joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180097370
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x370
mov rax, qword [0x1800db028]
xor rax, rsp
mov qword [rsp + 0x360], rax
mov rbx, qword [0x1800df9e8]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 8], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov qword [rbx + 0x10], rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x28]
lea rdx, [rsp + 0x30]
sub eax, dword [rsp + 0x20]
mov r8d, 0x104
mov rcx, qword [rbx + 0x10]
mov dword [rbx + 0x18], eax
mov eax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
mov dword [rbx + 0x1c], eax
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, qword [rbx + 0x10]
lea rax, [rsp + 0x30]
mov r8d, 0x104
mov qword [rbx + 0x28], rax
lea rdx, [rsp + 0x140]
call qword [sym.imp.USER32.dll_GetClassNameA]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x140]
mov r9d, 0x104
mov qword [rbx + 0x30], rax
lea r8, [rsp + 0x250]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
lea rax, [rsp + 0x250]
mov qword [rbx + 0x38], rax
lea rdx, str.GameData::Init___Process_Window_Info_Established_n
mov rcx, qword [0x1800df9d8]
mov r8d, dword [rcx + 0x48]
call fcn.180096710
mov rdi, qword [0x1800dfa00]
mov rcx, rdi
call fcn.1800967c0
test al, al
je 0x1800974e0
mov rax, qword [0x1800e01e8]
lea rdx, [0x180097000]
mov r8, rdi
mov rbx, qword [rax + 0x40]
mov rcx, rbx
call fcn.180091970
test eax, eax
jne 0x180097494
lea edx, [rax + 1]
mov rcx, rbx
call fcn.180091e50
mov rax, qword [0x1800e01e8]
lea r8, [rdi + 8]
lea rdx, [fcn.1800026b0]
mov rbx, qword [rax + 0x60]
mov rcx, rbx
call fcn.180091970
test eax, eax
jne 0x1800974c1
lea edx, [rax + 1]
mov rcx, rbx
call fcn.180091e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1800df9d8]
lea rdx, str.D3D11Window::Hook_Initialized_n
mov r8d, dword [rcx + 0x48]
jmp 0x1800974f2
mov rcx, qword [0x1800df9d8]
lea rdx, str.___D3D11Window::Hook_Failed_to_Initialize_n
mov r8d, dword [rcx + 0x44]
call fcn.180096710
lea rcx, str.PalWorld_Win64_Shipping.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, qword [0x1800db048]
lea r8, [0x1800e0100]
add rcx, rax
mov qword [0x1800db040], rax
lea rdx, [0x180001270]
mov qword [0x1800e0108], rcx
call fcn.180091970
mov edx, 1
xor ecx, ecx
call fcn.180091e50
mov rcx, qword [0x1800df9d8]
lea rdx, str.Hooking::Hook_Initialized_n
mov r8d, dword [rcx + 0x48]
call fcn.180096710
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.180098380
mov rbx, qword [rsp + 0x380]
add rsp, 0x370
pop rdi
ret
Function at 0x140002720
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x38
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140002736
lea rax, [rcx - 1]
add rsp, 0x38
ret
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov rax, 0xffffffffffffffff
je 0x140002759
mov eax, dword [rsp + 0x40]
add rsp, 0x38
ret

Function at 0x140002780
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x140002796
lea rax, [rcx - 1]
add rsp, 0x28
ret
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x1400027c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x30]
test ecx, ecx
cmovne rax, rdx
add rsp, 0x28
ret
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x14000a3f0
Capabilities:
Hash data with md5

Disassembly:
add rcx, 8
je 0x14000a417
xor eax, eax
mov dword [rcx], 0x67452301
mov qword [rcx + 0x10], rax
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
ret

Function at 0x140019710
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov edx, 0x100080
mov dword [rsp + 0x28], 0x80
mov ebx, ebp
mov qword [rsp + 0x70], rbp
lea r8d, [rbp + 7]
mov dword [rsp + 0x20], 3
call qword [0x140098130]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400197bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x140019768
cmp eax, 2
jne 0x1400197b7
test ebx, ebx
jle 0x1400197b7
mov ecx, 0xc8
cmp ebx, ecx
cmovl ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0x100080
mov rcx, rsi
mov dword [rsp + 0x20], 3
sub ebx, 0xc8
lea r8d, [r9 + 7]
call qword [0x140098130]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140019758
jmp 0x1400197bd
cmp rdi, 0xffffffffffffffff
je 0x1400197c2
test rdi, rdi
jne 0x1400197d1
xor al, al
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
lea rdx, [rsp + 0x6c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x68], eax
cmp eax, 0xffffffff
jne 0x140019802
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, qword [rsp + 0x68]
mov rcx, 0xffffffffffffffff
test eax, eax
cmovne rbx, rcx
jmp 0x140019807
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [0x140098118]
test rbx, rbx
mov rbx, qword [rsp + 0x60]
setg al
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001a530
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
mov r9d, r8d
mov r10, rcx
test rdx, rdx
je 0x14001a55e
mov eax, dword [rdx]
test eax, eax
je 0x14001a55e
cmp eax, 1
je 0x14001a5f1
mov eax, dword [rdx + 4]
add rdx, 8
add rdx, rax
mov eax, dword [rdx]
test eax, eax
jne 0x14001a545
mov ecx, r9d
mov eax, r9d
and ecx, 1
mov edx, ecx
or edx, 2
and al, 2
mov eax, r9d
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, r9d
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 8
mov eax, r9d
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
and al, 0x10
mov eax, r9d
cmove ecx, edx
mov edx, ecx
bts edx, 7
and al, 0x20
mov eax, r9d
cmove edx, ecx
mov r8d, edx
bts r8d, 9
and al, 0x80
mov eax, r9d
cmove r8d, edx
mov ecx, r8d
bts ecx, 0x12
and eax, 0x100
cmove ecx, r8d
mov edx, ecx
bts edx, 0x16
and r9d, 0x200
cmove edx, ecx
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
neg eax
sbb eax, eax
neg eax
dec eax
add rsp, 0x28
ret
add rsp, 0x28
jmp 0x14001ba00
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rdx, rcx
mov ebx, r8d
lea rcx, [rsp + 0x68]
call qword [0x140098040]
xor edi, edi
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0x50], edi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rdi
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x20
lea r8, [rsp + 0x88]
mov dword [rsp + 0x38], 1
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x30], 7
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x80
mov edx, 0x100180
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x90], rdi
mov dword [rsp + 0xa0], 0x40
mov qword [rsp + 0x98], rax
movdqu xmmword [rsp + 0xa8], xmm0
call qword [0x140098008]
test eax, eax
jns 0x14001bad3
lfence
mov ecx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [rdi - 1]
jmp 0x14001bbbb
xor eax, eax
mov dword [rsp + 0x20], 4
mov qword [rsp + 0xd8], rax
mov ecx, ebx
and ecx, 1
mov eax, ebx
mov edx, ecx
xorps xmm0, xmm0
or edx, 2
mov r9d, 0x28
and al, 2
mov eax, ebx
cmove edx, ecx
mov ecx, edx
or ecx, 4
and al, 4
mov eax, ebx
cmove ecx, edx
mov edx, ecx
or edx, 0x10
and al, 8
mov eax, ebx
cmove edx, ecx
mov ecx, edx
bts ecx, 0xa
and al, 0x10
mov eax, ebx
cmove ecx, edx
mov edx, ecx
bts edx, 7
and al, 0x20
mov eax, ebx
cmove edx, ecx
mov r8d, edx
bts r8d, 9
and al, 0x80
mov eax, ebx
cmove r8d, edx
lea rdx, [rsp + 0x78]
mov ecx, r8d
bts ecx, 0x12
and eax, 0x100
movups xmmword [rsp + 0xb8], xmm0
cmove ecx, r8d
lea r8, [rsp + 0xb8]
mov eax, ecx
bts eax, 0x16
and ebx, 0x200
movups xmmword [rsp + 0xc8], xmm0
cmove eax, ecx
mov rcx, qword [rsp + 0x60]
bts eax, 7
mov dword [rsp + 0xd8], eax
call qword [0x140098030]
mov ecx, eax
mov ebx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x60]
call qword [section..data]
test ebx, ebx
setns dil
lea eax, [rdi - 1]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400498a0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x14001a600
Capabilities:
Get file size

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x78
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
test rdx, rdx
jne 0x14001a62e
test rbx, rbx
je 0x14001a671
lea rdx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x14001a644
mov eax, 0xffffffff
jmp 0x14001a6a1
test rdi, rdi
je 0x14001a661
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x20]
mov qword [rdi], rax
test rbx, rbx
je 0x14001a671
mov ecx, dword [rsp + 0x28]
call fcn.14003d470
mov dword [rbx], eax
test rsi, rsi
je 0x14001a69f
lea rdx, [rsp + 0x24]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x20], eax
cmp eax, 0xffffffff
jne 0x14001a697
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14001a63d
mov rax, qword [rsp + 0x20]
mov qword [rsi], rax
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400498a0
add rsp, 0x78
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14001c5c0
Capabilities:
Hash data using sha256

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x14001c5d1
lea eax, [rcx + 1]
add rsp, 0x18
ret
mov dword [rcx + 0x90], 0x6a09e667
xor r8d, r8d
cmp qword [0x14009b4d0], r8
mov dword [rcx + 0x94], 0xbb67ae85
mov dword [rcx + 0x98], 0x3c6ef372
mov dword [rcx + 0x9c], 0xa54ff53a
mov dword [rcx + 0xa0], 0x510e527f
mov dword [rcx + 0xa4], 0x9b05688c
mov dword [rcx + 0xa8], 0x1f83d9ab
mov dword [rcx + 0xac], 0x5be0cd19
mov qword [rcx + 8], r8
mov qword [rcx], r8
jne 0x14001c677
xor eax, eax
mov qword [rsp + 0x10], rbx
xor ecx, ecx
cpuid
cmp eax, 7
jl 0x14001c655
xor ecx, ecx
mov eax, 7
cpuid
shr ebx, 0x1d
and bl, 1
jmp 0x14001c657
xor bl, bl
test bl, bl
lea rcx, [0x14001c0a0]
mov rbx, qword [rsp + 0x10]
lea rdx, [0x14001bbe0]
cmove rcx, rdx
mov qword [0x14009b4d0], rcx
mov eax, r8d
add rsp, 0x18
ret

Function at 0x14001c7c0
Capabilities:
Hash data using sha224

Disassembly:
sub rsp, 0x18
test rcx, rcx
jne 0x14001c7d1
lea eax, [rcx + 1]
add rsp, 0x18
ret
mov dword [rcx + 0x90], 0xc1059ed8
xor r8d, r8d
cmp qword [0x14009b4d0], r8
mov dword [rcx + 0x94], 0x367cd507
mov dword [rcx + 0x98], 0x3070dd17
mov dword [rcx + 0x9c], 0xf70e5939
mov dword [rcx + 0xa0], 0xffc00b31
mov dword [rcx + 0xa4], 0x68581511
mov dword [rcx + 0xa8], 0x64f98fa7
mov dword [rcx + 0xac], 0xbefa4fa4
mov qword [rcx + 8], r8
mov qword [rcx], r8
jne 0x14001c877
xor eax, eax
mov qword [rsp + 0x10], rbx
xor ecx, ecx
cpuid
cmp eax, 7
jl 0x14001c855
xor ecx, ecx
mov eax, 7
cpuid
shr ebx, 0x1d
and bl, 1
jmp 0x14001c857
xor bl, bl
test bl, bl
lea rcx, [0x14001c0a0]
mov rbx, qword [rsp + 0x10]
lea rdx, [0x14001bbe0]
cmove rcx, rdx
mov qword [0x14009b4d0], rcx
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140024170
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov ecx, 0x88
call fcn.14004fe74
test rax, rax
jne 0x1400241b4
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x58], rax
mov dword [rax + 8], 1
lea rcx, vtable.RefCountObj_class_HashAlgorithmMD5_.0
mov qword [rax], rcx
lea rdx, [rax + 0x18]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x58], rdx
lea rcx, vtable.HashAlgorithmMD5.0
mov qword [rdx], rcx
lea rcx, [rdx + 8]
test rcx, rcx
je 0x140024233
mov qword [rcx + 0x10], rdi
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rax + 0x10], 1
mov qword [rbx], rdx
mov qword [rbx + 8], rax
movdqu xmmword [rsp + 0x28], xmm0
mov dword [rsp + 0x20], 1
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400247e0
Capabilities:
Hash data using sha1

Disassembly:
add rcx, 8
jmp fcn.1400375c0

Function at 0x140025a80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r9
mov rbp, r8
mov rbx, rcx
je 0x140025b20
cmp rdx, 0xffffffffffffffff
je 0x140025ac0
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
je 0x140025b20
mov ecx, dword [rbx + 0x30]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x140025b20
mov rsi, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov rax, rdi
mov qword [rsp + 0x20], 0
div rcx
mov rcx, qword [rsi]
mov rdx, rbp
mov r8, rax
mov eax, dword [rsi + 0x1c]
imul r8, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140025b20
mov ecx, dword [rsi + 0x1c]
xor edx, edx
mov eax, dword [rsp + 0x40]
div rcx
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140025b20
mov eax, dword [rbx + 0x30]
imul rax, rcx
jmp 0x140025b27
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140025b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x20], 0
mov rdi, r9
mov rbp, r8
mov rbx, rcx
je 0x140025be0
cmp rdx, 0xffffffffffffffff
je 0x140025b80
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
je 0x140025be0
mov ecx, dword [rbx + 0x30]
xor edx, edx
mov rax, rdi
div rcx
test rdx, rdx
jne 0x140025be0
mov rsi, qword [rbx + 0x20]
lea r9, [rsp + 0x40]
mov rax, rdi
mov qword [rsp + 0x20], 0
div rcx
mov rcx, qword [rsi]
mov rdx, rbp
mov r8, rax
mov eax, dword [rsi + 0x1c]
imul r8, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140025be0
mov ecx, dword [rsi + 0x1c]
xor edx, edx
mov eax, dword [rsp + 0x40]
div rcx
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x140025be0
mov eax, dword [rbx + 0x30]
imul rax, rcx
jmp 0x140025be7
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140026730
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r9
mov rbp, r8
mov rdi, rcx
cmp rdx, 0xffffffffffffffff
je 0x140026770
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
jne 0x140026770
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
mov rcx, qword [rdi + 0x20]
lea r9, [rsp + 0x58]
mov r8d, r14d
mov qword [rsp + 0x50], rbx
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x1400267c8
mov rbx, rsi
call fcn.14003cef0
cmp eax, 0x13
jne 0x1400267e8
mov r9, qword [rdi + 0x38]
mov r8, r14
mov rcx, qword [rdi + 0x20]
mov rdx, rbp
call fcn.14003f750
mov rbx, rax
cmp rax, rsi
je 0x1400267e8
jmp 0x1400267cc
mov ebx, dword [rsp + 0x58]
add qword [rdi + 0x38], rbx
cmp dword [rdi + 0x28], 0
je 0x1400267e8
mov rdx, rbx
mov rcx, rbp
call fcn.14003ac40
cmp rbx, rax
cmovne rbx, rsi
mov rbp, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x140026800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rsi, rcx
cmp rdx, 0xffffffffffffffff
je 0x14002683f
mov rax, qword [rcx]
xor r8d, r8d
mov rax, qword [rax + 0x40]
call qword [case.0x140017e6f.8]
cmp rax, 0xffffffffffffffff
je 0x1400268ef
xor r15d, r15d
mov edi, r15d
test rbp, rbp
jne 0x140026865
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x20]
call fcn.14001a3d0
sub r15d, eax
neg r15d
sbb rax, rax
jmp 0x14002692e
cmp dword [rsi + 0x28], edi
je 0x1400268f8
mov r12d, 0x10000
cmp qword [rsi + 0x50], rdi
jne 0x140026890
mov ecx, r12d
call fcn.14004fe74
mov qword [rsi + 0x50], rax
test rax, rax
je 0x1400268ef
nop dword [rax + rax]
mov rcx, qword [rsi + 0x50]
cmp rbp, r12
mov rbx, rbp
mov rdx, r14
cmovae rbx, r12
mov r8, rbx
call fcn.14004f4b0
mov rcx, qword [rsi + 0x50]
mov rdx, rbx
call fcn.14003af20
cmp rbx, rax
jne 0x1400268ef
mov rdx, qword [rsi + 0x50]
lea r9, [rsp + 0x68]
mov rcx, qword [rsi + 0x20]
mov r8d, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400268ef
mov eax, dword [rsp + 0x68]
add rdi, rax
cmp rax, rbx
jne 0x140026921
add r14, rbx
sub rbp, rbx
jne 0x140026890
jmp 0x140026921
mov rax, 0xffffffffffffffff
jmp 0x14002692e
mov rcx, qword [rsi + 0x20]
lea r9, [rsp + 0x68]
mov r8d, ebp
mov qword [rsp + 0x20], r15
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, 0xffffffffffffffff
test eax, eax
je 0x140026921
mov edi, dword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
je 0x14002692b
add qword [rsi + 0x38], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400269c0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [rcx + 0x20]
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov edi, ebx
test rax, rax
je 0x140026a02
lea rdx, [rsp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x140026a23
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140026a23
lea ebx, [rdi - 1]
jmp 0x140026a28
mov rax, qword [rcx + 8]
test rax, rax
je 0x140026a2f
mov rdx, qword [rcx + 0x10]
lea r9, [rsp + 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
call fcn.14003f010
mov ebx, eax
mov rdi, qword [rsp + 0x30]
mov rax, rdi
test ebx, ebx
je 0x140026a36
mov rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x140027640
Capabilities:
Delete file

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0xb8], rax
mov rdx, qword [rcx + 8]
test rdx, rdx
jne 0x140027687
lea ecx, [rdx + 0xd]
call fcn.14003d1c0
mov eax, 0xffffffff
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400498a0
add rsp, 0xc8
ret
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0xc0], rdi
test rax, rax
je 0x1400276b5
mov ecx, dword [rax]
test ecx, ecx
je 0x1400276b5
nop
cmp ecx, 1
je 0x1400276e9
mov ecx, dword [rax + 4]
add rax, 8
add rax, rcx
mov ecx, dword [rax]
test ecx, ecx
jne 0x1400276a0
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb ecx, ecx
neg ecx
lea edi, [rcx - 1]
mov eax, edi
mov rdi, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
xor rcx, rsp
call fcn.1400498a0
add rsp, 0xc8
ret
lea rcx, [rsp + 0x50]
call qword [0x140098040]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x40
xorps xmm0, xmm0
mov qword [rsp + 0x70], rax
xor edi, edi
mov dword [rsp + 0x60], 0x30
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rdi
lea r8, [rsp + 0x60]
mov dword [rsp + 0x78], 0x40
mov edx, 0x10100
mov dword [rsp + 0x20], 7
lea rcx, [rsp + 0x38]
movdqu xmmword [rsp + 0x80], xmm0
call qword [0x140098010]
cmp eax, 0xc0000056
jne 0x140027767
xor ecx, ecx
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1400276c7
test eax, eax
jns 0x140027788
lfence
mov ecx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, 0xffffffff
jmp 0x1400276c7
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x90]
xor eax, eax
mov qword [rsp + 0xd8], rbx
xorps xmm0, xmm0
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x40]
mov dword [rsp + 0xb0], 0x80
movups xmmword [rsp + 0x90], xmm0
lea r9d, [rax + 0x28]
mov dword [rsp + 0x20], 4
movups xmmword [rsp + 0xa0], xmm0
call qword [0x140098030]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov r9d, 1
mov byte [rsp + 0x30], 1
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x20], 0xd
call qword [0x140098030]
mov ecx, eax
mov ebx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
call qword [section..data]
test ebx, ebx
mov rbx, qword [rsp + 0xd8]
setns dil
dec edi
jmp 0x1400276c7
Function at 0x140027b90
Capabilities:
Move file
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x340
mov rax, qword [0x1400981e8]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rax, qword [rcx]
mov esi, edx
mov rbx, rcx
mov rax, qword [rax + 0x20]
call qword [case.0x140017e6f.8]
mov r8, qword [rbx + 8]
test r8, r8
je 0x140027c03
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140027bf5
mov eax, dword [rcx]
test eax, eax
je 0x140027bf5
nop
cmp eax, 1
je 0x140027c5e
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov eax, dword [rcx]
test eax, eax
jne 0x140027be0
mov edx, 0x80
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0xb8]
call qword [case.0x140017e6f.8]
movzx edi, al
bt esi, 9
jae 0x140027ddb
mov rcx, qword [rbx + 0x10]
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x140027da1
mov edx, dword [rcx]
test edx, edx
je 0x140027da1
nop
cmp edx, 1
je 0x140027d78
mov eax, dword [rcx + 4]
add rcx, 8
add rcx, rax
mov edx, dword [rcx]
test edx, edx
jne 0x140027c40
jmp 0x140027da1
mov rdx, r8
lea rcx, [rsp + 0x68]
call qword [0x140098040]
xor ecx, ecx
mov dword [rsp + 0x88], 0x30
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rcx
lea r9, [rsp + 0x78]
mov dword [rsp + 0x40], 0x20
lea r8, [rsp + 0x88]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
mov dword [rsp + 0x30], 7
mov edx, 0x100180
mov qword [rsp + 0x90], rcx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0xa0], 0x40
mov qword [rsp + 0x98], rax
movdqu xmmword [rsp + 0xa8], xmm0
call qword [0x140098008]
test eax, eax
jns 0x140027d0c
lfence
mov ecx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140027c03
mov rcx, qword [rsp + 0x60]
lea r8, [rsp + 0xb8]
xor eax, eax
mov dword [rsp + 0x20], 4
xorps xmm0, xmm0
mov qword [rsp + 0xd8], rax
lea rdx, [rsp + 0x78]
mov dword [rsp + 0xd8], 0x80
movups xmmword [rsp + 0xb8], xmm0
lea r9d, [rax + 0x28]
movups xmmword [rsp + 0xc8], xmm0
call qword [0x140098030]
mov ecx, eax
call qword [0x140098038]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x60]
call qword [section..data]
jmp 0x140027c03
mov r8d, 0x122
lea rdx, [rsp + 0xe0]
mov rcx, r9
call fcn.140045310
test al, al
jne 0x140027d99
mov eax, 0x1388
jmp 0x140027db6
lea r9, [rsp + 0xe0]
xor edx, edx
mov rcx, r9
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x140027df4
xor eax, eax
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.1400498a0
lea r11, [rsp + 0x340]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
mov rax, qword [rax + 0xa0]
call qword [case.0x140017e6f.8]
test eax, eax
je 0x140027db4
call fcn.14003cef0
mov ecx, eax
call fcn.140048700
lea ecx, [rax - 0x2332]
cmp ecx, 1
jbe 0x140027db4
test dil, dil
mov ecx, 0x2337
cmovne eax, ecx
jmp 0x140027db6