joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140027e40
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001b8c4
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001b8c4
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140027f90
cmp rax, 0xffffffffffffffff
je 0x140027f90
xor edi, edi
test rbp, rbp
jle 0x140027f3b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001dec8
mov rbx, rax
test rax, rax
jne 0x140027ec8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140027f31
mov edx, 0x8000
mov ecx, r14d
call fcn.140015978
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001c5a0
cmp eax, 0xffffffff
je 0x140027f11
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140027ed8
mov edx, r15d
mov ecx, r14d
call fcn.140015978
jmp 0x140027f31
cmp byte [rsi + 0x38], dil
je 0x140027f28
cmp dword [rsi + 0x34], 5
jne 0x140027f28
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140027f31
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140019f88
jmp 0x140027fa4
jns 0x140027fa4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001b8c4
cmp rax, 0xffffffffffffffff
jne 0x140027f5c
cmp byte [rsi + 0x30], dil
je 0x140027fa4
mov edi, dword [rsi + 0x2c]
jmp 0x140027fa4
mov ecx, r14d
call fcn.14001706c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140027fa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140027fa4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140027f9d
mov eax, dword [rsi + 0x2c]
jmp 0x140027fa2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001b8c4
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x402b20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004503b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402b99
mov rcx, r10
call fcn.004029f0
test eax, eax
je 0x402b99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402b96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402b99
add r8, 0x28
cmp r8, r9
jne 0x402b78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140004940
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400049d0
jmp 0x1400049bf
jae 0x140004a90
cmp r8, 0x201
jae 0x1400049d0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140004a28
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400049ff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001a520
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140004a51
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140004af8
mov r8d, r14d
cmp r15, r8
jne 0x1400049b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140004b1b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400049bf
jmp 0x1400049d0
cmp rsi, r8
jb 0x140004b35
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.140006390
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140004ae1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400020e0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140004ac9
jmp 0x140004ae1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_cc66ad468955717ab92600c770da8c1601a4ff33library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14001afb0
jmp 0x140004b4a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14001b3a0
ud2
Function at 0x14000b240
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14001de98]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000b284
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000b2ea
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000b321
test eax, eax
js 0x14000b2fb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000b314
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x20], 0
lea rdx, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
lea rsi, [rsp + 0x78]
lea r9, [rsp + 0x50]
mov r8d, 1
mov rcx, rsi
call fcn.140002490
lea rcx, [rsp + 0x58]
mov rdx, rsi
call fcn.140006190
mov rcx, rax
call fcn.1400028c0
mov ecx, 7
int 0x29
ud2
Function at 0x140018320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001839a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140018390
cmp r11, r10
ja 0x140018433
cmp r10, rdx
ja 0x140018447
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140018392
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140018370
jmp 0x140018407
ja 0x14001839a
mov r11, r10
cmp rax, r8
jne 0x140018342
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001840b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1400183e0
mov r8, r10
sub ecx, r9d
jns 0x1400183fe
jmp 0x14001840d
cmp r10, rdx
je 0x140018419
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001840d
xor al, 1
cmp r8, rdx
jne 0x1400183c0
jmp 0x14001840d
xor eax, eax
jmp 0x14001840d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001afb0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001b410
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001b3a0
ud2

Function at 0x140019ef4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140019f3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019f3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019f3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019f3e
cmp dword [rcx + 0x84], 0xe
jbe 0x140019f3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140019f40
xor al, al
add rsp, 0x28
ret

Function at 0x402b20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x004503b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402b99
mov rcx, r10
call fcn.004029f0
test eax, eax
je 0x402b99
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402b96
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x402b8d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402b99
add r8, 0x28
cmp r8, r9
jne 0x402b78
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140002930
Capabilities:
Accept command line arguments

Disassembly:
sub rsp, 0x68
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140002a90
cmp dword [rsp + 0x20], 2
jl 0x140002a90
lea rcx, [rsp + 0x38]
call fcn.140003220
mov dword [rsp + 0x40], 1
jmp 0x140002992
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x40], eax
jge 0x140002a4a
movsxd rax, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + rax*8]
lea rcx, [rsp + 0x48]
call fcn.140003240
lea rdx, [0x140058aac]
lea rcx, [rsp + 0x48]
call fcn.140003520
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0xffffffff
je 0x140002a0e
lea rdx, [0x140058ab0]
lea rcx, [rsp + 0x48]
call fcn.140003460
movsxd r11, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx + r11*8]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
lea rdx, [0x140058ab4]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
mov eax, dword [rsp + 0x40]
add eax, 1
cmp eax, dword [rsp + 0x20]
jge 0x140002a2c
lea rdx, [0x140058ab8]
lea rcx, [rsp + 0x48]
call fcn.1400034e0
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.1400034a0
lea rcx, [rsp + 0x48]
call fcn.1400038b0
jmp 0x140002987
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [rsp + 0x38]
call fcn.1400329c0
mov r8, rax
mov edx, 0x410
lea rcx, [0x140067130]
call fcn.140003f30
lea rax, [0x140067130]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
call fcn.1400038b0
mov rax, qword [rsp + 0x50]
jmp 0x140002aa5
cmp qword [rsp + 0x28], 0
je 0x140002aa3
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
add rsp, 0x68
ret
Function at 0x140004990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x40], rax
movzx edx, word [rsp + 0x68]
lea r8, [0x140058dc0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x1400049df
xor eax, eax
jmp 0x140004a9d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jne 0x140004a01
xor eax, eax
jmp 0x140004a9d
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x140004a22
xor eax, eax
jmp 0x140004a9d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [rsp + 0x28], eax
cmp qword [rsp + 0x20], 0
je 0x140004a55
cmp dword [rsp + 0x28], 0
jne 0x140004a59
xor eax, eax
jmp 0x140004a9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.1400040f0
test eax, eax
jne 0x140004a75
xor eax, eax
jmp 0x140004a9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx]
call fcn.140043410
mov r11, qword [rsp + 0x78]
mov eax, dword [rsp + 0x28]
mov dword [r11], eax
mov eax, 1
add rsp, 0x58
ret
Function at 0x1400053d0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140065840]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov dword [rsp + 0x68], 0
mov rcx, qword [rsp + 0x2d0]
call fcn.14000d250
test rax, rax
jne 0x14000541a
xor eax, eax
jmp 0x14000563c
lea rdi, [rsp + 0x80]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov r8, qword [rsp + 0x2d8]
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003f30
lea r8, str.Baymax64.Ini
mov edx, 0x104
lea rcx, [rsp + 0x80]
call fcn.140003fa0
cmp dword [rsp + 0x2e0], 0
jne 0x140005484
lea rcx, [rsp + 0x80]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140005484
mov eax, 1
jmp 0x14000563c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov r8d, 7
mov edx, 0xc0000000
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x1400054cd
xor eax, eax
jmp 0x14000563c
mov byte [rsp + 0x60], 0xff
mov byte [rsp + 0x61], 0xfe
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, 2
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, str._BAYMAX64__r_n
lea rcx, [rsp + 0x50]
call fcn.140003240
lea rcx, [rsp + 0x50]
call fcn.140006550
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x50]
call fcn.1400329c0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x2d0]
call fcn.140028990
lea rdx, [rsp + 0x298]
mov rcx, qword [rsp + 0x2d0]
call fcn.14000c0c0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000fa30
movzx eax, al
test eax, eax
je 0x140005615
lea rcx, [rsp + 0x290]
call fcn.140003220
lea rcx, [rsp + 0x40]
call fcn.1400212a0
mov r8, qword [rax]
lea rdx, str._s_r_n
lea rcx, [rsp + 0x290]
call fcn.1400057e0
lea rcx, [rsp + 0x290]
call fcn.140006550
movsxd rdi, eax
shl rdi, 1
lea rcx, [rsp + 0x290]
call fcn.1400329c0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, edi
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x40]
call fcn.140006790
lea rcx, [rsp + 0x290]
call fcn.1400038b0
jmp 0x14000555f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x2a8], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x2c0
pop rdi
ret
Function at 0x14000ab40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rcx, qword [rsp + 0x90]
call fcn.14000ad20
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x14000abac
xor eax, eax
jmp 0x14000ad12
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LockFile]
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x54], eax
cmp qword [rsp + 0xa0], 0
je 0x14000ac07
mov rcx, qword [rsp + 0xa0]
mov eax, dword [rsp + 0x54]
mov dword [rcx], eax
cmp dword [rsp + 0x40], 0
jne 0x14000ace5
cmp dword [rsp + 0x54], 0xa00000
jge 0x14000ace5
cmp dword [rsp + 0x54], 6
jle 0x14000ace5
mov eax, dword [rsp + 0x54]
add eax, 4
mov dword [rsp + 0x60], eax
movsxd rcx, dword [rsp + 0x60]
call fcn.1400438a8
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x14000ace5
movsxd r8, dword [rsp + 0x60]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call fcn.140044a30
mov dword [rsp + 0x64], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000acc8
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x64], eax
jne 0x14000acc8
mov r8d, dword [rsp + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.14000ae10
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x50], 1
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x70]
call fcn.140043800
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x20], 0xffffffff
mov r9d, 0xffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x50]
add rsp, 0x88
ret
Function at 0x140010520
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x690
mov rax, qword [0x140065840]
xor rax, rsp
mov qword [rsp + 0x680], rax
lea rdi, [rsp + 0x60]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x480]
call fcn.140001000
mov rcx, qword [rsp + 0x6a8]
call fcn.1400329c0
mov rdx, rax
lea rcx, [rsp + 0x4e0]
call fcn.140010b80
mov rcx, rax
call fcn.1400329c0
lea rdx, [0x140059614]
mov rcx, rax
call fcn.1400450b4
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x4e0]
call fcn.140010bd0
cmp qword [rsp + 0x58], 0
jne 0x1400105d6
mov dword [rsp + 0x568], 0
mov rcx, qword [rsp + 0x6a8]
call fcn.1400038b0
mov eax, dword [rsp + 0x568]
jmp 0x1400106c4
mov r9, qword [rsp + 0x58]
mov r8d, 0x400
mov edx, 1
lea rcx, [rsp + 0x80]
call fcn.140044f5c
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
je 0x14001061a
mov r8d, dword [rsp + 0x70]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x480]
call fcn.140001060
jmp 0x1400105d6
mov rcx, qword [rsp + 0x58]
call fcn.140044bc8
mov qword [rsp + 0x58], 0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x480]
call fcn.1400027f0
lea rdi, [rsp + 0x28]
xor eax, eax
mov ecx, 0x21
rep stosb byte [rdi], al
mov dword [rsp + 0x50], 0x20
mov r9d, dword [rsp + 0x50]
lea r8, [rsp + 0x28]
mov edx, 0x10
lea rcx, [rsp + 0x60]
call fcn.140010380
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x570]
call fcn.140010c00
mov rcx, rax
call fcn.1400329c0
mov rdx, rax
mov rcx, qword [rsp + 0x6b0]
call fcn.140003460
lea rcx, [rsp + 0x570]
call fcn.140010bd0
mov dword [rsp + 0x678], 1
mov rcx, qword [rsp + 0x6a8]
call fcn.1400038b0
mov eax, dword [rsp + 0x678]
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1400437e0
add rsp, 0x690
pop rdi
ret
Function at 0x1400106f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0xa0
mov dword [rsp + 0x5c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0xffffffffffffffff
jne 0x140010755
mov eax, dword [rsp + 0x5c]
jmp 0x140010893
mov dword [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0x19000
jae 0x140010782
cmp dword [rsp + 0x58], 0
je 0x14001078b
mov eax, dword [rsp + 0x5c]
jmp 0x140010893
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.140003220
lea rax, [rsp + 0x70]
mov qword [rsp + 0x78], rax
mov rdx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
call fcn.140003240
lea r8, [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0xb0]
call fcn.140010520
test eax, eax
jne 0x1400107f6
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x80]
jmp 0x140010893
lea rcx, [rsp + 0x50]
call fcn.1400329c0
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0xb0]
call fcn.14001ad30
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0xb0]
call fcn.140028360
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140028b60
movzx eax, al
test eax, eax
je 0x140010877
lea rcx, [rsp + 0x50]
call fcn.1400329c0
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.140021280
mov rdx, rbx
mov rcx, rax
call fcn.1400109f0
test eax, eax
jne 0x14001086b
mov dword [rsp + 0x5c], 1
jmp 0x140010877
lea rcx, [rsp + 0x40]
call fcn.140028b40
jmp 0x140010812
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x98], eax
lea rcx, [rsp + 0x50]
call fcn.1400038b0
mov eax, dword [rsp + 0x98]
add rsp, 0xa0
pop rbx
ret