joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401c0970
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
push r13
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x38], r12
mov r9d, dword [rax + 8]
mov edi, r9d
shr edi, 0x18
mov dword [rbp + 0x38], r9d
cmp edi, 0xff
jae 0x1401c09eb
test edi, edi
jne 0x1401c09b7
mov word [rbp + 0x38], di
mov byte [rbp + 0x3a], dil
jmp 0x1401c09e7
movzx eax, r9b
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x38], al
movzx eax, byte [rbp + 0x39]
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x39], al
movzx eax, byte [rbp + 0x3a]
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x3a], al
mov r9d, dword [rbp + 0x38]
mov r12d, 1
xor r13d, r13d
mov dword [rbp - 0x50], r12d
cmp dword [rcx + 0x24], r12d
jle 0x1401c0b8e
movsd xmm2, qword [0x1403a8d30]
lea eax, [r8 - 1]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x30], r14
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
movd xmm1, eax
mov qword [rbp - 0x40], r14
mov qword [rsp + 0x28], r15
mov qword [rbp - 0x48], r13
cvtdq2pd xmm1, xmm1
nop dword [rax + rax]
mov rax, qword [rcx + 0x18]
movaps xmm0, xmm1
mov ecx, dword [r14 + rax + 8]
mov edx, ecx
mulsd xmm0, qword [r14 + rax]
shr edx, 0x18
addsd xmm0, xmm2
movsd qword [rbp + 0x38], xmm0
mov r10d, dword [rbp + 0x38]
sub r10d, r13d
mov dword [rbp + 0x38], ecx
cmp edx, 0xff
jae 0x1401c0ab1
test edx, edx
jne 0x1401c0a7f
mov word [rbp + 0x38], dx
mov byte [rbp + 0x3a], dl
jmp 0x1401c0aae
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x38], al
movzx eax, byte [rbp + 0x39]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x39], al
movzx eax, byte [rbp + 0x3a]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rbp + 0x3a], al
mov ecx, dword [rbp + 0x38]
xor ebx, ebx
test r10d, r10d
jle 0x1401c0b52
mov r12, qword [rbp - 0x48]
mov r15d, r9d
mov r14, qword [rbp + 0x28]
and r15d, 0xff00ff
shr r9d, 8
mov r11d, ecx
shr r11d, 8
and r9d, 0xff00ff
and r11d, 0xff00ff
mov esi, ecx
and esi, 0xff00ff
sub r11d, r9d
shl r9d, 8
sub esi, r15d
add r13d, r10d
nop dword [rax]
mov eax, ebx
mov r8d, esi
shl eax, 8
inc ebx
cdq
idiv r10d
mov edx, r11d
imul r8d, eax
mov edi, eax
imul edx, eax
mov eax, r11d
imul eax, edi
shr r8d, 8
add r8d, r15d
add edx, r9d
xor r8d, edx
add eax, r9d
and r8d, 0xff00ff
xor r8d, eax
mov dword [r14 + r12*4], r8d
inc r12
cmp ebx, r10d
jl 0x1401c0b00
mov r14, qword [rbp - 0x40]
mov qword [rbp - 0x48], r12
mov r12d, dword [rbp - 0x50]
inc r12d
add r14, 0x10
mov r9d, ecx
mov dword [rbp - 0x50], r12d
mov rcx, qword [rbp + 0x20]
mov qword [rbp - 0x40], r14
cmp r12d, dword [rcx + 0x24]
jl 0x1401c0a40
mov rdx, qword [rbp + 0x28]
mov r8d, dword [rbp + 0x30]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov r12, qword [rsp + 0x38]
cmp r13d, r8d
jge 0x1401c0baa
movsxd rax, r13d
sub r8d, r13d
movsxd rcx, r8d
lea rdi, [rdx + rax*4]
mov eax, r9d
rep stosd dword [rdi], eax
add rsp, 0x50
pop r13
pop rdi
pop rbp
ret
Function at 0x1401c3c30
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rbx, rcx
mov dword [rsp + 0x20], 0
lea rax, [0x1402be078]
mov qword [rcx], rax
mov dword [rsp + 0x20], 1
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401c3cfb
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
je 0x1401c3cf5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
test rax, rax
je 0x1401c3cf5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalSize]
shr rax, 1
mov qword [rsp + 0x60], rsi
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.14001beb0
nop
mov rax, qword [rbx]
mov rcx, qword [rsp + 0x58]
mov qword [rbx], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rax - 0x10]
lea rax, [0x1402be068]
cmp rcx, rax
je 0x1401c3cec
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401c3cec
call fcn.14010a370
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401c3d10
Capabilities:
Write clipboard data

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x1401c3d9c
mov rax, qword [rsi]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
call fcn.14001c650
mov rbx, rax
add rbx, 4
je 0x1401c3d97
lea rdx, [rbx + 2]
mov qword [rsp + 0x40], rdi
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1401c3d92
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1401c3d92
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.14014b880
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, SafeArrayGetDim
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
jmp qword [sym.imp.USER32.dll_CloseClipboard]

Function at 0x1401c4240
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1404716f0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r8d, ecx
bt ecx, 0x10
jb 0x1401c42b8
movdqa xmm0, xmmword [str.__._:__]
lea edx, [r8 - 0x20]
movdqa xmm1, xmmword [0x1403a9100]
xor eax, eax
add ecx, 0xffffff9f
mov dword [rsp + 0x40], 0xdb005b
cmp cx, 0x19
mov dword [rsp + 0x44], 0xdd005d
movdqu xmmword [rsp + 0x20], xmm0
cmova dx, r8w
movzx r8d, dx
movdqu xmmword [rsp + 0x30], xmm1
nop
cmp r8w, word [rsp + rax*2 + 0x20]
jne 0x1401c42ae
movzx r8d, word [rsp + rax*2 + 0x22]
add rax, 2
cmp rax, 0x14
jl 0x1401c42a0
movsx ecx, r8w
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14010a310
add rsp, 0x58
ret
Function at 0x1401c5390
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
cmp byte [0x14047d7ad], 0
jne 0x1401c55c1
lea rcx, str.SHCore.dll
mov qword [rsp + 0x20], rbx
mov byte [0x14047d7ad], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x1401c5587
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d838], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetDpiForWindow
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetProcessDpiAwareness
mov rcx, rbx
mov qword [0x14047d7c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d7f0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetWindowDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d820], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetThreadDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d830], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.GetAwarenessFromDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d7e0], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetThreadDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x14047d0c8], 0
mov qword [0x14047d800], rax
je 0x1401c55bc
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetProcessDpiAwarenessContext
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14047d7d0], rax
test rax, rax
je 0x1401c54f0
mov rcx, 0xfffffffffffffffc
call rax
test eax, eax
jns 0x1401c55bc
lea rdx, [0x1402c7420]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.user32.dll
mov qword [0x14047d7f8], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.EnableNonClientDpiScaling
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [0x14047d7c8], rax
mov rax, qword [0x14047d7f8]
test rax, rax
je 0x1401c5556
test rcx, rcx
je 0x1401c5551
mov ecx, 2
call rax
test eax, eax
jns 0x1401c55bc
mov rax, qword [0x14047d7f8]
test rax, rax
jne 0x1401c5572
lea rdx, str.SetProcessDpiAwareness
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14047d7f8], rax
test rax, rax
je 0x1401c5587
cmp qword [0x14047d838], 0
je 0x1401c5587
mov ecx, 1
call rax
test eax, eax
jns 0x1401c55bc
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.SetProcessDPIAware
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14047d7b8], rax
test rax, rax
je 0x1401c55bc
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp rax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x1401ce080
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rsi
mov rsi, rcx
mov ecx, 0x190
call fcn.14010a334
mov rdi, rax
mov qword [rsp + 0x60], rax
movzx ebx, byte [rsi + 0x28]
mov byte [rsp + 0x20], 1
mov r9d, 4
mov r8d, dword [rsi + 8]
mov rdx, rsi
mov rcx, rax
call fcn.1401cdf70
nop
lea rax, vtable.juce::DialogWindow.0
mov qword [rdi], rax
mov byte [rdi + 0x188], bl
lea rax, vtable.juce::DefaultDialogWindow.0
mov qword [rdi], rax
movzx edx, byte [rsi + 0x29]
mov rcx, rdi
call fcn.1401c9a60
mov byte [rsp + 0x58], 0
lea rdx, [rsp + 0x58]
lea rcx, [0x1401c4150]
call qword [sym.imp.USER32.dll_EnumWindows]
movzx edx, byte [rsp + 0x58]
mov rcx, rdi
call fcn.140245950
mov rdx, qword [rsi + 0x10]
mov r9b, 1
mov rcx, rdi
cmp byte [rsi + 0x18], 0
mov qword [rsi + 0x10], 0
je 0x1401ce135
movzx r8d, r9b
jmp 0x1401ce138
xor r8d, r8d
call fcn.1401cc8b0
mov r9d, dword [rdi + 0x2c]
mov r8d, dword [rdi + 0x28]
mov rdx, qword [rsi + 0x20]
mov rcx, rdi
call fcn.1401c9730
movzx r8d, byte [rsi + 0x2b]
movzx edx, byte [rsi + 0x2a]
mov rcx, rdi
call fcn.1401cc0b0
nop
mov r9b, 1
xor r8d, r8d
movzx edx, r9b
mov rcx, rdi
call fcn.140243800
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1401dd160
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
add edx, 0xffffeffe
cmp edx, 7
ja case.0x1401dd195.4103
movsxd rax, edx
lea rcx, [0x140000000]
mov edx, dword [rcx + rax*4 + 0x1dd284]
add rdx, rcx
jmp rdx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401dc2a0
mov rcx, rbx
call fcn.1401e0700
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401de480
mov rcx, rbx
call fcn.1401e0700
cmp byte [rbx + 0x1ec], 0
jne case.0x1401dd195.4103
test byte [rbx + 0xa9], 0x10
jne case.0x1401dd195.4103
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1401dd1f1
call fcn.14023e880
test al, al
je case.0x1401dd195.4103
lea rcx, [rsp + 0x50]
call fcn.1401c3c30
nop
mov rax, qword [rsp + 0x50]
cmp byte [rax], 0
je 0x1401dd219
lea rcx, [rbx + 0xb0]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x30]
nop
mov rcx, qword [rsp + 0x50]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je case.0x1401dd195.4103
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne case.0x1401dd195.4103
call fcn.14010a370
add rsp, 0x30
pop rbx
ret
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401de340
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401dc180
mov dl, 1
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401e0640
xor edx, edx
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.1401e0640
add rsp, 0x30
pop rbx
ret

Function at 0x1401de480
Capabilities:
Open clipboard

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov r8, rcx
mov dword [rsp + 0x20], 0
cmp dword [rcx + 0x2bc], 0
jne 0x1401de513
add rcx, 0xb0
mov rax, qword [rcx]
add r8, 0x278
lea rdx, [rsp + 0x40]
call qword [rax + 0x28]
mov ebx, 1
mov dword [rsp + 0x20], ebx
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
je 0x1401de4e5
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1401de4e5
lea rcx, [rsp + 0x40]
call fcn.1401c3d10
and ebx, 0xfffffffe
mov dword [rsp + 0x20], ebx
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x1401de513
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x1401de513
call fcn.14010a370
add rsp, 0x30
pop rbx
ret
Function at 0x140225350
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rax - 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12d, r9d
mov r15, rdx
mov rbp, rcx
mov esi, dword [rdx + 0xc]
sub esi, 1
js 0x14022551d
movsxd r14, esi
shl r14, 3
mov eax, 4
lea rbx, [0x1402be078]
lea r13, [0x1402be068]
cmp esi, dword [r15 + 0xc]
jae 0x1402253b1
mov rdx, qword [r15]
add rdx, r14
jmp 0x1402253d5
mov edx, eax
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14047e918], eax
jg 0x14022553b
lea rdx, [0x14047e910]
lea rcx, [rsp + 0x20]
call fcn.14015ee70
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1402254eb
cmp eax, 0xffffffff
je 0x1402254eb
cmp dword [rbp + 0x50], 0
jbe 0x140225437
mov rax, qword [rbp + 0xf0]
mov ecx, dword [rax + 0x18c]
sub ecx, dword [rax + 0x24]
sub ecx, dword [rbp + 0x4c]
lea eax, [r12 + rcx]
cdq
idiv dword [rbp + 0x11c]
mov edx, eax
cmp eax, dword [rbp + 0x118]
jb 0x14022543c
mov edx, 0xffffffff
lea rcx, [rbp + 0x10]
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x98], rax
lea r8, [rax - 0x10]
cmp r8, r13
je 0x140225460
mov eax, 1
lock xadd dword [r8], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x98]
call fcn.140019c50
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, r13
je 0x14022549e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14022549e
call fcn.14010a370
lea rcx, [rbp + 0x28]
call fcn.1401e69a0
mov edx, dword [rbp + 0x54]
mov eax, dword [rbp + 0x50]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x4c], edx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
mov r8b, 1
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140242a40
lea rcx, [rbp - 0xc0]
call fcn.140225d30
lea rbx, [0x1402be078]
mov rcx, qword [rsp + 0x20]
add rcx, 0xfffffffffffffff0
cmp rcx, r13
je 0x14022550b
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14022550b
call fcn.14010a370
sub r14, 8
sub esi, 1
mov eax, 4
jns 0x1402253a3
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x14047e918]
call fcn.14010a5c4
cmp dword [0x14047e918], 0xffffffff
jne 0x1402253ce
mov qword [0x14047e910], rbx
lea rcx, [0x1402ab9a0]
call fcn.14010aa70
nop
lea rcx, [0x14047e918]
call fcn.14010a564
jmp 0x1402253ce
Function at 0x1402268b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rbx, rdx
mov rsi, rcx
mov byte [rcx + 0x1b6], 0
mov r8d, dword [rcx - 0x94]
mov eax, dword [rcx - 0x98]
xor ecx, ecx
mov qword [r11 - 0x28], rcx
mov dword [rsp + 0x58], eax
mov dword [r11 - 0x1c], r8d
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
mov r8b, 1
lea rdx, [r11 - 0x18]
lea rcx, [rsi - 0xc0]
call fcn.140242a40
xor edx, edx
mov rcx, rbx
call fcn.14014a970
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14015ee70
nop
lea rbx, [0x1402be068]
mov rax, qword [rsp + 0x80]
cmp byte [rax], 0
je 0x1402269ce
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1402269ce
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x38]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x140226989
cmp eax, 0xffffffff
je 0x140226989
mov al, 1
jmp 0x14022698b
xor al, al
cmp al, byte [rsi + 0x1b4]
jne 0x1402269ce
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea rcx, [rax - 0x10]
cmp rcx, rbx
je 0x1402269bc
mov eax, 1
lock xadd dword [rcx], eax
lea rdx, [rsp + 0x20]
lea rcx, [rsi - 0xc0]
call fcn.1402264c0
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x1402269f1
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x1402269f1
call fcn.14010a370
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140228770
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, rcx
mov rcx, qword [rbx + 0xb0]
call fcn.14022b940
movzx edx, al
lea rcx, [rbx + 0xb8]
call fcn.14023e760
mov rcx, qword [rdi + 8]
mov rdx, qword [rcx + 0xb0]
lea rbx, [rcx + 0x448]
mov rax, qword [rbx]
mov rdi, qword [rax + 0x58]
mov eax, dword [rdx + 0xf0]
shr eax, 1
test al, 1
je 0x1402287f9
add rdx, 0xf8
lea rcx, [rsp + 0x30]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1402287f9
cmp eax, 0xffffffff
je 0x1402287f9
mov dl, 1
mov rcx, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
xor edx, edx
mov rcx, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x14022a5b0
Capabilities:
Get file attributes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x68]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14022a657
cmp eax, 0xffffffff
je 0x14022a657
lea rcx, [rdi - 0xb0]
mov rdx, rsi
call fcn.14022b290
mov eax, dword [rdi + 0x40]
and eax, 0x108
cmp eax, 8
jne 0x14022a6e3
lea rcx, [rdi + 0x208]
lea rbx, [0x1402be068]
lea rax, [rbx + 0x10]
mov qword [rsp + 0x58], rax
mov r8b, 1
lea rdx, [rsp + 0x58]
call fcn.1401df800
nop
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rbx
je 0x14022a6e3
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14022a6e3
add rsp, 0x30
pop rdi
pop rsi
pop rbx
jmp fcn.14010a370
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rdi - 0xb0]
lea rcx, [rsp + 0x60]
call fcn.14008ee90
nop
mov ebx, dword [rdi + 0x6c]
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x14022a6b6
cmp qword [rax + 0x10], 0
je 0x14022a6b6
test ebx, ebx
jle 0x14022a6b6
mov eax, dword [rdi + 0x6c]
dec ebx
cmp ebx, eax
jl 0x14022a6a0
lea ebx, [rax - 1]
mov eax, ebx
shr eax, 0x1f
xor al, 1
je 0x14022a6b6
movsxd rcx, ebx
mov rax, qword [rdi + 0x60]
mov rcx, qword [rax + rcx*8]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14022a676
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14022a6e3
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14022a6e3
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x14022b940
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.14022ba00
nop
mov ecx, dword [rbx + 0xf0]
mov eax, ecx
shr eax, 1
test al, 1
je 0x14022b998
test cl, 8
jne 0x14022b994
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x14022b994
cmp eax, 0xffffffff
jne 0x14022b9c3
mov bl, 1
jmp 0x14022b9c5
mov rax, qword [rsp + 0x40]
cmp byte [rax], 0
je 0x14022b9c3
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.140018b20
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14022b9c3
mov bl, 1
jmp 0x14022b9c5
xor bl, bl
mov rcx, qword [rsp + 0x40]
add rcx, 0xfffffffffffffff0
lea rax, [0x1402be068]
cmp rcx, rax
je 0x14022b9ec
mov edx, 0xffffffff
lock xadd dword [rcx], edx
test edx, edx
jne 0x14022b9ec
call fcn.14010a370
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14022d4f0
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x60
mov rax, qword [rcx + 0x40]
mov rbx, rcx
mov rcx, qword [rdx]
mov qword [r11 - 0x10], rbp
movzx ebp, r9b
mov qword [r11 - 0x30], r14
mov r14, rdx
mov qword [r11 - 0x38], r15
movzx r15d, r8b
cmp rcx, rax
je 0x14022d636
mov qword [r11 + 0x10], rcx
lea rdx, [r11 + 8]
lea rcx, [r11 + 0x10]
mov qword [r11 + 8], rax
call fcn.14001abc0
test eax, eax
je 0x14022d636
mov qword [rsp + 0x50], rsi
mov rcx, rbx
mov qword [rsp + 0x40], r12
call fcn.14022d460
xor esi, esi
lea r12d, [rsi + 1]
cmp dword [rbx + 0x94], esi
jle 0x14022d5c0
lea rcx, [rbx + 0x88]
mov qword [rsp + 0x48], rdi
call fcn.14008e4f0
cmp dword [rbx + 0x90], esi
je 0x14022d58c
mov rcx, qword [rbx + 0x88]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x88], rsi
mov rdi, qword [rsp + 0x48]
mov dword [rbx + 0x90], esi
cmp dword [rbx + 0x2c], esi
jle 0x14022d5c0
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r12d
jne 0x14022d5c0
mov rcx, qword [rbx + 0x10]
call fcn.140169820
test al, al
jne 0x14022d5c0
mov rcx, qword [rbx + 0x10]
mov eax, esi
xchg dword [rcx + 0x18], eax
mov rcx, qword [r14]
lea r8, [0x1402be068]
lea rdx, [rcx - 0x10]
cmp rdx, r8
je 0x14022d5dd
mov eax, r12d
lock xadd dword [rdx], eax
mov rcx, qword [r14]
mov qword [rsp + 0x20], rcx
xchg qword [rbx + 0x40], rcx
add rcx, 0xfffffffffffffff0
cmp rcx, r8
je 0x14022d601
mov eax, 0xffffffff
lock xadd dword [rcx], eax
test eax, eax
jne 0x14022d601
call fcn.14010a370
cmp dword [rbx + 0x2c], esi
jle 0x14022d628
mov rcx, qword [rbx + 0x10]
xor eax, eax
lock cmpxchg dword [rcx + 0x18], r12d
jne 0x14022d628
mov rcx, qword [rbx + 0x10]
call fcn.140169820
test al, al
jne 0x14022d628
mov rax, qword [rbx + 0x10]
xchg dword [rax + 0x18], esi
and dword [rbx + 0x58], 0xfffffffc
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov edx, dword [rbx + 0x58]
mov eax, edx
mov r14, qword [rsp + 0x38]
and eax, 0xfffffffe
mov ecx, edx
or ecx, 1
test r15b, r15b
mov r15, qword [rsp + 0x30]
cmove ecx, eax
mov eax, ecx
or ecx, 2
and eax, 0xfffffffd
test bpl, bpl
mov rbp, qword [rsp + 0x58]
cmove ecx, eax
cmp edx, ecx
je 0x14022d67a
mov dword [rbx + 0x58], ecx
mov rcx, rbx
add rsp, 0x60
pop rbx
jmp fcn.14022d260
add rsp, 0x60
pop rbx
ret