joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008310
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [rcx]
mov rbx, rcx
call qword [rax + 0x50]
test al, al
je 0x140008331
xor eax, eax
add rsp, 0x80
pop rbx
ret
mov qword [rsp + 0x90], rbp
xor ebp, ebp
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
cmp qword [rbx + 0x80], rbp
jne 0x140008509
mov r10d, 0x20
mov byte [rbx + 0xa0], 1
mov dword [rbx + 0xa4], r10d
lea r15, [0x14012c0a0]
mov esi, ebp
lea r13d, [rbp + 3]
mov eax, ebp
mov r11b, 1
mov r12d, 0x200
nop dword [rax + rax]
mov rax, qword [rax + r15 + 0x10]
lea r9d, [r10 + 7]
mov edi, dword [rbx + 0x64]
shr r9d, 3
imul r9d, edi
mov qword [rbx + 0xb0], rax
mov eax, dword [rbx + 0x94]
mov dword [rbx + 0xa8], r9d
test eax, eax
je 0x1400083d5
mov r8d, r9d
imul r8d, eax
jmp 0x1400083e1
mov r8d, dword [rbx + 0x60]
imul r8d, r9d
shr r8d, 3
xor edx, edx
mov dword [rbx + 0x88], 1
mov eax, r8d
mov ecx, 1
div r9d
sub r8d, edx
mov edx, r9d
cmp r8d, ecx
jbe 0x140008420
add ecx, ecx
cmp ecx, r8d
jb 0x140008403
movzx r10d, word [rbx + 0xa4]
movzx r11d, byte [rbx + 0xa0]
mov dword [rbx + 0x88], ecx
mov eax, ecx
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x78]
lea r8, [rbx + 0x80]
shr eax, 2
xorps xmm0, xmm0
cmp eax, r12d
mov word [rsp + 0x2c], r9w
mov word [rsp + 0x22], di
cmova eax, r12d
mov word [rsp + 0x2e], r10w
mov dword [rbx + 0x8c], eax
test r11b, r11b
mov eax, 1
mov word [rsp + 0x30], bp
cmovne ax, r13w
mov dword [rsp + 0x44], ebp
mov word [rsp + 0x20], ax
xor r9d, r9d
mov eax, dword [rbx + 0x60]
mov dword [rsp + 0x24], eax
imul eax, edx
lea rdx, [rsp + 0x38]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x38], 0x28
mov dword [rsp + 0x3c], 0x14000
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jns 0x140008509
mov rcx, qword [rbx + 0x78]
lea r8, [rbx + 0x80]
mov dword [rsp + 0x3c], ebp
lea rdx, [rsp + 0x38]
xor r9d, r9d
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jns 0x140008509
inc rsi
lea rax, [rsi + rsi*2]
lea rax, [rax*8]
movzx r11d, byte [rax + r15]
mov byte [rbx + 0xa0], r11b
movzx r10d, byte [rax + r15 + 1]
mov dword [rbx + 0xa4], r10d
test r10d, r10d
jne 0x1400083a0
mov eax, 0x80040204
jmp 0x140008560
mov rcx, qword [rbx + 0x80]
xor edx, edx
mov qword [rbx + 0xbc], rbp
mov rax, qword [rcx]
call qword [rax + 0x68]
movabs rax, 0x7fffffffffffffff
mov word [rbx + 0xb8], 0x101
mov qword [rbx + 0x98], rax
mov rcx, rbx
mov eax, dword [rbx + 0x88]
shr eax, 2
mov dword [rbx + 0x90], eax
call fcn.14000ce30
mov ecx, eax
shr ecx, 0x1f
test cl, cl
je 0x140008560
mov byte [rbx + 0xb8], bpl
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov r15, qword [rsp + 0x60]
add rsp, 0x80
pop rbx
ret
Function at 0x14000ce30
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0
mov rdi, rcx
jne 0x14000ce4b
mov eax, 0x80040207
add rsp, 0x30
pop rdi
ret
cmp qword [rcx + 0x20], 0
mov qword [rsp + 0x48], rbx
je 0x14000ce5e
mov dl, 1
call fcn.14000d0c0
mov rcx, qword [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rdi
call fcn.14000cb50
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x38]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
xor ebx, ebx
mov byte [rdi + 0x18], 0
mov qword [rdi + 0x40], rax
lea r8, [0x14000d190]
lea rax, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rdi + 0x20], rax
mov ecx, 0x80040200
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000ced0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x68], 0
mov rdi, rcx
je 0x14000ceeb
mov eax, 0x80040207
