joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055190
Capabilities:
Get file size

Disassembly:
push rdi
push r14
sub rsp, 0x4b8
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x490], rax
cmp dword [rdx + 0xc], 0
mov r14, rdx
mov rdi, rcx
je 0x1400551f8
lea rcx, [rsp + 0x50]
sub rcx, rdi
movzx eax, byte [rdi]
lea rdi, [rdi + 1]
mov byte [rcx + rdi - 1], al
test al, al
jne 0x1400551c1
movsxd r8, dword [rdx + 8]
mov rdx, qword [rdx]
lea rax, [0x140051a20]
lea rcx, [rsp + 0x50]
mov r9d, 0x438
mov qword [rsp + 0x20], rax
call fcn.1401c37d8
jmp 0x140055340
mov qword [rsp + 0x4d0], rbx
mov rbx, qword [rdx]
mov qword [rsp + 0x4e0], rbp
mov qword [rsp + 0x4a8], r12
xor r12d, r12d
mov qword [rsp + 0x4a0], r15
mov ebp, r12d
mov r15d, r12d
cmp dword [rdx + 8], ebp
jle 0x140055315
mov qword [rsp + 0x4b0], rsi
nop word [rax + rax]
lea r9, [rbx + 0x108]
or edx, 0xffffffff
mov r8d, 0x70000
mov rcx, rbx
call fcn.140064210
test ax, ax
jne 0x140055264
or dword [rbx + 0x104], 1
xor r9d, r9d
mov qword [rsp + 0x30], r12
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rbx
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400552d5
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
lea r9, [rbx + 0x418]
lea r8, [rbx + 0x410]
mov ecx, eax
lea rdx, [rbx + 0x408]
mov qword [rbx + 0x428], rcx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8, rbx
mov rax, rdi
sub r8, rdi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400552f3
inc rax
test ecx, ecx
jne 0x1400552e0
test edx, edx
cmove rbp, rbx
inc r15d
add rbx, 0x438
cmp r15d, dword [r14 + 8]
jl 0x140055240
mov rsi, qword [rsp + 0x4b0]
mov r15, qword [rsp + 0x4a0]
mov r12, qword [rsp + 0x4a8]
mov rbx, qword [rsp + 0x4d0]
mov rax, rbp
mov rbp, qword [rsp + 0x4e0]
mov dword [r14 + 0xc], 1
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x4b8
pop r14
pop rdi
ret
Function at 0x1400557e0
Capabilities:
Get file size

Disassembly:
sub rsp, 0x48
test byte [rcx], 1
je 0x1400557f2
mov rax, qword [rcx + 0x38]
add rsp, 0x48
ret
mov rdx, qword [rcx + 0x58]
add rcx, 0x60
test rdx, rdx
je 0x14005581a
call fcn.140055190
test rax, rax
je 0x140055815
mov rax, qword [rax + 0x428]
add rsp, 0x48
ret
add rsp, 0x48
ret
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
test rax, rax
je 0x140055881
lea rdx, [rsp + 0x50]
mov rcx, rax
mov qword [rsp + 0x58], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x40]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
ret

Function at 0x140058410
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140058443
call fcn.140071b30
cmp byte [rbx + 0x58], 0
je 0x14005843c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1400584d5
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x1400584bc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14005846e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1400584b4
cmp eax, 2
je 0x1400584bc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140058460
dec eax
test eax, 0xfffffffd
jne 0x140058460
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140058460
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140058460
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140058510
cmp eax, 0xcc
je 0x1400584f7
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x14
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140058510
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14005853e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], edi
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], dil
je 0x14005856f
nop dword [rax + rax]
mov rax, qword [rbx]
mov rcx, rbx
mov dword [rax + 0x28], 0x30
mov rax, qword [rbx]
call qword [rax]
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], dil
jne 0x140058550
cmp byte [rbx + 0x59], dil
mov al, 1
setne dil
add edi, 0xcd
mov dword [rbx + 0x24], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140058510
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140058443
call fcn.140071b30
cmp byte [rbx + 0x58], 0
je 0x14005843c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x1400584d5
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x20], 0
je 0x1400584bc
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14005846e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1400584b4
cmp eax, 2
je 0x1400584bc
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140058460
dec eax
test eax, 0xfffffffd
jne 0x140058460
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140058460
mov ecx, dword [rbx + 0x184]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140058460
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x140058510
cmp eax, 0xcc
je 0x1400584f7
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x14
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140058510
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14005853e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], edi
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], dil
je 0x14005856f
nop dword [rax + rax]
mov rax, qword [rbx]
mov rcx, rbx
mov dword [rax + 0x28], 0x30
mov rax, qword [rbx]
call qword [rax]
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], dil
jne 0x140058550
cmp byte [rbx + 0x59], dil
mov al, 1
setne dil
add edi, 0xcd
mov dword [rbx + 0x24], edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14005a850
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
test dword [rdx + 0xc0], 0x10000
movsxd rbx, r8d
mov rbp, rdx
mov rsi, rcx
je 0x14005a8cf
lea eax, [rbx + 1]
mov qword [rsp + 0x30], rdi
movsxd rcx, eax
call fcn.1401bee78
mov rdi, rax
test rax, rax
je 0x14005a8ba
mov r9, qword [rsi]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.1401c1e14
xor r8d, r8d
mov rdx, rdi
mov rcx, rbp
mov byte [rbx + rdi], 0
call fcn.14005a720
mov rcx, rdi
call fcn.1401be23c
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rdx, rbx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.140066ff0
Function at 0x14005ada0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
test dword [rdx + 0xc0], 0x10000
mov r14, r8
mov rbp, rdx
mov rsi, rcx
je 0x14005ae2f
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
movsxd rdi, r9d
mov rcx, rdi
call fcn.1401bee78
mov rbx, rax
test rax, rax
je 0x14005ae14
mov r9, qword [rsi]
mov r8d, 1
mov rdx, rdi
mov rcx, rax
call fcn.1401c1e14
xor r9d, r9d
mov r8, rbx
mov rdx, r14
mov rcx, rbp
mov byte [rdi + rbx - 1], 0
call fcn.14005ac50
mov rcx, rbx
call fcn.1401be23c
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
movsxd rdx, r9d
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.140066ff0

Function at 0x14005c320
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
cmp dword [0x1402acc28], 0
jne 0x14005c352
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
or edx, 0xffffffff
mov rcx, rax
mov qword [0x1402acc10], rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x1402acc10]
or edx, 0xffffffff
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
Function at 0x140061d20
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, r8
xor ebp, ebp
mov r14, rdx
test byte [rbx], 4
mov r15, rcx
movzx r8d, bp
je 0x140061df7
movzx eax, word [rbx + 0x20]
cmp ax, 1
jle 0x140061df7
mov qword [rsp + 0x40], rsi
mov esi, ebp
cmp bp, ax
jge 0x140061df1
mov qword [rsp + 0x48], rdi
lea r12d, [rbp + 4]
test r8w, r8w
jne 0x140061dce
mov edi, ebp
cmp dword [rbx + 0x1c], ebp
jle 0x140061dc4
movsxd rdx, dword [rbx + 0x28]
mov r9, qword [r15]
mov rcx, qword [rbx + 0x10]
mov r8d, 1
call fcn.1401c1e14
test rax, rax
je 0x140061dc1
mov r9d, 1
or r8d, 0xffffffff
mov edx, esi
mov rcx, r14
call fcn.1400615b0
movzx r8d, ax
test ax, ax
jne 0x140061dc4
inc edi
cmp edi, dword [rbx + 0x1c]
jl 0x140061d80
jmp 0x140061dc4
mov r8d, r12d
movsx eax, word [rbx + 0x20]
inc esi
cmp esi, eax
jl 0x140061d73
mov rdi, qword [rsp + 0x48]
movzx eax, r8w
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
movzx eax, r8w
jmp 0x140061dd7
cmp dword [rbx + 0x1c], ebp
jle 0x140061e49
nop dword [rax]
movsx r8, word [rbx + 0x20]
movsxd rdx, dword [rbx + 0x28]
mov r9, qword [r15]
mov rcx, qword [rbx + 0x10]
call fcn.1401c1e14
movsx rcx, word [rbx + 0x20]
cmp rax, rcx
jne 0x140061e42
or r8d, 0xffffffff
mov r9d, 1
mov rcx, r14
or edx, r8d
call fcn.1400615b0
test ax, ax
jne 0x140061ddc
inc ebp
cmp ebp, dword [rbx + 0x1c]
jl 0x140061e00
jmp 0x140061ddc
mov eax, 4
jmp 0x140061ddc
movzx eax, r8w
jmp 0x140061ddc
Function at 0x140063dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, dword [rcx + 0x10]
mov r10, r8
mov rbx, rcx
lea eax, [r9 + 1]
mov dword [rcx + 0x10], eax
cmp r9d, dword [rcx + 0x14]
jl 0x140063de8
mov eax, 7
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call fcn.140061f50
test r10, r10
je 0x140063e0a
mov rcx, qword [rbx]
mov rdx, r10
call fcn.140061ed0
mov rdi, qword [rbx]
lea rcx, str.tiff
movsx esi, word [rdi + 0x80]
call fcn.140064760
cmp esi, eax
jne 0x140063e42
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp 0x1400c2ef0
lea rcx, [0x1401fc6d0]
call fcn.140064760
cmp esi, eax
jne 0x140063e70
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400d13d0
lea rcx, [0x14020d41c]
call fcn.140064760
cmp esi, eax
jne 0x140063e9e
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e85b0
lea rcx, [0x1401f89fc]
call fcn.140064760
cmp esi, eax
jne 0x140063ecc
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e5d50
lea rcx, [0x1401fc6cc]
call fcn.140064760
mov rdx, qword [rbx + 8]
mov r8, rdi
mov rcx, rbx
cmp esi, eax
jne 0x140063efa
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400e1cc0
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.1400df9c0
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rdi, r8
mov rbx, rdx
mov r8, rdx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400c30e0
test ax, ax
jne 0x1400c2fd6
mov qword [rsp + 0x110], rsi
cmp word [rbx + 0x32], ax
jne 0x1400c2f9c
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov rcx, qword [rcx]
lea r8d, [rdx + 2]
call fcn.1401c1f88
mov rcx, qword [rbx + 0x38]
mov rcx, qword [rcx]
call fcn.1401c2310
mov rcx, qword [rbx + 0x38]
mov edx, dword [rbx + 0x28]
mov dword [rsp + 0x30], eax
mov rcx, qword [rcx]
xor r8d, r8d
call fcn.1401c1f88
mov r9, qword [rbx + 0x38]
mov edx, 1
mov r9, qword [r9]
lea r8d, [rdx + 3]
lea rcx, [rsp + 0x30]
call fcn.1401c24f8
mov rcx, qword [rbx + 0x38]
xor edx, edx
mov rcx, qword [rcx]
lea r8d, [rdx + 2]
call fcn.1401c1f88
mov rcx, qword [rbx + 0x38]
xor esi, esi
mov word [rbx + 0x32], si
mov rcx, qword [rcx]
call fcn.1401c2310
mov rcx, qword [rbx + 0x38]
lea r8, [rsp + 0x40]
mov r9, rbx
mov rdx, rdi
mov dword [rsp + 0x20], eax
call fcn.1400c3630
test ax, ax
jne 0x1400c2fce
movzx eax, si
mov rsi, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1401bd600
mov rbx, qword [rsp + 0x128]
add rsp, 0x100
pop rdi
ret
Function at 0x140065ff0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
call fcn.1401c2588
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileA]
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
add rsp, 0x20
pop rdi
ret

Function at 0x140066090
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
xorps xmm0, xmm0
mov ebx, 4
mov r9, rcx
lea r8d, [rbx - 3]
lea rcx, [rsp + 0x38]
mov edx, ebx
cvtsd2ss xmm0, xmm1
movss dword [rsp + 0x38], xmm0
call fcn.1401c24f8
test rax, rax
jne 0x1400660c9
movzx eax, bx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400661b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [0x14020ebc8]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x140
pop rbx
ret

Function at 0x1400667d0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x14006681b
mov eax, 4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop rbx
ret
movsd xmm0, qword [rsp + 0x20]
xor eax, eax
movsd qword [rbx], xmm0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop rbx
ret

Function at 0x140066840
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov rbx, rdx
mov edx, 8
lea r8d, [rdx - 7]
lea rcx, [rsp + 0x20]
call fcn.1401c1e14
test rax, rax
jne 0x14006688b
mov eax, 4
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop rbx
ret
movzx eax, byte [rsp + 0x27]
movzx ecx, byte [rsp + 0x20]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x26]
mov byte [rsp + 0x27], cl
movzx ecx, byte [rsp + 0x21]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x25]
mov byte [rsp + 0x26], cl
movzx ecx, byte [rsp + 0x22]
mov byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x24]
mov byte [rsp + 0x25], cl
movzx ecx, byte [rsp + 0x23]
mov byte [rsp + 0x23], al
mov byte [rsp + 0x24], cl
xor eax, eax
movsd xmm0, qword [rsp + 0x20]
movsd qword [rbx], xmm0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x30
pop rbx
ret
Function at 0x140066900
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov edi, 4
mov rbx, rdx
lea r8d, [rdi - 3]
lea rcx, [rsp + 0x30]
mov edx, edi
call fcn.1401c1e14
test rax, rax
jne 0x140066938
movzx eax, di
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movss xmm0, dword [rsp + 0x30]
xor eax, eax
cvtps2pd xmm0, xmm0
movsd qword [rbx], xmm0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140066960
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov edi, 4
mov rbx, rdx
lea r8d, [rdi - 3]
lea rcx, [rsp + 0x30]
mov edx, edi
call fcn.1401c1e14
test rax, rax
jne 0x140066998
movzx eax, di
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rsp + 0x33]
movzx ecx, byte [rsp + 0x30]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x33], cl
movzx ecx, byte [rsp + 0x31]
mov byte [rsp + 0x31], al
xor eax, eax
mov byte [rsp + 0x32], cl
movss xmm0, dword [rsp + 0x30]
cvtps2pd xmm0, xmm0
movsd qword [rbx], xmm0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400669e0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov edx, 8
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c1e14
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x27]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x25]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x24]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x23]
shl rdx, 8
or rax, rdx
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x21]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x20]
shl rax, 8
or rax, rcx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x38
ret

Function at 0x140066a80
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1402a83b0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r9, qword [rcx]
mov edx, 8
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
call fcn.1401c1e14
movzx eax, byte [rsp + 0x21]
movzx ecx, byte [rsp + 0x25]
movzx edx, byte [rsp + 0x20]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x22]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x23]
shl rdx, 8
or rdx, rax
movzx eax, byte [rsp + 0x24]
shl rdx, 8
or rax, rdx
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x26]
shl rax, 8
or rax, rcx
movzx ecx, byte [rsp + 0x27]
shl rax, 8
or rax, rcx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1401bd600
add rsp, 0x38
ret

Function at 0x140066b20
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx]
mov edx, 4
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 3]
call fcn.1401c1e14
movzx ecx, byte [rsp + 0x32]
movzx eax, byte [rsp + 0x33]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x31]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x30]
shl eax, 8
or eax, ecx
add rsp, 0x28
ret
Function at 0x140066b70
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov r9, qword [rcx]
mov edx, 4
lea rcx, [rsp + 0x30]
lea r8d, [rdx - 3]
call fcn.1401c1e14
movzx ecx, byte [rsp + 0x31]
movzx eax, byte [rsp + 0x30]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x32]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0x33]
shl eax, 8
or eax, ecx
add rsp, 0x28
ret

Function at 0x140066bc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r9, qword [r9]
movsxd rdi, edx
mov esi, r8d
mov r8d, 2
mov rdx, rdi
mov rbx, rcx
call fcn.1401c1e14
cmp rax, 2
je 0x140066c01
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test esi, esi
jne 0x140066c2d
xor eax, eax
test rdi, rdi
jle 0x140066c2d
nop dword [rax]
movzx ecx, word [rbx + rax*2]
movzx edx, byte [rbx + rax*2 + 1]
inc rax
shl cx, 8
or dx, cx
mov word [rbx + rax*2 - 2], dx
cmp rax, rdi
jl 0x140066c10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140066c50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rbp, r8d
mov r14d, r9d
mov r9, qword [rsp + 0x50]
mov r9, qword [r9]
mov rdi, rdx
mov r8d, 2
mov rdx, rbp
mov rbx, rcx
mov rsi, rbp
call fcn.1401c1e14
cmp rax, 2
je 0x140066c9c
xor eax, eax
jmp 0x140066d7b
xor eax, eax
test r14d, r14d
je 0x140066d53
test ebp, ebp
jle 0x140066d34
cmp ebp, 0x10
jb 0x140066d34
lea ecx, [rbp - 1]
movsxd rdx, ecx
lea rcx, [rbx + rdx*2]
lea r8, [rdx + rdi]
cmp rdi, rcx
ja 0x140066cd0
cmp r8, rbx
jae 0x140066d34
mov ecx, ebp
and ecx, 0x8000000f
jge 0x140066ce1
dec ecx
or ecx, 0xfffffff0
inc ecx
sub ebp, ecx
mov ecx, 8
movd xmm1, ecx
nop dword [rax]
movsxd rcx, eax
movdqu xmm0, xmmword [rbx + rcx*2]
psrlw xmm0, xmm1
pand xmm0, xmmword [0x14020ebd0]
packuswb xmm0, xmm0
movq qword [rcx + rdi], xmm0
lea ecx, [rax + 8]
add eax, 0x10
movsxd rdx, ecx
movdqu xmm0, xmmword [rbx + rdx*2]
psrlw xmm0, xmm1
pand xmm0, xmmword [0x14020ebd0]
packuswb xmm0, xmm0
movq qword [rdx + rdi], xmm0
cmp eax, ebp
jl 0x140066cf0
movsxd rcx, eax
cmp rcx, rsi
jge 0x140066d76
nop dword [rax]
movzx eax, byte [rbx + rcx*2 + 1]
inc rcx
mov byte [rcx + rdi - 1], al
cmp rcx, rsi
jl 0x140066d40
jmp 0x140066d76
test ebp, ebp
jle 0x140066d76
nop word [rax + rax]
movzx ecx, word [rbx + rax*2]
inc rax
shl ecx, 8
sar ecx, 8
mov byte [rax + rdi - 1], cl
cmp rax, rbp
jl 0x140066d60
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140067060
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx]
xorps xmm0, xmm0
mov ebx, 4
lea r8d, [rbx - 3]
lea rcx, [rsp + 0x30]
cvtsd2ss xmm0, xmm1
movss dword [rsp + 0x30], xmm0
movzx edx, byte [rsp + 0x30]
movzx eax, byte [rsp + 0x33]
mov byte [rsp + 0x33], dl
movzx edx, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x32], dl
mov edx, ebx
mov byte [rsp + 0x31], al
call fcn.1401c24f8
test rax, rax
jne 0x1400670bd
movzx eax, bx
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140067130
Capabilities:
Write file on windows

Disassembly:
mov rax, rdx
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140067140
mov r9, qword [rcx]
mov edx, 1
mov rcx, rax
jmp fcn.1401c24f8