joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005c630
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov eax, 0xcccccccd
mov rsi, rcx
mul dword [rcx + 0x2c]
movabs rax, 0x6666666666666667
shr edx, 2
mov r8d, edx
imul qword [rcx + 0x2b8]
mov rdi, rdx
mov edx, dword [rcx + 0x195c]
sar rdi, 1
mov rax, rdi
shr rax, 0x3f
add rdi, rax
mov rax, qword [rcx + 0x2b0]
mov rcx, qword [rcx + 0x2a0]
cmp rdi, r8
cmovge edi, r8d
xor ebx, ebx
mov r14, qword [rax]
cmp edx, 0x10
jne 0x14005c71a
mov rdx, rcx
mov dword [rsp + 0x50], ebx
mov rcx, qword [rsi + 0x70]
lea ebp, [rdi + rdi]
mov r8d, ebp
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005c73f
cmp dword [rsp + 0x50], ebp
jne 0x14005c73f
cmp byte [rsi + 0x1958], bl
je 0x14005c6e4
mov rcx, qword [rsi + 0x2a0]
lea r8d, [rbx + 2]
mov edx, edi
call fcn.140028930
mov rbp, qword [rsi + 0x2a0]
test edi, edi
je 0x14005c7fa
movzx edx, word [rbp]
lea rcx, [rsi + 0x2c8]
mov eax, ebx
lea r8, [r14 + rax*4]
call fcn.140030050
add ebx, 5
lea rbp, [rbp + 2]
add edi, 0xffffffff
jne 0x14005c6f3
jmp 0x14005c7fa
imul edi, edx
lea rbp, [rsi + 0x1960]
mov r8, rcx
lea rdx, [rsi + 0x70]
mov rcx, rbp
lea r9d, [rdi + 7]
shr r9d, 3
call fcn.1400235f0
test al, al
jne 0x14005c749
mov eax, 0x80040205
jmp 0x14005c804
mov rcx, rbp
mov edx, dword [rsi + 0x195c]
cmp byte [rsi + 0x1958], bl
jne 0x14005c7ac
call fcn.140022fb0
test al, al
je 0x14005c7fa
nop word [rax + rax]
mov edx, dword [rsi + 0x195c]
mov rcx, rbp
mov eax, ebx
lea rdi, [r14 + rax*4]
call fcn.140024520
mov edx, eax
lea rcx, [rsi + 0x2c8]
mov r8, rdi
call fcn.140030050
mov edx, dword [rsi + 0x195c]
mov rcx, rbp
add ebx, 5
call fcn.140022fb0
test al, al
jne 0x14005c770
jmp 0x14005c7fa
call fcn.140022f70
test al, al
je 0x14005c7fa
nop word [rax + rax]
mov edx, dword [rsi + 0x195c]
mov rcx, rbp
mov eax, ebx
lea rdi, [r14 + rax*4]
call fcn.140024500
mov edx, eax
lea rcx, [rsi + 0x2c8]
mov r8, rdi
call fcn.140030050
mov edx, dword [rsi + 0x195c]
mov rcx, rbp
add ebx, 5
call fcn.140022f70
test al, al
jne 0x14005c7c0
mov edx, ebx
mov rcx, rsi
call fcn.140025060
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14005cf00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdx, qword [rcx + 0x68]
mov rbx, rcx
movaps xmmword [rsp + 0x20], xmm6
mov ecx, dword [rdx + 0x20]
cmp ecx, 1
setge al
mov byte [rbx + 0x2c8], al
mov edx, dword [rdx + 0x20]
cmp edx, 2
mov dword [rbx + 0x20], 1
sete al
mov byte [rbx + 0x2c9], al
jne 0x14005cf47
movsd xmm6, qword [0x140142b38]
jmp 0x14005cf5e
cmp ecx, 1
jl 0x14005cf56
movsd xmm6, qword [0x140142b30]
jmp 0x14005cf5e
movsd xmm6, qword [0x140142b28]
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
mov dword [rbx + 0x28], 0x1f40
test eax, eax
mov qword [rbx + 0x290], rdi
xorps xmm0, xmm0
lea r8, [0x14013f6e0]
mov ecx, edi
cmovne rcx, qword [rsp + 0x40]
lea r9d, [rdi - 1]
lea edx, [rdi + 2]
cvtsi2sd xmm0, rcx
lea rcx, [rbx + 0x58]
divsd xmm0, xmm6
cvttsd2si rax, xmm0
lea eax, [rax + rax*4]
shl eax, 5
mov qword [rbx + 0x18], rax
call fcn.140025fb0
movzx eax, byte [rbx + 0x2c9]
test al, al
je 0x14005cfcb
mov edi, 0x26
jmp 0x14005cfd9
cmp byte [rbx + 0x2c8], dil
setne dil
add edi, 0x41
movaps xmm6, xmmword [rsp + 0x20]
test al, al
mov eax, dword [rbx + 0x2c]
mov ecx, 0xa0
mov r8d, 0x140
cmovne r8d, ecx
xor edx, edx
div r8d
mov ecx, eax
imul eax, r8d
imul ecx, edi
mov dword [rbx + 0x2d0], eax
xor eax, eax
mov dword [rbx + 0x2cc], ecx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x14005d020
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rdx, qword [rcx + 0x2d8]
mov rsi, rcx
test rdx, rdx
jne 0x14005d045
mov rcx, qword [rcx + 0x10]
mov rax, qword [rcx]
add rsp, 0x50
pop rsi
jmp qword [rax + 0x18]
mov ecx, dword [rcx + 0x2cc]
lea r9, [rsp + 0x60]
cmp rdx, rcx
mov qword [rsp + 0x48], r12
mov eax, edx
mov qword [rsp + 0x30], r15
cmovge eax, ecx
mov rcx, qword [rsi + 0x70]
mov r15d, eax
xor r12d, r12d
sub rdx, r15
mov dword [rsp + 0x60], r12d
mov qword [rsi + 0x2d8], rdx
mov r8d, eax
mov rdx, qword [rsi + 0x2a0]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005d1db
cmp dword [rsp + 0x60], r15d
jne 0x14005d1db
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r14
cmp byte [rsi + 0x2c9], r12b
je 0x14005d176
mov rbx, qword [rsi + 0x2a0]
mov ebp, r15d
mov r14, rbx
mov r15d, r12d
cmp ebp, 0x26
jb 0x14005d176
mov r13d, 0xb6b6
movzx eax, word [rbx]
mov ecx, 0xfefe
cmp ax, r13w
je 0x14005d0ff
cmp ax, cx
jne 0x14005d1d4
mov edi, 2
cmp byte [rdi + rbx], 0x10
jne 0x14005d14f
cmp byte [rbx + 0x24], 0xa5
je 0x14005d14f
mov ecx, ebp
add rcx, rbx
cmp qword [rsi + 0x2d8], r12
je 0x14005d149
mov rdx, rcx
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x60]
mov r8d, 1
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
dec qword [rsi + 0x2d8]
jmp 0x14005d14c
mov byte [rcx], r12b
inc rbx
movzx eax, byte [rdi + rbx]
inc rdi
mov byte [r14], al
inc r14
cmp rdi, 0x23
jl 0x14005d104
add rbx, 0x26
add ebp, 0xffffffda
add r15d, 0x21
cmp ebp, 0x26
jae 0x14005d0e8
mov rdx, qword [rsi + 0x2b0]
lea rcx, [rsi + 0x2e0]
mov r8, qword [rsi + 0x2a0]
mov r9d, r15d
mov rdx, qword [rdx]
call fcn.140038f50
mov rcx, qword [rsi + 0x10]
mov r8d, eax
mov rdx, qword [rsi + 0x2b0]
mov r9, qword [rcx]
call qword [r9 + reloc.WSOCK32.dll_recv]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rsi
ret
mov eax, 0x8004020d
jmp 0x14005d1ab
mov r12, qword [rsp + 0x48]
mov eax, 0x80040205
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rsi
ret
Function at 0x14005d200
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x290]
mov rbx, rcx
mov rcx, qword [rcx + 0x70]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
lea rcx, [rbx + 0x2e0]
test eax, eax
cmovne rdx, qword [rsp + 0x30]
sub rdx, qword [rbx + 0x290]
mov qword [rbx + 0x2d8], rdx
movzx edx, byte [rbx + 0x2c8]
call fcn.140037120
mov ecx, dword [rbx + 0x2cc]
mov rdi, qword [rbx + 0x2a0]
add ecx, 0x100
call fcn.1400b609c
mov qword [rbx + 0x2a0], rax
test rdi, rdi
je 0x14005d28a
mov rcx, rdi
call fcn.1400b60a4
cmp qword [rbx + 0x2a0], 0
je 0x14005d2bd
mov r8d, dword [rbx + 0x2d0]
lea rcx, [rbx + 0x2b0]
mov edx, 1
call fcn.1400265b0
test al, al
je 0x14005d2bd
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov eax, 0x80040202
add rsp, 0x20
pop rdi
ret
Function at 0x14005dd40
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
lea rsi, [rdx - 0x80]
mov rbx, r8
mov rdi, rdx
mov r14, rcx
test rsi, rsi
jle 0x14005decf
mov rcx, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r14]
lea r9, [rbp + 0x6f]
xor eax, eax
lea rdx, [rbp - 0x59]
mov r8d, pe_nt_image_headers64
mov dword [rbp + 0x6f], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005decf
cmp dword [rbp + 0x6f], 0x80
jne 0x14005decf
cmp word [rbp - 0x59], 0x4154
jne 0x14005decf
cmp byte [rbp - 0x57], 0x47
jne 0x14005decf
test rbx, rbx
je 0x14005deca
add rbx, 0x58
cmp byte [rbp - 0x56], 0
je 0x14005ddf7
mov r9d, 0x1e
lea r8, [rbp - 0x56]
mov rcx, rbx
lea edx, [r9 - 0x1b]
call fcn.140025fb0
cmp byte [rbp - 0x38], 0
je 0x14005de13
mov r9d, 0x1e
lea r8, [rbp - 0x38]
mov rcx, rbx
lea edx, [r9 - 0x19]
call fcn.140025fb0
cmp byte [rbp - 0x1a], 0
je 0x14005de2f
mov r9d, 0x1e
lea r8, [rbp - 0x1a]
mov rcx, rbx
lea edx, [r9 - 0x13]
call fcn.140025fb0
cmp byte [rbp + 4], 0
je 0x14005de4b
mov r9d, 4
lea r8, [rbp + 4]
mov rcx, rbx
lea edx, [r9 + 0xa]
call fcn.140025fb0
cmp byte [rbp + 8], 0
je 0x14005de67
mov r9d, 0x1e
lea r8, [rbp + 8]
mov rcx, rbx
lea edx, [r9 - 0xf]
call fcn.140025fb0
cmp byte [rbp + 0x24], 0
jne 0x14005de9e
movzx eax, byte [rbp + 0x25]
test al, al
je 0x14005de9e
mov r8d, eax
lea rdx, [0x14012ccb8]
lea rcx, [rbp + 0x27]
call fcn.1400100f0
mov r9d, 0xffffffff
lea r8, [rbp + 0x27]
mov rcx, rbx
lea edx, [r9 + 0xd]
call fcn.140025fb0
cmp byte [rbp - 0x56], 0
je 0x14005deca
movzx edx, byte [rbp + 0x26]
lea rcx, [rbp + 0x27]
mov r8b, 1
call fcn.14005dcb0
mov r9d, 0xffffffff
lea r8, [rbp + 0x27]
mov rcx, rbx
lea edx, [r9 + 0xe]
call fcn.140025fb0
mov rax, rsi
jmp 0x14005ded2
mov rax, rdi
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14005def0
Capabilities:
Write file on windows

Disassembly:
test rdx, rdx
je 0x14005e11e
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xd8
mov qword [rax + 0x20], rbx
mov rdi, rdx
mov qword [rax - 0x18], rsi
mov rcx, rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov rax, qword [rdx]
mov edx, 3
call qword [rax + 0x40]
mov r8, qword [rdi]
mov edx, 5
mov rcx, rdi
mov r13, rax
call qword [r8 + 0x40]
mov r8, qword [rdi]
mov edx, 0xb
mov rcx, rdi
mov r15, rax
call qword [r8 + 0x40]
mov r8, qword [rdi]
mov edx, recv
mov rcx, rdi
mov r12, rax
call qword [r8 + 0x40]
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14005df90
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], al
jne 0x14005df80
cmp rcx, 4
cmovb rbx, rax
mov rax, qword [rdi]
mov edx, recv
mov rcx, rdi
call qword [rax + 0x40]
mov r8, qword [rdi]
mov edx, recv
mov rcx, rdi
mov rsi, rax
call qword [r8 + 0x40]
mov r8, qword [rdi]
mov edx, recv
mov rcx, rdi
mov r14, rax
call qword [r8 + 0x40]
mov rdi, rax
test r13, r13
jne 0x14005dfec
test r15, r15
jne 0x14005dfec
test r12, r12
jne 0x14005dfec
test rbx, rbx
jne 0x14005dfec
test rsi, rsi
jne 0x14005dfec
test r14, r14
jne 0x14005dfec
test rax, rax
je 0x14005e0e5
xorps xmm0, xmm0
mov word [rbp - 0x59], 0x4154
xor eax, eax
mov byte [rbp - 0x57], 0x47
mov qword [rbp + 0x1a], rax
mov dword [rbp + 0x22], eax
mov byte [rbp + 0x26], al
movups xmmword [rbp - 0x56], xmm0
movups xmmword [rbp - 0x46], xmm0
movups xmmword [rbp - 0x36], xmm0
movups xmmword [rbp - 0x26], xmm0
movups xmmword [rbp - 0x16], xmm0
movups xmmword [rbp - 6], xmm0
movups xmmword [rbp + 0xa], xmm0
test r13, r13
je 0x14005e036
lea r8d, [rax + 0x1e]
mov rdx, r13
lea rcx, [rbp - 0x56]
call fcn.1400f4c50
test r15, r15
je 0x14005e04d
mov r8d, 0x1e
lea rcx, [rbp - 0x38]
mov rdx, r15
call fcn.1400f4c50
test r12, r12
je 0x14005e064
mov r8d, 0x1e
lea rcx, [rbp - 0x1a]
mov rdx, r12
call fcn.1400f4c50
test rbx, rbx
je 0x14005e07b
mov r8d, 4
lea rcx, [rbp + 4]
mov rdx, rbx
call fcn.1400f4c50
test rsi, rsi
je 0x14005e092
mov r8d, 0x1c
lea rcx, [rbp + 8]
mov rdx, rsi
call fcn.1400f4c50
xor ebx, ebx
mov dword [rbp + 0x6f], ebx
mov eax, ebx
test r14, r14
je 0x14005e0b4
lea r8, [rbp + 0x6f]
mov rcx, r14
lea rdx, [0x14012ccb8]
call fcn.140010150
mov eax, dword [rbp + 0x6f]
mov rcx, rdi
mov byte [rbp + 0x25], al
call fcn.14005fc10
mov rcx, qword [rbp + 0x67]
lea r9, [rbp + 0x77]
mov r8d, pe_nt_image_headers64
mov byte [rbp + 0x26], al
lea rdx, [rbp - 0x59]
mov dword [rbp + 0x77], ebx
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0x108]
mov r15, qword [rsp + 0xb0]
add rsp, 0xd8
pop rdi
pop rbp
ret
Function at 0x14005f9e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rsi
push rdi
push r14
mov eax, 0x1420
call fcn.1400b6710
sub rsp, rax
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x14
jle 0x14005fbf9
mov rcx, qword [rcx]
add rdx, 0xfffffffffffffff7
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r14]
lea r9, [rsp + 0x1448]
xor edi, edi
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x1448], edi
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 9]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005fbf9
cmp dword [rsp + 0x1448], 9
jne 0x14005fbf9
cmp dword [rsp + 0x30], 0x4952594c
jne 0x14005fbf9
cmp word [rsp + 0x34], 0x5343
jne 0x14005fbf9
movzx ecx, word [rsp + 0x36]
movzx eax, word [rsp + 0x38]
cmp cx, 0x4e45
jne 0x14005fb22
cmp al, 0x44
jne 0x14005fb22
mov rcx, qword [r14]
mov eax, 0x13ec
cmp rsi, rax
mov ebx, esi
mov rdx, rsi
cmovg ebx, eax
xor r9d, r9d
movsxd rax, ebx
xor r8d, r8d
sub rdx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r14]
lea r9, [rsp + 0x1448]
mov r8d, ebx
mov dword [rsp + 0x1448], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
add ebx, 0xffffffed
test ebx, ebx
jle 0x14005fbf9
movabs rcx, 0x454253434952594c
nop
mov eax, edi
cmp qword [rsp + rax + 0x30], rcx
jne 0x14005fb09
cmp word [rsp + rax + 0x38], 0x4947
jne 0x14005fb09
cmp byte [rsp + rax + 0x3a], 0x4e
je 0x14005fb14
inc edi
cmp edi, ebx
jl 0x14005faf0
jmp 0x14005fbf9
add rax, 0xffffffffffffec14
add rax, rsi
jmp 0x14005fbfc
cmp cx, 0x3032
jne 0x14005fbf9
cmp al, 0x30
jne 0x14005fbf9
mov rcx, qword [r14]
lea rdx, [rsi - 0xf]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r14]
lea r9, [rsp + 0x1448]
mov r8d, 6
mov dword [rsp + 0x1448], edi
lea rdx, [rsp + 0x1458]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rcx, [rsp + 0x1458]
mov byte [rsp + 0x145e], dil
call fcn.1400cafdc
add eax, 0xf
mov rbx, rdi
movsxd rcx, eax
mov rax, rsi
sub rax, rcx
mov rcx, qword [r14]
cmovns rbx, rax
xor r9d, r9d
mov rdx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r14]
lea r9, [rsp + 0x1448]
mov r8d, recv
mov dword [rsp + 0x1448], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
movabs rcx, 0x454253434952594c
cmp qword [rsp + 0x30], rcx
jne 0x14005fbf9
cmp word [rsp + 0x38], 0x4947
jne 0x14005fbf9
cmp byte [rsp + 0x3a], 0x4e
mov rax, rbx
je 0x14005fbfc
mov rax, rsi
mov rbx, qword [rsp + 0x1440]
add rsp, 0x1420
pop r14
pop rdi
pop rsi
ret
Function at 0x140060960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
lea rdx, [rsp + 0x58]
mov eax, r8d
mov dword [rsp + 0x60], ebp
mov rsi, r9
mov qword [rsp + 0x20], rbp
mov ebx, r8d
lea r9, [rsp + 0x60]
mov rdi, rcx
lea r8d, [rbp + 4]
mov rcx, qword [rcx + 0x38]
bswap eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x60]
lea r8d, [rbp + 4]
mov dword [rsp + 0x60], ebp
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x60]
mov r8d, ebx
mov dword [rsp + 0x60], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140060c40
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor edi, edi
lea r9, [rsp + 0x60]
mov rsi, rcx
mov dword [rsp + 0x60], edi
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 0x1a]
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r9d, [rdi + 0x14]
lea r8, [rsp + 0x36]
lea edx, [rdi + 0xf]
lea rcx, [rsi + 0x58]
call fcn.140025fb0
lea r9d, [rdi - 1]
lea r8, [0x14012f1c8]
lea edx, [rdi + 2]
lea rcx, [rsi + 0x58]
call fcn.140025fb0
mov rcx, rsi
call fcn.140023ca0
mov rcx, qword [rsi + 0x70]
lea rdx, [rsp + 0x60]
mov qword [rsi + 0x290], 0x200
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rbx, qword [rsp + 0x68]
test eax, eax
mov dword [rsi + 0x28], 0x1f40
cmovne rdi, qword [rsp + 0x60]
sub rdi, qword [rsi + 0x290]
mov rax, rdi
mov dword [rsi + 0x20], 1
cqo
sub rax, rdx
sar rax, 1
mov qword [rsi + 0x18], rax
xor eax, eax
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400618e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor r14d, r14d
mov r15d, r8d
mov r13, rdx
mov rbp, rcx
cmp dword [rcx + 0x258], r14d
jbe 0x140061a33
lea rdi, [0x14012dcb0]
lea rsi, [0x14012bb38]
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp + r14*8 + 0x298]
xor r9d, r9d
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov eax, dword [rbp + 0x2d8]
lea rcx, [rbp + 0x28]
imul eax, r15d
mov edx, 2
add qword [rbp + r14*8 + 0x298], rax
mov rbx, qword [r13 + r14*8]
call fcn.140025da0
xor edx, edx
nop
movzx ecx, word [rax + rdx*2]
cmp cx, word [rdi + rdx*2]
jne 0x140061a59
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [rdi + rdx*2 + 2]
jne 0x140061a59
add rdx, 2
cmp rdx, 0xa
jne 0x140061970
mov rdi, qword [rbp + 0x270]
mov esi, r15d
test r15d, r15d
je 0x1400619d5
nop word [rax + rax]
mov rcx, qword [rbp + 0x280]
mov edx, r14d
movss xmm2, dword [rbx]
mov rax, qword [rcx]
call qword [rax + htons]
add al, 0x80
lea rbx, [rbx + 4]
mov byte [rdi], al
lea rdi, [rdi + 1]
add esi, 0xffffffff
jne 0x1400619b0
lea rsi, [0x14012bb38]
lea rdi, [0x14012dcb0]
mov ebx, dword [rbp + 0x2d8]
lea r9, [rsp + 0x60]
mov rdx, qword [rbp + 0x270]
xor eax, eax
mov rcx, qword [rbp + 0x38]
imul ebx, r15d
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], rax
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140061b4e
cmp dword [rsp + 0x60], ebx
jne 0x140061b4e
inc r14d
cmp r14d, dword [rbp + 0x258]
jb 0x140061930
add qword [rbp + 0x268], r15
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, 2
lea rcx, [rbp + 0x28]
call fcn.140025da0
mov r8, rax
mov rdx, 0xffffffffffffffff
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [rsi + rdx*2 + 2]
jne 0x140061a93
add rdx, 2
cmp rdx, 0xb
je 0x140061adf
movzx eax, word [r8 + rdx*2]
cmp ax, word [rsi + rdx*2]
je 0x140061a71
mov edx, 2
lea rcx, [rbp + 0x28]
call fcn.140025da0
mov r8, rax
lea r9, [0x14012dc58]
mov rdx, 0xffffffffffffffff
movzx ecx, word [r8 + rdx*2 + 2]
cmp cx, word [r9 + rdx*2 + 2]
jne 0x1400619e3
add rdx, 2
cmp rdx, 0xd
je 0x140061b1b
movzx eax, word [r8 + rdx*2]
cmp ax, word [r9 + rdx*2]
je 0x140061ab2
jmp 0x1400619e3
mov rdi, qword [rbp + 0x270]
mov esi, r15d
test r15d, r15d
je 0x1400619d5
mov rcx, qword [rbp + 0x280]
mov edx, r14d
movss xmm2, dword [rbx]
mov rax, qword [rcx]
call qword [rax + htons]
mov word [rdi], ax
lea rdi, [rdi + 2]
lea rbx, [rbx + 4]
add esi, 0xffffffff
jne 0x140061af2
jmp 0x1400619d5
mov rax, qword [rbp + 0x270]
mov ecx, r15d
test r15d, r15d
je 0x1400619e3
nop
movss xmm0, dword [rbx]
lea rax, [rax + 8]
lea rbx, [rbx + 4]
cvtps2pd xmm0, xmm0
movsd qword [rax - 8], xmm0
add ecx, 0xffffffff
jne 0x140061b30
jmp 0x1400619e3
mov eax, 0x80040206
jmp 0x140061a3c
Function at 0x140062bb0
Capabilities:
Get file size

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x60
cmp byte [rcx + 0x358], 0xa
mov rbx, rcx
mov byte [rcx + 0x2cd], 1
mov word [rcx + 0x2d0], 0x100
jne 0x140062c9f
movss xmm0, dword [rcx + 0x36c]
addss xmm0, dword [0x14012bc68]
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
movzx esi, byte [rcx + 0x359]
mov qword [rax - 0x10], rdi
and sil, 0x7f
cvttss2si rcx, xmm0
mov qword [rax - 0x18], r14
call fcn.14003f150
mov ecx, dword [rbx + 0x20]
movzx ebp, al
call fcn.14003ee30
movzx edi, byte [rbx + 0x359]
movzx r14d, al
shr dil, 7
test dil, dil
je 0x140062c48
movss xmm0, dword [rbx + 0x370]
addss xmm0, dword [0x14012bc68]
cvttss2si rcx, xmm0
call fcn.14003f150
jmp 0x140062c4a
xor al, al
mov byte [rsp + 0x28], al
lea rcx, [rsp + 0x31]
movzx r9d, r14b
mov byte [rsp + 0x20], dil
movzx r8d, bpl
movzx edx, sil
call fcn.14003f250
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
xor r9d, r9d
lea r8d, [rax + 1]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov r14, qword [rsp + 0x50]
mov ecx, eax
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
shr ecx, 0x1f
test cl, cl
jne 0x140062cc6
mov rcx, qword [rbx + 0x70]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r9d, r9d
mov rcx, rbx
test eax, eax
cmovne r9, qword [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call fcn.140063080
add rsp, 0x60
pop rbx
ret

Function at 0x140062d00
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov word [rcx + 0x2cc], 1
mov dword [rcx + 0x28c], ebx
lea rdx, [rsp + 0x30]
mov byte [rcx + 0x2cf], bl
mov rdi, rcx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rdi
cmovne rbx, qword [rsp + 0x30]
xor r8d, r8d
mov r9, rbx
xor edx, edx
call fcn.140063080
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140062d76
cmp dword [rdi + 0x28c], 0
je 0x140062d71
cmp qword [rdi + 0x18], 0
je 0x140062d71
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 0x8004020e
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140062d90
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 0x70]
cmp rdx, 8
jne 0x140062dd4
xor eax, eax
lea r9, [rsp + 0x48]
mov r8d, edx
mov dword [rsp + 0x48], eax
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rsp + 0x50]
bswap rax
mov qword [rsp + 0x50], rax
movsd xmm0, qword [rsp + 0x50]
add rsp, 0x38
ret
cmp rdx, 4
jne 0x140062e10
xor eax, eax
lea r9, [rsp + 0x50]
mov r8d, edx
mov dword [rsp + 0x50], eax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x48]
bswap eax
mov dword [rsp + 0x48], eax
movss xmm0, dword [rsp + 0x48]
cvtps2pd xmm0, xmm0
add rsp, 0x38
ret
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xorps xmm0, xmm0
add rsp, 0x38
ret