joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14016b280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
sub esi, dword [rdi + 0x9c]
mov ecx, dword [rdi + 0x44]
sub esi, edx
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x14016b33c
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1400c0020
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x14016b300
sub eax, ebx
jmp 0x14016b302
xor eax, eax
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x14016b2f0
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
nop word [rax + rax]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x14016b330
sub eax, ebx
jmp 0x14016b332
xor eax, eax
mov word [rcx], ax
add edx, 0xffffffff
jne 0x14016b320
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x14016b3b6
mov edx, dword [rdi + 0x9c]
mov r8d, esi
mov eax, dword [rdi + 0x94]
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.14016b760
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x14016b3a0
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x14016b3b6
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x14016b2a0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14016cd60
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jne 0x14016cd68
xor eax, eax
ret
jmp fcn.14016ca60
Function at 0x140171740
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
lea rcx, [rax - 0x10]
lea rbx, [0x1402901c8]
cmp rcx, rbx
je 0x140164bf0
mov eax, 1
lock xadd dword [rcx], eax
lea r8, [0x14028fa7c]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140185a50
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x140164c3c
or eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x140164c3c
call fcn.1400bd658
add rsp, 0x30
pop rbx
ret
mov rcx, qword [0x1404be420]
test rcx, rcx
je 0x140171753
mov rax, qword [rcx]
jmp qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, rdx
jmp 0x140164bc0

Function at 0x140172be0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rbp, rcx
mov esi, 1
cmp edx, esi
cmovg esi, edx
sub esi, 1
js 0x140172c5a
mov ecx, 0xd0
call fcn.1400bd614
mov qword [rsp + 0x80], rax
mov rdx, rbp
mov rcx, rax
call fcn.14003e6b0
mov rbx, rax
mov edx, dword [rbp + 0x28]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1400305b0
movsxd rdx, dword [rbp + 0x28]
lea ecx, [rdx + 1]
mov dword [rbp + 0x28], ecx
mov rcx, qword [rbp + 0x18]
mov qword [rcx + rdx*8], rbx
sub esi, 1
jns 0x140172c15
mov rsi, qword [rbp + 0x18]
movsxd rax, dword [rbp + 0x28]
lea r14, [rsi + rax*8]
cmp rsi, r14
je 0x140172d4f
xor r15d, r15d
lea r12d, [r15 + 2]
nop word [rax + rax]
mov rdi, qword [rsi]
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rdi + 0x75], r15b
mov rax, qword [rdi + 0x10]
test rax, rax
jne 0x140172d38
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rdi
lea r8, [0x1401649a0]
mov edx, dword [rdi + 0x68]
xor ecx, ecx
call fcn.1400c31b0
mov qword [rdi + 0x10], rax
mov eax, dword [rsp + 0x78]
mov qword [rdi + 0x18], rax
mov eax, dword [rdi + 0x60]
mov rcx, qword [rdi + 0x10]
cmp eax, 1
jge 0x140172ce0
mov ebx, 0xfffffff1
jmp 0x140172d18
cmp eax, r12d
jge 0x140172cec
mov ebx, 0xfffffffe
jmp 0x140172d18
cmp eax, 5
jge 0x140172cf6
or ebx, 0xffffffff
jmp 0x140172d18
cmp eax, 7
jge 0x140172d00
mov ebx, r15d
jmp 0x140172d18
cmp eax, 9
jge 0x140172d0c
mov ebx, 1
jmp 0x140172d18
mov ebx, SafeArrayGetDim
cmp eax, 0xa
cmovl ebx, r12d
test rcx, rcx
jne 0x140172d26
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsi, 8
cmp rsi, r14
jne 0x140172c80
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14017ab50
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1e0
mov rax, qword [0x1404a90f8]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rax, qword [rdx]
mov rbx, rcx
mov qword [rcx], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
lea rcx, [rax - 0x10]
movsxd rdi, r9d
lea rax, [0x1402901c8]
cmp rcx, rax
je 0x14017ab9e
mov eax, 1
lock xadd dword [rcx], eax
mov dword [rbx + 8], r8d
lea rcx, [rbx + 0x12]
mov dword [rbx + 0xc], edi
mov word [rbx + 0x10], 1
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x1404bea58], 0
jne 0x14017abd5
mov ecx, 0x101
mov byte [0x1404bea58], 1
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, rdi
call fcn.14017ae50
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1400bd5f0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1e0
pop rdi
ret

Function at 0x14017ac10
Capabilities:
Get socket status

Disassembly:
push rbx
push r14
sub rsp, 0x478
mov rax, qword [0x1404a90f8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r14, rcx
mov rbx, rdx
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
jne 0x14017ac48
or eax, 0xffffffff
jmp 0x14017ad1f
movsxd rcx, dword [r14]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x4a0], rsi
lea rdx, [rsp + 0x40]
xor esi, esi
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x258], rcx
xor r9d, r9d
mov qword [rsp + 0x470], rdi
xor r8d, r8d
mov rdi, rcx
mov qword [rsp + 0x38], rsi
inc ecx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x250], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14017ad03
mov eax, dword [r14]
test eax, eax
js 0x14017ad03
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x14017ad03
cmp dword [rsp + 0x34], esi
jne 0x14017ad03
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
mov rcx, rbx
setne sil
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x14017ad0f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or eax, 0xffffffff
mov rsi, qword [rsp + 0x4a0]
mov rdi, qword [rsp + 0x470]
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400bd5f0
add rsp, 0x478
pop r14
pop rbx
ret
Function at 0x14017ad40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r15, r9
mov ebp, r8d
mov r12, rdx
mov r13, rcx
mov r14, qword [rsp + 0x98]
xor ebx, ebx
test r8d, r8d
jle 0x14017add3
nop dword [rax]
movsxd rdi, ebx
add rdi, r12
mov esi, ebp
sub esi, ebx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
nop
test eax, eax
je 0x14017adcb
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.WS2_32.dll_recv]
nop
mov edi, eax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
test edi, edi
jle 0x14017adcb
movzx ecx, byte [r15]
test cl, cl
je 0x14017adcb
add ebx, edi
cmp ebx, ebp
jl 0x14017ad80
jmp 0x14017add3
or eax, 0xffffffff
test ebx, ebx
cmove ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14017ae50
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x18], r8b
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x14017aeee
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14017aeee
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x10000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14017aeee
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 1
lea edx, [rax + 6]
mov dword [rsp + 0x20], 4
lea r8d, [rax + 1]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14017aeee
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x14017f7d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rdx
mov r8d, 1
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14017ec90
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14017f8f0
mov edi, 4
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x14017f869
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017f869
mov ebx, edi
nop dword [rax]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.140180df0
test al, al
jne 0x14017f865
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x14017f840
jmp 0x14017f869
mov bl, 1
jmp 0x14017f86b
xor bl, bl
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.140165660
test al, al
jne 0x14017f88e
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x14017f870
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
lea rsi, [0x1402901c8]
or edi, 0xffffffff
cmp rcx, rsi
je 0x14017f8b5
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x14017f8b5
call fcn.1400bd658
mov rax, qword [rsp + 0x30]
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x14017f8d1
lock xadd dword [rcx], edi
test edi, edi
jne 0x14017f8d1
call fcn.1400bd658
nop
movzx eax, bl
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x14017fb70
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rbx, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x14017fbf6
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017fbf6
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140040d80
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140040d80
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
mov r9, rbx
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jbe 0x14017fbf6
mov al, 1
jmp 0x14017fbf8
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x14017ff70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rsi, rdx
mov r14, rcx
mov dword [rsp + 0x30], 0
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140180078
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140180078
lea rdx, [rsp + 0x38]
mov rcx, r14
call fcn.14017fef0
mov rdi, rax
lea rdx, [rsp + 0x98]
mov rcx, r14
call fcn.140180cc0
mov rbx, rax
lea rdx, [rsp + 0x80]
mov rcx, r14
call fcn.140183520
nop
mov byte [rsp + 0x20], 1
mov r9, rdi
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.1401800c0
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff0
lea rdi, [0x1402901c8]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x14018003a
mov eax, ebx
lock xadd dword [rcx], eax
test eax, eax
jne 0x14018003a
call fcn.1400bd658
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x14018005b
mov eax, ebx
lock xadd dword [rcx], eax
test eax, eax
jne 0x14018005b
call fcn.1400bd658
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x14018009c
lock xadd dword [rcx], ebx
test ebx, ebx
jne 0x14018009c
call fcn.1400bd658
jmp 0x14018009c
mov rax, qword [r14]
mov qword [rsi], rax
mov qword [rsp + 0x50], rax
lea rcx, [rax - 0x10]
lea rdi, [0x1402901c8]
cmp rcx, rdi
je 0x14018009c
mov eax, 1
lock xadd dword [rcx], eax
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x1401809c0
Capabilities:
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov dword [rbp - 0x29], edi
mov rax, qword [rcx]
cmp byte [rax], dil
je 0x140180b9b
mov rdx, rcx
lea rcx, [rbp - 0x19]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
jne 0x140180b9b
lea r12, vtable.juce::FileInputStream.0
mov qword [rbp - 1], r12
mov rax, qword [rbx]
mov qword [rbp + 7], rax
lea rcx, [rax - 0x10]
lea r15, [0x1402901c8]
cmp rcx, r15
je 0x140180a3f
mov eax, 1
lock xadd dword [rcx], eax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
lea rcx, [rbp + 0x1f]
call fcn.140037850
nop
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x11]
call fcn.140040d80
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or edi, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x140180a97
mov qword [rbp + 0xf], rax
jmp 0x140180acf
lea rcx, [rbp + 0x77]
call fcn.140165700
mov rcx, qword [rbp + 0x1f]
mov qword [rbp - 9], rcx
mov rdx, qword [rax]
mov qword [rbp + 0x1f], rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 0x77]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140180acf
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140180acf
call fcn.1400bd658
nop
lea r14, [0x1402901d8]
mov rax, qword [rbp + 0x1f]
cmp byte [rax], 0
jne 0x140180af6
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 1]
call fcn.140179550
mov rcx, rax
mov ebx, 2
jmp 0x140180b03
mov qword [rbp + 0x67], r14
lea rcx, [rbp + 0x67]
mov ebx, 4
mov rax, qword [rcx]
mov qword [rsi], rax
mov qword [rcx], r14
or ebx, 1
test bl, 4
je 0x140180b33
and ebx, 0xfffffffb
mov rcx, qword [rbp + 0x67]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140180b33
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140180b33
call fcn.1400bd658
test bl, 2
je 0x140180b55
mov rcx, qword [rbp + 0x7f]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140180b55
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140180b55
call fcn.1400bd658
nop
mov qword [rbp - 1], r12
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1f]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140180b7f
mov eax, edi
lock xadd dword [rcx], eax
test eax, eax
jne 0x140180b7f
call fcn.1400bd658
mov rcx, qword [rbp + 7]
add rcx, 0xfffffffffffffff0
cmp rcx, r15
je 0x140180ba5
lock xadd dword [rcx], edi
test edi, edi
jne 0x140180ba5
call fcn.1400bd658
jmp 0x140180ba5
lea r14, [0x1402901d8]
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140180df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x30
mov qword [r11 - 0x18], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rsi, qword [rdx]
cmp rsi, rax
je 0x140180e79
mov qword [r11 + 8], rax
mov qword [r11 + 0x10], rsi
lea rdx, [r11 + 8]
lea rcx, [r11 + 0x10]
call fcn.140047830
test eax, eax
je 0x140180e79
cmp byte [rsi], 0
je 0x140180e6c
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140180e6c
mov rdx, rdi
mov rcx, rbx
call fcn.1401655b0
test al, al
je 0x140180e7b
mov rcx, rbx
call fcn.140165660
jmp 0x140180e79
mov rdx, rdi
mov rcx, rbx
call fcn.140180ea0
jmp 0x140180e7b
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140180ea0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x30
mov qword [r11 - 0x18], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rdi, rdx
mov rsi, rcx
mov rbx, qword [rcx]
mov rax, qword [rdx]
cmp rax, rbx
je 0x140180f77
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rax
lea rdx, [r11 + 8]
lea rcx, [r11 + 0x10]
call fcn.140047830
test eax, eax
je 0x140180f77
cmp byte [rbx], 0
je 0x140180f73
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140180f73
mov rax, qword [rdi]
mov rcx, qword [rsi]
cmp rcx, rax
je 0x140180f43
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400458d0
test eax, eax
je 0x140180f43
mov rcx, rdi
call fcn.140165660
test al, al
je 0x140180f73
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140040d80
mov rbx, qword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.140040d80
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
jmp 0x140180f79
xor al, al
jmp 0x140180f79
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140182ae0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x460
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1404a90f8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x28], eax
mov word [rsp + 0x40], ax
lea rdx, [rsp + 0x40]
mov ecx, 0x204
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140046380
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1401810f0
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402901c8]
cmp rcx, rax
je 0x140182b6f
or edx, 0xffffffff
lock xadd dword [rcx], edx
test edx, edx
jne 0x140182b6f
call fcn.1400bd658
mov rax, rbx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1400bd5f0
add rsp, 0x460
pop rbx
ret
Function at 0x140182c90
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x100
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1404a90f8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, rdx
xor esi, esi
mov dword [rsp + 0x50], esi
mov rax, qword [rcx]
mov qword [rsp + 0x40], rax
lea rcx, [rax - 0x10]
lea rbp, [0x1402901c8]
cmp rcx, rbp
je 0x140182cec
mov eax, 1
lock xadd dword [rcx], eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140165a00
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140040d80
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [r9 + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
sete dil
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x140182d55
or eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x140182d55
call fcn.1400bd658
test dil, dil
je 0x140182d5f
mov word [rsp + 0x70], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140046380
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400bd5f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140183190
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rsp + 0xa8], rbx
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x60], 0
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.140040d80
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1401831eb
cmp eax, 0xffffffff
je 0x1401831eb
mov rcx, rdi
call fcn.140037850
jmp 0x140183337
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.140183520
nop
mov rax, qword [rbx]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0x38]
cmp rcx, rax
je 0x1401832d2
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rcx
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x50]
call fcn.1400458d0
test eax, eax
je 0x1401832d2
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.140183190
nop
lea rsi, [0x1402901c8]
or ebx, 0xffffffff
mov rax, qword [rbp + 0x30]
cmp byte [rax], 0
jne 0x1401832be
lea rax, [0x14028f8c4]
mov qword [rbp - 0x48], rax
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp + 0x20]
call fcn.140175f40
nop
mov r8, rax
lea rdx, [rbp - 0x40]
call fcn.1401654c0
mov rcx, qword [rbp + 0x30]
mov qword [rbp - 0x10], rcx
mov rdx, qword [rax]
mov qword [rbp + 0x30], rdx
mov qword [rax], rcx
mov rcx, qword [rbp - 0x40]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1401832a2
mov eax, ebx
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401832a2
call fcn.1400bd658
nop
mov rcx, qword [rbp - 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1401832be
mov eax, ebx
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401832be
call fcn.1400bd658
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
lea rax, [0x1402901d8]
mov qword [rbp + 0x30], rax
jmp 0x14018331d
lea rax, [0x14028ed00]
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x20]
call fcn.1400461b0
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.14017b010
mov rcx, qword [rbp + 0x20]
add rcx, 0xfffffffffffffff0
lea rsi, [0x1402901c8]
or ebx, 0xffffffff
cmp rcx, rsi
je 0x14018331d
mov eax, ebx
lock xadd dword [rcx], eax
test eax, eax
jne 0x14018331d
call fcn.1400bd658
nop
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x140183337
lock xadd dword [rcx], ebx
test ebx, ebx
jne 0x140183337
call fcn.1400bd658
mov rax, rdi
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret