joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140131b80
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov eax, 1
test rcx, rcx
jne 0x140131c33
mov rax, qword [0x140202858]
cmp rax, 3
jne 0x140131c5b
mov rsi, rdx
mov rcx, rdx
mov edx, 1
call fcn.14012e760
test rax, rax
je 0x140131bc1
mov eax, 1
jmp 0x140131c33
cmp word [rsi], 0
je 0x140131be3
movups xmm0, xmmword [rsi + 4]
mov eax, dword [rsi + 0x14]
mov r9d, dword [rsi + 0x18]
movzx ecx, word [rsi + 0x1c]
mov r8d, 0x1c
mov r10w, 0x17
jmp 0x140131bf8
mov eax, dword [rsi + 2]
movzx ecx, word [rsi + 6]
mov r8d, 0x10
mov r10w, 2
xorps xmm0, xmm0
rol cx, 8
mov word [rsp + 0x2c], r10w
mov word [rsp + 0x2e], cx
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x34], xmm0
mov dword [rsp + 0x44], r9d
lea rax, [rsp + 0x2c]
mov rsi, rdx
mov rcx, rdx
mov rdx, rax
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
je 0x140131c3a
xor eax, eax
mov rdx, rsi
add rsp, 0x48
pop rdi
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rdx, rdi
jmp 0x140131bba
mov rsi, rdx
call fcn.140154780
mov rdx, rsi
jmp 0x140131ba5

Function at 0x140131db0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, rdx
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x2c], 0x80
lea rdx, [rsp + 0x30]
lea r8, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ws2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x140131e60
mov eax, dword [rsp + 0x2c]
movzx ecx, word [rsp + 0x30]
cmp ecx, 2
je 0x140131e70
cmp ecx, 0x17
jne 0x140131e97
cmp eax, 0x1b
jbe 0x140131eb0
movzx eax, word [rsp + 0x32]
rol ax, 8
movups xmm0, xmmword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x48]
mov word [rsi], 1
movups xmmword [rsi + 4], xmm0
mov dword [rsi + 0x14], ecx
mov dword [rsi + 0x18], edx
mov word [rsi + 0x1c], ax
add rsp, 0xb0
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
jmp 0x140131e9e
cmp eax, 0xf
jbe 0x140131ec8
movzx eax, word [rsp + 0x32]
rol ax, 8
mov ecx, dword [rsp + 0x34]
mov word [rsi], 0
mov word [rsi + 6], ax
mov dword [rsi + 2], ecx
add rsp, 0xb0
pop rsi
ret
lea rax, str.invalid_argument8
mov qword [rsi + 8], rax
mov word [rsi], 2
add rsp, 0xb0
pop rsi
ret
lea rcx, str.assertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in6___
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
mov edx, 0x43
call fcn.140155a10
lea rcx, [0x1401b1c79]
lea r8, str.library_std_src_sys_common_net.rsassertion_failed:_len_as_usize___mem::size_of::_c::sockaddr_in___
mov edx, 0x42
call fcn.140155a10
int3
Function at 0x140131fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
sub rsp, 0x50
mov rax, r8
cmp r8, 0x7fffffff
mov r8d, 0x7fffffff
cmovb r8, rax
cmp word [r9], 0
je 0x14013201e
movups xmm0, xmmword [r9 + 4]
mov eax, dword [r9 + 0x14]
mov r11d, dword [r9 + 0x18]
movzx r10d, word [r9 + 0x1c]
mov r9d, 0x1c
mov si, 0x17
jmp 0x140132034
mov eax, dword [r9 + 2]
movzx r10d, word [r9 + 6]
mov r9d, 0x10
mov si, 2
xorps xmm0, xmm0
rol r10w, 8
mov word [rsp + 0x34], si
mov word [rsp + 0x36], r10w
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x3c], xmm0
mov dword [rsp + 0x4c], r11d
mov rcx, qword [rcx]
mov dword [rsp + 0x28], r9d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
call qword [sym.imp.ws2_32.dll_sendto]
cmp eax, 0xffffffff
je 0x14013207d
movsxd rdx, eax
xor eax, eax
add rsp, 0x50
pop rsi
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0x50
pop rsi
ret
Function at 0x140146ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140146b5a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140146b50
cmp r11, r10
ja 0x140146be5
cmp r10, rdx
ja 0x140146bf7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140146b52
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140146b30
jmp 0x140146bc7
ja 0x140146b5a
mov r11, r10
cmp rax, r8
jne 0x140146b02
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140146bcb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140146ba0
mov r8, r10
sub ecx, r9d
jns 0x140146bbe
jmp 0x140146bcd
cmp r10, rdx
je 0x140146bd9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140146bcd
xor al, 1
cmp r8, rdx
jne 0x140146b80
jmp 0x140146bcd
xor eax, eax
jmp 0x140146bcd
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140155900
lea r8, str.0_e_
mov rcx, r11
mov rdx, r10
call fcn.140155ea0
lea r8, str.0_e_
mov rcx, r10
call fcn.140155e90
int3

Function at 0x140149390
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401493da
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401493da
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401493da
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401493da
cmp dword [rcx + 0x84], 0xe
jbe 0x1401493da
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401493dc
xor al, al
add rsp, 0x28
ret
Function at 0x14014ee00
Capabilities:
Link many functions at runtime

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
lea rcx, [0x1401700c5]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14014ee61
mov rdi, rax
lea rdx, [0x1401700e6]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014ee61
mov rsi, rax
lea rdx, [0x1401700f4]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014ee61
mov rdi, rax
xor ebx, ebx
jmp 0x14014eee7
lea rcx, [0x140170080]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14014ef5f
mov rsi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014ef5f
mov rdi, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014ef5f
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14014ef5f
mov rsi, rax
lea rcx, [rbp - 0x40]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rdi
test eax, eax
jne 0x14014ef5f
mov rdi, qword [rbp - 0x40]
movzx eax, byte [0x140202701]
mov ecx, 0x18
mov edx, 8
call fcn.14001c710
test rax, rax
je 0x14014ef94
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
xor eax, eax
lock cmpxchg qword [0x140202728], rcx
je 0x14014ef53
mov rsi, rax
cmp qword [rcx], 0
mov qword [rbp - 8], rcx
je 0x14014ef3c
mov rax, qword [rbp - 8]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x18
mov r8d, 8
mov rcx, qword [rbp - 8]
call fcn.14001c720
mov rcx, rsi
mov rax, rcx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea rax, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 1
lea rax, [0x140170080]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
lea rdx, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.10_src_thread_parkerwindowsmod.rs
lea rcx, [rbp - 0x40]
call fcn.140155940
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
mov ecx, 8
mov edx, 0x18
call fcn.140155720
ud2
Function at 0x1401547f0
Capabilities:
Resolve dns

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
mov r14, r9
mov rsi, rcx
lea rcx, [rsp + 0x30]
call fcn.140139dc0
mov rdx, qword [rsp + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
jne 0x14015487b
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x28], 0
lea r8, [rsp + 0x50]
lea r9, [rsp + 0x28]
mov rcx, rdi
xor edx, edx
call qword [sym.imp.ws2_32.dll_getaddrinfo]
test eax, eax
je 0x1401548ae
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
mov ecx, 1
jmp 0x1401548c3
lea rax, str.file_name_contained_an_unexpected_NUL_byte
mov qword [rsi + 8], rax
mov qword [rsi], 1
test rdx, rdx
je 0x1401548e3
mov rcx, qword [rsp + 0x38]
mov r8d, 1
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.14001c720
mov rcx, qword [r14]
mov rax, qword [rsp + 0x28]
movzx ecx, word [rcx]
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
xor ecx, ecx
mov qword [rsi + 8], rax
mov qword [rsi], rcx
mov byte [rdi], 0
test rbx, rbx
je 0x1401548e3
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.14001c720
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x180003a50
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
lea r9, [rcx + 0xc0]
cmp qword [r9 + 0x18], 8
jb 0x180003a9f
mov r9, qword [r9]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x180003c1b
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x180030910]
lea rcx, [rsp + 0x38]
call fcn.180002fc0
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.1800170e0
mov r8d, edi
lea rdx, [0x1800307c4]
lea rcx, [rbp - 0x80]
call fcn.180003240
lea rax, [rbp - 0x80]
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
cmp byte [rbx + 9], r15b
je 0x180003b76
call fcn.180003910
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180003b74
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180003b52
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180003110
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180002b20
nop
jmp 0x180003bc7
call fcn.180003a10
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180003bc7
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180003ba5
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180003110
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180002b20
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180003be4
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.180003110
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180019400
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180003c19
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.180003110
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.180014180
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180003c40
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.1800170e0
lea rax, [rbp + 0xc0]
cmp qword [rax + 0x18], 8
jb 0x180003cad
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x180003ce6
mov rax, qword [rbx]
jmp 0x180003ce9
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x180003d0a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180003d00
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.180002fc0
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x180003d2e
mov rax, qword [rbx]
jmp 0x180003d31
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180003d56
add rax, 2
test edx, edx
jne 0x180003d40
test r10d, r10d
jne 0x180003da8
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 9], r10b
je 0x180003d7b
call fcn.180003910
jmp 0x180003d80
call fcn.180003a10
mov rdx, rax
mov rcx, rbx
call fcn.180002a70
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180003da8
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.180003110
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180014180
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180004eb0
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call fcn.1800170e0
cmp qword [rdi + 0x58], 8
lea r8, [rdi + 0x40]
jb 0x180004efe
mov r8, qword [r8]
lea r9, str.Config
lea rdx, [0x1800309e8]
lea rcx, [rsp + 0x40]
call fcn.180003240
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180004f2f
lea rcx, [rsp + 0x40]
call fcn.18000ab70
xor edx, edx
lea rcx, [rbp + 0x150]
mov r8d, 0x208
call fcn.1800170e0
lea r9, str.UseVestige.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x150]
call fcn.180003240
xor ebx, ebx
cmp word [rbp + 0x150], bx
jne 0x180004f72
mov r8d, ebx
jmp 0x180004f8a
lea rax, [rbp + 0x150]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180004f80
lea rcx, [rdi + 0xc0]
lea rdx, [rbp + 0x150]
call fcn.180002fc0
xor edx, edx
lea rcx, [rbp + 0x360]
mov r8d, 0x208
call fcn.1800170e0
lea r9, str.UseCache.ini
lea r8, [rsp + 0x40]
lea rdx, str._s_s
lea rcx, [rbp + 0x360]
call fcn.180003240
cmp word [rbp + 0x360], bx
jne 0x180004fde
mov r8, rbx
jmp 0x180004ffa
lea rax, [rbp + 0x360]
or r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x180004ff0
lea rcx, [rdi + 0xe0]
lea rdx, [rbp + 0x360]
call fcn.180002fc0
xor edx, edx
lea rcx, [rbp + 0x570]
mov r8d, 0x208
call fcn.1800170e0
lea rdx, str.ShxlPath
lea rcx, [rsp + 0x20]
call fcn.18000b090
cmp qword [rax + 0x18], 8
jb 0x18000503c
mov rax, qword [rax]
mov r8, rax
lea rdx, [0x180030a4c]
lea rcx, [rbp + 0x570]
call fcn.180003240
mov r8, qword [rsp + 0x38]
cmp r8, 8
jb 0x18000506f
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x20]
inc r8
call fcn.180003110
lea rcx, [rbp + 0x570]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000508c
lea rcx, [rbp + 0x570]
call fcn.18000ab70
xor edx, edx
lea rcx, [rbp + 0x780]
mov r8d, 0x208
call fcn.1800170e0
lea r9, str.UseCache.ini
lea r8, [rbp + 0x570]
lea rdx, str._s_s
lea rcx, [rbp + 0x780]
call fcn.180003240
cmp word [rbp + 0x780], bx
je 0x1800050df
lea rax, [rbp + 0x780]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1800050d5
lea rcx, [rdi + 0x100]
mov r8, rbx
lea rdx, [rbp + 0x780]
call fcn.180002fc0
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.180014180
lea r11, [rsp + 0xaa0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000a7d0
Capabilities:
Check if file exists
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov eax, 0x1070
call fcn.1800141e0
sub rsp, rax
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov rsi, rcx
mov rdi, rdx
xor ecx, ecx
call fcn.18001c0d0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x58], rax
call fcn.18001c918
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [rbx]
lea rdx, str.__d__d__d__d__d__d___d_:_s
mov r9d, dword [rbx + 0x10]
mov r8d, dword [rbx + 0x14]
inc r9d
mov qword [rsp + 0x48], rdi
add r8d, 0x76c
mov dword [rsp + 0x40], eax
mov eax, dword [rbx + 0xc]
mov dword [rsp + 0x38], ecx
mov ecx, dword [rbx + 4]
mov dword [rsp + 0x30], ecx
mov ecx, dword [rbx + 8]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], eax
call fcn.18000a630
mov rcx, rsi
xor edi, edi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebp, 1
lea rdx, [0x1800311b0]
test eax, eax
mov rcx, rsi
cmovne edi, ebp
call fcn.18001c4bc
mov rbx, rax
test rax, rax
je 0x18000a923
test edi, edi
jne 0x18000a8b4
mov eax, 0xfeff
lea r8d, [rbp + 1]
mov r9, rbx
mov word [rsp + 0x54], ax
mov edx, ebp
lea rcx, [rsp + 0x54]
call fcn.1800188d8
lea rcx, [rsp + 0x60]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x18000a8c0
add eax, eax
lea rcx, [rsp + 0x60]
movsxd r8, eax
mov r9, rbx
mov rdx, rbp
call fcn.1800188d8
mov eax, 0xd
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 0xb]
call fcn.1800188d8
mov eax, 0xa
lea rcx, [rsp + 0x50]
mov r9, rbx
mov word [rsp + 0x50], ax
mov rdx, rbp
lea r8d, [rax - 8]
call fcn.1800188d8
mov rcx, rbx
call fcn.18001862c
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.180014180
mov rbx, qword [rsp + 0x10a0]
add rsp, 0x1070
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000ab70
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x18000ab90
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180014234
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x18000abc0
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x18000ac2f
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x18000ac1d
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000ac18
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x18000ac27
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x18000abf0
jmp 0x18000ac2a
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.18001406c
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18000ac50
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x290], rbx
mov rsi, rdx
xor bl, bl
mov rbp, rcx
call fcn.18000afc0
xor edi, edi
test al, al
je 0x18000acec
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
call fcn.18000aed0
test al, al
je 0x18000acec
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x298], r14
lea edx, [rdi + 0x1a]
mov r14d, 1
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x298]
test bl, bl
jne 0x18000ad00
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rbx, qword [rsp + 0x290]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x18000ad11
test eax, eax
je 0x18000adcf
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x18000ad30
mov eax, dword [0x180030914]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x18000ad50
xor r8d, r8d
nop dword [rax]
movzx ecx, word [rsi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x18000ad60
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x18000ad80
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x18000ada5
lea rcx, [rsp + 0x40]
call fcn.18000ab70
cmp word [rsp + 0x40], di
je 0x18000adbf
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x18000adb5
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.180002fc0
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180014180
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x18000afc0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1800470b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x1800483b0]
test al, al
jne 0x18000b072
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.1800170e0
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x18000b06b
lea rcx, [rsp + 0x20]
call fcn.18001c32c
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x20]
call fcn.180017428
test rax, rax
jne 0x18000b04b
lea rdx, str.documents_and_settingslocalservice
lea rcx, [rsp + 0x20]
call fcn.180017428
test rax, rax
je 0x18000b06b
mov al, 1
mov byte [0x1800483b0], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180014180
add rsp, 0x248
ret
movzx eax, byte [0x1800483b0]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180014180
add rsp, 0x248
ret
Function at 0x18000b460
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor bl, bl
call fcn.18000afc0
mov r15d, 1
test al, al
je 0x18000b4e6
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call fcn.18000aed0
test al, al
je 0x18000b4e6
mov r8, qword [rsp + 0x30]
mov r9d, r15d
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x18000b4e6
movzx eax, bl
jmp 0x18000b504
mov r9d, ebp
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
cmovne ecx, r15d
movzx eax, cl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret