joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400074c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, qword [rcx + 0x10]
xor r15d, r15d
mov r14, qword [rcx + 8]
mov rbx, rdx
mov r13, rcx
mov esi, r15d
test r12, r12
je 0x1400075d3
nop
mov rdi, qword [r14 + rsi*8]
mov rax, qword [rdi + 0x20]
lea rbx, [rax + 0xf]
and rbx, 0xfffffffffffffff0
sub rbx, rax
je 0x14000753c
nop word [rax + rax]
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 1
call fcn.140007820
mov byte [rax], 0xfe
sub rbx, 1
jne 0x140007520
inc rsi
cmp rsi, r12
jb 0x140007500
mov rdx, r15
mov rcx, r15
nop word [rax + rax]
mov rax, qword [r14 + rcx*8]
mov qword [rax + 8], rdx
mov rax, qword [r14 + rcx*8]
inc rcx
add rdx, qword [rax + 0x20]
cmp rcx, r12
jb 0x140007550
mov r11, r15
nop dword [rax + rax]
mov r9, qword [r14 + r11*8]
mov rax, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x38]
mov rbx, qword [r9 + 8]
lea rdx, [rcx + rcx*2]
lea r10, [rax + rdx*8]
cmp rax, r10
je 0x1400075c6
nop dword [rax]
movsxd rcx, dword [rax + 8]
mov rdx, qword [r14 + rcx*8]
mov r8, qword [rdx + 8]
add r8, qword [rax + 0x10]
sub r8, qword [rax]
sub r8, rbx
movsxd rcx, r8d
cmp rcx, r8
jne 0x14000768e
mov rcx, qword [rax]
add rax, 0x18
mov rdx, qword [r9 + 0x18]
mov dword [rdx + rcx], r8d
cmp rax, r10
jne 0x140007590
inc r11
cmp r11, r12
jb 0x140007570
mov rbx, qword [rsp + 0x58]
lea rdx, [0x14007e9e4]
mov rcx, rbx
call fcn.1400147a0
mov rdi, rax
test rax, rax
jne 0x14000760f
call fcn.140052b04
mov ecx, dword [rax]
call fcn.140052b24
mov r9, rax
lea rdx, str.Failed_to_open___s_:__s
mov r8, rbx
lea ecx, [rdi + 2]
call fcn.140013a20
xor al, al
jmp 0x140007671
mov rsi, qword [r13 + 0x10]
mov bpl, 1
mov r14, qword [r13 + 8]
nop word [rax + rax]
cmp r15, rsi
jae 0x140007665
mov rcx, qword [r14 + r15*8]
mov r9, rdi
mov edx, 1
mov rbx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x18]
mov r8, rbx
call fcn.1400529c8
cmp rbx, rax
sete bpl
jne 0x14000764f
inc r15
jmp 0x140007620
mov r8, qword [rsp + 0x58]
lea rdx, str.BinarySegmentWrite_failed_when_writing___s_
mov ecx, 2
call fcn.140013a20
mov rcx, rdi
call fcn.140052714
movzx eax, bpl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.pointer_relocation_too_big
call fcn.140013920
int3
Function at 0x140014580
Capabilities:
Delete directory
Delete file

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140026540
movups xmm1, xmmword [rax]
movsd xmm0, qword [rax + 0x10]
movd eax, xmm1
movsd qword [rsp + 0x30], xmm0
test al, 1
jne 0x1400145b4
mov al, 1
add rsp, 0x40
pop rbx
ret
movd eax, xmm1
lea rcx, [rsp + 0x20]
mov rdx, rbx
shr eax, 3
test al, 1
je 0x140014621
call fcn.140013c40
cmp qword [rax + 0x18], 7
jbe 0x1400145d6
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov rdx, qword [rsp + 0x38]
cmp eax, 1
sete bl
cmp rdx, 7
jbe 0x14001467d
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014678
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001468c
jmp 0x140014675
call fcn.140013c40
cmp qword [rax + 0x18], 7
jbe 0x140014630
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, qword [rsp + 0x38]
cmp eax, 1
sete bl
cmp rdx, 7
jbe 0x14001467d
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140014678
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014686
mov rcx, r8
call fcn.140048124
movzx eax, bl
add rsp, 0x40
pop rbx
ret
call fcn.140052424
int3
call fcn.140052424
int3

Function at 0x1400146a0
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rdi, rcx
lea rcx, [rsp + 0x40]
call fcn.140013c40
mov rbx, rax
cmp qword [rax + 0x18], 7
jbe 0x1400146c4
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140013c40
cmp qword [rax + 0x18], 7
jbe 0x1400146db
mov rax, qword [rax]
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rdx, qword [rsp + 0x38]
test eax, eax
setne bl
cmp rdx, 7
jbe 0x140014730
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001472b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014791
mov rcx, r8
call fcn.140048124
mov rdx, qword [rsp + 0x58]
xor eax, eax
movdqa xmm0, xmmword [0x140083230]
mov word [rsp + 0x20], ax
movdqu xmmword [rsp + 0x30], xmm0
cmp rdx, 7
jbe 0x140014783
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001477e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140014791
mov rcx, r8
call fcn.140048124
movzx eax, bl
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
call fcn.140052424
int3
Function at 0x140015850
Capabilities:
Hash data using djb2

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x4c0
mov r12, r9
mov rbx, r8
mov r15, rcx
call fcn.140015f50
cmp eax, 0xffffffff
je 0x1400158bd
movsxd rdx, eax
mov rax, qword [r15 + 0x28]
lea r9, [rax + rdx*4]
test r9, r9
je 0x1400158bd
mov rax, qword [r15 + 0x60]
xor r8d, r8d
add rax, 0x10
sub r8d, dword [rax]
movsxd rdx, dword [rax]
add rdx, rax
neg r8d
sbb rax, rax
and rdx, rax
movsxd rax, dword [r9]
imul rcx, rax, 0x94
mov al, 1
add rdx, rcx
mov qword [r12], rdx
add rsp, 0x4c0
pop r15
pop r12
pop rbx
ret
mov qword [rsp + 0x4e0], rbp
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x4e8], rsi
mov rdx, rbx
mov qword [rsp + 0x4f0], rdi
mov qword [rsp + 0x4b8], r13
mov qword [rsp + 0x4b0], r14
call fcn.14003d630
mov r13d, 0xffff
nop dword [rax + rax]
movzx eax, word [rsp + 0x224]
movzx ecx, word [rsp + 0x226]
shr ax, 1
and ax, 1
cmp cx, ax
jbe 0x140015a3e
add cx, r13w
lea rdx, [rsp + 0x220]
mov word [rsp + 0x226], cx
lea rcx, [rsp + 0x20]
call fcn.14003d9a0
movzx edx, byte [rsp + 0x20]
lea r9, [rsp + 0x21]
mov r8d, 0x1505
test edx, edx
je 0x140015980
nop dword [rax]
nop word [rax + rax]
lea eax, [rdx - 0x41]
cmp eax, 0x1a
lea ecx, [rdx + 0x20]
lea r9, [r9 + 1]
cmovb edx, ecx
imul r8d, r8d, 0x21
add r8d, edx
movzx edx, byte [r9 - 1]
test edx, edx
jne 0x140015960
mov edx, dword [r15 + 0x40]
test r8d, r8d
mov edi, 1
cmovne edi, r8d
test edx, edx
je 0x140015900
mov rsi, qword [r15 + 0x30]
lea ebx, [rdx - 1]
mov r14, qword [r15 + 0x38]
and ebx, edi
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
je 0x140015900
mov eax, ebx
lea ebp, [rdx - 1]
cmp edi, ecx
jne 0x1400159d5
mov rcx, qword [r14 + rax*8]
lea rax, [rsp + 0x20]
cmp rcx, rax
je 0x1400159e7
lea rdx, [rsp + 0x20]
call fcn.1400078f0
test eax, eax
je 0x1400159e7
inc ebx
and ebx, ebp
mov eax, ebx
mov ecx, dword [rsi + rbx*4]
test ecx, ecx
jne 0x1400159b5
jmp 0x140015900
cmp ebx, 0xffffffff
je 0x140015900
mov rax, qword [r15 + 0x58]
movsxd rcx, ebx
lea rdx, [rax + rcx*4]
test rdx, rdx
je 0x140015900
xor r8d, r8d
cmp dword [rdx], 0xffffffff
je 0x140015a36
mov rax, qword [r15 + 0x60]
add rax, 0x10
sub r8d, dword [rax]
movsxd rcx, dword [rax]
add rcx, rax
neg r8d
mov r8, rcx
sbb rax, rax
and r8, rax
movsxd rax, dword [rdx]
imul rcx, rax, 0x94
add r8, rcx
mov qword [r12], r8
mov al, 1
jmp 0x140015a40
xor al, al
mov r13, qword [rsp + 0x4b8]
mov rdi, qword [rsp + 0x4f0]
mov rsi, qword [rsp + 0x4e8]
mov rbp, qword [rsp + 0x4e0]
mov r14, qword [rsp + 0x4b0]
add rsp, 0x4c0
pop r15
pop r12
pop rbx
ret
Function at 0x140018d90
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x4d0
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rsi, rcx
test r9, r9
je 0x140018f54
cmp qword [r9 + 8], 0
je 0x140018f54
mov rdx, qword [rsi + 0x10]
add rcx, 0x18
mov qword [rsp + 0x4f0], rbx
mov r8d, 4
mov ebx, dword [r9 + 8]
call fcn.140007820
lea rdx, [rsp + 0x20]
mov rcx, rsi
mov dword [rax], ebx
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.140007290
mov rsi, qword [rbp + 8]
xor edi, edi
test rsi, rsi
je 0x140018f2d
nop
mov rax, qword [rbp + 0x10]
mov rdx, qword [rax + rdi*8]
cmp dword [rdx], 4
jne 0x140018f50
mov rdx, qword [rdx + 8]
lea rcx, [rsp + 0x240]
call fcn.14003d630
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x40]
call fcn.14003d9a0
mov eax, dword [r15]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov rcx, r14
mov rax, qword [r15 + 0x20]
mov qword [rsp + 0x28], rax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140007290
lea rax, [rsp + 0x40]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140018e90
mov rdx, qword [r15 + 0x10]
lea rcx, [r15 + 0x18]
lea r8, [rbx + 1]
call fcn.140007820
mov rcx, rax
lea r8, [rbx + 1]
lea rdx, [rsp + 0x40]
call fcn.1400700e0
movzx eax, byte [rsp + 0x40]
lea r9, [rsp + 0x41]
mov r8d, 0x1505
test eax, eax
je 0x140018f00
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x41]
cmp ecx, 0x1a
lea edx, [rax + 0x20]
lea r9, [r9 + 1]
cmovb eax, edx
imul r8d, r8d, 0x21
add r8d, eax
movzx eax, byte [r9 - 1]
test eax, eax
jne 0x140018ee0
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
test r8d, r8d
mov ebx, 1
cmovne ebx, r8d
mov r8d, 4
call fcn.140007820
inc rdi
mov dword [rax], ebx
cmp rdi, rsi
jb 0x140018e20
mov al, 1
mov rbx, qword [rsp + 0x4f0]
lea r11, [rsp + 0x4d0]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
xor al, al
jmp 0x140018f2f
mov rdx, qword [rsi + 0x10]
add rcx, 0x18
mov r8d, 4
call fcn.140007820
xor edi, edi
lea rcx, [rsi + 0x18]
mov dword [rax], edi
mov rdx, qword [rsi + 0x10]
lea r8d, [rdi + 4]
call fcn.140007820
mov dword [rax], edi
mov al, 1
jmp 0x140018f37
Function at 0x140018f90
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
movzx r10d, byte [r8]
lea r11, [r8 + 1]
mov rbx, r9
mov rdi, r8
mov r14, rdx
mov r15, rcx
mov eax, 0x1505
test r10d, r10d
je 0x140018fd5
imul eax, eax, 0x21
lea r11, [r11 + 1]
add eax, r10d
movzx r10d, byte [r11 - 1]
test r10d, r10d
jne 0x140018fc1
test eax, eax
mov esi, 1
mov rcx, rbx
cmovne esi, eax
mov edx, esi
call fcn.1400106c0
cmp eax, 0xffffffff
je 0x140019014
cdqe
shl rax, 4
add rax, qword [rbx + 0x28]
je 0x140019014
movups xmm0, xmmword [rax]
lea rdx, [rsp + 0x20]
mov rcx, r15
movaps xmmword [rsp + 0x20], xmm0
call fcn.140007290
jmp 0x1400190f3
mov eax, dword [r14]
mov ecx, dword [rbx + 0x14]
mov r8d, dword [rbx + 0x10]
mov qword [rsp + 0x60], rbp
mov ebp, dword [rbx + 0x18]
mov dword [rsp + 0x20], eax
mov rax, qword [r14 + 0x20]
movaps xmmword [rsp + 0x30], xmm6
lea edx, [rbp + 1]
mov qword [rsp + 0x28], rax
shl rdx, 8
shr rdx, cl
cmp rdx, 0x50
jbe 0x140019054
mov rcx, rbx
call fcn.14001d250
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx]
lea eax, [r8 - 1]
and eax, esi
cmp dword [rdx + rax*4], 0
je 0x14001907b
dec r8d
nop word [rax + rax]
inc eax
and eax, r8d
cmp dword [rdx + rax*4], 0
jne 0x140019070
movaps xmm6, xmmword [rsp + 0x20]
mov dword [rdx + rax*4], esi
mov rcx, qword [rbx + 8]
mov qword [rcx + rax*8], rdi
lea ecx, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x18], ecx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
add rcx, rcx
mov rbx, 0xffffffffffffffff
movups xmmword [rax + rcx*8], xmm6
nop dword [rax + rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1400190b0
mov rdx, qword [r14 + 0x10]
lea rcx, [r14 + 0x18]
lea r8, [rbx + 1]
call fcn.140007820
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call fcn.1400700e0
lea rdx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
mov rcx, r15
call fcn.140007290
movaps xmm6, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x14001e910
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x80
mov r14, rcx
mov rsi, r9
lea rcx, [rsp + 0x20]
mov rbp, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001eb20
mov rax, qword [rsp + 0x20]
lea rcx, [rsp + 0x60]
sub rax, qword [0x14008eac8]
xor edx, edx
imul rax, rax, 0xf4240
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0xa0], rdi
div qword [0x14008eac0]
mov qword [rsp + 0xa8], r15
mov r15, rax
mov qword [rsp + 0x60], rbx
add r15, qword [0x14008ead0]
mov qword [rsp + 0x78], 0
call fcn.1400076a0
lea rcx, [rsp + 0x60]
mov rdi, rax
call fcn.1400076a0
lea rcx, [rsp + 0x60]
mov rbx, rax
call fcn.1400076a0
mov ecx, dword [rbx]
mov rdx, qword [rbx + 0x20]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0x54]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
mov dword [rsp + 0x34], ecx
lea rcx, [r14 + 0x70]
mov qword [rsp + 0x38], rdx
lea rdx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.14001ed70
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140007820
lea rcx, [rdi + 0x18]
mov r8d, 4
mov dword [rax], 0x6a683db9
mov rdx, qword [rdi + 0x10]
mov ebx, dword [r14 + 0x88]
call fcn.140007820
movaps xmm0, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rdi
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rax], ebx
call fcn.140007290
mov rdx, qword [rdi + 0x10]
lea rcx, [rdi + 0x18]
mov r8d, 4
call fcn.140007820
lea rcx, [r14 + 0x50]
mov dword [rax], 0x6a683db9
call fcn.140038e20
mov rdx, rsi
mov qword [r14 + 0x10], 0
lea rcx, [rsp + 0x60]
call fcn.1400074c0
mov rdi, qword [rsp + 0xa0]
movzx ebx, al
mov rcx, rsi
test al, al
je 0x14001eaa8
mov rdx, rbp
call fcn.1400146a0
movzx ebx, al
test al, al
jne 0x14001eaad
mov r9, rbp
lea rdx, str.Failed_to_rename___s__to___s_
mov r8, rsi
mov ecx, 1
call fcn.140013a20
jmp 0x14001eaad
call fcn.140014580
lea rcx, [rsp + 0x60]
call fcn.1400073b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x14001eb13
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
div qword [0x14008eac0]
sub rax, r15
add rax, qword [0x14008ead0]
lock add qword [0x14008e820], rax
mov r15, qword [rsp + 0xa8]
movzx eax, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rsi
pop rbp
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
Function at 0x140021e20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
xor eax, eax
mov rbp, rdx
mov rdx, rcx
mov qword [r11 - 0x40], rax
mov rdi, rcx
mov qword [r11 - 0x38], rax
lea rcx, [r11 - 0x40]
mov qword [r11 - 0x30], rax
mov r14, r8
mov qword [r11 - 0x28], rax
call fcn.140038bd0
mov rbx, qword [rsp + 0x38]
mov r8, rdi
mov ecx, 8
test rbx, rbx
je 0x140021f0e
mov rsi, qword [rsp + 0x40]
lea rdx, str._s:_successfully_mapped_at__p___d_bytes_
mov r9, rbx
mov dword [rsp + 0x20], esi
call fcn.140013a20
cmp rsi, 0x14
jae 0x140021eaf
mov r9d, esi
mov dword [rsp + 0x20], 0x14
mov r8, rdi
lea rdx, str._s:_Bad_mmap_size__d___need_at_least__d_bytes
mov ecx, 2
call fcn.140013a20
jmp 0x140021f1a
cmp dword [rbx], 0x2b431fdd
je 0x140021ed8
mov r9d, dword [rbx]
lea rdx, str._s:_Bad_magic_number__08x___current_is__08x
mov r8, rdi
mov dword [rsp + 0x20], 0x2b431fdd
mov ecx, 8
call fcn.140013a20
jmp 0x140021f1a
cmp dword [rbx + 0x10], 0x2b431fdd
je 0x140021ef2
mov r8, rdi
lea rdx, str.Did_not_find_expected_magic_number_marker_at_the_end_of__s._This_most_likely_means_data_writing_code_for_that_file_is_writing_too_much_or_too_little_data
mov ecx, 1
jmp 0x140021f15
movups xmm0, xmmword [rsp + 0x38]
mov al, 1
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm1
mov qword [r14], rbx
jmp 0x140021fcb
lea rdx, str._s:_mmap_failed
call fcn.140013a20
lea rcx, [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140021fed
mov rax, qword [rsp + 0x98]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
div qword [0x14008eac0]
mov rdi, rax
add rdi, qword [0x14008ead0]
test rbx, rbx
je 0x140021f85
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x140021ffa
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140021fe0
mov rax, qword [rsp + 0x30]
xor edx, edx
sub rax, qword [0x14008eac8]
imul rax, rax, 0xf4240
div qword [0x14008eac0]
sub rax, rdi
add rax, qword [0x14008ead0]
lock inc dword [0x14008e7b0]
lock add qword [0x14008e7b8], rax
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
lea rcx, str.UnMapViewOfFile___failed
call fcn.1400139a0
int3
Function at 0x140022e90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rsi, rcx
xor r15d, r15d
mov rbp, rdx
mov ebx, r8d
mov ecx, r15d
movsxd rdx, dword [rsi + 0x7c]
test rdx, rdx
je 0x140022ecf
mov r10d, r15d
nop dword [rax + rax]
add ecx, 5
add ecx, dword [rsi + r10*4]
inc r10
cmp r10, rdx
jne 0x140022ec0
lea eax, [r8 + 0xc]
mov dword [rsp + 0x24], r9d
add eax, ecx
lea r14, [rsp + 0x20]
mov dword [rsp + 0x20], eax
mov edi, 0xc
mov eax, dword [0x14008e898]
mov dword [rsp + 0x28], eax
inc eax
add dword [0x14008e89c], edi
mov dword [0x14008e898], eax
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, edi
mov rcx, r14
call fcn.1400529c8
movsxd rcx, eax
sub edi, eax
add r14, rcx
test edi, edi
jg 0x140022f00
add dword [0x14008e89c], ebx
test ebx, ebx
jle 0x140022f53
nop dword [rax]
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebx
mov rcx, rbp
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rbp, rcx
test ebx, ebx
jg 0x140022f30
cmp dword [rsi + 0x7c], r15d
je 0x140023048
lea rbp, [rsi + 0x7c]
lea r14, [rsi + 0x28]
nop word [rax + rax]
mov eax, dword [rsi]
lea rdi, [rsp + 0x78]
mov ebx, 4
mov dword [rsp + 0x78], eax
add dword [0x14008e89c], ebx
nop word [rax + rax]
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140022f90
mov eax, dword [0x14008e89c]
mov ebx, dword [rsp + 0x78]
add eax, ebx
mov rdi, qword [r14]
mov dword [0x14008e89c], eax
test ebx, ebx
jle 0x140022ff9
nop dword [rax]
mov r9, qword [0x14008e868]
mov edx, 1
movsxd r8, ebx
mov rcx, rdi
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140022fd0
mov eax, dword [0x14008e89c]
inc eax
mov byte [rsp + 0x70], 0
mov dword [0x14008e89c], eax
lea rdi, [rsp + 0x70]
mov ebx, 1
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140023010
inc r15d
add r14, 8
add rsi, 4
cmp r15d, dword [rbp]
jne 0x140022f70
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140023510
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [0x14008e868], 0
mov rbx, rcx
je 0x14002378a
mov qword [rsp + 0x60], rbp
lea rcx, [0x14008e870]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rdx, qword [rbx]
mov r9d, dword [0x14008e89c]
mov r8d, dword [rdx]
mov rdx, qword [rbx + 8]
lea eax, [r9 + 0x18]
mov dword [rsp + 0x30], r8d
mov ecx, dword [rdx]
mov dword [rsp + 0x34], ecx
mov rcx, qword [rbx + 0x10]
mov rdi, qword [rcx]
test rdi, rdi
jne 0x14002357a
xor eax, eax
mov ebx, eax
jmp 0x14002358a
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140023581
mov dword [rsp + 0x38], eax
lea r14, [rsp + 0x20]
lea eax, [rbx + 0x1d]
mov dword [rsp + 0x24], 1
mov dword [rsp + 0x20], eax
mov esi, 0xc
mov eax, dword [0x14008e898]
mov ebp, esi
mov dword [rsp + 0x28], eax
inc eax
add r9d, esi
mov dword [0x14008e898], eax
mov dword [0x14008e89c], r9d
nop word [rax + rax]
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebp
mov rcx, r14
call fcn.1400529c8
movsxd rcx, eax
sub ebp, eax
add r14, rcx
test ebp, ebp
jg 0x1400235d0
mov r14, qword [rsp + 0x40]
lea rbp, [rsp + 0x30]
add dword [0x14008e89c], esi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, esi
mov rcx, rbp
call fcn.1400529c8
movsxd rcx, eax
sub esi, eax
add rbp, rcx
test esi, esi
jg 0x140023610
mov rbp, qword [rsp + 0x60]
lea rsi, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov ebx, 4
add dword [0x14008e89c], ebx
nop dword [rax]
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebx
mov rcx, rsi
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
test ebx, ebx
jg 0x140023650
mov eax, dword [0x14008e89c]
mov ebx, dword [rsp + 0x70]
add eax, ebx
mov rsi, qword [rsp + 0x78]
mov dword [0x14008e89c], eax
test ebx, ebx
jle 0x1400236b9
nop
mov r9, qword [0x14008e868]
mov edx, 1
movsxd r8, ebx
mov rcx, rdi
call fcn.1400529c8
movsxd rcx, eax
sub ebx, eax
add rdi, rcx
test ebx, ebx
jg 0x140023690
mov eax, dword [0x14008e89c]
inc eax
mov byte [rsp + 0x68], 0
mov dword [0x14008e89c], eax
lea rdi, [rsp + 0x68]
mov ebx, 1
mov r9, qword [0x14008e868]
mov edx, 1
mov r8d, ebx
mov rcx, rdi
call fcn.1400529c8
movsxd rdx, eax
sub ebx, eax
add rdi, rdx
test ebx, ebx
jg 0x1400236d0
mov rdi, qword [rsp + 0x48]
lea rcx, [0x14008e870]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140023790
mov rax, qword [rsp + 0x68]
xor edx, edx
sub rax, qword [0x14008eac8]
xorps xmm0, xmm0
imul rax, rax, 0xf4240
div qword [0x14008eac0]
mov rbx, rax
add rbx, qword [0x14008ead0]
mov rcx, rbx
sub rcx, qword [0x14008e8a0]
js 0x140023750
cvtsi2sd xmm0, rcx
jmp 0x140023765
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm0, qword [0x140083220]
comisd xmm0, xmmword [0x140083200]
jbe 0x14002378a
mov rcx, qword [0x14008e868]
call fcn.14005342c
mov qword [0x14008e8a0], rbx
add rsp, 0x50
pop rbx
ret
lea rcx, str.QueryPerformanceCounter_failed
call fcn.1400139a0
int3
Function at 0x140023b10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r12
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rsi, r8
mov r12, rdx
mov rbx, rcx
jne 0x140023b4e
mov ecx, 1
call fcn.14004fcc0
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, r12
add rsp, 0x20
pop r12
pop rsi
pop rbx
jmp fcn.1400529c8
movsxd rax, dword [rcx + 0x20]
mov qword [rsp + 0x40], rbp
add rax, rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
cmp rax, qword [rcx + 0x18]
jbe 0x140023bdc
mov edi, dword [rcx + 0x18]
movsxd rcx, dword [rcx + 0x20]
add edi, edi
movsxd rax, edi
add rcx, rsi
cmp rax, rcx
jae 0x140023b88
mov edi, dword [rbx + 0x20]
add edi, esi
mov rax, qword [rbx + 0x10]
mov r14, qword [rbx + 0x28]
movsxd rbp, edi
lea rdx, [rbp + 8]
test rax, rax
jne 0x140023bb3
mov rcx, rdx
call fcn.140053cb4
mov qword [rax], rbp
lock add qword [r14], rbp
add rax, 8
je 0x140023c0f
jmp 0x140023bd1
lea r15, [rax - 8]
mov rax, qword [rax - 8]
neg rax
lock add qword [r14], rax
mov rcx, r15
call fcn.1400587c4
test rax, rax
je 0x140023c1e
jmp 0x140023ba4
mov qword [rbx + 0x10], rax
movsxd rax, edi
mov qword [rbx + 0x18], rax
movsxd rcx, dword [rbx + 0x20]
mov r8, rsi
add rcx, qword [rbx + 0x10]
mov rdx, r12
call fcn.1400700e0
add dword [rbx + 0x20], esi
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
add rsp, 0x20
pop r12
pop rsi
pop rbx
ret
mov edx, edi
lea rcx, str.out_of_memory_allocating__d_bytes_for_output_buffer
call fcn.140013920
int3
mov r8, r15
lea rcx, str.out_of_memory_reallocating__d_bytes_at__p
mov edx, edi
call fcn.140013920
int3