joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004a0c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x30
mov r9, qword [rcx + 0x218]
mov r14, r8
mov rdi, rdx
mov rbx, rcx
test r9, r9
je 0x14004a26f
test rdx, rdx
js 0x14004a26f
mov rdx, qword [rcx + 0x228]
cmp rdi, rdx
jge 0x14004a26f
mov rcx, rdi
mov qword [rsp + 0x58], rsi
sub rcx, qword [rbx + 0x220]
mov qword [rsp + 0x60], r15
js 0x14004a206
mov eax, dword [r8]
movsxd rdx, dword [rbx + 0x230]
add rax, rcx
cmp rax, rdx
jg 0x14004a149
movsxd rax, ecx
add rax, r9
mov rsi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
xor ebp, ebp
mov qword [rbx + 0x220], rdi
mov r15d, dword [r8]
cmp rdx, rcx
jle 0x14004a181
sub edx, ecx
mov dword [rbx + 0x230], edx
movsxd r8, edx
mov edx, ecx
mov rcx, r9
add rdx, r9
call fcn.1400b9e30
movsxd rcx, dword [rbx + 0x230]
add rdi, rcx
sub r15d, ecx
jmp 0x14004a189
mov dword [rbx + 0x230], ebp
mov ecx, ebp
test r15d, r15d
jle 0x14004a263
mov esi, dword [rbx + 0x234]
sub esi, ecx
mov rcx, qword [rbx + 0x228]
mov eax, esi
add rax, rdi
cmp rax, rcx
jle 0x14004a1af
mov esi, ecx
sub esi, edi
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
movsxd rdx, dword [rbx + 0x230]
lea r9, [rsp + 0x50]
add rdx, qword [rbx + 0x218]
mov r8d, esi
mov rcx, qword [rbx]
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
add dword [rbx + 0x230], esi
sub r15d, esi
test r15d, r15d
jle 0x14004a263
sub dword [r14], r15d
mov rax, qword [rbx + 0x218]
jmp 0x14004a131
mov esi, dword [rbx + 0x234]
lea rax, [rdi + rsi]
cmp rax, rdx
jle 0x14004a219
mov esi, edx
sub esi, edi
mov rcx, qword [rbx]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rdx, qword [rbx + 0x218]
lea r9, [rsp + 0x50]
mov rcx, qword [rbx]
xor ebp, ebp
mov r8d, esi
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov qword [rbx + 0x220], rdi
mov dword [rbx + 0x230], esi
cmp esi, dword [r14]
jae 0x14004a263
mov dword [r14], esi
mov rax, qword [rbx + 0x218]
jmp 0x14004a131
mov rbx, qword [rsp + 0x68]
xor ebp, ebp
mov dword [r8], ebp
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rbp
ret
Function at 0x14004af80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1010
call fcn.1400b6710
sub rsp, rax
mov rsi, rcx
lea rcx, [rsp + 0x58]
call fcn.140044b90
mov rcx, qword [rsi + 0x70]
lea rax, [rsp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x50], rax
mov edx, ebx
xor r9d, r9d
xor r8d, r8d
mov ebp, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14004b0d5
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x1020]
mov r8d, pe_nt_image_headers64
mov dword [rsp + 0x1020], ebx
lea rdx, [rsp + 0x90]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004b0d5
cmp dword [rsp + 0x1020], 0x80
jne 0x14004b0d5
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.140045ba0
lea rcx, [rsp + 0x30]
call fcn.14002b850
mov edi, eax
test eax, eax
jne 0x14004b0d7
mov r8d, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
lea ecx, [r8 + rax]
cmp ecx, 0x80
jbe 0x14004b08b
lea r8d, [rcx - 0x80]
mov dword [rsp + 0x1020], ebx
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x1020]
lea rdx, [rsp + 0x110]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r8d, dword [rsp + 0x34]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x90]
mov r9d, dword [rsp + 0x38]
add rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x20]
mov edi, eax
shr eax, 0x1f
test al, al
jne 0x14004b0d7
mov eax, dword [rsp + 0x34]
xor r9d, r9d
add eax, dword [rsp + 0x30]
xor r8d, r8d
mov rcx, qword [rsi + 0x70]
add rbp, rax
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x14004afd2
mov edi, ebx
lea rcx, [rsp + 0x58]
call fcn.140044c60
lea r11, [rsp + 0x1010]
mov eax, edi
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14004b120
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rdi, rcx
lea rcx, [rsp + 0x58]
call fcn.140044b90
mov rcx, qword [rdi + 0x70]
lea rax, [rsp + 0x58]
xor ebx, ebx
mov qword [rsp + 0x50], rax
lea r9, [rbp + 0x20]
mov dword [rbp + 0x20], ebx
mov r8d, pe_nt_image_headers64
mov qword [rsp + 0x20], rbx
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004b2a0
cmp dword [rbp + 0x20], 0x80
jne 0x14004b2a0
mov r8d, pe_nt_image_headers64
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call fcn.140045ba0
lea rcx, [rsp + 0x30]
call fcn.14002b850
test eax, eax
je 0x14004b1ba
cmp eax, 1
jne 0x14004b2a5
mov eax, 0x8004020c
jmp 0x14004b2a5
mov r9d, 0xffffffff
lea rcx, [rdi + 0x58]
lea r8, [0x14013f550]
lea edx, [r9 + 3]
call fcn.140025fb0
mov eax, dword [rsp + 0x3c]
xor r9d, r9d
mov edx, dword [rsp + 0x30]
xor r8d, r8d
add edx, dword [rsp + 0x34]
mov rcx, qword [rdi + 0x70]
mov dword [rdi + 0x28], eax
mov eax, dword [rsp + 0x44]
mov dword [rdi + 0x20], eax
mov eax, dword [rsp + 0x48]
mov dword [rdi + 0x24], eax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x2c], eax
mov qword [rdi + 0x18], rax
mov eax, dword [rsp + 0x40]
mov dword [rdi + 0x2d0], eax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x70]
lea r9, [rbp + 0x20]
mov r8d, pe_nt_image_headers64
mov dword [rbp + 0x20], ebx
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004b2a7
cmp dword [rbp + 0x20], 0x80
jne 0x14004b2a7
mov r8d, pe_nt_image_headers64
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x58]
call fcn.140045ba0
lea rcx, [rsp + 0x30]
call fcn.14002b850
shr eax, 0x1f
not al
test al, 1
je 0x14004b2a7
mov rcx, qword [rdi + 0x70]
lea rdx, [rbp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rsp + 0x34]
mov r8, rbx
test eax, eax
cmovne r8, qword [rbp + 0x20]
add ecx, dword [rsp + 0x30]
mov rax, r8
cqo
idiv rcx
mov rcx, qword [rdi + 0x18]
imul rcx, rax
mov qword [rdi + 0x18], rcx
jmp 0x14004b2a7
mov eax, 0x80040205
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.140044c60
lea r11, [rsp + 0x110]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14004b2d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0xf38]
mov eax, 0x1038
call fcn.1400b6710
sub rsp, rax
cmp qword [rcx + 0x2c8], 0
mov rbx, rcx
jne 0x14004b304
mov eax, 0x80040207
add rsp, 0x1038
pop rbx
pop rbp
ret
mov qword [rsp + 0x1030], rsi
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x1028], rdi
mov qword [rsp + 0x1020], r12
mov qword [rsp + 0x1018], r14
mov qword [rsp + 0x1010], r15
call fcn.140044b90
lea rax, [rsp + 0x58]
xor r12d, r12d
mov qword [rsp + 0x50], rax
mov r15d, r12d
nop word [rax + rax]
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
sete r14b
test eax, eax
je 0x14004b3ac
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0xf60]
mov r8d, pe_nt_image_headers64
mov dword [rbp + 0xf60], r12d
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004b3a9
cmp dword [rbp + 0xf60], 0x80
jne 0x14004b3a9
xor r14b, r14b
jmp 0x14004b3ac
mov r14b, 1
mov dword [rbp + 0xf50], r12d
mov edi, r12d
test r14b, r14b
je 0x14004b3ca
mov dword [rbp + 0xf58], r12d
mov rax, r12
jmp 0x14004b453
mov eax, dword [rsp + 0x30]
lea rcx, [rbp - 0x70]
add rcx, rax
lea rdx, [rbp - 0x70]
mov qword [rbp + 0xf68], rcx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x58]
call fcn.140045ba0
lea rcx, [rsp + 0x30]
call fcn.14002b850
mov esi, eax
test eax, eax
jne 0x14004b525
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
lea r8d, [rax + rcx]
cmp r8d, 0x80
jbe 0x14004b446
mov rcx, qword [rbx + 0x70]
lea r9, [rbp + 0xf60]
add r8d, 0xffffff80
mov dword [rbp + 0xf60], r12d
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
mov dword [rbp + 0xf58], eax
mov eax, ecx
lea rax, [rbp + rax - 0x70]
mov qword [rbp + 0xf68], rax
nop word [rax + rax]
mov eax, dword [rbx + 0x2c]
lea r9, [rbp + 0xf68]
mov rdx, qword [rbx + 0x2b0]
lea r8, [rbp + 0xf50]
mov rcx, qword [rbx + 0x2c8]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf58]
mov qword [rsp + 0x20], rax
call fcn.14002bdd0
mov esi, eax
shr eax, 0x1f
test al, al
jne 0x14004b525
mov r8d, dword [rbp + 0xf50]
test r8d, r8d
je 0x14004b4cf
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x2b0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov esi, eax
shr eax, 0x1f
test al, al
jne 0x14004b525
add edi, dword [rbp + 0xf50]
jmp 0x14004b460
cmp dword [rbp + 0xf58], r12d
jne 0x14004b460
test r14b, r14b
je 0x14004b4e1
test edi, edi
je 0x14004b4f1
mov eax, dword [rsp + 0x34]
add eax, dword [rsp + 0x30]
add r15, rax
jmp 0x14004b350
mov rdi, qword [rbx + 0x2c8]
test rdi, rdi
je 0x14004b512
mov rcx, rdi
call fcn.14002bd40
mov edx, 0x50
mov rcx, rdi
call fcn.1400b6094
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x2c8], r12
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
lea rcx, [rsp + 0x58]
call fcn.140044c60
mov r15, qword [rsp + 0x1010]
mov eax, esi
mov rsi, qword [rsp + 0x1030]
mov r14, qword [rsp + 0x1018]
mov r12, qword [rsp + 0x1020]
mov rdi, qword [rsp + 0x1028]
add rsp, 0x1038
pop rbx
pop rbp
ret
Function at 0x14004d600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov dword [rsp + 0x50], edx
mov eax, r8d
mov dword [rsp + 0x58], ebp
mov rsi, r9
mov qword [rsp + 0x20], rbp
mov ebx, r8d
lea r9, [rsp + 0x58]
mov rdi, rcx
lea r8d, [rbp + 8]
mov rcx, qword [rcx + 0x38]
lea rdx, [rsp + 0x50]
bswap eax
mov dword [rsp + 0x54], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x58]
mov r8d, ebx
mov dword [rsp + 0x58], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x14004dca0
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x2a0]
mov rdi, rcx
test rax, rax
jne 0x14004dcd2
mov ecx, dword [rcx + 0x2e8]
call fcn.1400b609c
mov qword [rdi + 0x2a0], rax
test rax, rax
jne 0x14004dcd2
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi + 0x70]
xor r9d, r9d
mov qword [rsp + 0x38], rbx
xor r8d, r8d
xor ebx, ebx
mov qword [rdi + 0x2f8], rax
mov edx, ebx
mov dword [rdi + 0x2e4], ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x70]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov al, 1
cmovne rbx, qword [rsp + 0x30]
mov qword [rdi + 0x2f0], rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14004e000
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x2e4]
movzx r14d, r9b
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
cmp eax, r8d
jae 0x14004e0c6
mov ecx, eax
test eax, eax
je 0x14004e058
mov rdx, qword [rbx + 0x2f8]
mov r9, qword [rbx + 0x2a0]
cmp rdx, r9
jbe 0x14004e058
mov r8d, eax
mov rcx, r9
call fcn.1400b9e30
mov ecx, dword [rbx + 0x2e4]
mov esi, dword [rbx + 0x2e8]
mov rax, qword [rbx + 0x2f0]
sub esi, ecx
mov r8, qword [rbx + 0x2a0]
cmp rsi, rax
mov qword [rbx + 0x2f8], r8
cmovge esi, eax
test esi, esi
je 0x14004e0c2
mov edx, ecx
lea r9, [rsp + 0x60]
mov rcx, qword [rbx + 0x70]
xor eax, eax
add rdx, r8
mov dword [rsp + 0x60], eax
mov r8d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004e0c2
cmp dword [rsp + 0x60], esi
jne 0x14004e0c2
add dword [rbx + 0x2e4], esi
mov eax, esi
sub qword [rbx + 0x2f0], rax
cmp dword [rbx + 0x2e4], edi
jae 0x14004e0c6
xor al, al
jmp 0x14004e0f1
test rbp, rbp
je 0x14004e0dd
mov rdx, qword [rbx + 0x2f8]
mov r8, rdi
mov rcx, rbp
call fcn.1400b9e30
test r14b, r14b
jne 0x14004e0ef
add qword [rbx + 0x2f8], rdi
sub dword [rbx + 0x2e4], edi
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14004e6a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push r14
push r15
sub rsp, 0x58
xor r15d, r15d
mov r14d, r8d
mov rbx, rcx
test rdx, rdx
je 0x14004e6be
mov rsi, qword [rdx]
jmp 0x14004e6c1
mov rsi, r15
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x50], rdi
test r8d, r8d
je 0x14004e7b7
mov ecx, dword [rcx + 0x538]
nop dword [rax]
mov ebp, r14d
mov eax, 0xa0
sub eax, ecx
movsxd rcx, ecx
cmp eax, r14d
cmovb ebp, eax
add rcx, 0xae
mov edi, ebp
sub r14d, ebp
shl rdi, 2
mov r8, rdi
lea rcx, [rbx + rcx*4]
test rsi, rsi
je 0x14004e71c
mov rdx, rsi
call fcn.1400b9e30
add rsi, rdi
jmp 0x14004e723
xor edx, edx
call fcn.1400ba240
mov ecx, dword [rbx + 0x538]
add ecx, ebp
mov dword [rbx + 0x538], ecx
cmp ecx, 0xa0
jne 0x14004e7ae
mov edx, dword [rbx + 0x2b4]
lea rax, [rbx + 0x2b8]
lea rcx, [rbx + 0x298]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
lea r8, [rsp + 0x30]
call fcn.14002d1d0
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x14004e7b9
mov r8d, dword [rsp + 0x88]
lea r9, [rsp + 0x90]
mov rcx, qword [rbx + 0x38]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x90], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
add qword [rbx + 0x250], 0xa0
mov ecx, r15d
mov dword [rbx + 0x538], r15d
test r14d, r14d
jne 0x14004e6e0
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x80]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbx
ret

Function at 0x14004ed40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
lea rdi, [rdx + 8]
mov rbp, r8
mov rbx, rdx
mov rsi, rcx
cmp rdi, r8
jge 0x14004ee99
mov qword [rsp + 0x70], r14
xor r14d, r14d
mov qword [rsp + 0x40], r15
mov r15d, 0xfffffffe
mov rcx, qword [rsi + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x78]
mov r8d, 8
mov dword [rsp + 0x78], r14d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14004ee8f
cmp dword [rsp + 0x78], 8
jne 0x14004ee8f
mov ecx, dword [rsp + 0x34]
mov rax, qword [rsp + 0x30]
lea ebx, [rcx + 1]
and rbx, r15
add rbx, rdi
cmp eax, 0x5453494c
jne 0x14004ee1e
mov rcx, qword [rsi + 0x70]
lea r9, [rsp + 0x78]
mov r8d, 4
mov dword [rsp + 0x78], r14d
lea rdx, [rsp + 0x80]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x80], 0x4f464e49
jne 0x14004ee8f
lea rdx, [rdi + 4]
mov r8, rbx
mov rcx, rsi
call fcn.14004ed40
jmp 0x14004ee82
test ecx, ecx
je 0x14004ee82
mov edx, eax
lea rcx, [rsp + 0x88]
call fcn.14008a080
test al, al
je 0x14004ee82
mov ecx, dword [rsp + 0x34]
call fcn.1400b609c
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x78]
mov rcx, qword [rsi + 0x70]
mov rdx, rax
mov rdi, rax
mov dword [rsp + 0x78], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r9d, dword [rsp + 0x34]
lea rcx, [rsi + 0x58]
mov edx, dword [rsp + 0x88]
mov r8, rdi
call fcn.140025fb0
mov rcx, rdi
call fcn.1400b60a4
lea rdi, [rbx + 8]
cmp rdi, rbp
jl 0x14004ed72
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x40]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14004eec0
Capabilities:
Get file size

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r8, str.c_APEDecompress_CreateW
lea rcx, str.MACDll.dll
lea rdx, [0x1401a9000]
call fcn.140028a70
test al, al
jne 0x14004eef2
mov eax, 0x80040210
add rsp, 0x20
pop rdi
ret
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x50]
test rax, rax
je 0x14004f07a
cmp word [rax], 0
je 0x14004f07a
mov qword [rsp + 0x48], rsi
lea rdx, [rsp + 0x38]
xor esi, esi
mov rcx, rax
mov dword [rsp + 0x38], esi
call qword [0x1401a9000]
mov qword [rdi + 0x2c8], rax
test rax, rax
jne 0x14004ef45
mov rsi, qword [rsp + 0x48]
mov eax, 0x8004020c
add rsp, 0x20
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov edx, 0x3ee
mov rcx, rax
call qword [0x1401a9020]
mov rcx, qword [rdi + 0x2c8]
xor r9d, r9d
xor r8d, r8d
mov dword [rdi + 0x20], eax
mov edx, 0x3f8
call qword [0x1401a9020]
mov rcx, qword [rdi + 0x2c8]
xor r9d, r9d
mov dword [rdi + 0x2d8], eax
xor r8d, r8d
cdqe
mov edx, 0x3eb
mov qword [rdi + 0x18], rax
call qword [0x1401a9020]
mov rcx, qword [rdi + 0x2c8]
xor r9d, r9d
xor r8d, r8d
mov dword [rdi + 0x28], eax
mov edx, 0x3ec
call qword [0x1401a9020]
mov dword [rdi + 0x2ac], eax
lea rcx, [rdi + 0x58]
cmp eax, 8
ja 0x14004efd7
lea rbx, [0x14012dcb0]
lea r8, [0x140130360]
jmp 0x14004effa
cmp eax, 0x10
ja 0x14004efec
lea rbx, [0x14012bb38]
lea r8, [0x140130398]
jmp 0x14004effa
lea rbx, [0x14012dc98]
lea r8, [0x1401303d0]
mov edx, 2
lea r9d, [rdx - 3]
call fcn.140025fb0
mov qword [rdi + 0x2d0], rbx
lea rdx, [rsp + 0x40]
mov rcx, qword [rdi + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8, rdi
lea rcx, [rdi + 0x70]
test eax, eax
cmovne rsi, qword [rsp + 0x40]
mov rdx, rsi
call fcn.14004faf0
mov rcx, qword [rdi + 0x2c8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x3f4
mov rbx, rax
call qword [0x1401a9020]
test eax, eax
jle 0x14004f068
movsxd rcx, eax
mov rdx, rbx
sub rdx, rcx
mov r8, rbx
mov rcx, rdi
call fcn.14004ed40
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov eax, 0x80040201
add rsp, 0x20
pop rdi
ret
Function at 0x14004fe70
Capabilities:
Get file size
Write file on windows

Disassembly:
push rbp
push rbx
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12, rdx
mov dword [rbp - 0x20], 0x7d0
mov r15, rcx
lea rdx, [rbp - 0x1c]
xorps xmm0, xmm0
movabs rax, 0x5845474154455041
xor ebx, ebx
mov qword [rbp - 0x28], rax
mov rcx, r12
mov dword [rbp - 0xc], ebx
movzx r13d, r8b
movdqu xmmword [rbp - 0x1c], xmm0
call fcn.14004fa00
mov dword [rbp - 0x18], eax
test eax, eax
je 0x14005005c
mov rcx, qword [r15]
lea rdx, [rbp + 0x48]
mov dword [rbp - 0x14], 0xa0000000
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rcx, qword [r15]
mov edx, ebx
test eax, eax
cmovne rdx, qword [rbp + 0x48]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [r15]
lea r9, [rbp + 0x48]
lea r8d, [rbx + 0x20]
mov dword [rbp + 0x48], ebx
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp qword [0x140140230], rbx
je 0x140050036
mov qword [rsp + 0x90], rsi
mov ecx, ebx
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], r14
mov r14d, ebx
lea rbx, [0x140140230]
mov rsi, rbx
movzx eax, byte [rcx + rbx + 0xc]
test al, 1
je 0x140050003
test r13b, r13b
je 0x14004ff5a
test al, 2
jne 0x140050003
mov edx, dword [rcx + rbx + 8]
mov rcx, r12
mov rax, qword [r12]
call qword [rax + 0x48]
mov rdi, rax
test rax, rax
je 0x140050003
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x14004ff80
mov rcx, qword [r15]
lea r9, [rbp + 0x48]
xor eax, eax
lea rdx, [rbp - 0x30]
inc ebx
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x30], ebx
mov dword [rbp + 0x48], eax
lea r8d, [rax + 8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsi]
mov rax, 0xffffffffffffffff
xor esi, esi
mov dword [rbp + 0x48], esi
nop
cmp byte [rdx + rax + 1], sil
lea rax, [rax + 1]
jne 0x14004ffc0
mov rcx, qword [r15]
lea r8d, [rax + 1]
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [r15]
lea r9, [rbp + 0x48]
mov r8d, ebx
mov dword [rbp + 0x48], esi
mov rdx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rbx, [0x140140230]
inc r14
mov rcx, r14
shl rcx, 4
cmp qword [rcx + rbx], 0
lea rsi, [rcx + rbx]
jne 0x14004ff40
mov r14, qword [rsp + 0xa0]
xor ebx, ebx
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rcx, qword [r15]
lea r9, [rbp + 0x48]
mov r8d, 0x20
mov dword [rbp - 0x14], 0x80000000
lea rdx, [rbp - 0x28]
mov dword [rbp + 0x48], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
add rsp, 0x60
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
Function at 0x1400509c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
test r8d, r8d
je 0x140050a89
add rcx, 0x28
mov edx, 2
call fcn.140025da0
mov r9d, dword [rbx + 0x258]
lea rdx, [0x14012bb38]
mov r8, qword [rbx + 0x280]
lea rcx, [0x14012dc98]
mov byte [rsp + 0x40], 0
cmp word [rax + 8], 0x31
mov byte [rsp + 0x38], 0
cmove rcx, rdx
mov rdx, rsi
mov qword [rsp + 0x30], rcx
mov rcx, qword [rbx + 0x270]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 0
call fcn.140026dd0
mov esi, dword [rbx + 0x290]
lea r9, [rsp + 0x70]
imul esi, dword [rbx + 0x258]
mov rdx, qword [rbx + 0x270]
mov rcx, qword [rbx + 0x38]
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
imul esi, edi
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140050a9b
cmp dword [rsp + 0x70], esi
jne 0x140050a9b
add qword [rbx + 0x268], rdi
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x60]
mov eax, 0x80040206
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140051730
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov edx, 2
add rcx, 0x58
call fcn.140025da0
xor ebx, ebx
lea r8, [0x1401409e0]
mov edx, ebx
nop dword [rax + rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140051798
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140051798
add rdx, 2
cmp rdx, 0x12
jne 0x140051760
lea rcx, [rdi + 0x2c8]
mov edx, 8
call fcn.14002dca0
jmp 0x1400518a2
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
lea r8, [0x140140a08]
mov rdx, rbx
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400517d7
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400517d7
add rdx, 2
cmp rdx, 0x12
jne 0x1400517b0
jmp 0x140051890
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
lea r8, [0x140140a30]
mov rdx, rbx
nop
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140051814
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140051814
add rdx, 2
cmp rdx, 0x12
jne 0x1400517f0
jmp 0x140051890
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
lea r8, [0x140140a58]
mov rdx, rbx
nop dword [rax]
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140051854
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140051854
add rdx, 2
cmp rdx, 0x12
jne 0x140051830
jmp 0x140051890
mov edx, 2
lea rcx, [rdi + 0x58]
call fcn.140025da0
lea rdx, [0x140140a80]
nop dword [rax]
movzx ecx, word [rax + rbx*2]
cmp cx, word [rdx + rbx*2]
jne 0x1400518a2
movzx ecx, word [rax + rbx*2 + 2]
cmp cx, word [rdx + rbx*2 + 2]
jne 0x1400518a2
add rbx, 2
cmp rbx, 0x12
jne 0x140051870
mov edx, dword [rdi + 0x2ac]
lea rcx, [rdi + 0x3e8]
call fcn.14002eb00
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140024a80