joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007af60
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rsi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
jbe 0x14007af95
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x20], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14007a030
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14007b104
mov qword [rsp + 0x50], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rbp
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rbx
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rbx
xor r11, rdx
imul r11, rbx
and r11, qword [rsi + 0x30]
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x14007b079
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14007b0f3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14007b0b6
mov r10, qword [rdx]
cmp r10, rax
je 0x14007b0b0
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14007b0f3
cmp r9, rdx
je 0x14007b0cf
nop dword [rax + rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14007b115
cmp r9, rdx
jne 0x14007b0c0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x14007b000
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rsi
pop rbx
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14007b0f3
Function at 0x14007b140
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14007b171
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14009fa18]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14009fa28]
lea rdx, [rdi + rdi]
call fcn.14007a030
mov rax, qword [0x14009fa18]
lea r9, [rdi - 1]
mov qword [0x14009fa40], r9
mov qword [0x14009fa48], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14007b312
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14009fa28]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14007b25c
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14007b2d3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x14007b299
mov r10, qword [rdx]
cmp r10, rax
je 0x14007b293
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14007b2d3
cmp r9, rdx
je 0x14007b2af
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x14007b2e7
cmp r9, rdx
jne 0x14007b2a0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14007b30d
mov r9, qword [0x14009fa40]
jmp 0x14007b1e1
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14007b2d3
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007f7a4
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14007f7de
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14007f7e3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14007f82c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140084a60]
cmp byte [rcx + rax], 0
je 0x14007f82c
dec r8
sub rdx, 1
jne 0x14007f812
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140080eac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140080ef6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140080ef6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140080ef6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140080ef6
cmp dword [rcx + 0x84], 0xe
jbe 0x140080ef6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140080ef8
xor al, al
add rsp, 0x28
ret
Function at 0x3a98a15b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rsi
push rbx
sub rsp, 0x58
mov r8d, 0x1000
mov edx, 0x6b800
mov rbx, rcx
mov rsi, r9
xor ecx, ecx
mov r9d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, [rsp + 0x30]
mov r9, rsi
mov rcx, rbx
mov qword [rsp + 0x30], rax
lea rax, [0x3a996206e]
mov r8d, 1
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], eax
call fcn.3a98a1420
add rsp, 0x58
pop rbx
pop rsi
ret

Function at 0x3a98a5540
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
xor r8d, r8d
mov eax, r8d
mov ecx, r8d
cpuid
mov r10d, eax
mov r9d, eax
test eax, eax
je 0x3a98a55ea
mov eax, 1
mov ecx, r8d
cpuid
mov eax, ecx
mov r11d, ecx
shr eax, 9
and eax, 1
mov r9d, eax
or r9d, 2
test ecx, 0x80000
cmove r9d, eax
mov eax, r9d
or eax, 4
test ecx, 0x100000
cmovne r9d, eax
test ecx, 0x8000000
je 0x3a98a55be
mov ecx, r8d
xgetbv
and r11d, 0x10000000
je 0x3a98a55be
mov edx, r9d
and eax, 6
or edx, 8
cmp rax, 6
cmove r9d, edx
cmp r10d, 6
jbe 0x3a98a55ea
mov eax, 7
xor ecx, ecx
cpuid
mov eax, r9d
or eax, 0x10
test bh, 1
cmovne r9d, eax
mov eax, r9d
or eax, 0x20
and ebx, 0x20000000
cmovne r9d, eax
lea rcx, str.WIMLIB_DISABLE_CPU_FEATURES
mov dword [0x3a9982030], r9d
call sub.msvcrt.dll_getenv
mov edi, dword [0x3a9982030]
mov rbx, rax
test rax, rax
jne 0x3a98a5634
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rdx, rsi
mov rcx, rbx
sub rdx, rbx
lea rbx, [rsi + 1]
call fcn.3a98a54c0
not eax
and edi, eax
mov dword [0x3a9982030], edi
mov edx, 0x2c
mov rcx, rbx
call sub.msvcrt.dll_strchr
mov rsi, rax
test rax, rax
jne 0x3a98a5618
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rdx, rax
call fcn.3a98a54c0
not eax
and eax, edi
mov dword [0x3a9982030], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x3a98adef0
Capabilities:
Create directory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call qword [sym.imp.msvcrt.dll__wmkdir]
test eax, eax
jne 0x3a98adf10
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rsi, qword [sym.imp.msvcrt.dll__errno]
call rsi
cmp dword [rax], 0x11
je 0x3a98adf03
call rsi
cmp dword [rax], 0xd
jne 0x3a98f21d7
jmp 0x3a98adf03
mov rdx, rbx
lea rcx, str.Failed_to_create_directory___ls_
call fcn.3a98f208a
mov eax, 0x25
jmp 0x3a98adf05
Function at 0x3a98cb240
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r13, qword [fcn.3a98f1190]
mov ebp, 0x39
xor edi, edi
xor esi, esi
xor r12d, r12d
mov r15, rcx
mov r14, rdx
jmp 0x3a98cb273
mov r12, rbx
lea rdi, [rdi + rdi + 0x100]
sub ebp, 1
je 0x3a98f2e50
mov rdx, rdi
mov rcx, r12
call fcn.3a98cd970
mov rbx, rax
test rax, rax
je 0x3a98f2e50
xor ecx, ecx
call r13
mov r8, rdi
lea rcx, [rbx + rsi]
mov edx, 1
sub r8, rsi
mov r9, rax
call sub.msvcrt.dll_fread
add rsi, rax
cmp rdi, rsi
je 0x3a98cb270
xor ecx, ecx
call r13
mov rcx, rax
call sub.msvcrt.dll_feof
test eax, eax
je 0x3a98f2e6e
mov qword [r15], rbx
xor eax, eax
mov qword [r14], rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.Too_much_data_sent_on_stdin_
call fcn.3a98f204c
mov rcx, r12
call fcn.3a98cd960
mov eax, 0x18
jmp 0x3a98cb2dc
lea rcx, str.Error_reading_stdin
call fcn.3a98f208a
mov rcx, rbx
call fcn.3a98cd960
mov eax, 0x32
jmp 0x3a98cb2dc

Function at 0x3a98cbaa0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx + 8], rdx
mov rbx, rcx
mov r9, rcx
xor edx, edx
mov qword [rcx + 0x10], r8
xor ecx, ecx
lea r8, [0x3a98cba80]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x3a98cbae8
mov qword [rbx], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_create_thread
mov ecx, eax
call fcn.3a98f4925
xor eax, eax
jmp 0x3a98cbae2

Function at 0x3a98d4d10
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
cmp qword [rcx + 0x158], 0
mov rbx, rcx
mov rdi, rdx
je 0x3a98d4d80
lea rcx, [rbx + 0x48]
lea r8, [rsp + 0x28]
mov rdx, rbx
mov rbp, qword [rbx + 0x58]
call fcn.3a98c4900
mov esi, eax
test eax, eax
jne 0x3a98d4d6b
mov rcx, qword [rsp + 0x28]
mov r9, rdi
mov r8, rbp
mov edx, 1
call sub.msvcrt.dll_fwrite
cmp rax, rbp
jne 0x3a98f35f2
mov rcx, qword [rsp + 0x28]
call fcn.3a98cd960
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rcx + 0x160]
mov esi, 0x2d
call fcn.3a98b0a50
test al, al
je 0x3a98d4d28
jmp 0x3a98d4d6b
lea rcx, str.Failed_to_extract_XML_data
mov esi, 0x48
call fcn.3a98f208a
nop
jmp 0x3a98d4d61
Function at 0x3a98da3c0
Capabilities:
Clear file content

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
movups xmmword [rsp + 0xb0], xmm6
movups xmmword [rsp + 0xc0], xmm7
cmp byte [rsp + 0x140], 0
mov rbx, rcx
mov r15, rdx
mov rsi, r8
je 0x3a98da4e0
mov r14d, 4
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x5c]
movq xmm7, qword [0x3a9972cf0]
lea r13, [rsp + 0x4c]
pxor xmm6, xmm6
movdqu xmm1, xmmword [r15 + 0x18]
mov eax, dword [r15 + 0x28]
movups xmmword [rdi], xmm6
mov r8, rbp
mov dword [rdi + 0x20], 0
mov r9d, 0x30
mov edx, 0x9030c
mov rcx, rbx
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x60], rsi
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
movq qword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x68], xmm1
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x3a98da610
mov rax, qword [0x3a9979bc0]
cmp byte [rax], 0
je 0x3a98f466b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, 0x30
lea rcx, str.FSCTL_SET_EXTERNAL_BACKING_failed__err_u___data_was__zu_bytes:
mov edx, eax
call fcn.3a98f20cb
mov r12, qword [0x3a9979bb0]
mov rcx, rbp
mov edx, 0x30
mov r8, qword [r12]
call fcn.3a98ad4f0
mov rdx, qword [r12]
mov ecx, 0xa
call sub.msvcrt.dll_putc
nop
jmp 0x3a98f466b
movdqu xmm2, xmmword [rdx + 0x18]
movdqu xmm3, xmmword [r9]
lea rdi, [rsp + 0x4c]
movabs rax, 0x5880000017
mov qword [rsp + 0x50], rax
mov eax, dword [rdx + 0x28]
movdqu xmm0, xmmword [0x3a9972cf0]
movups xmmword [rsp + 0x70], xmm2
mov rsi, qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [rsp + 0x80], eax
mov eax, dword [r9 + 0x10]
mov r9d, 0x60
movups xmmword [rsp + 0x58], xmm0
movq xmm0, qword [rdx + 0x10]
mov dword [rsp + 0x94], eax
mov rax, qword [rdx + 0x40]
mov edx, 0x900a4
movups xmmword [rsp + 0x84], xmm3
mov qword [rsp + 0x68], r8
lea r8, [rsp + 0x50]
movhps xmm0, qword [rax + 0x10]
movups xmmword [rsp + 0x98], xmm0
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
jne 0x3a98da5b8
xor eax, eax
movups xmm6, xmmword [rsp + 0xb0]
movups xmm7, xmmword [rsp + 0xc0]
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rdi
mov edx, 0x900c4
mov qword [rsp + 0x38], 0
mov rcx, rbx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rsi
test eax, eax
je 0x3a98da58f
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [r15 + 0x10]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x3a98da58f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x3a98da58f
nop
mov eax, 1
jmp 0x3a98da591
sub r14d, 1
je 0x3a98f468e
lea rcx, str.Retrying_after_100ms...
call fcn.3a98f20cb
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x3a98da41b
lea rcx, [0x3a9972c98]
call fcn.3a98f20cb
nop
jmp 0x3a98da58f
Function at 0x3a98dbb40
Capabilities:
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov eax, dword [rdx + 0x34]
mov rsi, rcx
mov rbx, r8
test byte [r8 + 0x1a], 0x10
jne 0x3a98dbb66
mov edx, dword [r8 + 0x104]
test edx, edx
jne 0x3a98dbb78
xor eax, eax
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsp + 0x20], 4
and eax, 0x800
lea rdx, [r8 + 0x220]
mov r9d, 0x28
lea r8, [rsp + 0x50]
setne bpl
mov edi, eax
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
js 0x3a98dbbb5
mov eax, dword [rsp + 0x70]
shr eax, 0xb
and eax, 1
cmp bpl, al
je 0x3a98dbb66
mov qword [rsp + 0x30], 0
mov rcx, rsi
movzx ebp, bpl
mov r9d, 2
lea r8, [rsp + 0x4e]
mov edx, 0x9c040
mov word [rsp + 0x4e], bp
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call fcn.3a98daa10
mov esi, eax
test eax, eax
jns 0x3a98dbb66
mov rcx, rbx
call fcn.3a98dacc0
test edi, edi
lea r8, str.clear
mov ecx, esi
mov r9, rax
lea rax, [0x3a9973690]
lea rdx, str.Cant__s_compression_attribute_on___ls_
cmovne r8, rax
call fcn.3a98f4982
mov eax, 0x39
jmp 0x3a98dbb68
Function at 0x3a98dec00
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0xb0
mov r9d, 0x68
mov dword [rsp + 0x20], 0x12
mov rbx, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jns 0x3a98dec33
cmp eax, 0x80000005
jne 0x3a98dec7d
movq xmm1, qword [rsp + 0x78]
movq xmm0, qword [rsp + 0x60]
mov rax, qword [rsp + 0x70]
punpckldq xmm0, xmm1
movq xmm1, qword [rsp + 0x40]
movq qword [rbx], xmm0
movq xmm0, qword [rsp + 0x48]
mov qword [rbx + 0x28], rax
mov eax, dword [rsp + 0x88]
movhps xmm1, qword [rsp + 0x50]
movhps xmm0, qword [rsp + 0x80]
movups xmmword [rbx + 8], xmm1
mov dword [rbx + 0x30], eax
xor eax, eax
movups xmmword [rbx + 0x18], xmm0
add rsp, 0xb0
pop rbx
ret

Function at 0x3a98def40
Capabilities:
Get file attributes

Disassembly:
push rsi
push rbx
sub rsp, 0xc8
mov r9d, pe_nt_image_headers64
mov dword [rsp + 0x20], 0x15
mov rsi, rdx
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
call sub.ntdll.dll_NtQueryInformationFile
mov ebx, eax
test eax, eax
js 0x3a98def77
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x3a98def88
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
ret
lea rcx, [rsp + 0x44]
call fcn.3a98ad3d0
mov qword [rsi + 0x40], rax
test rax, rax
je 0x3a98defaf
mov eax, dword [rsp + 0x40]
mov word [rsi + 0x4a], ax
mov eax, ebx
add rsp, 0xc8
pop rbx
pop rsi
ret
mov ebx, 0xc0000017
jmp 0x3a98def77
Function at 0x3a98df8d0
Capabilities:
Get file attributes

Disassembly:
push r15
mov eax, 0x1068
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.3a98e4420
sub rsp, rax
mov rdi, rcx
mov r12, rdx
mov r14, r8
mov rbp, r9
test byte [r9 + 0xe], 4
je 0x3a98df9c8
lea r13, [rsp + 0x60]
mov esi, 0x1000
lea r15, [rsp + 0x40]
mov rbx, r13
mov r9d, esi
mov r8, rbx
mov rdx, r15
mov rcx, rdi
mov dword [rsp + 0x20], 0x16
call sub.ntdll.dll_NtQueryInformationFile
test eax, eax
jns 0x3a98dfa38
cmp eax, 0x80000005
jne 0x3a98df960
add rsi, rsi
cmp rbx, r13
je 0x3a98df9b8
mov rdx, rsi
mov rcx, rbx
call fcn.3a98cd970
test rax, rax
je 0x3a98dfa80
mov rbx, rax
jmp 0x3a98df912
jl 0x3a98f4cb5
cmp eax, 0xc0000004
jge 0x3a98df9a8
cmp eax, 0xc0000002
jl 0x3a98f4cb5
xor eax, eax
test dword [r12 + 0x34], 0x410
je 0x3a98df9db
cmp rbx, r13
jne 0x3a98dfa1c
add rsp, 0x1068
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0xc00000bb
je 0x3a98df978
jmp 0x3a98f4cb5
mov rcx, rsi
call fcn.3a98cd930
jmp 0x3a98df94d
xor eax, eax
test dword [rdx + 0x34], 0x410
jne 0x3a98df98e
lea r13, [rsp + 0x60]
mov rbx, r13
mov qword [rsp + 0x20], rbp
lea rcx, [rsp + 0x50]
mov r9, r12
mov r8, r14
movabs rdx, 0x4100540041
movabs rax, 0x440024003a003a
mov qword [rsp + 0x58], rdx
mov edx, 7
mov qword [rsp + 0x50], rax
call fcn.3a98df820
cmp rbx, r13
je 0x3a98df98e
mov rcx, rbx
mov dword [rsp + 0x3c], eax
call fcn.3a98cd960
mov eax, dword [rsp + 0x3c]
jmp 0x3a98df98e
xor eax, eax
cmp qword [rsp + 0x48], 0
je 0x3a98df985
mov rsi, rbx
jmp 0x3a98dfa5d
mov edx, dword [rsi]
test edx, edx
je 0x3a98df985
add rsi, rdx
mov edx, dword [rsi + 4]
mov r8, qword [rsi + 8]
mov qword [rsp + 0x20], rbp
lea rcx, [rsi + 0x18]
mov r9, r12
shr edx, 1
call fcn.3a98df820
test eax, eax
je 0x3a98dfa50
jmp 0x3a98df985
mov eax, 0x27
jmp 0x3a98df985
mov rdx, qword [rbp]
mov ecx, eax
mov r8, qword [rdx + 0xb0]
lea rdx, str.__ls_:_Failed_to_query_stream_information
add r8, 8
call fcn.3a98f4982
mov eax, 0x32
jmp 0x3a98df985
Function at 0x3a98e2680
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov r14d, dword [rsp + 0xd0]
mov dword [rsp + 0x34], 0xffffffff
mov r12, rdx
mov rdi, r8
mov rbp, r9
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x3a98e27b8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 3
je 0x3a98e27df
xor edx, edx
mov r9d, 1
lea r8, [rsp + 0x38]
mov rcx, rbx
mov r13, qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
call r13
test eax, eax
je 0x3a98e27ed
mov esi, 0x100000
pxor xmm0, xmm0
lea r15, [rsp + 0x40]
cmp rdi, rsi
movups xmmword [rsp + 0x50], xmm0
cmovbe rsi, rdi
mov qword [rsp + 0x50], rbp
xor ecx, ecx
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov qword [rsp + 0x20], r15
mov r8d, esi
mov rdx, r12
lea r9, [rsp + 0x34]
mov rcx, rbx
test r14b, r14b
jne 0x3a98e2780
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3a98e2829
mov eax, dword [rsp + 0x34]
cmp rsi, rax
jb 0x3a98e27c0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call r13
test eax, eax
je 0x3a98e2805
mov eax, dword [rsp + 0x34]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x3a98e2742
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.write
mov ebx, eax
mov qword [rsp + 0x20], rbp
mov r9, rsi
lea rdx, str.Failed_to__s__zu_bytes_at_offset__llu
mov ecx, ebx
call fcn.3a98f4925
test ebx, ebx
jne 0x3a98e2820
nop dword [rax + rax]
mov eax, 0xffffffff
jmp 0x3a98e2768
mov r8d, 0x208
lea rdx, str.src_win32_replacements.c
lea rcx, str.result___count
call qword [sym.imp.msvcrt.dll__wassert]
jmp 0x3a98e274b
call qword [sym.imp.msvcrt.dll__errno]
mov dword [rax], 0x1d
jmp 0x3a98e27b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.Failed_to_get_original_file_position
mov ecx, eax
mov ebx, eax
call fcn.3a98f4925
jmp 0x3a98e27af
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, rbp
lea rdx, str.Failed_to_restore_file_position_to__llu
mov ecx, eax
mov ebx, eax
call fcn.3a98f4925
jmp 0x3a98e27af
mov ecx, ebx
call fcn.3a98e2660
jmp 0x3a98e27b8
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.read
mov ebx, eax
jmp 0x3a98e2799

Function at 0x3a98e28e0
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
pxor xmm0, xmm0
movups xmmword [rsp + 0x44], xmm0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
movups xmmword [rsp + 0x24], xmm0
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x28]
cmp rax, rdx
cmova rax, rdx
lea rdx, [rax + rax*4]
mov rax, rdx
shl rax, 4
add rdx, rax
movabs rax, 0x28f5c28f5c28f5c3
shr rdx, 2
mul rdx
mov rax, rdx
shr rax, 2
add rsp, 0x68
ret
Function at 0x3a98e2a20
Capabilities:
Delete file
Move file

Disassembly:
push rbp
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov r8d, 1
mov rsi, rcx
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x3a98e2a60
xor eax, eax
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 5
je 0x3a98e2aa0
call rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, ebx
mov r8, rax
call fcn.3a98e2390
mov dword [r8], eax
mov eax, 0xffffffff
lea rsp, [rbp + 8]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop rbp
ret
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r8, rax
lea rax, [rax + rax + 0x2d]
and rax, 0xfffffffffffffff0
call fcn.3a98e4420
sub rsp, rax
mov rdx, rbx
lea r13, [rsp + 0x20]
mov rcx, r13
call fcn.3a98e46d0
mov r8d, 5
lea rdx, str..orig
mov rcx, rax
call fcn.3a98e46d0
mov edx, 9
mov rcx, rax
mov r12, rax
call fcn.3a98cdbf0
xor eax, eax
mov rdx, r13
mov rcx, rbx
mov word [r12 + 0x12], ax
mov r12, qword [sym.imp.KERNEL32.dll_MoveFileW]
call r12
test eax, eax
je 0x3a98e2a6e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x3a98e2b4d
mov rdx, rbx
mov rcx, rsi
call r12
test eax, eax
jne 0x3a98e2a47
call fcn.3a98e2840
mov rdx, rsi
lea rcx, str.Atomic_semantics_not_respected_in_failed_rename____new_file_is_at___ls__
call fcn.3a98f2109
mov eax, 1
jmp 0x3a98e2a49
call fcn.3a98e2840
mov rdx, r13
lea rcx, str.Failed_to_delete_original_file__moved_to___ls__
call fcn.3a98f2109
jmp 0x3a98e2b1e

Function at 0x3a98e2bb0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov edi, ecx
mov rbp, rdx
mov rbx, r8
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov dword [rsp + 0x3c], 0xffffffff
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x3a98e2c72
mov eax, 0x100000
cmp rbx, rax
cmova rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [rsp + 0x3c]
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], 0
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x3a98e2c4f
mov eax, dword [rsp + 0x3c]
cmp rbx, rax
jb 0x3a98e2c28
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x240
lea rdx, str.src_win32_replacements.c
lea rcx, str.result___count
call qword [sym.imp.msvcrt.dll__wassert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, edi
mov r8, rbx
lea rdx, str.Error_reading__zu_bytes_from_fd__d
mov esi, eax
mov ecx, eax
call fcn.3a98f4925
mov ecx, esi
call fcn.3a98e2660
or rax, 0xffffffffffffffff
jmp 0x3a98e2c19