joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x5c88], 0
mov rbp, r8
mov r14, rdx
mov rdi, rcx
je 0x1400193cd
mov qword [rsp + 0x30], rbx
lea rbx, [rcx + 0x5c90]
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x38], rsi
xor esi, esi
test ecx, ecx
jns 0x140019372
je 0x14001935e
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140019363
mov eax, 8
test eax, eax
mov edx, esi
mov rcx, rbx
cmovg edx, eax
call fcn.14001b960
mov r8, rbp
mov dword [rbx], esi
mov rdx, r14
mov rcx, rbx
call fcn.140004110
mov eax, dword [rbx]
test eax, eax
je 0x14001938b
lea esi, [rax - 1]
mov rax, qword [rbx + 8]
lea rcx, [0x14013eaf8]
mov r9, qword [rdi + 0x5c88]
test rax, rax
movsxd r8, esi
mov edx, 1
cmovne rcx, rax
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add rcx, 0x5c90
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140004110

Function at 0x140019810
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14013eb00]
or r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140019877
mov qword [rsp], rbx
lea rbx, [0x1400d7b20]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140019853
cmp byte [r8], r9b
jne 0x140019853
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
mov ecx, eax
inc r8
shr ecx, 8
mov eax, dword [rbx + rdx*4]
xor eax, ecx
test r9b, r9b
jne 0x140019840
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c00]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400198ab
mov r10, qword [r10 + 0x5c08]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400198b2
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140019898
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret

Function at 0x140019b70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14013eb00]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5bec], ecx
test rbx, rbx
je 0x140019bdf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.140019bf0
lea rdx, [0x1400d7744]
mov rcx, rbx
mov rdi, rax
call fcn.1400038a0
mov rbx, rax
test rax, rax
je 0x140019bda
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400304b0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
mov r10, rdx
mov eax, 0x5e6ea9af
mul r8d
mov edi, r8d
xor r9d, r9d
shr edx, 0xb
mov esi, r8d
imul eax, edx, 0x15b0
mov ecx, 1
sub edi, eax
test r8d, r8d
je 0x1400305ec
mov qword [rsp + 0x10], rbx
xor edx, edx
cmp edi, 7
jbe 0x140030552
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add ecx, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add ecx, eax
add r10, 8
add r9d, ecx
cmp r8d, edi
jb 0x1400304f3
xor r8d, r8d
xor r11d, r11d
cmp edx, edi
jae 0x1400305b4
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x14003059d
mov eax, edi
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov ebx, eax
lea edx, [rdx + rax*2]
nop word [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add r8d, ecx
add r10, 2
add ecx, eax
add r11d, ecx
sub rbx, 1
jne 0x140030580
cmp edx, edi
jae 0x1400305ad
movzx eax, byte [r10]
add ecx, eax
add r9d, ecx
inc r10
lea eax, [r11 + r8]
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
sub esi, edi
mov edi, 0x15b0
jne 0x1400304e8
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
shl r9d, 0x10
lea eax, [rcx + r9]
pop rdi
ret
Function at 0x1400325f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov rcx, qword [0x14013eb00]
mov edx, 0x210
call fcn.1400104d0
cmp byte [rax], 0
je 0x140032666
xor edx, edx
mov ecx, 0x210
call fcn.140012850
test al, al
je 0x140032666
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140032666
mov rbx, qword [0x14013eb00]
cmp byte [rbx + 0x37b9], 0
je 0x140032652
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002ef0
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov rcx, qword [0x14013eb00]
mov edx, 0x214
call fcn.1400104d0
cmp byte [rax], 0
je 0x1400326d6
xor edx, edx
mov ecx, 0x214
call fcn.140012850
test al, al
je 0x1400326d6
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400326d6
mov rbx, qword [0x14013eb00]
cmp byte [rbx + 0x37b9], 0
je 0x1400326c2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002ef0
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov rcx, qword [0x14013eb00]
mov edx, 0x212
call fcn.1400104d0
cmp byte [rax], 0
je 0x140032746
xor edx, edx
mov ecx, 0x212
call fcn.140012850
test al, al
je 0x140032746
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x140032746
mov rbx, qword [0x14013eb00]
cmp byte [rbx + 0x37b9], 0
je 0x140032732
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002ef0
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov rcx, qword [0x14013eb00]
mov edx, 0x216
call fcn.1400104d0
cmp byte [rax], 0
je 0x1400327b6
xor edx, edx
mov ecx, 0x216
call fcn.140012850
test al, al
je 0x1400327b6
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1400327b6
mov rbx, qword [0x14013eb00]
cmp byte [rbx + 0x37b9], 0
je 0x1400327a2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002ef0
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x1400327c0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x14013eb00]
mov ecx, 0x11
add rbx, 8
movaps xmmword [rsp + 0x20], xmm6
call qword [sym.imp.USER32.dll_GetKeyState]
movss xmm6, dword [0x1400ddb70]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x37b1], 0
je 0x140032814
test al, al
je 0x140032800
movaps xmm3, xmm6
jmp 0x140032803
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x1000
mov rcx, rbx
call fcn.140002ef0
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x37b1], 0
je 0x14003284a
test al, al
je 0x140032836
movaps xmm3, xmm6
jmp 0x140032839
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x2000
mov rcx, rbx
call fcn.140002ef0
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x37b1], 0
je 0x140032880
test al, al
je 0x14003286c
movaps xmm3, xmm6
jmp 0x14003286f
xorps xmm3, xmm3
movzx r8d, al
mov edx, 0x4000
mov rcx, rbx
call fcn.140002ef0
mov ecx, 0x5d
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rbx + 0x37b1], 0
je 0x1400328b4
test al, al
jne 0x1400328a0
xorps xmm6, xmm6
movaps xmm3, xmm6
movzx r8d, al
mov edx, 0x8000
mov rcx, rbx
call fcn.140002ef0
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
Function at 0x1400348f0
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
sub rsp, 0x78
xor eax, eax
lea r8, [0x1400dcd65]
mov qword [r11 - 0x50], rax
or r10d, 0xffffffff
mov qword [r11 - 0x48], rax
mov r9b, 0x54
mov qword [r11 - 0x40], rax
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x18], rax
lea rax, str.Table
mov qword [r11 - 0x58], rax
mov eax, r10d
lea r11, [0x1400d7b20]
nop dword [rax]
cmp r9b, 0x23
jne 0x140034953
cmp byte [r8], r9b
jne 0x140034953
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
mov ecx, eax
inc r8
shr ecx, 8
mov eax, dword [r11 + rdx*4]
xor eax, ecx
test r9b, r9b
jne 0x140034940
mov rcx, qword [0x14013eb00]
lea rdx, [rsp + 0x20]
not eax
add rcx, 0x5c00
mov dword [rsp + 0x28], eax
lea rax, [0x1400340b0]
mov qword [rsp + 0x30], rax
lea rax, [0x1400341a0]
mov qword [rsp + 0x40], rax
lea rax, [0x140034290]
mov qword [rsp + 0x48], rax
lea rax, [0x140034150]
mov qword [rsp + 0x50], rax
lea rax, [0x140034540]
mov qword [rsp + 0x58], rax
call fcn.14001b290
add rsp, 0x78
ret
Function at 0x14004f240
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea rdx, [rsp + 0x90]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x90]
mov byte [rsp + rax + 0x20], cl
lea rax, [rax + 1]
test cl, cl
jne 0x14004f290
lea r9, [0x1400dd0f8]
lea r8, [rsp + 0x20]
lea rdx, str._s_s
lea rcx, [0x14013ee38]
call fcn.14004aa30
lea rdx, [0x1400dda24]
lea rcx, [0x14013ee38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14013ee30], rax
test rax, rax
jne 0x14004f33f
lea rdx, [0x1400dda28]
mov dword [0x14013ef40], 1
lea rcx, [0x14013ee38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [0x14013ee30], rax
test rax, rax
jne 0x14004f32b
mov dword [0x14013ef3c], eax
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400b8130
add rsp, 0x1b8
ret
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x14013ee30], 0
mov dword [0x14013ef3c], 1
mov eax, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400b8130
add rsp, 0x1b8
ret

Function at 0x14004f4a0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x120
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rdx
lea rcx, [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor r8d, r8d
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], r8b
jne 0x14004f4f0
mov edx, r8d
test rax, rax
je 0x14004f528
nop dword [rax]
nop word [rax + rax]
movsx ecx, byte [rbx]
lea rbx, [rbx + 1]
imul r8d, r8d, 0x21
inc edx
add r8d, ecx
movsxd rcx, edx
cmp rcx, rax
jb 0x14004f510
lea rdx, [0x1400d77c4]
lea rcx, [rsp + 0x30]
call fcn.14004aa30
lea rax, [0x14013ee38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0xa0]
lea r8, [0x1400d6986]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b8130
add rsp, 0x120
pop rbx
ret
Function at 0x14004f5a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rdx
lea rcx, [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor edi, edi
mov r8d, edi
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rbx + rax], dil
jne 0x14004f5f0
mov edx, edi
test rax, rax
je 0x14004f618
movsx ecx, byte [rbx]
lea rbx, [rbx + 1]
imul r8d, r8d, 0x21
inc edx
add r8d, ecx
movsxd rcx, edx
cmp rcx, rax
jb 0x14004f600
lea rdx, [0x1400d77c4]
lea rcx, [rsp + 0x30]
call fcn.14004aa30
lea rax, [0x14013ee38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0xa0]
lea r8, [0x1400d6986]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
cmp eax, 1
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b8130
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret

Function at 0x14004f6a0
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x120
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rdx
lea rcx, [rsp + 0xa0]
xor edx, edx
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor r8d, r8d
or rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], r8b
jne 0x14004f6f0
mov edx, r8d
test rcx, rcx
je 0x14004f728
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
imul r8d, r8d, 0x21
inc edx
add r8d, eax
movsxd rax, edx
cmp rax, rcx
jb 0x14004f710
lea rdx, [0x1400d77c4]
lea rcx, [rsp + 0x30]
call fcn.14004aa30
lea rax, [0x14013ee38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0xa0]
lea r8, [0x1400d6986]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b8130
add rsp, 0x120
pop rbx
ret
Function at 0x14004f7a0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x120
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, rdx
lea rcx, [rsp + 0xa0]
xor edx, edx
mov rdi, r8
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 0x64]
call sub.VCRUNTIME140.dll_memset
xor r8d, r8d
or rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rbx + rcx], r8b
jne 0x14004f7f0
mov edx, r8d
test rcx, rcx
je 0x14004f828
nop dword [rax]
nop word [rax + rax]
movsx eax, byte [rbx]
lea rbx, [rbx + 1]
imul r8d, r8d, 0x21
inc edx
add r8d, eax
movsxd rax, edx
cmp rax, rcx
jb 0x14004f810
lea rdx, [0x1400d77c4]
lea rcx, [rsp + 0x30]
call fcn.14004aa30
lea rax, [0x14013ee38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0xa0]
lea r8, [0x1400d6986]
mov dword [rsp + 0x20], 0x104
lea rdx, [rsp + 0x30]
lea rcx, str.config
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea rdx, [0x1400dcc38]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
test rax, rax
je 0x14004f8bc
nop dword [rax + rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
lea rdx, [0x1400dcc38]
cvtsd2ss xmm1, xmm0
xor ecx, ecx
movss dword [rdi], xmm1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
lea rdi, [rdi + 4]
test rax, rax
jne 0x14004f890
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1400b8130
mov rbx, qword [rsp + 0x130]
add rsp, 0x120
pop rdi
ret
Function at 0x140060dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.14004fe70
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140060e16
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x140060e6d
mov ebp, 0x4b0000
jmp 0x140060e7b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.1400522b0
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140060e91
mov eax, r12d
jmp 0x140060e9a
mov edx, edi
mov ecx, ebp
call fcn.1400522b0
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140060eb6
shl esi, 0x10
mov ecx, esi
jmp 0x140060fa5
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x140060f14
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.14004fe70
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140060f04
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.140052180
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.14004fe70
add ebx, eax
jmp 0x140060fae
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x140060f21
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x140060f60
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.14004fe70
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x140060f65
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.140052180
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.14004fe70
add ebx, eax
jmp 0x140060fae
cmp eax, r12d
jge 0x140060f9e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.14004fe70
sub ebp, eax
sub r15d, esi
je 0x140060f9e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.140052180
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.14004fe70
add ebx, eax
jmp 0x140060fae
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.14004fe70
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.14004fe70
Function at 0x1400acf50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x1400ed008]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x1400ad0ec
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x1400ad0ec
cmp r10d, r14d
jne 0x1400acff0
sub rbx, 0x10
jmp 0x1400ad134
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x1400ad062
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x1400ad024
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x1400ad02c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x1400ad04b
movzx edx, r11b
mov rcx, rsi
call fcn.1400ae100
test al, al
jne 0x1400ad145
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.1400ae770
test al, al
jne 0x1400ad145
mov edx, dword [rsi + 0x64]
lea r9, [0x1400aead0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x1400ad08e
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.1400acdd0
jmp 0x1400ad0e2
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.1400acdd0
test dil, dil
je 0x1400ad0da
cmp byte [rsi + 0x6a], 0
jne 0x1400ad0da
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x1400ad145
sub rbx, 0x10
jmp 0x1400ad134
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x1400ad149
mov ebp, dword [rbx]
jmp 0x1400acfb0
mov al, 1
jmp 0x1400ad152
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400b8130
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x1400b3550
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x1400b356c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b35c0
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400b36e5
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x1400b36e5
test rax, rax
je 0x1400b36e5
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x1400b36e5
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x1400b365a
lea rax, [0x1400b3740]
jmp 0x1400b36b3
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x1400b36e5
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400b36d3
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x1400b3680
lea rax, [0x1400b3710]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x1400b36fa
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret