joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140071f20
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140071f30
test al, 1
je 0x140072023
test al, 2
jne 0x140072023
test al, 8
jne 0x140071f6b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140062a30
jmp 0x140071f83
test al, 0x10
je 0x140071f83
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140072023
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x140072023
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x140071fec
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x140071ff2
test rax, rax
jne 0x140071ffb
mov rdx, qword [rsi + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x140071ffb
test rdx, rdx
je 0x140071ffb
mov rcx, qword [rsi + 0x38]
mov r8d, 1
call fcn.1400550c0
jmp 0x140071ffb
add rsp, 0x50
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.14005ffd0
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14007200b
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.1400550c0
ud2

Function at 0x140073af0
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov eax, dword [0x1400d6d58]
cmp eax, 3
jne 0x140073b8d
mov ecx, edi
mov edx, esi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x140073b68
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x140073b7e
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
jmp 0x140073b83
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov eax, 1
jmp 0x140073b83
xor eax, eax
mov rdi, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_1.0.2_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400d6d58]
lea r9, [0x1400ba9e0]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1400b3ea0
jmp 0x140073b14
Function at 0x140073bd0
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.140073af0
mov rdi, rdx
test rax, rax
je 0x140073c02
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x140073ca3
cmp word [rbx], 0
je 0x140073c27
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x140073c40
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x140073c7a
call sub.kernel32.dll_GetLastError
cmp eax, 0x2733
jne 0x140073c87
mov qword [rsi], rdi
mov qword [rsi + 8], 0
jmp 0x140073ca3
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x140077540
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x1400775d0
jmp 0x1400775bf
jae 0x14007768c
cmp r8, 0x201
jae 0x1400775d0
mov esi, 0x200
lea r13, [rsp + 0x78]
mov rbp, r8
jmp 0x1400775fb
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x14007765c
cmp rdi, rbx
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x48], r12
mov rsi, r12
mov r13, qword [rsp + 0x28]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call r14
mov r15d, eax
test eax, eax
jne 0x140077620
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14007773f
mov r8d, r15d
cmp rbp, r8
jne 0x1400775b0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14007776a
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x1400775bf
jmp 0x1400775d0
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x38]
mov rdx, r12
call fcn.1400b1030
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1400775de
cmp rsi, r8
jb 0x14007776a
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rbx, qword [rax + 8]
lea r14, [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.140082d30
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, r14
call fcn.140086d60
cmp byte [rbx], 0
jne 0x1400776dc
lea rdx, [0x1400bb218]
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.140087700
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14007da20
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x14007770d
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call fcn.1400550c0
test rdi, rdi
je 0x140077728
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1400550c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000001
mov qword [rsi], rax
test rdi, rdi
jne 0x140077712
jmp 0x140077728
ud2
Function at 0x140077a60
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 2
mov qword [rsp + 0x48], 0
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor edi, edi
mov r14, qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov ebx, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x140077af0
jmp 0x140077adf
jae 0x140077bac
cmp r8, 0x201
jae 0x140077af0
mov esi, 0x200
lea r13, [rsp + 0x78]
mov rbp, r8
jmp 0x140077b1b
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x140077b7c
cmp rdi, rbx
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x48], r12
mov rsi, r12
mov r13, qword [rsp + 0x28]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call r14
mov r15d, eax
test eax, eax
jne 0x140077b40
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140077c5f
mov r8d, r15d
cmp rbp, r8
jne 0x140077ad0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140077c8a
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rbx
cmp r8, 0x201
jb 0x140077adf
jmp 0x140077af0
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x38]
mov rdx, r12
call fcn.1400b1030
mov rdi, qword [rsp + 0x38]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x140077afe
cmp rsi, r8
jb 0x140077c8a
mov rax, qword [rsp + 0x50]
mov rsi, qword [rax]
mov rbx, qword [rax + 8]
lea r14, [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.140082d30
mov rdx, qword [rsi]
mov r8, qword [rsi + 8]
mov rcx, r14
call fcn.140086d60
cmp byte [rbx], 0
jne 0x140077bfc
lea rdx, [0x1400bb218]
lea rcx, [rsp + 0x58]
mov r8d, 3
call fcn.140087700
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x30]
mov rcx, rsi
call fcn.14007da20
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x140077c2d
mov rcx, qword [rsp + 0x60]
mov r8d, 1
call fcn.1400550c0
test rdi, rdi
je 0x140077c48
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x28]
mov rdx, rdi
call fcn.1400550c0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x30]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000001
mov qword [rsi], rax
test rdi, rdi
jne 0x140077c32
jmp 0x140077c48
ud2
Function at 0x140078310
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r14, qword [rdx + 8]
mov r8d, 0x200
mov eax, 2
mov qword [rsp + 0x30], rax
xor edi, edi
mov esi, 0xffffffff
xor r12d, r12d
cmp r8, 0x201
jae 0x140078390
jmp 0x14007837f
jae 0x14007845b
cmp r8, 0x201
jae 0x140078390
mov ebx, 0x200
lea r13, [rsp + 0x58]
mov rbp, r8
jmp 0x1400783bf
sub r8, r12
mov rax, rdi
sub rax, r12
cmp r8, rax
ja 0x14007842b
cmp rdi, rsi
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x50], r12
mov rbx, r12
mov r13, qword [rsp + 0x30]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r14
mov rdx, r13
mov r8d, ebp
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r15d, eax
test eax, eax
jne 0x1400783eb
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x1400784a2
mov r8d, r15d
cmp rbp, r8
jne 0x140078370
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400784cd
lea r8, [rbp*2]
cmp rbp, 0x7fffffff
cmova r8, rsi
cmp r8, 0x201
jb 0x14007837f
jmp 0x140078390
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1400b1030
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x1400783a2
cmp rbx, r8
jb 0x1400784cd
mov rsi, qword [rsp + 0x38]
mov rcx, rsi
mov rdx, r13
call fcn.140082d30
test rdi, rdi
je 0x14007848b
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.1400550c0
mov rax, rsi
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rsp + 0x38]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rdi, rdi
jne 0x140078475
jmp 0x14007848b
ud2
Function at 0x1400784d0
Capabilities:
Get common file path

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x458
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 2
mov qword [rsp + 0x50], 0
mov r15d, 0x200
mov eax, 2
mov qword [rsp + 0x30], rax
xor edi, edi
mov r14d, 0xffffffff
xor r12d, r12d
cmp r15, 0x201
jae 0x140078550
jmp 0x14007853f
jae 0x140078615
cmp r15, 0x201
jae 0x140078550
mov ebx, 0x200
lea r13, [rsp + 0x58]
mov rbp, r15
jmp 0x14007857f
sub r15, r12
mov rax, rdi
sub rax, r12
cmp r15, rax
ja 0x1400785e2
cmp rdi, r14
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rsp + 0x50], r12
mov rbx, r12
mov r13, qword [rsp + 0x30]
mov rbp, r12
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, r13
mov edx, ebp
call qword [sym.imp.kernel32.dll_GetSystemDirectoryW]
mov esi, eax
test eax, eax
jne 0x1400785a6
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x140078648
mov r15d, esi
cmp rbp, r15
jne 0x140078530
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400786c8
lea r15, [rbp*2]
cmp rbp, 0x7fffffff
cmova r15, r14
cmp r15, 0x201
jb 0x14007853f
jmp 0x140078550
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, r15
call fcn.1400b1030
mov rdi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x140078562
cmp rbx, r15
jb 0x1400786c8
lea r14, [r15 + r15]
test esi, esi
je 0x140078673
movzx eax, byte [0x1400d6d30]
mov edx, 2
mov rcx, r14
call fcn.1400550b0
test rax, rax
je 0x1400786ca
mov rsi, rax
jmp 0x140078678
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rbx, qword [rsp + 0x38]
mov qword [rbx + 8], rax
movabs rax, 0x8000000000000000
mov qword [rbx], rax
test rdi, rdi
jne 0x14007869b
jmp 0x1400786b1
mov esi, 2
mov rcx, rsi
mov rdx, r13
mov r8, r14
call fcn.1400af260
mov rbx, qword [rsp + 0x38]
mov qword [rbx], r15
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], r15
test rdi, rdi
je 0x1400786b1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rsp + 0x30]
mov rdx, rdi
call fcn.1400550c0
mov rax, rbx
add rsp, 0x458
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
mov ecx, 2
mov rdx, r14
call fcn.140060750
int3

Function at 0x140079740
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x40]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x58
ret
Function at 0x14007b050
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140061c00
add rcx, 0x18
jmp 0x140073cc0
ud2
jmp 0x14007b050
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14007b088
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x14007b0a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14007b0d2
movsxd rdx, eax
xor ecx, ecx
mov rax, rcx
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x14007b0ca
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x28
ret

Function at 0x14007b100
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
mov rcx, qword [rcx]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14007b12f
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x28
ret

Function at 0x14007b150
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
mov rcx, qword [rax]
cmp r8, 0x7fffffff
mov eax, 0x7fffffff
cmovae r8, rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
je 0x14007b185
movsxd rdx, eax
xor ecx, ecx
mov rax, rcx
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
xor edx, edx
mov ecx, 0
cmp eax, 0x274a
je 0x14007b17d
shl rax, 0x20
or rax, 2
mov ecx, 1
mov rdx, rax
mov rax, rcx
add rsp, 0x28
ret

Function at 0x14007b1c0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
cmp r8, 0x7fffffff
mov ecx, 0x7fffffff
cmovae r8, rcx
mov rcx, qword [rax]
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
je 0x14007b1f2
movsxd rdx, eax
xor eax, eax
add rsp, 0x28
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x28
ret
Function at 0x14007d8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, r9
mov rbx, r8
mov rdi, rcx
mov rax, qword [rdx]
mov r8, qword [rdx + 8]
mov rcx, r9
mov rdx, rax
call fcn.140086d60
cmp byte [rbx], 0
jne 0x14007d8f2
lea rdx, str.exe.NULcmd.exemaximum_number_of_ProcThreadAttributes_exceeded
mov r8d, 3
mov rcx, rsi
call fcn.140087700
movabs r15, 0x8000000000000000
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140077080
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
cmp rax, r15
je 0x14007d953
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x50]
call fcn.14008d1f0
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
cmp r14, r15
jne 0x14007d9e0
mov eax, ebx
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14007d9aa
test rax, rax
je 0x14007d9aa
mov r14, qword [rbx - 1]
mov r12, qword [rbx + 7]
mov rax, qword [r12]
test rax, rax
je 0x14007d97d
mov rcx, r14
call rax
dec rbx
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x14007d997
mov r8, qword [r12 + 0x10]
mov rcx, r14
call fcn.1400550c0
mov edx, 0x18
mov r8d, 8
mov rcx, rbx
call fcn.1400550c0
mov qword [rdi], r15
mov rdx, qword [rsi]
test rdx, rdx
je 0x14007d9d1
mov rcx, qword [rsi + 8]
mov r8d, 1
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.1400550c0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov r12, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007da00
mov qword [rdi], r14
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], r12
jmp 0x14007d9ad
mov qword [rdi], r15
test r14, r14
je 0x14007d9ad
add r14, r14
mov r8d, 2
mov rcx, rbx
mov rdx, r14
call fcn.1400550c0
jmp 0x14007d9ad
Function at 0x14007da20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rcx, [rsp + 0x40]
call fcn.140077080
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
cmp rax, r14
je 0x14007da83
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x28]
lea rdx, [rsp + 0x58]
call fcn.14008d1f0
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
cmp rbx, r14
jne 0x14007dae9
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14007dad7
test rax, rax
je 0x14007dad7
mov rbx, qword [rdi - 1]
mov r15, qword [rdi + 7]
mov rax, qword [r15]
test rax, rax
je 0x14007daac
mov rcx, rbx
call rax
dec rdi
mov rdx, qword [r15 + 8]
test rdx, rdx
je 0x14007dac4
mov r8, qword [r15 + 0x10]
mov rcx, rbx
call fcn.1400550c0
mov edx, 0x18
mov r8d, 8
mov rcx, rdi
call fcn.1400550c0
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14007db09
mov qword [rsi], rbx
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], r15
jmp 0x14007dada
mov qword [rsi], r14
test rbx, rbx
je 0x14007dada
add rbx, rbx
mov r8d, 2
mov rcx, rdi
mov rdx, rbx
call fcn.1400550c0
jmp 0x14007dada
Function at 0x14007f180
Capabilities:
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov r8, rdx
mov rdx, rcx
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x28]
call fcn.140077080
mov rax, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
cmp rax, rbx
je 0x14007f1e5
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov r8b, 1
call fcn.14008aa70
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x14007f1f3
mov rbx, rsi
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
mov rcx, rsi
call qword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
je 0x14007f21d
test rdi, rdi
je 0x14007f248
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400550c0
xor ebx, ebx
jmp 0x14007f1e8
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test rdi, rdi
je 0x14007f1e8
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400550c0
jmp 0x14007f1e8
xor ebx, ebx
jmp 0x14007f1e8

Function at 0x140080000
Capabilities:
Copy file

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
mov rbx, r9
mov r14, r8
mov r8, rdx
mov rdx, rcx
movabs r12, 0x8000000000000000
lea rcx, [rsp + 0x48]
call fcn.140077080
mov rax, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
cmp rax, r12
je 0x140080071
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r8b, 1
call fcn.14008aa70
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
cmp rdi, r12
jne 0x14008008e
mov r14d, 1
mov rbx, rsi
mov rax, r14
mov rdx, rbx
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [rsp + 0x48]
mov rdx, r14
mov r8, rbx
call fcn.140077080
mov rax, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
cmp rax, r12
je 0x1400800e2
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x30]
mov r8b, 1
call fcn.14008aa70
mov r15, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
cmp r15, r12
jne 0x140080109
mov rbx, r14
mov r14d, 1
test rdi, rdi
je 0x14008007a
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400550c0
jmp 0x14008007a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [0x1400801b0]
lea r9, [rsp + 0x30]
mov rcx, rsi
mov rdx, r14
call qword [sym.imp.kernel32.dll_CopyFileExW]
test eax, eax
je 0x14008017e
mov rbx, qword [rsp + 0x30]
test r15, r15
je 0x14008015d
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.1400550c0
test rdi, rdi
je 0x140080176
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400550c0
xor r14d, r14d
jmp 0x14008007a
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
test r15, r15
je 0x1400800e5
add r15, r15
mov r8d, 2
mov rcx, r14
mov rdx, r15
call fcn.1400550c0
jmp 0x1400800e5
Function at 0x140081960
Capabilities:
Read file on windows

Disassembly:
push rsi
sub rsp, 0x60
mov eax, 0xffffffff
cmp r8, rax
cmovae r8, rax
mov dword [rsp + 0x34], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x58], rax
mov rcx, qword [rcx]
lea rax, [0x140081a30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_ReadFileEx]
test eax, eax
je 0x1400819f0
mov rsi, qword [sym.imp.kernel32.dll_SleepEx]
nop dword [rax]
mov ecx, 0xffffffff
mov edx, 1
call rsi
cmp dword [rsp + 0x34], 0
je 0x1400819c0
mov eax, dword [rsp + 0x38]
mov esi, dword [rsp + 0x3c]
mov rcx, rax
shl rcx, 0x20
or rcx, 2
test eax, eax
cmovne rsi, rcx
jne 0x140081a00
jmp 0x140081a16
call qword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov rcx, rsi
call fcn.140081120
mov ecx, eax
mov eax, 1
cmp cl, 0xb
jne 0x140081a18
xor esi, esi
xor eax, eax
mov rdx, rsi
add rsp, 0x60
pop rsi
ret