joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800c4180
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov rbp, rcx
mov rdx, rcx
lea rcx, [rsp + 0x48]
mov edi, r8d
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800c41c4
xor al, al
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov ebx, eax
not edi
or ebx, esi
and ebx, edi
cmp ebx, eax
je 0x1800c41f1
lea rcx, [rsp + 0x48]
mov rdx, rbp
call fcn.180016d90
mov edx, ebx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1800c41f6
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800c9990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x94]
mov esi, dword [rdi + 0x58]
mov ecx, dword [rdi + 0x44]
sub esi, dword [rdi + 0x9c]
add ecx, 0xfffffefa
add ecx, ebx
sub esi, edx
cmp edx, ecx
jb 0x1800c9a3f
mov rcx, qword [rdi + 0x50]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1800a0460
mov r8d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebx
sub dword [rdi + 0x94], ebx
sub dword [rdi + 0x84], ebx
lea rdx, [rax + r8*2]
nop
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x1800c9a10
sub eax, ebx
jmp 0x1800c9a12
xor eax, eax
mov word [rdx], ax
dec r8d
jne 0x1800c9a00
mov rax, qword [rdi + 0x60]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x1800c9a34
sub eax, ebx
jmp 0x1800c9a36
xor eax, eax
mov word [rcx], ax
dec edx
jne 0x1800c9a24
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1800c9ab9
mov edx, dword [rdi + 0x9c]
mov eax, dword [rdi + 0x94]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x50]
call fcn.1800c9e40
add dword [rdi + 0x9c], eax
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x1800c9aa3
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x1800c9ab9
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1800c99b0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800cb430
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
jne 0x1800cb438
xor eax, eax
ret
jmp fcn.1800cb130
Function at 0x1800d2580
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rbp, rcx
mov esi, 1
cmp edx, esi
cmovg esi, edx
xor r15d, r15d
dec esi
js 0x1800d260e
nop word [rax + rax]
mov ecx, 0x88
call fcn.1800a103c
mov qword [rsp + 0x80], rax
test rax, rax
je 0x1800d25e7
mov rdx, rbp
mov rcx, rax
call fcn.180012940
mov rdi, rax
jmp 0x1800d25ea
mov rdi, r15
mov edx, dword [rbp + 0x28]
inc edx
lea rcx, [rbp + 0x18]
call fcn.18000a6d0
movsxd rcx, dword [rbp + 0x28]
lea eax, [rcx + 1]
mov dword [rbp + 0x28], eax
mov rax, qword [rbp + 0x18]
mov qword [rax + rcx*8], rdi
dec esi
jns 0x1800d25c0
mov rsi, qword [rbp + 0x18]
movsxd rax, dword [rbp + 0x28]
lea r14, [rsi + rax*8]
cmp rsi, r14
je 0x1800d26ff
mov r12d, 2
nop dword [rax]
mov rdi, qword [rsi]
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rdi + 0x75], 0
mov rax, qword [rdi + 0x10]
test rax, rax
jne 0x1800d26e8
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rdi
lea r8, [0x1800c2540]
mov edx, dword [rdi + 0x68]
xor ecx, ecx
call fcn.1800a339c
mov qword [rdi + 0x10], rax
mov eax, dword [rsp + 0x78]
mov qword [rdi + 0x18], rax
mov eax, dword [rdi + 0x60]
mov rcx, qword [rdi + 0x10]
cmp eax, 1
jge 0x1800d2690
mov ebx, 0xfffffff1
jmp 0x1800d26c8
cmp eax, r12d
jge 0x1800d269c
mov ebx, 0xfffffffe
jmp 0x1800d26c8
cmp eax, 5
jge 0x1800d26a6
or ebx, 0xffffffff
jmp 0x1800d26c8
cmp eax, 7
jge 0x1800d26b0
mov ebx, r15d
jmp 0x1800d26c8
cmp eax, 9
jge 0x1800d26bc
mov ebx, 1
jmp 0x1800d26c8
mov ebx, SafeArrayGetDim
cmp eax, 0xa
cmovl ebx, r12d
test rcx, rcx
jne 0x1800d26d6
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rcx, [rdi + 0x20]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add rsi, 8
cmp rsi, r14
jne 0x1800d2630
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x1800dc600
Capabilities:
Initialize winsock library

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rdi
sub rsp, 0x1c0
mov rax, qword [rdx]
mov rbx, rcx
movsxd rdi, r9d
mov qword [rcx], rax
lea rcx, [rax - 0x10]
mov qword [r11 + 8], rax
mov qword [r11 + 0x10], rax
lea rax, [0x1802bccb0]
cmp rcx, rax
je 0x1800dc63c
mov eax, 1
lock xadd dword [rcx], eax
mov dword [rbx + 8], r8d
lea rcx, [rbx + 0x12]
mov word [rbx + 0x10], 1
mov dword [rbx + 0xc], edi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x180427e9c], 0
jne 0x1800dc673
lea rdx, [rsp + 0x20]
mov ecx, 0x101
mov byte [0x180427e9c], 1
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov rcx, rdi
call fcn.1800dc8f0
mov rax, rbx
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1c0
pop rdi
ret
Function at 0x1800dc6a0
Capabilities:
Get socket status

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov byte [rax + 0x18], r8b
push rbx
push rbp
sub rsp, 0x468
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r14
mov r14, rcx
mov rcx, rdx
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
setne sil
test sil, sil
je 0x1800dc78f
movsxd rcx, dword [r14]
lea rax, [rsp + 0x488]
xor ebx, ebx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x248], rcx
lea rdx, [rsp + 0x30]
inc ecx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x488], rbx
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x240], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x1800dc78f
mov eax, dword [r14]
test eax, eax
js 0x1800dc78f
lea rax, [rsp + 0x490]
lea r9, [rsp + 0x498]
mov edx, 0xffff
mov r8d, 0x1007
mov rcx, rdi
mov dword [rsp + 0x490], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x1800dc78f
cmp dword [rsp + 0x498], ebx
jne 0x1800dc78f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
setne bl
jmp 0x1800dc792
or ebx, 0xffffffff
mov r14, qword [rsp + 0x450]
mov rdi, qword [rsp + 0x458]
test sil, sil
mov rsi, qword [rsp + 0x460]
je 0x1800dc7b8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
add rsp, 0x468
pop rbp
pop rbx
ret

Function at 0x1800dc8f0
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x18], r8b
push rbx
sub rsp, 0x30
mov rbx, rcx
test rcx, rcx
je 0x1800dc995
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x50], 0x10000
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1800dc995
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
mov dword [rsp + 0x50], 0x10000
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x1800dc995
lea r9, [rsp + 0x50]
lea edx, [rax + 6]
lea r8d, [rax + 1]
mov rcx, rbx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
xor ecx, ecx
test eax, eax
sete cl
test ecx, ecx
je 0x1800dc995
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret
Function at 0x1800e4500
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rdx
mov r8d, 1
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.1800e3080
nop
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1800e45b0
mov rax, qword [rsp + 0x30]
cmp byte [rax], 0
je 0x1800e4588
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e4588
mov ebx, 4
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.1800e6d50
test al, al
jne 0x1800e4584
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
dec ebx
jns 0x1800e4560
jmp 0x1800e4588
mov bl, 1
jmp 0x1800e458a
xor bl, bl
lea rcx, [rsp + 0x30]
call fcn.1800e2fd0
movzx eax, bl
add rsp, 0x40
pop rbx
ret

Function at 0x1800e4790
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov rbx, rdx
mov rdi, rcx
cmp byte [rax], 0
je 0x1800e4814
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e4814
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.180016d90
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov rbx, qword [rax]
call fcn.180016d90
mov r9, rbx
mov r8, qword [rax]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
jbe 0x1800e4814
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800e4e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x30], 0
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x1800e4f20
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e4f20
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.1800e4d90
mov rdi, rax
lea rdx, [rsp + 0x98]
mov rcx, rsi
call fcn.1800e6bb0
mov rbx, rax
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1800e6c30
nop
mov byte [rsp + 0x20], 1
mov r9, rdi
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.1800e4f60
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff0
lea rdi, [0x1802bccb0]
or ebx, 0xffffffff
cmp rcx, rdi
je 0x1800e4edb
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1800e4edb
call fcn.1800a0c6c
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x1800e4eff
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e4eff
call fcn.1800a0c6c
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x1800e4f44
lock xadd dword [rcx], ebx
lea eax, [rbx - 1]
cmp eax, 0xffffffff
jne 0x1800e4f44
call fcn.1800a0c6c
jmp 0x1800e4f44
mov rax, qword [rsi]
mov qword [r14], rax
mov qword [rsp + 0x50], rax
lea rcx, [rax - 0x10]
lea rdi, [0x1802bccb0]
cmp rcx, rdi
je 0x1800e4f44
mov eax, 1
lock xadd dword [rcx], eax
mov rax, r14
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x1800e5890
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
mov rax, qword [rcx]
cmp byte [rax], dil
je 0x1800e5ab3
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1800e5ab3
lea r15, vtable.juce::FileInputStream.0
mov qword [rsp + 0x60], r15
mov rax, qword [rbx]
mov qword [rsp + 0x68], rax
lea rcx, [rax - 0x10]
lea rbp, [0x1802bccb0]
cmp rcx, rbp
je 0x1800e5913
mov eax, 1
lock xadd dword [rcx], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
lea rcx, [rsp + 0x80]
call fcn.18000bdd0
nop
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.180016d90
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 3]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or edi, 0xffffffff
cmp rax, 0xffffffffffffffff
je 0x1800e5973
mov qword [rsp + 0x70], rax
jmp 0x1800e59ba
lea rcx, [rsp + 0xd0]
call fcn.1800c3cf0
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rax]
mov qword [rsp + 0x80], rdx
mov qword [rax], rcx
mov rcx, qword [rsp + 0xd0]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1800e59ba
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e59ba
call fcn.1800a0c6c
nop
lea rsi, [0x1802bccc0]
mov rax, qword [rsp + 0x80]
cmp byte [rax], 0
jne 0x1800e59ea
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x60]
call fcn.1800db780
mov rcx, rax
mov ebx, 2
jmp 0x1800e59ff
mov qword [rsp + 0xc0], rsi
lea rcx, [rsp + 0xc0]
mov ebx, 4
mov rax, qword [rcx]
mov qword [r14], rax
mov qword [rcx], rsi
or ebx, 1
test bl, 4
je 0x1800e5a36
and ebx, 0xfffffffb
mov rcx, qword [rsp + 0xc0]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1800e5a36
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5a36
call fcn.1800a0c6c
test bl, 2
je 0x1800e5a5f
mov rcx, qword [rsp + 0xd8]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1800e5a5f
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5a5f
call fcn.1800a0c6c
nop
mov qword [rsp + 0x60], r15
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1800e5a92
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5a92
call fcn.1800a0c6c
mov rcx, qword [rsp + 0x68]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1800e5abd
lock xadd dword [rcx], edi
lea eax, [rdi - 1]
cmp eax, 0xffffffff
jne 0x1800e5abd
call fcn.1800a0c6c
jmp 0x1800e5abd
lea rsi, [0x1802bccc0]
mov qword [r14], rsi
mov rax, r14
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e5ae0
Capabilities:
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rbp, rdx
mov rsi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x1800e5cc7
mov rdx, rcx
lea rcx, [r11 + 0x18]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x1800e5cc7
lea r15, vtable.juce::FileInputStream.0
mov qword [rsp + 0x78], r15
mov rax, qword [rsi]
mov qword [rsp + 0x80], rax
lea rcx, [rax - 0x10]
lea r14, [0x1802bccb0]
cmp rcx, r14
je 0x1800e5b5d
mov eax, 1
lock xadd dword [rcx], eax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
lea rcx, [rsp + 0x98]
call fcn.18000bdd0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe8]
call fcn.180016d90
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x1800e5bcb
mov qword [rsp + 0x88], rax
jmp 0x1800e5c12
lea rcx, [rsp + 0xd0]
call fcn.1800c3cf0
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rax]
mov qword [rsp + 0x98], rdx
mov qword [rax], rcx
mov rcx, qword [rsp + 0xd0]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x1800e5c12
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5c12
call fcn.1800a0c6c
nop
mov rax, qword [rsp + 0x98]
cmp byte [rax], 0
jne 0x1800e5c68
mov rdx, rsi
lea rcx, [rsp + 0x48]
call fcn.180016d90
lea r8, [rsp + 0x50]
xor edx, edx
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1800e5c4f
mov ebx, dword [rsp + 0x6c]
shl rbx, 0x20
mov eax, dword [rsp + 0x70]
or rbx, rax
mov r8, rdi
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.1800db900
cmp rbx, rax
jne 0x1800e5c68
mov bl, 1
jmp 0x1800e5c6a
xor bl, bl
mov qword [rsp + 0x78], r15
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, r14
je 0x1800e5ca0
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5ca0
call fcn.1800a0c6c
mov rax, qword [rsp + 0x80]
lea rcx, [rax - 0x10]
cmp rcx, r14
je 0x1800e5cc2
lock xadd dword [rcx], edi
lea edx, [rdi - 1]
cmp edx, 0xffffffff
jne 0x1800e5cc2
call fcn.1800a0c6c
movzx eax, bl
jmp 0x1800e5cc9
xor al, al
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e5d60
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x98], rbx
mov rdi, rdx
mov rbx, rcx
mov dword [rbp - 0x20], 0
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x1800e5db7
cmp eax, 0xffffffff
je 0x1800e5db7
mov rcx, rdi
call fcn.18000bdd0
jmp 0x1800e5f0a
lea rdx, [rbp + 0x38]
mov rcx, rbx
call fcn.1800e6c30
nop
mov rax, qword [rbx]
mov qword [rbp - 8], rax
mov rcx, qword [rbp + 0x38]
cmp rcx, rax
je 0x1800e5e9f
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x28], rcx
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x28]
call fcn.180019ca0
test eax, eax
je 0x1800e5e9f
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1800e5d60
nop
lea rsi, [0x1802bccb0]
or ebx, 0xffffffff
mov rax, qword [rbp + 0x30]
cmp byte [rax], 0
jne 0x1800e5e8b
mov rax, qword [0x180423538]
mov qword [rbp - 0x30], rax
lea r8, [rbp - 0x30]
lea rdx, [rbp - 0x48]
mov rcx, qword [rbp + 0x20]
call fcn.1800d60c0
nop
mov r8, rax
lea rdx, [rbp - 0x50]
call fcn.1800c39c0
mov rcx, qword [rbp + 0x30]
mov rdx, qword [rax]
mov qword [rbp + 0x30], rdx
mov qword [rax], rcx
mov rcx, qword [rbp - 0x50]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1800e5e6c
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1800e5e6c
call fcn.1800a0c6c
nop
mov rcx, qword [rbp - 0x48]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1800e5e8b
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e5e8b
call fcn.1800a0c6c
mov rax, qword [rbp + 0x30]
mov qword [rdi], rax
lea rax, [0x1802bccc0]
mov qword [rbp + 0x30], rax
jmp 0x1800e5eec
lea rax, str.Cannot_create_parent_directory
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x20]
call fcn.18001a440
lea rdx, [rbp + 0x20]
mov rcx, rdi
call fcn.1800dcd40
mov rcx, qword [rbp + 0x20]
add rcx, 0xfffffffffffffff0
lea rsi, [0x1802bccb0]
or ebx, 0xffffffff
cmp rcx, rsi
je 0x1800e5eec
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1800e5eec
call fcn.1800a0c6c
nop
mov rcx, qword [rbp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1800e5f0a
lock xadd dword [rcx], ebx
lea eax, [rbx - 1]
cmp eax, 0xffffffff
jne 0x1800e5f0a
call fcn.1800a0c6c
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800e5f30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rdi, rdx
mov r14, rcx
xor r15d, r15d
mov dword [rbp - 0x61], r15d
mov rax, qword [rcx]
cmp byte [rax], r15b
je 0x1800e5f90
mov rdx, rcx
lea rcx, [rbp + 0x27]
call fcn.180016d90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800e5f90
mov rcx, rdi
call fcn.18000bdd0
jmp 0x1800e6130
lea rdx, [rbp + 0x77]
mov rcx, r14
call fcn.1800e6c30
nop
mov rax, qword [r14]
mov qword [rbp + 0x1f], rax
mov rcx, qword [rbp + 0x77]
cmp rcx, rax
je 0x1800e60c5
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rcx
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x49]
call fcn.180019ca0
test eax, eax
je 0x1800e60c5
lea rdx, [rbp + 0x67]
lea rcx, [rbp + 0x77]
call fcn.1800e5d60
nop
lea rsi, [0x1802bccb0]
or ebx, 0xffffffff
mov rax, qword [rbp + 0x67]
cmp byte [rax], 0
jne 0x1800e60b5
lea rax, vtable.juce::OutputStream.0
mov qword [rbp - 0x39], rax
lea rax, [0x180375c60]
mov qword [rbp - 0x59], rax
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x31]
call fcn.18001a440
nop
lea rax, vtable.juce::FileOutputStream.0
mov qword [rbp - 0x39], rax
mov rax, qword [r14]
mov qword [rbp - 0x29], rax
lea rcx, [rax - 0x10]
lea r14d, [rbx + 2]
cmp rcx, rsi
je 0x1800e603d
mov eax, r14d
lock xadd dword [rcx], eax
mov qword [rbp - 0x21], r15
lea rcx, [rbp - 0x19]
call fcn.18000bdd0
nop
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 8
mov qword [rbp - 1], r15
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.1800a0a4c
mov qword [rbp + 7], rax
lea rcx, [rbp - 0x39]
call fcn.1800c36d0
nop
mov rax, qword [rbp - 0x19]
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x1800e6089
lock xadd dword [rcx], r14d
mov rax, qword [rbp - 0x19]
xchg qword [rbp + 0x67], rax
lea rcx, [rax - 0x10]
cmp rcx, rsi
je 0x1800e60a8
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1800e60a8
call fcn.1800a0c6c
lea rcx, [rbp - 0x39]
call fcn.1800e3a90
mov rax, qword [rbp + 0x67]
mov qword [rdi], rax
lea rax, [0x1802bccc0]
mov qword [rbp + 0x67], rax
jmp 0x1800e6112
lea rax, [0x1802bfba8]
mov qword [rbp - 0x69], rax
lea rdx, [rbp - 0x69]
lea rcx, [rbp + 0x7f]
call fcn.18001a440
lea rdx, [rbp + 0x7f]
mov rcx, rdi
call fcn.1800dcd40
mov rcx, qword [rbp + 0x7f]
add rcx, 0xfffffffffffffff0
lea rsi, [0x1802bccb0]
or ebx, 0xffffffff
cmp rcx, rsi
je 0x1800e6112
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1800e6112
call fcn.1800a0c6c
nop
mov rcx, qword [rbp + 0x77]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x1800e6130
lock xadd dword [rcx], ebx
lea eax, [rbx - 1]
cmp eax, 0xffffffff
jne 0x1800e6130
call fcn.1800a0c6c
mov rax, rdi
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret