joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d27d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x1f8]
cmp dword [rax + 0x28], 0
je 0x1400d2808
mov r8d, reloc.WS2_32.dll_listen
mov dword [rbx + 0x844], 0xd
mov dl, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d2920
cmp byte [rcx + 0xbc6], 0
je 0x1400d2820
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d3360
cmp byte [rcx + 0xbde], 0
je 0x1400d28c1
mov r8, qword [rbx + 0x810]
test r8, r8
jne 0x1400d287b
mov r8, qword [rcx + 0xc38]
test r8, r8
jne 0x1400d285e
cmp byte [rcx + 0xbc5], 0
lea rax, str.NLST
lea r8, str.LIST
cmovne r8, rax
lea rcx, [rbx + 0x788]
lea rdx, str.PRET__s
call fcn.1400dfbc0
test eax, eax
je 0x1400d28b1
add rsp, 0x20
pop rbx
ret
cmp byte [rcx + 0xbd1], 0
lea rcx, [rbx + 0x788]
je 0x1400d28a1
lea rdx, str.PRET_STOR__s
call fcn.1400dfbc0
test eax, eax
je 0x1400d28b1
add rsp, 0x20
pop rbx
ret
lea rdx, str.PRET_RETR__s
call fcn.1400dfbc0
test eax, eax
jne 0x1400d28ce
mov dword [rbx + 0x844], 0x1d
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d32d0
add rsp, 0x20
pop rbx
ret

Function at 0x1400d2c10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx]
mov rbx, rcx
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x28], 0
je 0x1400d2c5d
cmp qword [rcx + 0x810], 0
je 0x1400d2c5d
add rcx, 0x788
lea rdx, str.REST__d
xor r8d, r8d
call fcn.1400dfbc0
test eax, eax
jne 0x1400d2c67
mov dword [rbx + 0x844], 0x1a
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.1400d27d0
add rsp, 0x20
pop rbx
ret

Function at 0x1400d2e00
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
add rcx, 0x788
mov rax, qword [rbx]
mov rdx, qword [rax + 0x1f8]
cmp dword [rdx + 0x28], 1
jne 0x1400d2e4c
mov r8, qword [rcx + 0x88]
test r8, r8
je 0x1400d2e4c
lea rdx, str.SIZE__s
call fcn.1400dfbc0
test eax, eax
jne 0x1400d2e59
mov dword [rbx + 0x844], 0x17
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d2c10
add rsp, 0x20
pop rbx
ret

Function at 0x1400d2e60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov r9, qword [rcx]
cmp byte [r9 + 0xbd0], 0
je 0x1400d2eb8
cmp qword [rcx + 0x810], 0
je 0x1400d2eb8
cmp byte [r9 + 0xbc3], 0
mov eax, Ordinal_68
mov edx, Ordinal_77
cmovne edx, eax
movsx eax, byte [rcx + 0x834]
cmp eax, edx
je 0x1400d2eb8
mov rax, qword [r9 + 0x1f8]
mov r8d, reloc.WS2_32.dll_send
mov dword [rax + 0x28], 1
movzx edx, byte [r9 + 0xbc3]
jmp fcn.1400d1640
jmp fcn.1400d2e00
Function at 0x1400d2ec0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rsi, rcx
mov rcx, qword [rcx]
mov edi, r8d
cmp eax, 0x64
jb 0x1400d2f04
lea rdx, str.Couldnt_set_desired_mode
call fcn.1400b4780
lea eax, [rbx + 0x11]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
cmp edx, 0xc8
je 0x1400d2f1b
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200_n
call fcn.1400b4900
mov qword [rsp + 0x48], rbp
cmp edi, 0x13
jne 0x1400d2f32
mov rcx, rsi
call fcn.1400d2e00
jmp 0x1400d308b
cmp edi, 0x14
jne 0x1400d306d
mov rbp, qword [rsi]
mov rax, qword [rbp + 0x1f8]
mov rdi, qword [rax + 0x18]
mov rax, rbx
mov qword [rsp + 0x40], rbx
cmp dword [rbp + 0xba8], 2
jne 0x1400d2fc9
test rdi, rdi
je 0x1400d2fc9
cmp byte [rdi], al
je 0x1400d2fc9
mov edx, Ordinal_50
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x1400d2fc4
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdi + rax], bl
jne 0x1400d2f80
cmp byte [rax + rdi - 1], 0x2f
je 0x1400d2f9f
mov edx, Ordinal_50
mov rcx, rdi
call sub.VCRUNTIME140.dll_strrchr
sub rax, rdi
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x40]
mov r8, rax
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov rcx, rbp
call fcn.1400c3df0
test eax, eax
jne 0x1400d308b
mov rax, qword [rsp + 0x40]
mov rdx, qword [rbp + 0xc38]
test rdx, rdx
jne 0x1400d2fed
cmp byte [rbp + 0xbc5], bl
lea rcx, str.NLST
lea rdx, str.LIST
cmovne rdx, rcx
test rax, rax
lea r8, [0x14013dd40]
mov r9, r8
lea rcx, [0x14013dd7c]
cmovne r8, rcx
cmovne r9, rax
lea rcx, [0x140129e78]
call fcn.1400bdb60
mov rbp, rax
test rax, rax
jne 0x1400d302d
mov rcx, qword [rsp + 0x40]
call qword [fcn.14011456d]
lea ebx, [rbp + 0x1b]
jmp 0x1400d308d
lea rcx, [rsi + 0x788]
mov r8, rbp
lea rdx, [0x14013dde0]
call fcn.1400dfbc0
mov rcx, qword [rsp + 0x40]
mov edi, eax
call qword [fcn.14011456d]
mov rcx, rbp
call qword [fcn.14011456d]
test edi, edi
je 0x1400d3061
mov ebx, edi
jmp 0x1400d308d
mov dword [rsi + 0x844], 0x1f
jmp 0x1400d308d
cmp edi, 0x15
jne 0x1400d3078
lea r8d, [rdi - 8]
jmp 0x1400d3081
cmp edi, 0x16
jne 0x1400d308d
lea r8d, [rdi - 8]
mov dl, 1
mov rcx, rsi
call fcn.1400d2920
mov ebx, eax
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400df420
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400df440
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x50], rdi
cmp rbx, rax
ja 0x1400df564
test rbx, rbx
je 0x1400df472
lea rcx, [rbx + rbx]
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
jmp 0x1400df47f
lea rcx, [0x14013dd40]
call qword [0x140194048]
mov rdi, rax
test rax, rax
je 0x1400df564
xor ecx, ecx
test rbx, rbx
je 0x1400df4b4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
mov byte [rdi + rcx*2], al
mov byte [rdi + rcx*2 + 1], 0
inc rcx
cmp rcx, rbx
jb 0x1400df4a0
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
xor r8d, r8d
lea rcx, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400df54f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400df542
mov rcx, qword [rsp + 0x30]
lea r8d, [rbx + rbx]
xor r9d, r9d
mov dword [rsp + 0x68], reloc.WS2_32.dll_recv
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x68]
mov r8, rbp
mov dword [rsp + 0x20], 0
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov rcx, rdi
mov dword [rbp + 0x10], eax
mov byte [rbp + 0x14], al
call qword [fcn.14011456d]
xor eax, eax
jmp 0x1400df569
mov eax, reloc.WLDAP32.dll_Ordinal_27
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
Function at 0x1400df580
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, r8
mov dword [rbp - 0x40], 8
mov rbx, rdx
mov dword [rsp + 0x20], 0xf0000000
mov rsi, rcx
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x38]
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1400df6b7
movzx edx, byte [rdi + 1]
movzx ecx, byte [rdi]
movzx eax, dl
movzx r8d, byte [rdi + 5]
shr al, 1
mov byte [rbp - 0x1c], cl
shl cl, 7
or al, cl
shl dl, 6
movzx ecx, byte [rdi + 2]
mov byte [rbp - 0x1b], al
movzx eax, cl
shr al, 2
or al, dl
shl cl, 5
movzx edx, byte [rdi + 3]
mov byte [rbp - 0x1a], al
movzx eax, dl
shr al, 3
or al, cl
shl dl, 4
movzx ecx, byte [rdi + 4]
mov byte [rbp - 0x19], al
movzx eax, cl
shr al, 4
or al, dl
shl cl, 3
mov byte [rbp - 0x18], al
movzx eax, r8b
shr al, 5
or al, cl
shl r8b, 2
movzx ecx, byte [rdi + 6]
mov byte [rbp - 0x17], al
movzx eax, cl
add cl, cl
shr al, 6
or al, r8b
mov byte [rbp - 0x15], cl
mov qword [rsp + 0xa0], r14
lea rcx, [rbp - 0x1c]
xor r14d, r14d
mov byte [rbp - 0x16], al
mov dword [rbp - 0x28], 0x208
mov dword [rbp - 0x24], 0x6601
mov dword [rbp - 0x20], 8
lea edx, [r14 + 8]
call fcn.1400e32a0
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r8d, [r14 + 0x14]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
lea rdx, [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov r14, qword [rsp + 0xa0]
test eax, eax
jne 0x1400df6bb
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
jmp 0x1400df700
mov rax, qword [rsi]
xor r9d, r9d
mov rcx, qword [rbp - 0x30]
xor r8d, r8d
mov qword [rbx], rax
xor edx, edx
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x30], eax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e49c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400e4a02
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400e4a49
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400e4aa2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x1400e4a60
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400e4ae3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x140134c0a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x140134c0b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400e4ab0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140101cc0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx], eax
cmp eax, 0xffffffff
je 0x140101cdf
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, str.TLS_capacity_depleted
lea rcx, str.libslog_src_thread_specific.cpp
lea edx, [r9 + 0x1d]
call fcn.1400ebb90
int3
Function at 0x1401074c0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbp
mov rbp, rdx
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov eax, 1
test esi, esi
cmove esi, eax
mov r8d, esi
mov eax, 2
mul r8
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.1400ace58
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rdx, rax
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor esi, esi
test eax, eax
jne 0x14010753b
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14010753d
mov eax, esi
lea r8, str.boost::filesystem::current_path
mov rdx, rbp
mov ecx, eax
call fcn.1401083c0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 7
mov word [r14], si
nop
inc rdi
cmp word [rbx + rdi*2], si
jne 0x140107560
mov r8, rdi
mov rdx, rbx
mov rcx, r14
call fcn.140004a60
nop
mov rcx, rbx
call fcn.1400ace14
mov rax, r14
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140108a70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov dword [rsp + 0x20], 0
mov rdi, rcx
call fcn.1400e5a00
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov qword [rsp + 0x28], rax
jb 0x140108aa9
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140108ad0
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140108940
mov esi, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x140108b0b
xor esi, esi
call fcn.1400e5a00
bt ebx, 0xa
jae 0x140108b02
mov rcx, rdi
call fcn.140108540
test al, al
je 0x140108afb
test bl, 0x10
mov eax, inet_ntoa
mov ebx, 4
cmovne ebx, eax
jmp 0x140108b0b
mov ebx, 9
jmp 0x140108b0f
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x140108b11
xor esi, esi
lea r9, str.boost::filesystem::remove
mov r8, rbp
mov rdx, rdi
mov ecx, esi
call fcn.1401082f0
test al, al
je 0x140108b2d
xor al, al
jmp 0x140108b3a
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.140108b50
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x140108b50
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x140108b89
test r8, r8
je 0x140108c3d
xor eax, eax
mov dword [r8], eax
call fcn.1400e5a00
mov qword [rdi + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x140108bdb
cmp qword [rcx + 0x18], 8
jb 0x140108b9d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140108c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140108bc2
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140108c23
cmp eax, 0x7b
je 0x140108c23
cmp eax, 0x57
je 0x140108c23
cmp eax, 0xa1
je 0x140108c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140108c25
cmp qword [rcx + 0x18], 8
jb 0x140108be5
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140108c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x140108c0a
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140108c23
cmp eax, 0x7b
je 0x140108c23
cmp eax, 0x57
je 0x140108c23
cmp eax, 0xa1
je 0x140108c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140108c25
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.1401082f0
test al, al
je 0x140108c4a
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140108c60
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jb 0x140108c82
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x140108c8c
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140108ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140108ca6
xor eax, eax
lea rcx, str.boost::filesystem::rename
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov ecx, eax
mov rdx, rbx
call fcn.140108200
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x140108ce0
Capabilities:
Get disk size

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbx, rcx
mov rcx, rdx
mov rsi, r8
mov rdi, rdx
jb 0x140108cfe
mov rcx, qword [rdx]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ecx, ecx
lea r9, str.boost::filesystem::space
test eax, eax
mov r8, rsi
mov rdx, rdi
sete cl
call fcn.1401082f0
test al, al
jne 0x140108d73
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rsp + 0x48]
mov qword [rbx], rcx
mov ecx, dword [rsp + 0x4c]
shl rcx, 0x20
add rcx, rax
mov eax, dword [rsp + 0x58]
mov qword [rbx + 8], rcx
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
add rcx, rax
mov rax, rbx
mov qword [rbx + 0x10], rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
mov qword [rbx + 0x10], 0
mov rax, rbx
mov qword [rbx + 8], 0
mov qword [rbx], 0
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x140108da0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140194020]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140108de5
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x140108e06
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140108940
jmp 0x140108f2d
xor ebp, ebp
bt r15d, 0xa
jae 0x140108eea
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140108e20
mov rdx, qword [rdi]
movdqa xmm0, xmmword [0x140147820]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], bp
jne 0x140108e40
lea rcx, [rsp + 0x50]
call fcn.140004a60
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.1400049f0
nop
cmp rbx, 0xffffffffffffffff
jne 0x140108eb4
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140108940
nop
jmp 0x140108f2d
mov rcx, rdi
call fcn.140108540
test al, al
jne 0x140108ee0
mov edx, r15d
mov rcx, rdi
call fcn.1401087e0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140108f2d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x140108efb
mov dword [r14], ebp
call fcn.1400e5a00
mov qword [r14 + 8], rax
mov ebx, r15d
mov edx, r15d
mov rcx, rdi
call fcn.1401087e0
and ebx, 0x10
je 0x140108f14
mov ecx, dword [rsp + 0x40]
jmp 0x140108f1a
mov ecx, eax
mov eax, dword [rsp + 0x40]
test ebx, ebx
setne bpl
add ebp, 2
mov dword [rsi], ebp
test ebx, ebx
cmove eax, ecx
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400acdf0
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010d900
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbp, r8
mov r14, rdx
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
je 0x14010d93f
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x14010d95c
call fcn.14010e420
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
jne 0x14010d953
xor esi, esi
jmp 0x14010d95c
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
mov rax, qword [r14]
mov qword [rsp + 0x38], rax
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x40], rcx
mov edx, 1
test rcx, rcx
je 0x14010d988
mov eax, edx
lock xadd dword [rcx + 8], eax
test rcx, rcx
je 0x14010d988
lock xadd dword [rcx + 8], edx
mov qword [rsp + 0x68], rbp
mov edi, 0xffffffff
test rcx, rcx
je 0x14010d9c9
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010d9c9
mov rbx, qword [rsp + 0x40]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14010d9c9
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x60], 0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x88], rbp
lea rdx, [rsp + 0x70]
lea rcx, [rsi + 0x28]
call fcn.14010b420
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x48]
lea rcx, [rsi + 0x28]
call fcn.14010b910
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14010da75
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x14010da75
mov rbx, qword [rsp + 0x80]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14010da75
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov rbx, qword [r14 + 8]
test rbx, rbx
je 0x14010daa7
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14010daa7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x14010daa7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
add rsp, 0x90
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14010dac0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x20
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
je 0x14010dae0
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14010dafa
call fcn.14010e420
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
jne 0x14010daf4
xor eax, eax
jmp 0x14010dafa
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rax + 0x18]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14010c530
mov qword [rbx], rax
add rsp, 0x20
pop rbx
ret
Function at 0x14010e390
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
je 0x14010e3f5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14010e3f5
mov rcx, qword [rax + 0x28]
mov rax, rcx
mov rdx, qword [rcx + 8]
cmp byte [rdx + 0x19], 0
jne 0x14010e3e3
cmp qword [rdx + 0x20], rbx
jae 0x14010e3cc
mov rdx, qword [rdx + 0x10]
jmp 0x14010e3d2
mov rax, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], 0
je 0x14010e3c0
cmp rax, rcx
je 0x14010e3e3
cmp rbx, qword [rax + 0x20]
jae 0x14010e3e6
mov rax, rcx
cmp rax, rcx
je 0x14010e3f5
add rax, 0x28
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x14010e420
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
call fcn.14010c4c0
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rdx, [0x14010e050]
lea rcx, [0x1401a47e8]
call fcn.14010db20
mov ecx, dword [0x1401942e0]
cmp ecx, 0xffffffff
je 0x14010e464
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
add rsp, 0x30
pop rbx
ret