joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400618a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
cvtsi2sd xmm0, qword [rsp + 0x20]
movsd qword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
cvtsi2sd xmm0, dword [rsp + 0x70]
movsd xmm1, qword [0x14014fe40]
mulsd xmm1, xmm0
movaps xmm0, xmm1
movsd qword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
cvtsi2sd xmm0, rax
movsd qword [rsp + 0x38], xmm0
movsd xmm0, qword [rsp + 0x38]
divsd xmm0, qword [rsp + 0x40]
movsd qword [rsp + 0x50], xmm0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
movsd xmm0, qword [rsp + 0x48]
comisd xmm0, xmmword [rsp + 0x50]
ja 0x1400618f0
add rsp, 0x68
ret
Function at 0x140062500
Capabilities:
Create thread
Reference absolute stream path on windows
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x60]
lea r8, [0x140062480]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x14006255d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8d, dword [rsp + 0x30]
lea rdx, str.m_videoThreadId:_d
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_6407_:CPlayVideoWnd::StartTLMediaThread
call fcn.1400c46e0
mov dword [rsp + 0x34], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x60]
lea r8, [0x1400624c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400625c9
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
ret
Function at 0x140066000
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [rsp + 0x80]
mov rax, qword [rax + 0x148]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140066051
mov dword [rsp + 0x28], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1400053b0
mov eax, dword [rsp + 0x28]
jmp 0x1400661c9
xor edx, edx
mov eax, dword [rsp + 0xa0]
mov ecx, 0x3e8
div ecx
mov ecx, dword [rsp + 0x88]
add ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x80]
mov dword [rcx + 0x2c8], eax
mov rax, qword [rsp + 0x80]
mov r8d, dword [rax + 0x2c8]
lea rdx, [0x140131628]
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_8385_:CPlayVideoWnd::UpdateFFmpegConvertFileProgress
call fcn.1400c46e0
nop
cmp dword [rsp + 0x98], 0
jne 0x1400660bc
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x2c8]
mov dword [rsp + 0x98], eax
mov rcx, qword [rsp + 0x30]
call fcn.140051e30
movzx eax, al
test eax, eax
je 0x1400661b0
xorps xmm0, xmm0
movsd qword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov ecx, dword [rsp + 0x98]
mov eax, dword [rax + 0x2c8]
sub eax, ecx
mov eax, eax
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x14014fe78]
mov eax, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x90]
sub ecx, eax
mov eax, ecx
mov eax, eax
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x14014fe78]
divsd xmm0, xmm1
movsd qword [rsp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x20]
mulsd xmm0, qword [0x14014fed0]
movsd qword [rsp + 0x20], xmm0
movsd xmm0, qword [rsp + 0x20]
comisd xmm0, xmmword [0x14014fed0]
jb 0x14006615d
movsd xmm0, qword [0x14014fec8]
movsd qword [rsp + 0x20], xmm0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x38]
call fcn.140020770
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
cvttsd2si rax, qword [rsp + 0x20]
mov r9d, eax
mov r8, qword [rsp + 0x48]
mov rax, qword [rsp + 0x80]
mov edx, dword [rax + 0x2cc]
mov rcx, qword [rsp + 0x30]
call fcn.1400529b0
nop
mov dword [rsp + 0x2c], 0
mov rcx, qword [rsp + 0xa8]
call fcn.1400053b0
mov eax, dword [rsp + 0x2c]
add rsp, 0x78
ret
Function at 0x1400661d0
Capabilities:
Read file on windows
Read pipe
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1060
call fcn.140101360
sub rsp, rax
mov rax, qword [0x140173240]
xor rax, rsp
mov qword [rsp + CMFCToolBar::DrawButton], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x28], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1400662fb
cmp dword [rsp + 0x30], 0
jbe 0x1400662fb
movzx eax, word [0x1401316a8]
mov word [rsp + 0x50], ax
lea rax, [rsp + 0x52]
mov rdi, rax
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
cmp dword [rsp + 0x30], 0xfff
jbe 0x140066277
mov dword [rsp + 0x34], 0xfff
jmp 0x14006627f
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x1000
rep stosb byte [rdi], al
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x1078]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400662dd
lea rdx, [rsp + 0x50]
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_8415_:CPlayVideoWnd::ReadFileNamedPipe
call fcn.1400c46e0
mov dword [rsp + 0x3c], 0
jmp 0x1400662f1
lea rdx, [0x140131948]
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_8420_:CPlayVideoWnd::ReadFileNamedPipe
call fcn.1400c46e0
nop
mov dword [rsp + 0x40], 1
jmp 0x14006630f
lea rdx, [0x1401319b8]
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_8426_:CPlayVideoWnd::ReadFileNamedPipe
call fcn.1400c46e0
nop
xor eax, eax
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140100c60
add rsp, 0x1060
pop rdi
ret
Function at 0x140068e60
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0x28]
cmp eax, 5
jne 0x140068e9c
lea rdx, [0x140132188]
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_9081_:CPlayVideoWnd::SaveGpsRecordFile
call fcn.1400c46e0
nop
jmp 0x140068f08
mov rax, qword [rsp + 0xd0]
movzx eax, byte [rax + 0x28]
cmp eax, 4
jne 0x140068ec3
lea rdx, str.Not_Supply
lea rcx, str.D:_svnplayersvnTLDrivingRecordPlayWndDlg.cpp_9085_:CPlayVideoWnd::SaveGpsRecordFile
call fcn.1400c46e0
nop
jmp 0x140068f08
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x20]
call fcn.14002cf90
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov r8, qword [rsp + 0x30]
mov edx, dword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc0]
call fcn.140068670
nop
mov rcx, qword [rsp + 0xd0]
call fcn.140015f40
nop
add rsp, 0xb8
ret
Function at 0x1400767a0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x380
mov rax, qword [0x140173240]
xor rax, rsp
mov qword [rsp + 0x370], rax
mov dword [rsp + 0x40], 0xffffffff
lea rax, [rsp + 0x160]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
cmp qword [rsp + 0x390], 0
jne 0x140076808
mov edx, 0x208
lea rcx, [rsp + 0x160]
call fcn.140076950
lea rax, [rsp + 0x160]
mov qword [rsp + 0x390], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], operator
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rsp + 0x390]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0xffffffff
jne 0x140076919
lea rax, [rsp + 0x50]
lea rcx, [0x140133fc8]
sub rcx, rax
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140076891
inc rax
test dl, dl
jne 0x14007687e
xor eax, eax
jmp 0x140076896
sbb eax, eax
or eax, 1
test eax, eax
je 0x140076919
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140076919
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0
jmp 0x1400768e2
mov eax, dword [rsp + 0x44]
inc eax
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x48], 0
je 0x140076919
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x18]
cmp qword [rcx + rax*8], 0
je 0x140076919
movsxd rax, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx + rax*8]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
jmp 0x1400768d8
mov ecx, dword [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_ntohl]
jmp 0x14007692c
mov rcx, qword [rsp + 0x370]
xor rcx, rsp
call fcn.140100c60
add rsp, 0x380
pop rdi
ret
Function at 0x140076950
Capabilities:
Get hostname
Resolve dns

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
mov rax, qword [0x140173240]
xor rax, rsp
mov qword [rsp + 0x160], rax
cmp qword [rsp + 0x180], 0
je 0x140076a7f
cmp dword [rsp + 0x188], 0
jbe 0x140076a7f
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
je 0x140076a7d
lea rcx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1400769eb
mov r8d, operator
mov rax, qword [rsp + 0x40]
mov rdx, qword [rax]
lea rcx, [rsp + 0x50]
call fcn.140077f40
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x38], 0xffffffffffffffff
inc qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
cmp byte [rax + rcx], 0
jne 0x1400769fe
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x188]
cmp rax, rcx
jbe 0x140076a33
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x140076a8f
mov eax, dword [rsp + 0x188]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140076a6e
mov dword [rsp + 0x30], 1
jmp 0x140076a76
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
jmp 0x140076a8f
jmp 0x140076a8b
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x140076a8d
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140100c60
add rsp, 0x170
pop rdi
ret
Function at 0x140076fd0
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rcx, qword [rsp + 0x50]
call fcn.140076640
movzx eax, al
test eax, eax
jne 0x140077055
mov rcx, qword [rsp + 0x50]
call fcn.140076610
movzx eax, al
test eax, eax
je 0x140077055
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x50]
lea r8, [0x140077cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140077055
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x20], rcx
mov al, 1
jmp 0x140077059
jmp 0x140077057
xor al, al
add rsp, 0x48
ret
Function at 0x140077060
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
lea rdx, str.enter__StopComm
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_821_:CSocketComm::StopComm
call fcn.1400c46e0
nop
mov rcx, qword [rsp + 0x30]
call fcn.140076610
movzx eax, al
test eax, eax
je 0x1400770ac
lea rdx, str.CloseComm
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_825_:CSocketComm::StopComm
call fcn.1400c46e0
mov rcx, qword [rsp + 0x30]
call fcn.140076f80
nop
mov rcx, qword [rsp + 0x30]
call fcn.140076640
movzx eax, al
test eax, eax
je 0x140077158
lea rdx, str.kill_Thread
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_831_:CSocketComm::StopComm
call fcn.1400c46e0
mov edx, 1
mov ecx, dword [0x140133aec]
call qword [sym.imp.KERNEL32.dll_SleepEx]
lea rdx, [0x1401348e0]
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_833_:CSocketComm::StopComm
call fcn.1400c46e0
nop
mov edx, 0x3e8
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140077128
lea rdx, str.terminate_Thread
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_836_:CSocketComm::StopComm
call fcn.1400c46e0
nop
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x20], 0
lea rdx, str.leave__kill_Thread
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_840_:CSocketComm::StopComm
call fcn.1400c46e0
nop
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov rcx, rax
call fcn.140077db0
movzx eax, al
test eax, eax
jne 0x140077195
lea rdx, str._Clear_Address_list
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_846_:CSocketComm::StopComm
call fcn.1400c46e0
mov rax, qword [rsp + 0x30]
add rax, 0x30
mov rcx, rax
call fcn.140077d40
nop
mov rax, qword [rsp + 0x30]
cmp qword [rax + 0x40], 0
je 0x1400771d0
lea rdx, str._CloseHandle
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_853_:CSocketComm::StopComm
call fcn.1400c46e0
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x30]
mov qword [rax + 0x40], 0
lea rdx, str.leave__StopComm
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_857_:CSocketComm::StopComm
call fcn.1400c46e0
nop
jmp 0x1400771e6
add rsp, 0x28
ret
Function at 0x140077ce0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
cmp qword [rsp + 0x38], 0
je 0x140077d1d
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov qword [rax + 0x48], rcx
lea rdx, [0x140135130]
lea rcx, str.D:_svnplayersvnTLDrivingRecordSocketComm.cpp_1232_:CSocketComm::InitParam
call fcn.1400c46e0
nop
cmp qword [rsp + 0x40], 0
je 0x140077d33
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x50], rcx
jmp 0x140077d35
add rsp, 0x28
ret

Function at 0x14007dc40
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [0x140173240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x20], 1
mov dword [rsp + 0x24], 0
jmp 0x14007dc76
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 3
jge 0x14007dcf2
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
call fcn.140020770
nop
lea rdx, [0x1401366c4]
lea rcx, [rsp + 0x28]
call fcn.140005350
movsxd rax, dword [rsp + 0x24]
lea rcx, str.INDEX00.bin
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x28]
call fcn.140005350
nop
lea rcx, [rsp + 0x28]
call fcn.140005330
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14007dce2
mov byte [rsp + 0x20], 0
lea rcx, [rsp + 0x28]
call fcn.1400053b0
nop
jmp 0x14007dcf2
lea rcx, [rsp + 0x28]
call fcn.1400053b0
nop
jmp 0x14007dc6c
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
mov rcx, qword [rsp + 0x68]
call fcn.1400053b0
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140100c60
add rsp, 0x58
ret
Function at 0x140090ab0
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x160
mov rax, qword [0x140173240]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
rep stosb byte [rdi], al
lea rcx, [rsp + 0xd0]
call fcn.14000f190
nop
mov rax, qword [rsp + 0x178]
movzx eax, byte [rax + 0x29]
mov dword [rsp + 0xb8], eax
mov rax, qword [rsp + 0x178]
mov eax, dword [rax + 0x2a]
mov dword [rsp + 0xc0], eax
mov rax, qword [rsp + 0x178]
mov eax, dword [rax + 0x2e]
mov dword [rsp + 0xc4], eax
mov byte [rsp + 0xc8], 0
mov rax, qword [rsp + 0x178]
mov eax, dword [rax + 7]
mov dword [rsp + 0xbc], eax
mov rax, qword [rsp + 0x178]
mov eax, dword [rax + 3]
mov dword [rsp + 0xcc], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rax, [rsp + 0x98]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x178]
movzx eax, byte [rax + 0xc]
mov rcx, qword [rsp + 0x170]
mov rcx, qword [rcx + 0x3b8]
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x50]
call fcn.140001fa0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0xf0]
call fcn.14004d330
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x178]
movzx eax, word [rax + 0xd]
mov dword [rsp + 0x48], eax
mov rcx, qword [rsp + 0x70]
call fcn.140005330
mov ecx, dword [rsp + 0x48]
mov r9d, ecx
mov r8, rax
lea rdx, str._s_fly_05d.ifv
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
nop
lea rcx, [rsp + 0xf0]
call fcn.1400053b0
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCPropertyGridProperty::GetHierarchyLevel]
mov edx, eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_Ordinal_4946]
mov rdx, rax
lea rcx, [rsp + 0xd0]
call fcn.140005380
mov edx, 0xffffffff
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CDialogImpl::ProcessMouseClick]
lea rcx, [rsp + 0xd0]
call fcn.140005330
mov ecx, dword [rsp + 0xc4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rsp + 0xc0]
mov dword [rsp + 0x28], ecx
mov ecx, dword [rsp + 0xb8]
mov dword [rsp + 0x20], ecx
mov r9d, dword [rsp + 0xbc]
mov r8, rax
lea rdx, str.filePath:_s_fileOffset:_u_channelNum:_d_startTime:_u_endTime:_u_n
lea rcx, str.D:_svnplayersvnTLDrivingRecordBackupMediaFile.cpp_2322_:CBackupMediaFile::InsertOneRecordFile
call fcn.1400c4810
nop
mov rax, qword [rsp + 0x178]
add rax, 0x2a
lea r8, [rsp + 0xb8]
mov rdx, rax
lea rcx, [rsp + 0x110]
call fcn.14009c380
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x180]
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x88]
mov rcx, rax
call fcn.14009c3e0
nop
lea rcx, [rsp + 0x110]
call fcn.140090d40
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0xb8]
call fcn.140088cb0
nop
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140100c60
add rsp, 0x160
pop rdi
ret
Function at 0x140093750
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x70]
add rax, 0x398
mov rcx, rax
call fcn.140005330
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009377d
xor al, al
jmp 0x1400937ce
mov dword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
add rax, 0x398
mov rdx, rax
mov rcx, qword [rsp + 0x28]
call fcn.140020770
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov r9d, dword [rsp + 0x20]
mov r8b, 1
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.140093330
nop
add rsp, 0x68
ret

Function at 0x140094740
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
add rax, 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rsp + 0x50]
movzx eax, byte [rax + 0x260]
test eax, eax
je 0x140094788
mov rax, qword [rsp + 0x50]
add rax, 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x140094901
mov rax, qword [rsp + 0x50]
add rax, 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
cmp qword [rcx + rax + 0x108], 0
je 0x140094825
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rax + 0x108]
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + rcx + 0x108]
mov rax, qword [rax]
xor edx, edx
call qword [rax + 0x1b0]
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rax + 0x108]
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + rcx + 0x108]
mov rax, qword [rax]
xor edx, edx
call qword [rax + 0x198]
nop
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
cmp qword [rcx + rax + 0x108], 0
je 0x1400948ad
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rax + 0x108]
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + rcx + 0x108]
mov rax, qword [rax]
mov dl, 1
call qword [rax + 0x1b0]
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx + rax + 0x108]
mov ecx, 8
imul rcx, rcx, 1
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rdx + rcx + 0x108]
mov rax, qword [rax]
mov dl, 1
call qword [rax + 0x198]
nop
mov dword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, qword [rsp + 0x50]
lea r8, [0x1400944b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140094901
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x48
ret
Function at 0x1400967b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rcx, qword [rsp + 0x48]
call fcn.1400080a0
test rax, rax
ja 0x1400967da
mov rcx, qword [rsp + 0x48]
call fcn.1400053b0
nop
jmp 0x14009681a
mov rcx, qword [rsp + 0x48]
call fcn.140005330
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14013d580]
lea rdx, [0x14013d738]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400053b0
nop
add rsp, 0x38
ret