joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400274ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbp, rcx
mov rdx, rcx
mov rsi, r9
mov rcx, r8
mov rbx, r8
call fcn.1401396ec
mov eax, dword [rbp + 8]
sub rdi, rbp
mov dword [rbx + 8], eax
mov r9, rsi
mov eax, dword [rbp + 0xc]
mov rcx, rbp
mov dword [rbx + 0xc], eax
mov eax, dword [rbp + 0x10]
mov dword [rbx + 0x10], eax
mov eax, dword [rbp + 0x14]
mov dword [rbx + 0x14], eax
movabs rax, 0x2aaaaaaaaaaaaaab
imul rdi
sar rdx, 2
mov r8, rdx
shr r8, 0x3f
add r8, rdx
xor edx, edx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.1400273a4
Function at 0x140102c1c
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
cmp dword [rax], 2
je 0x140102c69
mov r9d, 0x137
lea r8, str.C:qt64qt_1544645195969workqtbase_srccorelib_toolsqcryptographichash.cpp
lea rdx, str.Method_not_compiled_in
lea rcx, str.QCryptographicHash
call fcn.1401225ac
mov r9d, 0x138
lea r8, str.C:qt64qt_1544645195969workqtbase_srccorelib_toolsqcryptographichash.cpp
lea rdx, str.Q_UNREACHABLE_was_reached
lea rcx, str.Q_UNREACHABLE__
call fcn.1401225ac
int3
and qword [rax + 0x20], 0
mov dword [rax + 8], 0x67452301
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 0x10], 0x98badcfe
mov dword [rax + 0x14], 0x10325476
mov dword [rax + 0x18], 0xc3d2e1f0
mov rcx, qword [rcx]
add rcx, 0x68
add rsp, 0x28
jmp fcn.14010bfb0

Function at 0x140105ff0
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rsi, r8
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov rbx, rax
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rcx, qword [rsp + 0x58]
mov edi, 2
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14010606d
cmp eax, 0xffffffff
je 0x14010607b
sub eax, 1
mov dword [rcx], eax
jne 0x14010607b
mov rcx, qword [rsp + 0x58]
mov r8d, 8
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140106097
cmp eax, 0xffffffff
je 0x1401060a5
sub eax, 1
mov dword [rcx], eax
jne 0x1401060a5
mov rcx, qword [rsp + 0x20]
mov r8d, 8
mov rdx, rdi
call fcn.14010b388
test bl, bl
jne 0x1401060bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], edi
mov rcx, qword [rsp + 0x58]
mov qword [rsi], rcx
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140106454
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x140238598]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rsi, rcx
lea rdi, [0x1401a5d88]
mov ecx, 0x104
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, 2
or r15, 0xffffffffffffffff
mov ebx, eax
lea r12d, [r14 + 6]
test eax, eax
je 0x1401065cb
cmp ebx, 0x104
jbe 0x140106565
mov eax, r14d
mul rbx
cmovo rax, r15
mov rcx, rax
call fcn.1401667d0
mov rdx, rax
mov ecx, 0x104
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14010655b
mov r8d, ebx
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.14013c1dc
lea rcx, [0x1401a5d88]
mov rbx, qword [rax]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140106529
cmp eax, r15d
je 0x140106534
sub eax, 1
mov dword [rcx], eax
jne 0x140106534
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov rdx, r14
call fcn.14010b388
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
mov eax, dword [rcx]
test eax, eax
je 0x140106550
cmp eax, r15d
je 0x14010655b
sub eax, 1
mov dword [rcx], eax
jne 0x14010655b
mov r8, r12
mov rdx, r14
call fcn.14010b388
mov rcx, rdi
call fcn.140166074
jmp 0x1401065cb
mov r8d, ebx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14013c1dc
mov rbx, qword [rax]
mov qword [rax], rdi
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x140106599
cmp eax, r15d
je 0x1401065a4
sub eax, 1
mov dword [rcx], eax
jne 0x1401065a4
mov rcx, qword [rsp + 0x30]
mov r8, r12
mov rdx, r14
call fcn.14010b388
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x28], rbx
mov eax, dword [rcx]
test eax, eax
je 0x1401065c0
cmp eax, r15d
je 0x1401065cb
sub eax, 1
mov dword [rcx], eax
jne 0x1401065cb
mov r8, r12
mov rdx, r14
call fcn.14010b388
mov rax, qword [rsp + 0x28]
cmp dword [rax + 4], r14d
jl 0x140106633
lea rax, [rsp + 0x28]
mov dword [rsp + 0x38], 1
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
call fcn.140038078
cmp word [rax], 0x3a
jne 0x140106633
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.1400068e8
movzx ecx, word [rax]
call fcn.140142d24
and dword [rsp + 0x38], 0
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x30], rcx
movzx edx, ax
lea rcx, [rsp + 0x30]
call fcn.140027aa0
mov r8b, byte [rsp + 0x20]
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.1401044dc
mov rcx, qword [rsp + 0x28]
mov r9d, dword [rcx]
test r9d, r9d
je 0x140106665
cmp r9d, r15d
je 0x140106670
sub r9d, 1
mov dword [rcx], r9d
jne 0x140106670
mov rcx, qword [rsp + 0x28]
mov r8, r12
mov rdx, r14
call fcn.14010b388
mov rax, rsi
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1401666e0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140107b18
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140238598]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rax, qword [rcx]
mov rdi, rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
cmp rcx, rdx
jne 0x140107b76
mov r8d, 0x38b
lea rdx, str.c:qt64qt_1544645195969workqtbaseincludeqtcore.._.._src_corelib_tools_qstring.h
lea rcx, str.other___this
call fcn.140122564
mov rax, qword [rsp + 0x20]
mov edx, dword [rax]
lea ecx, [rdx + 1]
cmp ecx, 1
jbe 0x140107b8a
lea ecx, [rdx + 1]
mov dword [rax], ecx
mov rax, qword [rsp + 0x20]
cmp dword [rax + 4], 2
jne 0x140107bba
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
call fcn.1400068e8
cmp word [rax], 0x3a
jne 0x140107bba
mov edx, 0x5c
lea rcx, [rsp + 0x20]
call fcn.140006514
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14011e384
mov rcx, rax
call fcn.14014385c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
mov edx, dword [rcx]
test edx, edx
je 0x140107bf8
cmp edx, 0xffffffff
je 0x140107c06
sub edx, 1
mov dword [rcx], edx
jne 0x140107c06
mov rcx, qword [rsp + 0x30]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
cmp ebx, 0xffffffff
jne 0x140107c3e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x140107c1b
cmp eax, 0x20
jne 0x140107c3e
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14011e384
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.14010724c
test al, al
cmovne ebx, dword [rsp + 0x40]
test rdi, rdi
je 0x140107c4b
cmp ebx, 0xffffffff
setne al
mov byte [rdi], al
cmp ebx, 0xffffffff
jne 0x140107c54
xor bl, bl
jmp 0x140107c5a
shr ebx, 4
and bl, 1
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x140107c76
cmp eax, 0xffffffff
je 0x140107c84
sub eax, 1
mov dword [rcx], eax
jne 0x140107c84
mov rcx, qword [rsp + 0x20]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
mov al, bl
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1401666e0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140108490
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
lea rdx, [rsp + 0x40]
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x40]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x1401084d9
cmp eax, 0xffffffff
je 0x1401084e7
sub eax, 1
mov dword [rcx], eax
jne 0x1401084e7
mov rcx, qword [rsp + 0x40]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
test bl, bl
jne 0x140108505
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 2
mov rcx, qword [rsp + 0x40]
mov qword [rdi], rcx
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140108514
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rsi, r8
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov rbx, rax
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rcx, qword [rsp + 0x58]
mov edi, 2
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x14010858b
cmp eax, 0xffffffff
je 0x140108599
sub eax, 1
mov dword [rcx], eax
jne 0x140108599
mov rcx, qword [rsp + 0x58]
mov r8d, 8
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x1401085b5
cmp eax, 0xffffffff
je 0x1401085c3
sub eax, 1
mov dword [rcx], eax
jne 0x1401085c3
mov rcx, qword [rsp + 0x20]
mov r8d, 8
mov rdx, rdi
call fcn.14010b388
test bl, bl
jne 0x1401085dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x5c], edi
mov rcx, qword [rsp + 0x58]
mov qword [rsi], rcx
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x140108698
Capabilities:
Set current directory

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x50
and dword [rax - 0x38], 0
lea rdx, [rax - 0x38]
and dword [rax - 0x34], 0
mov r8d, 0x440000
or qword [rax - 0x30], 0xffffffffffffffff
mov rbx, rcx
call fcn.1401068fc
test dword [rsp + 0x24], 0x400000
je 0x140108768
test dword [rsp + 0x24], 0x40000
je 0x140108768
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140104774
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140117ca4
mov rcx, rax
call fcn.14014385c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov rcx, qword [rsp + 0x68]
test eax, eax
setne bl
mov eax, dword [rcx]
test eax, eax
je 0x140108727
cmp eax, 0xffffffff
je 0x140108735
sub eax, 1
mov dword [rcx], eax
jne 0x140108735
mov rcx, qword [rsp + 0x68]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
mov rcx, qword [rsp + 0x70]
mov r9d, dword [rcx]
test r9d, r9d
je 0x140108756
cmp r9d, 0xffffffff
je 0x140108764
sub r9d, 1
mov dword [rcx], r9d
jne 0x140108764
mov rcx, qword [rsp + 0x70]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
mov al, bl
jmp 0x14010876a
xor al, al
add rsp, 0x50
pop rbx
ret
Function at 0x140108ad0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r14, rdx
mov rdi, rcx
xor sil, sil
xor ebx, ebx
call fcn.140104bfc
test al, al
je 0x140108b7f
mov ecx, 0x8001
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ecx, ebx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.140104774
mov rcx, rax
lea rdx, [rbp + 0x40]
xor r8d, r8d
call fcn.1400068e8
movzx ecx, word [rax]
call fcn.140142d24
mov edi, 1
lea ecx, [rax - 0x41]
shl edi, cl
mov rcx, qword [rbp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x140108b5f
cmp eax, 0xffffffff
je 0x140108b6d
sub eax, 1
mov dword [rcx], eax
jne 0x140108b6d
mov rcx, qword [rbp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
and edi, esi
setne sil
neg edi
sbb ebx, ebx
and ebx, 0x14
jmp 0x140108c5d
lea rdx, [rbp + 0x48]
mov rcx, rdi
call fcn.140104e80
lea rdi, str._UNC
mov rcx, rdi
call fcn.14016a910
mov qword [rbp - 8], rdi
lea rdx, [rbp - 0x10]
mov dword [rbp - 0x10], eax
lea rcx, [rbp + 0x48]
movaps xmm0, xmmword [rbp - 0x10]
mov edi, 1
mov r8d, edi
movdqa xmmword [rbp - 0x10], xmm0
call fcn.140141fa0
test al, al
je 0x140108c36
xor r8d, r8d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.1400068e8
mov r9d, edi
lea r8d, [rdi + 6]
lea rcx, [rbp + 0x48]
movzx edx, word [rax]
call fcn.14013c494
mov r15d, eax
test eax, eax
jle 0x140108c21
xor r8d, r8d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call fcn.1400068e8
lea r8d, [r15 + 1]
mov r9d, edi
lea rcx, [rbp + 0x48]
movzx edx, word [rax]
call fcn.14013c494
test eax, eax
jle 0x140108c21
mov rcx, qword [rbp + 0x48]
mov edx, dword [rcx + 4]
sub edx, edi
cmp eax, edx
jne 0x140108c3a
lea rcx, [rbp + 0x48]
call fcn.140108eb0
test al, al
je 0x140108c36
mov ebx, 0x10
mov sil, dil
mov rcx, qword [rbp + 0x48]
mov eax, dword [rcx]
test eax, eax
je 0x140108c4f
cmp eax, 0xffffffff
je 0x140108c5d
sub eax, edi
mov dword [rcx], eax
jne 0x140108c5d
mov rcx, qword [rbp + 0x48]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
test sil, sil
je 0x140108c89
mov dword [r14 + 0x10], ebx
mov eax, 0x20000
and bl, 0x10
neg bl
sbb ecx, ecx
and ecx, eax
add ecx, eax
or ecx, dword [r14 + 4]
bts ecx, 0x16
mov dword [r14 + 4], ecx
or dword [r14], 0x560000
mov rbx, qword [rsp + 0x60]
mov al, sil
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010a3dc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 1
je 0x14010a40e
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 1
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14011ec30
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x70], 0
mov rbp, r8
mov r15, qword [rcx + 0x18]
mov r14, rdx
mov rbx, rcx
jne 0x14011ed23
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14011ed87
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14011ed81
mov rsi, r8
lea r9, [rax + 8]
xor edi, edi
mov r13d, 0x2000000
mov r8d, r13d
cmp rsi, r13
cmovl r8d, ebp
and qword [rax - 0x38], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14011ece8
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14011ece0
add rdi, rax
sub rsi, rax
cmp rdi, rbp
jge 0x14011ece0
mov rcx, qword [rbx + 0x78]
lea rdx, [rdi + r14]
mov r8d, r13d
lea r9, [rsp + 0x60]
cmp rsi, r13
cmovl r8d, esi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14011eca1
test rdi, rdi
je 0x14011ece8
mov rax, rdi
jmp 0x14011ed95
or edx, 0xffffffff
lea rcx, [rsp + 0x78]
call fcn.140145228
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx]
test eax, eax
je 0x14011ed72
cmp eax, 0xffffffff
je 0x14011ed81
sub eax, 1
mov dword [rcx], eax
jne 0x14011ed81
mov rcx, qword [rsp + 0x78]
jmp 0x14011ed72
call fcn.14011e9f0
test al, al
je 0x14011ed87
mov rcx, qword [rbx + 0x70]
call fcn.14016f758
test eax, eax
je 0x14011ed87
or edx, 0xffffffff
lea rcx, [rsp + 0x60]
call fcn.140145394
mov r8, rax
mov edx, 1
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x60]
mov edx, dword [rcx]
test edx, edx
je 0x14011ed72
cmp edx, 0xffffffff
je 0x14011ed81
sub edx, 1
mov dword [rcx], edx
jne 0x14011ed81
mov rcx, qword [rsp + 0x60]
mov r8d, 8
lea edx, [r8 - 6]
call fcn.14010b388
or rax, 0xffffffffffffffff
jmp 0x14011ed95
mov r8, rbp
mov rdx, r14
mov rcx, rbx
call fcn.14010a42c
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x14010a42c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, qword [rcx + 0x18]
mov rbp, r8
mov r9, rdx
mov rsi, rcx
test r8, r8
js 0x14010a591
xor ebx, ebx
cmp qword [rcx + 0x70], rbx
je 0x14010a4f9
mov r12b, 1
lea rcx, [rbx + r9]
mov r8, rbp
mov r9, qword [rsi + 0x70]
sub r8, rbx
mov edx, 1
call fcn.14016fbc0
mov rcx, qword [rsi + 0x70]
mov r14, rax
call fcn.14016f758
test eax, eax
setne r15b
test r12b, r12b
je 0x14010a4c2
test r15b, r15b
je 0x14010a4c2
test r14, r14
jne 0x14010a4c2
mov rcx, qword [rsi + 0x70]
call fcn.140173a90
mov rcx, qword [rsi + 0x70]
mov edx, eax
xor r8d, r8d
call fcn.140173594
xor r12b, r12b
jmp 0x14010a4c5
add rbx, r14
test r15b, r15b
jne 0x14010a58c
test r14, r14
jne 0x14010a4e2
call fcn.1401727cc
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x14010a4ea
xor ecx, ecx
cmp rbx, rbp
setl cl
mov r9, qword [rsp + 0x58]
test ecx, ecx
jne 0x14010a46d
jmp 0x14010a540
cmp dword [rcx + 0x98], 0xffffffff
je 0x14010a545
mov r14d, 0x7fffffff
mov ecx, dword [rsi + 0x98]
lea rdx, [rbx + r9]
mov r8d, r14d
mov rax, rbp
sub rax, rbx
cmp rax, r14
cmovb r8d, eax
call fcn.1401714f8
movsxd rdx, eax
test eax, eax
jle 0x14010a53b
mov r9, qword [rsp + 0x58]
add rbx, rdx
cmp rbx, rbp
jl 0x14010a508
cmp edx, 0xffffffff
jne 0x14010a58c
test rbx, rbx
jne 0x14010a58c
or rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
or edx, ebx
call fcn.140145394
mov r8, rax
lea edx, [rbx + 2]
mov rcx, r13
call fcn.14011d4bc
mov rcx, qword [rsp + 0x50]
mov edx, dword [rcx]
test edx, edx
je 0x14010a57e
cmp edx, ebx
je 0x14010a58c
sub edx, 1
mov dword [rcx], edx
jne 0x14010a58c
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
mov rax, rbx
jmp 0x14010a5de
mov edx, 0x16
lea rcx, [rsp + 0x50]
call fcn.140145394
mov r8, rax
mov edx, 1
mov rcx, r13
call fcn.14011d4bc
mov rcx, qword [rsp + 0x50]
mov edx, dword [rcx]
test edx, edx
je 0x14010a5cc
cmp edx, 0xffffffff
je 0x14010a5da
sub edx, 1
mov dword [rcx], edx
jne 0x14010a5da
mov rcx, qword [rsp + 0x50]
mov edx, 2
lea r8d, [rdx + 6]
call fcn.14010b388
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14010aac8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, r8
mov rsi, rdx
cmp dword [rbx + 0x9c], 2
je 0x14010aafa
mov rax, qword [rcx]
call qword [rax + 0x18]
mov dword [rbx + 0x9c], 2
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14011ef44
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
cmp qword [rcx + 0x70], 0
mov rbp, r8
mov r15, qword [rcx + 0x18]
mov r14, rdx
mov rbx, rcx
jne 0x14011f04c
cmp dword [rcx + 0x98], 0xffffffff
jne 0x14011f04c
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x14011f046
mov rsi, r8
lea r9, [rsp + 0x60]
mov eax, 0x2000000
xor edi, edi
cmp rsi, rax
mov r8d, eax
cmovl r8d, ebp
and qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14011eff8
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x14011eff3
add rdi, rax
sub rsi, rax
cmp rdi, rbp
jge 0x14011eff3
mov rcx, qword [rbx + 0x78]
lea rdx, [rdi + r14]
mov eax, 0x2000000
lea r9, [rsp + 0x60]
cmp rsi, rax
mov r8d, eax
cmovl r8d, esi
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14011efaf
test rdi, rdi
je 0x14011eff8
mov rax, rdi
jmp 0x14011f051
or edx, 0xffffffff
lea rcx, [rsp + 0x78]
call fcn.140145228
mov ebx, 2
mov r8, rax
mov edx, ebx
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x78]
mov r8d, dword [rcx]
test r8d, r8d
je 0x14011f038
cmp r8d, 0xffffffff
je 0x14011f046
sub r8d, 1
mov dword [rcx], r8d
jne 0x14011f046
mov rcx, qword [rsp + 0x78]
mov r8d, 8
mov rdx, rbx
call fcn.14010b388
or rax, 0xffffffffffffffff
jmp 0x14011f051
call fcn.14010ab18
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14010ab18
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r15, qword [rcx + 0x18]
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
js 0x14010ac3b
xor edi, edi
test r8, r8
je 0x14010ac31
lea r13d, [rdi + 4]
cmp qword [rcx + 0x70], rdi
je 0x14010ab99
mov r9, qword [rbx + 0x70]
lea rcx, [rdi + r14]
mov r8, rbp
mov edx, 1
sub r8, rdi
call fcn.140173ce4
add rdi, rax
test rax, rax
jne 0x14010ab8b
call fcn.1401727cc
xor ecx, ecx
cmp dword [rax], r13d
sete cl
jmp 0x14010ab93
xor ecx, ecx
cmp rdi, rbp
setl cl
test ecx, ecx
jne 0x14010ab5c
jmp 0x14010abd2
cmp dword [rcx + 0x98], 0xffffffff
je 0x14010abd7
mov ecx, dword [rbx + 0x98]
lea rdx, [rdi + r14]
mov r8d, 0x7fffffff
mov rax, rbp
sub rax, rdi
cmp rax, r8
cmovb r8d, eax
call fcn.140174694
test eax, eax
jle 0x14010abd2
cdqe
add rdi, rax
cmp rdi, rbp
jl 0x14010aba2
test rdi, rdi
jne 0x14010ac31
or rdi, 0xffffffffffffffff
call fcn.1401727cc
or edx, edi
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.140145394
cmp dword [rbx], 0x1c
lea ebp, [rdi + 3]
mov edx, ebp
mov r8, rax
cmove edx, r13d
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx]
test eax, eax
je 0x14010ac21
cmp eax, edi
je 0x14010ac36
sub eax, 1
mov dword [rcx], eax
jne 0x14010ac36
mov rcx, qword [rsp + 0x40]
mov r8d, 8
mov rdx, rbp
call fcn.14010b388
jmp 0x14010ac36
btr dword [rbx + 0x40], 0x15
mov rax, rdi
jmp 0x14010ac8a
mov edx, 0x16
lea rcx, [rsp + 0x40]
call fcn.140145394
mov ebp, 2
mov r8, rax
mov edx, ebp
mov rcx, r15
call fcn.14011d4bc
mov rcx, qword [rsp + 0x40]
mov edx, dword [rcx]
test edx, edx
je 0x14010ac78
cmp edx, 0xffffffff
je 0x14010ac86
sub edx, 1
mov dword [rcx], edx
jne 0x14010ac86
mov rcx, qword [rsp + 0x40]
mov r8d, 8
mov rdx, rbp
call fcn.14010b388
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x14011ca18
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
call fcn.140109dc4
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp method.QFSFileEngine.virtual_96
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov rdi, qword [rcx + 8]
mov rsi, rcx
lea rcx, [rbp - 0x20]
call fcn.14010444c
mov rcx, rax
lea rdx, [rbp + 0x30]
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
lea rcx, [rdi + 0x20]
mov rbx, rax
lea rdx, [rbp + 0x20]
call fcn.140104e80
mov rcx, rax
call fcn.14014385c
mov rcx, rax
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rbp + 0x20]
mov edi, 2
test eax, eax
setne bl
mov eax, dword [rcx]
lea r14d, [rdi + 6]
test eax, eax
je 0x14011f393
cmp eax, 0xffffffff
je 0x14011f39e
sub eax, 1
mov dword [rcx], eax
jne 0x14011f39e
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp + 0x30]
mov eax, dword [rcx]
test eax, eax
je 0x14011f3b8
cmp eax, 0xffffffff
je 0x14011f3c3
sub eax, 1
mov dword [rcx], eax
jne 0x14011f3c3
mov rcx, qword [rbp + 0x30]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp - 0x18]
mov eax, dword [rcx]
test eax, eax
je 0x14011f3dd
cmp eax, 0xffffffff
je 0x14011f3e8
sub eax, 1
mov dword [rcx], eax
jne 0x14011f3e8
mov rcx, qword [rbp - 0x18]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rcx, qword [rbp - 0x20]
mov eax, dword [rcx]
test eax, eax
je 0x14011f402
cmp eax, 0xffffffff
je 0x14011f40d
sub eax, 1
mov dword [rcx], eax
jne 0x14011f40d
mov rcx, qword [rbp - 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
test bl, bl
jne 0x14011f460
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, edi
lea rcx, [rbp + 0x20]
mov r8d, eax
call fcn.1401453bc
lea r8, [rbp + 0x20]
mov edx, 0xa
mov rcx, rsi
call fcn.14011d4bc
mov rcx, qword [rbp + 0x20]
mov r9d, dword [rcx]
test r9d, r9d
je 0x14011f455
cmp r9d, 0xffffffff
je 0x14011f460
sub r9d, 1
mov dword [rcx], r9d
jne 0x14011f460
mov rcx, qword [rbp + 0x20]
mov r8, r14
mov rdx, rdi
call fcn.14010b388
mov rsi, qword [rsp + 0x78]
mov al, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret