joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007cf00
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x160
mov rbx, rcx
lea r9, [rax + 8]
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x40]
xor edi, edi
mov r14d, 0x18
mov r8d, r14d
mov dword [rax + 8], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x40]
mov r15d, 1
cmp eax, r15d
mov dword [rbx + 0x28c], edi
mov esi, edi
mov ecx, edi
cmovl eax, r15d
test eax, eax
jle 0x14007d129
nop word [rax + rax]
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
mov edx, r14d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x180]
mov r8d, recv
mov dword [rsp + 0x180], edi
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
add r14d, 0xc
cmp dword [rsp + 0x34], edi
je 0x14007d10e
mov ecx, dword [rbx + 0x28c]
lea eax, [rcx + 1]
mov dword [rbx + 0x28c], eax
cmp dword [rbx + 0x288], ecx
jne 0x14007d10e
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14007d031
mov rcx, qword [rbx + 0x70]
mov edx, eax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.1400ba240
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x180]
mov r8d, 0x100
mov dword [rsp + 0x180], edi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx eax, byte [rsp + 0x60]
jmp 0x14007d037
xor al, al
mov byte [rsp + 0x60], al
test al, al
je 0x14007d048
mov edx, recv
mov r9d, 0x100
jmp 0x14007d065
mov r8d, esi
lea rdx, str.Voice_prompt__.4d
lea rcx, [rsp + 0x60]
call fcn.1400100f0
mov edx, 4
lea r9d, [rdx - 5]
lea r8, [rsp + 0x60]
lea rcx, [rbx + 0x58]
call fcn.140025fb0
mov ecx, dword [0x1401a9130]
test ecx, ecx
je 0x14007d0ab
sub ecx, r15d
je 0x14007d0a2
sub ecx, r15d
je 0x14007d099
cmp ecx, r15d
jne 0x14007d156
lea r8, [0x140148f50]
jmp 0x14007d0b2
lea r8, [0x14012f288]
jmp 0x14007d0b2
lea r8, [0x14012f280]
jmp 0x14007d0b2
lea r8, [0x14012f1f8]
mov edx, 2
lea rcx, [rbx + 0x58]
lea r9d, [rdx - 3]
call fcn.140025fb0
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x34]
mov dword [rbx + 0x28], eax
mov eax, dword [rsp + 0x30]
mov qword [rbx + 0x290], rax
mov qword [rbx + 0x18], rcx
cmp dword [0x1401a9130], 3
sete al
mov byte [rbx + 0x2c8], al
test al, al
je 0x14007d106
lea rax, [rcx + rcx]
mov dword [rbx + 0x2ac], 4
mov qword [rbx + 0x18], rax
jmp 0x14007d10e
mov rcx, rbx
call fcn.140023ca0
mov eax, dword [rsp + 0x40]
inc esi
cmp eax, r15d
cmovl eax, r15d
cmp esi, eax
jl 0x14007cf70
mov ecx, dword [rbx + 0x28c]
cmp dword [rbx + 0x288], ecx
mov eax, 0x8004020e
cmovge edi, eax
mov eax, edi
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov eax, 0x80040201
jmp 0x14007d139
Function at 0x14007d160
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x2c8], 0
mov rbx, rcx
je 0x14007d253
mov edx, dword [rcx + 0x2c]
mov eax, edx
mov r8, qword [rcx + 0x2b8]
mov ecx, 0xfffffffe
and edx, ecx
mov qword [rsp + 0x38], rsi
and rax, rcx
lea rcx, [rbx + 0x2d8]
cmp r8, rax
cmovge r8d, edx
lea rdx, [rbx + 0x70]
lea r9d, [r8*4 + 7]
mov r8, qword [rbx + 0x2a0]
shr r9d, 3
call fcn.1400235f0
test al, al
jne 0x14007d1cf
mov rsi, qword [rsp + 0x38]
mov eax, 0x80040205
add rsp, 0x20
pop rbx
ret
mov qword [rsp + 0x40], rdi
lea rcx, [rbx + 0x2d8]
xor edi, edi
lea edx, [rdi + 4]
call fcn.140022f70
test al, al
je 0x14007d23a
mov qword [rsp + 0x30], rbp
nop
mov edx, 4
lea rcx, [rbx + 0x2d8]
call fcn.140024500
mov edx, eax
lea rcx, [rbx + 0x2cc]
call fcn.14002d7d0
mov rax, qword [rbx + 0x2b0]
mov edx, 4
mov rcx, qword [rax]
movss dword [rcx + rdi*4], xmm0
lea rcx, [rbx + 0x2d8]
inc edi
call fcn.140022f70
test al, al
jne 0x14007d1f0
mov rbp, qword [rsp + 0x30]
mov edx, edi
mov rcx, rbx
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
jmp fcn.140025060
add rsp, 0x20
pop rbx
jmp fcn.1400248c0

Function at 0x14007d260
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x2c8], 0
mov rbx, rcx
je 0x14007d27e
add rcx, 0x2cc
call fcn.14002d770
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80
Function at 0x14007d540
Capabilities:
Write file on windows

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x20
mov r12, rdx
mov ebp, r8d
mov rdi, rcx
mov edx, 2
add rcx, 0x28
call fcn.140025da0
mov r10, rax
lea rcx, [0x140148ff8]
mov r9, 0xffffffffffffffff
movzx r8d, word [r10 + r9*2 + 2]
cmp r8w, word [rcx + r9*2 + 2]
jne 0x14007d595
add r9, 2
cmp r9, 0x15
je 0x14007d5ab
movzx eax, word [r10 + r9*2]
cmp ax, word [rcx + r9*2]
je 0x14007d571
mov r8d, ebp
mov rdx, r12
mov rcx, rdi
add rsp, 0x20
pop r12
pop rdi
pop rbp
jmp fcn.1400250c0
test ebp, ebp
je 0x14007d617
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rsi
mov rsi, rbp
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov rax, qword [r12]
lea rcx, [rdi + 0x298]
movss xmm1, dword [rax + rbx]
call fcn.14002d8b0
mov edx, eax
lea rcx, [rdi + 0x2a8]
mov r8d, 4
call fcn.140024770
lea rbx, [rbx + 4]
sub rsi, 1
jne 0x14007d5d0
mov r15, qword [rsp + 0x58]
mov r14, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add qword [rdi + 0x268], rbp
xor eax, eax
add rsp, 0x20
pop r12
pop rdi
pop rbp
ret
Function at 0x14007db60
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x60
cmp dword [rcx + 0x2cc], 1
mov rdi, rcx
jbe 0x14007db7d
mov eax, 1
add rsp, 0x60
pop rdi
ret
mov rdx, qword [rcx + 0x290]
xor r9d, r9d
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], r12
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r12d, dword [rdi + 0x2ac]
mov ecx, dword [rdi + 0x2c]
add r12d, 7
mov rbx, qword [rdi + 0x2a0]
shr r12d, 3
imul r12d, dword [rdi + 0x20]
imul ecx, r12d
call fcn.1400b609c
mov qword [rdi + 0x2a0], rax
test rbx, rbx
je 0x14007dbd9
mov rcx, rbx
call fcn.1400b60a4
cmp qword [rdi + 0x2a0], 0
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r15
je 0x14007dd86
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14007d810
mov ecx, eax
mov edx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14007dd77
xor ebx, ebx
nop dword [rax + rax]
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [rdi + 0x70]
lea r8, [rsp + 0x78]
test eax, eax
mov qword [rsp + 0x78], rbx
mov rsi, rbx
mov r9d, 1
cmovne rsi, qword [rsp + 0x80]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ebp, dword [rsp + 0x70]
mov rcx, 0xffffffffffffffff
test eax, eax
cmovne rcx, qword [rsp + 0x78]
sub rsi, rcx
cmp rbp, rsi
cmovg ebp, esi
test ebp, ebp
je 0x14007dd82
cmp ebp, dword [rdi + 0x2dc]
jbe 0x14007dcce
mov dword [rdi + 0x2dc], ebp
mov rsi, qword [rdi + 0x2a0]
mov ecx, ebp
call fcn.1400b609c
mov qword [rdi + 0x2a0], rax
test rsi, rsi
je 0x14007dcc1
mov rcx, rsi
call fcn.1400b60a4
cmp qword [rdi + 0x2a0], rbx
je 0x14007dd86
mov rdx, qword [rdi + 0x2a0]
lea r9, [rsp + 0x70]
mov rcx, qword [rdi + 0x70]
mov r8d, ebp
mov dword [rsp + 0x70], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14007dd7b
cmp dword [rsp + 0x70], ebp
jne 0x14007dd7b
mov r14, qword [rdi + 0x2a0]
xor edx, edx
mov eax, ebp
div r12d
mov dword [rsp + 0x70], eax
mov esi, eax
test eax, eax
je 0x14007dd5a
nop word [rax + rax]
cmp esi, dword [rdi + 0x2c]
mov ebp, esi
mov rcx, qword [rdi + 0x10]
mov rdx, r14
cmovae ebp, dword [rdi + 0x2c]
mov r15d, ebp
mov r9d, ebp
imul r15d, r12d
mov rax, qword [rcx]
mov r8d, r15d
call qword [rax + 0x20]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14007dd8b
mov eax, r15d
add r14, rax
sub esi, ebp
mov dword [rsp + 0x70], esi
jne 0x14007dd20
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.14007d810
mov edx, eax
shr eax, 0x1f
test al, al
je 0x14007dc30
mov eax, edx
jmp 0x14007dd8b
mov eax, 0x80040205
jmp 0x14007dd8b
xor eax, eax
jmp 0x14007dd8b
mov eax, 0x80040202
mov r14, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov r12, qword [rsp + 0x40]
add rsp, 0x60
pop rdi
ret
Function at 0x14007de00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor edi, edi
lea r9, [rsp + 0x60]
mov rbx, rcx
mov dword [rsp + 0x60], edi
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 0x1a]
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea r8d, [rdi + 0x13]
lea rdx, str.Creative_Voice_File
lea rcx, [rsp + 0x30]
call fcn.1400f4ab4
test eax, eax
je 0x14007de59
mov eax, 0x8004020c
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
cmp byte [rsp + 0x46], 0xd
mov qword [rbx + 0x290], 0x1a
jne 0x14007de8c
mov rcx, qword [rbx + 0x70]
mov r9d, 1
mov edx, r9d
mov qword [rbx + 0x290], 0x1b
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8b, 1
mov dword [rbx + 0x20], 1
lea rdx, [rsp + 0x60]
mov qword [rbx + 0x18], rdi
mov rcx, rbx
mov dword [rbx + 0x2c8], 0xffffffff
mov dword [rbx + 0x2cc], edi
mov dword [rbx + 0x2dc], edi
call fcn.14007d810
mov ecx, eax
mov edx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14007df6e
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x14007df7b
mov eax, dword [rbx + 0x2c8]
cmp eax, 7
ja case.0x14007df03.5
mov ecx, dword [rdi + rax*4 + 0x7df88]
add rcx, rdi
jmp rcx
mov eax, r8d
shr eax, 1
jmp 0x14007df30
lea ecx, [r8*2 - 2]
jmp 0x14007df37
lea eax, [r8 - 1]
lea eax, [rax + rax*2]
add qword [rbx + 0x18], rax
jmp case.0x14007df03.5
lea ecx, [r8*4 - 4]
jmp 0x14007df37
mov eax, r8d
xor edx, edx
div dword [rbx + 0x20]
mov ecx, eax
add qword [rbx + 0x18], rcx
mov rcx, qword [rbx + 0x70]
mov rdx, r8
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8b, 1
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14007d810
mov edx, eax
shr eax, 0x1f
test al, al
je 0x14007dee0
mov eax, edx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x50
pop rdi
ret
Function at 0x14007efa0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x20], 1
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edx, edx
lea r8, [0x140148f50]
test eax, eax
mov r9d, 0xffffffff
mov rax, qword [rbx + 0x68]
cmovne rdx, qword [rsp + 0x30]
add rdx, rdx
mov qword [rbx + 0x18], rdx
lea edx, [r9 + 3]
mov ecx, dword [rax + 0x20]
test ecx, ecx
mov eax, dword [0x140190b98]
cmovne eax, ecx
lea rcx, [rbx + 0x58]
mov dword [rbx + 0x28], eax
call fcn.140025fb0
xor eax, eax
mov qword [rbx + 0x290], 0
mov dword [rbx + 0x2ac], 4
add rsp, 0x20
pop rbx
ret

Function at 0x14007f130
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x2c8
call fcn.14002d770
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80

Function at 0x14007fac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
movzx eax, word [rcx + 0x298]
xor ebp, ebp
mov rbx, rcx
mov esi, ebp
cmp ax, 0x50
jne 0x14007fbc3
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
cmp byte [rbx + 0x2b0], bpl
je 0x14007fb05
mov rcx, qword [rbx + 0x2a8]
call fcn.1400447e0
jmp 0x14007fb11
mov rcx, qword [rbx + 0x2a0]
call fcn.1400448d0
mov esi, eax
shr eax, 0x1f
test al, al
jne 0x14007fc4d
cmp esi, 1
je 0x14007fb4c
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x14007fae4
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14007fae4
cmp byte [rbx + 0x2b0], bpl
je 0x14007fb8c
mov rdi, qword [rbx + 0x2a8]
test rdi, rdi
je 0x14007fb76
mov rcx, rdi
call fcn.140043f80
mov edx, 0x2438
mov rcx, rdi
call fcn.1400b6094
mov qword [rbx + 0x2a8], rbp
mov eax, esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rdi, qword [rbx + 0x2a0]
test rdi, rdi
je 0x14007fbad
mov rcx, rdi
call fcn.140043f90
mov edx, gethostbyname
mov rcx, rdi
call fcn.1400b6094
mov qword [rbx + 0x2a0], rbp
mov eax, esi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp ax, 0x11
jne 0x14007fc4d
mov r9d, dword [rcx + 0x3b8]
test r9d, r9d
je 0x14007fc41
lea eax, [r9 - 1]
and eax, 7
je 0x14007fc08
mov rcx, qword [rcx + 0x3b0]
mov edi, 8
sub edi, eax
mov edx, r9d
mov r8d, edi
call fcn.1400288c0
add dword [rbx + 0x3b8], edi
mov r9d, dword [rbx + 0x3b8]
lea r8, [rsp + 0x50]
mov rcx, rbx
lea rdx, [rsp + 0x60]
call fcn.14007f940
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x14007fc41
mov rdx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rbx + 0x2a0]
call fcn.14003dc80
mov rbx, qword [rsp + 0x68]
mov eax, esi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007fc60
Capabilities:
Read file on windows

Disassembly:
push rbx
mov eax, 0x1030
call fcn.1400b6710
sub rsp, rax
cmp byte [rcx + 0x2c0], 0
mov rbx, rcx
je 0x14007fc88
add rsp, 0x1030
pop rbx
jmp method.awReaderFilter.virtual_56
cmp word [rcx + 0x2c8], 0x50
mov qword [rsp + 0x1050], rsi
mov qword [rsp + 0x1058], rdi
mov byte [rcx + 0x2f0], 0
jne 0x14007fe66
mov rcx, qword [rcx + 0x310]
test rcx, rcx
je 0x14007fcc3
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov ecx, 0x58
call fcn.1400b6058
xor esi, esi
test rax, rax
je 0x14007fe58
mov r9, qword [rbx + 0x2d0]
lea rcx, [rbx + 0x324]
mov r8, qword [rbx + 0x290]
lea rdx, [rbx + 0x70]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140044a90
mov qword [rbx + 0x310], rax
test rax, rax
je 0x14007fe5f
mov rcx, qword [rbx + 0x318]
test rcx, rcx
je 0x14007fd27
mov rax, qword [rcx]
lea edx, [rsi + 1]
call qword [rax]
mov ecx, 0x9600
call fcn.1400b6058
test rax, rax
je 0x14007fe4a
mov rdx, qword [rbx + 0x310]
mov rcx, rax
call fcn.14003f2a0
mov qword [rbx + 0x318], rax
test rax, rax
je 0x14007fe5f
mov rcx, rax
call fcn.140043a00
mov rdi, qword [rbx + 0x30]
cmp rdi, 0x480
jl 0x14007fd9f
nop
mov rcx, qword [rbx + 0x318]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
call fcn.14003f330
test eax, eax
je 0x14007fe46
mov eax, eax
sub rdi, rax
cmp rdi, 0x480
jge 0x14007fd70
mov rcx, qword [rbx + 0x318]
lea rax, [rsp + 0x1040]
lea r9, [rsp + 0x1048]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14003f330
mov edi, eax
test eax, eax
je 0x14007fe46
nop dword [rax + rax]
mov rcx, qword [rbx + 0x310]
lea rdx, [rsp + 0x30]
mov r9d, dword [rsp + 0x1040]
mov r8d, dword [rsp + 0x1048]
mov r10, qword [rcx]
call qword [r10 + 0x40]
test al, al
je 0x14007fe66
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov r8d, dword [rsp + 0x1040]
mov r9d, edi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14007fe6b
mov rcx, qword [rbx + 0x318]
lea rax, [rsp + 0x1040]
lea r9, [rsp + 0x1048]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call fcn.14003f330
mov edi, eax
test eax, eax
jne 0x14007fdd0
xor eax, eax
jmp 0x14007fe6b
mov qword [rbx + 0x318], rsi
mov eax, 0x80040202
jmp 0x14007fe6b
mov qword [rbx + 0x310], rsi
mov eax, 0x80040202
jmp 0x14007fe6b
mov eax, 0x80040200
mov rsi, qword [rsp + 0x1050]
mov rdi, qword [rsp + 0x1058]
add rsp, 0x1030
pop rbx
ret
Function at 0x140080ed0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x220
xor ebx, ebx
lea rdx, [rsp + 0x230]
mov dword [rcx + 0x2ac], ebx
mov rdi, rcx
mov qword [rcx + 0x290], rbx
mov qword [rcx + 0x2d0], rbx
mov qword [rcx + 0x2d8], rbx
mov qword [rcx + 0x18], rbx
mov qword [rcx + 0x2e8], rbx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov rcx, rdi
cmovne rbx, qword [rsp + 0x230]
xor edx, edx
mov r8, rbx
call fcn.14007fed0
mov rcx, qword [rdi + 0x2e8]
mov ebx, eax
test rcx, rcx
je 0x140080f9e
xorps xmm2, xmm2
js 0x140080f4c
cvtsi2sd xmm2, rcx
jmp 0x140080f61
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
mov eax, dword [rdi + 0x28]
lea rdx, str._.12lf
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
cvtsi2sd xmm0, rax
divsd xmm2, xmm0
movq r8, xmm2
call fcn.1400100f0
mov r9d, 0xffffffff
lea rcx, [rdi + 0x58]
lea r8, [rsp + 0x20]
lea edx, [r9 + 0x1a]
call fcn.140025fb0
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x140080fba
mov eax, ebx
mov rbx, qword [rsp + 0x238]
add rsp, 0x220
pop rdi
ret
cmp dword [rdi + 0x2ac], 0
jne 0x140080fd9
mov eax, 0x8004020d
mov rbx, qword [rsp + 0x238]
add rsp, 0x220
pop rdi
ret
mov rax, qword [rdi + 0x290]
test rax, rax
jne 0x140080ffb
mov eax, 0x8004020e
mov rbx, qword [rsp + 0x238]
add rsp, 0x220
pop rdi
ret
mov rcx, qword [rdi + 0x2d8]
sub qword [rdi + 0x2d0], rcx
add rax, rcx
mov rbx, qword [rsp + 0x238]
mov qword [rdi + 0x290], rax
xor eax, eax
add rsp, 0x220
pop rdi
ret
Function at 0x140082c60
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
cmp byte [r8], 0
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
je 0x140082d25
movups xmm0, xmmword [r8 + 1]
mov rax, qword [r8 + 0x18]
lea r9, [r11 + 0x18]
mov rcx, qword [rsi]
lea rdx, [r11 - 0x38]
mov qword [r11 + 8], r14
xor r14d, r14d
movups xmmword [rsp + 0x30], xmm0
mov qword [r11 - 0x28], rax
mov dword [r11 + 0x18], r14d
lea r8d, [r14 + 0x18]
mov qword [r11 - 0x48], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rdi, rdi
jns 0x140082cf9
mov r8d, dword [rbx + 0x18]
lea rdx, [rbx + 0x20]
mov rcx, qword [rsi]
lea r9, [rsp + 0x80]
sub r8d, 0x18
mov dword [rsp + 0x80], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, rbx
mov rdx, rsi
mov rcx, rbp
call fcn.140082d40
jmp 0x140082d20
jle 0x140082d20
mov rcx, qword [rsi]
lea rdx, [rbx + 0x20]
lea r9, [rsp + 0x80]
mov dword [rsp + 0x80], r14d
mov r8d, edi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret

Function at 0x140082d40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov r10, rdx
xor edx, edx
cmp byte [r8], dl
jne 0x140082d56
mov ecx, dword [r8 + 0x18]
mov eax, edx
jmp 0x140082d62
mov rcx, qword [r8 + 0x18]
lea rax, [rcx + 7]
and rax, 0xfffffffffffffff8
sub eax, ecx
test eax, eax
jle 0x140082d8c
mov rcx, qword [r10]
lea r9, [rsp + 0x50]
and eax, 7
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x20], rdx
mov r8d, eax
lea rdx, [0x1401497b8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret
Function at 0x140086160
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
push rdi
push r14
sub rsp, 0x248
mov qword [rax - 0x28], r15
lea rdx, [rax + 8]
xor r15d, r15d
mov rdi, rcx
mov dword [rcx + 0x2ac], r15d
mov qword [rcx + 0x290], r15
mov qword [rcx + 0x2d0], r15
mov qword [rcx + 0x2d8], r15
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x2f8], r15
mov qword [rcx + 0x2e8], r15
mov dword [rcx + 0x2f0], r15d
mov qword [rcx + 0x300], r15
mov qword [rcx + 0x308], r15
mov qword [rcx + 0x310], r15
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8d, r15d
mov rcx, rdi
test eax, eax
cmovne r8, qword [rsp + 0x260]
xor edx, edx
call fcn.1400844c0
mov rcx, qword [rdi + 0x2e8]
mov r14d, eax
test rcx, rcx
je 0x1400862cf
mov qword [rsp + 0x270], rbp
mov ebp, r15d
cmp dword [rdi + 0x2f0], r15d
jle 0x1400862c2
mov qword [rsp + 0x240], rsi
lea rsi, [rcx + 0x10]
mov qword [rsp + 0x238], r12
mov r12d, 0x1ff
mov qword [rsp + 0x268], rbx
mov eax, dword [rsi - 4]
test eax, eax
je 0x140086295
mov rcx, qword [rdi + 0x70]
mov edx, eax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov ebx, dword [rsi]
lea r9, [rsp + 0x260]
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x30]
cmp ebx, r12d
mov dword [rsp + 0x260], r15d
mov qword [rsp + 0x20], r15
cmova ebx, r12d
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movsxd rax, ebx
lea r8, [rsp + 0x30]
mov rcx, rdi
mov byte [rsp + rax + 0x30], r15b
mov edx, dword [rsi + 4]
call fcn.140026450
inc ebp
add rsi, 0x18
cmp ebp, dword [rdi + 0x2f0]
jl 0x140086234
mov rcx, qword [rdi + 0x2e8]
mov r12, qword [rsp + 0x238]
mov rsi, qword [rsp + 0x240]
mov rbx, qword [rsp + 0x268]
call fcn.1400b60a4
mov rbp, qword [rsp + 0x270]
mov rcx, qword [rdi + 0x2f8]
mov r15, qword [rsp + 0x230]
test rcx, rcx
je 0x140086341
xorps xmm2, xmm2
js 0x1400862ef
cvtsi2sd xmm2, rcx
jmp 0x140086304
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm2, rax
addsd xmm2, xmm2
mov eax, dword [rdi + 0x28]
lea rdx, str._.12lf
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
cvtsi2sd xmm0, rax
divsd xmm2, xmm0
movq r8, xmm2
call fcn.1400100f0
mov r9d, 0xffffffff
lea rcx, [rdi + 0x58]
lea r8, [rsp + 0x30]
lea edx, [r9 + 0x1a]
call fcn.140025fb0
mov eax, r14d
shr eax, 0x1f
test al, al
je 0x140086359
mov eax, r14d
add rsp, 0x248
pop r14
pop rdi
ret
mov rax, qword [rdi + 0x290]
test rax, rax
jne 0x140086375
mov eax, 0x8004020e
add rsp, 0x248
pop r14
pop rdi
ret
mov rcx, qword [rdi + 0x2d8]
sub qword [rdi + 0x2d0], rcx
add rax, rcx
mov qword [rdi + 0x290], rax
xor eax, eax
add rsp, 0x248
pop r14
pop rdi
ret
Function at 0x140089790
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
cmp byte [r8], 0
mov esi, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
je 0x140089856
mov r9d, dword [r8 + 8]
lea rdx, [r11 - 0x28]
mov eax, dword [r8 + 4]
inc r9d
mov rcx, qword [rdi]
and r9d, 0xfffffffe
cmp qword [r8 + 8], r9
mov dword [rsp + 0x30], eax
mov eax, 0xffffffff
cmovg r9d, eax
mov qword [r11 + 8], r14
xor r14d, r14d
mov dword [r11 - 0x24], r9d
lea r9, [r11 + 0x18]
mov dword [r11 + 0x18], r14d
mov qword [r11 - 0x38], r14
lea r8d, [r14 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
jns 0x140089830
mov r8d, dword [rbx + 8]
lea rdx, [rbx + 0x10]
mov rcx, qword [rdi]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.1400898b0
jmp 0x140089851
jle 0x140089851
mov rcx, qword [rdi]
lea rdx, [rbx + 0x10]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov r8d, esi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x140089870
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
push rbx
sub rsp, 0x30
xor r9d, r9d
mov rbx, rdx
call fcn.140089790
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
xor eax, eax
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x30
pop rbx
ret

Function at 0x1400898b0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x38
mov rax, qword [r8 + 8]
mov r10, rdx
xor edx, edx
lea rcx, [rax + 8]
cmp byte [r8], dl
jne 0x1400898ca
mov eax, edx
jmp 0x1400898d5
inc rax
and rax, 0xfffffffffffffffe
add rax, 8
sub eax, ecx
test eax, eax
jle 0x1400898ff
mov rcx, qword [r10]
lea r9, [rsp + 0x50]
and eax, 7
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x20], rdx
mov r8d, eax
lea rdx, [0x14014a5e0]
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x38
ret