joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005b54
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x320
lea rbp, [rsp + 0x30]
xor r15d, r15d
mov qword [rbp + 0x328], rbx
movsxd r14, r8d
mov rsi, rdx
test r9, r9
jne 0x140005b98
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x140005ba7
mov rdx, r9
lea rcx, [rbp + 0xe0]
call fcn.1400266bc
lea rdx, [rbp + 0x338]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
movsxd rdi, eax
test eax, eax
je 0x140005cd4
lea rax, [rdi + 0xf]
mov r8, rdi
cmp rax, rdi
ja 0x140005bdc
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140037ab0
sub rsp, rax
lea rbx, [rsp + 0x30]
test rbx, rbx
je 0x140005cd4
xor edx, edx
mov rcx, rbx
call fcn.140021310
mov edx, dword [rbp + 0x338]
lea rcx, [rbp + 0xe0]
mov r9, rbx
mov r8d, edi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x140005cd4
lea r9, [rbp + 0x320]
mov rcx, rbx
lea r8, [rbp]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140005cd4
mov rax, qword [rbp]
lea rdi, [0x1400465e8]
lea rdx, str.StringFileInfo_04X_04X_s
mov qword [rsp + 0x20], rdi
lea rcx, [rbp + 0x10]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
call fcn.140003170
lea r9, [rbp + 0x320]
mov rcx, rbx
lea r8, [rbp]
lea rdx, [rbp + 0x10]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x140005cb8
mov r8, rdi
lea rdx, str.StringFileInfo040904E4_s
lea rcx, [rbp + 0x10]
call fcn.140003170
lea r9, [rbp + 0x320]
mov rcx, rbx
lea r8, [rbp]
lea rdx, [rbp + 0x10]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x140005cd4
mov rdx, qword [rbp]
mov r8, r14
mov rcx, rsi
call fcn.140026720
mov eax, 1
mov word [rsi + r14*2 - 2], r15w
jmp 0x140005cd6
xor eax, eax
mov rbx, qword [rbp + 0x328]
lea rsp, [rbp + 0x2f0]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140005cec
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor esi, esi
mov ecx, dword [rcx + 0x11d0]
mov rbx, rdx
test ecx, ecx
je 0x140005d9e
cmp ecx, 1
je 0x140005d1d
xor eax, eax
jmp 0x140005dba
lea rcx, [rdi + 0x1470]
mov rax, qword [rcx]
test rax, rax
je 0x140005d3b
cmp word [rax], si
je 0x140005d3b
call fcn.140013a24
mov rdx, rax
jmp 0x140005da5
lea rax, [rdi + 0x42c]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rcx, [rdi + 0x840]
lea r8, [0x1400446c8]
mov dword [rsp + 0x20], 0x104
lea rdx, str.INSTLOCAL
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov rcx, rbx
call fcn.140026704
test eax, eax
jne 0x140005dad
lea rdx, [rdi + 0x18]
mov rcx, rbx
call fcn.1400266bc
mov rcx, rbx
call fcn.14000f670
lea rdx, str.INSTALL
mov rcx, rbx
call fcn.1400266d8
jmp 0x140005dad
lea rdx, [rdi + 0x222]
mov rcx, rbx
call fcn.1400266bc
mov rcx, rbx
call fcn.14000f670
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140006dd8
Capabilities:
Read .ini file

Disassembly:
mov edx, 1
jmp fcn.140004be8

Function at 0x140006de4
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x460
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rsi, rcx
lea rbx, [rcx + 0x42c]
lea rbp, [rcx + 0x222]
lea rdi, [rcx + 0x840]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
mov r9, rbp
lea r8, [0x1400446c8]
lea rdx, [0x140045c98]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x40]
lea r8, [0x1400446c8]
lea rdx, [0x140045ca8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1400266d8
mov rcx, rbp
call fcn.14000f670
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x250]
lea r8, str.WDUPDATE.NET
lea rdx, str.FICUPDATE
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add rsi, 0x636
mov rdx, rbp
mov rcx, rsi
call fcn.1400266bc
lea rdx, [rsp + 0x250]
mov rcx, rsi
call fcn.1400266d8
mov rcx, rsi
call fcn.14000f414
test eax, eax
jne 0x140006f39
lea r9, str.WDUPDATE.NET
mov r8, rbp
lea rdx, str._s_s
lea rcx, [rsp + 0x470]
call fcn.1400031c4
nop
lea rcx, [rsp + 0x470]
call fcn.140013a24
mov rcx, rax
call fcn.14000f414
test eax, eax
je 0x140006f2c
lea rcx, [rsp + 0x470]
call fcn.140013a24
mov rdx, rax
mov rcx, rsi
call fcn.1400266bc
nop
lea rcx, [rsp + 0x470]
call fcn.140013988
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140007548
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x60
xor r14d, r14d
cmp byte [rcx + 0x11d9], r14b
jne 0x140007612
lea rbx, [rcx + 0x42c]
xor r8d, r8d
lea rdi, [rcx + 0x840]
mov r9, rbx
mov rcx, rdi
lea rdx, str.DELAICHECKVERSION
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea r9, [rbp - 0x30]
mov qword [rsp + 0x28], rbx
lea r8, [0x1400446c8]
mov dword [rsp + 0x20], 9
lea rdx, str.LASTCHECKVERSION
mov rcx, rdi
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea rcx, [rbp - 0x18]
call fcn.140007b24
test esi, esi
jle 0x140007612
cmp word [rbp - 0x30], r14w
je 0x140007612
lea rdx, [rbp + 0x20]
mov dword [rbp + 0x20], r14d
lea rcx, [rbp - 0x18]
call fcn.140007b58
lea rdx, [rbp + 0x28]
mov dword [rbp + 0x28], r14d
lea rcx, [rbp - 0x30]
call fcn.140007b58
mov eax, dword [rbp + 0x20]
sub eax, dword [rbp + 0x28]
cmp eax, esi
jl 0x14000762c
mov r9, rbx
lea r8, [rbp - 0x18]
lea rdx, str.LASTCHECKVERSION
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, 1
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
xor eax, eax
jmp 0x140007617
Function at 0x140007630
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x240
lea rsi, [rcx + 0x636]
mov rbx, rcx
mov rcx, rsi
call fcn.14000f414
test eax, eax
je 0x1400076ed
lea rdi, [rbx + 0x840]
mov qword [rsp + 0x28], rsi
mov rcx, rdi
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x30]
lea r8, [0x1400468cc]
lea rdx, str.DELAICHECKVERSION
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rbx + 0x42c]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, str.DELAICHECKVERSION
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rsi
lea r8, [0x1400468cc]
mov dword [rsp + 0x20], 0x104
lea rdx, str.SILENTCHECKVERSION
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r9, [rbx + 0x42c]
mov rcx, rdi
lea r8, [rsp + 0x30]
lea rdx, str.SILENTCHECKVERSION
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140008250
Capabilities:
Read .ini file

Disassembly:
push rbx
sub rsp, 0x30
add rcx, 8
mov r10, r9
mov r11, r8
mov rbx, rdx
cmp word [rcx], 0
je 0x14000828c
mov eax, dword [rsp + 0x68]
mov r8, r10
mov r9, qword [rsp + 0x60]
mov rdx, r11
mov qword [rsp + 0x28], rcx
mov rcx, rbx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x14000828e
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x140008294
Capabilities:
Read .ini file

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x30
lea rbx, [rcx + 8]
xor ebp, ebp
mov rsi, r9
mov rax, r8
mov r10, rdx
cmp word [rbx], bp
je 0x140008303
mov edi, dword [rsp + 0x78]
xor r8d, r8d
mov r9, qword [rsp + 0x70]
mov rdx, rax
mov qword [r11 - 0x10], rbx
mov rcx, r10
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jg 0x140008305
mov r9, qword [rsp + 0x70]
mov rcx, rsi
mov r8, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x140008305
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140008344
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rbx, [rcx + 8]
mov rdi, r9
cmp word [rbx], 0
mov rax, r8
mov r10, rdx
je 0x140008395
mov r9, rbx
mov r8d, 0x8f8f8f8f
mov rdx, rax
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x8f8f8f8f
jne 0x140008397
mov r8d, dword [rsp + 0x58]
mov r9, rbx
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x140008397
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000842c
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x28
lea rdx, str.WL_Run_Res_W
mov qword [0x140058398], rcx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_Run_Res_Cmd_W
mov qword [0x1400583a0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_Run_Service_W
mov qword [0x1400583a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_Run_Service_Cmd_W
mov qword [0x1400583b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_Term_Service
mov qword [0x1400583b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_TestEx_W
mov qword [0x1400583c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_ListeDLL_W
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_CheminDLL_W
mov qword [0x1400583c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_DonneWDL_W
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_DonneREP_W
mov qword [0x1400583d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_DonneGPU_W
mov qword [0x1400583e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_DonneFinInit
mov qword [0x1400583e8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_InitGoRequete
mov qword [0x1400583f0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_ListeWDL_W
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140058398]
lea rdx, str.WL_SetParam
mov qword [0x1400583d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400583f8], rax
mov eax, 1
add rsp, 0x28
ret
Function at 0x140008a34
Capabilities:
Get graphical window text

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x140058098]
xor r14d, r14d
mov edx, 0x3e9
mov rcx, qword [rbp + 0x10]
mov dword [rbp + 0x18], r14d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
movsxd rcx, ebx
call fcn.140012aac
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test rsi, rsi
je 0x140008aa8
cmp word [rsi], r14w
je 0x140008aa8
mov rcx, rsi
call fcn.140026704
jmp 0x140008aab
mov eax, r14d
mov r8d, eax
lea rcx, [rbp + 0x20]
mov rdx, rsi
call fcn.14000774c
mov rcx, rsi
call fcn.140026e1c
mov rcx, qword [rbp + 0x10]
mov edx, 0x3ea
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ebx, [rax + 1]
movsxd rcx, ebx
call fcn.140012aac
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
test rsi, rsi
je 0x140008b0f
cmp word [rsi], r14w
je 0x140008b0f
mov rcx, rsi
call fcn.140026704
jmp 0x140008b12
mov eax, r14d
mov r8d, eax
lea rcx, [rbp + 0x28]
mov rdx, rsi
call fcn.14000774c
mov rcx, rsi
call fcn.140026e1c
mov rcx, qword [rbp + 0x10]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 2]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.USER32.dll_SendMessageW]
Function at 0x140008f34
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x250
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15, r8
mov r12, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rdx
mov ebx, 0x104
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
lea rsi, [0x1400446c8]
mov r8, rsi
lea rdx, [0x140045c98]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea r14, [rdi + 8]
xor r13d, r13d
cmp word [rsp + 0x40], r13w
je 0x140008fae
lea rcx, [rsp + 0x40]
call fcn.140026704
jmp 0x140008fb1
mov eax, r13d
mov r8d, eax
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14000774c
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
mov r8, rsi
lea rdx, [0x140045ca8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [rsp + 0x40], r13w
je 0x140008ff6
lea rcx, [rsp + 0x40]
call fcn.140026704
jmp 0x140008ff9
mov eax, r13d
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x40]
call fcn.14000774c
lea rcx, str.PC_SOFT
call fcn.140026704
mov r8, rax
lea rdx, str.PC_SOFT
lea rcx, [rdi + 0x18]
call fcn.14000774c
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
lea r8, [0x1400468cc]
lea rdx, str.HTTPAUTHENTIFIE
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, r13d
cmp word [rsp + 0x40], 0x30
setne al
mov dword [rdi + 0x4c], eax
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x40]
lea r8, [0x1400468cc]
lea rdx, str.HTTPSECURE
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, r13d
cmp word [rsp + 0x40], 0x30
setne bl
je 0x1400090a5
lea rcx, str.HTTPS
call fcn.140026704
lea rdx, str.HTTPS
jmp 0x1400090b8
lea rcx, str.HTTP
call fcn.140026704
lea rdx, str.HTTP
mov r8, rax
mov rcx, rdi
call fcn.14000774c
mov qword [rbp + 0x190], r13
lea r9, [rbp + 0x190]
lea r8, [0x140048230]
mov edx, 1
mov rcx, r14
call fcn.140007890
or r15d, 0xffffffff
test eax, eax
je 0x140009162
mov rbx, qword [r14]
test rbx, rbx
je 0x140009102
mov qword [rbp + 0x1a8], rbx
lock inc dword [rbx - 0xc]
jmp 0x14000910c
mov qword [rbp + 0x1a8], r13
mov rbx, r13
mov r9, r14
lea r8, [0x140048230]
xor edx, edx
lea rcx, [rbp + 0x1a8]
call fcn.140007890
mov rax, qword [rbp + 0x190]
test rax, rax
cmovne rsi, rax
mov rcx, rsi
call fcn.140027854
mov dword [rdi + 0x10], eax
test rbx, rbx
je 0x140009160
mov eax, r15d
lock xadd dword [rbx - 0xc], eax
add eax, r15d
jne 0x140009160
mov rcx, qword [0x140058170]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x18]
nop
jmp 0x140009171
neg ebx
sbb eax, eax
and eax, 0x16b
add eax, 0x50
mov dword [rdi + 0x10], eax
mov rdx, qword [rbp + 0x190]
test rdx, rdx
je 0x140009198
mov eax, r15d
lock xadd dword [rdx - 0xc], eax
add eax, r15d
jne 0x140009198
mov rcx, qword [0x140058170]
mov rax, qword [rcx]
call qword [rax + 0x18]
nop
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b3ec
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
and dword [rax - 0x28], 0
mov rbp, r9
mov r9, qword [rsp + 0xc8]
mov r14d, r8d
lea r8, [rax - 0x28]
mov r15, rdx
mov rsi, rcx
call fcn.14000b274
test eax, eax
je 0x14000b578
mov rcx, qword [0x1400580a0]
lea r8, [rsp + 0xa0]
mov ebx, 4
mov r9d, ebx
lea edx, [rbx - 2]
call qword [0x140058110]
neg dword [rsp + 0x98]
mov r9, rbp
mov rcx, qword [0x1400580a0]
movzx r8d, r14w
sbb eax, eax
mov rdx, r15
and qword [rsp + 0x38], 0
and eax, 0x8000000
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call qword [0x140058108]
mov rdi, rax
test rax, rax
je 0x14000b50c
mov r9d, ebx
lea r8, [rsp + 0xa0]
lea edx, [rbx - 2]
mov rcx, rax
call qword [0x140058110]
mov r9d, ebx
lea r8, [rsp + 0xa0]
lea edx, [rbx + 2]
mov rcx, rdi
call qword [0x140058110]
mov r9d, ebx
lea r8, [rsp + 0xa0]
lea edx, [rbx + 1]
mov rcx, rdi
call qword [0x140058110]
lea ecx, [rbx + 0x4c]
call fcn.14001fb50
mov rdx, rsi
mov qword [rsp + 0x40], rax
mov rcx, rax
mov rbx, rax
call fcn.14000c580
lea rax, vtable.CInfoSessionFTPWininet.0
mov qword [rbx + 0x48], rdi
mov qword [rbx], rax
mov rax, rbx
jmp 0x14000b57a
test rbp, rbp
lea rbx, [0x1400446c8]
cmovne rbx, rbp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsp + 0xc8]
xor r8d, r8d
add eax, 0xffffd113
mov dword [rsp + 0x30], r14d
cmp eax, 2
mov qword [rsp + 0x28], rbx
mov r9d, 1
mov qword [rsp + 0x20], r15
seta r8b
mov rcx, rsi
add r8d, 0x5c50d6
call fcn.14000b324
test rdi, rdi
je 0x14000b569
mov rcx, rdi
call qword [0x140058120]
cmp dword [rsp + 0x40], 0
jne 0x14000b578
mov rcx, rsi
call fcn.14000b2f0
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14000dc48
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x5b0]
sub rsp, 0x6b0
mov rax, qword [rcx + 0x228]
mov rdi, rcx
add rcx, 0x18
xor r14d, r14d
test rax, rax
mov rsi, rdx
cmovne rcx, rax
call fcn.1400102c4
test eax, eax
jne 0x14000dddc
lea rcx, str.NTDLL.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x14000dddc
lea rdx, str.NtQueryInformationFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000dddc
xor edx, edx
lea rcx, [rbp - 0x70]
mov r8d, 0x20e
call fcn.140021310
mov rcx, qword [rdi + 0x230]
lea r8, [rbp - 0x70]
mov r9d, 0x20c
mov dword [rsp + 0x20], 9
lea rdx, [rsp + 0x40]
call rbx
test eax, eax
js 0x14000dddc
mov eax, dword [rbp - 0x70]
lea rdx, [rsp + 0x50]
shr rax, 1
mov word [rbp + rax*2 - 0x6c], r14w
mov rcx, qword [rdi + 0x230]
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
je 0x14000dddc
xor edx, edx
lea rcx, [rbp + 0x1a0]
mov r8d, 0x410
call fcn.140021310
lea rdx, [rbp + 0x1a0]
mov ecx, 0x207
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
movabs rax, 0x5c003a0020
lea rbx, [rbp + 0x1a0]
mov qword [rbp + 0x5e0], rax
lea edi, [r14 + 1]
movzx eax, word [rbp + 0x1a0]
mov word [rbp + 0x5e0], ax
sub ax, 0x41
cmp ax, di
jbe 0x14000ddc8
lea rcx, [rbp + 0x5e0]
call fcn.14001023c
cmp eax, 3
jne 0x14000ddc8
mov dword [rsp + 0x38], r14d
lea r9, [rbp + 0x5d0]
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x5e0]
mov qword [rsp + 0x28], r14
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x5d0], r14d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov eax, dword [rsp + 0x6c]
cmp dword [rbp + 0x5d0], eax
je 0x14000ddf6
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x14000ddc8
movzx eax, word [rbx]
test ax, ax
jne 0x14000dd67
xor eax, eax
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov r8d, 2
lea rdx, [rbp + 0x5e0]
mov rcx, rsi
call fcn.140026720
lea rcx, [rsi + 4]
mov r8d, 0x102
lea rdx, [rbp - 0x6c]
call fcn.140026720
mov eax, edi
jmp 0x14000ddde
Function at 0x14000df94
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov edx, 1
mov rbx, r9
mov esi, r8d
call fcn.140015308
test esi, esi
jne 0x14000dfd7
test rbx, rbx
je 0x14000dfcd
and dword [rbx], esi
mov eax, 1
jmp 0x14000e0d4
mov rcx, qword [rdi + 0x230]
lea r9, [rsp + 0x50]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
mov eax, dword [rsp + 0x50]
add qword [rdi + 0x238], rax
test rbx, rbx
je 0x14000e009
mov dword [rbx], eax
test esi, esi
jne 0x14000e0d2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rdi + 0x10]
lea edx, [rsi + 3]
mov ebx, eax
call fcn.140015308
mov rcx, qword [rdi + 0x10]
lea r8d, [rsi + 1]
lea rdx, [0x140047f50]
call fcn.140015174
mov rcx, qword [rdi + 0x10]
mov edx, ebx
call fcn.140015b9c
mov r8, qword [rdi + 0x230]
lea rdx, str._IXStream__Handle__p_
mov rcx, qword [rdi + 0x10]
call fcn.1400156d0
mov r8d, dword [rdi + 0x250]
lea rdx, str._IXStream__Access__x_
mov rcx, qword [rdi + 0x10]
call fcn.1400156d0
mov r9, qword [rdi + 0x258]
test r9, r9
jne 0x14000e090
lea r9, [rdi + 0x18]
mov rax, qword [r9 + 0x210]
test rax, rax
cmovne r9, rax
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140047f50]
mov r8d, 0x6d68
call fcn.140015490
mov r8, qword [rdi + 0x258]
test r8, r8
jne 0x14000e0c4
lea r8, [rdi + 0x18]
mov rax, qword [r8 + 0x210]
test rax, rax
cmovne r8, rax
mov rcx, qword [rdi + 0x10]
mov edx, 1
call fcn.1400157a8
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14000e0ec
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, rdx
mov rbx, rcx
mov rcx, qword [rcx + 0x10]
mov edx, 1
mov r12, r9
mov r13d, r8d
call fcn.140015308
test r12, r12
lea r14, [rsp + 0x70]
mov r8d, r13d
mov rdx, r15
cmovne r14, r12
mov ebp, r13d
xor eax, eax
mov r9, r14
test r12, r12
sete al
and dword [r14], 0
mov rcx, qword [rbx + 0x230]
and qword [rsp + 0x20], 0
mov dword [rsp + 0x80], eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, dword [r14]
test r13d, r13d
jmp 0x14000e1a7
test edi, edi
jne 0x14000e1ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x14000e17e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xa2
jne 0x14000e1ab
mov eax, dword [r14]
mov r9, r14
mov rcx, qword [rbx + 0x230]
add r15, rax
and qword [rsp + 0x20], 0
sub ebp, eax
mov r8d, ebp
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
add esi, dword [r14]
test ebp, ebp
mov edi, eax
jne 0x14000e160
mov ebp, esi
mov dword [r14], esi
add qword [rbx + 0x238], rbp
test edi, edi
je 0x14000e1cc
test r12, r12
jne 0x14000e1c5
cmp esi, r13d
jne 0x14000e1cc
mov eax, edi
jmp 0x14000e2cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbx + 0x10]
mov edx, 3
mov r14d, eax
call fcn.140015308
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140047f50]
mov r15d, 1
mov r8d, r15d
call fcn.140015174
mov rcx, qword [rbx + 0x10]
test edi, edi
je 0x14000e208
xor edx, edx
jmp 0x14000e20b
mov edx, r14d
call fcn.140015b9c
mov r8, qword [rbx + 0x230]
lea rdx, str._IXStream__Handle__p_
mov rcx, qword [rbx + 0x10]
call fcn.1400156d0
mov r8d, dword [rsp + 0x80]
lea rdx, str._IXStream__bExact__d_
mov rcx, qword [rbx + 0x10]
call fcn.1400156d0
mov rcx, qword [rbx + 0x10]
lea rdx, str._IXStream__A_lire__u___lu__u_
mov r9d, esi
mov r8d, r13d
call fcn.1400156d0
mov r8, qword [rbx + 0x238]
lea rdx, str._IXStream__Offset__I64u_
mov rcx, qword [rbx + 0x10]
sub r8, rbp
call fcn.1400156d0
mov r9, qword [rbx + 0x258]
test r9, r9
jne 0x14000e28d
lea r9, [rbx + 0x18]
mov rax, qword [r9 + 0x210]
test rax, rax
cmovne r9, rax
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140047f50]
mov r8d, 0x6d63
call fcn.140015490
mov r8, qword [rbx + 0x258]
test r8, r8
jne 0x14000e2c1
lea r8, [rbx + 0x18]
mov rax, qword [r8 + 0x210]
test rax, rax
cmovne r8, rax
mov rcx, qword [rbx + 0x10]
mov edx, r15d
call fcn.1400157a8
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret