rbx, qword [rsp + 0x30]
xor r8d, r8d
mov r9, rbx
xor edx, edx
call fcn.140063080
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140062eac
mov rcx, rdi
call fcn.140061e90
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140062eac
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140062ec0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
lea ebx, [r9 - 1]
mov rdi, rdx
movsxd rax, ebx
cmp r8, rax
cmovb ebx, r8d
test ebx, ebx
je 0x140062efc
mov rcx, qword [rcx + 0x70]
lea r9, [rsp + 0x58]
xor eax, eax
mov r8d, ebx
mov dword [rsp + 0x58], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [rbx + rdi], 0
mov rax, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140062f10
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov ebx, 8
cmp rdx, rbx
cmovb ebx, edx
test ebx, ebx
je 0x140062f73
mov rcx, qword [rcx + 0x70]
lea r9, [rsp + 0x48]
mov r8d, ebx
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [rsp + 0x50]
lea rdx, [rsp + 0x51]
add ebx, 0xffffffff
je 0x140062f73
nop word [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
shl rax, 8
add rax, rcx
add ebx, 0xffffffff
jne 0x140062f60
add rsp, 0x30
pop rbx
ret

Function at 0x140062f80
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
test rdx, rdx
jg 0x140062f96
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov eax, dword [rcx + 0x28]
xorps xmm1, xmm1
cvtsi2sd xmm1, rdx
mov byte [rcx + 0x2cd], 1
xor r9d, r9d
mov byte [rcx + 0x2d0], 1
xor r8d, r8d
mov qword [rsp + 0x30], rbx
xor ebx, ebx
mov qword [rcx + 0x2f0], rbx
mov edx, ebx
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
movsd qword [rcx + 0x2e8], xmm1
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rdi
cmovne rbx, qword [rsp + 0x38]
xor r8d, r8d
mov r9, rbx
xor edx, edx
call fcn.140063080
mov eax, dword [rdi + 0x28]
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x30]
cvtsi2sd xmm0, rax
mulsd xmm0, qword [rdi + 0x2f0]
addsd xmm0, qword [0x14012c8e0]
cvttsd2si rax, xmm0
add rsp, 0x20
pop rdi
ret
Function at 0x140064700
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
lea rax, vtable.TBoxFileBuf.0
mov rbx, rcx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140064741
cmp byte [rbx + 0x238], 0
je 0x14006472c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x248]
mov qword [rbx + 0x28], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x28]
cmp rcx, 0xffffffffffffffff
je 0x140064762
cmp byte [rbx + 0x238], 0
je 0x14006475a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], 0xffffffffffffffff
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140064770

Function at 0x140064a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov edi, r8d
mov rcx, qword [rcx + 0x28]
cmp rcx, 0xffffffffffffffff
jne 0x140064aba
mov eax, 0x80040204
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, edi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140064af1
cmp dword [rsp + 0x40], edi
jne 0x140064af1
add qword [rbx + 0x240], rdi
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
mov eax, 0x80040206
add rsp, 0x30
pop rdi
ret
Function at 0x140066070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
mov ecx, dword [rcx + 0x2e4]
test ecx, ecx
je 0x1400660d1
mov eax, dword [rbx + 0x2c]
imul eax, dword [rbx + 0x20]
imul ecx, eax
mov dword [rbx + 0x2a8], ecx
mov rdi, qword [rbx + 0x2a0]
call fcn.1400b609c
mov qword [rbx + 0x2a0], rax
test rdi, rdi
je 0x1400660b7
mov rcx, rdi
call fcn.1400b60a4
cmp qword [rbx + 0x2a0], 0
jne 0x1400660d1
mov eax, 0x80040202
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rbx + 0x2e0]
mov byte [rbx + 0x340], 1
cmp eax, 0x20636161
je 0x1400660ec
cmp eax, 0x6134706d
jne 0x140066137
mov rdx, qword [rbx + 0x2f0]
test rdx, rdx
je 0x14006614d
mov edi, dword [rbx + 0x2f8]
lea eax, [rdi - 2]
cmp eax, 0xe
ja 0x14006614d
mov r8d, edi
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x21]
call fcn.1400b9e30
mov rcx, qword [rbx + 0x10]
lea r8d, [rdi + 1]
xor r9d, r9d
lea rdx, [rsp + 0x20]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140066152
lea rdx, [rbx + 0x70]
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.140064bd0
mov eax, 0x8004020d
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140066340
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, qword [rsp + 0x98]
mov r15, rdx
mov rdx, qword [r8]
mov rbx, r9
mov rsi, r8
lea rax, [rdx + 8]
cmp rax, r9
jle 0x140066387
mov rax, qword [rsp + 0x90]
xor edi, edi
mov qword [r8], rbx
mov dword [rax], edi
mov qword [r14], rdi
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [r15]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x70], rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r15]
lea r9, [rsp + 0x80]
xor edi, edi
lea rdx, [rsp + 0x88]
mov dword [rsp + 0x80], edi
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x88]
add qword [rsi], 8
mov rbp, qword [rsp + 0x90]
mov eax, dword [rsp + 0x8c]
bswap ecx
mov dword [rsp + 0x88], ecx
mov dword [rbp], eax
cmp ecx, 1
jne 0x14006643f
mov rax, qword [rsi]
add rax, 8
cmp rax, rbx
jg 0x140066448
mov rcx, qword [r15]
lea r9, [rsp + 0x80]
lea r8d, [rdi + 8]
mov dword [rsp + 0x80], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rsp + 0x30]
mov ebx, edi
add qword [rsi], 8
bswap rcx
cmp rcx, 0x10
lea rax, [rcx - 0x10]
cmovge rbx, rax
jmp 0x140066459
test ecx, ecx
jne 0x140066448
sub rbx, qword [rsi]
jmp 0x140066459
mov ebx, ecx
cmp rbx, 8
jae 0x140066455
mov rbx, rdi
jmp 0x140066459
add rbx, 0xfffffffffffffff8
mov qword [r14], rbx
cmp dword [rbp], 0x64697575
jne 0x1400664b3
mov rcx, qword [r15]
lea r9, [rsp + 0x80]
mov r8d, 4
mov dword [rsp + 0x80], edi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
add qword [rsi], 0x10
mov rax, qword [r14]
cmp rax, 0x10
jge 0x1400664ac
mov rbp, qword [rsp + 0x70]
mov qword [r14], rdi
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
add rax, 0xfffffffffffffff0
mov qword [r14], rax
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
Function at 0x140066570
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], r9
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xa0]
mov r13d, r8d
mov r14, rdx
mov rbp, rcx
cmp r9, r12
jge 0x140066753
xor edi, edi
nop dword [rax]
lea rax, [rsp + 0x30]
mov r9, r12
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x98]
lea rax, [rsp + 0xa0]
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140066340
mov rdx, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x30]
mov eax, dword [rsp + 0xa0]
lea r15, [rbx + rdx]
cmp eax, 0x32334449
je 0x14006671f
cmp eax, 0x6174656d
je 0x140066704
cmp eax, 0x666f6f6d
je 0x140066628
cmp eax, 0x70797466
je 0x1400666af
cmp eax, 0x766f6f6d
jne 0x140066742
test r13d, r13d
jne 0x140066742
test rbx, rbx
je 0x140066742
cmp rbx, 0x20000000
jg 0x14006677e
mov ecx, ebx
mov qword [rbp + 0x338], rdx
mov esi, ebx
call fcn.1400b609c
mov rdi, rax
test rax, rax
je 0x140066777
mov rcx, qword [r14]
lea r9, [rsp + 0x98]
xor eax, eax
mov r8d, ebx
mov rdx, rdi
mov dword [rsp + 0x98], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400666ea
cmp dword [rsp + 0x98], ebx
jne 0x1400666ea
mov edx, dword [rsp + 0xa0]
lea r9, [rsi + rdi]
mov r8, rdi
mov rcx, rbp
call fcn.1400669f0
mov ebx, eax
jmp 0x1400666ef
mov rcx, qword [r14]
lea r9, [rsp + 0x98]
mov r8d, recv
mov dword [rsp + 0x98], edi
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x38], 0x20207471
sete al
mov byte [rbp + 0x2c8], al
jmp 0x140066742
mov ebx, 0x80040205
mov rcx, rdi
call fcn.1400b60a4
mov eax, ebx
shr eax, 0x1f
test al, al
jne 0x140066773
xor edi, edi
jmp 0x140066742
mov r9, rdx
mov qword [rsp + 0x20], r15
mov rdx, r14
mov r8d, 0x6174656d
mov rcx, rbp
call fcn.140066570
jmp 0x140066742
cmp r13d, 0x6174656d
jne 0x140066742
cmp rbx, 0x16
jb 0x140066742
cmp rbx, 0x100000
jg 0x140066742
mov r8, rbp
mov rcx, r14
call fcn.14005e120
mov qword [rsp + 0x98], r15
cmp r15, r12
jl 0x1400665b0
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, ebx
jmp 0x140066755
mov eax, 0x80040202
jmp 0x140066755
mov eax, 0x8004020d
jmp 0x140066755
Function at 0x140068a90
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp dword [rcx + 0x28c], 0
mov rdi, rcx
jne 0x140068bc8
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r8d, r8d
lea rdx, [rdi + 0x70]
test eax, eax
mov rcx, rdi
cmovne r8, qword [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], r8
xor r8d, r8d
call fcn.140066570
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140068bca
cmp dword [rdi + 0x2d0], 0
jne 0x140068b01
mov eax, 0x8004020e
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov r8, qword [rdi + 0x308]
lea rcx, [rdi + 0x58]
mov r9d, 0xffffffff
lea edx, [r9 + 3]
call fcn.140026280
mov eax, dword [rdi + 0x2fc]
mov dword [rdi + 0x20], eax
mov eax, dword [rdi + 0x300]
test eax, eax
je 0x140068b31
mov dword [rdi + 0x24], eax
mov r8, qword [rdi + 0x2d8]
mov eax, dword [rdi + 0x304]
mov dword [rdi + 0x28], eax
mov qword [rdi + 0x18], 0
test r8, r8
je 0x140068b8c
nop
mov eax, dword [r8 + 8]
test eax, eax
je 0x140068b5e
add qword [rdi + 0x18], rax
jmp 0x140068b83
mov rax, qword [r8]
test rax, rax
je 0x140068b83
mov rdx, qword [rdi + 0x18]
nop word [rax + rax]
mov ecx, dword [rax + 0xc]
add rdx, rcx
mov qword [rdi + 0x18], rdx
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x140068b70
mov r8, qword [r8 + 0x10]
test r8, r8
jne 0x140068b50
cmp dword [rdi + 0x28c], 1
jle 0x140068bc8
mov r8d, dword [rdi + 0x288]
lea rdx, str.Audio_track__d
inc r8d
lea rcx, [rsp + 0x30]
call fcn.1400100f0
mov r9d, 0xffffffff
lea r8, [rsp + 0x30]
lea rcx, [rdi + 0x58]
lea edx, [r9 + 5]
call fcn.140025fb0
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140068dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
call fcn.140068cf0
mov ecx, 0xffffffff
lea r9, [rsp + 0x60]
cmp rax, rcx
lea rdx, [rsp + 0x68]
mov ecx, dword [rbx + 8]
mov r8d, eax
mov rsi, rax
mov dword [rsp + 0x6c], ecx
mov rcx, qword [rdi]
mov eax, 1
cmovg r8d, eax
setg bpl
bswap r8d
mov dword [rsp + 0x68], r8d
xor r14d, r14d
lea r8d, [rax + 7]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140068eba
cmp dword [rsp + 0x60], 8
jne 0x140068eba
test bpl, bpl
je 0x140068e70
mov rcx, qword [rdi]
lea r9, [rsp + 0x60]
bswap rsi
lea r8d, [r14 + 8]
mov qword [rsp + 0x70], rsi
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x60], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140068eba
cmp dword [rsp + 0x60], 8
jne 0x140068eba
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
call qword [rax + reloc.WSOCK32.dll_recv]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140068ebf
mov rbx, qword [rbx + 0x10]
test rbx, rbx
je 0x140068ead
nop
mov rdx, rdi
mov rcx, rbx
call fcn.140068dc0
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140068ebf
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x140068e90
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 0x80040206
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14006b750
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r12
push r14
push r15
sub rsp, 0x40
mov r14, qword [rcx + 0x240]
mov r12, rdx
mov r15, rcx
test r14, r14
jne 0x14006b779
xor eax, eax
add rsp, 0x40
pop r15
pop r14
pop r12
ret
mov eax, 0x100000
mov qword [rsp + 0x70], rbp
cmp r14, rax
mov qword [rsp + 0x30], r13
cmovg r14d, eax
mov ecx, r14d
mov r13d, r14d
call fcn.1400b609c
mov rbp, rax
test rax, rax
jne 0x14006b7ac
mov eax, 0x80040202
jmp 0x14006b867
mov rcx, qword [r15 + 0x28]
xor r9d, r9d
mov qword [rsp + 0x68], rbx
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x78], rsi
mov rsi, qword [r15 + 0x240]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test rsi, rsi
je 0x14006b853
mov qword [rsp + 0x38], rdi
nop
mov rcx, qword [r15 + 0x28]
lea r9, [rsp + 0x60]
cmp r13, rsi
mov dword [rsp + 0x60], ebx
mov edi, r14d
mov qword [rsp + 0x20], rbx
cmovge edi, esi
mov rdx, rbp
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006b849
cmp dword [rsp + 0x60], edi
jne 0x14006b849
mov rcx, qword [r12]
lea r9, [rsp + 0x60]
mov r8d, edi
mov dword [rsp + 0x60], ebx
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006b842
cmp dword [rsp + 0x60], edi
jne 0x14006b842
mov eax, edi
sub rsi, rax
jne 0x14006b7e0
jmp 0x14006b84e
mov ebx, 0x80040206
jmp 0x14006b84e
mov ebx, 0x80040205
mov rdi, qword [rsp + 0x38]
mov rcx, rbp
call fcn.1400b60a4
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
ret

Function at 0x14006b890
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rsi, rdx
mov rdi, rcx
call qword [rax + htons]
mov rbx, rax
test eax, eax
je 0x14006b8f1
mov rdx, qword [rdi + 0x28]
lea r9, [rsp + 0x40]
mov rcx, qword [rsi]
xor eax, eax
mov r8d, ebx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006b8dc
cmp dword [rsp + 0x40], ebx
je 0x14006b8f1
mov eax, 0x80040206
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14006b910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x298]
mov edi, r8d
mov r10d, r9d
mov rsi, rdx
add qword [rcx + 0x268], r10
mov rbx, rcx
cmp eax, 0x6134706d
je 0x14006b969
cmp eax, 0x33706d2e
je 0x14006b969
mov r9d, dword [rcx + 0x258]
xor edx, edx
imul r9d, r10d
mov eax, r8d
mov rcx, rsi
div r9d
mov edx, r9d
mov r8d, eax
call fcn.140028930
jmp 0x14006b9d4
add rcx, 0x300
cmp byte [rcx], 0
jne 0x14006b9c6
test r9d, r9d
jne 0x14006b9b1
cmp edi, 3
jb 0x14006b9b1
lea eax, [r8 - 1]
mov edx, reloc.WSOCK32.dll_recv
cmp eax, edx
cmovb edx, eax
mov dword [rbx + 0x310], edx
mov r8d, edx
lea rdx, [rsi + 1]
call fcn.1400b9e30
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0x80040207
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x2b0]
mov edx, edi
call fcn.140064b10
mov rcx, qword [rbx + 0x2a8]
mov r8d, edi
mov rdx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140064a90

Function at 0x14006c690
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea r8, [rsp + 0x50]
add rcx, 0x298
lea rdx, [rsp + 0x60]
call fcn.1400447e0
mov edx, eax
mov r8d, eax
shr edx, 0x1f
test dl, dl
jne 0x14006c70d
xor esi, esi
nop
cmp r8d, 1
je 0x14006c718
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x14006c6ed
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x58], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + 0x298]
call fcn.1400447e0
mov r8d, eax
shr eax, 0x1f
test al, al
je 0x14006c6c0
mov eax, r8d
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 0x26d0]
test rcx, rcx
je 0x14006c735
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0x26d0], rsi
xor eax, eax
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006ca60
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
lea r8, [rsp + 0x60]
add rcx, 0x298
lea rdx, [rsp + 0x70]
call fcn.1400448d0
mov edx, eax
mov r8d, eax
shr edx, 0x1f
test dl, dl
jne 0x14006cadd
xor ebx, ebx
nop
cmp r8d, 1
je 0x14006cae8
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x14006cabd
mov rdx, qword [rsp + 0x70]
lea r9, [rsp + 0x68]
mov rcx, qword [rdi + 0x38]
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rdi + 0x298]
call fcn.1400448d0
mov r8d, eax
shr eax, 0x1f
test al, al
je 0x14006ca90
mov eax, r8d
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rdi + 0x2c8]
mov qword [rsp + 0x78], rbp
test rcx, rcx
je 0x14006cb0a
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rdi + 0x2c8], rbx
lea rcx, [rdi + 0x28]
xor edx, edx
call fcn.140025da0
mov rbp, rax
test rax, rax
je 0x14006cbef
mov rcx, qword [rdi + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14006cb41
cmp byte [rdi + 0x248], bl
je 0x14006cb39
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x38], 0xffffffffffffffff
mov rdx, rbp
lea rcx, [rdi + 0x298]
call fcn.140044a50
mov rcx, qword [rdi + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x14006cb70
cmp byte [rdi + 0x248], bl
je 0x14006cb68
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x38], 0xffffffffffffffff
lea rdx, [rdi + 0x38]
mov byte [rdi + 0x248], 1
sub rdx, rbp
mov rcx, rbp
movzx eax, word [rcx]
mov word [rdx + rcx + 8], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x14006cb81
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], pe_nt_image_headers64
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x38], rax
cmp rax, 0xffffffffffffffff
je 0x14006cbef
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [rdi + 0x38]
test eax, eax
cmovne rbx, qword [rsp + 0x60]
xor r9d, r9d
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rbp, qword [rsp + 0x78]
xor eax, eax
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x14006cd30
Capabilities:
Get file size

Disassembly:
push rbp
push rdi
sub rsp, 0x38
mov eax, dword [rsp + 0x70]
mov rdi, rcx
mov qword [rsp + 0x58], rbx
mov rbx, r9
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x20], eax
call fcn.140022440
xor ebp, ebp
lea rax, vtable.mpeg_Reader.0
mov qword [rdi], rax
lea r14, [rdi + 0x2e4]
mov qword [rdi + 0x2d0], rbp
mov qword [rdi + 0x2d8], rbp
mov dword [r14], ebp
cmp dword [rbx + 0x20], 1
sete al
mov byte [rdi + 0x2e0], al
jne 0x14006cdc4
lea ecx, [rbp + 0x60]
call fcn.1400b6058
mov rsi, rax
test rax, rax
je 0x14006ce0b
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8d, ebp
lea rdx, [rdi + 0x70]
test eax, eax
mov rcx, rsi
cmovne r8, qword [rsp + 0x50]
call fcn.140044bb0
jmp 0x14006ce0e
mov ecx, 0x58
call fcn.1400b6058
mov rsi, rax
test rax, rax
je 0x14006ce0b
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r9, rbp
mov qword [rsp + 0x28], rdi
test eax, eax
mov qword [rsp + 0x20], r14
lea rdx, [rdi + 0x70]
mov rcx, rsi
cmovne r9, qword [rsp + 0x50]
xor r8d, r8d
call fcn.140044a90
jmp 0x14006ce0e
mov rax, rbp
mov ecx, 0x9600
mov qword [rdi + 0x2d0], rax
call fcn.1400b6058
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
test rax, rax
je 0x14006ce53
mov rdx, qword [rdi + 0x2d0]
mov rcx, rax
call fcn.14003f2a0
mov qword [rdi + 0x2d8], rax
mov rax, rdi
add rsp, 0x38
pop rdi
pop rbp
ret
mov qword [rdi + 0x2d8], rbp
mov rax, rdi
add rsp, 0x38
pop rdi
pop rbp
ret
Function at 0x14006ddc0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
xor esi, esi
mov dword [rcx + 0x2c8], 0xbb80
mov dword [rcx + 0x2d4], esi
mov rbx, rcx
mov qword [rcx + 0x2e0], rsi
mov qword [rcx + 0x2cc], 1
mov byte [rcx + 0x2d8], 1
call fcn.14006d890
mov ecx, eax
shr eax, 0x1f
test al, al
je 0x14006de13
mov eax, ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x40], rdi
mov dword [rbx + 0x28c], esi
nop
mov ecx, dword [rbx + 0x28c]
lea eax, [rcx + 1]
mov dword [rbx + 0x28c], eax
cmp dword [rbx + 0x288], ecx
jne 0x14006ded1
mov eax, dword [rbx + 0x2c8]
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0x2cc]
mov dword [rbx + 0x20], eax
mov eax, dword [rbx + 0x2d0]
test eax, eax
jne 0x14006de90
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rdx, rsi
mov eax, dword [rbx + 0x2d4]
cmovne rdx, qword [rsp + 0x30]
imul eax, dword [rbx + 0x2cc]
sub rdx, qword [rbx + 0x2e8]
movsxd rcx, eax
mov rax, rdx
cqo
idiv rcx
mov r9d, 0xffffffff
mov qword [rbx + 0x18], rax
mov r8, qword [rbx + 0x2e0]
lea rcx, [rbx + 0x58]
lea edx, [r9 + 3]
call fcn.140025fb0
mov rax, qword [rbx + 0x2e8]
mov rcx, rbx
mov qword [rbx + 0x290], rax
movzx eax, byte [rbx + 0x2d8]
mov byte [rbx + 0x2c1], al
call fcn.140023ca0
mov edi, dword [rbx + 0x2d4]
lea rdx, [rsp + 0x38]
imul edi, dword [rbx + 0x2cc]
mov rcx, qword [rbx + 0x70]
imul edi, dword [rbx + 0x2d0]
add rdi, qword [rbx + 0x2e8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rsi
cmovne rcx, qword [rsp + 0x38]
cmp rdi, rcx
jge 0x14006df31
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rbx
call fcn.14006d890
shr eax, 0x1f
test al, al
je 0x14006de20
mov ecx, dword [rbx + 0x28c]
mov eax, 0x8004020e
cmp dword [rbx + 0x288], ecx
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
cmovge esi, eax
mov eax, esi
add rsp, 0x20
pop rsi
ret