joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072f50
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x2c8], 0
mov rbx, rcx
je 0x140072f7b
add rcx, 0x2cc
call fcn.14002d490
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140024a80
mov ecx, dword [rcx + 0x2ac]
mov eax, 1
movss xmm1, dword [0x14012c8dc]
dec ecx
shl eax, cl
xorps xmm0, xmm0
mov rcx, rbx
cvtsi2ss xmm0, rax
divss xmm1, xmm0
movss dword [rbx + 0x2cc], xmm1
add rsp, 0x20
pop rbx
jmp fcn.140024a80

Function at 0x140073500
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rdi, rcx
lea r9, [rbp + 0x480]
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov esi, 0x538
mov r8d, esi
mov dword [rbp + 0x480], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 0x32c]
lea rdx, [rbp + 0x480]
mov rcx, qword [rdi + 0x70]
ror word [rsp + 0x30], 8
ror word [rbp + 0x334], 8
bswap eax
mov dword [rbp + 0x32c], eax
mov eax, dword [rbp - 0x18]
bswap eax
mov dword [rbp - 0x18], eax
mov eax, dword [rbp + 0x220]
bswap eax
mov dword [rbp + 0x220], eax
mov eax, dword [rbp + 0x224]
bswap eax
mov dword [rbp + 0x224], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
movzx ecx, word [rsp + 0x30]
test eax, eax
cmovne rbx, qword [rbp + 0x480]
cmp rcx, rbx
jge 0x1400736cd
cmp cx, si
je 0x1400735dc
mov r8d, 6
lea rdx, str.Linear
lea rcx, [rbp + 0x337]
call fcn.1400f4ab4
test eax, eax
jne 0x1400736cd
movsx r9d, byte [rbp + 0x2e]
lea r8, [rbp + 0x2f]
mov edx, 3
lea rcx, [rdi + 0x58]
call fcn.140025fb0
cmp word [rbp + 0x334], 8
lea rax, [0x14012f1c8]
mov edx, 2
mov byte [rdi + 0x2c1], 1
lea r8, [0x14012f1f8]
cmovg r8, rax
lea rcx, [rdi + 0x58]
lea r9d, [rdx - 3]
call fcn.140025fb0
mov rcx, rdi
call fcn.140023ca0
movsx r8d, word [rbp + 0x334]
xor edx, edx
movzx eax, word [rsp + 0x30]
mov r9d, dword [rbp + 0x224]
mov qword [rdi + 0x290], rax
mov eax, dword [rbp + 0x32c]
mov dword [rdi + 0x28], eax
mov eax, dword [rbp - 0x18]
mov dword [rdi + 0x20], 1
mov byte [rdi + 0x38], 1
lea eax, [rax*8]
div r8d
mov ecx, eax
mov qword [rdi + 0x18], rcx
mov ecx, dword [rbp + 0x220]
lea eax, [rcx*8]
cdq
idiv r8d
mov dword [rdi + 0x48], eax
lea eax, [r9*8]
cdq
idiv r8d
movzx edx, byte [rbp + 0x464]
mov dword [rdi + 0x4c], eax
test dl, dl
je 0x1400736bb
test ecx, ecx
js 0x1400736bb
cmp r9d, ecx
jle 0x1400736bb
mov al, 1
cmp dl, 2
mov byte [rdi + 0x44], al
sete al
mov byte [rdi + 0x45], al
xor eax, eax
jmp 0x1400736d2
xor al, al
cmp dl, 2
mov byte [rdi + 0x44], al
sete al
mov byte [rdi + 0x45], al
xor eax, eax
jmp 0x1400736d2
mov eax, 0x8004020c
lea r11, [rsp + 0x570]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140073d30
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov byte [rcx + 0x2c1], 1
mov rbx, rcx
mov eax, dword [reloc.WSOCK32.dll_recv]
add rcx, 0x58
cmp eax, 8
je 0x140073d66
cmp eax, 0x18
lea r8, [0x14012f1c8]
lea rdx, [0x14012f1d8]
cmove r8, rdx
jmp 0x140073d6d
lea r8, [0x14012f1f8]
mov edx, 2
lea r9d, [rdx - 3]
call fcn.140025fb0
mov rcx, rbx
call fcn.140023ca0
mov eax, dword [0x14019027c]
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x70]
mov dword [rbx + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ecx, dword [rbx + 0x2ac]
xor edx, edx
test eax, eax
cmovne rdx, qword [rsp + 0x30]
imul ecx, dword [0x14019027c]
lea rax, [rdx*8]
cqo
idiv rcx
mov qword [rbx + 0x18], rax
mov eax, dword [0x140190280]
mov dword [rbx + 0x28], eax
xor eax, eax
mov qword [rbx + 0x290], 0
add rsp, 0x20
pop rbx
ret
Function at 0x140074f00
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rdi, qword [rcx + 0x290]
lea rdx, [rax + 8]
mov rbx, rcx
movaps xmmword [rax - 0x28], xmm6
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r14d, r14d
test eax, eax
mov ebp, r14d
cmovne rbp, qword [rsp + 0xe0]
cmp rdi, rbp
jge 0x14007510c
movss xmm6, dword [0x14012cb3c]
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0xe0]
mov r8d, 0x7f
mov dword [rsp + 0xe0], r14d
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rsp + 0x30], 0xf0
jne 0x140075119
cmp byte [rsp + 0x31], 0x7e
jne 0x140075119
movzx ecx, byte [rsp + 0x33]
sub ecx, 1
je 0x140075100
sub ecx, 1
je 0x140074fdd
cmp ecx, 1
je 0x140074fd4
add rdi, 6
jmp 0x140075103
add rdi, 7
jmp 0x140075103
mov ecx, dword [rbx + 0x2d4]
add rdi, 0x7f
movzx edx, byte [rsp + 0x34]
mov eax, ecx
and eax, 0x7f
cmp eax, edx
je 0x140075003
lea eax, [rcx - 1]
and eax, 0x7f
cmp eax, edx
je 0x140075103
mov eax, dword [rbx + 0x2cc]
mov rsi, qword [rbx + 0x2b8]
mov edx, dword [rbx + 0x1598]
cmp rsi, rax
cmovge esi, eax
lea eax, [rsi + rdx]
cmp eax, 0x4b0
jbe 0x140075061
mov rcx, qword [rbx + 0x10]
lea rax, [rbx + 0x2d8]
mov qword [rsp + 0xe0], rax
mov r8d, edx
lea rdx, [rsp + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140075160
mov dword [rbx + 0x1598], r14d
mov edx, r14d
mov r11d, edx
lea r8, [rsp + 0x35]
add r11, 0xb6
mov r10d, esi
lea r11, [rbx + r11*4]
test esi, esi
je 0x1400750da
nop dword [rax + rax]
mov edx, dword [rbx + 0x2c8]
dec r10d
mov r9d, r14d
mov ecx, 0x20
test edx, edx
je 0x1400750b4
nop word [rax + rax]
movzx eax, byte [r8]
add ecx, 0xfffffff9
shl eax, cl
inc r8
or r9d, eax
add edx, 0xffffffff
jne 0x1400750a0
lea eax, [r9 - 0x80000000]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm6
movss dword [r11], xmm0
add r11, 4
test r10d, r10d
jne 0x140075080
mov edx, dword [rbx + 0x1598]
inc dword [rbx + 0x2d4]
lea eax, [rsi + rdx]
mov dword [rbx + 0x1598], eax
mov eax, esi
sub qword [rbx + 0x2b8], rax
mov eax, dword [rbx + 0x2d4]
cmp eax, dword [rbx + 0x2d0]
jb 0x140075103
mov rdi, rbp
cmp rdi, rbp
jl 0x140074f60
mov rax, qword [rbx + 0x18]
cmp qword [rbx + 0x2b8], rax
jne 0x140075120
mov eax, 0x8004020d
jmp 0x140075160
mov r8d, dword [rbx + 0x1598]
test r8d, r8d
je 0x140075156
mov rcx, qword [rbx + 0x10]
lea rax, [rbx + 0x2d8]
mov qword [rsp + 0xe0], rax
lea rdx, [rsp + 0xe0]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x140075160
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140075480
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
movzx edx, byte [rcx + 0x2a4]
lea r14, [rcx + 0x2a8]
inc dword [rcx + 0x2a4]
lea rbx, [rbp - 0x44]
xor eax, eax
xorps xmm0, xmm0
mov rdi, rcx
mov qword [rbp + 0x27], rax
mov ecx, dword [rcx + 0x298]
and dl, 0x7f
movups xmmword [rbp - 0x49], xmm0
mov dword [rbp + 0x2f], eax
mov r12d, 1
mov esi, dword [rdi + 0x398]
mov r15d, r12d
shl r15d, cl
mov r9b, 2
mov word [rbp + 0x33], ax
dec r15d
mov byte [rbp + 0x35], al
mov r8b, 0x7e
mov eax, 0x20
mov word [rbp - 0x49], 0x7ef0
sub eax, ecx
mov byte [rbp - 0x46], r9b
movzx ecx, al
mov byte [rbp - 0x45], dl
shl r15d, cl
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
test esi, esi
je 0x140075576
nop word [rax + rax]
movss xmm0, dword [r14]
lea r14, [r14 + 4]
dec esi
call fcn.140027880
mov edx, dword [rdi + 0x29c]
add eax, 0x80000000
and eax, r15d
test edx, edx
je 0x140075564
mov ecx, eax
shl eax, 7
shr ecx, 0x19
mov byte [rbx], cl
inc rbx
add edx, 0xffffffff
jne 0x140075552
test esi, esi
jne 0x140075530
movzx edx, byte [rbp - 0x45]
movzx r9d, byte [rbp - 0x46]
movzx r8d, byte [rbp - 0x48]
movzx ecx, byte [rbp - 0x47]
xorps xmm2, xmm2
xor cl, dl
xorps xmm1, xmm1
xor cl, r9b
xor cl, r8b
xor ebx, ebx
mov byte [rbp + 0x34], cl
mov eax, ebx
nop
movdqu xmm0, xmmword [rbp + rax - 0x44]
pxor xmm0, xmm2
movdqa xmm2, xmm0
movdqu xmm0, xmmword [rbp + rax - 0x34]
add rax, 0x20
pxor xmm1, xmm0
cmp rax, 0x60
jl 0x140075590
pxor xmm2, xmm1
movdqa xmm0, xmm2
psrldq xmm0, 8
pxor xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
pxor xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
pxor xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
pxor xmm2, xmm0
movd eax, xmm2
xor cl, al
mov eax, 0x60
mov byte [rbp + 0x34], cl
nop dword [rax + rax]
xor cl, byte [rbp + rax - 0x44]
inc rax
mov byte [rbp + 0x34], cl
cmp rax, 0x78
jl 0x140075600
mov rcx, qword [rdi + 0x38]
lea r9, [rbp + 0x67]
mov r8d, 0x7f
mov byte [rbp + 0x35], 0xf7
lea rdx, [rbp - 0x49]
mov dword [rbp + 0x67], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14007563e
cmp dword [rbp + 0x67], 0x7f
je 0x140075641
mov r12d, ebx
mov ecx, dword [rdi + 0x398]
lea r11, [rsp + 0xb0]
add qword [rdi + 0x268], rcx
mov eax, r12d
mov rsi, qword [r11 + 0x40]
mov dword [rdi + 0x398], ebx
mov rbx, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140075910
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
xor ebx, ebx
lea r9, [rbp + 0x6f]
mov rdi, rcx
mov dword [rbp + 0x6f], ebx
mov rcx, qword [rcx + 0x70]
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x20], rbx
lea r8d, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rbp + 0x77], 0x3a584453
jne 0x140075b05
mov esi, ebx
lea r14, [rbp - 0x29]
nop dword [rax]
mov rcx, qword [rdi + 0x70]
lea r9, [rbp + 0x6f]
mov r8d, 1
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rbp + 0x67], 0x1a
je 0x140075990
inc esi
inc r14
cmp esi, 0x50
jb 0x140075960
mov rcx, qword [rdi + 0x70]
lea r9, [rbp + 0x6f]
mov r8d, 1
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rbp + 0x67], 1
jne 0x140075b05
mov esi, ebx
lea r14, [rbp - 0x29]
mov rcx, qword [rdi + 0x70]
lea r9, [rbp + 0x6f]
mov r8d, 1
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp + 0x67]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [rbp + 0x67], 0
je 0x1400759f0
inc esi
inc r14
cmp esi, 0x50
jb 0x1400759c0
test esi, esi
jne 0x140075a0a
mov rcx, qword [rdi + 0x70]
mov r9d, 1
mov edx, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rdi + 0x70]
lea r9, [rbp + 0x6f]
mov r8d, socket
mov dword [rbp + 0x6f], ebx
lea rdx, [rbp - 0x49]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, qword [rdi + 0x70]
lea r8, [rbp + 0x6f]
mov r9d, 1
mov qword [rbp + 0x6f], rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, 0xffffffffffffffff
mov dword [rdi + 0x20], 1
test eax, eax
mov eax, dword [rbp - 0x41]
mov qword [rdi + 0x18], rax
mov eax, dword [rbp - 0x45]
cmovne rcx, qword [rbp + 0x6f]
mov dword [rdi + 0x28], eax
movzx eax, byte [rbp - 0x46]
mov qword [rdi + 0x290], rcx
cmp al, 0x20
jbe 0x140075a89
mov eax, 0x80040208
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rdi + 0x58]
cmp al, 0x18
jbe 0x140075a9a
lea r8, [0x14012f1e8]
jmp 0x140075abb
cmp al, 0x10
jbe 0x140075aa7
lea r8, [0x14012f1d8]
jmp 0x140075abb
cmp al, 8
lea r8, [0x14012f1c8]
lea rdx, [0x14012f1f8]
cmovbe r8, rdx
mov edx, 2
lea r9d, [rdx - 3]
call fcn.140025fb0
mov rcx, rdi
call fcn.140023ca0
cmp byte [rbp - 0x35], 0x7f
mov byte [rdi + 0x38], 1
setne al
cmp byte [rbp - 0x35], 1
mov byte [rdi + 0x44], al
sete al
mov byte [rdi + 0x45], al
mov eax, dword [rbp - 0x3d]
mov dword [rdi + 0x48], eax
mov eax, dword [rbp - 0x39]
mov dword [rdi + 0x4c], eax
xor eax, eax
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0x8004020c
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140075c90
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x430
mov rbx, rcx
lea r9, [rax + 8]
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
xor edi, edi
mov r8d, 0x400
mov dword [rax + 8], edi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x30]
cmp eax, 0x1a364
jne 0x140075cdd
mov ecx, dword [rsp + 0x38]
xor sil, sil
jmp 0x140075d09
cmp eax, 0x64a30100
jne 0x140075e2a
mov eax, dword [rsp + 0x34]
mov sil, 1
mov ecx, dword [rsp + 0x38]
bswap eax
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
bswap eax
bswap ecx
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], ecx
movss xmm1, dword [rsp + 0x34]
xorps xmm0, xmm0
comiss xmm1, xmm0
mov qword [rbx + 0x290], 0x400
jbe 0x140075d29
cvttss2si rax, xmm1
jmp 0x140075d2e
mov eax, 0x5622
mov dword [rbx + 0x20], ecx
lea rdx, [rsp + 0x440]
mov rcx, qword [rbx + 0x70]
mov dword [rbx + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
mov eax, dword [rbx + 0x20]
cmovne rdi, qword [rsp + 0x440]
sub rdi, qword [rbx + 0x290]
lea ecx, [rax + rax]
mov rax, rdi
cqo
idiv rcx
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x140075d85
cmp eax, 4
jne 0x140075e3d
lea r8, [0x14012f260]
jmp 0x140075d8c
lea r8, [0x14012f1c8]
mov edx, 2
lea rdi, [rbx + 0x58]
mov rcx, rdi
lea r9d, [rdx - 3]
call fcn.140025fb0
mov rcx, rbx
mov byte [rbx + 0x2c1], 1
call fcn.140023ca0
lea rbx, [rsp + 0x40]
nop word [rax + rax]
movzx ecx, word [rbx]
mov r8, rbx
movzx edx, word [rbx + 2]
test sil, sil
je 0x140075dde
ror cx, 8
ror dx, 8
mov word [rbx + 2], dx
mov word [rbx], cx
add rbx, 4
movzx eax, dx
add rbx, rax
test cx, cx
je 0x140075e26
cmp cx, 2
je 0x140075e04
cmp cx, 4
jne 0x140075e19
movzx r9d, dx
mov edx, reloc.WSOCK32.dll_recv
jmp 0x140075e0d
movzx r9d, dx
mov edx, recv
add r8, 4
mov rcx, rdi
call fcn.140025fb0
lea rax, [rsp + 0x42f]
cmp rbx, rax
jb 0x140075dc0
xor eax, eax
jmp 0x140075e42
cmp eax, 0x1a396
je 0x140075e3d
cmp eax, 0x96a30100
mov eax, 0x8004020c
jne 0x140075e42
mov eax, 0x80040208
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140075ec0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x430
lea rsi, [0x14012bb38]
mov rdi, rcx
mov rdx, rsi
call fcn.140024c30
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x1400760ef
mov qword [rsp + 0x440], rbx
lea rcx, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x450], rbp
mov r8d, 0x3f0
call fcn.1400ba240
mov eax, dword [rdi + 0x260]
lea rcx, [rdi + 0x28]
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x1a364
mov ebp, 2
mov edx, ebp
cvtsi2ss xmm0, rax
mov eax, dword [rdi + 0x258]
mov dword [rsp + 0x38], eax
movss dword [rsp + 0x34], xmm0
call fcn.140025da0
mov rbx, 0xffffffffffffffff
mov r9, rax
mov rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [r9 + rdx*2 + 2]
movzx ecx, word [rsi + rdx*2 + 2]
sub r8d, ecx
jne 0x140075f87
add rdx, rbp
cmp rdx, 0xb
je 0x140075f87
movzx r8d, word [r9 + rdx*2]
movzx eax, word [rsi + rdx*2]
sub r8d, eax
je 0x140075f60
mov eax, dword [rsp + 0x30]
test r8d, r8d
bswap eax
mov dword [rsp + 0x30], eax
mov ecx, 4
mov eax, dword [rsp + 0x34]
cmove ecx, ebp
bswap eax
mov dword [rsp + 0x34], eax
mov edx, recv
mov eax, dword [rsp + 0x38]
bswap eax
bswap ecx
mov dword [rsp + 0x3c], ecx
mov rcx, qword [rdi + 0x10]
mov dword [rsp + 0x38], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x448], rax
mov rax, qword [rcx]
call qword [rax + 0x40]
mov r9, rax
test rax, rax
je 0x140076020
mov rcx, rbx
nop dword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x140075fe0
inc ecx
cmp ecx, 0x200
jge 0x140076004
mov rax, rbx
inc rax
cmp byte [r9 + rax], 0
jne 0x140075ff6
inc eax
jmp 0x140076009
mov eax, 0x200
mov r8d, ebp
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x448]
mov rcx, rdi
call fcn.140075e60
mov rcx, qword [rdi + 0x10]
mov edx, reloc.WSOCK32.dll_recv
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rbp, qword [rsp + 0x450]
test rax, rax
je 0x140076082
mov rcx, rbx
nop
inc rcx
cmp byte [rax + rcx], 0
jne 0x140076040
inc ecx
cmp ecx, 0x200
jge 0x140076060
inc rbx
cmp byte [rax + rbx], 0
jne 0x140076053
inc ebx
jmp 0x140076065
mov ebx, 0x200
mov r8d, 4
mov dword [rsp + 0x20], ebx
mov r9, rax
lea rdx, [rsp + 0x448]
mov rcx, rdi
call fcn.140075e60
xor ebx, ebx
lea rdx, [rsp + 0x448]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov rcx, rdi
call fcn.140075e60
mov rcx, qword [rdi + 0x38]
lea r9, [rsp + 0x448]
mov r8d, 0x400
mov dword [rsp + 0x448], ebx
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov byte [rdi + 0x289], 1
call fcn.140024080
mov rbx, qword [rsp + 0x440]
mov ecx, eax
shr ecx, 0x1f
test cl, cl
jne 0x1400760ef
mov rcx, rdi
call fcn.1400246e0
mov rsi, qword [rsp + 0x458]
add rsp, 0x430
pop rdi
ret
Function at 0x1400762d0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x50
xor eax, eax
lea r9, [rsp + 0x60]
mov rbx, rcx
mov dword [rsp + 0x60], eax
mov rcx, qword [rcx + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8d, [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x30], 0x53465253
je 0x140076311
mov eax, 0x8004020c
add rsp, 0x50
pop rbx
ret
movzx r8d, word [rsp + 0x3a]
xor edx, edx
mov eax, dword [rsp + 0x40]
div r8d
cmp word [rsp + 0x3c], 8
mov edx, 2
mov ecx, eax
mov eax, dword [rsp + 0x36]
mov dword [rbx + 0x20], r8d
lea r8, [0x14012f1f8]
mov dword [rbx + 0x28], eax
lea r9d, [rdx - 3]
lea rax, [0x14012f1c8]
mov qword [rbx + 0x18], rcx
cmova r8, rax
mov qword [rbx + 0x290], 0x20
lea rcx, [rbx + 0x58]
call fcn.140025fb0
cmp word [rsp + 0x3c], 8
ja 0x140076375
mov byte [rbx + 0x2c2], 1
mov rcx, rbx
call fcn.140023ca0
xor eax, eax
add rsp, 0x50
pop rbx
ret
Function at 0x140076fd0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rcx + 0x1c]
mov rbx, rcx
cmp edi, dword [rcx + 0x20]
jne 0x14007703a
mov r8d, dword [rcx + 0x24]
test r8d, r8d
jne 0x140076ffb
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp r8d, dword [rcx + 0x18]
lea r9, [rsp + 0x40]
mov rdx, qword [rbx + 0x10]
cmovge r8d, dword [rcx + 0x18]
xor edi, edi
mov dword [rcx + 0x20], r8d
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x40], edi
lea r8d, [r8*4]
mov qword [rsp + 0x20], rdi
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbx + 0x20]
sub dword [rbx + 0x24], eax
mov dword [rbx + 0x1c], edi
mov rax, qword [rbx + 0x10]
movsxd rcx, edi
mov eax, dword [rax + rcx*4]
lea ecx, [rdi + 1]
mov dword [rbx + 0x1c], ecx
mov rbx, qword [rsp + 0x48]
bswap eax
add rsp, 0x30
pop rdi
ret
Function at 0x140077d20
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov qword [rcx + 8], rdx
xor ebp, ebp
mov edi, r9d
mov rbx, r8
mov qword [rcx], rbp
mov r14, rcx
xor r9d, r9d
mov rcx, qword [rsi]
xor r8d, r8d
lea edx, [rbp + 5]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov qword [r14 + 0x10], rbx
lea rdx, [rsp + 0x40]
mov qword [r14 + 0x1c], rbp
shr edi, 2
mov dword [r14 + 0x18], edi
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rbx, qword [rsp + 0x48]
test eax, eax
cmovne rbp, qword [rsp + 0x40]
sub rbp, 5
sar rbp, 2
mov dword [r14 + 0x24], ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140077da0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
push rbx
push rdi
sub rsp, 0x68
movaps xmmword [rax - 0x48], xmm6
xor edi, edi
movaps xmmword [rax - 0x58], xmm7
mov ebx, edi
mov qword [rax + 8], rbp
mov r10d, edi
mov ebp, dword [rdx - 4]
mov r11d, edi
mov qword [rax - 0x18], rsi
mov esi, edi
mov qword [rax - 0x28], r13
mov r13d, r9d
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
mov r15, rdx
mov edx, ebp
movsxd rax, r8d
sub edx, r9d
sub ebp, dword [r15 - 8]
mov r14d, dword [r15 - 0xc]
sub r14d, dword [r15 - 8]
add r14d, ebp
test r8d, r8d
jle 0x140077e6d
mov qword [rsp + 0x58], r12
mov r12d, edi
mov rdi, rax
nop word [rax + rax]
mov r9d, dword [r15 + r12*4]
inc r12
sub r9d, r13d
mov r8d, r9d
mov eax, r9d
sub r8d, edx
cdq
xor eax, edx
mov ecx, r8d
sub eax, edx
sub ecx, ebp
add esi, eax
mov ebp, r8d
mov eax, r8d
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
add r10d, eax
mov eax, ecx
sub eax, r14d
mov r14d, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, r9d
add r11d, eax
cmp r12, rdi
jl 0x140077e10
mov r8d, dword [rsp + 0x90]
xor edi, edi
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x40]
cmp ebx, r10d
mov r14, qword [rsp + 0x48]
mov ecx, r10d
mov r13, qword [rsp + 0x50]
cmovl ecx, ebx
mov rbp, qword [rsp + 0x80]
cmp ecx, r11d
mov eax, r11d
cmovl eax, ecx
cmp esi, eax
jge 0x140077e9e
mov ebx, esi
jmp 0x140077eca
cmp r10d, r11d
mov eax, r11d
cmovl eax, r10d
cmp ebx, eax
jge 0x140077eb3
mov edi, 1
jmp 0x140077eca
cmp r10d, r11d
jge 0x140077ec2
mov ebx, r10d
mov edi, 2
jmp 0x140077eca
mov ebx, r11d
mov edi, 3
movd xmm7, r8d
xorps xmm6, xmm6
cvtdq2pd xmm7, xmm7
test esi, esi
jle 0x140077efd
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140148190]
divsd xmm0, xmm7
call fcn.1400f6310
mulsd xmm0, qword [0x140148198]
jmp 0x140077f00
xorps xmm0, xmm0
mov rax, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
cvtsd2ss xmm0, xmm0
movss dword [rax], xmm0
test ebx, ebx
jle 0x140077f3d
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x140148190]
divsd xmm0, xmm7
call fcn.1400f6310
movaps xmm6, xmm0
mulsd xmm6, qword [0x140148198]
mov rcx, qword [rsp + 0xa8]
xorps xmm0, xmm0
movaps xmm7, xmmword [rsp + 0x20]
mov eax, edi
cvtsd2ss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movss dword [rcx], xmm0
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x140078ae0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
movsxd r8, dword [rcx + 0x1c]
mov rbx, rcx
mov rax, qword [rcx + 0x10]
bswap edx
mov dword [rax + r8*4], edx
inc dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x18]
cmp dword [rcx + 0x1c], r8d
jne 0x140078b3a
mov rcx, qword [rcx + 8]
lea r8d, [r8*4]
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x48]
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x20], 0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [rbx + 0x1c], 0
add rsp, 0x30
pop rbx
ret

Function at 0x140078b40
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [rcx + 0x6c8], 0
mov rbx, rcx
je 0x140078bbe
mov qword [rsp + 0x48], rsi
xor esi, esi
mov qword [rsp + 0x50], rdi
mov edi, esi
cmp dword [rcx + 0x258], esi
jbe 0x140078bb4
nop dword [rax + rax]
mov ecx, dword [rbx + 0x298]
lea r9, [rsp + 0x40]
mov rax, qword [rbx + 0x6c0]
mov r8d, dword [rbx + 0x6c8]
imul ecx, edi
shl r8d, 2
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea rdx, [rax + rcx*4]
mov rcx, qword [rbx + 0x4a8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc edi
cmp edi, dword [rbx + 0x258]
jb 0x140078b70
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp method.awAudioOutputFilter.virtual_24