joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d8d0
Capabilities:
Enumerate process modules

Disassembly:
push rdi
mov eax, 0x1270
call fcn.1400fa5c0
sub rsp, rax
mov rax, qword [0x141693be0]
xor rax, rsp
mov qword [rsp + 0x1250], rax
mov rdi, rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14000da87
mov qword [rsp + 0x1280], rbx
mov qword [rsp + 0x1288], rbp
mov ebp, dword [rsp + 0x20]
mov qword [rsp + 0x1290], rsi
shr ebp, 2
xor esi, esi
mov qword [rsp + 0x1268], r14
mov qword [rsp + 0x1260], r15
test ebp, ebp
je 0x14000da5d
lea r14, [rsp + 0x40]
or r15, 0xffffffffffffffff
mov r8d, dword [r14]
test r8d, r8d
je 0x14000da4f
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000da4f
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rax
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x14000da46
mov rdx, qword [rsp + 0x28]
lea r8, [rsp + 0x1040]
mov r9d, 0x104
mov rcx, rbx
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x14000da46
cmp word [rsp + 0x1040], 0
jne 0x14000d9c9
xor eax, eax
jmp 0x14000d9de
lea rcx, [rsp + 0x1040]
mov rax, r15
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000d9d4
cmp qword [rdi + 0x18], 8
mov r10, qword [rdi + 0x10]
jb 0x14000d9ee
mov rdx, qword [rdi]
jmp 0x14000d9f1
mov rdx, rdi
cmp r10, rax
mov r9, rax
cmovb r9, r10
test r9, r9
je 0x14000da2a
lea r8, [rsp + 0x1040]
nop dword [rax + rax]
movzx ecx, word [r8]
cmp word [rdx], cx
jne 0x14000daa0
add rdx, 2
add r8, 2
dec r9
jne 0x14000da10
xor r9d, r9d
movsxd rcx, r9d
test r9d, r9d
jne 0x14000da42
cmp r10, rax
jb 0x14000da46
xor ecx, ecx
cmp r10, rax
setne cl
test ecx, ecx
je 0x14000dab2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
add r14, 4
cmp esi, ebp
jb 0x14000d952
xor al, al
mov r14, qword [rsp + 0x1268]
mov rsi, qword [rsp + 0x1290]
mov rbp, qword [rsp + 0x1288]
mov rbx, qword [rsp + 0x1280]
mov r15, qword [rsp + 0x1260]
mov rcx, qword [rsp + 0x1250]
xor rcx, rsp
call fcn.1400fa620
add rsp, 0x1270
pop rdi
ret
cmp word [rdx], cx
mov r9d, 1
cmovb r9d, r15d
jmp 0x14000da2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000da5f
Function at 0x14000ed30
Capabilities:
Check os version

Disassembly:
mov r11, rsp
sub rsp, 0x168
mov eax, dword [0x141696954]
test eax, eax
jne 0x14000eec9
mov qword [r11 + 8], rbx
mov qword [r11 - 8], rdi
xor edi, edi
lea rcx, [rsp + 0x56]
mov ebx, 0x10
xor edx, edx
mov r8d, 0xfe
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x50], edi
mov word [rsp + 0x54], di
mov dword [0x141696954], ebx
mov qword [rsp + 0x40], 0x114
call fcn.1400fa650
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x44], 6
jne 0x14000edb9
mov eax, dword [rsp + 0x48]
cmp eax, 2
jne 0x14000edbd
lea rcx, [rsp + 0x40]
call fcn.14000e0f0
test al, al
jne 0x14000edb9
lea rcx, [rsp + 0x40]
call fcn.14000df80
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x14000eeac
dec ecx
je 0x14000ee95
mov rcx, qword [rsp + 0x40]
shr rcx, 0x20
cmp ecx, 5
jb 0x14000eeb1
jne 0x14000ee15
test eax, eax
jne 0x14000edf1
lea ebx, [rax + 0x20]
jmp 0x14000eeb1
cmp ecx, 5
jne 0x14000ee15
cmp eax, 1
jne 0x14000ee03
lea ebx, [rcx + 0x2b]
jmp 0x14000eeb1
cmp ecx, 5
jne 0x14000ee15
cmp eax, 2
jne 0x14000ee15
lea ebx, [rcx + 0x3b]
jmp 0x14000eeb1
cmp ecx, 6
jne 0x14000ee59
test eax, eax
jne 0x14000ee26
lea ebx, [rcx + 0x7a]
jmp 0x14000eeb1
cmp ecx, 6
jne 0x14000ee59
cmp eax, 1
jne 0x14000ee37
mov ebx, 0x90
jmp 0x14000eeb1
cmp ecx, 6
jne 0x14000ee59
cmp eax, 2
jne 0x14000ee48
mov ebx, 0xa0
jmp 0x14000eeb1
cmp ecx, 6
jne 0x14000ee59
cmp eax, 3
jne 0x14000ee59
mov ebx, 0xb0
jmp 0x14000eeb1
lea rdx, [0x141668178]
xorps xmm0, xmm0
mov r8d, ecx
mov qword [rsp + 0x38], rdx
lea rcx, [rsp + 0x20]
lea rdx, [0x1415242a8]
movdqu xmmword [rsp + 0x28], xmm0
mov r9d, eax
mov qword [rsp + 0x20], 2
call fcn.140011b90
mov ebx, 0xf0
jmp 0x14000eeb1
cmp eax, 0x5a
jne 0x14000ee9f
lea ebx, [rax - 0x56]
jmp 0x14000eeb1
cmp eax, 0xa
mov ebx, edi
sete bl
add ebx, 2
jmp 0x14000eeb1
mov ebx, 1
mov rdi, qword [rsp + 0x160]
mov dword [0x141696954], ebx
mov eax, ebx
mov rbx, qword [rsp + 0x170]
add rsp, 0x168
ret
Function at 0x14000ef70
Capabilities:
Print debug messages

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov r9, r8
mov r8, rdx
mov edx, ecx
lea rcx, [rsp + 0x20]
call fcn.140010120
nop
lea rax, [0x141524b70]
mov rcx, qword [rsp + 0x20]
cmp rcx, rax
je 0x14000f06a
mov eax, dword [0x14169698c]
test al, 1
jne 0x14000efcc
or eax, 1
mov dword [0x14169698c], eax
call fcn.140011c90
mov byte [0x141696989], al
jmp 0x14000efd3
movzx eax, byte [0x141696989]
lea rcx, [rsp + 0x20]
test al, al
jne 0x14000f003
mov eax, 0xa
mov word [rsp + 0x68], ax
movzx edx, ax
call fcn.1400131a0
lea rcx, [rsp + 0x20]
call fcn.14001b320
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x14000f065
lea rdx, [rsp + 0x28]
call fcn.140042830
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x10]
add rbx, rcx
call fcn.1400fa21c
lea rcx, [rax + 0x60]
mov r8, rbx
lea rdx, [0x141524b64]
call fcn.1400fb190
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x14000f049
cmp eax, 0xffffffff
je 0x14000f057
lock dec dword [rcx]
jne 0x14000f057
mov rcx, qword [rsp + 0x28]
mov edx, 1
lea r8d, [rdx + 7]
call fcn.140011e00
call fcn.1400fa21c
lea rcx, [rax + 0x60]
call fcn.1400f97cc
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14000f07f
cmp eax, 0xffffffff
je 0x14000f08d
lock dec dword [rcx]
jne 0x14000f08d
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140042630
Capabilities:
Get common file path

Disassembly:
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x268], rbx
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x30], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
cmp eax, 0x104
jbe 0x1400426b9
mov dword [rsp + 0x260], eax
lea rcx, [rsp + 0x30]
lea rax, [rsp + 0x260]
cmp edi, dword [rsp + 0x30]
cmovge rcx, rax
mov r8d, dword [rcx]
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140042700
mov edx, edi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, eax
mov r8d, edi
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14000e3e0
nop
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp rcx, rax
je 0x1400426de
call fcn.1400f95d4
mov rax, rbx
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x140062830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x140062862
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14006b130
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rax, qword [rcx + 0x70]
test rax, rax
jne 0x14006b257
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14006b252
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14006b2b8
mov rdi, r8
mov qword [r11 + 0x20], r8
xor r12d, r12d
mov ebx, r12d
lea r13, [0x141595980]
nop dword [rax]
nop dword [rax + rax]
lea rax, [rsp + 0xa8]
cmp rdi, 0x2000000
cmovge rax, r13
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x90]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006b1f5
mov eax, dword [rsp + 0x90]
test eax, eax
je 0x14006b24d
add rbx, rax
sub rdi, rax
mov qword [rsp + 0xa8], rdi
cmp rbx, rbp
jge 0x14006b24d
jmp 0x14006b1a0
test rbx, rbx
jne 0x14006b24d
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14000e720
nop
mov r8, rax
lea edx, [rbx + 1]
mov rcx, r15
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b239
cmp eax, 0xffffffff
je 0x14006b2b8
lock dec dword [rcx]
jne 0x14006b2b8
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
or rax, 0xffffffffffffffff
jmp 0x14006b2cc
mov rax, rbx
jmp 0x14006b2cc
test rax, rax
je 0x14006b2be
call fcn.14006aeb0
test al, al
je 0x14006b2be
mov rcx, qword [rsi + 0x70]
call fcn.1400fd4a8
test eax, eax
je 0x14006b2be
call fcn.1400fd438
mov edx, dword [rax]
lea rcx, [rsp + 0x38]
call fcn.14000e720
nop
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14006b2aa
cmp eax, 0xffffffff
je 0x14006b2b8
lock dec dword [rcx]
jne 0x14006b2b8
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
or rax, 0xffffffffffffffff
jmp 0x14006b2cc
mov r8, rbp
mov rdx, r14
mov rcx, rsi
call fcn.140062880
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062880
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov rbp, r8
mov r12, rdx
mov rsi, rcx
mov r13, qword [rcx + 0x18]
test r8, r8
js 0x1400629e9
xor ebx, ebx
cmp qword [rcx + 0x70], rbx
je 0x140062958
mov r15b, 1
nop dword [rax]
nop word [rax + rax]
mov r8, rbp
sub r8, rbx
lea rcx, [rbx + r12]
mov r9, qword [rsi + 0x70]
mov edx, 1
call fcn.1400fd850
mov rdi, rax
mov rcx, qword [rsi + 0x70]
call fcn.1400fd4a8
test eax, eax
setne r14b
test r15b, r15b
je 0x140062926
test r14b, r14b
je 0x140062926
test rdi, rdi
jne 0x140062926
mov rcx, qword [rsi + 0x70]
call fcn.1400fb508
mov rdx, rax
xor r8d, r8d
mov rcx, qword [rsi + 0x70]
call fcn.1400f9b8c
xor r15b, r15b
jmp 0x140062929
add rbx, rdi
test r14b, r14b
jne 0x140062a3f
test rdi, rdi
jne 0x140062946
call fcn.1400fd438
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x14006294e
xor ecx, ecx
cmp rbx, rbp
setl cl
test ecx, ecx
jne 0x1400628d0
jmp 0x1400629a0
cmp dword [rcx + 0x98], 0xffffffff
je 0x1400629a9
mov rax, rbp
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r12]
mov ecx, dword [rsi + 0x98]
call fcn.1400fda98
movsxd rcx, eax
test eax, eax
jle 0x140062992
add rbx, rcx
cmp rbx, rbp
jl 0x140062961
cmp ecx, 0xffffffff
setne al
test al, al
jne 0x140062a3f
test rbx, rbx
jne 0x140062a3f
or rbx, 0xffffffffffffffff
call fcn.1400fd438
mov edx, dword [rax]
lea rcx, [rsp + 0x70]
call fcn.14000e720
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
test eax, eax
je 0x140062a30
cmp eax, ebx
je 0x140062a3f
lock dec dword [rcx]
jne 0x140062a3f
mov rcx, qword [rsp + 0x70]
jmp 0x140062a30
mov edx, 0x16
lea rcx, [rsp + 0x80]
call fcn.14000e720
nop
mov r8, rax
mov edx, 1
mov rcx, r13
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x140062a30
cmp eax, ebx
je 0x140062a3f
lock dec dword [rcx]
jne 0x140062a3f
mov rcx, qword [rsp + 0x80]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.140011e00
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062ff0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x140063022
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14006b4c0
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
cmp qword [rcx + 0x70], 0
jne 0x14006b5c9
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14006b5c9
cmp qword [rcx + 0x78], 0xffffffffffffffff
je 0x14006b5be
mov edi, r8d
xor r12d, r12d
mov ebx, r12d
lea r13, [0x141595988]
mov dword [rsp + 0x80], edi
lea rax, [rsp + 0x80]
cmp edi, 0x2000000
cmovae rax, r13
lea rdx, [rbx + r14]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x98]
mov r8d, dword [rax]
mov rcx, qword [rsi + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14006b574
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x14006b5c4
add rbx, rax
sub rdi, rax
cmp rbx, rbp
jge 0x14006b5c4
jmp 0x14006b521
test rbx, rbx
jne 0x14006b5c4
or edx, 0xffffffff
lea rcx, [rsp + 0x30]
call fcn.14000e720
nop
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r15
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b5b0
cmp eax, 0xffffffff
je 0x14006b5be
lock dec dword [rcx]
jne 0x14006b5be
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
or rax, 0xffffffffffffffff
jmp 0x14006b5ce
mov rax, rbx
jmp 0x14006b5ce
call fcn.140063040
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063040
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbp
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
mov r14, qword [rcx + 0x18]
test r8, r8
js 0x140063167
xor ebx, ebx
cmp qword [rcx + 0x70], rbx
je 0x1400630bd
nop word [rax + rax]
mov r8, rdi
sub r8, rbx
lea rcx, [rbx + rbp]
mov r9, qword [rsi + 0x70]
mov edx, 1
call fcn.1400f9e44
add rbx, rax
test rax, rax
jne 0x1400630af
call fcn.1400fd438
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x1400630b7
xor ecx, ecx
cmp rbx, rdi
setl cl
test ecx, ecx
jne 0x140063080
jmp 0x140063100
cmp dword [rcx + 0x98], 0xffffffff
je 0x140063100
nop word [rax + rax]
mov rax, rdi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + rbp]
mov ecx, dword [rsi + 0x98]
call fcn.1400fe424
test eax, eax
jle 0x140063100
cdqe
add rbx, rax
cmp rbx, rdi
jl 0x1400630d0
test rdi, rdi
je 0x14006315e
test rbx, rbx
jne 0x14006315e
or rbx, 0xffffffffffffffff
call fcn.1400fd438
mov edx, dword [rax]
lea rcx, [rsp + 0x50]
call fcn.14000e720
mov rdi, rax
call fcn.1400fd438
mov edx, 2
mov ecx, 4
cmp dword [rax], 0x1c
cmove edx, ecx
mov r8, rdi
mov rcx, r14
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx]
test eax, eax
je 0x1400631a5
cmp eax, ebx
je 0x1400631b4
lock dec dword [rcx]
jne 0x1400631b4
mov rcx, qword [rsp + 0x50]
jmp 0x1400631a5
and dword [rsi + 0x40], 0xffdfffff
jmp 0x1400631b4
mov edx, 0x16
lea rcx, [rsp + 0x60]
call fcn.14000e720
nop
mov r8, rax
mov edx, 2
mov rcx, r14
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx]
or rbx, 0xffffffffffffffff
test eax, eax
je 0x1400631a5
cmp eax, ebx
je 0x1400631b4
lock dec dword [rcx]
jne 0x1400631b4
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.140011e00
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140063e00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140062190
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.QFSFileEngine.virtual_96
push rbx
push rsi
push rdi
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.140060e50
nop
lea rdx, [rsp + 0x80]
mov rcx, rax
call fcn.1400618a0
mov rbx, rax
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x70]
call fcn.1400618a0
mov rdi, rax
mov rcx, rbx
call fcn.14001b320
mov rbx, rax
mov rcx, rdi
call fcn.14001b320
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x70]
mov eax, dword [rcx]
or ebx, 0xffffffff
test eax, eax
je 0x14006b96e
cmp eax, ebx
je 0x14006b97d
lock dec dword [rcx]
jne 0x14006b97d
mov rcx, qword [rsp + 0x70]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
nop
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx]
test eax, eax
je 0x14006b99d
cmp eax, 0xffffffff
je 0x14006b9ac
lock dec dword [rcx]
jne 0x14006b9ac
mov rcx, qword [rsp + 0x80]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
nop
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x14006b9c6
cmp eax, 0xffffffff
je 0x14006b9d4
lock dec dword [rcx]
jne 0x14006b9d4
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14006b9f3
cmp eax, 0xffffffff
je 0x14006ba01
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
jne 0x14006ba01
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
test dil, dil
jne 0x14006ba6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], 2
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x88]
call fcn.1400a9290
nop
mov r8, rax
mov edx, 0xa
mov rcx, rsi
call fcn.140060d40
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14006ba5c
cmp eax, 0xffffffff
je 0x14006ba6a
lock dec dword [rcx]
jne 0x14006ba6a
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
movzx eax, dil
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400645a0
Capabilities:
Copy file

Disassembly:
push r14
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
mov r14, r8
mov rax, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.1400618a0
mov rsi, rax
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.1400618a0
mov rdi, rax
mov rcx, rsi
call fcn.14001b320
mov rbx, rax
mov rcx, rdi
call fcn.14001b320
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
setne dil
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx]
test eax, eax
je 0x14006462c
cmp eax, 0xffffffff
je 0x14006463b
lock dec dword [rcx]
jne 0x14006463b
mov rcx, qword [rsp + 0x58]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140064655
cmp eax, 0xffffffff
je 0x140064663
lock dec dword [rcx]
jne 0x140064663
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
test dil, dil
jne 0x140064682
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], 2
mov rcx, qword [rsp + 0x58]
mov qword [r14], rcx
movzx eax, dil
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x140064a50
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x270
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x141693be0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
mov dword [rsp + 0x40], 0
lea rax, [0x141524b70]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
or rbx, 0xffffffffffffffff
test eax, eax
je 0x140064b89
cmp edi, 0x104
jbe 0x140064b3c
mov eax, 2
mul rdi
cmovo rax, rbx
mov rcx, rax
call fcn.1400f853c
mov rbp, rax
mov rdx, rax
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140064b32
mov r8d, edi
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14000e3e0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140064b24
cmp eax, ebx
je 0x140064b32
lock dec dword [rcx]
jne 0x140064b32
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
mov rcx, rbp
call fcn.140094b20
jmp 0x140064b89
mov r8d, edi
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.14000e3e0
mov rdx, rax
mov rcx, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov qword [rdx], rcx
mov rcx, qword [rsp + 0x38]
mov eax, dword [rcx]
test eax, eax
je 0x140064b7b
cmp eax, 0xffffffff
je 0x140064b89
lock dec dword [rcx]
jne 0x140064b89
mov rcx, qword [rsp + 0x38]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax + 4]
cmp ecx, 2
jl 0x140064bf4
cmp ecx, 1
jle 0x140064bf4
mov rdx, qword [rax + 0x10]
cmp word [rdx + rax + 2], 0x3a
jne 0x140064bf4
movzx ecx, word [rdx + rax]
call fcn.14001a990
mov edi, eax
mov rax, qword [rsp + 0x20]
mov edx, dword [rax + 4]
test edx, edx
jg 0x140064bcc
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1400151c0
jmp 0x140064be7
cmp dword [rax], 1
ja 0x140064bd8
cmp qword [rax + 0x10], 0x18
je 0x140064bec
inc edx
xor r8d, r8d
lea rcx, [rsp + 0x20]
call fcn.1400178a0
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov word [rax + rcx], di
xor eax, eax
mov byte [rsp + 0x28], al
movzx r8d, al
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140060eb0
nop
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140064c26
cmp eax, 0xffffffff
je 0x140064c34
lock dec dword [rcx]
jne 0x140064c34
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
mov rax, rsi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400fa620
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140066450
Capabilities:
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x141693be0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
mov rax, qword [rcx]
mov qword [rsp + 0x20], rax
mov ecx, dword [rax]
inc ecx
cmp ecx, 1
jbe 0x14006649a
lock inc dword [rax]
mov rax, qword [rsp + 0x20]
mov r8d, dword [rax + 4]
cmp r8d, 2
jne 0x140066510
mov rcx, qword [rax + 0x10]
cmp word [rcx + rax + 2], 0x3a
jne 0x140066510
cmp dword [rax], 1
ja 0x1400664c4
mov edx, dword [rax + 8]
btr edx, 0x1f
lea ecx, [r8 + 2]
cmp ecx, edx
jbe 0x1400664da
lea edx, [r8 + 2]
mov r8b, 1
lea rcx, [rsp + 0x20]
call fcn.1400178a0
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
mov ecx, 0x5c
mov word [r8 + rax], cx
mov rax, qword [rsp + 0x20]
inc dword [rax + 4]
mov rax, qword [rsp + 0x20]
movsxd rdx, dword [rax + 4]
mov rcx, qword [rax + 0x10]
lea r8, [rcx + rdx*2]
xor ecx, ecx
mov word [r8 + rax], cx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.14006a6f0
nop
mov rcx, rax
call fcn.14001b320
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx]
test eax, eax
je 0x14006654d
cmp eax, 0xffffffff
je 0x14006655b
lock dec dword [rcx]
jne 0x14006655b
mov rcx, qword [rsp + 0x28]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
cmp ebx, 0xffffffff
jne 0x140066593
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140066570
cmp eax, 0x20
jne 0x140066593
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.14006a6f0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.140065c60
test al, al
cmovne ebx, dword [rsp + 0x40]
test rsi, rsi
je 0x1400665a0
cmp ebx, 0xffffffff
setne al
mov byte [rsi], al
cmp ebx, 0xffffffff
jne 0x1400665a9
xor bl, bl
jmp 0x1400665af
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1400665c9
cmp eax, 0xffffffff
je 0x1400665d7
lock dec dword [rcx]
jne 0x1400665d7
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.140011e00
movzx eax, bl
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.1400fa620
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret