joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023760
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm15, xmm9
movdqu xmm11, xmmword [rbx + r12]
movdqa xmm12, xmm10
movdqu xmm13, xmmword [rbx + r13]
pxor xmm10, xmm15
pxor xmm11, xmm10
pxor xmm2, xmm10
pxor xmm12, xmm11
pxor xmm3, xmm11
pxor xmm13, xmm12
pxor xmm4, xmm12
pxor xmm5, xmm13
movups xmm0, xmmword [r11 + 0x20]
pxor xmm10, xmm9
pxor xmm11, xmm9
pxor xmm12, xmm9
pxor xmm13, xmm9
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x30]
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x140023800
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140023800
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm10
aesdeclast xmm3, xmm11
aesdeclast xmm4, xmm12
aesdeclast xmm5, xmm13
repz ret

Function at 0x140023880
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
pxor xmm7, xmm15
pxor xmm7, xmm9
pxor xmm2, xmm7
movups xmm0, xmmword [r11 + 0x20]
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x30]
pxor xmm7, xmm9
aesdec xmm2, xmm0
movups xmm0, xmmword [r11 + 0x40]
jmp 0x1400238c0
aesdec xmm2, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400238c0
aesdec xmm2, xmm1
movups xmm1, xmmword [r11 + 0x10]
mov rax, r10
aesdeclast xmm2, xmm7
repz ret
Function at 0x140024330
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 8
call fcn.1400243a0
shl edx, 4
test eax, eax
jne 0x140024396
lea rcx, [r8 + rdx + 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
movups xmmword [rcx], xmm0
movups xmmword [r8], xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmm0, xmmword [r8]
movups xmm1, xmmword [rcx]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea r8, [r8 + 0x10]
lea rcx, [rcx - 0x10]
movups xmmword [rcx + 0x10], xmm0
movups xmmword [r8 - 0x10], xmm1
cmp rcx, r8
ja 0x14002435b
movups xmm0, xmmword [r8]
aesimc xmm0, xmm0
pxor xmm1, xmm1
movups xmmword [rcx], xmm0
pxor xmm0, xmm0
add rsp, 8
repz ret
Function at 0x140025480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [rcx - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [rbp - 1]
vmovups xmm15, xmmword [rcx - 0x70]
lea r12, [rcx - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x1400255a0
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x1400254e0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x1400254e0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rdi]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rdi + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rdi + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rdi + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rdi + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rdi + 0x50]
lea rdi, [rdi + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rsi], xmm9
vmovups xmmword [rsi + 0x10], xmm10
vmovups xmmword [rsi + 0x20], xmm11
vmovups xmmword [rsi + 0x30], xmm12
vmovups xmmword [rsi + 0x40], xmm13
vmovups xmmword [rsi + 0x50], xmm14
lea rsi, [rsi + 0x60]
repz ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x1400254e0
Function at 0x14007c060
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x98]
test rcx, rcx
je 0x14007c07b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x80]
lea rax, vtable.nbase::Thread.0
mov qword [rbx + 0x70], rax
test rcx, rcx
je 0x14007c0ce
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x80]
test eax, eax
je 0x14007c0bc
test rcx, rcx
je 0x14007c0ce
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [rbx + 0x78], eax
mov qword [rbx + 0x80], rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14007fed0

Function at 0x14007f060
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov rdi, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14007f099
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rcx, rdi
call fcn.14007ee70
mov eax, 1
xchg dword [rdi + 0xa0], eax
mov rcx, qword [rdi + 0x98]
test rcx, rcx
je 0x14007f0c5
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov rcx, qword [rdi + 0x80]
xor ebp, ebp
test rcx, rcx
je 0x14007f10d
mov edx, 0x1f4
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x80]
test eax, eax
je 0x14007f0fd
test rcx, rcx
je 0x14007f10d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rdi + 0x78], ebp
mov qword [rdi + 0x80], rbp
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rbx, qword [rdi + 0x38]
mov rdx, qword [rbx + 8]
lea rcx, [rdi + 0x38]
call fcn.1400800f0
mov rax, qword [rdi + 0x38]
mov qword [rax + 8], rbx
mov rax, qword [rdi + 0x38]
mov qword [rax], rbx
mov rax, qword [rdi + 0x38]
mov qword [rax + 0x10], rbx
mov qword [rdi + 0x40], rbp
lea rcx, [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14007fce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_IsWindow]
xor esi, esi
test eax, eax
jne 0x14007fe0e
xor edx, edx
lea rcx, [rsp + 0xb0]
mov r8d, 0x208
call fcn.1402dd440
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, str.EasyMsg__d
mov edx, 0x104
mov r9d, eax
lea rcx, [rsp + 0xb0]
call fcn.14007f180
xor edx, edx
lea r8d, [rsi + 0x50]
lea rcx, [rsp + 0x60]
call fcn.1402dd440
xor ecx, ecx
mov dword [rsp + 0x60], 0x50
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0xa0], rax
lea rax, [0x14007fc60]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov rax, qword [rsp + 0x78]
xor r9d, r9d
mov rdx, qword [rsp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x58], rsi
xor ecx, ecx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], 0xfffffffffffffffd
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rcx, rax
mov qword [rbx + 8], rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14007fe0e
mov rcx, qword [rbx + 8]
lea edx, [rsi - 0x15]
mov r8, rbx
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
mov dword [rbx + 0x90], esi
xor edx, edx
xor ecx, ecx
lea r8d, [r9 + 0x64]
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
lea rdi, [rbx + 0x78]
xor edx, edx
lea r9, [rbx + 0x70]
mov qword [rbx + 0x98], rax
mov qword [rsp + 0x28], rdi
lea r8, [0x140134940]
xor ecx, ecx
mov dword [rsp + 0x20], esi
call fcn.1402e67b4
mov qword [rbx + 0x80], rax
mov rcx, rax
cmp rax, 2
jae 0x14007fe69
mov qword [rbx + 0x80], rsi
mov rcx, rsi
mov dword [rdi], esi
mov eax, dword [rbx + 0x88]
test eax, eax
jle 0x14007fea4
mov edx, 0xffffffff
cmp eax, 1
jne 0x14007fe82
lea edx, [rax - 3]
jmp 0x14007fe9e
cmp eax, 2
je 0x14007fe9e
cmp eax, 3
jne 0x14007fe91
lea edx, [rax - 1]
jmp 0x14007fe9e
cmp eax, 4
mov r8d, reloc.WS2_32.dll_ntohs
cmove edx, r8d
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov al, 1
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.1401aed20
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140081a00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
test rcx, rcx
je 0x140081b3e
mov r8, 0xffffffffffffffff
mov rax, r8
inc rax
cmp word [rcx + rax*2], 0
jne 0x140081a26
test rax, rax
je 0x140081b3e
mov qword [rsp + 0x68], rbx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov word [rsp + 0x20], bx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x38], 7
nop dword [rax + rax]
inc r8
cmp word [rcx + r8*2], bx
jne 0x140081a60
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.14007ece0
mov r10, qword [rsp + 0x30]
test r10, r10
je 0x140081ad4
cmp qword [rsp + 0x38], 8
lea r9, [r10 + r10]
lea rdx, [rsp + 0x20]
mov r8, rbx
cmovae rdx, qword [rsp + 0x20]
lea rax, [r9 + rdx]
shr r9, 1
cmp rdx, rax
cmova r9, rbx
test r9, r9
je 0x140081ad4
nop dword [rax]
movzx ecx, word [rdx]
lea eax, [rcx - 0x41]
cmp ax, 0x19
ja 0x140081ac3
add cx, 0x20
mov word [rdx], cx
add rdx, 2
inc r8
cmp r8, r9
jb 0x140081ab0
mov r10, qword [rsp + 0x30]
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
lea rdx, [r10 + r10]
movabs rdi, 0xcbf29ce484222325
cmovae rcx, qword [rsp + 0x20]
test rdx, rdx
je 0x140081b15
movabs r8, 0x100000001b3
movzx eax, byte [rbx + rcx]
inc rbx
xor rdi, rax
imul rdi, r8
cmp rbx, rdx
jb 0x140081b02
lea rcx, [rsp + 0x20]
call fcn.14007ec70
mov rbx, qword [rsp + 0x68]
mov rax, rdi
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x58
ret
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x58
ret
Function at 0x140081f80
Capabilities:
Get file system object information

Disassembly:
push rdi
sub rsp, 0x320
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rdi, rcx
test dl, dl
jne 0x140081fc0
cmp qword [rcx + 0x38], 0
je 0x140081fc0
cmp qword [rcx + 0x40], 8
lea rax, [rcx + 0x28]
jb 0x1400820db
mov rax, qword [rax]
jmp 0x1400820db
mov qword [rsp + 0x338], rbx
lea rcx, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x340], rsi
mov r8d, 0x2b8
call fcn.1402dd440
lea rbx, [rdi + 0xb8]
cmp qword [rbx], 0
jne 0x140082045
xor eax, eax
mov qword [rsp + 0x30], rbx
cmp qword [rdi + 0x20], 8
lea rcx, [rdi + 8]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 1
jb 0x14008200e
mov rcx, qword [rcx]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
cmp byte [rsp + 0x40], 0
je 0x140082045
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rdx]
mov qword [rdx], rax
test rcx, rcx
je 0x140082045
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbx]
lea r8, [rsp + 0x50]
mov r9d, 0x2b8
mov dword [rsp + 0x20], 0x608
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov rbx, 0xffffffffffffffff
lea rsi, [rdi + 0x28]
mov r8, rbx
lea rax, [rsp + 0x60]
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140082080
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.14007ece0
lea rax, [rsp + 0x268]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400820a0
mov r8, rbx
lea rcx, [rdi + 0x48]
lea rdx, [rsp + 0x268]
call fcn.14007ece0
cmp qword [rsi + 0x18], 8
mov rbx, qword [rsp + 0x338]
jb 0x1400820d0
mov rsi, qword [rsi]
mov rax, rsi
mov rsi, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x320
pop rdi
ret

Function at 0x140082410
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x80], 8
mov rbx, rcx
je 0x140082447
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x140082430
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140082447
mov eax, dword [rbx + 0x7c]
shr eax, 1
and al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x140082450
Capabilities:
Check if file exists

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x80], 8
mov rbx, rcx
je 0x14008248c
add rcx, 8
cmp qword [rcx + 0x18], 8
jb 0x140082470
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x14008248c
mov eax, dword [rbx + 0x7c]
shr eax, 1
and al, 1
je 0x14008248c
call fcn.1400a2240
test al, al
je 0x1400824c0
cmp dword [rbx + 0x80], 8
je 0x1400824c8
cmp qword [rbx + 0x20], 8
lea rcx, [rbx + 8]
jb 0x1400824a3
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400824c8
mov eax, dword [rbx + 0x7c]
and eax, 6
cmp al, 6
jne 0x1400824c8
call fcn.1400a22a0
test al, al
jne 0x1400824c8
xor al, al
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400824d0
Capabilities:
Get file system object information

Disassembly:
push rbx
sub rsp, 0x300
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
cmp qword [rcx + 0x58], 0
mov rbx, rcx
jne 0x140082558
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x2b8
call fcn.1402dd440
mov rcx, rbx
call fcn.140082580
mov rcx, rax
mov dword [rsp + 0x20], 0x408
mov r9d, 0x2b8
lea r8, [rsp + 0x30]
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea rcx, [rbx + 0x48]
mov r8, 0xffffffffffffffff
lea rax, [rsp + 0x248]
inc r8
cmp word [rax + r8*2], 0
jne 0x140082540
lea rdx, [rsp + 0x248]
call fcn.14007ece0
cmp qword [rbx + 0x60], 8
lea rax, [rbx + 0x48]
jb 0x140082566
mov rax, qword [rax]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x300
pop rbx
ret

Function at 0x140084eb0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x50
lea rbx, [rcx + 0xf8]
cmp qword [rbx], 0
jne 0x140084f86
mov qword [rsp + 0x60], rdi
lea rdi, [rcx + 0xb8]
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x140084ee0
mov rcx, qword [rdi]
call fcn.1400851b0
mov qword [rsp + 0x30], rbx
mov byte [rsp + 0x40], 1
test al, al
je 0x140084f2d
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rsp + 0x38]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
cmp byte [rsp + 0x40], 0
je 0x140084f78
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [r8]
mov qword [r8], rdx
jmp 0x140084f6d
xor eax, eax
cmp qword [rdi + 0x18], 8
mov qword [rsp + 0x38], rax
jb 0x140084f3e
mov rdi, qword [rdi]
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHELL32.dll_SHParseDisplayName]
cmp byte [rsp + 0x40], 0
je 0x140084f78
mov rdx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rdx]
mov qword [rdx], rax
test rcx, rcx
je 0x140084f78
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rax, qword [rbx]
mov rdi, qword [rsp + 0x60]
add rsp, 0x50
pop rbx
ret
mov rax, qword [rbx]
add rsp, 0x50
pop rbx
ret
Function at 0x140084f90
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x140481c10], 0
lea rdi, [0x140481c00]
jne 0x140085065
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1402dd440
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x10]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140084ff2
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14007ece0
cmp qword [reloc.WS2_32.dll_getsockopt], 8
lea r9, [0x1403fe8e8]
mov rdx, qword [0x140481c10]
mov rcx, rdi
cmovae rcx, qword [0x140481c00]
mov qword [rsp + 0x20], 2
call fcn.140085aa0
inc rax
cmp qword [0x140481c10], rax
jb 0x140085091
cmp qword [reloc.WS2_32.dll_getsockopt], 8
mov rcx, rdi
mov qword [0x140481c10], rax
cmovae rcx, qword [0x140481c00]
xor edx, edx
mov word [rcx + rax*2], dx
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae rdi, qword [0x140481c00]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x250
pop rdi
ret
call fcn.140087620
int3

Function at 0x1400850a0
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x140481c30], 0
lea rdi, [0x140481c20]
jne 0x140085175
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.1402dd440
xor r9d, r9d
lea rdx, [rsp + 0x30]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140085102
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.14007ece0
cmp qword [reloc.WS2_32.dll_getsockopt], 8
lea r9, [0x1403fe8e8]
mov rdx, qword [0x140481c30]
mov rcx, rdi
cmovae rcx, qword [0x140481c20]
mov qword [rsp + 0x20], 2
call fcn.140085aa0
inc rax
cmp qword [0x140481c30], rax
jb 0x1400851a1
cmp qword [reloc.WS2_32.dll_getsockopt], 8
mov rcx, rdi
mov qword [0x140481c30], rax
cmovae rcx, qword [0x140481c20]
xor edx, edx
mov word [rcx + rax*2], dx
cmp qword [reloc.WS2_32.dll_getsockopt], 8
cmovae rdi, qword [0x140481c20]
mov rax, rdi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x250
pop rdi
ret
call fcn.140087620
int3
Function at 0x14008acd0
Capabilities:
Print debug messages

Disassembly:
jmp 0x14008ae40
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1401afbb0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1438]
xor r12d, r12d
mov word [rbp + 0x3c0], r12w
mov byte [rbp - 0x40], r12b
mov ecx, dword [rbp + 0x1440]
call fcn.140088c70
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x140492878], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rax, qword [0x140492810]
test rax, rax
je 0x14008af22
call rax
mov qword [rbp - 0x68], rax
jmp 0x14008af26
mov qword [rbp - 0x68], r12
mov rax, qword [0x140492820]
test rax, rax
je 0x14008af43
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140492818]
test rax, rax
je 0x14008af56
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1404927d8]
test rax, rax
je 0x14008af69
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x14008b054
cmp byte [0x140492841], r12b
jne 0x14008afc5
mov rax, qword [0x140492848]
test rax, rax
je 0x14008af91
call rax
movzx r12d, al
jmp 0x14008af9d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14008afc5
mov rax, qword [0x140492850]
test rax, rax
je 0x14008b01b
cmp byte [0x140492830], r12b
jne 0x14008b01b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14008b01b
mov rax, qword [0x140492850]
test rax, rax
je 0x14008afee
cmp byte [0x140492830], 0
jne 0x14008afee
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x14008b00e
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140080960
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140492840], 0
je 0x14008b033
mov rax, qword [0x140492808]
test rax, rax
je 0x14008b033
call rax
nop
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x14d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140089220
nop
int3
Function at 0x14008ae40
Capabilities:
Print debug messages

Disassembly:
jmp 0x14008ae40
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13d0]
mov eax, 0x14d0
call fcn.1401afbb0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x13c0], rax
mov r14, r8
mov esi, edx
mov r15, rcx
mov rdi, qword [rbp + 0x1438]
xor r12d, r12d
mov word [rbp + 0x3c0], r12w
mov byte [rbp - 0x40], r12b
mov ecx, dword [rbp + 0x1440]
call fcn.140088c70
mov ebx, eax
mov edx, 1
mov dword [rsp + 0x20], edx
mov dword [rsp + 0x24], ecx
lock xadd dword [0x140492878], edx
inc edx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x5c], ebx
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], r15
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov rax, qword [0x140492810]
test rax, rax
je 0x14008af22
call rax
mov qword [rbp - 0x68], rax
jmp 0x14008af26
mov qword [rbp - 0x68], r12
mov rax, qword [0x140492820]
test rax, rax
je 0x14008af43
mov r8d, 0x400
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x140492818]
test rax, rax
je 0x14008af56
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1404927d8]
test rax, rax
je 0x14008af69
lea rcx, [rsp + 0x20]
call rax
cmp dword [rsp + 0x24], r12d
jge 0x14008b054
cmp byte [0x140492841], r12b
jne 0x14008afc5
mov rax, qword [0x140492848]
test rax, rax
je 0x14008af91
call rax
movzx r12d, al
jmp 0x14008af9d
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne r12b
test r12d, r12d
jne 0x14008afc5
mov rax, qword [0x140492850]
test rax, rax
je 0x14008b01b
cmp byte [0x140492830], r12b
jne 0x14008b01b
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x20]
call rax
jmp 0x14008b01b
mov rax, qword [0x140492850]
test rax, rax
je 0x14008afee
cmp byte [0x140492830], 0
jne 0x14008afee
mov r8d, 0x800
lea rdx, [rbp + 0x3c0]
lea rcx, [rsp + 0x20]
call rax
cmp word [rbp + 0x3c0], 0
jne 0x14008b00e
lea r8, [rsp + 0x20]
mov edx, 0x800
lea rcx, [rbp + 0x3c0]
call fcn.140080960
lea rcx, [rbp + 0x3c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x140492840], 0
je 0x14008b033
mov rax, qword [0x140492808]
test rax, rax
je 0x14008b033
call rax
nop
mov rcx, qword [rbp + 0x13c0]
xor rcx, rsp
call fcn.1401aed20
add rsp, 0x14d0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140089220
nop
int3