add rsp, 0x30
pop rdi
ret
test rdx, rdx
jne 0x14000cefb
mov eax, 0x80040201
add rsp, 0x30
pop rdi
ret
mov qword [rcx + 0x88], rdx
mov rcx, qword [rcx + 0x70]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rdi + 0x78]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rax, [rsp + 0x40]
xor ebx, ebx
mov qword [rsp + 0x28], rax
lea r8, [0x14000d150]
mov r9, rdi
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rdi + 0x68], rax
mov ecx, 0x80040200
cmove ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000d030
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x68]
movzx esi, dl
mov rbx, rcx
test rdi, rdi
je 0x14000d0ab
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test sil, sil
je 0x14000d0ab
mov edx, 1
lea rcx, [rbx + 0x78]
mov r8d, 0x9c4
call fcn.14000d8f0
test eax, eax
jne 0x14000d08b
lea edx, [rax + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x78]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x68], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000d0c0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x20]
movzx esi, dl
mov rbx, rcx
test rdi, rdi
je 0x14000d13b
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.KERNEL32.dll_SetEvent]
test sil, sil
je 0x14000d13b
mov edx, 1
lea rcx, [rbx + 0x30]
mov r8d, 0x9c4
call fcn.14000d8f0
test eax, eax
jne 0x14000d11b
lea edx, [rax + 1]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x30]
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x20], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140014b80
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
lea rax, vtable.awMixerFilter.0
mov rbx, rcx
mov qword [rcx], rax
lea rax, vtable.awMixerFilter.1.0
mov qword [rcx + 0x18], rax
mov rcx, qword [rcx + 0x58]
test rcx, rcx
je 0x140014bb0
call fcn.1400b60a4
xor ebp, ebp
cmp qword [rbx + 0x48], rbp
je 0x140014c83
mov qword [rsp + 0x30], rsi
mov esi, ebp
mov qword [rsp + 0x38], rdi
cmp dword [rbx + 0x30], ebp
jbe 0x140014c03
nop dword [rax]
mov eax, esi
imul rdi, rax, 0x218
add rdi, qword [rbx + 0x48]
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x140014bfc
cmp byte [rdi + 0x210], bpl
je 0x140014bf5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0xffffffffffffffff
inc esi
cmp esi, dword [rbx + 0x30]
jb 0x140014bd0
mov rax, qword [rbx + 0x48]
test rax, rax
je 0x140014c79
mov rsi, qword [rax - 8]
imul rdi, rsi, 0x218
mov qword [rsp + 0x40], r14
lea r14, [rax - 8]
add rdi, rax
test rsi, rsi
je 0x140014c61
nop dword [rax + rax]
lea rdi, [rdi - 0x218]
dec rsi
mov rcx, qword [rdi]
cmp rcx, 0xffffffffffffffff
je 0x140014c59
cmp byte [rdi + 0x210], bpl
je 0x140014c52
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], 0xffffffffffffffff
test rsi, rsi
jne 0x140014c30
mov rsi, qword [r14]
imul rdx, rsi, 0x218
mov rcx, r14
add rdx, 8
call fcn.1400b66cc
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140014cb4
cmp dword [rbx + 0x30], ebp
jbe 0x140014caf
mov eax, ebp
imul rcx, rax, 0x208
add rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc ebp
cmp ebp, dword [rbx + 0x30]
jb 0x140014c91
mov rcx, qword [rbx + 0x50]
call fcn.1400b60a4
lea rcx, [rbx + 0x40]
call fcn.140027db0
mov rcx, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
jmp fcn.1400256a0
Function at 0x140014ff0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rsi, rcx
mov edi, r9d
mov rcx, qword [rcx + 0x10]
mov rbp, r8
mov rbx, rdx
test rcx, rcx
je 0x1400151aa
cmp qword [rdx], 0xffffffffffffffff
je 0x1400151aa
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + htons]
cmp edi, dword [rsp + 0x38]
jb 0x140015045
mov eax, 0x80040201
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rsp + 0x44]
mov eax, 4
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400b609c
mov qword [rsi + 0x50], rax
test rax, rax
jne 0x140015082
mov eax, 0x80040202
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
movss xmm0, dword [rsp + 0x90]
mov rax, rbp
movss dword [rsi + 0x4c], xmm0
mov qword [rsi + 0x20], rbx
mov dword [rsi + 0x48], edi
mov qword [rsp + 0x78], r14
xor r14d, r14d
test rbp, rbp
mov edx, r14d
cmovns rdx, rbp
neg rax
test rbp, rbp
cmovns rax, r14
mov qword [rsi + 0x40], rax
mov qword [rsi + 0x30], rdx
lea rdx, [rsp + 0x70]
mov qword [rsi + 0x28], r14
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdi, qword [rsi + 0x30]
mov edx, r14d
test eax, eax
mov rax, qword [rsi + 0x20]
cmovne rdx, qword [rsp + 0x70]
xor r9d, r9d
shr rdx, 2
xor r8d, r8d
mov qword [rsi + 0x38], rdx
mov rcx, qword [rax]
cmp rdi, rdx
jle 0x14001516e
sub rdi, rdx
lea rdx, [rdx*4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r8d, dword [rsp + 0x44]
xor edx, edx
mov rcx, qword [rsi + 0x50]
shl r8, 2
call fcn.1400ba240
add qword [rsi + 0x38], rdi
test rdi, rdi
jle 0x14001517c
nop word [rax + rax]
mov ebx, dword [rsp + 0x44]
lea r9, [rsp + 0x70]
mov rcx, qword [rsi + 0x20]
cmp rdi, rbx
mov rdx, qword [rsi + 0x50]
cmovb ebx, edi
mov dword [rsp + 0x70], r14d
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx]
lea r8d, [rbx*4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
sub rdi, rax
test rdi, rdi
jg 0x140015130
jmp 0x14001517c
lea rdx, [rdi*4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, rsi
call fcn.140025f20
mov rcx, qword [rsi + 0x50]
mov ebx, eax
call fcn.1400b60a4
mov qword [rsi + 0x20], r14
mov eax, ebx
mov r14, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x80]
mov eax, 0x80040207
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400151c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x70], 0
mov rdi, rdx
mov rbx, rcx
jne 0x1400151db
call fcn.140025c30
cmp qword [rbx + 0x48], 0
je 0x140015245
mov qword [rsp + 0x38], rsi
xor esi, esi
mov qword [rdi], 0
mov eax, dword [rbx + 0x30]
test eax, eax
je 0x14001523e
nop word [rax + rax]
mov eax, esi
lea rdx, [rsp + 0x30]
imul rcx, rax, 0x218
add rcx, qword [rbx + 0x48]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ecx, ecx
test eax, eax
cmovne rcx, qword [rsp + 0x30]
shr rcx, 2
sub rcx, qword [rbx + 0x68]
cmp rcx, qword [rdi]
jle 0x140015235
mov qword [rdi], rcx
mov eax, dword [rbx + 0x30]
inc esi
cmp esi, eax
jb 0x140015200
mov rsi, qword [rsp + 0x38]
jmp 0x140015255
movabs rax, 0x7fffffffffffffff
mov qword [rdi], rax
mov eax, dword [rbx + 0x30]
mov dword [rdi + 8], eax
mov eax, dword [rbx + 0x70]
test eax, eax
je 0x140015262
mov dword [rdi + 0xc], eax
mov eax, dword [rbx + 0x34]
mov dword [rdi + 0x10], eax
mov eax, dword [rbx + 0x38]
mov rbx, qword [rsp + 0x40]
mov dword [rdi + 0x14], eax
add rsp, 0x20
pop rdi
ret
Function at 0x140015310
Capabilities:
Read file on windows

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov eax, dword [rcx + 0x38]
mov rbp, rcx
mov rcx, qword [rcx + 0x60]
cmp rcx, rax
mov r14d, ecx
cmovge r14d, eax
test r14d, r14d
jne 0x140015343
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
add rsp, 0x68
pop r14
pop rbp
jmp qword [rax + 0x18]
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x58], r13
xor r13d, r13d
mov r12d, r14d
sub rcx, r12
mov qword [rsp + 0x50], r15
mov r15d, r13d
mov qword [rbp + 0x60], rcx
cmp dword [rbp + 0x30], r13d
jbe 0x140015485
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
movaps xmmword [rsp + 0x40], xmm6
movss xmm6, dword [0x14012dee4]
movaps xmmword [rsp + 0x30], xmm7
movss xmm7, dword [0x14012c8dc]
nop
mov rax, qword [rbp + 0x40]
mov edi, r15d
mov rbx, qword [rax + rdi*8]
mov rax, qword [rbp + 0x58]
mov rsi, qword [rax + rdi*8]
cmp rsi, r12
jge 0x1400153c4
test esi, esi
jne 0x1400153c7
mov r8d, r14d
mov rcx, rbx
jmp 0x140015415
mov esi, r14d
mov rcx, qword [rbp + 0x48]
lea r8d, [rsi*4]
imul rax, rdi, 0x218
lea r9, [rsp + 0x80]
mov dword [rsp + 0x80], r13d
mov rdx, rbx
mov qword [rsp + 0x20], r13
mov rcx, qword [rax + rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rax, qword [rbp + 0x58]
mov ecx, esi
sub qword [rax + rdi*8], rcx
cmp esi, r14d
jae 0x140015420
mov r8d, r14d
lea rcx, [rbx + rcx*4]
sub r8d, esi
shl r8, 2
xor edx, edx
call fcn.1400ba240
cmp byte [rbp + 0x78], r13b
je 0x140015456
mov eax, r14d
nop dword [rax]
movss xmm0, dword [rbx]
dec eax
comiss xmm0, xmm6
jae 0x140015443
mov dword [rbx], 0xbf800000
jmp 0x14001544e
comiss xmm0, xmm7
jbe 0x14001544e
mov dword [rbx], 0x3f800000
add rbx, 4
test eax, eax
jne 0x140015430
inc r15d
cmp r15d, dword [rbp + 0x30]
jb 0x1400153a0
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm6, xmmword [rsp + 0x40]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rbp + 0x10]
mov r8d, r14d
mov rdx, qword [rbp + 0x40]
mov rax, qword [rcx]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
add rsp, 0x68
pop r14
pop rbp
jmp qword [rax + reloc.WSOCK32.dll_recv]
Function at 0x1400154c0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x48], 0
mov rbx, rcx
je 0x1400155b2
cmp qword [rcx + 0x10], 0
jne 0x1400154e6
mov eax, 0x80040207
add rsp, 0x30
pop rbx
ret
mov r8d, dword [rbx + 0x38]
add rcx, 0x40
mov edx, dword [rbx + 0x30]
call fcn.1400265b0
test al, al
je 0x1400155b2
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x28], rdi
xor edi, edi
mov qword [rsp + 0x20], r14
mov qword [rbx + 0x60], 0
cmp dword [rbx + 0x30], edi
jbe 0x14001558f
mov r14d, edi
imul rsi, r14, 0x218
add rsi, qword [rbx + 0x48]
mov rcx, qword [rsi]
cmp rcx, 0xffffffffffffffff
je 0x1400155ab
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rdx, qword [rbx + 0x68]
xor ebp, ebp
test eax, eax
mov rax, qword [rbx + 0x58]
cmovne rbp, qword [rsp + 0x40]
shr rbp, 2
cmp rbp, rdx
cmovl rdx, rbp
xor r9d, r9d
sub rbp, rdx
xor r8d, r8d
mov qword [rax + rdi*8], rbp
mov rcx, qword [rsi]
lea rdx, [rdx*4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp rbp, qword [rbx + 0x60]
jle 0x140015588
mov qword [rbx + 0x60], rbp
inc edi
cmp edi, dword [rbx + 0x30]
jb 0x140015521
xor eax, eax
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
mov eax, 0x80040204
jmp 0x140015591
mov eax, 0x80040202
add rsp, 0x30
pop rbx
ret
Function at 0x1400155c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov r10, qword [rcx + 0x20]
mov rsi, rcx
mov edi, r8d
test r10, r10
jne 0x1400155e2
mov eax, 0x80040203
add rsp, 0x48
pop rdi
pop rsi
ret
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x40], r15
movaps xmmword [rsp + 0x30], xmm6
test r8d, r8d
je 0x140015793
mov eax, dword [rcx + 0x48]
mov rbx, qword [rdx + rax*8]
mov rdx, qword [rcx + 0x40]
test rdx, rdx
jle 0x140015627
nop
mov eax, edi
mov ecx, edx
cmp rdx, rax
cmovge ecx, edi
lea rbx, [rbx + rcx*4]
sub edi, ecx
jne 0x140015610
jmp 0x140015793
mov rbp, qword [rcx + 0x38]
mov rdx, rdi
add qword [rcx + 0x28], rdx
xor r15d, r15d
mov rcx, qword [rcx + 0x30]
movss xmm6, dword [0x14012c8dc]
cmp rcx, rbp
jge 0x14001572b
mov rax, rbp
mov qword [rsp + 0x78], r14
sub rax, rcx
cmp rax, rdx
jge 0x14001565e
sub ebp, ecx
jmp 0x140015660
mov ebp, edi
mov rdx, qword [rsi + 0x50]
lea r14d, [rbp*4]
mov rcx, qword [r10]
lea r9, [rsp + 0x60]
mov r8d, r14d
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
ucomiss xmm6, dword [rsi + 0x4c]
mov rax, qword [rsi + 0x50]
mov ecx, ebp
jne 0x1400156bb
test ebp, ebp
je 0x1400156de
nop word [rax + rax]
movss xmm0, dword [rax]
addss xmm0, dword [rbx]
add rbx, 4
movss dword [rax], xmm0
add rax, 4
add ecx, 0xffffffff
jne 0x1400156a0
jmp 0x1400156de
test ebp, ebp
je 0x1400156de
nop
movss xmm0, dword [rbx]
add rbx, 4
mulss xmm0, dword [rsi + 0x4c]
addss xmm0, dword [rax]
movss dword [rax], xmm0
add rax, 4
add ecx, 0xffffffff
jne 0x1400156c0
mov rcx, qword [rsi + 0x20]
xor r9d, r9d
mov rdx, qword [rsi + 0x30]
xor r8d, r8d
shl rdx, 2
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x60]
mov rdx, qword [rsi + 0x50]
mov r8d, r14d
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r14, qword [rsp + 0x78]
mov eax, ebp
add qword [rsi + 0x30], rax
sub edi, ebp
je 0x140015793
ucomiss xmm6, dword [rsi + 0x4c]
je 0x140015762
mov rax, qword [rsi + 0x50]
mov ecx, edi
test edi, edi
je 0x14001575f
nop dword [rax + rax]
movss xmm0, dword [rbx]
lea rax, [rax + 4]
mulss xmm0, dword [rsi + 0x4c]
lea rbx, [rbx + 4]
movss dword [rax - 4], xmm0
add ecx, 0xffffffff
jne 0x140015740
mov rax, qword [rsi + 0x50]
mov rbx, rax
mov rcx, qword [rsi + 0x20]
lea r8d, [rdi*4]
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov rdx, rbx
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, edi
add qword [rsi + 0x30], rax
add qword [rsi + 0x38], rax
mov r15, qword [rsp + 0x40]
xor eax, eax
mov rbp, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
ret
Function at 0x140015a30
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, vtable.awNormalizeFilter.0
mov rbx, rcx
mov qword [rcx], rax
lea rax, vtable.awNormalizeFilter.1.0
mov qword [rcx + 0x18], rax
add rcx, 0xa8
call fcn.140027db0
mov rdi, qword [rbx + 0x778]
test rdi, rdi
je 0x140015a7f
mov rcx, rdi
call fcn.140015b30
mov edx, 0x20
mov rcx, rdi
call fcn.1400b6094
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140015a99
sub dword [rcx + 8], 1
jne 0x140015a99
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x20]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140015ab3
sub dword [rcx + 8], 1
jne 0x140015ab3
mov rax, qword [rcx]
mov edx, 1
call qword [rax + 0x20]
mov rcx, qword [rbx + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x140015ae7
cmp byte [rbx + 0x2c0], 0
je 0x140015acf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x2c8]
mov qword [rbx + 0xb0], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0xb0]
cmp rcx, 0xffffffffffffffff
je 0x140015b0e
cmp byte [rbx + 0x2c0], 0
je 0x140015b03
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0xb0], 0xffffffffffffffff
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400256a0
Function at 0x1400179f0
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
call fcn.140018860
mov edx, eax
shr edx, 0x1f
test dl, dl
jne 0x140017b88
cmp qword [rsi + 0x758], 0
jne 0x140017a20
mov eax, 0x80040207
add rsp, 0x50
pop rsi
ret
mov qword [rsp + 0x48], rbp
mov ebp, dword [rsi + 0x760]
imul ebp, dword [rsi + 0x50]
mov qword [rsp + 0x30], r15
test ebp, ebp
je 0x140017a40
mov eax, dword [rsi + 0x5c]
imul eax, ebp
jmp 0x140017a45
mov eax, 0x1000
mov ecx, eax
call fcn.1400b609c
mov r15, rax
test rax, rax
jne 0x140017a69
mov rbp, qword [rsp + 0x48]
mov eax, 0x80040202
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rsi
ret
mov rcx, qword [rsi + 0xb0]
xor r9d, r9d
mov qword [rsp + 0x60], rbx
xor r8d, r8d
xor ebx, ebx
mov qword [rsp + 0x38], r14
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov r14d, ebx
mov qword [rsp + 0x40], rdi
mov rcx, qword [rsi + 0xb0]
lea r9, [rsp + 0x70]
mov r8d, 4
mov dword [rsp + 0x70], ebx
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140017b5e
cmp dword [rsp + 0x70], 4
jne 0x140017b5e
test ebp, ebp
je 0x140017adc
mov edi, dword [rsp + 0x78]
imul edi, ebp
mov dword [rsp + 0x68], edi
jmp 0x140017b06
mov rcx, qword [rsi + 0xb0]
lea r9, [rsp + 0x70]
mov r8d, 4
mov dword [rsp + 0x70], ebx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [rsp + 0x68]
test edi, edi
je 0x140017b64
mov rcx, qword [rsi + 0xb0]
lea r9, [rsp + 0x70]
mov r8d, edi
mov dword [rsp + 0x70], ebx
mov rdx, r15
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140017b5e
cmp dword [rsp + 0x70], edi
jne 0x140017b5e
mov rcx, qword [rsi + 0x10]
mov rdx, r15
mov r9d, dword [rsp + 0x78]
mov r8d, dword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov ecx, eax
mov r14d, eax
shr ecx, 0x1f
test cl, cl
je 0x140017a92
jmp 0x140017b64
mov r14d, 0x80040205
mov rcx, r15
call fcn.1400b60a4
mov rdi, qword [rsp + 0x40]
mov eax, r14d
mov r14, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x48]
mov r15, qword [rsp + 0x30]
add rsp, 0x50
pop rsi
ret
Function at 0x140019520
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
push rsi
push rdi
sub rsp, 0x38
mov rsi, rdx
mov rdi, rcx
test r8d, r8d
jne 0x14001953f
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret
mov rcx, qword [rcx + 0x98]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rbp
lea rdx, [rsp + 0x60]
xor ebp, ebp
mov dword [rsp + 0x68], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400195da
cmp dword [rsp + 0x68], 4
jne 0x1400195da
mov qword [rsp + 0x50], rbx
mov ebx, ebp
cmp dword [rdi + 0x38], ebx
jbe 0x1400195b6
mov r8d, dword [rsp + 0x60]
lea r9, [rsp + 0x68]
mov rcx, qword [rdi + 0x98]
mov edx, ebx
mov dword [rsp + 0x68], ebp
lea r8d, [r8*4]
mov qword [rsp + 0x20], rbp
mov rdx, qword [rsi + rdx*8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
inc ebx
cmp ebx, dword [rdi + 0x38]
jb 0x140019581
mov r8d, dword [rsp + 0x60]
lea rcx, [rdi - 0x18]
mov rdx, rsi
call fcn.140016a00
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
pop rdi
pop rsi
ret
mov rbp, qword [rsp + 0x30]
mov eax, 0x80040206
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14001a5b0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
lea rax, vtable.awPeakLevelsFilter.0
mov rbx, rcx
mov qword [rcx], rax
lea rax, vtable.awPeakLevelsFilter.1.0
mov qword [rcx + 0x18], rax
mov rcx, qword [rcx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x14001a5f5
cmp byte [rbx + 0x468], 0
je 0x14001a5ea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x258], 0xffffffffffffffff
cmp word [rbx + 0x50], 0
lea rcx, [rbx + 0x50]
je 0x14001a606
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001a614
call fcn.1400b60a4
lea rcx, [rbx + 0x498]
call fcn.140027db0
mov rcx, qword [rbx + 0x258]
cmp rcx, 0xffffffffffffffff
je 0x14001a647
cmp byte [rbx + 0x468], 0
je 0x14001a63c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x258], 0xffffffffffffffff
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400256a0