joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180112f30
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov rdi, rcx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rdx, dword [rdi]
xor esi, esi
mov ebx, esi
test rax, rax
je 0x180112f6d
test edx, edx
jle 0x180112f6d
cmp edx, dword [rax + 8]
jge 0x180112f6d
mov rax, qword [rax]
mov rbx, qword [rax + rdx*8]
test rbx, rbx
jne 0x180112f96
lea ecx, [rbx + 8]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x180113027
xor eax, eax
mov rdx, rbx
mov rcx, rdi
mov qword [rbx], rax
call fcn.180106bc0
mov rax, qword [rbx]
test rax, rax
jne 0x180113017
lea ecx, [rax + 0x58]
call sym.tcl86t.dll_hclpAlloc
test rax, rax
je 0x180113039
mov rdx, rax
mov qword [rbx], rax
lea rcx, [0x180113050]
call sym.tcl86t.dll_hcl_CreateThreadExitHandler
mov rcx, qword [rbx]
lea rax, [rcx + 8]
mov qword [rcx], rax
mov qword [rax], rsi
lea rax, [fcn.18009de20]
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x40], rax
lea rax, [fcn.18009de40]
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x28], 4
mov dword [rcx + 0x30], reloc.WS2_32.dll_inet_ntoa
mov dword [rcx + 0x34], 0x1c
mov dword [rcx + 0x38], 3
mov dword [rcx + 0x3c], 1
mov rax, qword [rbx]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov edx, 8
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
mov edx, 0x58
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3

Function at 0x1801139f0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 8], 0
mov rbx, rdx
jne 0x180113a31
mov edx, dword [rcx]
mov eax, edx
and eax, 0x874
cmp eax, 4
jne 0x180113a31
mov eax, dword [rcx + 0x10]
shr edx, 3
not edx
and edx, 1
cmp eax, edx
jne 0x180113a31
test eax, eax
jne 0x180113a28
call sym.tcl86t.dll_hclpFree
jmp 0x180113a31
add rcx, 0x18
call sym.tcl86t.dll_hcl_DeleteHashEntry
test rbx, rbx
je 0x180113a79
cmp qword [rbx + 8], 0
jne 0x180113a79
mov ecx, dword [rbx]
mov eax, ecx
and eax, 0x874
cmp eax, 4
jne 0x180113a79
mov eax, dword [rbx + 0x10]
shr ecx, 3
not ecx
and ecx, 1
cmp eax, ecx
jne 0x180113a79
test eax, eax
jne 0x180113a6b
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hclpFree
lea rcx, [rbx + 0x18]
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hcl_DeleteHashEntry
add rsp, 0x20
pop rbx
ret
Function at 0x180119540
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [rcx + 0x28]
mov rbx, rdx
add rax, 0xf8
mov rbp, rcx
mov esi, 0x40
cmp rdx, rax
jne 0x18011957b
mov esi, 0x41
jmp 0x180119597
mov rax, qword [rcx + 0xa8]
mov rcx, qword [rax]
mov eax, 0x42
add rcx, 0xf8
cmp rbx, rcx
cmove esi, eax
mov r9d, dword [rbx + 0x28]
xor r14d, r14d
mov edx, r14d
cmp edx, r9d
jge 0x1801195b9
mov rax, qword [rbx]
movsxd rcx, edx
inc edx
mov r8, qword [rax + rcx*8]
test r8, r8
je 0x1801195a1
jmp 0x1801195bc
mov r8, r14
test r8, r8
lea rdi, [r8 - 0x18]
cmove rdi, r14
test rdi, rdi
je 0x18011962d
nop dword [rax]
mov r9, qword [rdi + 0x38]
mov r8, rbp
mov dword [rsp + 0x30], 0xffffffff
xor edx, edx
mov dword [rsp + 0x28], esi
mov rcx, rdi
mov qword [rsp + 0x20], r14
call fcn.1801159a0
lea rcx, [rdi + 0x18]
call sym.tcl86t.dll_hcl_DeleteHashEntry
mov r9d, dword [rbx + 0x28]
mov eax, r14d
cmp eax, r9d
jge 0x18011961a
mov rcx, qword [rbx]
movsxd rdx, eax
inc eax
mov r8, qword [rcx + rdx*8]
test r8, r8
je 0x180119602
jmp 0x18011961d
mov r8, r14
test r8, r8
lea rdi, [r8 - 0x18]
cmove rdi, r14
test rdi, rdi
jne 0x1801195d0
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
jmp sym.tcl86t.dll_hcl_DeleteHashTable
Function at 0x18011d2b0
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x60], 0
mov rbx, rcx
jne 0x18011d2d8
add rcx, 8
cmp dword [rbx + 0x84], 0x10
jne 0x18011d2d3
call fcn.180123680
jmp 0x18011d2d8
call fcn.1801270c0
mov rcx, qword [rbx + 0x68]
test rcx, rcx
je 0x18011d2f2
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x18011d2f2
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x18011d30c
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x18011d30c
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x18011d326
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x18011d326
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0xa0]
test rcx, rcx
je 0x18011d343
mov edx, dword [rcx]
lea eax, [rdx - 1]
mov dword [rcx], eax
cmp edx, 1
jg 0x18011d343
call sym.tcl86t.dll_hclFreeObj
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x18011d354
call sym.tcl86t.dll_hclpFree
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp sym.tcl86t.dll_hclpFree
Function at 0x180129c70
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x10]
mov rbx, rcx
test rdi, rdi
je 0x180129d6e
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov edx, ebp
cmp dword [rcx], ebp
jle 0x180129cb6
mov ecx, ebp
nop dword [rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rcx + 4]
inc edx
mov dword [rcx + rax - 4], ebp
cmp edx, dword [rbx]
jl 0x180129ca0
mov rdi, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
test rdi, rdi
je 0x180129d5a
cmp dword [0x1801905e4], ebp
jne 0x180129ced
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x1801905ac], eax
mov dword [0x1801905e4], 1
cmp eax, 0xffffffff
je 0x180129dec
jmp 0x180129cf3
mov eax, dword [0x1801905ac]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x180129d11
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x180129df9
test rsi, rsi
jne 0x180129d1e
call fcn.180105bb0
mov rsi, rax
movzx eax, byte [rdi - 0x10]
add rdi, 0xfffffffffffffff0
cmp al, 0xef
jne 0x180129dd3
cmp byte [rdi + 3], al
jne 0x180129dd3
movzx edx, byte [rdi + 1]
cmp edx, 0xa
jne 0x180129d79
mov eax, dword [rdi + 8]
sub dword [rsi + 0x28], eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x38]
mov qword [rbx + 0x10], rbp
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rax, [rdx + rdx*4]
lea rcx, [rsi + rax*8]
mov eax, dword [rdi + 8]
sub dword [rcx + 0x54], eax
mov rax, qword [rcx + 0x30]
mov qword [rdi], rax
mov r9d, dword [rcx + 0x40]
mov qword [rcx + 0x30], rdi
test r9d, r9d
jne 0x180129d9f
mov qword [rcx + 0x38], rdi
inc dword [rcx + 0x48]
inc r9d
cmp rsi, qword [0x18018f158]
mov dword [rcx + 0x40], r9d
je 0x180129d5a
lea rax, [rdx + rdx*2]
lea rcx, [0x180190200]
cmp r9d, dword [rcx + rax*8 + 8]
jle 0x180129d5a
mov r8d, dword [rcx + rax*8 + 0xc]
mov rcx, rsi
call fcn.180106700
jmp 0x180129d5a
movzx r9d, byte [rdi + 3]
lea rcx, str.alloc:_invalid_block:__p:__x__x
movzx r8d, al
mov rdx, rdi
call sym.tcl86t.dll_hcl_Panic
int3
lea rcx, str.could_not_allocate_thread_local_storage
call sym.tcl86t.dll_hcl_Panic
int3
lea rcx, str.TlsGetValue_failed_from_TclpGetAllocCache
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x180131830
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x180190360]
xor ebx, ebx
test rax, rax
je 0x180131863
test ecx, ecx
jle 0x180131863
cmp ecx, dword [rax + 8]
jge 0x180131863
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1801318e7
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x180190360]
test rax, rax
je 0x180131893
test ecx, ecx
jle 0x180131893
cmp ecx, dword [rax + 8]
jge 0x180131893
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x1801318bc
lea ecx, [rbx + 8]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x1801318f0
xor eax, eax
lea rcx, [0x180190360]
mov rdx, rbx
mov qword [rbx], rax
call fcn.180106bc0
xor r8d, r8d
mov qword [rbx], 0
lea rdx, [0x1801319f0]
lea rcx, [0x180131930]
call sym.tcl86t.dll_hcl_CreateEventSource
xor edx, edx
lea rcx, [0x180131910]
call sym.tcl86t.dll_hcl_CreateThreadExitHandler
mov rax, rbx
add rsp, 0x20
pop rbx
ret
mov edx, 8
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x180132ba0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x180190368], 0
jne 0x180132be7
lea rcx, [0x180190370]
call sym.tcl86t.dll_hcl_MutexLock
cmp dword [0x180190368], 0
jne 0x180132bda
xor edx, edx
mov dword [0x180190368], 1
lea rcx, [0x180132cf0]
call sym.tcl86t.dll_hcl_CreateExitHandler
mov rcx, qword [0x180190370]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x180190378]
test rax, rax
je 0x180132c19
test ecx, ecx
jle 0x180132c19
cmp ecx, dword [rax + 8]
jge 0x180132c19
mov rax, qword [rax]
cmp qword [rax + rcx*8], 0
jne 0x180132cad
mov rax, qword [0x1801902f8]
mov qword [rsp + 0x20], rbx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
movsxd rcx, dword [0x180190378]
xor ebx, ebx
test rax, rax
je 0x180132c4b
test ecx, ecx
jle 0x180132c4b
cmp ecx, dword [rax + 8]
jge 0x180132c4b
mov rax, qword [rax]
mov rbx, qword [rax + rcx*8]
test rbx, rbx
jne 0x180132c74
lea ecx, [rbx + 8]
call sym.tcl86t.dll_hclpAlloc
mov rbx, rax
test rax, rax
je 0x180132cb2
xor eax, eax
lea rcx, [0x180190378]
mov rdx, rbx
mov qword [rbx], rax
call fcn.180106bc0
xor r8d, r8d
mov qword [rbx], 0
lea rdx, [0x180132e20]
lea rcx, [0x180132d20]
call sym.tcl86t.dll_hcl_CreateEventSource
xor edx, edx
lea rcx, [0x180132cd0]
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
jmp sym.tcl86t.dll_hcl_CreateThreadExitHandler
add rsp, 0x28
ret
mov edx, 8
lea rcx, str.unable_to_alloc__u_bytes
call sym.tcl86t.dll_hcl_Panic
int3
Function at 0x180133630
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x18018f008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, qword [rcx]
mov edi, edx
mov rbx, rcx
test edi, edi
je 0x1801336b7
mov rax, qword [rbx + 0x60]
test rax, rax
je 0x1801336b7
mov eax, dword [rax + 8]
cmp eax, 8
je 0x1801336b7
cmp dword [0x18018fdbc], 0
jne 0x1801336b7
mov rax, qword [0x1801902f8]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
movsxd rax, dword [0x18018fdd0]
test rdx, rdx
je 0x1801336b0
test eax, eax
jle 0x1801336b0
cmp eax, dword [rdx + 8]
jge 0x1801336b0
mov rcx, rax
mov rax, qword [rdx]
mov rdx, qword [rax + rcx*8]
test rdx, rdx
je 0x1801336b0
cmp dword [rdx + 8], 0
jne 0x1801336b7
mov edx, 0xffffffff
jmp 0x1801336b9
xor edx, edx
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18013375d
test byte [rbx + 0x80], 4
jne 0x180133749
lea r9, [rsp + 0x20]
mov r8d, 1
lea rdx, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
test eax, eax
je 0x180133722
test byte [rbx + 0x80], 8
jne 0x180133749
mov rcx, qword [rbx + 0x58]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x180133656
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x180133656
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rbx + 0x80]
cmp dword [rax], 0xffffffff
jne 0x180133750
or ecx, 4
mov dword [rbx + 0x80], ecx
mov eax, 1
jmp 0x18013376e
and cl, 8
neg cl
sbb eax, eax
neg eax
dec eax
jmp 0x18013376e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x8c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180146240
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x180134410
Capabilities:
Check if file exists
Copy file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, rdx
mov rdi, rcx
mov rcx, rax
lea rdx, str.native
call sym.tcl86t.dll_hcl_FSGetInternalRep
lea rdx, str.native
mov rcx, rdi
mov rbx, rax
call sym.tcl86t.dll_hcl_FSGetInternalRep
mov rdx, rbx
mov rcx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180134460

Function at 0x180134460
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov esi, 0xffffffff
mov dword [rsp + 0x20], esi
test rcx, rcx
je 0x1801345b8
cmp word [rcx], 0
je 0x1801345b8
test rdx, rdx
je 0x1801345b8
cmp word [rdx], 0
je 0x1801345b8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor r15d, r15d
test eax, eax
cmovne esi, r15d
mov dword [rsp + 0x20], esi
jmp 0x1801344db
cmp esi, 0xffffffff
je 0x1801344e7
mov eax, esi
jmp 0x1801345c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 9
jne 0x180134510
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x1801345c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0xd
jne 0x1801345c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp r14d, 0xffffffff
je 0x1801345c4
cmp eax, 0xffffffff
cmove esi, r15d
mov ecx, esi
or ecx, r14d
test cl, 0x10
je 0x180134577
bt r14d, 0xa
jae 0x18013456b
mov rdx, rbx
mov rcx, rdi
call fcn.180135f50
test eax, eax
jne 0x18013456b
xor eax, eax
jmp 0x1801345c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_setsockopt
test sil, 1
je 0x1801345c4
mov edx, esi
and edx, 0xfffffffe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x180134567
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
mov edx, esi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x1801345c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1801345e0
Capabilities:
Check if file exists
Delete file

Disassembly:
sub rsp, 0x28
lea rdx, str.native
call sym.tcl86t.dll_hcl_FSGetInternalRep
mov rcx, rax
add rsp, 0x28
jmp fcn.180134600
Function at 0x180134600
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x180134745
cmp word [rcx], 0
je 0x180134745
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180134733
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0xd
jne 0x1801346dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x18013471e
test dil, 0x10
je 0x180134693
bt eax, 0xa
jae 0x180134682
xor edx, edx
mov rcx, rbx
call fcn.180135fb0
test eax, eax
je 0x180134733
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_setsockopt
jmp 0x18013471e
test dil, 1
je 0x18013471e
mov edx, edi
mov rcx, rbx
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov esi, eax
test eax, eax
je 0x1801346be
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180134733
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
test esi, esi
je 0x18013471e
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x18013471e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 2
jne 0x180134707
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18013471e
test al, 0x10
je 0x18013471e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_setsockopt
jmp 0x18013471e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x16
jne 0x18013471e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], reloc.WS2_32.dll_listen
mov rsi, qword [rsp + 0x30]
mov eax, 1
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 2
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180134760
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
lea rdx, str.native
call sym.tcl86t.dll_hcl_FSGetInternalRep
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x180134796
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
mov eax, 1
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x180134c10
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov ebp, edx
mov rbx, rcx
test rcx, rcx
je 0x180134d9d
cmp word [rcx], 0
je 0x180134d9d
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rcx, rbx
bt eax, 0xa
jae 0x180134c70
xor edx, edx
call fcn.180135fb0
test eax, eax
jne 0x180134c7a
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x180134c59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0xd
jne 0x180134d18
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp eax, 0xffffffff
je 0x180134d18
test dil, 0x10
jne 0x180134cbd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], shutdown
jmp 0x180134d3e
bt edi, 0xa
jae 0x180134cd4
mov edx, 1
mov rcx, rbx
call fcn.180135fb0
test eax, eax
jne 0x180134d3e
test dil, 1
je 0x180134d18
and edi, 0xfffffffe
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x180134d3e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x180134c59
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
or edi, 1
mov rcx, rbx
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x29
jne 0x180134d2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
test ebp, ebp
je 0x180134d3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [rax], 0x11
je 0x180134d93
test rsi, rsi
je 0x180134d93
lea rax, [rsi + 0x10]
mov dword [rsi + 8], 0
mov qword [rsi], rax
mov dword [rsi + 0xc], 0xc8
mov byte [rax], 0
mov rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], 0
jne 0x180134d62
mov r8, rsi
mov edx, eax
mov rcx, rbx
call sym.tcl86t.dll_hcl_UniCharToUtfDString
movzx ecx, byte [rax]
test cl, cl
je 0x180134d93
cmp cl, 0x5c
jne 0x180134d88
mov byte [rax], 0x2f
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
jne 0x180134d80
mov eax, 1
jmp 0x180134c5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov dword [rax], 2
lea rax, [rsi + 0x10]
mov qword [rsi], rax
mov dword [rsi + 8], 0
mov dword [rsi + 0xc], 0xc8
mov byte [rax], 0
mov eax, 1
add rsp, 0x20
pop rsi
ret
Function at 0x180135cc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xa90
mov rax, qword [0x18018f008]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov rdi, rdx
lea r9, [rsp + 0x20]
mov ebx, r8d
mov rsi, rcx
mov rcx, rdi
lea r8, [rsp + 0x870]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x180135d58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180135d2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], select
jmp 0x180135f15
lea r9, [rsp + 0x20]
mov edx, 0x104
lea r8, [rsp + 0x870]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x180135d58
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x180135d6a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call sym.tcl86t.dll_hclWinConvertError
jmp 0x180135f15
test al, 0x10
jne 0x180135da7
test bl, 2
je 0x180135d8d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
je 0x180135d58
xor eax, eax
jmp 0x180135f1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test bl, 1
je 0x180135f0f
mov dword [rax], shutdown
jmp 0x180135f15
test bl, 1
je 0x180135efc
movabs rax, 0x5c003f003f005c
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x660], rax
mov r8, rbx
nop dword [rax]
cmp word [rdi + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x180135dd0
lea r8, [r8*2 + 2]
mov rdx, rdi
lea rcx, [rsp + 0x668]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x660]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x180135e00
mov rax, qword [rsp + 0x660]
lea rdx, [rsp + 0x660]
test ax, ax
je 0x180135e40
mov r9d, 0x5c
cmp ax, 0x2f
jne 0x180135e30
mov word [rdx], r9w
movzx ecx, word [rdx + 2]
add rdx, 2
movzx eax, cx
test cx, cx
jne 0x180135e26
movsxd rcx, r8d
xor edi, edi
lea rax, [rcx*2 - 2]
cmp word [rsp + rax + 0x660], 0x5c
jne 0x180135e77
cmp word [rsp + rcx*2 + 0x65c], 0x3a
je 0x180135e77
cmp rax, 0x208
jae 0x180135f41
mov word [rsp + rax + 0x660], di
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x630
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x660]
mov dword [rsp + 0x30], 0xa0000003
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], di
jne 0x180135ea0
add bx, bx
mov word [rsp + 0x36], di
movzx r8d, bx
lea rdx, [rsp + 0x660]
mov word [rsp + 0x3a], r8w
lea rcx, [rsp + 0x40]
mov word [rsp + 0x3e], di
lea eax, [r8 + 2]
add r8, 2
mov word [rsp + 0x3c], ax
call sub.VCRUNTIME140.dll_memcpy
movzx eax, word [rsp + 0x3a]
lea rdx, [rsp + 0x30]
add ax, 0xc
mov rcx, rsi
mov word [rsp + 0x34], ax
call fcn.1801363b0
jmp 0x180135f1c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
test bl, 2
je 0x180135f0f
mov dword [rax], reloc.WS2_32.dll_setsockopt
jmp 0x180135f15
mov dword [rax], reloc.WS2_32.dll_send
mov rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.180146240
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18014636c
int3