joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1418769b0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
push r14
push r15
sub rsp, 0x2d0
mov qword [rax - 0x260], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x1419e93b0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov r14, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
movsd xmm6, qword [0x141868150]
mov ebx, ebp
lea r15, [0x140179e20]
or esi, 0xffffffff
movsd xmm7, qword [0x141868140]
nop word [rax + rax]
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm7
subsd xmm6, xmm0
mov qword [rsp + 0x48], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.14187ca70
mov rdi, rax
mov r8d, esi
lea rdx, [0x14017a178]
lea rcx, [rsp + 0x20]
call fcn.141872fc0
nop
mov rdx, rax
mov rcx, qword [rdi]
call fcn.141897000
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x141876a9a
cmp eax, 0xffffffff
je 0x141876aa8
mov eax, esi
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141876aa8
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x141876ab8
mov dl, 0x20
call fcn.141897080
movaps xmm1, xmm6
mov rcx, qword [rdi]
call fcn.1418972e0
mov rcx, qword [rdi]
cmp byte [rcx + 0x20], 0
je 0x141876ad4
mov dl, 0x20
call fcn.141897080
nop
lea rcx, [rsp + 0x38]
call fcn.14188fb00
inc ebx
cmp ebx, 0x1e
jl 0x141876a20
mov edx, 0x104
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
test eax, eax
jne 0x141876ba4
mov qword [rsp + 0x68], 2
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r15
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.14187ca70
mov rbx, rax
mov r8d, esi
lea rdx, [0x14017a1a0]
lea rcx, [rsp + 0x28]
call fcn.141872fc0
nop
mov rdx, rax
mov rcx, qword [rbx]
call fcn.141897000
nop
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x141876b6f
cmp eax, 0xffffffff
je 0x141876b7d
lock xadd dword [rcx], esi
cmp esi, 1
jne 0x141876b7d
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov rcx, qword [rbx]
cmp byte [rcx + 0x20], 0
je 0x141876b8e
mov dl, 0x20
call fcn.141897080
nop
lea rcx, [rsp + 0x40]
call fcn.14188fb00
lea rax, [0x1400367e8]
mov qword [r14], rax
jmp 0x141876bb7
mov r8d, esi
lea rdx, [rsp + 0x90]
mov rcx, r14
call fcn.1418752c0
mov rax, r14
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14196a0d0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x141879b50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1419e93b0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x141879be3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x141879bda
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x141879bc4
add rax, 2
test ecx, ecx
jne 0x141879bb0
mov rcx, rbx
test edx, edx
je 0x141879c06
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x141879ba0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14196a0d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x141879be5
Function at 0x14187fa10
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rbx, r8
mov rdi, rdx
mov esi, ecx
call fcn.14187f600
test al, al
je 0x14187fa3e
xor al, al
jmp 0x14187faad
mov r9, rbx
mov r8, rdi
mov edx, esi
lea rcx, [rsp + 0x20]
call fcn.14187d870
nop
mov eax, 0xa
mov word [rsp + 0x58], ax
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.141884860
lea rcx, [rsp + 0x20]
call fcn.14188e360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14187fa9d
cmp eax, 0xffffffff
je 0x14187faab
or eax, 0xffffffff
lock xadd dword [rcx], eax
sub eax, 1
jne 0x14187faab
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1418ace50
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0xc0
mov rax, qword [0x1419e93b0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, [0x140039c10]
mov dword [rsp + 0x40], eax
mov rdi, rcx
mov qword [rsp + 0x38], rax
mov r9d, 0x20019
lea rax, [rsp + 0x38]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1418acf23
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x140039c50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0xd8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x4a
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
sete bl
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov rbx, qword [rsp + 0xd8]
je 0x1418acf23
mov edx, dword [rsp + 0x30]
lea rax, [rsp + 0x60]
dec edx
mov qword [rsp + 0x50], rax
shr rdx, 1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdx
mov rdx, rdi
call fcn.1418ad7f0
jmp 0x1418acf2d
lea rax, [0x1400367e8]
mov qword [rdi], rax
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14196a0d0
add rsp, 0xc0
pop rdi
ret
Function at 0x1418b6450
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
movzx edi, cl
mov eax, dword [0x1419e6030]
cmp eax, 0xffffffff
jne 0x1418b64a5
lea rbx, [0x1419ecf60]
mov rcx, rbx
call fcn.1418adc70
or rbx, 1
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1419e6030], eax
test bl, 1
je 0x1418b64a5
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1418ae120
mov eax, dword [0x1419e6030]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x1418b65aa
test dil, dil
je 0x1418b65aa
lea ecx, [rax + 0x78]
call fcn.14196a0f4
mov qword [rsp + 0x78], rax
lea edx, [rsi + 1]
mov rcx, rax
call fcn.1418b7a10
mov rsi, rax
mov qword [rsp + 0x88], rax
mov rdx, rax
mov ecx, dword [0x1419e6030]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov ecx, 0x10
call fcn.14196a0f4
mov qword [rsp + 0x78], rax
mov rdx, rsi
mov rcx, rax
call fcn.1418b78f0
nop
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x80]
mov qword [rsi + 0x38], rax
mov rcx, rsi
call fcn.1418b7f40
mov byte [rsi + 0x72], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
mov qword [rsi + 0x40], rax
mov rax, qword [0x1419ecdf8]
test rax, rax
jne 0x1418b6555
mov rax, qword [rsi + 0x38]
mov qword [0x1419ecdf8], rax
jmp 0x1418b65aa
mov qword [rsp + 0x78], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov dword [rsp + 0x30], 2
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x78]
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rsi + 0x38]
mov rcx, qword [rsp + 0x78]
call fcn.1418b6db0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1418b6db0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rsi, rdx
mov rdi, rcx
lea rbx, [0x1419ecf58]
mov rcx, rbx
call fcn.1418adc70
or rbx, 1
mov qword [rsp + 0x60], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1419ecf40]
jne 0x1418b6e03
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1418b6f43
mov rax, qword [0x1419e6038]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
movsxd rdx, dword [rax + 4]
lea ecx, [rdx + 1]
cmp dword [rax], 1
ja 0x1418b6e26
cmp r8d, ecx
jb 0x1418b6e29
jmp 0x1418b6e4e
cmp r8d, ecx
sbb r9d, r9d
and r9d, 8
cmp ecx, r8d
cmova r8d, ecx
lea rcx, [0x1419e6038]
call fcn.1418b7100
mov rax, qword [0x1419e6038]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rdi
mov rax, qword [0x1419e6038]
inc dword [rax + 4]
mov rax, qword [0x1419e6040]
mov r8d, dword [rax + 8]
btr r8d, 0x1f
movsxd rdx, dword [rax + 4]
lea ecx, [rdx + 1]
cmp dword [rax], 1
ja 0x1418b6e87
cmp r8d, ecx
jb 0x1418b6e8a
jmp 0x1418b6eaf
cmp r8d, ecx
sbb r9d, r9d
and r9d, 8
cmp ecx, r8d
cmova r8d, ecx
lea rcx, [0x1419e6040]
call fcn.1418b6f70
mov rax, qword [0x1419e6040]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
mov qword [rdx + rax], rsi
mov rax, qword [0x1419e6040]
inc dword [rax + 4]
cmp dword [0x1419ecf40], 0
jne 0x1418b6f35
cmp qword [0x1419ecf48], 0
jne 0x1418b6f02
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1419ecf48], rax
lea rdx, [0x1419ecf48]
lea rcx, [0x1419e6038]
call fcn.1418b67c0
lea rax, [0x1419ecf40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1418b68b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1418b6f43
mov rcx, qword [0x1419ecf48]
call qword [sym.imp.KERNEL32.dll_SetEvent]
nop
test bl, 1
je 0x1418b6f54
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1418ae120
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1418b7840
Capabilities:
Create thread
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 8]
mov rsi, rcx
lea rbx, [rdi + 0x70]
test rbx, rbx
je 0x1418b767b
mov rcx, rbx
call fcn.1418adc70
or rbx, 1
cmp byte [rdi + 0x7c], 0
je 0x1418b76ac
cmp byte [rdi + 0xa0], 0
jne 0x1418b7693
mov byte [rdi + 0xa1], 1
jmp 0x1418b76ac
mov rcx, qword [rdi + 0x90]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, rsi
call fcn.1418b65e0
test bl, 1
je 0x1418b76bd
and rbx, 0xfffffffffffffffe
mov rcx, rbx
call fcn.1418ae120
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test edx, edx
jne 0x1418b789a
cmp r8d, 5
ja case.default.0x1418b7863
movsxd rax, r8d
lea r8, [0x140000000]
mov edx, dword [r8 + rax*4 + 0x18b78d0]
add rdx, r8
jmp rdx
movzx edx, byte [rsp + 0x10]
jmp fcn.1418b8350
movzx edx, byte [rsp + 0x10]
jmp fcn.1418b8170
mov rax, qword [r9 + 8]
mov edx, dword [rax]
jmp fcn.1418b7290
mov edx, 7
jmp fcn.1418b7290
jmp 0x1418b7650
xor edx, edx
jmp fcn.1418b80a0
cmp edx, 0xa
jne case.default.0x1418b7863
mov rax, qword [r9 + 8]
mov rcx, qword [r9]
mov rdx, qword [rax]
lea rax, [fcn.1418b8350]
cmp rdx, rax
jne 0x1418b78bc
mov dword [rcx], 0
ret
lea rax, [fcn.1418b8170]
cmp rdx, rax
jne case.default.0x1418b7863
mov dword [rcx], 1
ret
Function at 0x1418c5aa0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
test r8, r8
js 0x1418c5c0a
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x1418c5b78
mov r15b, 1
nop dword [rax]
nop word [rax + rax]
mov r8, rbp
sub r8, rbx
lea rcx, [rbx + r12]
mov r9, qword [rsi + 0x78]
mov edx, 1
call fcn.141995670
mov rdi, rax
mov rcx, qword [rsi + 0x78]
call fcn.1419952e0
test eax, eax
setne r14b
test r15b, r15b
je 0x1418c5b46
test r14b, r14b
je 0x1418c5b46
test rdi, rdi
jne 0x1418c5b46
mov rcx, qword [rsi + 0x78]
call fcn.141991650
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsi + 0x78]
call fcn.1419959ac
xor r15b, r15b
jmp 0x1418c5b49
add rbx, rdi
test r14b, r14b
jne 0x1418c5c66
test rdi, rdi
jne 0x1418c5b66
call fcn.141992110
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x1418c5b6e
xor ecx, ecx
cmp rbx, rbp
setl cl
test ecx, ecx
jne 0x1418c5af0
jmp 0x1418c5bc0
cmp dword [rcx + 0xa0], 0xffffffff
je 0x1418c5bc9
mov rax, rbp
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r12]
mov ecx, dword [rsi + 0xa0]
call fcn.14199637c
movsxd rcx, eax
test eax, eax
jle 0x1418c5bb2
add rbx, rcx
cmp rbx, rbp
jl 0x1418c5b81
cmp ecx, 0xffffffff
setne al
test al, al
jne 0x1418c5c66
test rbx, rbx
jne 0x1418c5c66
or rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x70]
call fcn.1418ac630
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call fcn.1418c3e30
nop
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
test eax, eax
je 0x1418c5c57
cmp eax, ebx
je 0x1418c5c66
mov edx, ebx
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x1418c5c66
mov rcx, qword [rsp + 0x70]
jmp 0x1418c5c57
mov edx, 0x16
lea rcx, [rsp + 0x80]
call fcn.1418ac630
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call fcn.1418c3e30
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1418c5c57
cmp eax, ebx
je 0x1418c5c66
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c5c66
mov rcx, qword [rsp + 0x80]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.1418993e0
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1418c6220
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x18]
test r8, r8
js 0x1418c6353
xor ebx, ebx
test r8, r8
je 0x1418c634a
cmp qword [rcx + 0x78], rbx
je 0x1418c62ad
nop dword [rax]
nop word [rax + rax]
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0x78]
mov edx, 1
call fcn.141995bf4
add rbx, rax
test rax, rax
jne 0x1418c629f
call fcn.141992110
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x1418c62a7
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x1418c6270
jmp 0x1418c62f0
cmp dword [rcx + 0xa0], 0xffffffff
je 0x1418c62f5
nop word [rax + rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0xa0]
call fcn.141996e9c
test eax, eax
jle 0x1418c62f0
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x1418c62c0
test rbx, rbx
jne 0x1418c634a
or rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.1418ac630
mov rdi, rax
call fcn.141992110
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call fcn.1418c3e30
nop
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1418c6397
cmp eax, ebx
je 0x1418c63a6
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c63a6
mov rcx, qword [rsp + 0x50]
jmp 0x1418c6397
and dword [rsi + 0x40], 0xffdfffff
jmp 0x1418c63a6
mov edx, 0x16
lea rcx, [rsp + 0x60]
call fcn.1418ac630
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.1418c3e30
nop
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1418c6397
cmp eax, ebx
je 0x1418c63a6
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c63a6
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.1418993e0
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1418c7d10
Capabilities:
Copy file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1418c47d0
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1418c47d0
mov rdi, rax
mov rcx, rsi
call fcn.14188e360
mov rbx, rax
mov rcx, rdi
call fcn.14188e360
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x1418c7da4
cmp eax, ebx
je 0x1418c7db3
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c7db3
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1418c7dd1
cmp eax, 0xffffffff
je 0x1418c7ddf
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1418c7ddf
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
test dil, dil
jne 0x1418c7dfe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x1418c81d0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1419e93b0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x40], r14d
lea rax, [0x1400367e8]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1418c832d
cmp esi, 0x104
jbe 0x1418c82d5
mov eax, 2
mul rsi
cmovo rax, rbx
mov rcx, rax
call fcn.14196a9c8
mov r15, rax
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x1418c82cb
mov r8d, esi
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.1418752c0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rcx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x1418c82bd
cmp eax, ebx
je 0x1418c82cb
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c82cb
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov rcx, r15
call fcn.14196a130
jmp 0x1418c832d
mov r8d, esi
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.1418752c0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rcx
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x1418c831f
cmp eax, 0xffffffff
je 0x1418c832d
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x1418c832d
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 4]
cmp ecx, 2
jl 0x1418c83b0
cmp ecx, 1
jle 0x1418c8349
mov rcx, qword [rax + 0x10]
movzx r14d, word [rcx + rax + 2]
cmp r14w, 0x3a
jne 0x1418c83b0
mov rcx, qword [rax + 0x10]
movzx ecx, word [rax + rcx]
call fcn.14188d7b0
mov esi, eax
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 4]
test edx, edx
jg 0x1418c8388
mov eax, 0x20
mov word [rsp + 0x28], ax
movzx r8d, ax
lea edx, [rax - 0x1f]
lea rcx, [rsp + 0x20]
call fcn.14188c590
jmp 0x1418c83a3
cmp dword [rax], 1
ja 0x1418c8394
cmp qword [rax + 0x10], 0x18
je 0x1418c83a8
inc edx
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.14188aba0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov word [rax + rcx], si
movzx r8d, byte [rsp + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1418c3fa0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1418c83e2
cmp eax, 0xffffffff
je 0x1418c83f0
lock xadd dword [rcx], ebx
cmp ebx, 1
jne 0x1418c83f0
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14196a0d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1418ca080
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1419e93b0]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x1418ca0ca
lock inc dword [rax]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 4]
cmp r8d, 2
jne 0x1418ca140
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x1418ca140
cmp dword [rax], 1
ja 0x1418ca0f4
mov edx, dword [rax + 8]
btr edx, 0x1f
lea ecx, [r8 + 2]
cmp ecx, edx
jbe 0x1418ca10a
lea edx, [r8 + 2]
mov r8b, 1
lea rcx, [rsp + 0x20]
call fcn.14188aba0
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
mov ecx, 0x5c
mov word [r8 + rax], cx
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
xor ecx, ecx
mov word [r8 + rax], cx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1418e5b80
nop
mov rcx, rax
call fcn.14188e360
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
or edi, 0xffffffff
test eax, eax
je 0x1418ca185
cmp eax, edi
je 0x1418ca193
mov edx, edi
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x1418ca193
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
cmp ebx, 0xffffffff
jne 0x1418ca1cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x1418ca1a8
cmp eax, 0x20
jne 0x1418ca1cb
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.1418e5b80
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1418c94d0
test al, al
cmovne ebx, dword [rsp + 0x50]
test rsi, rsi
je 0x1418ca1d8
cmp ebx, 0xffffffff
setne al
mov byte [rsi], al
cmp ebx, 0xffffffff
jne 0x1418ca1e1
xor bl, bl
jmp 0x1418ca1e7
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1418ca205
cmp eax, 0xffffffff
je 0x1418ca213
lock xadd dword [rcx], edi
cmp edi, 1
jne 0x1418ca213
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.1418993e0
movzx eax, bl
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.14196a0d0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret