joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ce350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov r10, r9
movzx ebx, r8b
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x38], r14
mov r11, qword [rcx]
mov r8, qword [r11 + 8]
mov cl, 1
nop dword [rax]
cmp byte [r8 + 0x19], 0
jne 0x1800ce427
mov r11, r8
test bl, bl
je 0x1800ce3db
mov rax, qword [r8 + 0x20]
test rax, rax
je 0x1800ce3cb
mov r9, qword [r10]
sub r9, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1800ce3c4
inc rax
test ecx, ecx
jne 0x1800ce3b1
test edx, edx
sets cl
jmp 0x1800ce3d6
mov eax, dword [r10 + 8]
cmp dword [r8 + 0x28], eax
setb cl
xor cl, 1
jmp 0x1800ce415
mov rax, qword [r10]
test rax, rax
je 0x1800ce40a
mov r9, qword [r8 + 0x20]
sub r9, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1800ce403
inc rax
test ecx, ecx
jne 0x1800ce3f0
test edx, edx
sets cl
jmp 0x1800ce415
mov eax, dword [r8 + 0x28]
cmp dword [r10 + 8], eax
setb cl
test cl, cl
je 0x1800ce41e
mov r8, qword [r8]
jmp 0x1800ce422
mov r8, qword [r8 + 0x10]
jmp 0x1800ce390
mov rbx, r11
test cl, cl
je 0x1800ce4ac
mov rdx, qword [rdi]
cmp r11, qword [rdx]
jne 0x1800ce460
mov qword [rsp + 0x28], r14
mov r9, r11
mov r8b, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1800ce080
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x1800ce54b
cmp byte [r11 + 0x19], 0
je 0x1800ce46d
mov rbx, qword [r11 + 0x10]
jmp 0x1800ce4ac
mov rax, qword [r11]
cmp byte [rax + 0x19], 0
jne 0x1800ce490
mov rbx, rax
nop dword [rax]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1800ce4ac
mov rbx, rax
jmp 0x1800ce480
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1800ce4a4
cmp rbx, qword [rax]
jne 0x1800ce4a4
mov rbx, rax
jmp 0x1800ce490
cmp byte [rbx + 0x19], 0
cmove rbx, rax
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x1800ce4dd
mov r9, qword [r10]
sub r9, rax
nop dword [rax + rax]
movzx r8d, byte [rax]
movzx edx, byte [rax + r9]
sub r8d, edx
jne 0x1800ce4d5
inc rax
test edx, edx
jne 0x1800ce4c0
test r8d, r8d
sets al
jmp 0x1800ce4e7
mov eax, dword [r10 + 8]
cmp dword [rbx + 0x28], eax
setb al
test al, al
je 0x1800ce513
mov qword [rsp + 0x28], r14
mov r9, r11
movzx r8d, cl
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1800ce080
mov rcx, qword [rax]
mov qword [rsi], rcx
mov byte [rsi + 8], 1
mov rax, rsi
jmp 0x1800ce54b
lea rdi, [r14 + 0x20]
mov qword [rsp + 0x30], rdi
lea rcx, [rdi + 0x10]
call fcn.1800c3c10
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800ce539
cmp dword [rdi + 8], 1
jne 0x1800ce539
call fcn.1802d0c88
mov rcx, r14
call fcn.18011da90
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x1800ced90
Capabilities:
Get file version info

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x1800cedb6
cmp qword [rdx + 0x18], 8
jb 0x1800ceda8
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800cedbe
xor al, al
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800d0500
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, rdx
mov rsi, rcx
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1800d0553
xor al, al
jmp 0x1800d0615
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x1800d054c
mov eax, 2
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1802b8484
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800d05fc
mov r9, rax
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1800d05fc
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x180093198]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1800d05fc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1800d05fc
movzx eax, word [rcx + 0xa]
mov word [rsi], ax
movzx eax, word [rcx + 8]
mov word [rsi + 2], ax
movzx eax, word [rcx + 0xe]
mov word [rsi + 4], ax
movzx eax, word [rcx + 0xc]
mov word [rsi + 6], ax
mov dil, 1
jmp 0x1800d05ff
xor dil, dil
test rbx, rbx
je 0x1800d0611
mov edx, 2
mov rcx, rbx
call fcn.1802b8d50
movzx eax, dil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1800cedd0
Capabilities:
Get file version info

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x1800cedeb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800cedf3
xor al, al
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800d0500
Function at 0x1800d0500
Capabilities:
Get file version info

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x1800cedb6
cmp qword [rdx + 0x18], 8
jb 0x1800ceda8
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jne 0x1800cedbe
xor al, al
add rsp, 0x20
pop rbx
ret
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1800d0500
mov rax, rsp
push rdi
sub rsp, 0x260
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rax, rdx
mov rsi, rcx
mov r8d, 0x104
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1800d0553
xor al, al
jmp 0x1800d0615
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov edi, eax
test eax, eax
je 0x1800d054c
mov eax, 2
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1802b8484
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1800d05fc
mov r9, rax
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x1800d05fc
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], eax
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
lea rdx, [0x180093198]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x1800d05fc
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1800d05fc
movzx eax, word [rcx + 0xa]
mov word [rsi], ax
movzx eax, word [rcx + 8]
mov word [rsi + 2], ax
movzx eax, word [rcx + 0xe]
mov word [rsi + 4], ax
movzx eax, word [rcx + 0xc]
mov word [rsi + 6], ax
mov dil, 1
jmp 0x1800d05ff
xor dil, dil
test rbx, rbx
je 0x1800d0611
mov edx, 2
mov rcx, rbx
call fcn.1802b8d50
movzx eax, dil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800d0ed0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x190
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov ecx, dword [0x180415068]
mov rax, qword gs:[0x58]
mov edx, 0x68
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x180417488], eax
jle 0x1800d0f75
lea rcx, [0x180417488]
call fcn.1802b887c
cmp dword [0x180417488], 0xffffffff
jne 0x1800d0f75
lea r9d, [rsi + 6]
lea r8, [0x1800940b0]
lea rcx, [0x180417468]
call fcn.1800abfb0
nop
lea rcx, [0x18035e390]
call fcn.1802b846c
nop
lea rcx, [0x180417488]
call fcn.1802b881c
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x70]
call fcn.1802c7550
lea rdx, [rsp + 0x70]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1800d10d6
cmp eax, 0x104
jae 0x1800d0fc4
mov r9d, eax
lea r8, [rsp + 0x70]
mov rcx, rdi
call fcn.1800abfb0
nop
mov dword [rsp + 0x20], 1
jmp 0x1800d112f
lea edx, [rax + 1]
lea rcx, [rsp + 0x28]
call fcn.1800bc860
nop
mov rcx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
sub rcx, rbx
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x1800d1073
mov r9d, eax
mov r8, rbx
mov rcx, rdi
call fcn.1800abfb0
nop
mov dword [rsp + 0x20], 1
test rbx, rbx
je 0x1800d112f
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, 0x1000
jb 0x1800d1058
test bl, 0x1f
je 0x1800d102b
call fcn.1802d51b4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1800d103a
call fcn.1802d51b4
int3
sub rbx, rax
cmp rbx, 8
jae 0x1800d1049
call fcn.1802d51b4
int3
cmp rbx, 0x27
jbe 0x1800d1055
call fcn.1802d51b4
int3
mov rbx, rax
mov rcx, rbx
call fcn.18011da90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
jmp 0x1800d112f
test rbx, rbx
je 0x1800d10d6
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, 0x1000
jb 0x1800d10c0
test bl, 0x1f
je 0x1800d1093
call fcn.1802d51b4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1800d10a2
call fcn.1802d51b4
int3
sub rbx, rax
cmp rbx, 8
jae 0x1800d10b1
call fcn.1802d51b4
int3
cmp rbx, 0x27
jbe 0x1800d10bd
call fcn.1802d51b4
int3
mov rbx, rax
mov rcx, rbx
call fcn.18011da90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x50]
call fcn.1800d1160
nop
cmp dword [rsp + 0x60], 0
je 0x1800d1106
lea r8, [0x180417468]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call fcn.1800ab320
mov dword [rsp + 0x20], 1
jmp 0x1800d1125
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x18], recv
mov qword [rdi + 0x10], rsi
mov byte [rdi], al
mov dword [rsp + 0x20], 1
lea rcx, [rsp + 0x50]
call fcn.1800ad110
mov rax, rdi
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800d1160
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x170
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x50]
call fcn.1802c7550
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1800d12f5
cmp eax, 0x104
jae 0x1800d11e3
mov r9d, eax
lea r8, [rsp + 0x50]
mov rcx, rdi
call fcn.1800abfb0
nop
jmp 0x1800d130c
lea edx, [rax + 1]
lea rcx, [rsp + 0x28]
call fcn.1800bc860
nop
mov rdx, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x28]
sub rdx, rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1800d1292
mov r9d, eax
mov r8, rbx
mov rcx, rdi
call fcn.1800abfb0
nop
mov dword [rsp + 0x20], 1
test rbx, rbx
je 0x1800d1314
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, 0x1000
jb 0x1800d1277
test bl, 0x1f
je 0x1800d124a
call fcn.1802d51b4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1800d1259
call fcn.1802d51b4
int3
sub rbx, rax
cmp rbx, 8
jae 0x1800d1268
call fcn.1802d51b4
int3
cmp rbx, 0x27
jbe 0x1800d1274
call fcn.1802d51b4
int3
mov rbx, rax
mov rcx, rbx
call fcn.18011da90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
jmp 0x1800d1314
test rbx, rbx
je 0x1800d12f5
mov rax, qword [rsp + 0x38]
sub rax, rbx
cmp rax, 0x1000
jb 0x1800d12df
test bl, 0x1f
je 0x1800d12b2
call fcn.1802d51b4
int3
mov rax, qword [rbx - 8]
cmp rax, rbx
jb 0x1800d12c1
call fcn.1802d51b4
int3
sub rbx, rax
cmp rbx, 8
jae 0x1800d12d0
call fcn.1802d51b4
int3
cmp rbx, 0x27
jbe 0x1800d12dc
call fcn.1802d51b4
int3
mov rbx, rax
mov rcx, rbx
call fcn.18011da90
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x18], recv
mov qword [rdi + 0x10], rsi
mov byte [rdi], al
mov dword [rsp + 0x20], 1
mov rax, rdi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1800f4a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
cmp qword [rcx + 0x10], 0
jne 0x1800f4a42
xor al, al
jmp 0x1800f4b20
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov rdi, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1800d3d60
mov rax, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x88]
test al, al
je 0x1800f4b13
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x70]
lea r8, [0x1800944f0]
or rdi, 0xffffffffffffffff
cmp rax, r8
jne 0x1800f4aac
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800f4ab1
mov rbx, rdi
nop dword [rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1800f4aa0
jmp 0x1800f4ab1
call rdx
mov rbx, rax
inc rbx
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.1802b8484
mov rdi, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x98]
mov r8, rbx
mov rdx, rax
call r9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800f4afe
test al, 0x10
jne 0x1800f4afe
mov bl, 1
jmp 0x1800f4b00
xor bl, bl
test rdi, rdi
je 0x1800f4b13
mov edx, 2
mov rcx, rdi
call fcn.1802b8d50
nop
lea rcx, [rsp + 0x40]
call fcn.1800d3d60
movzx eax, bl
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f4b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rdx
test rdx, rdx
je 0x1800f4c8e
cmp qword [rcx + 0x10], 0
je 0x1800f4c8e
mov qword [rsp + 0x48], 0
mov rbx, qword [rcx + 0x10]
lea rcx, [rsp + 0x48]
call fcn.1800d3d60
mov rax, qword [rbx]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [rax + 0x88]
test al, al
jne 0x1800f4b93
xor bl, bl
jmp 0x1800f4c7f
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x70]
lea r8, [0x1800944f0]
or rsi, 0xffffffffffffffff
cmp rax, r8
jne 0x1800f4bcf
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1800f4bc0
xor eax, eax
jmp 0x1800f4bd1
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x1800f4bc3
jmp 0x1800f4bd1
call rdx
lea rbx, [rax + 1]
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.1802b8484
mov rsi, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x98]
mov r8, rbx
mov rdx, rax
call r9
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r8d, eax
cmp eax, 0xffffffff
jne 0x1800f4c1e
xor bl, bl
jmp 0x1800f4c6c
mov edx, r8d
shr edx, 5
mov ecx, r8d
shr ecx, 1
movzx r9d, r8b
and r9b, 1
shr r8d, 2
and r8b, 1
mov dword [rdi], 0
mov eax, dword [rdi]
mov r10d, 1
and dl, r10b
cmovne eax, r10d
mov dword [rdi], eax
and cl, r10b
je 0x1800f4c58
or dword [rdi], 2
test r9b, r9b
je 0x1800f4c60
or dword [rdi], 4
test r8b, r8b
je 0x1800f4c68
or dword [rdi], 8
movzx ebx, r10b
test rsi, rsi
je 0x1800f4c7f
mov edx, 2
mov rcx, rsi
call fcn.1802b8d50
nop
lea rcx, [rsp + 0x48]
call fcn.1800d3d60
movzx eax, bl
jmp 0x1800f4c90
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f4ca0
Capabilities:
Set file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x58], rsi
mov esi, edx
cmp qword [rcx + 0x10], 0
jne 0x1800f4cc9
xor al, al
jmp 0x1800f4dd2
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov rdi, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.1800d3d60
mov rax, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x88]
test al, al
je 0x1800f4dc5
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x70]
lea r8, [0x1800944f0]
or rdi, 0xffffffffffffffff
cmp rax, r8
jne 0x1800f4d2f
mov rax, qword [rcx + 0x10]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1800f4d34
mov rbx, rdi
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x1800f4d23
jmp 0x1800f4d34
call rdx
mov rbx, rax
inc rbx
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.1802b8484
mov rdi, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rcx]
mov r9, qword [rdx + 0x98]
mov r8, rbx
mov rdx, rax
call r9
movzx ecx, sil
and ecx, 1
or ecx, 4
shl ecx, 5
mov eax, esi
shr eax, 1
mov edx, ecx
or edx, 2
and al, 1
cmove edx, ecx
mov eax, esi
shr eax, 2
mov ecx, edx
or ecx, 1
and al, 1
cmove ecx, edx
shr esi, 3
mov edx, ecx
or edx, 4
and sil, 1
cmove edx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test rdi, rdi
je 0x1800f4dc5
mov edx, 2
mov rcx, rdi
call fcn.1802b8d50
nop
lea rcx, [rsp + 0x40]
call fcn.1800d3d60
movzx eax, bl
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f5ca0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1800f5e79
cmp byte [rcx + 0x71], 0
je 0x1800f5e79
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
cmp eax, 0xffffffff
jne 0x1800f5cfe
xor al, al
jmp 0x1800f5e7b
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], r14b
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.1800ade60
nop
lea r15, [0x18007b780]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
nop dword [rax]
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, r8
lea rbx, [rbp - 0x30]
cmovae rbx, r8
mov r10, qword [rdi + 0x68]
add r9, qword [rbp - 0x20]
mov rax, qword [r10]
mov r11, qword [rax + 0x40]
cmp rax, r15
jne 0x1800f5d71
mov qword [rbp - 0x40], rbx
mov eax, r14d
jmp 0x1800f5d93
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rdi + 0x74]
mov rcx, r10
call r11
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x40]
test eax, eax
je 0x1800f5d9e
sub eax, 1
jne 0x1800f5e03
jmp 0x1800f5da2
mov byte [rdi + 0x71], 0
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, r8
sub rbx, rax
je 0x1800f5de0
lea rcx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rcx, r8
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
call fcn.1802e4674
cmp rbx, rax
jne 0x1800f5e08
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
cmp byte [rdi + 0x71], 0
je 0x1800f5e0c
test rbx, rbx
jne 0x1800f5d40
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.1800ae520
jmp 0x1800f5d31
cmp eax, 2
je 0x1800f5e0c
xor bl, bl
jmp 0x1800f5e0e
mov bl, 1
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1800f5e64
inc rax
mov rcx, qword [rbp - 0x30]
cmp rax, 0x1000
jb 0x1800f5e5f
test cl, 0x1f
je 0x1800f5e32
call fcn.1802d51b4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800f5e41
call fcn.1802d51b4
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800f5e50
call fcn.1802d51b4
int3
cmp rcx, 0x27
jbe 0x1800f5e5c
call fcn.1802d51b4
int3
mov rcx, rax
call fcn.18011da90
mov qword [rbp - 0x18], recv
mov qword [rbp - 0x20], r14
mov byte [rbp - 0x30], 0
movzx eax, bl
jmp 0x1800f5e7b
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1800fd450
Capabilities:
Connect pipe

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rcx, rdx
xor edi, edi
mov rdx, r8
mov qword [r8 + 0x10], rdi
mov rsi, r8
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x1800fd492
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 0x217
je 0x1800fd4b7
cmp eax, 0x3e5
jne 0x1800fd4c1
mov edi, 1
mov eax, edi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800fd4e0
Capabilities:
Create pipe

Disassembly:
mov r11, rsp
push r12
push r14
push r15
sub rsp, 0xd0
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x1803fc9f0]
xor rax, rsp
mov qword [rsp + 0xc8], rax
mov rsi, rdx
xor r12d, r12d
mov qword [r11 - 0x80], r12
test rdx, rdx
jne 0x1800fd52c
xor eax, eax
jmp 0x1800fd725
mov edx, 1
lea rcx, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 6]
call fcn.1800fdc20
test al, al
je 0x1800fd6ab
lea rcx, [0x180001d58]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x1800fd6ab
lea rdx, [0x180001d68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov qword [rsp + 0x60], r12
mov byte [rsp + 0xc0], 0
mov byte [rsp + 0xc1], 0
mov byte [rsp + 0xc2], 0
mov byte [rsp + 0xc3], 0
mov byte [rsp + 0xc4], 0
mov byte [rsp + 0xc5], reloc.WSOCK32.dll_recv
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, 0x1000
mov dl, 1
lea rcx, [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1800fd6a2
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov eax, eax
add rax, 0x10
mov qword [rsp + 0x70], rax
lea r14, [rax + 3]
mov eax, 0xfffffffc
and r14, rax
mov qword [rsp + 0x70], r14
mov rdx, r14
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rdi, rax
test rax, rax
je 0x1800fd6a2
mov r8d, 2
mov edx, r14d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x1800fd6a2
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, rdi
call r15
test eax, eax
je 0x1800fd6a2
xor r9d, r9d
mov r8, rdi
lea edx, [r9 + 1]
lea rcx, [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorSacl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rsp + 0x78], reloc.OLEAUT32.dll_SafeArrayGetElement
mov dword [rsp + 0x88], r12d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x64
mov dword [rsp + 0x28], 0x1000
mov dword [rsp + 0x20], 0x1000
mov edx, 0x40000003
mov r9d, 8
lea r8d, [r9 - 2]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov qword [rsp + 0x68], rax
cmp rax, 0xffffffffffffffff
jne 0x1800fd71e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rax, r12
mov qword [rsp + 0x68], rax
jmp 0x1800fd725
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.1802b85a0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret