joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002fad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor ebx, ebx
mov r14, r8
mov esi, ebx
mov rdi, rdx
mov rbp, rcx
nop word [rax + rax]
mov rax, qword [rdi + 0x20]
shl ebx, 4
movsx ecx, byte [rax]
add ebx, ecx
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x14002fb18
add ebx, 0xffffffd0
jmp 0x14002fb42
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x14002fb24
add ebx, 0xffffffc9
jmp 0x14002fb42
sub cl, 0x61
cmp cl, 5
ja 0x14002fb31
add ebx, 0xffffffa9
jmp 0x14002fb42
mov dword [rbp + 0x30], 8
mov qword [rbp + 0x38], r14
cmp dword [rbp + 0x30], 0
jne 0x14002fbb0
mov rax, qword [rdi + 0x20]
cmp rax, qword [rdi + 0x18]
jae 0x14002fb55
inc rax
mov qword [rdi + 0x20], rax
jmp 0x14002fba1
cmp byte [rdi + 0x38], 0
jne 0x14002fba1
mov rax, qword [rdi + 0x28]
mov edx, 1
mov r9, qword [rdi]
mov r8, qword [rdi + 0x10]
mov rcx, qword [rdi + 8]
add qword [rdi + 0x30], rax
call fcn.140084c7c
mov rdx, qword [rdi + 8]
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rdi + 0x18], rcx
cmp rax, qword [rdi + 0x10]
jae 0x14002fba1
mov byte [rdx + rax], 0
inc qword [rdi + 0x18]
mov byte [rdi + 0x38], 1
inc esi
cmp esi, 4
jl 0x14002fb00
mov eax, ebx
jmp 0x14002fbb2
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140030f20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
movabs rdi, 0x100002600
nop word [rax + rax]
mov rcx, qword [rbx + 0x20]
movzx eax, byte [rcx]
cmp al, 0x20
ja 0x140030fb3
movsx rax, al
bt rdi, rax
jae 0x140030fb3
cmp rcx, qword [rbx + 0x18]
jae 0x140030f65
lea rax, [rcx + 1]
mov qword [rbx + 0x20], rax
jmp 0x140030f40
cmp byte [rbx + 0x38], 0
jne 0x140030f40
mov rax, qword [rbx + 0x28]
mov edx, 1
mov r9, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
add qword [rbx + 0x30], rax
call fcn.140084c7c
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x140030f40
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
jmp 0x140030f40
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140031870
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
add qword [rcx + 0x20], 0xfffffffffffffff0
mov rbx, rcx
mov rax, qword [rcx + 0x20]
cmp qword [rax], 0
je 0x1400318ea
test byte [rcx + 0x48], 1
jne 0x1400318ea
mov rdi, qword [rcx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x1400318c0
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x1400318c0
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0xa
inc qword [rdi + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, qword [rbx + 0x18]
mov eax, dword [rbx + 0x44]
movzx edx, byte [rbx + 0x40]
mov rcx, qword [rbx]
shr r8, 4
imul r8, rax
call fcn.140031bc0
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x140031918
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x140031918
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x5d
inc qword [rdi + 0x18]
mov rax, qword [rbx + 0x18]
cmp qword [rbx + 0x20], rax
jne 0x140031955
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140031955
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140031970
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
add qword [rcx + 0x20], 0xfffffffffffffff0
mov rbx, rcx
mov rax, qword [rcx + 0x20]
cmp qword [rax], 0
je 0x1400319e4
mov rdi, qword [rcx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x1400319ba
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x1400319ba
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0xa
inc qword [rdi + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, qword [rbx + 0x18]
mov eax, dword [rbx + 0x44]
movzx edx, byte [rbx + 0x40]
mov rcx, qword [rbx]
shr r8, 4
imul r8, rax
call fcn.140031bc0
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x140031a12
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x140031a12
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x7d
inc qword [rdi + 0x18]
mov rax, qword [rbx + 0x18]
cmp qword [rbx + 0x20], rax
jne 0x140031a4f
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140031a4f
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140031a60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.140031a90
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400323c0
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
lea rdx, [rsp + 0x20]
test rax, rax
jns 0x1400323f8
not rax
mov byte [rsp + 0x20], 0x2d
inc rax
lea rdx, [rsp + 0x21]
mov rcx, rax
call fcn.1400239b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003249a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032471
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032471
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x140032440
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x140031b60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8, qword [rcx + 0x18]
movzx edi, dl
mov rbx, rcx
cmp r8, qword [rcx + 0x10]
jb 0x140031b9b
mov rcx, qword [rcx + 8]
cmp r8, rcx
je 0x140031b9b
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], dil
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140031bc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov qword [rsp + 0x38], rdi
mov rsi, r8
mov rdi, qword [rcx + 0x10]
movzx r14d, dl
sub rdi, qword [rcx + 0x18]
mov rbx, rcx
cmp r8, rdi
jbe 0x140031c4c
mov qword [rsp + 0x30], rbp
movsx ebp, dl
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x18]
mov r8, rdi
mov edx, ebp
call fcn.14007bf60
add qword [rbx + 0x18], rdi
mov r8, qword [rbx + 0x18]
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140031c37
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
sub rsi, rdi
mov rdi, qword [rbx + 0x10]
sub rdi, qword [rbx + 0x18]
cmp rsi, rdi
ja 0x140031c00
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test rsi, rsi
je 0x140031c6a
mov rcx, qword [rbx + 0x18]
mov r8, rsi
movsx edx, r14b
call fcn.14007bf60
add qword [rbx + 0x18], rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140031c80
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
cmp rax, qword [rcx + 0x18]
jae 0x140031ca0
inc rax
mov qword [rcx + 0x20], rax
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0x38], 0
jne 0x140031cec
mov rax, qword [rcx + 0x28]
mov edx, 1
add qword [rcx + 0x30], rax
mov r9, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 8]
call fcn.140084c7c
mov rdx, qword [rbx + 8]
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x20], rdx
lea rcx, [rdx - 1]
add rcx, rax
mov qword [rbx + 0x18], rcx
cmp rax, qword [rbx + 0x10]
jae 0x140031cec
mov byte [rdx + rax], 0
inc qword [rbx + 0x18]
mov byte [rbx + 0x38], 1
add rsp, 0x20
pop rbx
ret

Function at 0x140031d90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, 4
mov rdi, rcx
call fcn.140031a90
mov rax, qword [rdi + 0x20]
add rax, 0x10
cmp rax, qword [rdi + 0x28]
jbe 0x140031dc3
mov edx, 1
lea rcx, [rdi + 8]
call fcn.14002f6c0
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
test rcx, rcx
je 0x140031ddf
mov qword [rcx], 0
mov byte [rcx + 8], 1
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140031e0d
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140031e0d
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x5b
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140031e30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov edx, 3
mov rdi, rcx
call fcn.140031a90
mov rax, qword [rdi + 0x20]
add rax, 0x10
cmp rax, qword [rdi + 0x28]
jbe 0x140031e63
mov edx, 1
lea rcx, [rdi + 8]
call fcn.14002f6c0
mov rcx, qword [rdi + 0x20]
lea rax, [rcx + 0x10]
mov qword [rdi + 0x20], rax
test rcx, rcx
je 0x140031e7f
mov qword [rcx], 0
mov byte [rcx + 8], 0
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140031ead
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140031ead
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x7b
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140031fc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 5
mov rsi, rcx
call fcn.140031a90
mov r8d, ebx
mov rdx, rdi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400326c0
Function at 0x140032000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.140031a90
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140032960
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1400239b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x140032a2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032a01
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032a01
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x1400329d0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x140032030
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx]
mov rbx, rcx
mov r8, qword [rdi + 0x18]
test dl, dl
je 0x1400320f1
cmp r8, qword [rdi + 0x10]
jb 0x140032073
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x140032073
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x74
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x1400320ac
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x1400320ac
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], WSAStartup
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x1400320e5
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x1400320e5
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x75
jmp 0x1400321ca
cmp r8, qword [rdi + 0x10]
jb 0x140032118
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x140032118
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x66
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x140032151
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x140032151
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x61
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x14003218a
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x14003218a
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], 0x6c
inc qword [rdi + 0x18]
mov rdi, qword [rbx]
mov r8, qword [rdi + 0x18]
cmp r8, qword [rdi + 0x10]
jb 0x1400321c3
mov rcx, qword [rdi + 8]
cmp r8, rcx
je 0x1400321c3
mov r9, qword [rdi]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rdi + 8]
mov qword [rdi + 0x18], rax
mov rax, qword [rdi + 0x18]
mov byte [rax], reloc.WS2_32.dll_WSAStartup
inc qword [rdi + 0x18]
mov rbx, qword [rbx]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x1400321fc
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400321fc
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x65
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140032220
Capabilities:
Write file on windows

Disassembly:
push r15
sub rsp, 0x80
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x50], rax
movsd qword [rsp + 0x20], xmm1
mov r15, rcx
mov rax, qword [rsp + 0x20]
movabs rcx, 0x7ff0000000000000
and rax, rcx
movaps xmm0, xmm1
cmp rax, rcx
jne 0x140032262
xor al, al
jmp 0x1400323a6
mov qword [rsp + 0xa0], rbx
movabs rcx, 0x7fffffffffffffff
movsd qword [rsp + 0x20], xmm0
lea rbx, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x68], rdi
mov edi, dword [r15 + 0x38]
test rcx, rax
jne 0x1400322bf
movabs rcx, 0x8000000000000000
test rcx, rax
je 0x1400322b0
mov byte [rsp + 0x30], 0x2d
lea rbx, [rsp + 0x31]
mov word [rbx], 0x2e30
lea rax, [rbx + 3]
mov byte [rbx + 2], 0x30
jmp 0x1400322ff
xorps xmm1, xmm1
comisd xmm1, xmm0
jbe 0x1400322d9
xorps xmm0, xmmword [0x1400a4f50]
lea rbx, [rsp + 0x31]
mov byte [rsp + 0x30], 0x2d
lea r9, [rsp + 0x28]
mov rdx, rbx
lea r8, [rsp + 0x20]
call fcn.140022990
mov r8d, dword [rsp + 0x28]
mov r9d, edi
mov edx, dword [rsp + 0x20]
mov rcx, rbx
call fcn.140022c20
xor edx, edx
lea rcx, [rsp + 0x30]
mov rsi, rax
lea rdi, [rsp + 0x30]
sub rsi, rcx
lea rcx, [rsp + 0x30]
cmp rcx, rax
cmova rsi, rdx
test rsi, rsi
je 0x140032392
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x60], r14
lea r14, [rsp + 0x30]
neg r14
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [r15]
movzx ebp, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032371
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032371
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], bpl
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rsi
jne 0x140032340
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x68]
mov al, 1
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x80
pop r15
ret
Function at 0x1400323c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.140031a90
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400323c0
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
lea rdx, [rsp + 0x20]
test rax, rax
jns 0x1400323f8
not rax
mov byte [rsp + 0x20], 0x2d
inc rax
lea rdx, [rsp + 0x21]
mov rcx, rax
call fcn.1400239b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003249a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032471
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032471
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x140032440
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x1400324c0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, edx
mov r15, rcx
lea rdx, [rsp + 0x20]
test eax, eax
jns 0x1400324f4
not eax
mov byte [rsp + 0x20], 0x2d
inc eax
lea rdx, [rsp + 0x21]
mov ecx, eax
call fcn.140023780
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x14003259a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032571
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032571
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x140032540
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret
Function at 0x1400325c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rdi, rcx
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x1400325fb
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400325fb
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], WSAGetLastError
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032634
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032634
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x75
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x14003266d
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x14003266d
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x6c
inc qword [rbx + 0x18]
mov rbx, qword [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x1400326a6
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x1400326a6
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
mov byte [rax], 0x6c
mov al, 1
inc qword [rbx + 0x18]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140032960
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov edx, 6
call fcn.140031a90
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140032960
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, rdx
mov r15, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.1400239b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x140032a2a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop dword [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032a01
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032a01
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x1400329d0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret

Function at 0x140032a50
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r15
sub rsp, 0x50
mov rax, qword [0x1400dc160]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov eax, edx
mov r15, rcx
mov ecx, eax
lea rdx, [rsp + 0x20]
call fcn.140023780
xor edx, edx
lea rcx, [rsp + 0x20]
mov rbp, rax
lea rdi, [rsp + 0x20]
sub rbp, rcx
lea rcx, [rsp + 0x20]
cmp rcx, rax
cmova rbp, rdx
test rbp, rbp
je 0x140032b1a
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r14
lea r14, [rsp + 0x20]
neg r14
nop word [rax + rax]
mov rbx, qword [r15]
movzx esi, byte [rdi]
mov r8, qword [rbx + 0x18]
cmp r8, qword [rbx + 0x10]
jb 0x140032af1
mov rcx, qword [rbx + 8]
cmp r8, rcx
je 0x140032af1
mov r9, qword [rbx]
sub r8, rcx
mov edx, 1
call fcn.140084f80
mov rax, qword [rbx + 8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x18]
inc rdi
mov byte [rax], sil
lea rax, [r14 + rdi]
inc qword [rbx + 0x18]
cmp rax, rbp
jne 0x140032ac0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x80]
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c600
add rsp, 0x50
pop r15
pop rdi
pop rbp
ret