joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140116d50
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140110aec
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140110aec
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140116ea0
cmp rax, 0xffffffffffffffff
je 0x140116ea0
xor edi, edi
test rbp, rbp
jle 0x140116e4b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140106bf0
mov rbx, rax
test rax, rax
jne 0x140116dd8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140116e41
mov edx, 0x8000
mov ecx, r14d
call fcn.1401038c4
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14010c918
cmp eax, 0xffffffff
je 0x140116e21
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140116de8
mov edx, r15d
mov ecx, r14d
call fcn.1401038c4
jmp 0x140116e41
cmp byte [rsi + 0x38], dil
je 0x140116e38
cmp dword [rsi + 0x34], 5
jne 0x140116e38
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetDim
cmp byte [rsi + 0x30], dil
je 0x140116e41
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140103a70
jmp 0x140116eb4
jns 0x140116eb4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140110aec
cmp rax, 0xffffffffffffffff
jne 0x140116e6c
cmp byte [rsi + 0x30], dil
je 0x140116eb4
mov edi, dword [rsi + 0x2c]
jmp 0x140116eb4
mov ecx, r14d
call fcn.14010f34c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140116eb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, SafeArrayGetDim
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], SafeArrayGetDim
jmp 0x140116eb4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140116ead
mov eax, dword [rsi + 0x2c]
jmp 0x140116eb2
mov eax, SafeArrayCopy
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140110aec
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140145130
Capabilities:
Get keyboard layout

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov esi, r8d
mov edi, edx
test dl, 2
je 0x1401451f7
xor ecx, ecx
mov qword [rsp + 0x170], rbx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
mov rbx, rax
call fcn.1400dda90
movzx eax, byte [rsp + 0x60]
lea r9, [rsp + 0x40]
movzx ecx, byte [rsp + 0x62]
lea r8, [rsp + 0x50]
mov edx, 0x80
mov qword [rsp + 0x30], rbx
test dil, 1
mov byte [rsp + 0x61], 0x80
cmovne ecx, edx
test dil, 4
mov byte [rsp + 0x62], cl
mov ecx, esi
cmovne eax, edx
xor edx, edx
mov byte [rsp + 0x60], al
xor eax, eax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], 3
mov dword [rsp + 0x40], eax
mov word [rsp + 0x44], ax
call qword [sym.imp.USER32.dll_ToUnicodeEx]
mov rbx, qword [rsp + 0x170]
test eax, eax
jle 0x1401451f3
cmp word [rsp + 0x40], 0x20
setb al
jmp 0x1401451f9
mov al, 1
jmp 0x1401451f9
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400da5a0
mov rsi, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x14014da30
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx]
mov qword [rsp + 0x30], rdx
mov eax, dword [rdx - 0x10]
nop
test eax, 0x30000000
jne 0x14014da4d
lock inc dword [rdx - 0x10]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rax
lea r8, [0x14037018d]
lea rdx, [0x14037018c]
lea rcx, [rsp + 0x30]
call fcn.14016b200
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov ecx, dword [rax - 0x10]
nop
test ecx, 0x30000000
jne 0x14014da89
lock inc dword [rax - 0x10]
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
mov ebx, 0xffffffff
test eax, 0x30000000
jne 0x14014dab3
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x14014dab3
call fcn.1400daaa8
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14014daef
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x14014daef
call fcn.1400daaa8
add rsp, 0x20
pop rbx
ret
Function at 0x14014ddc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov esi, r9d
mov ebp, r8d
mov r14, rdx
mov rbx, rcx
lea rdx, [rcx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14000ebe0
nop
mov rbx, qword [rbx]
test rbx, rbx
je 0x14014df23
mov edx, esi
mov rcx, rbx
call fcn.140013150
test al, al
je 0x14014df23
xor edi, edi
test ebp, ebp
jle 0x14014df28
mov qword [rsp + 0x48], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
mov r8d, ebp
mov rdx, r14
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14014de76
mov edi, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14014df28
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14014df18
movzx eax, byte [rbx + 0x1a]
nop
test al, al
jne 0x14014dec5
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rax
mov r9d, 0xffffffff
test esi, esi
cmovns r9d, esi
xor r8d, r8d
lea rdx, [rsp + 0x38]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14014ded1
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CancelIo]
jmp 0x14014df18
xor r9d, r9d
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x48]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x14014de5f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14014df18
cmp byte [rbx + 0x19], dil
je 0x14014df18
cmp byte [rbx + 0x18], dil
je 0x14014df18
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
mov byte [rbx + 0x18], dil
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 0xffffffff
mov rcx, qword [rsp + 0x30]
call fcn.140164960
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14014f260
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x14014f2cc
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14014f2cc
lea rcx, [rsp + 0x58]
call fcn.14014f920
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14014f2cc
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14014f2cc
call fcn.1400daaa8
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x14014f7c0
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x14014f859
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14014f859
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14014f835
cmp eax, 0xffffffff
je 0x14014f835
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140163dc0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
lea rbp, [rcx + 0x20]
mov qword [rsp + 0x50], rbp
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x140163ed2
mov rcx, rbx
call fcn.140164030
lea rcx, [rbx + 0x100]
call fcn.1400d7bb0
test eax, eax
jne 0x140163eed
mov eax, 1
xchg byte [rbx + 0x198], al
lea rcx, [rbx + 0x150]
call fcn.1400d7c5c
lea rcx, [rbx + 0x100]
call fcn.1400d7bd4
test edi, edi
je 0x140163e3f
mov edx, edi
mov rcx, rbx
call fcn.140163f00
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x140163ed2
lea rdx, str.___killing_thread_by_force___
lea rcx, [rsp + 0x40]
call fcn.1400199a0
nop
mov rcx, qword [0x14043c810]
test rcx, rcx
je 0x140163e78
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140163e83
lea rcx, [rsp + 0x40]
call fcn.14014da30
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140163eab
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x140163eab
call fcn.1400daaa8
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x140163ec2
mov rcx, qword [rbx + 0x10]
nop
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
mov eax, ecx
xchg qword [rbx + 0x10], rax
xchg qword [rbx + 0x18], rcx
xor bl, bl
jmp 0x140163ed4
mov bl, 1
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov ecx, eax
call fcn.1400d81b0
int3
Function at 0x140176fc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140177020
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140177020
mov ebx, 4
nop dword [rax + rax]
lea rdx, [rdi + 8]
mov rcx, rdi
call fcn.14017a7a0
test al, al
jne 0x140177032
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x140177000
xor al, al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140177050
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 4
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14017708c
cmp eax, 0xffffffff
je 0x14017708c
mov rcx, rbx
call fcn.14017a9c0
jmp 0x140177094
mov rcx, rbx
call fcn.14014f7c0
test al, al
jne 0x1401770a8
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x140177062
mov rcx, qword [rbx + 8]
sub rcx, 0x10
mov eax, dword [rcx]
nop
mov edi, 0xffffffff
test eax, 0x30000000
jne 0x1401770d0
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, edi
jne 0x1401770d0
call fcn.1400daaa8
mov rcx, qword [rbx]
sub rcx, 0x10
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x1401770f2
lock xadd dword [rcx], edi
dec edi
cmp edi, 0xffffffff
jne 0x1401770f2
call fcn.1400daaa8
nop
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140179930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x14017997d
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017997d
lea rax, [0x140370a58]
mov qword [rdi], rax
mov rax, rdi
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call fcn.14017a620
nop
mov rdx, qword [rsi]
mov rcx, qword [rsp + 0xb0]
cmp rcx, rdx
je 0x140179a74
call fcn.140018f90
test eax, eax
je 0x140179a74
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xb0]
call fcn.14017df80
nop
mov ebx, 0xffffffff
mov rax, qword [rsp + 0xa0]
cmp byte [rax], 0
jne 0x140179a3a
lea r8d, [rbx + 9]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140177aa0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx - 0x10]
nop
test eax, 0x30000000
jne 0x1401799fc
lock inc dword [rcx - 0x10]
mov rcx, qword [rsp + 0x50]
xchg qword [rsp + 0xa0], rcx
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x140179a28
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x140179a28
call fcn.1400daaa8
lea rcx, [rsp + 0x30]
call fcn.1401779d0
mov rax, qword [rsp + 0xa0]
mov qword [rdi], rax
lea rax, [0x140370a58]
mov qword [rsp + 0xa0], rax
mov eax, dword [0x140370a48]
nop
test eax, 0x30000000
jne 0x140179ac5
mov eax, ebx
lock xadd dword [0x140370a48], eax
dec eax
cmp eax, 0xffffffff
jne 0x140179ac5
lea rcx, [0x140370a48]
jmp 0x140179abf
lea rdx, str.Cannot_create_parent_directory
lea rcx, [rsp + 0xb8]
call fcn.1400199a0
lea rdx, [rsp + 0xb8]
mov rcx, rdi
call fcn.1401734d0
mov rcx, qword [rsp + 0xb8]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
mov ebx, 0xffffffff
test eax, 0x30000000
jne 0x140179ac5
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x140179ac5
call fcn.1400daaa8
nop
mov rcx, qword [rsp + 0xb0]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
test eax, 0x30000000
nop
jne 0x140179aeb
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x140179aeb
call fcn.1400daaa8
mov rax, rdi
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017a7a0
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rdx]
cmp rbx, qword [rcx]
je 0x14017a83c
mov rdx, qword [rcx]
mov rcx, rbx
call fcn.14001b9a0
test eax, eax
je 0x14017a83c
cmp byte [rbx], 0
je 0x14017a846
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017a846
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140014d10
mov rbx, qword [rax]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140014d10
xor ecx, ecx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9d, [rcx + 6]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
jne 0x14017a834
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
call fcn.14014f7c0
mov al, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rbx, qword [rdi]
cmp qword [rsi], rbx
je 0x14017a83c
mov rdx, rbx
mov rcx, qword [rsi]
call fcn.14001b9a0
test eax, eax
je 0x14017a83c
cmp byte [rbx], 0
je 0x14017a82a
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017a82a
mov rdx, qword [rsi]
cmp qword [rdi], rdx
je 0x14017a89e
mov rcx, qword [rdi]
call fcn.140018f90
test eax, eax
je 0x14017a89e
mov rcx, rsi
call fcn.14014f7c0
test al, al
je 0x14017a82a
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140014d10
mov rbx, qword [rax]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140014d10
mov rdx, rbx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14017a9c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov byte [rsp + 0x10], dl
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rbp, rcx
xor ebx, ebx
mov dword [rsp + 0x78], ebx
mov dil, 1
mov rdx, rcx
lea rcx, [rsp + 0x80]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x14017aae8
cmp eax, 0xffffffff
je 0x14017aae8
mov rdx, rbp
lea rcx, [rsp + 0x88]
call fcn.140014d10
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14017aa2c
bt eax, 0xa
jb 0x14017aae8
lea rdx, [0x1402d7104]
lea rcx, [rsp + 0x70]
call fcn.1400199a0
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x78], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r8d, 3
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140179560
nop
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14017aa96
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14017aa96
call fcn.1400daaa8
movsxd rax, dword [rsp + 0x3c]
mov rbx, qword [rsp + 0x30]
lea rsi, [rbx + rax*8]
cmp rbx, rsi
je 0x14017aad4
nop dword [rax]
xor edx, edx
mov rcx, rbx
call fcn.14017a9c0
test al, al
je 0x14017aac8
test dil, dil
je 0x14017aac8
mov dil, 1
jmp 0x14017aacb
xor dil, dil
add rbx, 8
cmp rbx, rsi
jne 0x14017aab0
lea rcx, [rsp + 0x30]
call fcn.1400033c0
mov rcx, qword [rsp + 0x30]
call fcn.1400e1bf4
mov rcx, rbp
call fcn.14014f7c0
test al, al
je 0x14017ab04
test dil, dil
je 0x14017ab04
mov al, 1
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14017da60
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rdx, [r8*4]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rdx
shr rdx, 1
add rdx, 3
lea rcx, [rbp - 0x50]
call fcn.14017d990
nop
test rbx, rbx
je 0x14017db71
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop dword [rax]
movzx edx, byte [rdi]
inc rdi
mov eax, edx
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [rbp + 0x20], al
and edx, 3
shl rdx, 4
cmp rbx, 1
jbe 0x14017db3f
movzx ecx, byte [rdi]
inc rdi
mov eax, ecx
shr rax, 4
or rax, rdx
movzx eax, byte [rax + r14]
mov byte [rbp + 0x21], al
and ecx, 0xf
lea rdx, [rcx*4]
cmp rbx, 2
jbe 0x14017db31
movzx eax, byte [rdi]
inc rdi
mov ecx, eax
shr rax, 6
or rax, rdx
movzx eax, byte [rax + r14]
mov byte [rbp + 0x22], al
and ecx, 0x3f
movzx eax, byte [rcx + r14]
mov byte [rbp + 0x23], al
sub rbx, 3
jmp 0x14017db4f
movzx eax, byte [rdx + r14]
mov byte [rbp + 0x22], al
mov byte [rbp + 0x23], 0x3d
jmp 0x14017db4d
movzx eax, byte [rdx + r14]
mov byte [rbp + 0x21], al
mov word [rbp + 0x22], 0x3d3d
xor ebx, ebx
mov r8d, 4
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x50]
mov rax, qword [rbp - 0x50]
call qword [rax + 0x20]
test al, al
je 0x14017db71
test rbx, rbx
jne 0x14017dac0
mov rax, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x18]
test rax, rax
jne 0x14017db84
mov rdx, qword [rbp - 0x28]
jmp 0x14017db9c
cmp qword [rax + 8], rcx
jbe 0x14017db99
mov rax, qword [rax]
mov byte [rcx + rax], 0
mov rcx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rax]
mov r8d, ecx
mov rcx, rsi
call fcn.14017e9a0
nop
lea rax, vtable.juce::MemoryOutputStream.0
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x38]
mov rcx, qword [rbp - 0x40]
cmp rcx, rax
je 0x14017dbce
test rcx, rcx
je 0x14017dbce
mov rdx, qword [rbp - 0x18]
call fcn.140173a80
mov rcx, qword [rbp - 0x38]
call fcn.1400e1bf4
lea rax, vtable.juce::OutputStream.0
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffff0
mov eax, dword [rcx]
nop
test eax, 0x30000000
jne 0x14017dc0a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14017dc0a
call fcn.1400daaa8
nop
mov rax, rsi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14017dc30
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [rdx], 0
mov rbx, rdx
mov r14, rcx
je 0x14017dd93
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
movzx ecx, byte [rbx]
inc rbx
mov eax, ecx
test cl, cl
jns 0x14017dcc2
mov ecx, 0x40
xor r8d, r8d
mov edx, 0x7f
test cl, al
je 0x14017dc90
cmp ecx, 8
jbe 0x14017dc90
shr edx, 1
inc r8d
shr ecx, 1
test eax, ecx
jne 0x14017dc80
and eax, edx
sub r8d, 1
js 0x14017dcc2
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x14017dcc2
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
inc rbx
sub r8d, 1
jns 0x14017dca0
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14017dcce
mov eax, ecx
jmp 0x14017dd18
lea ecx, [rax - 0x61]
cmp ecx, 0x19
ja 0x14017dcdb
add eax, 0xffffffb9
jmp 0x14017dd18
lea ecx, [rax - 0x30]
cmp ecx, 9
ja 0x14017dce8
add eax, 4
jmp 0x14017dd18
cmp eax, 0x2b
jne 0x14017dcf4
mov eax, 0x3e
jmp 0x14017dd18
cmp eax, 0x2f
jne 0x14017dd00
mov eax, 0x3f
jmp 0x14017dd18
cmp eax, 0x3d
jne 0x14017ddab
mov eax, 0x40
cmp r9, 1
jle 0x14017ddab
mov byte [rsp + r9 + 0x38], al
inc r9
cmp r9, 4
jl 0x14017dc63
movzx eax, byte [rsp + 0x38]
mov rcx, r14
movzx esi, byte [rsp + 0x39]
mov r8, qword [r14]
movzx edx, sil
shr dl, 4
shl al, 2
or dl, al
call qword [r8 + 0x28]
movzx edi, byte [rsp + 0x3a]
cmp dil, 0x40
jae 0x14017dd8a
mov rax, qword [r14]
movzx edx, dil
shr dl, 2
mov rcx, r14
shl sil, 4
or dl, sil
call qword [rax + 0x28]
movzx ecx, byte [rsp + 0x3b]
cmp cl, 0x40
jae 0x14017dd8a
mov rax, qword [r14]
shl dil, 6
or dil, cl
mov rcx, r14
movzx edx, dil
call qword [rax + 0x28]
cmp byte [rbx], 0
jne 0x14017dc60
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14017dd95
Function at 0x14017f7a0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x450
mov rax, qword [0x14041d440]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor eax, eax
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x30]
mov ecx, 0x204
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.140019cf0
nop
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14017abe0
nop
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
mov edx, dword [rcx]
nop
test edx, 0x30000000
jne 0x14017f821
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14017f821
call fcn.1400daaa8
mov rax, rbx
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400da5a0
add rsp, 0x450
pop rbx
ret