joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023730
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3e0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x3d0], rax
mov r15, rcx
mov qword [rsp + 0x60], rcx
xor r12d, r12d
mov qword [rcx], r12
mov ebp, r12d
mov qword [rsp + 0x48], r12
mov r14d, r12d
mov dword [rsp + 0x50], r12d
lea rbx, [r11 - 0x248]
lea rdx, [r11 - 0x248]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r13, [r12 - 1]
cmp eax, 0x104
jbe 0x140023839
mov edi, r12d
lea esi, [rax + 0xa]
mov rbx, rdi
test esi, esi
je 0x140023823
test rdi, rdi
je 0x1400237c8
cmp esi, r14d
jle 0x140023823
mov ecx, esi
call fcn.14000e0f0
movsxd r14, eax
mov dword [rsp + 0x50], r14d
mov eax, 2
mul r14
cmovo rax, r13
mov rcx, rax
call fcn.14003d3c8
mov rbx, rax
test rdi, rdi
je 0x140023817
lea eax, [r14 - 1]
movsxd rdi, eax
mov r8, rdi
mov rdx, rbp
mov rcx, rbx
call fcn.140064d58
mov word [rbx + rdi*2], r12w
mov rcx, rbp
call fcn.14003cadc
jmp 0x14002381b
mov word [rax], r12w
mov rbp, rbx
mov qword [rsp + 0x48], rbx
mov rdx, rbp
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdi, rbx
cmp eax, esi
ja 0x1400237b4
test eax, eax
je 0x1400238d9
mov byte [rsp + 0x20], 1
mov r9d, r13d
mov r8d, 0xfde9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140020fa0
mov rbx, qword [rsp + 0x38]
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], r12d
mov rcx, qword [r15]
call fcn.14003cadc
mov qword [r15], rbx
mov rcx, qword [rsp + 0x38]
cmp byte [rsp + 0x40], 0
je 0x140023896
test rcx, rcx
je 0x140023896
movsxd rdx, dword [rsp + 0x30]
call fcn.140004df0
mov rcx, qword [rsp + 0x38]
call fcn.14003cadc
nop
mov rcx, rbp
call fcn.14003cadc
nop
mov rax, r15
mov rcx, qword [rsp + 0x3d0]
xor rcx, rsp
call fcn.14003cb80
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140069c80
nop
mov r8d, dword [rax]
lea rdx, str.GetCurrentDirectory
lea rcx, [rsp + 0x70]
call fcn.14000c540
lea rdx, [0x1400c2288]
lea rcx, [rsp + 0x70]
call fcn.14003e874
int3

Function at 0x140024200
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], 0
je 0x14002426e
test rcx, rcx
je 0x14002426e
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x40]
call fcn.14003cadc
nop
test bl, bl
setne al
add rsp, 0x50
pop rbx
ret
Function at 0x140024400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x2f0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x328], rbx
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov r14, r8
mov rbx, rcx
mov qword [rsp + 0x50], rcx
mov r9b, 1
lea r8, [0x14009dab0]
lea rcx, [rsp + 0x60]
call fcn.1400349b0
nop
xor edi, edi
lea rcx, [rsp + 0x60]
call fcn.140034b80
test rax, rax
je 0x140024598
mov rcx, qword [rsp + 0x2c8]
call fcn.1400259f0
test al, al
je 0x1400244bb
mov r8, r14
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x48]
call fcn.140024400
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400244b6
mov qword [rsp + 0x48], rdi
mov qword [rbx], rcx
xor ecx, ecx
call fcn.14003cadc
nop
lea rcx, [rsp + 0x60]
call fcn.140034b20
mov rax, rbx
jmp 0x1400245b2
call fcn.14003cadc
test r14, r14
je 0x1400244ed
mov rdx, qword [rsp + 0x2d0]
test rdx, rdx
je 0x140024451
mov rax, r14
sub rdx, r14
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1400244e6
inc rax
test cl, cl
jne 0x1400244d3
mov eax, edi
jmp 0x1400244fa
sbb eax, eax
or eax, 1
jmp 0x1400244fa
mov rax, qword [rsp + 0x2d0]
neg rax
sbb eax, eax
test eax, eax
jne 0x140024451
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
mov byte [rsp + 0x40], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, qword [rsp + 0x2c8]
lea rcx, [rsp + 0x30]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne sil
mov rcx, qword [rsp + 0x38]
cmp byte [rsp + 0x40], 0
je 0x140024565
test rcx, rcx
je 0x140024565
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x38]
call fcn.14003cadc
nop
test sil, sil
je 0x140024451
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x2c8]
call fcn.1400048e0
mov qword [rbx], rax
lea rcx, [rsp + 0x60]
call fcn.140034b20
mov rax, rbx
jmp 0x1400245b2
lea rcx, [rsp + 0x60]
call fcn.140034b20
nop
jmp 0x1400245ac
mov qword [rbx], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.14003cb80
mov rbx, qword [rsp + 0x328]
add rsp, 0x2f0
pop r14
pop rdi
pop rsi
ret

Function at 0x140025180
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rax, rdx
movsxd r8, r8d
mov rbx, rcx
mov r9, rcx
mov rcx, rax
mov edx, 1
call fcn.14006a920
test eax, eax
jg 0x1400251c6
mov rcx, rbx
call fcn.14006a618
test eax, eax
je 0x140025202
jmp 0x1400251df
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003cb80
add rsp, 0x180
pop rbx
ret
lea rdx, str.End_of_file
lea rcx, [rsp + 0x20]
call fcn.140011040
lea rdx, [0x1400c22e8]
lea rcx, [rsp + 0x20]
call fcn.14003e874
int3
lea rdx, str.reading_from_file_failed
lea rcx, [rsp + 0x20]
call fcn.1400211e0
lea rdx, [0x1400c2470]
lea rcx, [rsp + 0x20]
call fcn.14003e874
int3
mov rcx, qword [rcx + 0x58]
jmp 0x140025180
Function at 0x1400252a0
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], 0
je 0x14002530d
test rcx, rcx
je 0x14002530d
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x40]
call fcn.14003cadc
nop
movzx eax, bl
add rsp, 0x50
pop rbx
ret

Function at 0x140025610
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, rcx
xor esi, esi
mov dword [rax - 0x28], esi
mov qword [rax - 0x20], rsi
mov byte [rax - 0x18], sil
mov byte [rax - 0x58], 1
lea r9d, [rsi - 1]
mov r8d, 0xfde9
lea rcx, [rax - 0x28]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002566d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14002566d
xor bl, bl
jmp 0x1400256e2
mov rbx, qword [rsp + 0x58]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x48], sil
mov byte [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rdi
lea rcx, [rsp + 0x38]
call fcn.14000e8d0
mov rdx, rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], 0
je 0x1400256d4
test rcx, rcx
je 0x1400256d4
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x40]
call fcn.14003cadc
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x40], rsi
mov rcx, qword [rsp + 0x58]
cmp byte [rsp + 0x60], 0
je 0x140025705
test rcx, rcx
je 0x140025705
movsxd rdx, dword [rsp + 0x50]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x58]
call fcn.14003cadc
nop
movzx eax, bl
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400259f0
Capabilities:
Get file attributes

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
xor eax, eax
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x48], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], 0
je 0x140025a5a
test rcx, rcx
je 0x140025a5a
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x40]
call fcn.14003cadc
nop
cmp ebx, 0xffffffff
je 0x140025a72
test bl, 0x10
je 0x140025a72
mov al, 1
add rsp, 0x50
pop rbx
ret
xor al, al
add rsp, 0x50
pop rbx
ret
Function at 0x140025a80
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
movzx esi, r8b
movzx ebp, dl
mov rbx, rcx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14000e8d0
nop
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
cmp byte [rsp + 0x40], 0
je 0x140025b1a
test rcx, rcx
je 0x140025b1a
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x38]
call fcn.14003cadc
nop
test edi, edi
je 0x140025b4f
mov al, 1
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.14003cb80
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, rbx
call fcn.1400259f0
test al, al
je 0x140025b7e
test bpl, bpl
je 0x140025b7a
test sil, sil
je 0x140025b7a
mov rdx, rbx
mov ecx, 0xffffffff
call fcn.140024bc0
xor al, al
jmp 0x140025b26
mov r9, rbx
mov r8d, edi
lea rdx, str.mkDir__s_
lea rcx, [rsp + 0x50]
call fcn.140023d50
lea rdx, [0x1400c2408]
lea rcx, [rsp + 0x50]
call fcn.14003e874
int3
Function at 0x140025d90
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
call fcn.1400259f0
test al, al
je 0x140025de8
test rdi, rdi
jne 0x140025dd3
test rbx, rbx
je 0x140025de1
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call fcn.140036e70
xor al, al
jmp 0x140025f39
lea rcx, [rbp + 0x27]
call fcn.140036550
nop
test rdi, rdi
je 0x140025e14
xor r9d, r9d
mov r8b, 1
mov rdx, rdi
lea rcx, [rbp + 0x27]
call fcn.1400367d0
xor edx, edx
lea rcx, [rbp + 0x27]
call fcn.140036860
test rbx, rbx
je 0x140025e28
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0x27]
call fcn.140036970
mov dword [rbp + 7], 0x18
xor r14d, r14d
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x17], r14d
mov qword [rbp + 0x1f], r14
mov rdx, qword [rbp + 0x27]
lea rcx, [rbp + 0x1f]
call fcn.1400366c0
mov rax, qword [rbp + 0x1f]
mov qword [rbp + 0xf], rax
test rdi, rdi
jne 0x140025e60
test rbx, rbx
mov ebx, r14d
je 0x140025e64
lea rbx, [rbp + 7]
mov dword [rbp - 0x11], r14d
mov qword [rbp - 9], r14
mov byte [rbp - 1], 0
mov byte [rsp + 0x20], 1
mov r9d, 0xffffffff
mov r8d, 0xfde9
mov rdx, rsi
lea rcx, [rbp - 0x11]
call fcn.14000e8d0
nop
mov rdx, rbx
mov rcx, qword [rbp - 9]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
mov r8, rsi
lea rdx, str.CreateDirectory_failed_for__s
movzx ecx, al
call fcn.1400240d0
nop
mov rcx, qword [rbp - 9]
cmp byte [rbp - 1], 0
je 0x140025ed2
test rcx, rcx
je 0x140025ed2
movsxd rdx, dword [rbp - 0x11]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rbp - 9]
call fcn.14003cadc
nop
mov rcx, qword [rbp + 0x1f]
mov qword [rbp + 0x1f], r14
test rcx, rcx
je 0x140025eec
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
mov rcx, qword [rbp + 0x47]
mov qword [rbp + 0x47], r14
test rcx, rcx
je 0x140025eff
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x3f]
mov qword [rbp + 0x3f], r14
test rcx, rcx
je 0x140025f12
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x37]
call fcn.14003cadc
mov rcx, qword [rbp + 0x2f]
call fcn.14003cadc
mov rcx, qword [rbp + 0x27]
mov qword [rbp + 0x27], r14
test rcx, rcx
je 0x140025f37
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov al, 1
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140026000
Capabilities:
Delete directory

Disassembly:
push rbx
sub rsp, 0x2e0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rbx, rcx
test dl, dl
je 0x14002608b
xor r9d, r9d
lea r8, [0x14009dab0]
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1400349b0
lea rcx, [rsp + 0x50]
call fcn.140034b80
test rax, rax
je 0x140026081
mov eax, dword [rsp + 0x50]
shr eax, 4
mov rcx, qword [rsp + 0x2b8]
test al, 1
je 0x14002606d
mov dl, 1
call fcn.140026000
jmp 0x140026072
call fcn.1400252a0
lea rcx, [rsp + 0x50]
call fcn.140034b80
test rax, rax
jne 0x140026051
lea rcx, [rsp + 0x50]
call fcn.140034b20
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], al
mov byte [rsp + 0x20], 1
lea r9d, [rax - 1]
mov r8d, 0xfde9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000e8d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov rcx, qword [rsp + 0x38]
cmp byte [rsp + 0x40], 0
je 0x1400260e9
test rcx, rcx
je 0x1400260e9
movsxd rdx, dword [rsp + 0x30]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x38]
call fcn.14003cadc
nop
movzx eax, bl
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.14003cb80
add rsp, 0x2e0
pop rbx
ret

Function at 0x140027ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rcx
xor edi, edi
mov dword [rax - 0x20], edi
mov qword [rax - 0x18], rdi
mov byte [rax - 0x10], dil
mov byte [rax - 0x38], 1
lea r9d, [rdi - 1]
mov r8d, 0xfde9
lea rcx, [rax - 0x20]
call fcn.14000e8d0
nop
lea r8, str.BUILTINRESOURCE
mov rdx, qword [rsp + 0x40]
mov rcx, qword [0x1400c5f88]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbp, rax
mov rcx, qword [rsp + 0x40]
cmp byte [rsp + 0x48], dil
je 0x140027f63
test rcx, rcx
je 0x140027f63
movsxd rdx, dword [rsp + 0x38]
add rdx, rdx
call fcn.140004df0
mov rcx, qword [rsp + 0x40]
call fcn.14003cadc
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x40], rdi
test rbp, rbp
jne 0x140027f7c
mov qword [rsi + 8], rdi
jmp 0x140027fb6
mov rdx, rbp
mov rcx, qword [0x1400c5f88]
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140027f76
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
mov rdx, rbp
mov rcx, qword [0x1400c5f88]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
cmovg edi, eax
mov qword [rsi + 8], rbx
mov dword [rsi], edi
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140029e80
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x180
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rax, rdx
movsxd r8, r8d
mov rbx, rcx
mov r9, rcx
mov rcx, rax
mov edx, 1
call fcn.14006a920
test eax, eax
jg 0x1400251c6
mov rcx, rbx
call fcn.14006a618
test eax, eax
je 0x140025202
jmp 0x1400251df
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003cb80
add rsp, 0x180
pop rbx
ret
lea rdx, str.End_of_file
lea rcx, [rsp + 0x20]
call fcn.140011040
lea rdx, [0x1400c22e8]
lea rcx, [rsp + 0x20]
call fcn.14003e874
int3
lea rdx, str.reading_from_file_failed
lea rcx, [rsp + 0x20]
call fcn.1400211e0
lea rdx, [0x1400c2470]
lea rcx, [rsp + 0x20]
call fcn.14003e874
int3
mov rcx, qword [rcx + 0x58]
jmp 0x140025180
Function at 0x14002b0c0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x2c0
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
xor edx, edx
add rcx, 4
mov r8d, 0x118
call fcn.14003fce0
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14002b22f
cmp dword [rbx + 4], 6
ja 0x14002b11c
jne 0x14002b1d7
cmp dword [rbx + 8], 2
jb 0x14002b1d7
xor edx, edx
mov dword [rsp + 0x30], 0x11c
mov r8d, 0x118
lea rcx, [rsp + 0x34]
call fcn.14003fce0
call fcn.14002b2c0
cmp qword [rax], 0
je 0x14002b1d7
call fcn.14002b2c0
mov rdx, qword [rax]
test rdx, rdx
je 0x14002b259
lea rcx, [rsp + 0x30]
call rdx
test eax, eax
jne 0x14002b1d7
mov rcx, rbx
lea rdx, [rsp + 0x30]
mov eax, 2
nop
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rdx + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rdx - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rdx - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rdx - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rdx - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rdx - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rdx - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rax, 1
jne 0x14002b170
mov rax, qword [rdx + 0x10]
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x18]
mov dword [rcx + 0x18], eax
cmp dword [rbx + 4], 5
ja 0x14002b1e3
jne 0x14002b289
cmp dword [rbx + 0x10], 2
jne 0x14002b205
mov rax, rbx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14003cb80
add rsp, 0x2c0
pop rbx
ret
mov r9d, 0x30
lea r8, str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.7.xlabelcon_windows_64_rvcore_baseoswinosversion.cxx
lea rdx, str.dwPlatformId__2
lea rcx, [rsp + 0x150]
call fcn.1400101f0
mov rcx, rax
call fcn.1400102f0
int3
mov r9d, 0x1e
lea r8, str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.7.xlabelcon_windows_64_rvcore_baseoswinosversion.cxx
lea rdx, str.gotVersion
lea rcx, [rsp + 0x150]
call fcn.1400101f0
mov rcx, rax
call fcn.1400102f0
int3
lea r8, str.RtlGetVersion
lea rdx, [0x14009ff60]
lea rcx, [rsp + 0x150]
call fcn.140012300
lea rdx, [0x1400c2348]
lea rcx, [rsp + 0x150]
call fcn.14003e874
int3
mov r9d, 0x2f
lea r8, str.c:ent_slave_rootworkspace_vncconnect_buildsclients_vnc_7.7.xlabelcon_windows_64_rvcore_baseoswinosversion.cxx
lea rdx, str.atLeastVersion_5_0_
lea rcx, [rsp + 0x150]
call fcn.1400101f0
mov rcx, rax
call fcn.1400102f0
int3
Function at 0x140034120
Capabilities:
Set thread local storage value

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov esi, edx
mov rbx, rcx
lea rax, vtable.plat::EventManager.0
mov qword [rcx], rax
mov rax, qword [rcx + 0x28]
cmp qword [rcx + 0x20], rax
je 0x140034192
nop dword [rax]
nop word [rax + rax]
add qword [rbx + 0x10], 0xfffffffffffffff8
mov rdx, qword [rbx + 0x28]
lea rcx, [rdx - 8]
mov rdi, qword [rcx]
xor r8d, r8d
call fcn.14003f880
nop
add qword [rbx + 0x28], 0xfffffffffffffff8
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
nop
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x20], rax
jne 0x140034160
mov rdx, qword [rbx + 0x38]
mov ecx, dword [0x1400c617c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rbx + 0x40]
xor edi, edi
mov qword [rbx + 0x40], rdi
test rcx, rcx
je 0x1400341b9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14003420c
mov rax, qword [rbx + 0x30]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x1400341fa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140034282
mov rcx, r8
call fcn.14003cad4
nop
mov qword [rbx + 0x20], rdi
mov qword [rbx + 0x28], rdi
mov qword [rbx + 0x30], rdi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003425b
mov rax, qword [rbx + 0x18]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
cmp rdx, 0x1000
jb 0x140034249
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140034288
mov rcx, r8
call fcn.14003cad4
nop
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
test sil, 1
je 0x14003426f
mov edx, 0x50
mov rcx, rbx
call fcn.14003cad4
nop
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.14004cb1c
nop
call fcn.14004cb1c
nop
int3

Function at 0x140034920
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x188
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov ecx, dword [0x1400c617c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14003496e
mov ecx, dword [0x1400c617c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14003cb80
add rsp, 0x188
ret
lea rdx, str.No_EventManager
lea rcx, [rsp + 0x20]
call fcn.140001a10
lea rdx, [0x1400c2258]
lea rcx, [rsp + 0x20]
call fcn.14003e874
int3
Function at 0x140035850
Capabilities:
Compare security identifiers

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x200], rbx
mov rax, qword [0x1400c42d8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
movzx r15d, r8b
mov rbp, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [rbx + 2]
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400359c7
mov edi, ebx
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x48], bl
mov r9d, dword [rsp + 0x30]
mov esi, r9d
test r9d, r9d
cmovle esi, ebx
test esi, esi
cmovle esi, ebx
test esi, esi
jle 0x1400358fb
movsxd rcx, esi
call fcn.14003d3c8
mov rdi, rax
xor ecx, ecx
call fcn.14003cadc
mov qword [rsp + 0x40], rdi
mov r9d, dword [rsp + 0x30]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, rdi
mov edx, 2
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14003599c
cmp dword [rdi], 0
jbe 0x140035957
nop dword [rax]
nop word [rax + rax]
mov esi, ebx
add rsi, rsi
mov rdx, qword [rdi + rsi*8 + 8]
test rdx, rdx
je 0x140035951
mov rcx, qword [r14]
test rcx, rcx
je 0x140035951
call qword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x14003598c
inc ebx
cmp ebx, dword [rdi]
jb 0x140035930
xor bl, bl
mov rcx, rdi
call fcn.14003cadc
nop
movzx eax, bl
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.14003cb80
mov rbx, qword [rsp + 0x200]
add rsp, 0x1c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
test r15b, r15b
je 0x140035998
test byte [rdi + rsi*8 + 0x10], 4
je 0x140035957
mov bl, 1
jmp 0x140035959
call sub.KERNEL32.dll_GetLastError
mov r8d, eax
lea rdx, [0x14009eb18]
lea rcx, [rsp + 0x60]
call fcn.14000c540
lea rdx, [0x1400c2288]
lea rcx, [rsp + 0x60]
call fcn.14003e874
nop
call sub.KERNEL32.dll_GetLastError
mov r8d, eax
lea rdx, [0x14009eb18]
lea rcx, [rsp + 0x60]
call fcn.14000c540
lea rdx, [0x1400c2288]
lea rcx, [rsp + 0x60]
call fcn.14003e874
int3