joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401df250
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
push r12
sub rsp, 0x38
mov rdi, qword [rcx + 0x18]
mov qword [rsp + 0x18], r13
mov r13, rcx
mov qword [rsp + 0x10], r14
mov r9d, dword [rdi + 8]
mov eax, r9d
shr eax, 0x18
mov dword [rsp + 0x68], r9d
cmp al, 0xff
jae 0x1401df2d7
test al, al
jne 0x1401df29b
mov word [rsp + 0x68], 0
mov byte [rsp + 0x6a], al
jmp 0x1401df2d2
mov ecx, eax
movzx eax, r9b
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x69]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x69], al
movzx eax, byte [rsp + 0x6a]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x6a], al
mov r9d, dword [rsp + 0x68]
xor r12d, r12d
mov r14d, 1
cmp dword [r13 + 0x24], r14d
jle 0x1401df452
movsd xmm2, qword [0x1403b5e08]
lea eax, [r8 - 1]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbp
mov ebp, reloc.OLEAUT32.dll_SafeArrayGetDim
mov qword [rsp + 0x20], rsi
movd xmm1, eax
mov qword [rsp + 8], r15
xor r15d, r15d
cvtdq2pd xmm1, xmm1
nop word [rax + rax]
mov ecx, dword [rdi + rbp + 8]
movaps xmm0, xmm1
mulsd xmm0, qword [rdi + rbp]
mov eax, ecx
shr eax, 0x18
addsd xmm0, xmm2
movsd qword [rsp + 0x68], xmm0
mov r8d, dword [rsp + 0x68]
sub r8d, r12d
mov dword [rsp + 0x68], ecx
cmp al, 0xff
jae 0x1401df396
test al, al
jne 0x1401df35c
mov word [rsp + 0x68], 0
mov byte [rsp + 0x6a], al
jmp 0x1401df392
mov edx, eax
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x68], al
movzx eax, byte [rsp + 0x69]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x69], al
movzx eax, byte [rsp + 0x6a]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x6a], al
mov ecx, dword [rsp + 0x68]
xor r10d, r10d
test r8d, r8d
jle 0x1401df420
mov r13, qword [rsp + 0x58]
mov esi, r9d
shr r9d, 8
and esi, 0xff00ff
and r9d, 0xff00ff
mov r11d, ecx
shr r11d, 8
mov ebx, ecx
and r11d, 0xff00ff
and ebx, 0xff00ff
sub r11d, r9d
sub ebx, esi
shl r9d, 8
add r12d, r8d
nop dword [rax]
mov eax, r10d
mov edi, ebx
shl eax, 8
inc r10d
cdq
idiv r8d
mov edx, r11d
imul edi, eax
imul edx, eax
shr edi, 8
add edi, esi
add edx, r9d
xor edi, edx
and edi, 0xff00ff
xor edi, edx
mov dword [r13 + r15*4], edi
inc r15
cmp r10d, r8d
jl 0x1401df3e0
mov r13, qword [rsp + 0x50]
mov rdi, qword [r13 + 0x18]
inc r14d
add rbp, 0x10
mov r9d, ecx
cmp r14d, dword [r13 + 0x24]
jl 0x1401df320
mov r15, qword [rsp + 8]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x60]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
cmp r12d, r8d
jge 0x1401df473
movsxd rax, r12d
sub r8d, r12d
movsxd rcx, r8d
lea rdi, [rdx + rax*4]
mov eax, r9d
rep stosd dword [rdi], eax
add rsp, 0x38
pop r12
pop rdi
ret
Function at 0x1401eb200
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x140379908]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401eb2ba
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1401eb2b4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401eb2b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.14001a580
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x48]
mov qword [rbx], rcx
lea rcx, [rax - 0x10]
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x1401eb2ab
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401eb2ab
call fcn.1400da0f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1401eb2e0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401eb37e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1401eb372
mov rcx, qword [rsi]
mov qword [rsp + 0x30], rbx
call fcn.14001ae20
mov rbx, rax
add rbx, 4
je 0x1401eb36d
lea rdx, [rbx + 2]
mov qword [rsp + 0x38], rdi
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401eb368
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401eb368
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.14017ea20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]
add rsp, 0x20
pop rsi
ret
Function at 0x1401eb920
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
cmp qword [r8], 0
je 0x1401eb9e9
call fcn.14017ec10
cmp eax, 0x203
jl 0x1401eb9e9
cmp byte [0x14044b0a8], 0
jne 0x1401eb9a6
mov byte [0x14044b0a8], 1
lea rcx, str.Comctl32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.Comctl32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401eb9a6
lea rdx, str.TaskDialogIndirect
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14044a388], rax
jmp 0x1401eb9ad
mov rax, qword [0x14044a388]
test rax, rax
je 0x1401eb9e9
mov ecx, 0x50
call fcn.1400da124
mov qword [rsp + 0x78], rax
mov r8, r15
mov rdx, r14
mov rcx, rax
call fcn.1400909a0
nop
mov qword [rbx], rax
mov rcx, qword [r15]
test rcx, rcx
je 0x1401ebb56
mov edx, 1
jmp 0x1401ebb51
mov eax, dword [r14 + 0x24]
mov r12d, 1
cmp eax, 3
jne 0x1401eb9fc
mov ebp, eax
jmp 0x1401eba5d
cmp eax, 2
jne 0x1401eba5b
lea rcx, [r14 + 0x18]
xor edx, edx
call fcn.14017f2f0
mov rcx, qword [rax]
lea rdi, [rcx - 0x10]
mov eax, dword [rdi]
nop
test eax, 0x30000000
jne 0x1401eba20
lock inc dword [rdi]
lea rdx, [0x1403992cc]
call fcn.14001c670
mov ebp, 4
test eax, eax
cmove ebp, r12d
mov eax, dword [rdi]
nop
test eax, 0x30000000
jne 0x1401eba5d
mov eax, 0xffffffff
lock xadd dword [rdi], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401eba5d
mov rcx, rdi
call fcn.1400da0f0
jmp 0x1401eba5d
xor ebp, ebp
mov ecx, 0x38
call fcn.1400da124
mov rdi, rax
mov qword [rsp + 0x78], rax
mov rax, qword [r14 + 0x28]
test rax, rax
je 0x1401eba7e
mov rsi, qword [rax + 0x10]
jmp 0x1401eba80
xor esi, esi
mov rcx, rdi
call fcn.140189bf0
nop
lea rax, vtable.juce::WindowsMessageBoxBase.0
mov qword [rdi], rax
lea rcx, [rdi + 0x10]
mov qword [rsp + 0x28], rcx
mov rdx, rsi
call fcn.140099a40
mov rax, qword [r15]
mov qword [r15], 0
mov qword [rdi + 0x18], rax
lea rax, vtable.juce::PreVistaMessageBox.0
mov qword [rdi], rax
mov esi, dword [r14]
mov byte [rsp + 0x70], 0
lea rdx, [rsp + 0x70]
lea rcx, [0x1401ebbb0]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx eax, byte [rsp + 0x70]
neg al
sbb ecx, ecx
and ecx, 0x40000
sub esi, 1
je 0x1401ebb09
sub esi, 1
je 0x1401ebb02
cmp esi, 1
je 0x1401ebafb
mov eax, 0x12000
jmp 0x1401ebb0e
mov eax, 0x12040
jmp 0x1401ebb0e
mov eax, 0x12030
jmp 0x1401ebb0e
mov eax, 0x12020
or ecx, ebp
or ecx, eax
mov dword [rdi + 0x20], ecx
mov rcx, qword [r14 + 8]
mov qword [rdi + 0x28], rcx
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x1401ebb2c
lock inc dword [rcx - 0x10]
mov rcx, qword [r14 + 0x10]
mov qword [rdi + 0x30], rcx
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x1401ebb43
lock inc dword [rcx - 0x10]
mov qword [rbx], rdi
mov rcx, qword [r15]
test rcx, rcx
je 0x1401ebb56
mov edx, r12d
mov rax, qword [rcx]
call qword [rax]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1401ebd90
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov r8d, ecx
bt ecx, 0x10
jb 0x1401ebdf8
movdqa xmm0, xmmword [0x1403b6110]
lea edx, [r8 - 0x20]
movdqa xmm1, xmmword [0x1403b6120]
xor eax, eax
add ecx, 0xffffff9f
mov dword [rsp + 0x40], 0xdb005b
cmp cx, 0x19
mov dword [rsp + 0x44], 0xdd005d
movdqu xmmword [rsp + 0x20], xmm0
cmova dx, r8w
movzx r8d, dx
movdqu xmmword [rsp + 0x30], xmm1
nop
cmp r8w, word [rsp + rax*2 + 0x20]
jne 0x1401ebdee
movzx r8d, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x1401ebde0
movsx ecx, r8w
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x58
ret
Function at 0x1401ed1b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
test rax, rax
je 0x1401ed1e0
lea rdx, str.SetProcessDPIAware
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed1e3
mov rax, rbx
lea rcx, str.SHCore.dll
mov qword [0x14044a348], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rcx, str.SHCore.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
je 0x1401ed395
lea rdx, [0x140381d40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.SetProcessDpiAwareness
mov rcx, rdi
mov qword [0x14044a3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14044a3a0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed262
lea rdx, [0x140381d18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed265
mov rax, rbx
lea rdx, str.GetProcessDpiAwareness
mov qword [0x14044a350], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14044a390], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed2a7
lea rdx, [0x140381e40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed2aa
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x14044a3c0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed2d5
lea rdx, [0x140381e20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed2d8
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x14044a3a8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed303
lea rdx, [0x140381e00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed306
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x14044a3d0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed331
lea rdx, [0x140381dd8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed334
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x14044a378], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed35f
lea rdx, str.SetProcessDpiAwarenessContext
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x1401ed362
mov rax, rbx
lea rcx, str.user32.dll
mov qword [0x14044a360], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401ed38e
lea rdx, str.EnableNonClientDpiScaling
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov qword [0x14044a358], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140209f20
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
test dl, dl
je 0x140209ffc
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edx, ax
mov eax, dword [0x140444cd8]
shr edx, 0xf
test dl, 1
je 0x140209f5b
mov edx, eax
and dl, 7
cmp dl, 4
je 0x140209ffc
cmp byte [rbx + 0x221], 0
jne 0x140209ff0
movdqa xmm0, xmmword [0x1403b6110]
xor ebx, ebx
movdqa xmm1, xmmword [0x1403b6120]
mov eax, ebx
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, 0x1b
mov dword [rsp + 0x50], 0xdb005b
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x54], 0xdd005d
nop dword [rax]
cmp cx, word [rsp + rax*2 + 0x30]
jne 0x140209fac
movzx ecx, word [rsp + rax*2 + 0x32]
add rax, 2
cmp rax, 0x14
jl 0x140209fa0
movsx ecx, cx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x140209fcf
test byte [0x140444cd8], 7
je 0x140209ffc
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], SafeArrayGetDim
mov dword [rsp + 0x28], ebx
call fcn.14025c020
test al, al
jne 0x140209ffc
mov eax, dword [0x140444cd8]
shr eax, 1
not al
and al, 1
add rsp, 0x60
pop rbx
ret
xor al, al
add rsp, 0x60
pop rbx
ret

Function at 0x140214730
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
test dl, dl
je 0x1402147a5
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
jne 0x14021479e
mov ecx, 0x10021
call fcn.1401ebd90
test al, al
jne 0x14021479e
mov ecx, 0x10028
call fcn.1401ebd90
test al, al
jne 0x14021479e
mov ecx, 0x10022
call fcn.1401ebd90
test al, al
jne 0x14021479e
mov ecx, 0x10024
call fcn.1401ebd90
test al, al
jne 0x14021479e
mov ecx, 0x10023
call fcn.1401ebd90
test al, al
jne 0x14021479e
mov ecx, SafeArrayGetDim
call fcn.1401ebd90
test al, al
je 0x1402147a5
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x14024c0e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
mov byte [rcx + 0x1de], 0
mov r8d, dword [rcx - 0xa4]
mov eax, dword [rcx - 0xa8]
xor ecx, ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x2c], r8d
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r8b, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xe8]
call fcn.140266a70
xor edx, edx
mov rcx, rbx
call fcn.14017f2f0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140178d10
nop
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
je 0x14024c1d4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14024c1d4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14024c19e
cmp eax, 0xffffffff
je 0x14024c19e
mov al, 1
jmp 0x14024c1a0
xor al, al
cmp al, byte [rsi + 0x1dc]
jne 0x14024c1d4
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov ecx, dword [rax - 0x10]
nop
test ecx, 0x30000000
jne 0x14024c1c2
lock inc dword [rax - 0x10]
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xe8]
call fcn.14024bcf0
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14024c1fc
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14024c1fc
call fcn.1400da0f0
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14024e510
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx + 0xd8]
call fcn.140252070
movzx edx, al
mov rcx, qword [rbx + 8]
add rcx, 0xe0
call fcn.140286e80
mov rax, qword [rbx + 8]
mov rdx, qword [rax + 0xd8]
mov eax, dword [rdx + 0x118]
shr eax, 1
test al, 1
je 0x14024e57b
add rdx, 0x120
lea rcx, [rsp + 0x30]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14024e57b
cmp eax, 0xffffffff
je 0x14024e57b
mov dl, 1
jmp 0x14024e57d
xor edx, edx
mov rcx, qword [rbx + 8]
add rcx, 0x4c0
mov rax, qword [rcx]
add rsp, 0x20
pop rbx
jmp qword [rax + 0x58]
Function at 0x140250760
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rbp, rdx
mov rsi, rcx
lea rcx, [rsp + 0x48]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140250810
cmp eax, 0xffffffff
je 0x140250810
lea rcx, [rsi - 0xd8]
mov rdx, rbp
call fcn.140251a90
mov eax, dword [rsi + 0x40]
and eax, 0x108
cmp eax, 8
jne 0x14025088e
lea rax, [0x140379908]
mov qword [rsp + 0x48], rax
lea rcx, [rsi + 0x230]
mov r8b, 1
lea rdx, [rsp + 0x48]
call fcn.14027e100
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14025088e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14025088e
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1400da0f0
lea rdx, [rsi - 0xd8]
lea rcx, [rsp + 0x50]
call fcn.140099a40
nop
mov edi, dword [rsi + 0x6c]
mov rbx, qword [rsp + 0x50]
nop word [rax + rax]
test rbx, rbx
je 0x14025086b
cmp qword [rbx + 0x10], 0
je 0x14025086b
test edi, edi
jle 0x14025086b
mov eax, dword [rsi + 0x6c]
dec edi
cmp edi, eax
jl 0x140250855
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x14025086b
movsxd rcx, edi
mov rax, qword [rsi + 0x60]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x140250830
test rbx, rbx
je 0x14025088e
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14025088e
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140252070
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor r8d, r8d
lea rdx, [rsp + 0x30]
call fcn.14027f0f0
test byte [rbx + 0x118], 8
jne 0x1402520b5
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1402520b5
cmp eax, 0xffffffff
je 0x1402520b5
xor bl, bl
jmp 0x1402520ef
mov eax, dword [rbx + 0x118]
shr eax, 1
test al, 1
jne 0x1402520ed
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x1402520e9
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
jne 0x1402520ed
xor bl, bl
jmp 0x1402520ef
mov bl, 1
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
mov edx, dword [rcx]
nop
test edx, 0x30000000
jne 0x140252118
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x140252118
call fcn.1400da0f0
movzx eax, bl
add rsp, 0x20
pop rbx
ret
Function at 0x140252ec0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x50], rbp
mov rbx, rcx
mov qword [rsp + 0x28], r14
movzx ebp, r9b
mov r14, rdx
mov qword [rsp + 0x20], r15
mov rdx, qword [rcx + 0x48]
movzx r15d, r8b
cmp qword [r14], rdx
je 0x140253039
mov rcx, qword [r14]
call fcn.140019450
test eax, eax
je 0x140253039
mov qword [rsp + 0x58], rsi
lea rdx, [rbx + 0x38]
xor esi, esi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
test rbx, rbx
mov r12d, 1
mov eax, r12d
cmove rdx, rsi
xchg byte [rbx + 0xb0], al
mov rcx, qword [rbx + 0x58]
call fcn.140160380
mov rdi, qword [rbx + 0xa8]
mov qword [rbx + 0xa8], rsi
test rdi, rdi
je 0x140252f5c
mov rcx, rdi
call fcn.14000f240
mov edx, 0x48
mov rcx, rdi
call fcn.1400da0f0
cmp dword [rbx + 0xa4], esi
je 0x140252fbe
lea rcx, [rbx + 0x98]
call fcn.140098ef0
cmp dword [rbx + 0xa0], esi
je 0x140252f8b
mov rcx, qword [rbx + 0x98]
call fcn.1400e0818
mov qword [rbx + 0x98], rsi
mov dword [rbx + 0xa0], esi
movzx eax, byte [rbx + 0x30]
nop
test al, al
je 0x140252fbe
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r12d
jne 0x140252fbe
mov rcx, qword [rbx + 0x10]
call fcn.140188d70
test al, al
jne 0x140252fbe
mov rcx, qword [rbx + 0x10]
mov eax, esi
xchg dword [rcx + 0x18], eax
mov rcx, qword [r14]
mov rdi, qword [rsp + 0x38]
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x140252fd5
lock inc dword [rcx - 0x10]
mov rcx, qword [r14]
xchg qword [rbx + 0x48], rcx
mov eax, dword [rcx - 0x10]
add rcx, 0xfffffffffffffff0
nop
test eax, 0x30000000
jne 0x140253000
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140253000
call fcn.1400da0f0
movzx eax, byte [rbx + 0x30]
nop
test al, al
je 0x14025302b
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r12d
jne 0x14025302b
mov rcx, qword [rbx + 0x10]
call fcn.140188d70
test al, al
jne 0x14025302b
mov rax, qword [rbx + 0x10]
xchg dword [rax + 0x18], esi
and dword [rbx + 0x60], 0xfffffffc
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov ecx, dword [rbx + 0x60]
mov eax, ecx
mov r14, qword [rsp + 0x28]
and eax, 0xfffffffe
mov edx, ecx
or edx, 1
test r15b, r15b
mov r15, qword [rsp + 0x20]
cmove edx, eax
mov eax, edx
or edx, 2
and eax, 0xfffffffd
test bpl, bpl
mov rbp, qword [rsp + 0x50]
cmove edx, eax
cmp ecx, edx
je 0x14025307d
mov rcx, rbx
mov dword [rbx + 0x60], edx
add rsp, 0x40
pop rbx
jmp fcn.140252bb0
add rsp, 0x40
pop rbx
ret
Function at 0x1402532e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x1402533be
lea rcx, [rsp + 0x50]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1402533be
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.1400dc674
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140099a40
nop
mov edi, dword [rsi + 0x1c]
mov rbx, qword [rsp + 0x60]
nop dword [rax]
test rbx, rbx
je 0x14025339b
cmp qword [rbx + 0x10], 0
je 0x14025339b
test edi, edi
jle 0x14025339b
mov eax, dword [rsi + 0x1c]
dec edi
cmp edi, eax
jl 0x140253385
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x14025339b
movsxd rcx, edi
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rdx, rbp
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x140253360
test rbx, rbx
je 0x1402533be
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1402533be
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret

Function at 0x140253420
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rdx + 0x10]
mov rdi, rdx
mov edx, dword [rcx + 0x128]
mov rbx, rcx
mov rcx, qword [rcx + 0xf8]
mov r9b, 1
call fcn.140214d30
mov rcx, qword [rbx + 0xf8]
lea rdx, [rbx + 0x108]
add rcx, 0x130
mov r8, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x140253420
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov rdx, qword [rcx + 8]
add rdx, 0x48
mov rax, qword [rdx]
cmp byte [rax], 0
je 0x140253503
lea rcx, [rsp + 0x50]
call fcn.140015780
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140253503
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov rcx, rsi
call fcn.1400dc674
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140099a40
nop
mov edi, dword [rsi + 0x1c]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1402534e0
cmp qword [rbx + 0x10], 0
je 0x1402534e0
test edi, edi
jle 0x1402534e0
mov eax, dword [rsi + 0x1c]
dec edi
cmp edi, eax
jl 0x1402534c7
lea edi, [rax - 1]
mov eax, edi
shr eax, 0x1f
xor al, 1
je 0x1402534e0
movsxd rcx, edi
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov r8, rbp
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
jmp 0x1402534a2
test rbx, rbx
je 0x140253503
mov eax, 0xffffffff
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140253503
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret