joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180045d80
Capabilities:
Create thread
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180045dcc
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
mov qword [0x180057948], rbx
mov qword [rsp + 0x28], rax
lea r8, [0x180045fd0]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x180057940], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
test edx, edx
jne 0x180045ddd
mov rcx, qword [0x180057940]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, 1
add rsp, 0x30
pop rbx
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
lea r9, str._J_ms8m
mov r8d, 3
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 2
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x7ff71f10471c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ff71f104726
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x7ff71f10474f
pop rbp
sub rbp, 0x33
sub rbp, 0xe7471c
sub rsp, 0x20
jmp 0x7ff71f10476e
mov rax, 0xe7471c
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x52d45cf4
xor byte [rax], dl
inc rax
dec rcx
jne 0x7ff71f10478d
jmp 0x7ff71f1047a4
mov rcx, rbp
mov ecx, dword [rcx + 0x3c]
add rcx, 0x108
add rcx, rbp
mov rax, 8
mov rdx, 0x28
mul rdx
add rcx, rax
mov eax, dword [rcx + 0xc]
add rax, rbp
push rax
push rax
movabs rax, 0x29616c
movabs rcx, 0xbde5ae
add rcx, rbp
movabs rdx, 0x125ac76b
call fcn.7ff71f104801
jmp 0x7ff71f104817
pop rax
pop rdx
push rdx
push rax
movabs rax, 0x29616c
movabs rcx, 0xbde5ae
add rcx, rbp
call fcn.7ff71f10483c
jmp 0x7ff71f104ac9
pop rdi
pop rsi
jmp 0x7ff71f104ad4
mov rax, 0xe7471c
add rax, rbp
add rax, 0x3ea
mov rcx, 0x2a5
mov rdx, 0x799bea0d
xor byte [rax], dl
inc rax
dec rcx
jne 0x7ff71f104af3
jmp 0x7ff71f104b0a
push rsi
mov rsi, rdi
pop rdi
mov edi, dword [rsi + 0x3c]
mov edi, dword [rdi + rsi + 0xb0]
add rdi, rsi
mov eax, dword [rsi + 0x3c]
add rax, rsi
mov rax, qword [rax + 0x30]
mov rbx, rsi
sub rbx, rax
mov edx, dword [rdi]
mov ecx, dword [rdi + 4]
cmp edx, 0
je 0x7ff71f104b94
add rdx, rsi
add rdi, 8
sub rcx, 8
cmp ecx, 0
je 0x7ff71f104b2f
mov ax, word [rdi]
shr eax, 0xc
and eax, 0xf
cmp eax, 0xa
jne 0x7ff71f104b82
mov ax, word [rdi]
and eax, 0xfff
add rax, rdx
add qword [rax], rbx
dec rcx
dec rcx
add rdi, 2
jmp 0x7ff71f104b52
jmp 0x7ff71f104b9d
mov rax, 0xe7471c
add rax, rbp
add rax, 0x4b3
mov rcx, 0x1dc
mov rdx, 0x35259bda
xor byte [rax], dl
inc rax
dec rcx
jne 0x7ff71f104bbc
jmp 0x7ff71f104bd3
mov edi, dword [rsi + 0x3c]
mov edi, dword [rdi + rsi + 0x90]
add rdi, rsi
cmp dword [rdi + 0xc], 0
je 0x7ff71f104c88
mov ecx, dword [rdi + 0xc]
add rcx, rsi
call qword [rbp + 0xbb8e6c]
cmp eax, 0
jne 0x7ff71f104c0e
mov ecx, dword [rdi + 0xc]
add rcx, rsi
call qword [rbp + 0xbb8e84]
cmp dword [rdi + 0xc], 0
je 0x7ff71f104c88
cmp dword [rdi], 0
jne 0x7ff71f104c2c
cmp dword [rdi + 0x10], 0
je 0x7ff71f104c7c
mov r13, rax
mov eax, dword [rdi + 0x10]
add rax, rsi
cmp dword [rax], 0
je 0x7ff71f104c7c
mov r12, rax
mov rdx, qword [rax]
or edx, edx
jns 0x7ff71f104c56
jmp 0x7ff71f104c60
add rdx, rsi
add rdx, 2
mov rcx, r13
call qword [rbp + 0xbb8e74]
mov qword [r12], rax
add r12, 8
mov rax, r12
jmp 0x7ff71f104c35
add rdi, 0x14
jmp 0x7ff71f104be0
add rsp, 0x20
mov r9, rsp
mov r8, 0xe74dac
mov rdx, rbp
mov rcx, rsi
mov eax, dword [rsi + 0x3c]
mov eax, dword [rax + rsi + 0x28]
add rax, rsi
jmp rax

Function at 0x7ff71f104801
Capabilities:
Encode data using xor

Disassembly:
shr eax, 2
xor dword [rcx], edx
add rcx, 4
dec rax
jne 0x7ff71f104804
ret
Function at 0x7ff71f1048bf
Capabilities:
Decompress data using aplib

Disassembly:
push rsi
push rdi
push rbp
push rdx
mov rdi, rdx
mov rsi, rcx
cld
mov dl, 0x80
mov al, byte [rsi]
add rsi, 1
mov byte [rdi], al
add rdi, 1
mov rbx, 2
add dl, dl
jne 0x7ff71f1048f4
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff71f1048cc
add dl, dl
jne 0x7ff71f104909
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff71f10498e
xor rax, rax
add dl, dl
jne 0x7ff71f104921
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x7ff71f104a8d
add dl, dl
jne 0x7ff71f104936
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x7ff71f104948
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x7ff71f10495a
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x7ff71f10496c
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
je 0x7ff71f10497d
mov rbx, rdi
sub rbx, rax
mov al, byte [rbx]
mov byte [rdi], al
inc rdi
mov rbx, 2
jmp 0x7ff71f1048e5
mov rax, 1
add dl, dl
jne 0x7ff71f1049a4
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rax, rax
add dl, dl
jne 0x7ff71f1049b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff71f104995
sub rax, rbx
mov rbx, 1
jne 0x7ff71f104a09
mov rcx, 1
add dl, dl
jne 0x7ff71f1049e2
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rcx, rcx
add dl, dl
jne 0x7ff71f1049f4
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff71f1049d3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff71f1048e5
dec rax
shl rax, 8
mov al, byte [rsi]
inc rsi
mov rbp, rax
mov rcx, 1
add dl, dl
jne 0x7ff71f104a2e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc rcx, rcx
add dl, dl
jne 0x7ff71f104a40
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x7ff71f104a1f
cmp rax, 0x7d00
sbb rcx, 0xffffffffffffffff
cmp rax, 0x500
sbb rcx, 0xffffffffffffffff
cmp rax, 0x80
adc rcx, 0
cmp rax, 0x80
adc rcx, 0
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x7ff71f1048e5
mov al, byte [rsi]
inc rsi
xor rcx, rcx
shr al, 1
je 0x7ff71f104abe
adc rcx, 2
mov rbp, rax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov rbx, 1
jmp 0x7ff71f1048e5
pop rdx
sub rdi, rdx
mov rax, rdi
pop rbp
pop rdi
pop rsi
ret
Function at 0x14000c930
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
movapd xmmword [rsp + 0x40], xmm7
movapd xmmword [rsp + 0x30], xmm6
mov r12, qword [rcx]
cmp dword [r12 + 4], 0
jne 0x14000caf0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
movsxd r15, dword [r12]
mov rcx, qword [rcx + 8]
cmp rcx, rdx
je 0x14000c992
mov qword [rsp + 0x28], r12
add r12, 8
mov qword [rsp + 0x20], r12
mov r8d, 1
mov rdx, rbx
mov r9d, 1
call fcn.14000bb80
jmp 0x14000c9e2
mov rcx, r15
shl rcx, 4
call fcn.14006d80c
mov r14, rax
lea rax, [r12 + 8]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
mov r8d, 1
mov rcx, r14
mov rdx, rbx
mov r9d, 1
call fcn.14000bb80
movsxd r8, dword [r12]
shl r8, 4
mov rcx, rbx
mov rdx, r14
call fcn.14008ff30
mov rcx, r14
call fcn.14006cbf8
mov rax, qword [rdi + 8]
movsd xmm0, qword [rax]
movsd xmm1, qword [rax + 8]
movapd xmm2, xmm0
addsd xmm2, xmm1
movsd qword [rsi], xmm2
subsd xmm0, xmm1
mov rax, r15
shl rax, 4
movsd qword [rsi + rax], xmm0
mov qword [rsi + 8], 0
mov qword [rsi + rax + 8], 0
cmp r15d, 2
jl 0x14000cad8
add rax, 0xfffffffffffffff0
shr r15d, 1
shl r15, 4
xor ecx, ecx
movapd xmm0, xmmword [0x140092020]
movapd xmm1, xmmword [0x1400927b0]
nop word cs:[rax + rax]
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
movupd xmm3, xmmword [rdx + rcx + 0x10]
movupd xmm4, xmmword [rdx + rax]
movapd xmm2, xmm3
addpd xmm2, xmm4
subpd xmm3, xmm4
movapd xmm4, xmm3
movsd xmm4, xmm2
movupd xmm5, xmmword [r8 + rcx]
movapd xmm6, xmm2
xorpd xmm6, xmm0
unpckhpd xmm6, xmm2
movapd xmm7, xmm3
unpcklpd xmm7, xmm3
mulpd xmm7, xmm5
shufpd xmm5, xmm5, 1
mulpd xmm5, xmm6
addpd xmm7, xmm5
addpd xmm4, xmm7
mulpd xmm4, xmm1
movupd xmmword [rsi + rcx + 0x10], xmm4
shufpd xmm2, xmm7, 2
shufpd xmm7, xmm3, 2
subpd xmm2, xmm7
mulpd xmm2, xmm1
movupd xmmword [rsi + rax], xmm2
add rax, 0xfffffffffffffff0
add rcx, 0x10
cmp r15, rcx
jne 0x14000ca50
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 2
call fcn.14005a570
lea rcx, str.kiss_fft_usage_error:_improper_alloc_n
mov edx, 0x25
mov r8d, 1
mov r9, rax
call fcn.14006cd3c
mov ecx, 1
call fcn.1400624a4
int3

Function at 0x14000ccc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x20]
jmp fcn.14000ccd0
Function at 0x140024380
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x14002438d
cmp edx, 4
jae 0x140024390
xor eax, eax
jmp 0x1400243d9
xor eax, eax
ret
mov r8d, edx
and r8d, 0xfffffffc
xor eax, eax
lea r9, [0x140094620]
xor al, byte [rcx]
movzx eax, al
movzx r10d, byte [rcx + 1]
xor r10b, byte [rax + r9]
movzx eax, byte [rcx + 2]
movzx r10d, r10b
xor al, byte [r10 + r9]
movzx eax, al
movzx r10d, byte [rcx + 3]
xor r10b, byte [rax + r9]
add rcx, 4
movzx eax, r10b
movzx eax, byte [rax + r9]
add r8d, 0xfffffffc
jne 0x1400243a0
test dl, 3
je 0x140024404
and edx, 3
xor r8d, r8d
lea r9, [0x140094620]
nop dword [rax + rax]
xor al, byte [rcx + r8]
movzx eax, al
movzx eax, byte [rax + r9]
inc r8
cmp edx, r8d
jne 0x1400243f0
ret

Function at 0x140024410
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, r8d
test edx, edx
je 0x1400244c1
mov edx, edx
xor r8d, r8d
lea r9, [0x140094720]
nop dword [rax]
mov rbx, qword [rcx + r8*8]
mov r10, rbx
mov r11, rbx
mov esi, ebx
mov edi, ebx
movzx ebp, bh
movzx r14d, bl
shr rbx, 0x30
xor eax, ebx
movzx ebx, ah
movzx eax, al
movzx eax, word [r9 + rax*2 + 0xc00]
xor ax, word [r9 + rbx*2 + 0xe00]
shr r10, 0x27
and r10d, 0x1fe
xor ax, word [r10 + r9 + 0xa00]
shr r11, 0x1f
and r11d, 0x1fe
xor ax, word [r11 + r9 + 0x800]
shr esi, 0x18
xor ax, word [r9 + rsi*2 + 0x600]
shr edi, 0x10
movzx r10d, dil
xor ax, word [r9 + r10*2 + 0x400]
xor ax, word [r9 + rbp*2 + 0x200]
xor ax, word [r9 + r14*2]
inc r8
cmp edx, r8d
jne 0x140024430
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140024a90
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
test r8d, r8d
je 0x140024aaf
mov eax, r8d
cmp r8d, 8
jae 0x140024ab6
xor r8d, r8d
xor ecx, ecx
jmp 0x140024b40
xor ecx, ecx
jmp 0x140024b59
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024ae0
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024b59
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024b40
cmp ecx, 1
adc ecx, 0
call fcn.140027920
add eax, esi
add rsp, 0x20
pop rsi
ret
Function at 0x140024b70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov edi, r9d
mov esi, ecx
test r8d, r8d
je 0x140024b93
mov eax, r8d
cmp r8d, 8
jae 0x140024b9a
xor r8d, r8d
xor ecx, ecx
jmp 0x140024c20
xor ecx, ecx
jmp 0x140024c39
mov r8d, eax
and r8d, 0xfffffff8
mov ecx, eax
shr ecx, 3
shl rcx, 5
pxor xmm0, xmm0
xor r9d, r9d
pxor xmm1, xmm1
nop word cs:[rax + rax]
movdqu xmm2, xmmword [rdx + r9]
movdqu xmm3, xmmword [rdx + r9 + 0x10]
movdqa xmm4, xmm2
psrad xmm4, 0x1f
pxor xmm2, xmm4
psubd xmm2, xmm4
paddd xmm0, xmm2
movdqa xmm2, xmm3
psrad xmm2, 0x1f
pxor xmm3, xmm2
psubd xmm3, xmm2
paddd xmm1, xmm3
add r9, 0x20
cmp rcx, r9
jne 0x140024bc0
paddd xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddd xmm0, xmm1
pshufd xmm1, xmm0, 0x55
paddd xmm1, xmm0
movd ecx, xmm1
cmp r8, rax
je 0x140024c39
nop
mov r9d, dword [rdx + r8*4]
mov r10d, r9d
neg r10d
cmovs r10d, r9d
add ecx, r10d
inc r8
cmp rax, r8
jne 0x140024c20
cmp ecx, 1
adc ecx, 0
call fcn.140027920
mov ecx, esi
sub ecx, edi
add eax, ecx
cmp eax, esi
cmovle eax, esi
inc eax
add rsp, 0x28
pop rdi
pop rsi
ret

Function at 0x140026d90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp r8d, 8
jl 0x140026e44
lea rax, [0x1400958c0]
nop word cs:[rax + rax]
mov ebx, dword [rdx]
bswap ebx
xor ebx, ecx
mov ecx, ebx
movzx esi, bh
movzx r9d, bl
mov r10d, ebx
shr r10d, 0x18
shr ecx, 0x10
movzx ecx, cl
mov ecx, dword [rax + rcx*4 + 0x1800]
xor ecx, dword [rax + r10*4 + 0x1c00]
xor ecx, dword [rax + rsi*4 + 0x1400]
xor ecx, dword [rax + r9*4 + 0x1000]
movzx r9d, byte [rdx + 4]
xor ecx, dword [rax + r9*4 + 0xc00]
movzx r9d, byte [rdx + 5]
xor ecx, dword [rax + r9*4 + 0x800]
movzx r9d, byte [rdx + 6]
xor ecx, dword [rax + r9*4 + 0x400]
movzx r9d, byte [rdx + 7]
xor ecx, dword [rax + r9*4]
add rdx, 8
lea r9d, [r8 - 8]
cmp r8d, 0xf
mov r8d, r9d
ja 0x140026db0
test r9d, r9d
je 0x140026e4c
test r9b, 1
jne 0x140026e50
mov r8d, r9d
cmp r9d, 1
jne 0x140026e79
jmp 0x140026ec2
mov r9d, r8d
test r9d, r9d
jne 0x140026e30
mov eax, ecx
jmp 0x140026ec2
lea r8d, [r9 - 1]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r10d, byte [rdx]
inc rdx
xor r10d, ecx
lea rcx, [0x1400958c0]
xor eax, dword [rcx + r10*4]
mov ecx, eax
cmp r9d, 1
je 0x140026ec2
mov r8d, r8d
xor r9d, r9d
lea r10, [0x1400958c0]
mov eax, ecx
nop dword [rax + rax]
mov ecx, eax
shl ecx, 8
shr eax, 0x18
movzx r11d, byte [rdx + r9]
xor r11d, eax
xor ecx, dword [r10 + r11*4]
mov eax, ecx
shl eax, 8
shr ecx, 0x18
movzx r11d, byte [rdx + r9 + 1]
xor r11d, ecx
xor eax, dword [r10 + r11*4]
add r9, 2
cmp r8d, r9d
jne 0x140026e90
pop rbx
pop rsi
ret
Function at 0x14002f060
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14002f0f6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14002f0fd
mov r15, rsi
jmp 0x14002f0bb
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.14008ff30
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x14002f0ee
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f0d3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x14002f090
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002f0ee
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x14002f0bb
sub rsi, r15
jmp 0x14002f1ea
xor esi, esi
jmp 0x14002f1ea
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f150
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x14002f150
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.14008ff30
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14002f161
jmp 0x14002f1e7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14002f1e7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14002f190
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x14002f1c3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.14006c978
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14002f190
jmp 0x14002f1e7
test r14, r14
je 0x14002f1e4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.14006c978
sub r14, rax
jmp 0x14002f1e7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140038f20
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1e8], 0xfffffffffffffffe
mov rax, qword [rcx + 0x28]
inc rax
cmp rax, 1
jbe 0x1400390b6
mov rdi, r8
test r8, r8
je 0x140038fb9
mov rbx, rdx
mov rsi, rcx
xor r15d, r15d
lea r14, [rbp + 0x1dc]
mov r12, qword [sym.imp.KERNEL32.dll_WriteFile]
nop word cs:[rax + rax]
mov dword [rbp + 0x1dc], 0
mov r8d, edi
sub r8d, r15d
lea rdx, [rbx + r15]
mov rcx, qword [rsi + 0x28]
mov qword [rsp + 0x20], 0
mov r9, r14
call r12
test eax, eax
je 0x140038fcb
mov eax, dword [rbp + 0x1dc]
add r15, rax
cmp r15, rdi
jb 0x140038f80
add rsp, 0x270
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rdx, str.Error_writing_to_file__
lea rdi, [rbp - 0x58]
mov rcx, rdi
call fcn.140034a30
add rsi, 0x20
mov rcx, rdi
mov rdx, rsi
call fcn.140033190
lea rdx, [0x1400a7522]
lea rcx, [rbp - 0x58]
call fcn.140032dc0
lea rcx, [rbp + 0x1e0]
call fcn.140048850
lea rcx, [rbp - 0x58]
lea rdx, [rbp + 0x1e0]
call fcn.140033190
mov rcx, qword [rbp + 0x1e0]
test rcx, rcx
je 0x140039040
mov qword [rbp + 0x1e0], 0
lock dec dword [rcx + 8]
jne 0x140039040
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rcx, [rbp + 0x1e0]
lea rdx, [rbp - 0x58]
call fcn.140033280
mov dword [rbp + 0x1c0], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c8], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x14003908a
mov qword [rbp + 0x1c8], rax
lock inc dword [rax + 8]
mov qword [rbp + 0x1d0], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp + 0x1b8], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp + 0x1b8]
call fcn.140057d4c
lea rdx, str.File_output_is_no_longer_open
lea rcx, [rbp + 0x1e0]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp + 0x1e0]
test rax, rax
je 0x1400390f7
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp - 0x58]
call fcn.140057d4c
int3
Function at 0x140041930
Capabilities:
Read file on windows

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
test r8, r8
je 0x140041980
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x140041984
mov dword [rbp - 0x14], 0
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x14]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400419e4
mov eax, dword [rbp - 0x14]
add rsp, 0x80
pop rbp
ret
xor eax, eax
jmp 0x140041977
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400419bf
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp - 0x58]
call fcn.140057d4c
jmp 0x140041a42
lea rdx, str.ReadFile___failed
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140041a1f
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp - 0x38]
call fcn.140057d4c
int3

Function at 0x140042390
Capabilities:
Get file size

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rcx, qword [rcx + 0x28]
test rcx, rcx
je 0x1400423cc
lea rdx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14004242c
mov rax, qword [rbp - 0x10]
add rsp, 0x80
pop rbp
ret
lea rdx, str.File_is_not_open
lea rcx, [rbp - 0x10]
call fcn.140032870
mov dword [rbp - 0x50], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x140042407
mov qword [rbp - 0x48], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x40], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x58], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp - 0x58]
call fcn.140057d4c
jmp 0x14004248a
lea rdx, str.Could_not_get_length_of_file
lea rcx, [rbp - 0x18]
call fcn.140032870
mov dword [rbp - 0x30], 0
lea rax, vtable.base::core::Exception.0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0
mov rax, qword [rbp - 0x18]
test rax, rax
je 0x140042467
mov qword [rbp - 0x28], rax
lock inc dword [rax + 8]
mov qword [rbp - 0x20], 0
lea rax, vtable.base::core::IOException.0
mov qword [rbp - 0x38], rax
lea rdx, [0x1400b3e70]
lea rcx, [rbp - 0x38]
call fcn.140057d4c
int3