joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502d80
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov ebp, dword [rdx + 0x24]
mov r14d, dword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
test ebp, ebp
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13, r9
je 0x502e60
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebp, eax
je 0x502dc6
mov dword [rbx + 0x24], 0xffffffff
mov rax, qword [rsi + 8]
lock add dword [rax + 0x30], 1
test r14b, r14b
jne 0x502e90
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x502ec1
lea r9, [rsp + 0x4c]
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x28], rdi
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x4c], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x4d2
je 0x502eb2
cmp eax, 0x3e5
setne dl
test ebx, ebx
mov rcx, qword [rsi + 8]
je 0x502e70
test dl, dl
je 0x502e70
mov r9d, dword [rsp + 0x4c]
mov r8d, eax
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x24], eax
jmp 0x502dc6
mov rdx, rdi
call fcn.00501f10
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 1
mov eax, 0x274d
jmp 0x502e32
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x503040
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov ebp, dword [rdx + 0x24]
mov r14d, dword [rsp + 0xb8]
mov rdi, qword [rsp + 0xc0]
test ebp, ebp
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13, r9
je 0x503131
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebp, eax
je 0x503086
mov dword [rbx + 0x24], 0xffffffff
mov rax, qword [rsi + 8]
lock add dword [rax + 0x30], 1
test r14b, r14b
jne 0x503160
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x503191
lea r9, [rsp + 0x48]
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x28], rdi
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x4c], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x40
je 0x503182
cmp eax, 0x4d2
je 0x5031c0
cmp eax, 0x3e5
setne dl
test ebx, ebx
mov rcx, qword [rsi + 8]
je 0x503140
test dl, dl
je 0x503140
mov r9d, dword [rsp + 0x48]
mov r8d, eax
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x24], eax
jmp 0x503086
mov rdx, rdi
call fcn.00501f10
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, qword [rsi + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 1
mov eax, 0x2746
jmp 0x503105
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 1
mov eax, 0x274d
jmp 0x503105
Function at 0x5031d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov ebp, dword [rdx + 0x24]
mov rdi, qword [rsp + 0xd8]
test ebp, ebp
mov rsi, rcx
mov rbx, rdx
mov r12, r8
mov r13, r9
je 0x5032e0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebp, eax
je 0x50320c
mov dword [rbx + 0x24], 0xffffffff
mov rax, qword [rsi + 8]
lock add dword [rax + 0x30], 1
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x503300
lea r9, [rsp + 0x58]
mov r8d, r13d
mov rdx, r12
mov qword [rsp + 0x38], rdi
mov eax, dword [rsp + 0xc8]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
mov ebx, eax
call qword [sym.imp.WSOCK32.dll_WSAGetLastError]
cmp eax, 0x4d2
je 0x5032f0
cmp eax, 0x3e5
setne dl
test ebx, ebx
mov rcx, qword [rsi + 8]
je 0x5032c0
test dl, dl
je 0x5032c0
mov r9d, dword [rsp + 0x58]
mov r8d, eax
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, rdi
call fcn.00501f10
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x24], eax
jmp 0x50320c
mov edx, 1
mov eax, 0x274d
jmp 0x50328f
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.00501fb0
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret

Function at 0x5039f0
Capabilities:
Check mutex on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x130
lea rbx, [rsp + 0x30]
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rbx
mov edx, pe_nt_image_headers64
mov qword [rsp + 0x20], rsi
lea r8, str.asio_58CCDC44_6264_4842_90C2_F3C545CB8AA7__u__p
mov r9d, eax
call qword [sym.imp.msvcrt.dll__snwprintf]
mov r8, rbx
xor ecx, ecx
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbx, rax
call rdi
test rbx, rbx
je 0x503ac3
cmp eax, 0xb7
je 0x503ab3
cmp byte [rsi], 0
jne 0x503a68
lea rcx, [rsi + 8]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
je 0x503a90
mov byte [rsi], 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
call rdi
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
add rsp, 0x130
pop rbx
pop rsi
pop rdi
ret
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x503a4d
call rdi
jmp 0x503a7c

Function at 0x503b70
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 1
lock xadd dword [rcx], eax
test eax, eax
je 0x503b80
ret
movzx edx, dl
movzx r8d, r8b
jmp fcn.004fc550
Function at 0x509010
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor eax, eax
mov rsi, rcx
mov rdi, rdx
lock xadd dword [rcx + 0x30], eax
test eax, eax
je 0x5090b4
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x007f4530]
mov rbp, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rbp
xor ebx, ebx
jmp 0x50907c
xor eax, eax
cmp rbx, 0xffffffffffffffff
setne al
add rbx, rax
mov rdx, rdi
mov rcx, rsi
call fcn.00508d40
test rax, rax
jne 0x509070
mov ecx, dword [0x007f4530]
mov rdx, qword [rsp + 0x40]
call rbp
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x5090a8
call fcn.007da050
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00508710
xor ebx, ebx
call fcn.004d6fb0
mov dword [rdi], 0
mov qword [rdi + 8], rax
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x509160
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rcx, qword [rcx + 0x10]
jmp fcn.00509010

Function at 0x509170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
mov rbx, rcx
mov rsi, rdx
lock xadd dword [rcx + 0x30], eax
test eax, eax
je 0x509200
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x007f4530]
mov rdi, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rdi
mov rdx, rsi
mov rcx, rbx
call fcn.00508d40
mov ecx, dword [0x007f4530]
mov rbx, rax
mov rdx, qword [rsp + 0x40]
call rdi
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x5091ef
call fcn.007da050
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.00508710
xor ebx, ebx
call fcn.004d6fb0
mov dword [rsi], 0
mov qword [rsi + 8], rax
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x509580
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor eax, eax
mov rsi, rcx
mov rdi, rdx
lock xadd dword [rcx + 0x30], eax
test eax, eax
je 0x509624
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x007f4530]
mov rbp, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rbp
xor ebx, ebx
jmp 0x5095ec
xor eax, eax
cmp rbx, 0xffffffffffffffff
setne al
add rbx, rax
mov rdx, rdi
mov rcx, rsi
call fcn.005092b0
test rax, rax
jne 0x5095e0
mov ecx, dword [0x007f4530]
mov rdx, qword [rsp + 0x40]
call rbp
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x509618
call fcn.007da050
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00508710
xor ebx, ebx
call fcn.004d6fb0
mov dword [rdi], 0
mov qword [rdi + 8], rax
mov rax, rbx
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x5096e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
xor eax, eax
mov rbx, rcx
mov rsi, rdx
lock xadd dword [rcx + 0x30], eax
test eax, eax
je 0x509770
lea rax, [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x007f4530]
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x38], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x30]
mov ecx, dword [0x007f4530]
mov rdi, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rdi
mov rdx, rsi
mov rcx, rbx
call fcn.005092b0
mov ecx, dword [0x007f4530]
mov rbx, rax
mov rdx, qword [rsp + 0x40]
call rdi
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x50975f
call fcn.007da050
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
call fcn.00508710
xor ebx, ebx
call fcn.004d6fb0
mov dword [rsi], 0
mov qword [rsi + 8], rax
mov rax, rbx
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x509de0
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rdx
mov rdi, rcx
mov r12d, r8d
xor ecx, ecx
xor r8d, r8d
mov edx, 1
call rbp
test rax, rax
mov rbx, rax
mov qword [rsi + 8], rax
je 0x509ea2
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rbp
mov qword [rdi + 8], rax
mov qword [rsi + 0x10], rax
cmp qword [rdi + 8], 0
je 0x509ee0
xor ecx, ecx
mov dword [rsp + 0x3c], 0
mov r9, rsi
mov edx, r12d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
lea r8, [0x004fc4c0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rdi], rax
je 0x509f62
test rbx, rbx
je 0x509e95
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rsi
mov r13d, eax
mov rax, qword [rsi]
call qword [rax + 8]
call fcn.004d6fb0
test r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x48], rax
je 0x509e1b
lea rcx, [rsp + 0x40]
lea rdx, str.thread.entry_event
call fcn.00508150
nop dword [rax]
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov rcx, rsi
mov ebp, eax
mov rax, qword [rsi]
call qword [rax + 8]
call fcn.004d6fb0
test ebp, ebp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rax
je 0x509f20
lea rcx, [rsp + 0x40]
lea rdx, str.thread.exit_event
call fcn.00508150
nop dword [rax + rax]
xor ecx, ecx
mov dword [rsp + 0x3c], 0
mov r9, rsi
mov edx, r12d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
lea r8, [0x004fc4c0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rdi], rax
jne 0x509e78
call r13
mov ebp, eax
jmp 0x509f6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 8]
test rbx, rbx
je 0x509f81
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x509f90
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004d6fb0
test ebp, ebp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rax
je 0x509e78
lea rcx, [rsp + 0x40]
lea rdx, str.thread
call fcn.00508150
nop
nop dword [rax + rax]
push rbx
sub rsp, 0x30
xor ebx, ebx
lock xadd dword [rcx + 4], ebx
test ebx, ebx
jne 0x509fd6
add rsp, 0x30
pop rbx
ret
call fcn.004d6fb0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
call fcn.00508150
nop
nop word cs:[rax + rax]
Function at 0x50a000
Capabilities:
Create thread

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
xor r9d, r9d
mov rbp, qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rdx
mov rdi, rcx
mov r12d, r8d
xor ecx, ecx
xor r8d, r8d
mov edx, 1
call rbp
test rax, rax
mov rbx, rax
mov qword [rsi + 8], rax
je 0x50a0c2
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rbp
mov qword [rdi + 8], rax
mov qword [rsi + 0x10], rax
cmp qword [rdi + 8], 0
je 0x50a101
xor ecx, ecx
mov dword [rsp + 0x3c], 0
mov r9, rsi
mov edx, r12d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
lea r8, [0x004fc4c0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rdi], rax
je 0x50a182
test rbx, rbx
je 0x50a0b5
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x20
mov rcx, rsi
mov r13d, eax
call fcn.007da070
call fcn.004d6fb0
test r13d, r13d
mov dword [rsp + 0x40], r13d
mov qword [rsp + 0x48], rax
je 0x50a03b
lea rcx, [rsp + 0x40]
lea rdx, str.thread.entry_event
call fcn.00508150
mov r13, qword [sym.imp.KERNEL32.dll_GetLastError]
call r13
mov edx, 0x20
mov rcx, rsi
mov ebp, eax
call fcn.007da070
call fcn.004d6fb0
test ebp, ebp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rax
je 0x50a140
lea rcx, [rsp + 0x40]
lea rdx, str.thread.exit_event
call fcn.00508150
nop dword [rax]
xor ecx, ecx
mov dword [rsp + 0x3c], 0
mov r9, rsi
mov edx, r12d
lea rax, [rsp + 0x3c]
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
lea r8, [0x004fc4c0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
test rax, rax
mov qword [rdi], rax
jne 0x50a098
call r13
mov ebp, eax
jmp 0x50a18a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov edx, 0x20
mov rcx, rsi
call fcn.007da070
test rbx, rbx
je 0x50a1a5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x50a1b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004d6fb0
test ebp, ebp
mov dword [rsp + 0x40], ebp
mov qword [rsp + 0x48], rax
je 0x50a098
lea rcx, [rsp + 0x40]
lea rdx, str.thread
call fcn.00508150
nop
nop dword [rax]
Function at 0x50af30
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
push rbx
sub rsp, 0x38
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov ebx, eax
je 0x50af50
mov eax, ebx
add rsp, 0x38
pop rbx
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.004d6fb0
test esi, esi
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x28], rax
je 0x50af43
lea rcx, [rsp + 0x20]
lea rdx, [0x0081661f]
call fcn.00508150
nop
nop dword [rax]

Function at 0x511b80
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov dword [r8], 0
mov rsi, rcx
mov rdi, rdx
mov rbp, r8
call fcn.004d6fb0
lea rbx, [rsp + 0x20]
mov rdx, rsi
mov qword [rbp + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rbx
call fcn.00602330
mov rdx, rdi
mov rcx, rsi
call fcn.00602330
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.msvcrt.dll__wrename]
test eax, eax
js 0x511c05
mov rcx, qword [rsp + 0x40]
add rsi, 0x10
cmp rcx, rsi
je 0x511be8
call fcn.007da050
mov rcx, qword [rsp + 0x20]
add rbx, 0x10
cmp rcx, rbx
je 0x511bfc
call fcn.007da050
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004d7020
mov rdi, rax
call qword [sym.imp.msvcrt.dll__errno]
mov rcx, qword [rsp + 0x40]
add rsi, 0x10
mov eax, dword [rax]
mov qword [rbp + 8], rdi
cmp rcx, rsi
mov dword [rbp], eax
jne 0x511be3
jmp 0x511be8

Function at 0x511d20
Capabilities:
Copy file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov dword [r8], 0
mov rsi, rcx
mov rbp, rdx
mov rdi, r8
call fcn.004d6fb0
lea rbx, [rsp + 0x20]
mov rdx, rsi
mov qword [rdi + 8], rax
lea rsi, [rsp + 0x40]
mov rcx, rbx
call fcn.00602330
mov rdx, rbp
mov rcx, rsi
call fcn.00602330
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x511db0
mov rcx, qword [rsp + 0x40]
add rsi, 0x10
cmp rcx, rsi
je 0x511d8b
call fcn.007da050
mov rcx, qword [rsp + 0x20]
add rbx, 0x10
cmp rcx, rbx
je 0x511d9f
call fcn.007da050
nop
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.004d6fb0
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
mov qword [rdi + 8], rbp
jmp 0x511d78
Function at 0x514080
Capabilities:
Delete directory
Delete file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x90
mov dword [rdx], 0
lea rbx, [rsp + 0x30]
mov rdi, rcx
mov rbp, rdx
call fcn.004d6fb0
mov byte [rsp + 0x40], 0
mov qword [rbp + 8], rax
lea rax, [rbx + 0x10]
mov r12, qword [rdi]
mov qword [rsp + 0x30], rax
mov rax, qword [rdi + 8]
mov qword [rsp + 0x38], 0
movzx edx, byte [r12 + rax - 1]
lea rsi, [rax - 1]
cmp dl, 0x2f
je 0x514140
cmp dl, 0x5c
je 0x514140
mov rdx, rdi
mov rcx, rbx
call fcn.0079ceb0
lea rsi, [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.00602330
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x514213
mov rcx, qword [rsp + 0x70]
lea rdx, [rsi + 0x10]
cmp rcx, rdx
je 0x51411a
call fcn.007da050
mov rcx, qword [rsp + 0x30]
add rbx, 0x10
cmp rcx, rbx
je 0x51412e
call fcn.007da050
nop
add rsp, 0x90
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdi, [rsp + 0x50]
cmp rsi, rax
cmova rsi, rax
mov rax, r12
lea rdx, [rdi + 0x10]
add rax, rsi
mov qword [rsp + 0x50], rdx
je 0x514170
test r12, r12
jne 0x514170
lea rcx, [0x00816838]
call fcn.007cd620
nop
cmp rsi, 0xf
mov qword [rsp + 0x28], rsi
ja 0x514240
cmp rsi, 1
je 0x514280
lea rcx, [rdi + 0x10]
test rsi, rsi
jne 0x514262
mov qword [rsp + 0x58], rsi
mov byte [rcx + rsi], 0
mov rdx, qword [rsp + 0x50]
lea rcx, [rdi + 0x10]
mov rax, qword [rsp + 0x30]
cmp rdx, rcx
je 0x5142f0
lea rcx, [rbx + 0x10]
cmp rax, rcx
je 0x5142b0
movdqu xmm0, xmmword [rsp + 0x58]
test rax, rax
mov qword [rsp + 0x30], rdx
mov rcx, qword [rsp + 0x40]
movups xmmword [rsp + 0x38], xmm0
je 0x5142c0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], 0
add rdi, 0x10
mov byte [rax], 0
mov rcx, qword [rsp + 0x50]
cmp rcx, rdi
je 0x5140e4
call fcn.007da050
jmp 0x5140e4
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
cmp eax, 5
je 0x514292
call fcn.004d6fb0
mov r12, rax
call rdi
mov dword [rbp], eax
mov qword [rbp + 8], r12
jmp 0x514107
lea rdx, [rsp + 0x28]
xor r8d, r8d
mov rcx, rdi
call fcn.0079cf60
mov rcx, rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x60], rax
mov r8, rsi
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rsi, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
jmp 0x514196
movzx eax, byte [r12]
lea rcx, [rdi + 0x10]
mov byte [rsp + 0x60], al
jmp 0x514196
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x514221
jmp 0x514107
movdqu xmm0, xmmword [rsp + 0x58]
mov qword [rsp + 0x30], rdx
movups xmmword [rsp + 0x38], xmm0
lea rax, [rdi + 0x10]
mov qword [rsp + 0x50], rax
jmp 0x5141eb
mov rdx, rdi
mov rcx, rbx
call fcn.0079ceb0
mov rax, qword [rsp + 0x50]
jmp 0x5141eb
Function at 0x514b40
Capabilities:
Create directory

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x308
mov r12, rdx
mov rdx, r8
mov rbp, rcx
mov rbx, r8
call fcn.00513710
test al, al
jne 0x514b92
mov eax, dword [rbx]
test eax, eax
je 0x514b82
add rsp, 0x308
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8, rbx
mov rdx, r12
mov rcx, rbp
call fcn.00511d20
jmp 0x514b6e
mov dword [rbx], 0
lea rdi, [rsp + 0xa0]
call fcn.004d6fb0
mov rdx, r12
mov rcx, rdi
mov qword [rbx + 8], rax
call fcn.00602330
xor edx, edx
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x514d61
mov rcx, qword [rsp + 0xa0]
lea rax, [rdi + 0x10]
cmp rcx, rax
je 0x514be2
call fcn.007da050
mov ecx, dword [rbx]
test ecx, ecx
jne 0x514b6e
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.00514720
cmp byte [rsp + 0x2fc], 0
jne 0x514d90
lea r15, [rsp + 0x60]
mov r13, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [r15 + 0x10]
lea r14, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [r14 + 0x10]
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x514c47
add dword [rsp + 0xa8], 1
cmp byte [rsp + 0x2fc], 0
jne 0x514d90
mov rdx, rdi
mov rcx, rsi
call fcn.00514a30
lea rdx, [0x008168e0]
mov rcx, rsi
call fcn.007160d0
test eax, eax
jne 0x514cc5
mov rcx, qword [rsp + 0x40]
lea rax, [rsi + 0x10]
cmp rcx, rax
je 0x514c78
call fcn.007da050
mov dword [rbx], 0
call fcn.004d6fb0
lea rdx, [rdi + 0xc]
mov rcx, qword [rsp + 0xa0]
mov qword [rbx + 8], rax
call r13
test eax, eax
jne 0x514c31
mov byte [rsp + 0x2fc], 1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
mov dword [rsp + 0x2c], eax
je 0x514c31
call fcn.004d6fb0
mov edx, dword [rsp + 0x2c]
mov qword [rbx + 8], rax
mov dword [rbx], edx
jmp 0x514c31
lea rdx, [0x008168d2]
mov rcx, rsi
call fcn.007160d0
test eax, eax
je 0x514c65
mov r8, rsi
mov rdx, r12
mov rcx, r14
call fcn.00512ab0
mov r8, rsi
mov rdx, rbp
mov rcx, r15
call fcn.00512ab0
mov r8, rbx
mov rdx, r14
mov rcx, r15
call fcn.00514b40
mov rcx, qword [rsp + 0x60]
cmp rcx, qword [rsp + 0x30]
je 0x514d13
call fcn.007da050
mov rcx, qword [rsp + 0x80]
cmp rcx, qword [rsp + 0x38]
je 0x514d27
call fcn.007da050
mov edx, dword [rbx]
test edx, edx
je 0x514c65
mov rcx, qword [rsp + 0x40]
add rsi, 0x10
cmp rcx, rsi
je 0x514d44
call fcn.007da050
mov rcx, qword [rsp + 0xa0]
cmp rcx, 0xffffffffffffffff
je 0x514b6e
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x514b6e
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0xb7
je 0x514bcc
call fcn.004d6fb0
mov r13, rax
call rsi
mov dword [rbx], eax
mov qword [rbx + 8], r13
jmp 0x514bcc
mov rcx, qword [rsp + 0xa0]
cmp rcx, 0xffffffffffffffff
je 0x514b6e
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x514b6e