joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a680
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
push rcx
nop
pop rsi
cmp qword [rcx], 0
je 0x14001a715
mov dword [rbp], 0
lea rbx, [rsi + 0x10]
mov r8, rbp
push rbx
nop
pop rcx
sub edx, edx
sub r9d, r9d
call sub.KERNEL32.dll_InitOnceBeginInitialize
mov dword [rbp - 4], eax
cmp eax, 1
jne 0x14001a754
cmp dword [rbp], 0
je 0x14001a738
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x14001a769
mov edi, eax
mov rax, qword [0x140085040]
mov rax, qword [0x1400820e8]
nop word cs:[rax + rax]
mov qword [rsi + 8], rax
lock cmpxchg qword [0x1400820e8], rsi
jne 0x14001a6f0
mov eax, edi
inc eax
mov dword [rsi + 0x18], eax
push rbx
pop rcx
nop
sub edx, edx
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
jmp 0x14001a749
call sub.KERNEL32.dll_TlsAlloc
mov dword [rbp + 4], eax
cmp eax, 0xffffffff
je 0x14001a7ab
mov ecx, eax
inc ecx
sub eax, eax
lock cmpxchg dword [rsi + 0x18], ecx
jne 0x14001a73d
mov edi, dword [rbp + 4]
jmp 0x14001a749
mov edi, dword [rsi + 0x18]
jmp 0x14001a747
mov edi, eax
mov ecx, dword [rbp + 4]
call sub.KERNEL32.dll_TlsFree
dec edi
mov eax, edi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov qword [rbp - 0x38], 0
lea rcx, [rbp - 4]
lea rdx, [rbp - 0x38]
call fcn.14001a7e0
nop
push rbx
pop rcx
mov edx, 4
xor r8d, r8d
call sub.KERNEL32.dll_InitOnceComplete
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rdx, str.std_src_sys_thread_localkeywindows.rs
lea rcx, [rbp - 0x38]
call fcn.1400063a0
lea rax, str.out_of_TLS_indexes
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 4]
lea rdx, [rbp - 0x38]
call fcn.14001a830
int3

Function at 0x14001ac90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x140049088]
or esi, esi
je 0x14001ad1a
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14001ad11
je 0x14001ad0f
movzx eax, byte [0x1400820f8]
mov edx, 0x18
xor ecx, ecx
call fcn.14003bc40
test rax, rax
je 0x14001ad2d
mov qword [rax], 0
mov byte [rax + 8], 0
mov dword [rax + 0x10], esi
mov ecx, esi
push rax
pop rbx
nop
call sub.KERNEL32.dll_TlsGetValue
push rax
nop
pop rdi
mov ecx, esi
push rbx
nop
pop rsi
push rbx
pop rdx
nop
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14001ad0a
mov edx, 8
mov rcx, rdi
call fcn.140005440
mov rax, rsi
jmp 0x14001ad11
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140049070]
call fcn.14001a680
mov esi, eax
jmp 0x14001aca9
mov ecx, 8
mov edx, 0x18
call fcn.140005810
int3
Function at 0x14003b100
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov esi, dword [0x1400490a8]
test esi, esi
je 0x14003b1a0
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
ja 0x14003b197
je 0x14003b195
movzx eax, byte [0x1400820f8]
mov edx, 0x10
xor ecx, ecx
call fcn.14003bc40
or rax, rax
je 0x14003b1b3
mov qword [rax], 0
mov dword [rax + 8], esi
mov ecx, esi
mov rbx, rax
call sub.KERNEL32.dll_TlsGetValue
nop
push rax
pop rdi
mov ecx, esi
mov rsi, rbx
push rbx
pop rdx
nop
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14003b190
mov rax, qword [rdi]
or rax, rax
je 0x14003b183
lock dec qword [rax]
jne 0x14003b183
mov rcx, qword [rdi]
call fcn.14003b1d0
mov edx, 8
nop
push rdi
pop rcx
call fcn.140005440
push rsi
pop rax
nop
jmp 0x14003b197
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x140049090]
call fcn.14001a680
mov esi, eax
jmp 0x14003b11d
mov ecx, 8
mov edx, 0x10
call fcn.140005810
int3

Function at 0x14003f494
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
nop
push rcx
pop rdi
mov esi, dword [0x140049128]
or esi, esi
je 0x14003f523
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
push rax
pop rbx
nop
cmp rax, 1
ja 0x14003f516
je 0x14003f4ce
or rdi, rdi
je 0x14003f4d2
test byte [rdi], 1
je 0x14003f4d7
mov r14, qword [rdi + 4]
jmp 0x14003f4da
xor ebx, ebx
jmp 0x14003f516
xor r14d, r14d
jmp 0x14003f4dd
xor r14d, r14d
and dword [rdi], 0
mov ecx, 0xc
mov edx, 4
call fcn.14003fb13
push rax
nop
pop rbx
mov qword [rax], r14
mov dword [rax + 8], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
push rax
pop rdi
nop
mov ecx, esi
mov rdx, rbx
call sub.KERNEL32.dll_TlsSetValue
test rdi, rdi
je 0x14003f516
push rdi
pop rcx
nop
call fcn.14000db91
push rbx
nop
pop rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140049110]
call fcn.14001a680
mov esi, eax
jmp 0x14003f4ac

Function at 0x14003fda4
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
push rdx
nop
pop rax
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call sub.SHELL32.dll_CommandLineToArgvW
test rax, rax
je 0x14003fe40
nop
push rax
pop rdi
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x14003fe25
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.msvcrt.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14003f628
push rbx
nop
pop rcx
mov rdx, r14
call fcn.1400400b4
add r13, 8
jmp 0x14003fdf5
mov rcx, rdi
call sub.KERNEL32.dll_LocalFree
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
jmp 0x14003fe51
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140045dff
Capabilities:
Reference wmi statements

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
and qword [rsp + 0x38], 0
push rdx
pop rsi
nop
mov rdi, rcx
cmp dword [rdx + 0x10], 1
jne 0x140045ec2
lea rcx, [0x14007993a]
call sub.OLEAUT32.dll_SysAllocString
mov rbx, rax
lea rcx, str.SELECT__FROM_MSAcpi_ThermalZoneTemperature
call sub.OLEAUT32.dll_SysAllocString
mov r14, rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
and qword [rsp + 0x20], 0
nop
push rbx
pop rdx
mov r8, r14
mov r9d, 0x30
call qword [rax + 0xa0]
mov ebp, eax
push rbx
pop rcx
nop
call sub.OLEAUT32.dll_SysFreeString
mov rcx, r14
call sub.OLEAUT32.dll_SysFreeString
or ebp, ebp
js 0x140045ec2
mov rbx, qword [rsp + 0x38]
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.1400440a4
mov qword [rsi + 0x20], 1
mov qword [rsi + 0x28], rbx
mov rax, qword [rsi + 0x30]
mov qword [rdi + 0x30], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rax, qword [rsi + 0x20]
mov qword [rdi + 0x20], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x28], rax
jmp 0x140045ed1
mov qword [rdi], 2
mov rcx, rsi
call fcn.140044028
nop
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140046609
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
push rcx
pop rbx
nop
mov esi, dword [0x140049148]
test esi, esi
je 0x1400466cf
dec esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
mov rdi, rax
cmp rax, 1
ja 0x1400466c2
je 0x1400466c0
or rbx, rbx
je 0x140046658
mov al, byte [rbx]
and qword [rbx], 0
test al, 1
je 0x140046658
mov r14, qword [rbx + 8]
mov rbx, qword [rbx + 0x10]
jmp 0x140046677
xorps xmm0, xmm0
lea rdi, [rsp + 0x20]
movaps xmmword [rdi], xmm0
mov edx, 0x10
mov rcx, rdi
call sub.bcryptprimitives.dll_ProcessPrng
mov r14, qword [rdi]
mov rbx, qword [rdi + 8]
mov ecx, 8
mov edx, 0x18
call fcn.14000b326
test rax, rax
je 0x1400466e2
push rax
pop rdi
nop
mov qword [rax], r14
mov qword [rax + 8], rbx
mov dword [rax + 0x10], esi
mov ecx, esi
call sub.KERNEL32.dll_TlsGetValue
push rax
pop rbx
nop
mov ecx, esi
push rdi
pop rdx
nop
call sub.KERNEL32.dll_TlsSetValue
or rbx, rbx
je 0x1400466c2
mov edx, 8
nop
push rbx
pop rcx
call fcn.140005440
jmp 0x1400466c2
sub edi, edi
push rdi
nop
pop rax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, [0x140049130]
call fcn.14001a680
mov esi, eax
jmp 0x140046625
mov ecx, 8
mov edx, 0x18
call fcn.140005810
int3

Function at 0x140047500
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140048310
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140048310
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140047570
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140082184]
mov r12, rcx
push rdx
pop rsi
nop
mov rbx, r8
test edi, edi
jle 0x140047720
mov rax, qword [0x140082188]
sub ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400475bc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140047647
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x1400475a0
mov rcx, r12
call fcn.140048020
push rax
pop rbp
nop
test rax, rax
je 0x14004777d
mov rax, qword [0x140082188]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140048150
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140082188]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
or rax, rax
je 0x140047762
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140047640
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400476d0
add dword [0x140082184], 1
cmp ebx, 8
jae 0x140047678
test bl, 4
jne 0x140047730
test ebx, ebx
je 0x140047669
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140047750
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140047669
and ebx, 0xfffffff8
sub eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x1400476aa
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140082188]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
or eax, eax
jne 0x140047640
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140047500
sub edi, edi
jmp 0x1400475c7
mov eax, dword [rsi]
push rax
pop rax
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140047669
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140047669
mov rax, qword [0x140082188]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140047500
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140047500
nop
nop dword [rax]
Function at 0x140047c90
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x1400821e0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400821c0]
test rbx, rbx
je 0x140047ce4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140047cdb
or r12, r12
je 0x140047cdb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140047cc0
lea rcx, [0x1400821e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140048020
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x14007a540]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140048099
mov rcx, r10
call fcn.140047ef0
test eax, eax
je 0x140048099
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140048096
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
nop
push rdx
pop rax
cmp rcx, rdx
jb 0x14004808d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140048099
add r8, 0x28
cmp r8, r9
jne 0x140048078
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x14001baa0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
test cl, cl
jne 0x14001bbce
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.1400ec680
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], bx
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], bx
jne 0x14001bb10
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400088b0
nop
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bx
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov r8d, 6
lea rdx, str.adppid
lea rcx, [rbp - 0x80]
call fcn.140008ab0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.14001a690
nop
lea rcx, [rbp - 0x80]
call fcn.140008a50
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140025150
cmp qword [rax + 0x18], 8
jb 0x14001bb9a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
sete bl
lea rcx, [rsp + 0x60]
call fcn.140008840
nop
lea rcx, [rsp + 0x20]
call fcn.140008840
nop
lea rcx, [rsp + 0x40]
call fcn.140008840
movzx eax, bl
jmp 0x14001bbd1
movzx eax, cl
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400e9d60
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2c0
pop rbp
ret
Function at 0x14001ca60
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov edi, 4
test ecx, ecx
cmovns edi, ecx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp eax, 1
jne 0x14001caaf
mov eax, 6
jmp 0x14001cc52
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x60]
call fcn.1400ec680
lea rdx, [rbp - 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor esi, esi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], si
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x14001caf0
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.1400088b0
nop
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], si
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov r8d, 8
lea rdx, str.adpdebug
lea rcx, [rsp + 0x40]
call fcn.140008ab0
nop
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.14001a690
nop
lea rcx, [rsp + 0x40]
call fcn.140008a50
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140025150
cmp qword [rax + 0x18], 8
jb 0x14001cb7e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.140008840
nop
lea rcx, [rsp + 0x60]
call fcn.140008840
mov eax, 5
cmp ebx, 1
cmove edi, eax
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], si
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov esi, 6
mov r8d, esi
lea rdx, str.adpdev
lea rcx, [rsp + 0x60]
call fcn.140008ab0
nop
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14001a690
nop
lea rcx, [rsp + 0x60]
call fcn.140008a50
nop
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140025150
cmp qword [rax + 0x18], 8
jb 0x14001cc21
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea rcx, [rsp + 0x20]
call fcn.140008840
nop
lea rcx, [rsp + 0x40]
call fcn.140008840
cmp ebx, 1
cmove edi, esi
lea rcx, [rbp - 0x80]
call fcn.140008840
mov eax, edi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.1400e9d60
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14001f600
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14001f622
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14001f69c
mov rdi, r14
mov rcx, rbx
call fcn.1400087c0
test rax, rax
jle 0x14001f674
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400ec270
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14001f68c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14001f694
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14001f636
sub r14, rdi
jmp 0x14001f789
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14001f6b3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14001f6b5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14001f6ea
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400ec270
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14001f786
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14001f725
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14001f761
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400f839c
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14001f79f
cmp rbp, rax
ja 0x14001f731
mov r8, rdi
test rdi, rdi
je 0x14001f786
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400f839c
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14001f789
Function at 0x14001ff40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14001ff6d
xor eax, eax
jmp 0x1400200b3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14001ffa7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14001ffa7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400200b3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400200a6
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14001ffea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14001fff9
movsx ecx, dil
jmp 0x14002004d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
js 0x1400200a6
cmp eax, 1
jle 0x140020067
cmp eax, 3
jne 0x1400200a6
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400f783c
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400200ab
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140020094
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1400f72d4
cmp rsi, rax
jne 0x1400200a6
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400200ab
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400e9d60
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140022800
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebx, dl
mov rdi, rcx
mov dword [rsp + 0x20], 0
cmp qword [rcx + 0x18], 8
jb 0x140022831
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002291f
test al, 0x10
je 0x14002291f
test bl, bl
je 0x14002290d
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 1
lea rax, [0x1400226a0]
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x50], 0
xor edx, edx
xor ecx, ecx
call fcn.140023fa0
mov rbx, rax
xor edx, edx
xor ecx, ecx
call fcn.140023fa0
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.1400241d0
mov byte [rsp + 0x50], 1
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140026ef0
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400228d9
cmp byte [rsp + 0x50], 0
je 0x1400228d0
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400228fe
cmp byte [rsp + 0x50], 0
je 0x1400228f5
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x48], 0
mov byte [rsp + 0x50], 0
lea rcx, [rsp + 0x28]
call fcn.14001b870
mov rcx, rdi
call fcn.1400261d0
test al, al
mov eax, dword [rsp + 0x20]
je 0x140022961
jmp 0x14002295f
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x14002292c
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140022956
mov edx, 0x80
mov rcx, rdi
call fcn.1400262d0
cmp qword [rdi + 0x18], 8
jb 0x14002294d
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
mov eax, dword [rsp + 0x20]
jne 0x140022961
inc eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e9d60
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret