joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008be40
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
call fcn.140246d00
nop
lea rax, vtable.juce::FileChooser::Pimpl.0
mov qword [rcx + 0xb0], rax
lea rax, vtable.juce::FileChooser::Native.0
mov qword [rcx], rax
lea rax, vtable.juce::FileChooser::Native.1.0
mov qword [rcx + 0xb0], rax
mov qword [rcx + 0xb8], rbx
mov ecx, 0x178
call fcn.14010a334
mov qword [rsp + 0x78], rax
lea rcx, [rbx + 8]
lea rdx, [rbx + 0x10]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdx
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call fcn.140089bf0
nop
mov qword [rsi + 0xc0], rax
test rax, rax
je 0x14008bee9
mov ecx, 1
lock xadd dword [rax + 8], ecx
mov rax, qword [0x14047d100]
test rax, rax
jne 0x14008bf14
mov ecx, 0x128
call fcn.14010a334
mov qword [rsp + 0x78], rax
mov rcx, rax
call fcn.14023c250
nop
mov qword [0x14047d100], rax
mov rcx, qword [rax + 0x78]
mov r8, qword [rcx]
mov rax, r8
movsxd rdx, dword [rcx + 0xc]
shl rdx, 6
add rdx, r8
cmp r8, rdx
je 0x14008bf3e
nop
cmp byte [rax], 0
jne 0x14008bf41
add rax, 0x40
cmp rax, rdx
jne 0x14008bf30
mov rax, r8
movups xmm1, xmmword [rax + 0x14]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
shr rax, 0x20
cdq
and edx, 3
add eax, edx
sar eax, 2
movq r8, xmm1
mov r10, r8
shr r10, 0x20
add r10d, eax
movd eax, xmm0
cdq
and edx, 3
add edx, eax
sar edx, 2
add edx, r8d
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, r10d
mov rcx, rsi
call fcn.140245390
mov dl, 1
mov rcx, rsi
call fcn.140245ea0
mov byte [rsp + 0x78], 0
lea rdx, [rsp + 0x78]
lea rcx, [0x1401c4150]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x78]
mov rcx, rsi
call fcn.140245950
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.140246070
nop
mov rax, rsi
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140094020
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0x20
cmp qword [0x14047d358], 0
mov rsi, rdx
jne 0x14009403a
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_]
int3
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call fcn.140081e90
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 2
shr ebx, 0xf
and ebx, 1
shl ebx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 0x20
mov ecx, 4
and al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x30]
mov ecx, edi
shr eax, 0xf
or ecx, 0x40
and al, 1
mov eax, dword [0x14047d2c0]
cmove ecx, edi
mov rdi, qword [rsp + 0x38]
and eax, 0xffffff8f
or ecx, eax
mov rax, rsi
mov dword [0x14047d2c0], ecx
mov dword [rsi], ecx
add rsp, 0x20
pop rsi
ret
Function at 0x140097860
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
call fcn.140081e90
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx ebx, ax
mov ecx, 2
shr ebx, 0xf
and ebx, 1
shl ebx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
mov edi, ebx
or edi, 0x20
mov ecx, 4
and al, 1
cmove edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsp + 0x30]
mov ecx, edi
shr eax, 0xf
or ecx, 0x40
and al, 1
mov eax, dword [0x14047d2c0]
cmove ecx, edi
and eax, 0xffffff8f
or ecx, eax
mov rax, rsi
mov dword [rsi], ecx
mov rsi, qword [rsp + 0x38]
mov dword [0x14047d2c0], ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14009a3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x90
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rsp + 0xd0], rbx
mov r15, r8
mov rbx, rdx
mov r12, rcx
mov qword [rbp + 0x67], rdx
mov r8, rdx
lea r13, [r15 - 1]
mov r14, r13
sar r14, 1
cmp rdx, r14
jge 0x14009a563
lea rax, [rbp - 0x11]
mov qword [rbp + 0x6f], rax
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
nop
lea rsi, [r8 + r8]
lea rax, [rbp - 0x11]
mov qword [rbp - 0x31], rax
mov rdi, rsi
shl rdi, 4
add rdi, r12
mov rcx, qword [rdi + 0x10]
mov qword [rbp - 0x11], rcx
mov rax, qword [rcx]
lea r8, [rdi + 0x18]
lea rdx, [rbp - 9]
call qword [rax + 0xb8]
nop
mov rcx, qword [rdi + 0x20]
mov qword [rbp - 0x21], rcx
mov rax, qword [rcx]
lea r8, [rdi + 0x28]
lea rdx, [rbp - 0x19]
call qword [rax + 0xb8]
nop
lea rax, [rbp - 1]
mov qword [rbp - 0x29], rax
lea rax, [rbp + 0xf]
mov qword [rbp - 0x31], rax
mov rcx, qword [rbp - 0x11]
mov qword [rbp - 1], rcx
mov rax, qword [rcx]
lea r8, [rbp - 9]
lea rdx, [rbp + 7]
call qword [rax + 0xb8]
nop
mov rcx, qword [rbp - 0x21]
mov qword [rbp + 0xf], rcx
mov rax, qword [rcx]
lea r8, [rbp - 0x19]
lea rdx, [rbp + 0x17]
call qword [rax + 0xb8]
nop
lea rdx, [rbp - 1]
lea rcx, [rbp + 0xf]
call fcn.1400720b0
test eax, eax
sets dil
mov rcx, qword [rbp - 0x21]
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
call qword [rax + 0xb0]
nop
mov rcx, qword [rbp - 0x11]
mov rax, qword [rcx]
lea rdx, [rbp - 9]
call qword [rax + 0xb0]
movzx r8d, dil
xor r8, 1
inc r8
add r8, rsi
mov rdx, r8
shl rdx, 4
add rdx, r12
shl rbx, 4
add rbx, r12
mov rcx, qword [rbx]
mov rax, qword [rdx]
mov qword [rbx], rax
mov qword [rdx], rcx
mov rax, qword [rbx + 8]
mov rcx, qword [rdx + 8]
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rax
mov rbx, r8
cmp r8, r14
jl 0x14009a450
mov r9, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x67]
cmp r8, r14
jne 0x14009a59d
test r15b, 1
jne 0x14009a59d
add r15, r15
shl rbx, 4
add rbx, r12
mov rcx, qword [rbx]
mov rax, qword [r12 + r15*8 - 0x10]
mov qword [rbx], rax
mov qword [r12 + r15*8 - 0x10], rcx
mov rax, qword [rbx + 8]
mov rcx, qword [r12 + r15*8 - 8]
mov qword [rbx + 8], rcx
mov qword [r12 + r15*8 - 8], rax
mov rbx, r13
mov r8, rdx
mov rdx, rbx
mov rcx, r12
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14009a850
Function at 0x1400a07b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1402528b0
mov rcx, rbx
call fcn.140252950
mov edi, eax
cmp eax, 0x7e
ja case.0x1400a07ef.12
lea rax, [0x140000000]
movzx edx, byte [rax + rdi + 0xa09e4]
mov r8d, dword [rax + rdx*4 + 0xa09b0]
add r8, rax
jmp r8
mov rcx, rbx
mov qword [rsp + 0x30], rsi
call fcn.1400a0fb0
mov esi, eax
test eax, eax
jne 0x1400a0825
mov rcx, rbx
call fcn.140252a70
cmp edi, 0x2e
jne 0x1400a0825
lea eax, [rsi + 9]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, esi
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140252a70
mov eax, 9
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140252a70
mov eax, 8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1400a0a70
mov eax, 7
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.140252950
cmp eax, 0x2b
je case.0x1400a07ef.11
jmp 0x1400a093d
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.1400a0fb0
test eax, eax
jne 0x1400a081a
mov rcx, rbx
call fcn.140252950
add eax, 0xffffffd3
test eax, 0xffffffef
jmp 0x1400a0940
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.140252950
cmp eax, 0x2f
jne 0x1400a08f4
mov rcx, rbx
call fcn.1402529d0
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 0x2a
jne 0x1400a093d
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.1400a12a0
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.140252950
cmp eax, edi
jne 0x1400a0935
mov rcx, rbx
call fcn.140252a70
mov rcx, rbx
call fcn.140252950
cmp eax, 0x3d
jne 0x1400a094a
mov rcx, rbx
call fcn.140252a70
mov eax, 3
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call fcn.1400a1390
mov eax, 0xa
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx ecx, di
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalpha]
test eax, eax
jne 0x1400a099e
cmp edi, 0x5f
je 0x1400a099e
cmp edi, 0x40
je 0x1400a099e
mov rcx, rbx
call fcn.140252a70
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1400a0b90
mov rcx, rdx
jmp 0x1400a07b0
Function at 0x1400b3f00
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, r8d
mov rcx, rdx
call sym.WavesHeadTracker.exe_public:_unsigned_long_long_unsigned___int64____cdecl_wvWavesV11_0_1_1::Utils::WCStMemObj::GetAllocatedPtrSize_void_const___ptr64
mov rcx, rbx
mov rdi, rax
call sym.WavesHeadTracker.exe_public:_unsigned_long_long_unsigned___int64____cdecl_wvWavesV11_0_1_1::Utils::WCStMemObj::GetAllocatedPtrSize_void_const___ptr64
mov rcx, rax
mov r8d, esi
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::DuplicateFile_struct_WTPathType__const___ptr64__struct_WTPathType__const___ptr64__enum_WECreateFlags_
Function at 0x1400ba5b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rsi, r8
mov ebx, edx
mov edi, ecx
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::Utils::IsVistaOrAbove_void_
test al, al
je 0x1400ba62e
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call sub.VCRUNTIME140.dll_memset
mov ecx, ebx
sub ecx, 7
je 0x1400ba65f
sub ecx, 7
je 0x1400ba610
cmp ecx, 1
jne 0x1400ba62e
lea rdx, str._public_Waves_Audio
jmp 0x1400ba617
lea rdx, str._public_
mov r9d, 0x104
lea r8, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.USERENV.dll_ExpandEnvironmentStringsForUserA]
test eax, eax
jne 0x1400ba6a8
mov r8, rsi
mov edx, ebx
mov ecx, edi
call fcn.1400ba6c0
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14010a310
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
cmp edi, 2
jne 0x1400ba62e
lea r9, [rsp + 0x20]
mov qword [rsp + 0x20], 0
xor r8d, r8d
lea rcx, [0x1402b87e0]
xor edx, edx
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1400ba62e
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 0x104
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov r8b, 1
lea rcx, [rsp + 0x30]
mov rdx, rsi
call sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::CreatePathRefFromString_char_const____ptr64__struct_WTPathType____ptr64____ptr64__bool_
jmp 0x1400ba63a
Function at 0x1400bae80
Capabilities:
Get common file path

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x590
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x580], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rdx], rax
mov qword [r8], rax
call sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::CreateFolder_struct_WTPathType__const___ptr64_
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400baf81
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x3ff
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x68], 0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call sym.WavesHeadTracker.exe_char_const____ptr64___cdecl_wvWavesV11_0_1_1::FM::GetNativePathAsString_struct_WTPathType__const___ptr64__class_WCFixedString_1023_____ptr64_
lea r9, [rsp + 0x470]
xor r8d, r8d
lea rdx, [0x1402b1870]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x1400baf96
mov r8b, 1
mov rdx, rbx
lea rcx, [rsp + 0x470]
call sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::CreatePathRefFromString_char_const____ptr64__struct_WTPathType____ptr64____ptr64__bool_
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400bafbc
mov eax, 0x1a4
mov word [rsp + 0x20], ax
mov r9, rsi
mov edx, 2
mov r8d, edx
mov rcx, qword [rbx]
call sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::CreateAFile_struct_WTPathType__const___ptr64__enum_WECreateFlags__enum_WEPermitions__struct_WTOpenFileType____ptr64____ptr64__unsigned_short_int_
mov dword [rsp + 0x30], eax
test eax, eax
jne 0x1400bafd1
jmp 0x1400baf66
mov rcx, qword [rsp + 0x580]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x590
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x34], eax
lea rdx, [0x140456c10]
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll__CxxThrowException
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x38], eax
lea rdx, [0x140456c10]
lea rcx, [rsp + 0x38]
call sub.VCRUNTIME140.dll__CxxThrowException
mov dword [rsp + 0x3c], eax
lea rdx, [0x140456c10]
lea rcx, [rsp + 0x3c]
call sub.VCRUNTIME140.dll__CxxThrowException
mov dword [rsp + 0x40], eax
lea rdx, [0x140456c10]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x1400baff0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x870
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov esi, r8d
mov rbx, rdx
mov rdi, rcx
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::FM::DoesFileExist_struct_WTPathType__const___ptr64_
test al, al
jne 0x1400bb030
mov eax, 0xfffffc16
jmp 0x1400bb114
mov rcx, rdi
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::FM::IsFile_struct_WTPathType__const___ptr64_
test al, al
jne 0x1400bb046
mov eax, 0xfffffc04
jmp 0x1400bb114
mov rcx, rbx
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::FM::DoesFileExist_struct_WTPathType__const___ptr64_
test al, al
je 0x1400bb061
cmp esi, 1
jne 0x1400bb061
mov eax, 0xfffffc15
jmp 0x1400bb114
mov rdx, rbx
mov rcx, rdi
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::FM::IsSamePath_struct_WTPathType__const___ptr64__struct_WTPathType__const___ptr64_
test al, al
je 0x1400bb07a
mov eax, 0xfffffbfa
jmp 0x1400bb114
lea rax, [rsp + 0x458]
mov qword [rsp + 0x448], 0x3ff
mov qword [rsp + 0x440], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x458]
mov byte [rsp + 0x458], 0
mov qword [rsp + 0x450], rax
mov rcx, rbx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], 0x3ff
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], 0
call sym.WavesHeadTracker.exe_char_const____ptr64___cdecl_wvWavesV11_0_1_1::FM::GetNativePathAsString_struct_WTPathType__const___ptr64__class_WCFixedString_1023_____ptr64_
lea rdx, [rsp + 0x440]
mov rcx, rdi
mov rbx, rax
call sym.WavesHeadTracker.exe_char_const____ptr64___cdecl_wvWavesV11_0_1_1::FM::GetNativePathAsString_struct_WTPathType__const___ptr64__class_WCFixedString_1023_____ptr64_
mov rcx, rax
xor r8d, r8d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x1400bb112
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
jmp 0x1400bb114
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.14010a310
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400bb1d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
cmp rcx, 0xffffffffffffffff
je 0x1400bb211
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400bb1fe
mov rcx, qword [rsp + 0x30]
xor eax, eax
mov qword [rbx], rcx
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffffbfe
add rsp, 0x20
pop rbx
ret
Function at 0x1400bb5a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov byte [rdx], bl
test rcx, rcx
je 0x1400bb623
xor r8d, r8d
mov rdx, rcx
lea rcx, [rsp + 0x58]
call fcn.140111800
mov ecx, dword [rax]
test ecx, ecx
je 0x1400bb61c
cmp ecx, 1
je 0x1400bb61c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [rdi + 0x18], 8
jb 0x1400bb5f3
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1400bb616
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
mov ebx, eax
mov dword [rsp + 0x20], eax
jmp 0x1400bb62c
and al, 1
mov byte [rsi], al
jmp 0x1400bb62c
mov ebx, 0xfffffc16
jmp 0x1400bb628
mov ebx, 0xfffff05d
mov dword [rsp + 0x20], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400bbcc0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
cmp rcx, 0xffffffffffffffff
je 0x1400bbd11
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400bbcfe
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov qword [rbx], rcx
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add rsp, 0x30
pop rbx
ret
mov eax, 0xfffffbfe
add rsp, 0x30
pop rbx
ret

Function at 0x1400bbd20
Capabilities:
Create shortcut via ishelllink

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call sym.WavesHeadTracker.exe_bool___cdecl_wvWavesV11_0_1_1::FM::IsWinShortcut_struct_WTPathType__const___ptr64_
test al, al
je 0x1400bbd4e
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp sym.WavesHeadTracker.exe_int___cdecl_wvWavesV11_0_1_1::FM::ResolveWinShortcut_struct_WTPathType__const___ptr64__struct_WTPathType____ptr64____ptr64_
mov rbx, qword [rsp + 0x30]
mov eax, 0xfffffbf7
add rsp, 0x20
pop rdi
ret
Function at 0x1400bc230
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
je 0x1400bc279
xor r9d, r9d
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400bc25e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400bc271
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0xfffffbfe
add rsp, 0x20
pop rbx
ret

Function at 0x1400bc3a0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, r9
cmp rcx, 0xffffffffffffffff
je 0x1400bc3e9
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400bc3d6
mov ecx, dword [rsp + 0x40]
xor eax, eax
mov qword [rbx], rcx
add rsp, 0x30
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.WavesHeadTracker.exe_int___cdecl_ConvertErrorWIN_unsigned_long_int_
add rsp, 0x30
pop rbx
ret
mov eax, 0xfffffbfe
add rsp, 0x30
pop rbx
ret

Function at 0x1400ca440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
xor ebx, ebx
mov ebp, r8d
mov rdi, rdx
mov r11, rcx
mov r10, rdx
mov r9d, ebx
test al, al
je 0x1400ca492
nop dword [rax]
movsx eax, al
lea r10, [r10 + 1]
add eax, r9d
imul r9d, eax, 0x401
mov eax, r9d
shr eax, 6
xor r9d, eax
movzx eax, byte [r10]
test al, al
jne 0x1400ca470
lea eax, [r9 + r9*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov r8, qword [r11 + rax*8]
lea rsi, [r11 + rax*8]
test r8, r8
je 0x1400ca510
nop
mov r10d, dword [r8]
mov ecx, r10d
sub ecx, 1
je 0x1400ca4db
sub ecx, 1
je 0x1400ca4d5
sub ecx, 1
je 0x1400ca4d5
cmp ecx, 1
je 0x1400ca4cf
mov rax, rbx
jmp 0x1400ca4df
lea rax, [r8 + 0x11]
jmp 0x1400ca4df
lea rax, [r8 + 0x18]
jmp 0x1400ca4df
lea rax, [r8 + 0x38]
mov r9, rdi
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1400ca503
inc rax
test ecx, ecx
jne 0x1400ca4f0
test edx, edx
je 0x1400ca53e
mov r8, qword [r8 + 8]
test r8, r8
jne 0x1400ca4b0
mov rdx, rdi
mov ecx, ebp
call fcn.1400d5450
test rax, rax
je 0x1400ca529
mov rcx, qword [rsi]
mov qword [rax + 8], rcx
mov qword [rsi], rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp r10d, ebp
cmove rbx, r8
mov rax, rbx
jmp 0x1400ca529

Function at 0x1400d2b30
Capabilities:
Hash data using murmur3

Disassembly:
mov r10, qword [rcx + 8]
mov eax, edx
mov r9, qword [rcx]
mov r11, rdx
shr eax, 0x10
dec r10
xor eax, edx
imul r8d, eax, 0x85ebca6b
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul eax, eax, 0xc2b2ae35
mov ecx, eax
mov edx, eax
shr rdx, 0x10
xor rdx, rcx
and rdx, r10
xor ecx, ecx
nop word [rax + rax]
mov rax, rdx
shl rax, 4
add rax, r9
mov r8, qword [rax]
cmp r8, r11
je 0x1400d2b9a
test r8, r8
je 0x1400d2b9a
inc rdx
add rdx, rcx
inc rcx
and rdx, r10
cmp rcx, r10
jbe 0x1400d2b70
xor eax, eax
ret
Function at 0x1400d4dd0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r12
push r13
sub rsp, 0x58
mov r13d, r9d
mov rbp, r8
mov r12, rdx
mov rbx, rcx
test r8, r8
jne 0x1400d4e09
xor eax, eax
mov dword [rcx], 1
mov dword [rcx + 0x10], eax
mov qword [rcx + 8], rax
mov rax, rcx
add rsp, 0x58
pop r13
pop r12
pop rbp
pop rbx
ret
mov qword [rsp + 0x88], rdi
xor edx, edx
mov edi, 2
mov qword [rsp + 0x90], r14
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
xor r8d, r8d
xor edx, edx
mov rcx, rbp
mov r14, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test r14, r14
jns 0x1400d4e5b
xor eax, eax
mov dword [rbx], edi
mov dword [rbx + 0x10], eax
mov qword [rbx + 8], rax
jmp 0x1400d4f1d
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x50], r15
lea r15, [r14 + 1]
mov rcx, r15
call qword [0x140470258]
mov rsi, rax
test rax, rax
jne 0x1400d4e8f
mov dword [rbx + 0x10], eax
mov dword [rbx], 3
mov qword [rbx + 8], rax
jmp 0x1400d4f10
mov r9, rbp
mov r8, r14
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, r14
je 0x1400d4ebe
mov rcx, rsi
call qword [0x140470260]
xor eax, eax
mov dword [rbx], edi
mov dword [rbx + 0x10], eax
mov qword [rbx + 8], rax
jmp 0x1400d4f10
mov eax, dword [rsp + 0xa0]
cmp eax, 8
je 0x1400d4ed7
cmp eax, 4
je 0x1400d4ed7
cmp eax, 7
jne 0x1400d4f3b
lea edi, [rax - 2]
mov r15, r14
mov rax, qword [rsp + 0xa8]
mov r9, rsi
mov qword [rsp + 0x48], rax
mov r8, r12
mov byte [rsp + 0x40], 1
mov rdx, r12
mov byte [rsp + 0x38], 1
mov rcx, rbx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r15
call fcn.1400d49e0
mov rsi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
mov rax, rbx
mov r14, qword [rsp + 0x90]
add rsp, 0x58
pop r13
pop r12
pop rbp
pop rbx
ret
test eax, eax
jne 0x1400d4f4a
mov rdx, r14
mov rcx, rsi
call fcn.1400d2cb0
mov edi, eax
cmp eax, 1
jne 0x1400d4ed7
mov byte [r14 + rsi], 0
jmp 0x1400d4eda