joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140079d10
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
test rcx, rcx
mov rsi, rcx
mov rbp, rdx
je 0x140079e30
lea rdi, [0x14007d858]
mov rcx, rdi
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
mov rcx, rdi
mov rbx, rax
call sym.pthread_mutex_unlock
test rbx, rbx
je 0x140079e30
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x140079e30
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140079e30
test byte [rbx + 0x44], 4
jne 0x140079e40
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14007d868]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140079e60
cmp rsi, qword [rax + 0x1d8]
je 0x140079e88
mov eax, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test eax, eax
je 0x140079dbb
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140079dca
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140079dde
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rbp, rbp
je 0x140079e78
mov rax, qword [rbx + 8]
mov qword [rbp], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x140079e8f
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x140079e50
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call sym.push_pthread_mem.part.0
xor eax, eax
jmp 0x140079e26
call sym.__pthread_self_lite.part.0
test rax, rax
jne 0x140079d96
jmp 0x140079da3
call sym.pthread_mutex_destroy
jmp 0x140079e00
mov eax, 0x24
jmp 0x140079e35
call sym.replace_spin_keys.part.0
nop
nop word cs:[rax + rax]
Function at 0x140079ea0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
lea rbp, [0x14007d858]
mov rsi, rcx
mov rcx, rbp
mov rdi, rdx
call sym.pthread_mutex_lock
mov rcx, rsi
call sym.__pthread_get_pointer
test rax, rax
mov rbx, rax
je 0x140079fc0
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140079fc0
lea rdx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x140079fc0
test byte [rbx + 0x44], 4
jne 0x140079fe0
call sym._pthread_once_raw.constprop.0.isra.0
mov ecx, dword [0x14007d868]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14007a020
mov rdx, qword [rax + 0x1d8]
cmp rsi, rdx
je 0x14007a058
mov edx, dword [rbx + 0xbc]
mov rcx, qword [rbx + 0x28]
test edx, edx
jne 0x140079f47
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14007a000
mov rcx, qword [rbx + 0x28]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140079f5b
call rsi
mov qword [rbx + 0x30], 0
lea rcx, [rbx + 0x38]
test rdi, rdi
je 0x14007a038
mov rax, qword [rbx + 8]
mov qword [rdi], rax
call sym.pthread_mutex_destroy
lea rcx, [rbx + 0x68]
call sym.pthread_spin_destroy
cmp eax, 1
je 0x14007a06a
cmp qword [rbx + 0x1d0], 0
mov qword [rbx + 0x68], 0xffffffffffffffff
je 0x14007a048
mov rcx, rbp
call sym.pthread_mutex_unlock
xor eax, eax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x16
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rbx + 0xbc]
test eax, eax
jne 0x140079f43
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x10
jmp 0x140079fae
call sym.__pthread_self_lite.part.0
xor edx, edx
test rax, rax
jne 0x140079f15
jmp 0x140079f1c
call sym.pthread_mutex_destroy
jmp 0x140079f7c
mov rcx, rbx
call sym.push_pthread_mem.part.0
jmp 0x140079fa4
mov rcx, rbp
call sym.pthread_mutex_unlock
mov eax, 0x24
jmp 0x140079fae
call sym.replace_spin_keys.part.0
nop

Function at 0x14007a750
Capabilities:
Terminate process

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdi, [0x14007d878]
mov rbx, rcx
mov rcx, rdi
mov esi, edx
call sym.pthread_spin_lock
mov rax, qword [rbx]
cmp dword [rax], 0xbab1f0ed
jne 0x14007a799
mov rax, qword [rbx]
mov eax, dword [rax + 4]
test eax, eax
jle 0x14007a799
mov rax, qword [rbx]
mov rcx, rdi
sub dword [rax + 4], 1
call sym.pthread_spin_unlock
mov eax, esi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov dword [rsp + 0x20], 0x28
lea r9, str..._.._src_mingw_w64_mingw_w64_libraries_winpthreads_src_rwlock.c
lea r8, str.___rwlock_t__rwl___valid__LIFE_RWLOCK______rwlock_t__rwl___busy___0_
mov rcx, rax
lea rdx, str.Assertion_failed:___s___file__s__line__d_n
call sym.fprintf_1
mov ecx, 1
call sym.exit
nop
nop word cs:[rax + rax]
nop
Function at 0x14007abc0
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007abe8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
jne 0x14007ac11
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14007ac28
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x14007ac50
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x14007ac13
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14007ac13

Function at 0x14007ac80
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rdi, rdx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007aca8
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
mov rdx, rdi
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
jne 0x14007acd4
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14007acf0
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rdx, rdi
mov rcx, r12
call sym.pthread_mutex_timedlock
test eax, eax
mov edi, eax
je 0x14007ad20
cmp eax, 0x8a
je 0x14007ad50
mov rcx, rbp
call sym.pthread_mutex_unlock
mov edx, edi
jmp 0x14007acd6
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14007acd6
lock add dword [rsi + 0x10], 1
jmp 0x14007ad0c

Function at 0x14007ad60
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007ad88
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_trylock
test eax, eax
jne 0x14007adb1
lock add dword [rsi + 0xc], 1
cmp dword [rsi + 0xc], 0x7fffffff
je 0x14007adc8
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, eax
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
je 0x14007adf0
mov rcx, rdi
call sym.pthread_mutex_unlock
mov edx, ebp
jmp 0x14007adb3
mov eax, dword [rsi + 0x10]
mov rcx, r12
mov dword [rsi + 0x10], 0
sub dword [rsi + 0xc], eax
call sym.pthread_mutex_unlock
mov rcx, rdi
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
jmp 0x14007adb3
Function at 0x14007ae20
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007ae48
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [rbx]
lea rbp, [rsi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_trylock
test eax, eax
mov edx, eax
jne 0x14007ae9e
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_trylock
test eax, eax
mov edi, eax
jne 0x14007aed8
mov eax, dword [rsi + 8]
mov edx, 0x10
test eax, eax
jne 0x14007ae9e
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14007ae91
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14007aeb0
mov dword [rsi + 8], 1
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sym.rwl_unref
mov rcx, r12
call sym.pthread_mutex_unlock
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
jne 0x14007aed0
test eax, eax
mov esi, 0x10
cmovne esi, eax
mov edx, esi
jmp 0x14007ae9e
mov rcx, rbp
call sym.pthread_mutex_unlock
test eax, eax
cmovne edi, eax
mov edx, edi
jmp 0x14007ae9e

Function at 0x14007aef0
Capabilities:
Terminate process

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
call sym.rwl_ref_unlock
test eax, eax
jne 0x14007af70
mov rdi, qword [rbx]
mov edx, dword [rdi + 8]
lea rbp, [rdi + 0x20]
test edx, edx
je 0x14007af48
lock sub dword [rdi + 8], 1
mov rcx, rbp
call sym.pthread_mutex_unlock
lea rcx, [rdi + 0x18]
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
mov edx, esi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp sym.rwl_unref
mov rcx, rbp
call sym.pthread_mutex_lock
test eax, eax
mov esi, eax
jne 0x14007af2f
lock add dword [rdi + 0x10], 1
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x14007af80
mov rcx, rbp
call sym.pthread_mutex_unlock
mov esi, eax
jmp 0x14007af2f
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, [rdi + 0x28]
call sym.pthread_cond_signal
mov rcx, rbp
mov esi, eax
call sym.pthread_mutex_unlock
test esi, esi
cmove esi, eax
jmp 0x14007af2f
Function at 0x14007afa0
Capabilities:
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, rcx
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007afc8
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rsi, qword [rbx]
lea rdi, [rsi + 0x18]
mov rcx, rdi
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14007b019
lea r12, [rsi + 0x20]
mov rcx, r12
call sym.pthread_mutex_lock
test eax, eax
mov ebp, eax
jne 0x14007b0b0
mov edx, dword [rsi + 8]
test edx, edx
jne 0x14007b014
mov edx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
test edx, edx
jle 0x14007b010
sub eax, edx
mov dword [rsi + 0x10], 0
mov dword [rsi + 0xc], eax
test eax, eax
jg 0x14007b030
lock add dword [rsi + 8], 1
mov edx, ebp
mov rcx, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.rwl_unref
mov qword [rsp + 0x28], rsi
lea r13, [rsi + 0x28]
neg eax
mov dword [rsi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14007b07f
mov eax, dword [rsi + 0x10]
test eax, eax
jns 0x14007b0c0
mov rdx, r12
mov rcx, r13
call sym.pthread_cond_wait
test eax, eax
mov edi, eax
je 0x14007b078
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov ebp, edi
mov qword [rax], rdx
mov rcx, qword [rsp + 0x28]
call qword [rsp + 0x20]
jmp 0x14007b019
mov rcx, rdi
call sym.pthread_mutex_unlock
jmp 0x14007b019
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
mov qword [rax], rdx
mov dword [rsi + 0xc], 0
jmp 0x14007b014
Function at 0x14007b0e0
Capabilities:
Terminate process

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x14007b190
test rdx, rdx
je 0x14007b190
call sym.rwl_ref.constprop.0
test eax, eax
je 0x14007b120
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rdi, qword [rbx]
mov rdx, rsi
lea rbp, [rdi + 0x18]
mov rcx, rbp
call sym.pthread_mutex_timedlock
test eax, eax
mov edx, eax
jne 0x14007b177
lea r13, [rdi + 0x20]
mov rdx, rsi
mov rcx, r13
call sym.pthread_mutex_timedlock
test eax, eax
mov r12d, eax
jne 0x14007b1a8
mov edx, dword [rdi + 8]
test edx, edx
jne 0x14007b16f
mov edx, dword [rdi + 0x10]
mov eax, dword [rdi + 0xc]
test edx, edx
jle 0x14007b16b
sub eax, edx
mov dword [rdi + 0x10], 0
mov dword [rdi + 0xc], eax
test eax, eax
jg 0x14007b1b8
lock add dword [rdi + 8], 1
mov edx, r12d
mov rcx, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sym.rwl_unref
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rbp
call sym.pthread_mutex_unlock
jmp 0x14007b174
mov qword [rsp + 0x28], rdi
lea r14, [rdi + 0x28]
neg eax
mov dword [rdi + 0x10], eax
lea rax, [sym.st_cancelwrite]
mov qword [rsp + 0x20], rax
call sym.pthread_getclean
mov rax, qword [rax]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call sym.pthread_getclean
lea rdx, [rsp + 0x20]
mov qword [rax], rdx
lock or qword [rsp], 0
jmp 0x14007b204
test ebp, ebp
jne 0x14007b21b
mov r8, rsi
mov rdx, r13
mov rcx, r14
call sym.pthread_cond_timedwait
mov ebp, eax
mov eax, dword [rdi + 0x10]
test eax, eax
js 0x14007b200
call sym.pthread_getclean
mov rdx, qword [rsp + 0x30]
test ebp, ebp
mov qword [rax], rdx
jne 0x14007b240
mov dword [rdi + 0xc], 0
jmp 0x14007b16f
mov rcx, qword [rsp + 0x28]
mov r12d, ebp
call qword [rsp + 0x20]
jmp 0x14007b174
Function at 0x140004d20
Capabilities:
Check if file exists
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
lea rax, [rbp + 0x48]
mov qword [rbp + 0x150], pe_nt_image_headers64
lea rcx, [rbp + 0x158]
mov qword [rbp + 0x148], rax
mov r8d, 5
mov byte [rbp + 0x48], 0
lea rdx, str._.6f
mov byte [rbp + 0x15c], 0
call fcn.140037260
movsxd rdx, dword [rbp + 0x154]
mov r8d, dword [rbp + 0x150]
mov rcx, rdx
add rcx, qword [rbp + 0x148]
sub r8d, edx
movsxd rbx, r8d
lea rdx, str.res_
add rbx, rcx
mov byte [rbp + 0x15c], 0
movsxd r8, r8d
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
mov r8d, dword [rbp + 0x150]
test al, al
jne 0x140004dcd
mov edx, dword [rbp + 0x154]
add edx, 4
jmp 0x140004dd1
lea edx, [r8 - 1]
sub r8d, edx
movsxd rcx, edx
add rcx, qword [rbp + 0x148]
movsxd rbx, r8d
mov dword [rbp + 0x154], edx
add rbx, rcx
movsxd r8, r8d
lea rdx, str.adj.txt
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
test al, al
jne 0x140004e12
add dword [rbp + 0x154], 7
jmp 0x140004e20
mov eax, dword [rbp + 0x150]
dec eax
mov dword [rbp + 0x154], eax
lea rax, [rsp + 0x30]
mov qword [rbp + 0x38], pe_nt_image_headers64
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x30], rax
mov r8d, 5
mov byte [rsp + 0x30], 0
lea rdx, str._.6f
mov byte [rbp + 0x44], 0
call fcn.140037260
movsxd rdx, dword [rbp + 0x3c]
mov r8d, dword [rbp + 0x38]
mov rcx, rdx
add rcx, qword [rbp + 0x30]
sub r8d, edx
movsxd rbx, r8d
lea rdx, [0x14005b7c0]
add rbx, rcx
mov byte [rbp + 0x44], 0
movsxd r8, r8d
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
mov r8d, dword [rbp + 0x38]
test al, al
jne 0x140004e97
mov edx, dword [rbp + 0x3c]
add edx, 3
jmp 0x140004e9b
lea edx, [r8 - 1]
sub r8d, edx
movsxd rcx, edx
add rcx, qword [rbp + 0x30]
movsxd rbx, r8d
mov dword [rbp + 0x3c], edx
add rbx, rcx
movsxd r8, r8d
lea rdx, str.adj.txt
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
test al, al
jne 0x140004ed3
add dword [rbp + 0x3c], 7
jmp 0x140004edb
mov eax, dword [rbp + 0x38]
dec eax
mov dword [rbp + 0x3c], eax
mov rbx, qword [rbp + 0x148]
xor r8d, r8d
mov rdi, qword [rbp + 0x30]
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x140004f38
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x140004f1b
cmp eax, 5
lea r9, str._other_
lea rcx, str.dst_access_denied
cmove r9, rcx
jmp 0x140004f22
lea r9, str.src_not_found
mov r8, rbx
mov dword [rsp + 0x20], eax
mov rdx, rdi
lea rcx, str.failed_to_copy__s_to__s._reason:__s__ec_u_
call fcn.140015000
lea rcx, [rsp + 0x30]
mov byte [rbp + 0x2f], 0
mov r8d, pe_nt_image_headers64
lea rdx, str._x__ERROR:_DEALLOCATED_TEMP_STRING
call fcn.140037260
lea rcx, [rbp + 0x48]
mov byte [rbp + 0x2f], 0
mov r8d, pe_nt_image_headers64
mov byte [rbp + 0x147], 0
lea rdx, str._x__ERROR:_DEALLOCATED_TEMP_STRING
call fcn.140037260
lea r11, [rsp + 0x260]
mov byte [rbp + 0x147], 0
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140005750
Capabilities:
Check if file exists
Copy file

Disassembly:
test r8b, r8b
jne 0x1400058f1
mov rax, rsp
mov qword [rax + 0x18], rsi
push rbp
lea rbp, [rax - 0xd8]
sub rsp, 0x1d0
mov rsi, rdx
mov qword [rax + 8], rbx
mov rcx, rsi
mov qword [rax + 0x10], rdi
mov edx, 0x2f
call fcn.140024f0c
mov rdi, rax
test rax, rax
je 0x140005794
inc rdi
jmp 0x140005797
mov rdi, rsi
lea rax, [rbp + 0x50]
mov qword [rbp + 0x38], 0x80
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x30], rax
mov r8d, 5
mov byte [rbp + 0x50], 0
lea rdx, str._.6f
mov byte [rbp + 0x44], 0
call fcn.140037260
movsxd rdx, dword [rbp + 0x3c]
mov r8d, dword [rbp + 0x38]
mov rcx, rdx
add rcx, qword [rbp + 0x30]
sub r8d, edx
movsxd rbx, r8d
lea rdx, str.res_
add rbx, rcx
mov byte [rbp + 0x44], 0
movsxd r8, r8d
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
mov r8d, dword [rbp + 0x38]
test al, al
jne 0x14000580c
mov edx, dword [rbp + 0x3c]
add edx, 4
jmp 0x140005810
lea edx, [r8 - 1]
sub r8d, edx
movsxd rcx, edx
add rcx, qword [rbp + 0x30]
movsxd rbx, r8d
mov dword [rbp + 0x3c], edx
add rbx, rcx
movsxd r8, r8d
mov rdx, rdi
mov byte [rbx - 1], 0
call fcn.140037260
movzx eax, byte [rbx - 1]
mov byte [rbx - 1], 0
mov rbx, qword [rsp + 0x1e0]
test al, al
jne 0x14000585e
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140005850
add dword [rbp + 0x3c], eax
jmp 0x140005866
mov eax, dword [rbp + 0x38]
dec eax
mov dword [rbp + 0x3c], eax
lea rcx, [rsp + 0x30]
mov byte [rbp + 0x2f], 0
mov r8d, pe_nt_image_headers64
lea rdx, str._x__ERROR:_DEALLOCATED_TEMP_STRING
call fcn.140037260
xor r8d, r8d
mov byte [rbp + 0x2f], 0
lea rdx, [rbp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdi, qword [rsp + 0x1e8]
test eax, eax
jne 0x1400058e1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400058c3
cmp eax, 5
lea r9, str._other_
lea rcx, str.dst_access_denied
cmove r9, rcx
jmp 0x1400058ca
lea r9, str.src_not_found
lea r8, [rbp + 0x50]
mov dword [rsp + 0x20], eax
mov rdx, rsi
lea rcx, str.failed_to_copy__s_to__s._reason:__s__ec_u_
call fcn.140015000
mov rsi, qword [rsp + 0x1f0]
add rsp, 0x1d0
pop rbp
ret
Function at 0x140017190
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
xor eax, eax
mov rbp, rdx
mov qword [rcx], rax
mov r14, rcx
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
test rdx, rdx
je 0x1400172bf
mov qword [rsp + 0x30], rbx
lea r8d, [rax + 1]
mov r9, rdx
mov qword [rsp + 0x38], rsi
lea edx, [rax + 2]
mov qword [rsp + 0x40], rdi
add rcx, 0x1e
call fcn.140030c48
mov edx, 4
lea rcx, [r14 + 8]
mov r9, rbp
lea r8d, [rdx - 3]
call fcn.140030c48
mov edx, 2
lea rcx, [r14 + 0x1c]
mov r9, rbp
lea r8d, [rdx - 1]
call fcn.140030c48
mov edx, 1
lea rcx, [r14 + 0xc]
mov r8d, edx
mov r9, rbp
call fcn.140030c48
mov edx, 1
lea rcx, [r14 + 0xd]
mov r9, rbp
lea r8d, [rdx + 0xd]
call fcn.140030c48
movzx ecx, byte [r14 + 0xc]
mov r8d, 1
movzx eax, word [r14 + 0x1e]
imul ecx, eax
mov ebx, ecx
mov edx, ecx
lea rcx, [0x140251ea0]
call qword [0x140251ea0]
mov r8d, ebx
mov r9, rbp
mov rcx, rax
mov qword [r14 + 0x20], rax
mov edx, 1
call fcn.140030c48
mov eax, dword [r14 + 8]
lea rcx, [0x140251ea0]
mov r8d, 2
lea ebx, [rax + rax*2]
lea edx, [rbx + rbx]
call qword [0x140251ea0]
movsxd r8, ebx
mov r9, rbp
mov rcx, rax
mov qword [r14 + 0x28], rax
mov edx, 2
call fcn.140030c48
mov edx, 0x18
lea rcx, [r14 + 0x30]
mov r9, rbp
lea r8d, [rdx - 0x17]
call fcn.140030c48
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140022f00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r9
movsxd rsi, r8d
mov ebx, edx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov r9, qword [rdi + 0x10]
lea ecx, [rbx + 1]
mov edx, 1
shr ax, 0xf
shl dx, cl
movzx ecx, word [r9 + 0x4e]
movzx r8d, cx
and r8w, dx
test al, al
je 0x140022f7f
test r8w, r8w
jne 0x140022fc1
or cx, dx
mov word [r9 + 0x4e], cx
mov ecx, esi
call fcn.140014260
movzx eax, byte [rsp + 0x39]
mov byte [0x140252379], al
mov byte [0x140252378], 0
mov word [0x14025237a], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
test r8w, r8w
je 0x140022fc1
movsd xmm0, qword [0x140252aa8]
not dx
and dx, cx
mov rcx, rsi
mov word [r9 + 0x4e], dx
lea rdx, [0x140000000]
movzx eax, byte [rsi + rdx + 0x252380]
and al, 0xfb
or al, 2
add rcx, rcx
mov byte [rsi + rdx + 0x252380], al
movsd qword [rdx + rcx*8 + 0x2523f8], xmm0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret