joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180098c30
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x48
test dword [rcx + 0x58], 0x200
mov r15d, r9d
mov r12d, r8d
mov dword [rsp + 0x30], 0
mov rdi, rdx
mov rbx, rcx
je 0x180098c65
xor eax, eax
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
mov qword [rsp + 0x80], rsi
mov esi, r15d
and esi, 1
je 0x180098c85
cmp word [rdx], 0x17
je 0x180098c85
mov eax, 0x57
jmp 0x180098d7e
cmp qword [rcx + 0x70], 0xffffffffffffffff
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x40], r14
jne 0x180098cde
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.WS2_32.dll_socket]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180098d63
movzx r9d, word [rdi]
mov r8, rax
mov rcx, qword [rbx + 8]
mov rdx, rbx
call fcn.1800994a0
mov r14d, eax
test eax, eax
je 0x180098cde
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, r14d
jmp 0x180098d74
test r15b, 4
je 0x180098d13
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x70]
mov edx, 0xffff
mov dword [rsp + 0x70], 1
mov r8d, 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x180098d63
movzx eax, word [rdi]
cmp ax, 0x17
jne 0x180098d4e
or dword [rbx + 0x58], 0x1000000
movzx eax, word [rdi]
cmp ax, 0x17
jne 0x180098d4e
test esi, esi
jne 0x180098d4e
mov rcx, qword [rbx + 0x70]
lea r9, [rsp + 0x30]
lea edx, [rsi + 0x29]
mov dword [rsp + 0x20], 4
lea r8d, [rsi + 0x1b]
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx + 0x70]
mov r8d, r12d
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x180098d6b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x180098d74
or dword [rbx + 0x58], 0x200
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x80]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbx
ret
Function at 0x1800994a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x2d0
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
cmp qword [rdx + 0x70], 0xffffffffffffffff
mov esi, r9d
mov rdi, r8
mov dword [rsp + 0x30], 1
mov rbx, rdx
mov rbp, rcx
je 0x1800994e6
mov eax, 0xfffff00e
jmp 0x1800995d6
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x180099509
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1800995d6
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x180099528
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1800995d6
mov rdx, qword [rbp + 0x38]
xor r9d, r9d
mov r8, rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x18009951d
cmp qword [0x18012e0f8], 0
je 0x1800995c4
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x274
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x2005
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getsockopt]
cmp eax, 0xffffffff
je 0x18009951d
cmp dword [rsp + 0x68], 1
jne 0x1800995c4
mov dl, 3
mov rcx, rdi
call qword [0x18012e0f8]
test eax, eax
je 0x1800995b5
or dword [rbx + 0x58], 0x40000
lea rax, [0x180002ba3]
mov qword [rbx + 0x198], rax
lea rax, [0x180001ff0]
mov qword [rbx + 0x1a0], rax
jmp 0x1800995c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 1
jne 0x18009951d
mov qword [rbx + 0x70], rdi
cmp esi, 0x17
jne 0x1800995d4
or dword [rbx + 0x58], 0x1000000
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.180002752
mov rbx, qword [rsp + 0x308]
add rsp, 0x2d0
pop rdi
pop rsi
pop rbp
ret
Function at 0x18009b3a0
Capabilities:
Connect pipe
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
test r9d, r9d
jne 0x18009b49b
mov rcx, qword [rdi + 0x120]
mov r9d, 0xff
mov qword [rax - 0x10], rbp
xor r8d, r8d
mov dword [rax - 0x18], ebp
mov edx, 0x40000003
mov dword [rax - 0x20], 0x10000
mov dword [rax - 0x28], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
cmp rax, 0xffffffffffffffff
jne 0x18009b45b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x18009b414
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18009b422
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x18009b44e
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x18009b540
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
jmp 0x18009b540
mov r9d, 0xffffffff
mov dword [rsp + 0x20], ebp
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call fcn.18009cd30
test eax, eax
je 0x18009b49b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x18009b414
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18009b422
xorps xmm0, xmm0
mov qword [rsp + 0x50], r14
movups xmmword [rbx + 0x40], xmm0
lea rdx, [rbx + 0x40]
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
jne 0x18009b53b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
je 0x18009b53b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x217
jne 0x18009b4dc
mov rax, rbp
jmp 0x18009b510
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x18009b500
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18009b50e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
mov qword [rbx + 0x68], rbp
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x18009b533
mov rax, qword [rax + 0x68]
mov qword [rbx + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rbx
jmp 0x18009b537
mov qword [rbx + 0x68], rbx
mov qword [rsi + 0x48], rbx
mov r14, qword [rsp + 0x50]
inc dword [rdi + 0x78]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x18009b5d0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
test dword [rdx + 0x58], 0x1000000
lea rdi, [rdx + 0x80]
mov rbx, rdx
mov rsi, rcx
je 0x18009b610
mov r8d, select
lea rcx, [0x18009c1d0]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
jmp 0x18009b6c3
lea rcx, [rdi + 0x40]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
test dword [rdx + 0x58], 0x100000
je 0x18009b633
mov rax, qword [rdi + 0x70]
or rax, 1
mov qword [rdi + 0x58], rax
mov qword [rsp + 0x20], rcx
lea rdx, [0x18012d665]
mov rcx, qword [rbx + 0x118]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18009b663
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x18009b6c7
test dword [rbx + 0x58], 0x100000
je 0x18009b71e
cmp qword [rdi + 0x70], 0
jne 0x18009b694
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x70], rax
test rax, rax
je 0x18009b740
cmp qword [rdi + 0x78], 0xffffffffffffffff
lea rcx, [rdi + 0x78]
jne 0x18009b71e
mov rdx, qword [rdi + 0x58]
lea r8, [0x180099be0]
mov dword [rsp + 0x28], 4
mov r9, rdi
mov dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
test eax, eax
jne 0x18009b71e
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x18009b6d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18009b6e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rdi + 0x40], rax
mov qword [rdi + 0x68], 0
mov rax, qword [rsi + 0x48]
test rax, rax
je 0x18009b714
mov rax, qword [rax + 0x68]
mov qword [rdi + 0x68], rax
mov rax, qword [rsi + 0x48]
mov qword [rax + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x18009b726
mov qword [rdi + 0x68], rdi
mov qword [rsi + 0x48], rdi
jmp 0x18009b726
mov rcx, rbx
call fcn.180099890
or dword [rbx + 0x58], 0x20000
inc dword [rbx + 0x78]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
lea rdx, str.CreateEvent
call fcn.180002982
int3
Function at 0x18009cee0
Capabilities:
Create pipe

Disassembly:
jmp 0x18009cee0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, qword [rsp + 0x90]
mov rsi, rdx
mov r15d, r8d
mov r14, rdx
mov r13, rcx
mov r8, r12
mov rcx, rsi
mov rdx, r9
mov rbp, r9
call fcn.18009d070
xor eax, eax
or r15d, 0x40080000
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov dword [rsp + 0x30], eax
mov edx, r15d
mov dword [rsp + 0x28], 0x10000
mov rcx, rbp
lea r9d, [rax + 1]
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x18009cfbc
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0xe7
je 0x18009cf74
cmp eax, 5
jne 0x18009cfdc
inc rsi
mov r8, r12
mov rcx, rsi
mov rdx, rbp
call fcn.18009d070
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov edx, r15d
mov dword [rsp + 0x30], eax
mov rcx, rbp
mov dword [rsp + 0x28], 0x10000
lea r9d, [rax + 1]
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18009cf60
mov rdx, qword [r13 + 0x38]
xor r9d, r9d
mov r8, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x18009cfef
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp rdi, 0xffffffffffffffff
je 0x18009cfeb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
jmp 0x18009d000
mov rcx, r14
call fcn.18009aa40
xor eax, eax
mov qword [r14 + 0x118], rdi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x18009eff0
Capabilities:
Manipulate console buffer

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xb8]
mov r15d, r9d
movzx r14d, r8b
mov ebp, edx
mov rbx, rcx
cmp dword [rdi], 0
je 0x18009f02e
mov eax, 0xffffffff
jmp 0x18009f0b0
mov qword [rsp + 0x58], rsi
movzx esi, byte [rsp + 0xb0]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x110]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
jne 0x18009f05e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov byte [rsp + 0x28], sil
lea rdx, [rsp + 0x30]
movzx r9d, r14b
mov dword [rsp + 0x20], r15d
mov r8d, ebp
mov rcx, rbx
call fcn.18009ef30
mov rcx, qword [rbx + 0x110]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
jne 0x18009f0a9
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x18009f040
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov eax, 0xffffffff
jmp 0x18009f0ab
xor eax, eax
mov rsi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180002752
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x18009f580
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x18009f580
push rbx
sub rsp, 0x50
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
mov ecx, dword [rcx + 0x58]
btr ecx, 8
mov eax, ecx
sub dword [rbx + 0x7c], 1
mov dword [rbx + 0x58], ecx
jne 0x18009f5c8
test cl, 1
jne 0x18009f5c8
test cl, 0x40
je 0x18009f5c8
and eax, 0xffffffbf
mov dword [rbx + 0x58], eax
test al, 0x20
je 0x18009f5c8
mov rax, qword [rbx + 8]
dec dword [rax + 8]
mov eax, dword [rbx + 0x58]
and eax, 0x2020000
cmp eax, 0x2020000
jne 0x18009f61a
mov rcx, qword [rbx + 0x110]
lea r9, [rsp + 0x20]
xor eax, eax
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x28], xmm0
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x18009f61a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret
mov rcx, qword [rbx + 0x118]
test rcx, rcx
je 0x18009f637
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x118], 0
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180002752
add rsp, 0x50
pop rbx
ret

Function at 0x18009f680
Capabilities:
Manipulate console buffer

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180118258]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx ebp, word [reloc.WS2_32.dll_getsockopt]
xor r14d, r14d
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x30], r14d
cmp dword [rdx], r14d
jne 0x18009f6d2
mov rcx, qword [rcx + 0x110]
movzx edx, bp
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
test eax, eax
jne 0x18009f6dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
jmp 0x18009f78e
mov rcx, qword [rdi + 0x110]
mov qword [rsp + 0x90], rbx
mov ebx, dword [rsp + 0x30]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
test eax, eax
je 0x18009f779
nop
mov rcx, qword [rdi + 0x110]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x18009f779
movsx eax, word [rsp + 0x38]
mov edx, 0x20
movsx r8d, word [rsp + 0x3a]
mov r9d, ebx
mov rcx, qword [rdi + 0x110]
imul r8d, eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
test eax, eax
je 0x18009f76e
mov r8d, dword [rsp + 0x34]
lea rax, [rsp + 0x34]
mov rcx, qword [rdi + 0x110]
mov r9d, ebx
movzx edx, bp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
test eax, eax
jne 0x18009f7ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
je 0x18009f700
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180002752
mov rbp, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
lea rcx, [rsp + 0x38]
mov dword [0x180118068], r14d
call fcn.1800a0080
xor eax, eax
jmp 0x18009f786
Function at 0x1800a46c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [rsp + 0x80]
xor ebp, ebp
mov r12, r9
mov rsi, rdx
mov rdi, rcx
cmp rdx, 2
jbe 0x1800a470f
cmp word [rcx], 0x5c
jne 0x1800a4715
cmp word [rcx + 2], 0x5c
jne 0x1800a4715
mov rbx, rbp
jmp 0x1800a47a0
cmp rsi, 1
jb 0x1800a472b
movzx eax, word [rcx]
cmp ax, 0x2f
je 0x1800a4724
cmp ax, 0x5c
jne 0x1800a472b
mov ebx, 2
jmp 0x1800a47a0
cmp rsi, 2
jb 0x1800a4798
cmp word [rcx + 2], 0x3a
jne 0x1800a477f
lea r14, [rcx + 4]
cmp rsi, 3
jb 0x1800a4752
movzx eax, word [r14]
cmp ax, 0x2f
je 0x1800a4785
cmp ax, 0x5c
je 0x1800a4785
mov rbx, qword [rsp + 0x88]
cmp rbx, 2
jb 0x1800a4707
mov rdx, rcx
mov r8d, 2
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x1800a4707
mov rdi, r14
sub rsi, 2
jmp 0x1800a47a0
cmp rsi, 2
jbe 0x1800a4798
cmp word [rcx + 2], 0x3a
mov rbx, qword [rsp + 0x88]
cmove rbx, rbp
jmp 0x1800a47a0
mov rbx, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
lea rcx, [rsi + r12]
add rcx, rbp
add rcx, rbx
lea rcx, [rcx*2 + 8]
call fcn.180001aeb
mov r9, 0xffffffffffffffff
mov r8, r13
mov rdx, rbx
mov rcx, rax
mov r15, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea r14, [r15 + rbx*2]
mov r13d, 0x5c
test rbx, rbx
je 0x1800a4802
movzx edx, word [r14 - 2]
lea rcx, [0x1800ed948]
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
jne 0x1800a4802
mov word [r14], r13w
add r14, 2
mov r9, 0xffffffffffffffff
mov r8, rdi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rbx, [r14 + rsi*2]
test rsi, rsi
je 0x1800a483e
movzx edx, word [rbx - 2]
lea rcx, [0x1800ed948]
call sub.VCRUNTIME140.dll_wcsrchr
test rax, rax
jne 0x1800a483e
mov word [rbx], r13w
add rbx, 2
mov r8, qword [rsp + 0x60]
mov r9, 0xffffffffffffffff
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rbx, [rbx + r12*2]
test rbp, rbp
je 0x1800a4893
test r12, r12
je 0x1800a4877
cmp word [rbx - 2], 0x2e
je 0x1800a4877
mov eax, 0x2e
mov word [rbx], ax
add rbx, 2
mov r8, qword [rsp + 0x70]
mov r9, 0xffffffffffffffff
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rbx, [rbx + rbp*2]
xor eax, eax
mov rcx, r15
mov word [rbx], ax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800a48af
test al, 0x10
jne 0x1800a48af
mov rax, r15
jmp 0x1800a48b9
mov rcx, r15
call fcn.180003bf2
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800a4a80
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
test edx, edx
je 0x1800a4afe
cmp edx, 0xf
ja 0x1800a4aee
mov eax, 0x8204
bt eax, edx
jae 0x1800a4aee
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x1800a4b3f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x1800a4adc
lea rdx, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1800a4adc
cmp dword [rsp + 0x38], 0x103
jne 0x1800a4b2f
mov ecx, edi
call fcn.180001f37
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xfffff02a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x1800a4b25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180001f37
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp dword [rsp + 0x38], 0x103
je 0x1800a4b3f
mov eax, 0xfffff038
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1800a55d0
Capabilities:
Terminate process

Disassembly:
jmp 0x1800a55d0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov rsi, rdx
mov qword [rsp + 0x30], rax
mov edi, ecx
mov dword [rsp + 0x28], eax
mov r8d, ecx
mov qword [rsp + 0x58], rax
mov r9d, 0x400
lea rax, [rsp + 0x58]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rax, qword [rsp + 0x58]
lea rbx, str.Unknown_error
test rax, rax
mov ecx, 2
cmovne rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
test rsi, rsi
je 0x1800a5653
mov r9d, edi
mov qword [rsp + 0x20], rbx
mov r8, rsi
lea rdx, str._s:___d___s
call fcn.180003b43
jmp 0x1800a5665
mov r9, rbx
lea rdx, str.__d___s
mov r8d, edi
call fcn.180003b43
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1800a5675
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1800a5d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1800a5d4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
test byte [rbx + 0x148], 2
je 0x1800a5d81
and al, 0x11
cmp al, 1
jne 0x1800a5d81
mov ecx, 0xfffff030
mov dword [rbx + 0x14c], 0xfffff030
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x88], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800a6a40
Capabilities:
Create directory

Disassembly:
jmp 0x1800a6a40
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wmkdir]
movsxd rdx, eax
mov qword [rbx + 0x88], rdx
cmp rdx, 0xffffffffffffffff
jne 0x1800a6a83
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1800a7260
Capabilities:
Read file on windows

Disassembly:
jmp 0x1800a7260
push rbx
push rbp
sub rsp, 0x58
mov rbx, rcx
mov ecx, dword [rcx + 0x150]
mov rbp, qword [rbx + 0x180]
cmp ecx, 0xffffffff
jne 0x1800a7298
mov dword [rbx + 0x14c], 6
mov qword [rbx + 0x88], 0xfffffffffffff00d
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x50], r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__get_osfhandle]
mov r15, rax
cmp rax, 0xffffffffffffffff
jne 0x1800a72d4
lea ecx, [rax + 7]
mov dword [rbx + 0x14c], 6
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
xor edi, edi
mov qword [rsp + 0x88], r14
cmp rbp, 0xffffffffffffffff
je 0x1800a7305
xorps xmm0, xmm0
lea r14, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
jmp 0x1800a7308
mov r14, rdi
mov esi, edi
nop word [rax + rax]
cmp rbp, 0xffffffffffffffff
je 0x1800a7327
mov eax, esi
add rax, rbp
mov dword [rsp + 0x40], eax
shr rax, 0x20
mov dword [rsp + 0x44], eax
mov rax, qword [rbx + 0x178]
lea r9, [rsp + 0x70]
mov ecx, edi
add rcx, rcx
mov qword [rsp + 0x20], r14
mov r8d, dword [rax + rcx*8]
mov rdx, qword [rax + rcx*8 + 8]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
add esi, dword [rsp + 0x70]
inc edi
test eax, eax
je 0x1800a738b
cmp edi, dword [rbx + 0x170]
jb 0x1800a7310
mov eax, esi
mov qword [rbx + 0x88], rax
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x50]
add rsp, 0x58
pop rbp
pop rbx
ret
test esi, esi
jne 0x1800a7361
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x26
je 0x1800a7361
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
jmp 0x1800a736a

Function at 0x1800a7a50
Capabilities:
Move file

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x160]
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1800a7a9a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov dword [rbx + 0x14c], eax
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x88], 0
add rsp, 0x20
pop rbx
ret

Function at 0x1800a7ad0
Capabilities:
Delete directory

Disassembly:
jmp 0x1800a7ad0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x150]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrmdir]
movsxd rdx, eax
mov qword [rbx + 0x88], rdx
cmp rdx, 0xffffffffffffffff
jne 0x1800a7b13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___doserrno]
mov ecx, dword [rax]
mov dword [rbx + 0x14c], ecx
call fcn.180001f37
movsxd rcx, eax
mov qword [rbx + 0x88], rcx
add rsp, 0x20
pop rbx
ret