joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rcx
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
mov ecx, dword [rax + 0x18]
jrcxz 0x1400040ca
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor r9, r9
xor rax, rax
lodsb al, byte [rsi]
ror r9d, 0xd
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
add rax, rdx
pop r8
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140002880
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x140072894], 0
lea rdi, [0x140072890]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002958
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400028b0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000298e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002970
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400029cf
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400029b3
cmp byte [r8], r9b
jne 0x1400029b3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400029a0
not eax
pop rdi
ret
Function at 0x140002bb0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140002bc9
mov qword [r8], 0
lea rdx, [0x140045940]
call fcn.1400029e0
mov rbx, rax
test rax, rax
jne 0x140002be8
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002ca8
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002ca8
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002ca8
mov rax, qword [0x1400725e0]
mov rbp, rsi
test rax, rax
je 0x140002c45
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002ca8
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140002c95
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400725e0]
test rax, rax
je 0x140002c8a
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002cb1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002ca3
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140002cb3
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013070
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x1400725e0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001318a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x1400130ca
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140014230
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x1400130de
mov edx, 8
mov rcx, rbx
call fcn.140014230
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001312a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x140013100
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140013139
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x140045944]
test rax, rax
movsxd rsi, esi
lea rdi, [0x1400725d8]
mov rcx, r15
cmovne rdi, rax
call fcn.1400029e0
mov rbx, rax
test rax, rax
je 0x140013185
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001ef30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f0e7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001efc6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001e900
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001df10
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001efb7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140013df0
mov dword [rbx + 0x80], 0
jmp 0x14001f0d3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001cd40
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140042730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140042791
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140042750
mov ecx, dword [r10]
jmp 0x14004287a
cmp ecx, 0x4e0
jb 0x14004287a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400427b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140042800
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1400434b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400434fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400434fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400434fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400434fa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400434fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400434fc
xor al, al
add rsp, 0x28
ret
Function at 0x140be5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140be51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140be5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140be506f
add dl, dl
jne 0x140be5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140be50f6
xor eax, eax
add dl, dl
jne 0x140be50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140be51ad
add dl, dl
jne 0x140be50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140be50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140be50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140be50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140be50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140be507e
mov eax, 1
add dl, dl
jne 0x140be5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140be5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140be50fb
sub eax, ebx
mov ebx, 1
jne 0x140be514c
mov ecx, 1
add dl, dl
jne 0x140be512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140be513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140be5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140be507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140be5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140be5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140be515d
cmp eax, 0x7d00
jae 0x140be519b
cmp eax, 0x500
jb 0x140be5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140be507e
cmp eax, 0x7f
ja 0x140be519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140be507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140be51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140be507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [rsi], al
jne 0x407091
pop rsi
pop rbx
ret
Function at 0x41a8fb
Capabilities:
Timestomp file

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x58
mov rbx, rcx
mov rsi, rdx
call fcn.0041f10d
mov r12, rax
mov rcx, rsi
call fcn.0041f10d
mov r13, rax
cmp byte [rbx], 0x2d
je 0x41aa15
cmp byte [rsi], 0x2d
je 0x41aa15
test r12, r12
je 0x41aa00
test rax, rax
je 0x41aa00
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, r12
mov r14, qword [sym.imp.KERNEL32.dll_CreateFileW]
call r14
mov rbx, rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 2
mov edx, 0x40000000
mov rcx, r13
call r14
mov r15, rax
cmp rbx, 0xffffffffffffffff
je 0x41aa1d
cmp rax, 0xffffffffffffffff
je 0x41a9d3
lea rsi, [rsp + 0x48]
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x41aa22
xor r14d, r14d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15, 0xffffffffffffffff
je 0x41a9ee
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x41aa03
xor r14d, r14d
mov eax, r14d
add rsp, 0x58
pop rbx
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14d, 1
jmp 0x41aa03
xor r14d, r14d
jmp 0x41a9df
mov r9, rsi
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor r14d, r14d
test eax, eax
setne r14b
jmp 0x41a9d6
Function at 0x41b3f8
Capabilities:
Create directory

Disassembly:
push r14
push r13
push r12
sub rsp, 0x340
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], r8
mov qword [rsp + 0x378], r9
mov byte [rsp + 0x140], 0xd
lea r8, [rsp + 0x368]
mov qword [rsp + 0x28], r8
lea r12, [rsp + 0x140]
lea r13, [rsp + 0x141]
mov rdx, rcx
mov rcx, r13
call sub.msvcrt.dll_vsprintf
mov ecx, 2
call qword [fcn.00457fe0]
mov rdx, rax
mov rcx, r12
call fcn.0041f3d7
call fcn.0041b1e5
mov rax, qword [0x004654d0]
mov edx, dword [rax]
test edx, edx
jne 0x41b483
add rsp, 0x340
pop r12
pop r13
pop r14
ret
cmp byte [0x004691c5], 0
je 0x41b566
movzx r14d, byte [0x004691c4]
test r14b, r14b
jne 0x41b5a1
movsx eax, r14b
test eax, eax
je 0x41b578
lea r14, [rsp + 0x30]
mov rcx, r14
mov r8d, dword [rcx]
add rcx, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
mov r9d, eax
and r9d, 0x80808080
je 0x41b4b5
mov edx, r9d
shr edx, 0x10
test eax, 0x8080
cmovne edx, r9d
lea r11, [rcx + 2]
cmovne r11, rcx
mov ecx, edx
add cl, dl
sbb r11, 3
movabs r10, 0x6b6361507661575c
mov qword [r11], r10
movabs r12, 0x6b6361707661775c
mov qword [r11 + 8], r12
mov dword [r11 + 0x10], 0x676f6c2e
mov byte [r11 + 0x14], 0
lea rdx, [0x0045ef9a]
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x41b5b7
mov rdx, r12
mov rcx, r13
call fcn.0041f3d7
mov rdx, r12
mov ecx, 0xa
call sub.msvcrt.dll_fputc
mov rcx, r12
call sub.msvcrt.dll_fclose
nop
add rsp, 0x340
pop r12
pop r13
pop r14
ret
lea rcx, [rsp + 0x30]
call fcn.0041a7b6
test eax, eax
jne 0x41b4ad
lea rdx, [0x0045ef9a]
lea rcx, str.c:wavpack.log
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
jne 0x41b537
add rsp, 0x340
pop r12
pop r13
pop r14
ret
lea rcx, [rsp + 0x30]
lea rdx, [0x004690c0]
call sub.msvcrt.dll_strcpy
jmp 0x41b4a1
cmp byte [0x004691c5], 0
je 0x41b6b9
cmp byte [0x004691c4], 0
jne 0x41b6c6
mov r9, r14
mov r8d, dword [r9]
add r9, 4
lea eax, [r8 - 0x1010101]
not r8d
and eax, r8d
mov r11d, eax
and r11d, 0x80808080
je 0x41b5d4
mov edx, r11d
shr edx, 0x10
test eax, 0x8080
cmovne edx, r11d
lea rcx, [r9 + 2]
cmove r9, rcx
mov eax, edx
add al, dl
sbb r9, 3
movabs r10, 0x6b6361507661575c
mov qword [r9], r10
mov byte [r9 + 8], 0
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41b578
mov r12, r14
mov r9d, dword [r12]
add r12, 4
lea eax, [r9 - 0x1010101]
not r9d
and eax, r9d
mov r8d, eax
and r8d, 0x80808080
je 0x41b63b
mov edx, r8d
shr edx, 0x10
test eax, 0x8080
cmovne edx, r8d
lea r11, [r12 + 2]
cmove r12, r11
mov ecx, edx
add cl, dl
sbb r12, 3
movabs r10, 0x6b6361707661775c
mov qword [r12], r10
mov dword [r12 + 8], 0x676f6c2e
mov byte [r12 + 0xc], 0
lea rdx, [0x0045ef9a]
mov rcx, r14
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x41b578
jmp 0x41b537
mov rcx, r14
call fcn.0041a7b6
jmp 0x41b5d1
lea rdx, [0x004690c0]
mov rcx, r14
call sub.msvcrt.dll_strcpy
jmp 0x41b5d1
Function at 0x41b6da
Capabilities:
Read file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rsi, rdx
mov ebx, r8d
mov rdi, r9
mov dword [r9], 0
xor ecx, ecx
test r8d, r8d
jne 0x41b709
jmp 0x41b720
mov ecx, eax
add ecx, dword [rdi]
mov dword [rdi], ecx
sub ebx, eax
je 0x41b720
add rcx, rsi
mov r9, r12
mov r8d, ebx
mov edx, 1
call sub.msvcrt.dll_fread
test eax, eax
jne 0x41b6ff
mov rcx, r12
call sub.msvcrt.dll_ferror
test eax, eax
sete al
movzx eax, al
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x41b73a
Capabilities:
Write file on windows

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rcx
mov rsi, rdx
mov ebx, r8d
mov rdi, r9
mov dword [r9], 0
xor ecx, ecx
test r8d, r8d
jne 0x41b769
jmp 0x41b780
mov ecx, eax
add ecx, dword [rdi]
mov dword [rdi], ecx
sub ebx, eax
je 0x41b780
add rcx, rsi
mov r9, r12
mov r8d, ebx
mov edx, 1
call sub.msvcrt.dll_fwrite
test eax, eax
jne 0x41b75f
mov rcx, r12
call sub.msvcrt.dll_ferror
test eax, eax
sete al
movzx eax, al
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x41b79a
Capabilities:
Get file size

Disassembly:
sub rsp, 0x38
test rcx, rcx
je 0x41b7e2
call qword [sym.imp.msvcrt.dll__fileno]
mov ecx, eax
call qword [sym.imp.msvcrt.dll__get_osfhandle]
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x41b7e2
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x28], eax
cmp eax, 0xffffffff
je 0x41b7d8
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41b7ce
xor eax, eax
add rsp, 0x38
ret
Function at 0x41f199
Capabilities:
Accept command line arguments
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbx, rcx
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x5c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r12, rax
test rax, rax
je 0x41f33c
movsxd rcx, dword [rsp + 0x5c]
shl rcx, 3
call sub.msvcrt.dll_malloc
mov qword [r13], rax
mov edx, dword [rsp + 0x5c]
mov dword [rbx], edx
test rax, rax
je 0x41f30f
test edx, edx
jle 0x41f2c5
xor r15d, r15d
mov r14, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x41f225
mov qword [rdi], rbx
mov rax, qword [r13]
cmp qword [rax + rbp], 0
je 0x41f2e0
add r15, 1
cmp dword [rsp + 0x5c], r15d
jle 0x41f2c5
lea rbp, [r15*8]
mov r8, qword [r12 + r15*8]
lea rdi, [rax + rbp]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov qword [rsp + 0x48], r8
xor edx, edx
mov ecx, 0xfde9
call r14
movsxd rcx, eax
mov rsi, rcx
call sub.msvcrt.dll_malloc
mov rbx, rax
test rax, rax
je 0x41f2bc
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x48]
xor edx, edx
mov ecx, 0xfde9
call r14
test eax, eax
jle 0x41f2bc
cmp esi, eax
jge 0x41f204
xor ebx, ebx
nop
jmp 0x41f204
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 2
call qword [fcn.00457fe0]
mov r9, rax
mov r8d, 0x1e
mov edx, 1
lea rcx, str._nFATAL:_utf16_to_utf8_failed_n_n
call sub.msvcrt.dll_fwrite
mov ecx, 0xffffffff
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.00457fe0]
mov r9, rax
mov r8d, 0x17
mov edx, 1
lea rcx, str._nFATAL:_Malloc_failed_n_n
call sub.msvcrt.dll_fwrite
or ecx, 0xffffffff
call sub.msvcrt.dll_exit
mov ecx, 2
call qword [fcn.00457fe0]
mov r9, rax
mov r8d, 0x23
mov edx, 1
lea rcx, str._nFATAL:_CommandLineToArgvW_failed_n_n
call sub.msvcrt.dll_fwrite
or ecx, 0xffffffff
call sub.msvcrt.dll_exit
nop
Function at 0x41f7b2
Capabilities:
Move file

Disassembly:
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov rsi, rdx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rcx
xor edx, edx
mov ecx, 0xfde9
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call rdi
movsxd rcx, eax
mov r13, rcx
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r12, rax
test rax, rax
je 0x41f8cc
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call rdi
test eax, eax
jle 0x41f8cc
cmp r13d, eax
jl 0x41f8cc
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call rdi
movsxd rcx, eax
mov rbx, rcx
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x41f947
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call rdi
test eax, eax
jle 0x41f947
cmp eax, ebx
jg 0x41f947
mov rdx, r13
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wrename]
mov esi, eax
mov rcx, r12
call sub.msvcrt.dll_free
mov rcx, r13
call sub.msvcrt.dll_free
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call rdi
movsxd rcx, eax
mov r14, rcx
add rcx, rcx
call sub.msvcrt.dll_malloc
mov r13, rax
test rax, rax
je 0x41f92a
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call rdi
test eax, eax
jle 0x41f92a
cmp r14d, eax
jge 0x41f93f
mov esi, 0xffffffff
mov eax, esi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
ret
or esi, 0xffffffff
jmp 0x41f8b4
mov rcx, r12
call sub.msvcrt.dll_free
nop
jmp 0x41f92a